Extracting prog: 29m27.18995306s
Minimizing prog: 2h16m34.442828907s
Simplifying prog options: 0s
Extracting C: 5m22.856103617s
Simplifying C: 26m51.546763725s


30 programs, timeouts [6m0s]
extracting reproducer from 30 programs
single: executing 5 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-setsockopt$inet_tcp_int-bind$inet-setsockopt$SO_ATTACH_FILTER-sendto$inet-setsockopt$inet_tcp_TCP_CONGESTION-sendmmsg$inet-setsockopt$sock_int-sendto$inet
detailed listing:
executing program 0:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x7a, 0x4)
bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe4}]}, 0x10)
sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10)
setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr\x00', 0x4)
sendmmsg$inet(r0, &(0x7f0000000cc0)=[{{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000400)="316f825a3d29f96a2093a917017b4cd300000000bee70035ed313e19d6dd1fb41a20baf7f7343067fd40cdd4b16742e94b62f4eb1c5d9faab7f3028100ae8180db94b9de7456ae62b0e6fe7766a0842912179154a96fa88e161d4adf77a486e10d1d50e44155790748b7226fa4bb5d77e85729336ba6369a4c33ac53b45d46a92db9fda99af4429dc23db6a1706328df4e75eb173a81bd4af8b89d1870c9b2382a759d67b1cd03b076bf90286b63eb7aaea4cbb1280955e9a59cd8e5e8ac68c27da3d542aece1ba7920e8f39b270458224e74afa52db1ac07f7cce47d5e8ce5b2806ff7171c64a689a0ba35e934506a46a10b9a579dc43630831e2c5400853b58e020c9cb65e44d4957b00ed35a858d44b25d5b8dad1be42", 0x118}, {&(0x7f0000000f00)="f5e022a4d2ed0cf5f8b2e9857cb9af98da7aa60f7a1582aadeaef336f9139f6768452f868624c7e6ce0948f33f1a63e0fcf0f2df28a3f1f4de26a8b575ccb465985e48f65b9a7fcc93c0a5be8b16774f7c7ca9848a182d6ee7c0f2b9c0e7030ed93ee34214c25cb51279b18c8e5bfbc52152be37f5e2b783e2149be25180430ac63ee1bbe01fbb6125e65839ae5b02d542a97d1bfb1ca420b5405baaaf5ec6ad96af2814dbbea5a064f2ab6fc0904c07f02cbfadfb96866d962e6e21d3a0a0276a36e01b6edafd6c8461de7afec966f9c023ffe15c3c1caec8ff3ef304ed0ffedd061941d9d022b25a4b9632856295fee3a314f6c196d953bcaf1aff06d181d51662fdaa52e46d7905c0b4", 0x10b}], 0x2}}, {{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f0000001080)="63c3b174ab06077f6ee67ac1310d86586b13d2c9e203a9da866b81e20e9fe5c43219396d489c1459ce9cd14fa3b43a0b9b6004118a35444790d7", 0x3a}, {&(0x7f00000003c0)="03d54d843173f8be883a57d9e39cc6c79c415ac50f3e1e9c9373002a5b1918", 0x1f}], 0x2}}, {{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000040)="610cb4f6db2105b873df3f7652cc642b85afb69fc18178429903bb6e1ecd", 0x1e}, {&(0x7f0000000180)="6fe279d51047ff146af40b78b8d7ae53db8648c2090d72bcfeaf6fabbbfbe8dbc8b8f4cb22ac43d5a0fa87533bb375454751b8dd8aae4808a37a7649", 0x3c}, {&(0x7f00000001c0)="6d5edb4b883e266ba8c38aa9d13a78431c9d2cb6d8f4e1e80bb8a936aa105f46c914c46487522bc58054c4b0a523eeda0c76b595b36a515b6d30e34705733bb34bda2f89e92b2a98d2edbcffad9c5ccde0d723423cf07e4ffdbd568d3e263fb3b4086af3f2db1933785e59538bfd61f138ffac9eef7c8b34e4ce506220f43af449d3a72f48d9febe830b04cb3c99425de34cac503014ce74", 0x98}], 0x3}}, {{0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000700)="acc841985992b79554acfc02163bb0fb2bb293e68702bb40b6b870bde5700d368744361ae9fce3a4ff6bb3bf10f3485e399c8b", 0x33}, {&(0x7f0000000740)="b1f56ee29c433328d3b2a83bd97e37007087acae7568edff43ed556d76770122635aea1dc487553859348d48e6fc49d81c71590cd542e796cc2669e2c691b3da35ad6a8d2ef9c2baa53a8dec36a2e434d46e643a1277b1dd932f3ef2cf46c257d6a19523b8b789ef34b46e461725b5e437323385b88c368f8bb5b95e269169f5f7b51dd5319b8016623d1863d7d77ceefde94faf2e36c3920581691a79a6678db1e5e7fa1ca703ee7aa87272e9c4a1bde5fbc390c7ccb9d3c1020e80bd06", 0xbe}], 0x2}}], 0x4, 0x0)
setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4)
sendto$inet(r0, &(0x7f00000012c0)="09268a927f1f6588b967481241ba7860fcfaf65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95425a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0x20c8, 0x11, 0x0, 0x27)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$P9_RLERRORu-mount$9p_fd
detailed listing:
executing program 0:
mkdir(&(0x7f0000000180)='./file0\x00', 0x0)
pipe2$9p(&(0x7f0000000240)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write$P9_RVERSION(r1, &(0x7f00000036c0)=ANY=[@ANYBLOB="1500000065ffff018000000800395032303030"], 0x15)
r2 = dup(r1)
write$P9_RLERRORu(r2, &(0x7f0000000800)=ANY=[@ANYBLOB='Q\x00\x00\x00\a\x00\x00'], 0x53)
mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[], [], 0x6b}})

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$KVM_CREATE_VM-syz_genetlink_get_family_id$nl80211-openat$dir-sendmsg$NL80211_CMD_GET_POWER_SAVE-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-prctl$PR_SCHED_CORE-setsockopt$IPT_SO_SET_REPLACE-sched_setaffinity-syz_open_dev$MSR-sched_setscheduler-read$msr-madvise-mremap-bind$inet6-mremap-madvise-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$PROG_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-creat-mount
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
sendmsg$NL80211_CMD_GET_POWER_SAVE(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, 0x0}, 0x20014000)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x14)
sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
sched_setscheduler(0x0, 0x0, 0x0)
read$msr(r0, &(0x7f0000000a40)=""/102368, 0x18fe0)
madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe)
mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil)
bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x0, 0x0, @local}, 0x1c)
mremap(&(0x7f0000241000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil)
madvise(&(0x7f000042f000/0x800000)=nil, 0x800000, 0x15)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000900)={0x18, 0x30, &(0x7f0000000140)=ANY=[@ANYRES32, @ANYBLOB="0000000000000000b70500000800000052000000a5000000b708000000001b2e7b8af8ff00000015aa12557a68fab7a4b68597b50d0b9a00b7080000e0ffffff7b8af0ff00000000bfa100000000000007010000f8ffffffbfa400008000000007040000f0ffffff"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x50, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000840)={0x0, 0x6, 0x8, 0xfffffffe}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffff5}, 0x90)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB], 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0}, 0x10)
creat(&(0x7f0000000100)='./bus\x00', 0x100)
mount(&(0x7f0000000340)=@filename='\x00', &(0x7f0000000080)='./bus\x00', &(0x7f00000000c0)='ecryptfs\x00', 0x0, &(0x7f0000000040)='&@,,')

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write$binfmt_aout-syz_open_pts-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-prctl$PR_SCHED_CORE-getpid-process_vm_readv-syz_emit_ethernet-bpf$BPF_PROG_TEST_RUN-syz_open_procfs-fchdir-io_uring_setup-socket$pppl2tp-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-recvmsg$kcm-socket$inet6_udp-connect$pppl2tp-setxattr$system_posix_acl-close_range-mount-inotify_init1-syz_open_procfs-ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS
detailed listing:
executing program 0:
write$binfmt_aout(0xffffffffffffffff, 0x0, 0xff2e)
r0 = syz_open_pts(0xffffffffffffffff, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYRESDEC=r0], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x38, '\x00', 0x0, 0x2}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = getpid()
process_vm_readv(r1, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x7ffff000}, {&(0x7f0000006180)=""/152, 0x98}], 0x2, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x7ffff000}], 0x286, 0x0)
syz_emit_ethernet(0x2a, &(0x7f0000000440)=ANY=[], 0x0)
bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00')
fchdir(r2)
r3 = io_uring_setup(0x2a0c, &(0x7f00000002c0))
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
r5 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r5, &(0x7f0000000000)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_sha256\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, 0x0, 0x0)
recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0)
socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r4, 0x0, 0x0)
setxattr$system_posix_acl(0x0, &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000340)=ANY=[@ANYBLOB="020000002000000000009b00000400000000000000100ce377f808bc0dc11e430000000000000020000000000000006a6c5c2794ee070300000000000000f1178b8d6b74e17011e30f9ba2097e571ad0a4922990bcfce16499e33a3f83196c8af21500f736f270e74c8d5f942cb1de6a90947457f4df36f2d9acc7c0376ae467d478a99ee76b822a9dc3beefd900136ecaebc0337810f3fce46754659dbc1d032863af13e6c1d2f496d45bb7152cb1c8946029f5eedf374434288ef7e85988b207522dfc"], 0x24, 0x0)
close_range(r3, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0)
inotify_init1(0x0)
r6 = syz_open_procfs(0x0, &(0x7f0000000040)='fd/4\x00')
ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r6, 0x4004662b, &(0x7f0000000180)={@id={0x2, 0x300, @b}})

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-openat$ptmx-ioctl$TCFLSH-io_uring_setup-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb-close_range-signalfd4-signalfd4-openat-pselect6-execveat
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$TCFLSH(r0, 0x400455c8, 0x0)
r1 = io_uring_setup(0x378e, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x7})
r2 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r2)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r2, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
close_range(r1, 0xffffffffffffffff, 0x0)
signalfd4(0xffffffffffffffff, &(0x7f0000000180), 0x8, 0x0)
signalfd4(0xffffffffffffffff, &(0x7f0000000140), 0x8, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x180, 0x0)
pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1100)

program crashed: lost connection to test machine
single: successfully extracted reproducer
found reproducer with 15 syscalls
minimizing guilty program
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-openat$ptmx-ioctl$TCFLSH-io_uring_setup-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb-close_range-signalfd4-signalfd4-openat-pselect6
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$TCFLSH(r0, 0x400455c8, 0x0)
r1 = io_uring_setup(0x378e, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x7})
r2 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r2)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r2, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
close_range(r1, 0xffffffffffffffff, 0x0)
signalfd4(0xffffffffffffffff, &(0x7f0000000180), 0x8, 0x0)
signalfd4(0xffffffffffffffff, &(0x7f0000000140), 0x8, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x180, 0x0)
pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-openat$ptmx-ioctl$TCFLSH-io_uring_setup-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb-close_range-signalfd4-signalfd4-openat-execveat
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$TCFLSH(r0, 0x400455c8, 0x0)
r1 = io_uring_setup(0x378e, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x7})
r2 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r2)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r2, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
close_range(r1, 0xffffffffffffffff, 0x0)
signalfd4(0xffffffffffffffff, &(0x7f0000000180), 0x8, 0x0)
signalfd4(0xffffffffffffffff, &(0x7f0000000140), 0x8, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x180, 0x0)
execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1100)

program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-openat$ptmx-ioctl$TCFLSH-io_uring_setup-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb-close_range-signalfd4-signalfd4-execveat
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$TCFLSH(r0, 0x400455c8, 0x0)
r1 = io_uring_setup(0x378e, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x7})
r2 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r2)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r2, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
close_range(r1, 0xffffffffffffffff, 0x0)
signalfd4(0xffffffffffffffff, &(0x7f0000000180), 0x8, 0x0)
signalfd4(0xffffffffffffffff, &(0x7f0000000140), 0x8, 0x0)
execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1100)

program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-openat$ptmx-ioctl$TCFLSH-io_uring_setup-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb-close_range-signalfd4-execveat
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$TCFLSH(r0, 0x400455c8, 0x0)
r1 = io_uring_setup(0x378e, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x7})
r2 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r2)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r2, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
close_range(r1, 0xffffffffffffffff, 0x0)
signalfd4(0xffffffffffffffff, &(0x7f0000000180), 0x8, 0x0)
execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1100)

program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-openat$ptmx-ioctl$TCFLSH-io_uring_setup-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb-close_range-execveat
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$TCFLSH(r0, 0x400455c8, 0x0)
r1 = io_uring_setup(0x378e, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x7})
r2 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r2)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r2, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
close_range(r1, 0xffffffffffffffff, 0x0)
execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1100)

program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-openat$ptmx-ioctl$TCFLSH-io_uring_setup-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb-execveat
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$TCFLSH(r0, 0x400455c8, 0x0)
io_uring_setup(0x378e, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x7})
r1 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r1)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r1, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1100)

program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-openat$ptmx-ioctl$TCFLSH-io_uring_setup-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-execveat
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$TCFLSH(r0, 0x400455c8, 0x0)
io_uring_setup(0x378e, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x7})
r1 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r1)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r1, 0x4004550f, 0x0)
execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1100)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-openat$ptmx-ioctl$TCFLSH-io_uring_setup-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-syz_open_dev$char_usb-execveat
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$TCFLSH(r0, 0x400455c8, 0x0)
io_uring_setup(0x378e, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x7})
r1 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r1)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1100)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-openat$ptmx-ioctl$TCFLSH-io_uring_setup-syz_open_dev$evdev-syz_usb_disconnect-ioctl$EVIOCRMFF-syz_open_dev$char_usb-execveat
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$TCFLSH(r0, 0x400455c8, 0x0)
io_uring_setup(0x378e, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x7})
r1 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r1)
ioctl$EVIOCRMFF(r1, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1100)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-openat$ptmx-ioctl$TCFLSH-io_uring_setup-syz_open_dev$evdev-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb-execveat
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$TCFLSH(r0, 0x400455c8, 0x0)
io_uring_setup(0x378e, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x7})
r1 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r1, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1100)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-openat$ptmx-ioctl$TCFLSH-io_uring_setup-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb-execveat
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$TCFLSH(r0, 0x400455c8, 0x0)
io_uring_setup(0x378e, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x7})
syz_usb_disconnect(0xffffffffffffffff)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(0xffffffffffffffff, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1100)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-openat$ptmx-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb-execveat
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$TCFLSH(r0, 0x400455c8, 0x0)
r1 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r1)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r1, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1100)

program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-openat$ptmx-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb-execveat
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r0 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r0)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r0, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1100)

program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb-execveat
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r0 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r0)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r0, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1100)

program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb-execveat
detailed listing:
executing program 0:
r0 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r0)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r0, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1100)

program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb-execveat
detailed listing:
executing program 0:
r0 = syz_open_dev$evdev(0x0, 0x0, 0x0)
syz_usb_disconnect(r0)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r0, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1100)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb-execveat
detailed listing:
executing program 0:
r0 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r0)
syz_usb_connect$cdc_ncm(0x0, 0x72, 0x0, 0x0)
ioctl$EVIOCRMFF(r0, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1100)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb-execveat
detailed listing:
executing program 0:
r0 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r0)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB], 0x0)
ioctl$EVIOCRMFF(r0, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1100)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb-execveat
detailed listing:
executing program 0:
r0 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r0)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB, @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r0, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1100)

program did not crash
extracting C reproducer
testing compiled C program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb-execveat
program crashed: no output from test machine
simplifying C reproducer
testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb-execveat
program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb-execveat
program crashed: no output from test machine
testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb-execveat
program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb-execveat
program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb-execveat
program crashed: no output from test machine
testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb-execveat
program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb-execveat
program crashed: WARNING in wdm_rxwork/usb_submit_urb
reproducing took 3h18m16.035675685s
repro crashed as (corrupted=false):
------------[ cut here ]------------
URB ffff888024029b00 submitted while active
WARNING: CPU: 0 PID: 941 at drivers/usb/core/urb.c:379 usb_submit_urb+0x14da/0x1730 drivers/usb/core/urb.c:379
Modules linked in:
CPU: 0 UID: 0 PID: 941 Comm: kworker/0:2 Not tainted 6.11.0-rc2-syzkaller-00027-g6a0e38264012 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Workqueue: events wdm_rxwork
RIP: 0010:usb_submit_urb+0x14da/0x1730 drivers/usb/core/urb.c:379
Code: fd eb cb bb fe ff ff ff e9 c1 f3 ff ff e8 fe 90 c2 fa c6 05 41 be 33 09 01 90 48 c7 c7 e0 ee 0b 8c 48 89 de e8 67 d5 84 fa 90 <0f> 0b 90 90 e9 b6 fe ff ff bb f8 ff ff ff e9 91 f3 ff ff 48 89 ef
RSP: 0000:ffffc90003e3fc18 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff888024029b00 RCX: ffffffff814cc379
RDX: ffff8880214d3c00 RSI: ffffffff814cc386 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000293
R13: ffff88807a6fb890 R14: ffff88807a6fb850 R15: ffff888015894000
FS:  0000000000000000(0000) GS:ffff8880b9200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007faacbb76068 CR3: 000000000db7c000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 wdm_rxwork+0xf3/0x200 drivers/usb/class/cdc-wdm.c:989
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xf20 kernel/workqueue.c:3390
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>

final repro crashed as (corrupted=false):
------------[ cut here ]------------
URB ffff888024029b00 submitted while active
WARNING: CPU: 0 PID: 941 at drivers/usb/core/urb.c:379 usb_submit_urb+0x14da/0x1730 drivers/usb/core/urb.c:379
Modules linked in:
CPU: 0 UID: 0 PID: 941 Comm: kworker/0:2 Not tainted 6.11.0-rc2-syzkaller-00027-g6a0e38264012 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Workqueue: events wdm_rxwork
RIP: 0010:usb_submit_urb+0x14da/0x1730 drivers/usb/core/urb.c:379
Code: fd eb cb bb fe ff ff ff e9 c1 f3 ff ff e8 fe 90 c2 fa c6 05 41 be 33 09 01 90 48 c7 c7 e0 ee 0b 8c 48 89 de e8 67 d5 84 fa 90 <0f> 0b 90 90 e9 b6 fe ff ff bb f8 ff ff ff e9 91 f3 ff ff 48 89 ef
RSP: 0000:ffffc90003e3fc18 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff888024029b00 RCX: ffffffff814cc379
RDX: ffff8880214d3c00 RSI: ffffffff814cc386 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000293
R13: ffff88807a6fb890 R14: ffff88807a6fb850 R15: ffff888015894000
FS:  0000000000000000(0000) GS:ffff8880b9200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007faacbb76068 CR3: 000000000db7c000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 wdm_rxwork+0xf3/0x200 drivers/usb/class/cdc-wdm.c:989
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xf20 kernel/workqueue.c:3390
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>