Extracting prog: 1m10.004336802s
Minimizing prog: 6m20.688356346s
Simplifying prog options: 0s
Extracting C: 23.715371917s
Simplifying C: 3m6.400125535s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0)
syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x81, 0x0, 0x0)
syz_usb_ep_read(r0, 0x2, 0x0, 0x0)
syz_usb_ep_write(r0, 0x81, 0x1e, &(0x7f0000000080)="830600004a5e00000059bb04e01cd9141100000000ff0000000000000000")

program crashed: BUG: unable to handle kernel paging request in pn533_acr122_is_rx_frame_valid
single: successfully extracted reproducer
found reproducer with 5 syscalls
minimizing guilty program
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0)
syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x81, 0x0, 0x0)
syz_usb_ep_read(r0, 0x2, 0x0, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0)
syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x81, 0x0, 0x0)
syz_usb_ep_write(r0, 0x81, 0x1e, &(0x7f0000000080)="830600004a5e00000059bb04e01cd9141100000000ff0000000000000000")

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0)
syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100))
syz_usb_ep_read(r0, 0x2, 0x0, 0x0)
syz_usb_ep_write(r0, 0x81, 0x1e, &(0x7f0000000080)="830600004a5e00000059bb04e01cd9141100000000ff0000000000000000")

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0)
syz_usb_ep_write(r0, 0x81, 0x0, 0x0)
syz_usb_ep_read(r0, 0x2, 0x0, 0x0)
syz_usb_ep_write(r0, 0x81, 0x1e, &(0x7f0000000080)="830600004a5e00000059bb04e01cd9141100000000ff0000000000000000")

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write
detailed listing:
executing program 0:
syz_usb_ep_read(0xffffffffffffffff, 0x2, 0x40, &(0x7f0000000100))
syz_usb_ep_write(0xffffffffffffffff, 0x81, 0x0, 0x0)
syz_usb_ep_read(0xffffffffffffffff, 0x2, 0x0, 0x0)
syz_usb_ep_write(0xffffffffffffffff, 0x81, 0x1e, &(0x7f0000000080)="830600004a5e00000059bb04e01cd9141100000000ff0000000000000000")

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x32, 0x0, 0x0)
syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x81, 0x0, 0x0)
syz_usb_ep_read(r0, 0x2, 0x0, 0x0)
syz_usb_ep_write(r0, 0x81, 0x1e, &(0x7f0000000080)="830600004a5e00000059bb04e01cd9141100000000ff0000000000000000")

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0)
syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x81, 0x0, 0x0)
syz_usb_ep_read(r0, 0x2, 0x0, 0x0)
syz_usb_ep_write(r0, 0x81, 0x1e, &(0x7f0000000080)="830600004a5e00000059bb04e01cd9141100000000ff0000000000000000")

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0)
syz_usb_ep_read(r0, 0x2, 0x0, 0x0)
syz_usb_ep_write(r0, 0x81, 0x0, 0x0)
syz_usb_ep_read(r0, 0x2, 0x0, 0x0)
syz_usb_ep_write(r0, 0x81, 0x1e, &(0x7f0000000080)="830600004a5e00000059bb04e01cd9141100000000ff0000000000000000")

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0)
syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x81, 0x0, 0x0)
syz_usb_ep_read(r0, 0x2, 0x0, 0x0)
syz_usb_ep_write(r0, 0x81, 0x0, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0)
syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x81, 0x0, 0x0)
syz_usb_ep_read(r0, 0x2, 0x0, 0x0)
syz_usb_ep_write(r0, 0x81, 0x0, &(0x7f0000000080))

program did not crash
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write
program crashed: BUG: unable to handle kernel paging request in pn533_acr122_is_rx_frame_valid
simplifying C reproducer
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write
program crashed: BUG: unable to handle kernel paging request in pn533_acr122_is_rx_frame_valid
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write
program crashed: BUG: unable to handle kernel paging request in pn533_acr122_is_rx_frame_valid
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write
program crashed: BUG: unable to handle kernel paging request in pn533_acr122_is_rx_frame_valid
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write
program crashed: BUG: unable to handle kernel paging request in pn533_acr122_is_rx_frame_valid
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write
program crashed: BUG: unable to handle kernel paging request in pn533_acr122_is_rx_frame_valid
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write
program crashed: BUG: unable to handle kernel paging request in pn533_acr122_is_rx_frame_valid
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write
program crashed: BUG: unable to handle kernel paging request in pn533_acr122_is_rx_frame_valid
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0)
syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x81, 0x0, 0x0)
syz_usb_ep_read(r0, 0x2, 0x0, 0x0)
syz_usb_ep_write(r0, 0x81, 0x1e, &(0x7f0000000080)="830600004a5e00000059bb04e01cd9141100000000ff0000000000000000")

program crashed: BUG: unable to handle kernel paging request in pn533_acr122_is_rx_frame_valid
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0)
syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x81, 0x0, 0x0)
syz_usb_ep_read(r0, 0x2, 0x0, 0x0)
syz_usb_ep_write(r0, 0x81, 0x1e, &(0x7f0000000080)="830600004a5e00000059bb04e01cd9141100000000ff0000000000000000")

program crashed: BUG: unable to handle kernel paging request in pn533_acr122_is_rx_frame_valid
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0)
syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x81, 0x0, 0x0)
syz_usb_ep_read(r0, 0x2, 0x0, 0x0)
syz_usb_ep_write(r0, 0x81, 0x1e, &(0x7f0000000080)="830600004a5e00000059bb04e01cd9141100000000ff0000000000000000")

program did not crash
validation run: crashed=false
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0)
syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x81, 0x0, 0x0)
syz_usb_ep_read(r0, 0x2, 0x0, 0x0)
syz_usb_ep_write(r0, 0x81, 0x1e, &(0x7f0000000080)="830600004a5e00000059bb04e01cd9141100000000ff0000000000000000")

program crashed: BUG: unable to handle kernel paging request in pn533_acr122_is_rx_frame_valid
validation run: crashed=true
reproducing took 13m23.754040431s
repro crashed as (corrupted=false):
BUG: unable to handle page fault for address: ffffed1013e838d1
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 7ffd5067 P4D 7ffd5067 PUD 3fffa067 PMD 0 
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
CPU: 1 UID: 0 PID: 30 Comm: kworker/1:0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: usb_hub_wq hub_event
RIP: 0010:pn533_acr122_is_rx_frame_valid drivers/nfc/pn533/usb.c:325 [inline]
RIP: 0010:pn533_acr122_is_rx_frame_valid+0xd9/0x150 drivers/nfc/pn533/usb.c:315
Code: ff 89 ee e8 99 de 87 fb 85 ed 74 55 e8 20 e4 87 fb 83 ed 02 48 b8 00 00 00 00 00 fc ff df 48 8d 7c 2b 0a 48 89 fa 48 c1 ea 03 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 04 84 c0 75 42 0f b6 5c 2b
RSP: 0018:ffffc900005a0b78 EFLAGS: 00010807
RAX: dffffc0000000000 RBX: ffff88805541c680 RCX: 0000000000000101
RDX: 1ffff11013e838d1 RSI: ffffffff86837db0 RDI: ffff88809f41c68e
RBP: 000000004a000004 R08: 0000000000000005 R09: 0000000000000000
R10: 000000004a000006 R11: 0000000000000001 R12: ffff88805541c680
R13: ffff88804d88bb18 R14: ffff888060d7e3c0 R15: ffff888060d7e518
FS:  0000000000000000(0000) GS:ffff888096a60000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffed1013e838d1 CR3: 000000005545e000 CR4: 0000000000352ef0
Call Trace:
 <IRQ>
 pn533_recv_frame+0x1b7/0x6d0 drivers/nfc/pn533/pn533.c:2203
 __usb_hcd_giveback_urb+0x38e/0x610 drivers/usb/core/hcd.c:1657
 usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
 dummy_timer+0xdb2/0x3700 drivers/usb/gadget/udc/dummy_hcd.c:2019
 __run_hrtimer kernel/time/hrtimer.c:2067 [inline]
 __hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2124
 hrtimer_run_softirq+0x1ca/0x360 kernel/time/hrtimer.c:2141
 handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0x16a/0x210 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:220 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:229
Code: 90 f3 0f 1e fa 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 fa 5b 15 f6 48 89 df e8 82 b2 15 f6 e8 3d 59 42 f6 fb bf 01 00 00 00 <e8> 12 a8 04 f6 65 48 83 3d 81 a5 ba 08 00 74 06 5b c3 cc cc cc cc
RSP: 0018:ffffc90000586c90 EFLAGS: 00000206
RAX: 0000000000030e2b RBX: ffffc90000586e20 RCX: 0000000000000040
RDX: 0000000000000001 RSI: ffffffff8e3f18bd RDI: 0000000000000001
RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 000000000000760b R12: ffffc90000586e18
R13: 0000000000000002 R14: ffffc90000586e20 R15: ffff88801cfa0000
 do_wait_for_common kernel/sched/completion.c:99 [inline]
 __wait_for_common+0x2da/0x4c0 kernel/sched/completion.c:121
 pn533_send_cmd_sync drivers/nfc/pn533/pn533.c:640 [inline]
 pn533_get_firmware_version drivers/nfc/pn533/pn533.c:2535 [inline]
 pn533_finalize_setup+0x120/0x190 drivers/nfc/pn533/pn533.c:2732
 pn533_usb_probe+0x81b/0xd50 drivers/nfc/pn533/usb.c:570
 usb_probe_interface+0x386/0x9b0 drivers/usb/core/driver.c:399
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x210/0x460 drivers/base/dd.c:868
 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026
 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098
 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x64/0x160 drivers/base/bus.c:620
 device_add+0x121d/0x1970 drivers/base/core.c:3776
 usb_set_configuration+0xd97/0x1c60 drivers/usb/core/message.c:2268
 usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250
 usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:293
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x210/0x460 drivers/base/dd.c:868
 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026
 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098
 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x64/0x160 drivers/base/bus.c:620
 device_add+0x121d/0x1970 drivers/base/core.c:3776
 usb_new_device.part.0+0xcc2/0x1686 drivers/usb/core/hub.c:2708
 usb_new_device include/linux/workqueue.h:715 [inline]
 hub_port_connect drivers/usb/core/hub.c:5580 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5720 [inline]
 port_event drivers/usb/core/hub.c:5884 [inline]
 hub_event.cold+0x1e3/0xe90 drivers/usb/core/hub.c:5966
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396
 process_scheduled_works kernel/workqueue.c:3479 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
CR2: ffffed1013e838d1
---[ end trace 0000000000000000 ]---
RIP: 0010:pn533_acr122_is_rx_frame_valid drivers/nfc/pn533/usb.c:325 [inline]
RIP: 0010:pn533_acr122_is_rx_frame_valid+0xd9/0x150 drivers/nfc/pn533/usb.c:315
Code: ff 89 ee e8 99 de 87 fb 85 ed 74 55 e8 20 e4 87 fb 83 ed 02 48 b8 00 00 00 00 00 fc ff df 48 8d 7c 2b 0a 48 89 fa 48 c1 ea 03 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 04 84 c0 75 42 0f b6 5c 2b
RSP: 0018:ffffc900005a0b78 EFLAGS: 00010807
RAX: dffffc0000000000 RBX: ffff88805541c680 RCX: 0000000000000101
RDX: 1ffff11013e838d1 RSI: ffffffff86837db0 RDI: ffff88809f41c68e
RBP: 000000004a000004 R08: 0000000000000005 R09: 0000000000000000
R10: 000000004a000006 R11: 0000000000000001 R12: ffff88805541c680
R13: ffff88804d88bb18 R14: ffff888060d7e3c0 R15: ffff888060d7e518
FS:  0000000000000000(0000) GS:ffff888096a60000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffed1013e838d1 CR3: 000000005545e000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
   0:	ff 89 ee e8 99 de    	decl   -0x21661712(%rcx)
   6:	87 fb                	xchg   %edi,%ebx
   8:	85 ed                	test   %ebp,%ebp
   a:	74 55                	je     0x61
   c:	e8 20 e4 87 fb       	call   0xfb87e431
  11:	83 ed 02             	sub    $0x2,%ebp
  14:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  1b:	fc ff df
  1e:	48 8d 7c 2b 0a       	lea    0xa(%rbx,%rbp,1),%rdi
  23:	48 89 fa             	mov    %rdi,%rdx
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	0f b6 04 02          	movzbl (%rdx,%rax,1),%eax <-- trapping instruction
  2e:	48 89 fa             	mov    %rdi,%rdx
  31:	83 e2 07             	and    $0x7,%edx
  34:	38 d0                	cmp    %dl,%al
  36:	7f 04                	jg     0x3c
  38:	84 c0                	test   %al,%al
  3a:	75 42                	jne    0x7e
  3c:	0f                   	.byte 0xf
  3d:	b6 5c                	mov    $0x5c,%dh
  3f:	2b                   	.byte 0x2b

final repro crashed as (corrupted=false):
BUG: unable to handle page fault for address: ffffed1013e838d1
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 7ffd5067 P4D 7ffd5067 PUD 3fffa067 PMD 0 
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
CPU: 1 UID: 0 PID: 30 Comm: kworker/1:0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: usb_hub_wq hub_event
RIP: 0010:pn533_acr122_is_rx_frame_valid drivers/nfc/pn533/usb.c:325 [inline]
RIP: 0010:pn533_acr122_is_rx_frame_valid+0xd9/0x150 drivers/nfc/pn533/usb.c:315
Code: ff 89 ee e8 99 de 87 fb 85 ed 74 55 e8 20 e4 87 fb 83 ed 02 48 b8 00 00 00 00 00 fc ff df 48 8d 7c 2b 0a 48 89 fa 48 c1 ea 03 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 04 84 c0 75 42 0f b6 5c 2b
RSP: 0018:ffffc900005a0b78 EFLAGS: 00010807
RAX: dffffc0000000000 RBX: ffff88805541c680 RCX: 0000000000000101
RDX: 1ffff11013e838d1 RSI: ffffffff86837db0 RDI: ffff88809f41c68e
RBP: 000000004a000004 R08: 0000000000000005 R09: 0000000000000000
R10: 000000004a000006 R11: 0000000000000001 R12: ffff88805541c680
R13: ffff88804d88bb18 R14: ffff888060d7e3c0 R15: ffff888060d7e518
FS:  0000000000000000(0000) GS:ffff888096a60000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffed1013e838d1 CR3: 000000005545e000 CR4: 0000000000352ef0
Call Trace:
 <IRQ>
 pn533_recv_frame+0x1b7/0x6d0 drivers/nfc/pn533/pn533.c:2203
 __usb_hcd_giveback_urb+0x38e/0x610 drivers/usb/core/hcd.c:1657
 usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
 dummy_timer+0xdb2/0x3700 drivers/usb/gadget/udc/dummy_hcd.c:2019
 __run_hrtimer kernel/time/hrtimer.c:2067 [inline]
 __hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2124
 hrtimer_run_softirq+0x1ca/0x360 kernel/time/hrtimer.c:2141
 handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0x16a/0x210 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:220 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:229
Code: 90 f3 0f 1e fa 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 fa 5b 15 f6 48 89 df e8 82 b2 15 f6 e8 3d 59 42 f6 fb bf 01 00 00 00 <e8> 12 a8 04 f6 65 48 83 3d 81 a5 ba 08 00 74 06 5b c3 cc cc cc cc
RSP: 0018:ffffc90000586c90 EFLAGS: 00000206
RAX: 0000000000030e2b RBX: ffffc90000586e20 RCX: 0000000000000040
RDX: 0000000000000001 RSI: ffffffff8e3f18bd RDI: 0000000000000001
RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 000000000000760b R12: ffffc90000586e18
R13: 0000000000000002 R14: ffffc90000586e20 R15: ffff88801cfa0000
 do_wait_for_common kernel/sched/completion.c:99 [inline]
 __wait_for_common+0x2da/0x4c0 kernel/sched/completion.c:121
 pn533_send_cmd_sync drivers/nfc/pn533/pn533.c:640 [inline]
 pn533_get_firmware_version drivers/nfc/pn533/pn533.c:2535 [inline]
 pn533_finalize_setup+0x120/0x190 drivers/nfc/pn533/pn533.c:2732
 pn533_usb_probe+0x81b/0xd50 drivers/nfc/pn533/usb.c:570
 usb_probe_interface+0x386/0x9b0 drivers/usb/core/driver.c:399
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x210/0x460 drivers/base/dd.c:868
 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026
 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098
 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x64/0x160 drivers/base/bus.c:620
 device_add+0x121d/0x1970 drivers/base/core.c:3776
 usb_set_configuration+0xd97/0x1c60 drivers/usb/core/message.c:2268
 usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250
 usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:293
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x210/0x460 drivers/base/dd.c:868
 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026
 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098
 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x64/0x160 drivers/base/bus.c:620
 device_add+0x121d/0x1970 drivers/base/core.c:3776
 usb_new_device.part.0+0xcc2/0x1686 drivers/usb/core/hub.c:2708
 usb_new_device include/linux/workqueue.h:715 [inline]
 hub_port_connect drivers/usb/core/hub.c:5580 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5720 [inline]
 port_event drivers/usb/core/hub.c:5884 [inline]
 hub_event.cold+0x1e3/0xe90 drivers/usb/core/hub.c:5966
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396
 process_scheduled_works kernel/workqueue.c:3479 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
CR2: ffffed1013e838d1
---[ end trace 0000000000000000 ]---
RIP: 0010:pn533_acr122_is_rx_frame_valid drivers/nfc/pn533/usb.c:325 [inline]
RIP: 0010:pn533_acr122_is_rx_frame_valid+0xd9/0x150 drivers/nfc/pn533/usb.c:315
Code: ff 89 ee e8 99 de 87 fb 85 ed 74 55 e8 20 e4 87 fb 83 ed 02 48 b8 00 00 00 00 00 fc ff df 48 8d 7c 2b 0a 48 89 fa 48 c1 ea 03 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 04 84 c0 75 42 0f b6 5c 2b
RSP: 0018:ffffc900005a0b78 EFLAGS: 00010807
RAX: dffffc0000000000 RBX: ffff88805541c680 RCX: 0000000000000101
RDX: 1ffff11013e838d1 RSI: ffffffff86837db0 RDI: ffff88809f41c68e
RBP: 000000004a000004 R08: 0000000000000005 R09: 0000000000000000
R10: 000000004a000006 R11: 0000000000000001 R12: ffff88805541c680
R13: ffff88804d88bb18 R14: ffff888060d7e3c0 R15: ffff888060d7e518
FS:  0000000000000000(0000) GS:ffff888096a60000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffed1013e838d1 CR3: 000000005545e000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
   0:	ff 89 ee e8 99 de    	decl   -0x21661712(%rcx)
   6:	87 fb                	xchg   %edi,%ebx
   8:	85 ed                	test   %ebp,%ebp
   a:	74 55                	je     0x61
   c:	e8 20 e4 87 fb       	call   0xfb87e431
  11:	83 ed 02             	sub    $0x2,%ebp
  14:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  1b:	fc ff df
  1e:	48 8d 7c 2b 0a       	lea    0xa(%rbx,%rbp,1),%rdi
  23:	48 89 fa             	mov    %rdi,%rdx
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	0f b6 04 02          	movzbl (%rdx,%rax,1),%eax <-- trapping instruction
  2e:	48 89 fa             	mov    %rdi,%rdx
  31:	83 e2 07             	and    $0x7,%edx
  34:	38 d0                	cmp    %dl,%al
  36:	7f 04                	jg     0x3c
  38:	84 c0                	test   %al,%al
  3a:	75 42                	jne    0x7e
  3c:	0f                   	.byte 0xf
  3d:	b6 5c                	mov    $0x5c,%dh
  3f:	2b                   	.byte 0x2b