Extracting prog: 12m19.867760915s
Minimizing prog: 12m7.579496217s
Simplifying prog options: 0s
Extracting C: 1m18.488411337s
Simplifying C: 14m18.279934213s
extracting reproducer from 24 programs
testing a last program of every proc
single: executing 4 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect-syz_open_dev$char_usb-read$char_usb-syz_usb_connect_ath9k-write$char_usb-syz_open_dev$hiddev-read$char_usb-syz_usb_ep_write-read$char_usb-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100009ac0b620110f2110"], 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
read$char_usb(r1, &(0x7f00000001c0)=""/238, 0xee)
syz_usb_connect_ath9k(0x3, 0x0, 0x0, 0x0)
write$char_usb(0xffffffffffffffff, &(0x7f0000000040)="e2", 0x2250)
syz_open_dev$hiddev(0x0, 0x6, 0xa8000)
read$char_usb(r1, &(0x7f0000000100)=""/178, 0xb2)
syz_usb_ep_write(r0, 0x81, 0x15, &(0x7f00000002c0)="28d36689fb2134111f63db24e27edc54c2d14345c6")
read$char_usb(r1, &(0x7f0000000300)=""/215, 0xd7)
syz_usb_connect(0x0, 0x24, 0x0, 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect-syz_open_dev$evdev-ioctl$EVIOCGKEYCODE_V2
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005f8bfa"], 0x0)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0)
ioctl$EVIOCGKEYCODE_V2(r0, 0x80284504, &(0x7f0000000040)=""/95)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io$cdc_ecm-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000400)=ANY=[@ANYBLOB="12010000e4c5ad101d0620c0159c010203010902120001000000000904"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000340)=ANY=[@ANYBLOB="000003"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f0000000100)=ANY=[@ANYBLOB="000b0300"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$cdc_ecm-syz_usb_control_io$cdc_ecm-syz_usb_control_io$cdc_ncm-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$cdc_ncm-syz_usb_control_io$uac1-syz_usb_control_io-syz_usb_control_io$uac1-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ecm-syz_usb_control_io$printer-syz_usb_control_io$rtl8150-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000040)={0x44, &(0x7f0000000180)={0x40, 0x17, 0x1, 'i'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000001c0)={0x1c, &(0x7f0000000940)=ANY=[], 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000500)={0x34, &(0x7f0000000300)={0x40, 0x12}, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f00000009c0)={0x84, &(0x7f0000000440)={0x40, 0x38}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000cc0)={0x84, &(0x7f00000008c0)={0x0, 0x12}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000800)={0x44, &(0x7f0000000540)={0x40, 0xe}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
program did not crash
single: failed to extract reproducer
bisect: bisecting 24 programs with base timeout 30s
testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 2, 9, 17, 4, 25, 6, 1, 5, 17, 4, 23, 12, 21, 1, 23, 8, 8, 2, 27, 5, 6, 4, 12]
detailed listing:
executing program 1:
r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x20d6, 0xcb17, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0xff, 0x50, 0x9, "", [{{0x9, 0x4, 0x0, 0xd, 0xff, 0x3, 0x1, 0x3, 0x4, {0x9, 0x21, 0x2, 0x77, 0x1, {0x22, 0xfb1}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x3, 0x8, 0x64}}}}}]}}]}}, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]})
syz_usb_connect(0x0, 0x3f, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000004600)={0x24, 0x0, 0x0, &(0x7f0000000680), 0x0}, 0x0)
syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0)
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f0000000a40)=ANY=[@ANYBLOB="12010000e3ddef20501da1604fa1010203010902120001000000000904"], 0x0)
syz_usb_connect(0x2, 0x0, 0x0, 0x0)
executing program 1:
r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120141014813442024040075ee69010203010902240001000010000904b8070259d1ca000905060200020d0006090582020002"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000380)={0x20, 0x15, 0x4, "abe763a8"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000640)={0x44, &(0x7f0000000200)={0x0, 0xc, 0x4, "ca258375"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000740)={0x44, &(0x7f0000000000)=ANY=[@ANYBLOB="601004"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000005c0)={0x1c, &(0x7f0000000100)={0x20, 0x14, 0x4, "00bd24ba"}, 0x0, 0x0})
syz_usb_control_io$uac3(r0, 0x0, &(0x7f00000006c0)={0x44, &(0x7f00000007c0)={0x20, 0x18, 0x4, "7f46cf1c"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 0:
r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_connect$cdc_ncm(0x4, 0x73, &(0x7f0000000080)=ANY=[], 0x0)
syz_usb_disconnect(0xffffffffffffffff)
r1 = syz_usb_connect$uac1(0x7, 0x71, &(0x7f0000000040)=ANY=[@ANYBLOB="00406b1d010140000102030109025f0003010380f40904000000010100000a24010f00030201020904"], 0x0)
r2 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)
syz_usb_control_io(r2, 0x0, 0x0)
syz_usb_control_io$hid(r2, 0x0, 0x0)
syz_usb_control_io(r2, 0x0, &(0x7f0000000880)={0x84, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, 0x0, &(0x7f0000000740)={0x84, &(0x7f0000000300)={0x0, 0x5, 0x3a, "2b245bdb9c1a4a4f49e8977b7f28687dd0a95a0b7d2209df0455f3e34912f4472f0e34885db2ffb615e7e52076d2096484e6cfdee68cf7973ebd"}, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x0, 0x4, {0x2, 0x2}}, 0x0, 0x0, 0x0, &(0x7f0000000500)={0x40, 0xb, 0x2, "a271"}, 0x0, &(0x7f0000000580)={0x40, 0x13, 0x6, @multicast}, &(0x7f00000005c0)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1e}}, &(0x7f0000000600)={0x40, 0x19, 0x2, "86ab"}, 0x0, 0x0, 0x0, 0x0})
syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[], 0x0)
syz_usb_connect(0x3, 0xf5, &(0x7f0000000000)=ANY=[], 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000480)={0x34, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$HIDIOCGUSAGE(r3, 0xc0145b0e, &(0x7f0000000040)={0x100000, 0x0, 0x0, 0x0, 0x3})
syz_usb_disconnect(r0)
syz_usb_connect(0x0, 0x0, 0x0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0})
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[], 0x0)
executing program 2:
r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="12011001000000407d1e383100000000000109022400010000100309040002fe0300000009210000020122050009058103"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000300)={0x24, 0x0, 0x0, &(0x7f0000000140)={0x0, 0x22, 0x5, {[@main=@item_4={0x3, 0x0, 0xb, "60924fdb"}]}}, 0x0}, 0x0)
syz_usb_connect$cdc_ncm(0x0, 0x6e, 0x0, 0x0)
executing program 1:
syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000101c1b021b00000000000109022400010000400009040000010300400009210000000122050009058103"], 0x0)
ioctl$HIDIOCGFIELDINFO(0xffffffffffffffff, 0xc038480a, 0x0)
syz_open_dev$hiddev(&(0x7f00000005c0), 0x1ff, 0x200)
ioctl$HIDIOCGFEATURE(0xffffffffffffffff, 0xc0404807, 0x0)
ioctl$HIDIOCGRDESCSIZE(0xffffffffffffffff, 0x80044801, &(0x7f0000001440))
syz_usb_connect$uac1(0x6, 0x0, 0x0, 0x0)
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000401e04012800000000000109022400010000000009040100010300000009210000000122070009058103"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100002d3d6a08c6050592ac29000000010902240003"], 0x0)
r1 = syz_usb_connect(0x0, 0x3f, 0x0, 0x0)
syz_usb_connect$uac1(0x0, 0x81, &(0x7f0000000000)={{0x12, 0x1, 0x100, 0x0, 0x0, 0x0, 0x10, 0x200c, 0x1018, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6f, 0x3, 0x1, 0xf, 0x60, 0x1, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x8, 0x19}, [@selector_unit={0x6, 0x24, 0x5, 0x1, 0x0, "e3"}, @output_terminal={0x9, 0x24, 0x3, 0x2, 0x101, 0x2, 0x1, 0x9}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0xfb, 0x3, 0x7, {0x7, 0x25, 0x1, 0x0, 0x3, 0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x19, 0x9, 0x62, {0x7, 0x25, 0x1, 0x0, 0xc, 0x3}}}}}}}}]}}, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r1, &(0x7f0000000200)={0x24, &(0x7f0000000140)={0x40, 0x7, 0x2b, {0x2b, 0x9, "5b4f2b4f046223b628142d3dc11a1e63a63538937b8620c4c23ca236cf3f0b285e3c9adf66f041b398"}}, &(0x7f0000000600)={0x0, 0x3, 0x74, @string={0x74, 0x3, "1f83645a9c52c3bc12917beee77fada07bc76f31bb27ef94745ce59034c351df4904402a706101ed1074e8f8a62f54fd0e88b9f24ba70a4fe6c625eea999d35bc0ddf8177eb74374b49afcbf95618f4e4994115687fbd8561bd2874c5b5b12684c00fb3cb54bbc4c5d21e5ad4da9c78a71fd"}}, &(0x7f0000000540), 0x0}, &(0x7f0000000500)={0x2c, 0x0, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x6}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x4c}, &(0x7f0000000380)={0x20, 0x1, 0x59, "3b05075882a023e96dd83e6a3c7ab3de02df87af7876acd9905141bcd44db6f0b2718bcd447075104120207669404b5ea4bdc936bfc221f54e6e57669eb1903c12d324edbe5489129cf61dfbaea09c8c5c3ffb8ccfb9b4d2a2"}, &(0x7f0000000180)={0x20, 0x3, 0x1, 0x2}})
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201500285d5c2086004040031960154030109021b000100031003090458080119662194090586d7"], 0x0)
r2 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYRESDEC], 0x0)
syz_usb_disconnect(r2)
syz_usb_connect(0x3, 0x24, &(0x7f0000000240)={{0x12, 0x1, 0x310, 0x86, 0x1b, 0x33, 0xff, 0x1b3d, 0x9317, 0xbe5e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0xc8, 0x3, 0x10}}]}}, 0x0)
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01)
ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f00000003c0)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x45, 0x2}, @cond=[{0x8, 0xfff, 0x44, 0x2, 0x0, 0x7}, {0xfff, 0x3, 0x7fff, 0x8, 0xf, 0x8}]})
write$char_usb(r3, &(0x7f0000000040)="e2", 0x2250)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
ioctl$HIDIOCSFEATURE(0xffffffffffffffff, 0xc0404806, &(0x7f0000001ec0)="35efa6de8ad57c4adcaf7356d257e3314ca44b6dc88002b1f51083d48e72e2b9de")
syz_usb_control_io$uac3(0xffffffffffffffff, &(0x7f0000002780)={0x14, 0x0, 0x0}, 0x0)
executing program 2:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000105804105000000000000109022d00010700000009040005050300000009210002080122940309058103"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_connect(0x0, 0x3f, 0x0, 0x0)
ioctl$EVIOCGMASK(r1, 0x800248a0, 0x0)
executing program 3:
syz_usb_connect(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d81"], 0x0)
executing program 0:
syz_open_dev$hidraw(&(0x7f0000000100), 0xffffffffffffffff, 0x400000)
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000000000104c05d5030000000000010902240001000000000904000002030000000921000000012205000905810300f9"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
ioctl$HIDIOCGUSAGES(0xffffffffffffffff, 0xd01c4813, &(0x7f0000000c80)={{0x2, 0x1, 0xf, 0x4, 0x7, 0x6}, 0x3d8, [0xe, 0x8, 0x3, 0x1, 0x3, 0x7fff, 0x6, 0x4, 0x2, 0x1, 0x6543, 0x7, 0x1, 0x8d, 0x4, 0x400, 0x81, 0x3, 0xc, 0xec93, 0xffff, 0x6d5e, 0x400, 0x98, 0x80000000, 0x7, 0x1, 0x8, 0x3, 0x3, 0xb, 0x5, 0x7, 0x80000000, 0xe225, 0x10001, 0x9, 0x0, 0x7, 0x8, 0x4, 0x1, 0x6, 0x10000, 0x10000, 0x7, 0x7fffffff, 0x9, 0xc, 0xb8, 0xb663, 0x7, 0x7f, 0x5, 0xf, 0x7ff, 0x8b, 0x52, 0xfffffffa, 0xc, 0x400, 0x7ff, 0x7ff, 0x3a63, 0x5, 0x3ff, 0x10, 0x9, 0x5, 0x2, 0x6, 0x0, 0x6, 0xfff, 0x1, 0x8e47, 0x10000, 0x8, 0xcaa4, 0x4, 0x80000001, 0x401, 0x8, 0x6, 0x7, 0x7, 0x6, 0x1, 0x4, 0x6, 0x2, 0x7, 0x2, 0xf, 0x40, 0x18, 0x4, 0x772, 0xfffffffd, 0x20000, 0x125, 0x8, 0x9, 0x8, 0x16f7800, 0x9, 0x5, 0x1000, 0x8, 0x1, 0x4, 0x8, 0x0, 0x7fffffff, 0x6, 0xfffffffc, 0x6, 0xfffffff8, 0x80, 0x0, 0x4, 0x3, 0xffffffff, 0x5, 0x100, 0x9, 0x1, 0x9, 0x10000, 0x7, 0x5, 0xc, 0x5, 0x4, 0x1, 0x5857, 0xfffffff9, 0x3, 0x6, 0x3, 0xcb, 0x7, 0x1, 0x1, 0x1a91, 0x1, 0xfffffff4, 0x1a, 0xffffda16, 0x4, 0x3ff, 0x6, 0x7ff, 0xfffffffe, 0xaea4, 0x492e388d, 0x2, 0x101, 0x3, 0xd16a, 0x0, 0x8, 0x4, 0x4, 0x0, 0xfff, 0xfffffff8, 0xf, 0xf, 0xdc000000, 0x81, 0x40, 0x3, 0x9, 0xeaa, 0xac4, 0x8, 0x10000, 0x0, 0xfffffff7, 0x7, 0x7, 0xb44, 0x80, 0xb3be, 0x6, 0xb, 0x5, 0x0, 0x0, 0x7, 0x5, 0x1, 0x4, 0x1, 0x2, 0xff, 0xad, 0x3, 0xb0, 0x9, 0xb, 0x6, 0x101, 0x0, 0x3, 0x1, 0x0, 0x10, 0xb, 0x0, 0x200, 0x7ff, 0x6a18, 0x69, 0x4, 0x2, 0x7, 0x7, 0x8, 0x1eb, 0x1, 0x10677334, 0x2, 0x7, 0x8, 0x4, 0x4, 0x0, 0x4, 0x2, 0x9, 0x0, 0x0, 0x5, 0x4, 0x4, 0x2f6, 0x0, 0x3, 0x9, 0xffffffff, 0x0, 0x10, 0x8, 0x5, 0x1, 0x80000000, 0x8, 0x1ff, 0xdc0, 0x6, 0x3, 0xf6, 0x6, 0x2, 0x9, 0x10000, 0x5308009b, 0x800, 0xfffffffc, 0x823c, 0x8000, 0x4be, 0x0, 0x7, 0x674f, 0x0, 0xa7ee, 0x4, 0x1, 0x3ff, 0x1ff, 0x7, 0x2, 0x7, 0x1, 0x1c0, 0x9957, 0xb, 0x7, 0x5, 0xffff8000, 0x9, 0x5, 0x2, 0x8, 0x1, 0x4, 0x8001, 0x4222, 0x5, 0xffffffc0, 0x3, 0xffffffff, 0x1, 0x8, 0x9, 0x6, 0x5, 0x1000, 0xfffffffc, 0x40, 0x9, 0x1, 0x3, 0x0, 0x7ff, 0xe, 0x5, 0x5, 0x8, 0x5, 0x1, 0x8, 0x2, 0xf51, 0x101, 0xca0c, 0x6, 0x1, 0x6, 0x8, 0x7, 0x6, 0xfffffffb, 0x80000000, 0x4, 0xd22, 0x0, 0x7f, 0x5701, 0x3, 0x0, 0x200, 0x3, 0x1, 0x8, 0x8, 0x401, 0x10001, 0x8, 0xc47, 0x7ff, 0xffff, 0x6, 0x7fff, 0x4, 0x1, 0x101, 0x3, 0x707, 0x9, 0x10000, 0x5, 0xff, 0x400, 0x3363, 0xff, 0x8, 0x2, 0xa, 0x1, 0xfffffffb, 0x8663, 0x6, 0x7, 0xf, 0x6, 0x7b3, 0x10, 0x5, 0x800, 0x80, 0x6, 0x7, 0x2, 0x2, 0x0, 0x1, 0x0, 0x9, 0x1, 0x48000, 0x51, 0x4, 0x7, 0x100, 0x8, 0x1, 0x7, 0x6b, 0x8, 0x2, 0x2, 0x0, 0x5, 0x8000, 0x2, 0x8, 0x40, 0x1, 0x2, 0x7, 0x2, 0x5, 0xab9, 0x101, 0x3, 0x9, 0x1, 0xbf, 0x836e, 0xfff, 0x80000000, 0x3, 0x800, 0xd7, 0x3, 0x10, 0x4, 0x10000, 0x0, 0xaeaa, 0xd000, 0x4, 0x7f8, 0x5, 0x6, 0xbb78, 0x10000, 0xeaf2, 0x7, 0x7, 0x6, 0x1, 0x7, 0xedcf, 0x1, 0x101, 0x5, 0xfffffffa, 0x8881, 0x9, 0x0, 0x6, 0xffffffff, 0x4, 0x8, 0x2, 0x8001, 0x1, 0x9, 0xfffffff4, 0x2, 0x0, 0x5, 0x70000, 0x6fae341a, 0xffffff80, 0x9, 0xffff7fff, 0x6, 0x2, 0x4, 0x0, 0x5f, 0x1bc500, 0x1ff, 0x9, 0x0, 0x3, 0xffffffc0, 0x7fff, 0x6, 0x4, 0x4, 0x66be, 0x7, 0x800, 0x7f, 0x7, 0x0, 0x9, 0x9, 0x8, 0x2aa, 0x1, 0x6, 0x9, 0x1, 0x9, 0x7fffffff, 0xe, 0x0, 0x13a, 0xd27, 0x7, 0xc58, 0x200, 0x1, 0x2, 0x2, 0x14b, 0x2f0, 0x9, 0x3542, 0x7, 0xc9c, 0x401, 0x6, 0x5, 0x5, 0x5, 0x8, 0x8, 0x904, 0x4cfa, 0x3000000, 0x1, 0x7, 0x4, 0x9, 0x8000, 0x5, 0x9, 0x600, 0x57, 0x9, 0xffffffff, 0x9, 0xfffffffc, 0x9, 0xccaa, 0xfffffff8, 0x8, 0x9, 0x0, 0xdf67, 0x0, 0x1, 0x800, 0x9, 0x2, 0x0, 0x4, 0x8, 0x1, 0x2, 0xd21f, 0x2, 0x285, 0xc0, 0x2, 0x400, 0x1, 0xdecd, 0x0, 0x18f, 0x0, 0x6, 0x1ac667c5, 0xffff, 0x200, 0xa8, 0x2, 0x1, 0xe, 0x2, 0x6, 0x64769b0c, 0x317976f2, 0xd1, 0x7b, 0xffffffff, 0x7, 0xf1, 0x51a1, 0xffffffff, 0x4, 0x50, 0x8, 0x5, 0xcf, 0xaddf, 0x747f, 0x9, 0x8000, 0x6, 0x2, 0x7fffffff, 0x2, 0xffff0000, 0x7, 0x2, 0xa, 0x200, 0x4, 0x5, 0xcd, 0x200, 0x5, 0x7, 0x2, 0x2, 0x5, 0x727737aa, 0x4, 0x200, 0x4ce, 0x8001, 0x3, 0xffffffec, 0x1, 0xd, 0xffff, 0x7, 0xb, 0x6, 0xfffff522, 0x1, 0x8, 0x10000, 0x1e, 0x0, 0xfffffe00, 0x2, 0x101, 0x9, 0x80, 0x0, 0x101, 0x7f, 0x2e0, 0x5, 0x4, 0x1, 0x7, 0x2, 0x0, 0x4, 0xfffffffc, 0x6, 0x4, 0x73c1, 0x8001, 0x6, 0x1904, 0x4, 0x6, 0x8, 0x2, 0x7, 0x19fa, 0x2, 0x68352a35, 0x3, 0xb, 0xae0d, 0x8, 0x3, 0x9, 0xe, 0x1000, 0x3, 0x7fffffff, 0x5, 0x80, 0x0, 0x5, 0x6, 0xd5, 0x0, 0x7f, 0x4, 0x9, 0x80, 0x0, 0x0, 0x5, 0x6, 0x10000, 0x7, 0x4, 0xfffffffa, 0xeb, 0xfff, 0x5, 0x4, 0xfffffffc, 0x1, 0xfff, 0x2, 0x0, 0x6, 0x3, 0x0, 0x4, 0x101, 0x5, 0x7, 0x80000000, 0x7, 0x3, 0x80000, 0xf, 0x332, 0x1, 0x8, 0x6480, 0xfff, 0xa, 0x5, 0x7ff, 0x8c, 0x4, 0x1, 0x3, 0x5c03, 0x1, 0x9235, 0x6, 0x8, 0x3, 0x9, 0x800, 0x1ff, 0x5, 0x6, 0x6, 0x4, 0xfffffe00, 0x7bb, 0x5, 0x33, 0x3, 0x6, 0x80000001, 0x2, 0x1, 0x8, 0x2, 0x1, 0x8, 0xea5, 0xffff8000, 0x9963, 0x4, 0x9, 0x5, 0x4, 0x3ff, 0xd, 0x7, 0xa, 0x1, 0x4fd6, 0x0, 0x366, 0x9, 0xfffffffe, 0x8, 0xbfc2, 0x2800000, 0x0, 0x35d, 0x9, 0x0, 0x6, 0x9, 0x2, 0x8, 0x100, 0x7fff, 0x6, 0x1, 0xfff, 0x2, 0x6de, 0xc, 0x1, 0x162, 0x7fff, 0x5, 0x2, 0x2, 0xffffffff, 0xa, 0xfffff600, 0x1ff, 0x6, 0xf, 0x2, 0xba, 0x7, 0x9, 0x8, 0x0, 0x0, 0x6, 0xf2, 0x9, 0xb184, 0x99, 0x5, 0x0, 0x2, 0x2, 0x0, 0x40, 0x338a0000, 0x9, 0x0, 0x2, 0x7ff, 0x7fffffff, 0xe18, 0x98, 0x8, 0x1, 0x8, 0x3, 0x85, 0x2, 0x7, 0x4, 0x1, 0x9d5e, 0x3, 0x9, 0x5, 0x103, 0x2, 0xffff, 0x8, 0x4, 0xfffff801, 0x3, 0x0, 0x6, 0x800, 0x9f, 0x76, 0x6, 0x4, 0x1, 0x9, 0x973, 0x3, 0x27136107, 0x9, 0x3, 0x6, 0x1000, 0x7, 0xaa, 0x4, 0x9, 0x76b709dd, 0xa, 0x80000000, 0x7fff, 0x7, 0x1, 0x6, 0x7, 0x40, 0x3, 0x2, 0xdb9, 0x1000, 0x4, 0x3, 0x5, 0x190, 0x0, 0x7, 0x7, 0x8, 0xfffffffb, 0x80000001, 0x9, 0x20, 0x1, 0x1, 0x0, 0x2, 0x812, 0x7, 0x8, 0x400, 0xf41, 0x3, 0xcd43, 0x0, 0x8, 0x0, 0xee, 0x5, 0x5dba, 0x1000, 0x7a61, 0x1, 0x7c10, 0x7, 0x1, 0x88f2, 0x7, 0xffffffff, 0x0, 0x10001, 0x10001, 0x3, 0x101, 0xb20, 0x6, 0x60000000, 0x5, 0xa5, 0x8, 0x4, 0x863a, 0xf0, 0x0, 0x9, 0x7f0, 0x5, 0x0, 0x35d, 0x9d, 0x5, 0x0, 0x6, 0x7f, 0x5, 0x2, 0x3, 0x8, 0x7fffffff, 0x9, 0x1, 0x2, 0x3e4d, 0x4, 0x3, 0x8000, 0x1000, 0x7, 0x6, 0x10000, 0x2, 0xc, 0xc3, 0x7, 0x6, 0xff, 0xffffffff, 0x53dc0522, 0xffffff9f, 0x4, 0x7f, 0x4, 0x200, 0x9, 0xf2e, 0x7ff, 0x1ff, 0xd5, 0x9, 0xffffffff, 0x2, 0x2, 0x101, 0x271e, 0xb0b, 0x6, 0x23, 0x80000000, 0x6, 0xffff, 0xffff0001, 0x10001, 0x5, 0x100, 0x5, 0x12, 0xd, 0x2, 0xff, 0xa, 0xe71, 0x5, 0x9, 0x6, 0x6, 0x6, 0x7b, 0xfffff8be, 0x40, 0x5, 0x86, 0x6a9, 0x475b29a0, 0xffffffff, 0x8, 0x10001, 0x10001, 0x0, 0x8, 0x0, 0x8, 0x7d62, 0x200, 0x1ff, 0x8, 0x3, 0x7f, 0x1e5, 0x5, 0x6, 0x759, 0x55, 0x5, 0x90]})
syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000000)={0x0, 0x0, 0x5, {0x5, 0x0, "a6ea31"}}, 0x0, 0x0, 0x0, 0x0}, 0x0)
executing program 1:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000004c0)={0x1c, &(0x7f0000000540)=ANY=[], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000380)={0x44, &(0x7f0000000600)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000080)={0x60, 0x5, 0x2, '#('}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$uac2(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
executing program 3:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005f8bfa"], 0x0)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0)
ioctl$EVIOCGKEYCODE_V2(r0, 0x80284504, &(0x7f0000000040)=""/95)
executing program 0:
r0 = syz_usb_connect(0x0, 0x36, &(0x7f00000004c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a8230800090400bc6435fb4d00090503034d00ff99090805", @ANYRES32], &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]})
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_connect(0x0, 0x575, &(0x7f0000000780)=ANY=[@ANYBLOB="120100009ba23610030478faffc501"], 0x0)
read$char_usb(r1, &(0x7f0000000a80)=""/188, 0xba)
syz_open_dev$char_usb(0xc, 0xb4, 0xfffffffffffffffd)
syz_usb_disconnect(0xffffffffffffffff)
syz_usb_connect$cdc_ncm(0x0, 0x76, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x418000)
r2 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090000082502000000000000000109025c00020100f92a0904000001020900000524060001053408fa6e0d240f0100000000000d000a0006471a010000190581"], 0x0)
syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000fe07124081173809499b010203010902240001000000000904"], 0x0)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_disconnect(0xffffffffffffffff)
write$char_usb(r3, 0x0, 0x0)
syz_usb_disconnect(r2)
syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[], 0x0)
syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0)
r4 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x4b4, 0xbca1, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xe8, 0x1, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x7ffd, 0x0, 0x1, {0x22, 0xeb}}, {{{0x9, 0x5, 0x81, 0x3, 0x200}}}}}]}}]}}, 0x0)
syz_open_dev$evdev(0x0, 0x800, 0x20100)
syz_usb_control_io$hid(r4, 0x0, 0x0)
read$char_usb(r1, 0x0, 0x0)
syz_usb_connect$cdc_ecm(0x0, 0x64, &(0x7f00000000c0)={{0x12, 0x1, 0x300, 0x2, 0x0, 0x0, 0x0, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x52, 0x1, 0x1, 0xfa, 0x30, 0x92, "", [{{0x9, 0x4, 0x0, 0x5, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x7, 0x24, 0x6, 0x0, 0x0, "1b35"}, {0x5, 0x24, 0x0, 0x81}, {0xd, 0x24, 0xf, 0x1, 0x80000001, 0x100, 0xdb, 0x2}, [@mdlm={0x15, 0x24, 0x12, 0xf}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x3ff, 0x9, 0x0, 0xf9}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x8, 0xaa, 0x6}}}}}]}}]}}, &(0x7f0000000500)={0xa, &(0x7f0000000140)={0xa, 0x6, 0x201, 0x10, 0x5, 0x4f, 0x40, 0x4}, 0x5, &(0x7f0000000180)={0x5, 0xf, 0x5}, 0x8, [{0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0xf8ff}}, {0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0x1c01}}, {0xab, &(0x7f0000000240)=@string={0xab, 0x3, "6fcb1786b7bc726773a016c32715d45a6dc7e08317f0e69c2b94912bd1ef8bc471a39efa9d1bf86f63eb6dbb0a800a6d9e6206c9fb7d71392da7b15a2bdf3042400b48c40282619ea7c0f7d0072d2571ddaa904e047a0c48e7b2691bc4efc092ffcf5d9fa17f8db0167b1b1f6ae4f0cb68c6e2ba0342f531149e7250ec7017b990d0ee2bbc53c3cccaa676813418c1bb0e577f97a5e38b12471deaa671d5e984efe0b0904ad4966c35"}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x445}}, {0x41, &(0x7f0000000340)=@string={0x41, 0x3, "852a02441add735a9f6b7eb9c8d1e1fa80e5201588654a3cb0a5270050e27e5007cf5aadf0633633db8e66caa8a8fbcd34bf4494f298ca9683a52d2a86bf04"}}, {0x37, &(0x7f00000003c0)=@string={0x37, 0x3, "5f0643e6ac95bc43de79bcee467ad4ab1c4aa44e1726286b7ec41560c7d922d981c02981eba493f47d9e8459acb3851fdc503edadf"}}, {0x34, &(0x7f0000000400)=@string={0x34, 0x3, "e616649dc1e381b94376f8b358037f81f428c4290f4541f0c1f82851ecc6ed8d3873e4eb4b5b2b8bfda53aa19dd296948597"}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x2c01}}]})
syz_usb_disconnect(r0)
executing program 2:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100009ac0b620110f2110"], 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
read$char_usb(r1, &(0x7f00000001c0)=""/238, 0xee)
syz_usb_connect_ath9k(0x3, 0x0, 0x0, 0x0)
write$char_usb(0xffffffffffffffff, &(0x7f0000000040)="e2", 0x2250)
syz_open_dev$hiddev(0x0, 0x6, 0xa8000)
read$char_usb(r1, &(0x7f0000000100)=""/178, 0xb2)
syz_usb_ep_write(r0, 0x81, 0x15, &(0x7f00000002c0)="28d36689fb2134111f63db24e27edc54c2d14345c6")
read$char_usb(r1, &(0x7f0000000300)=""/215, 0xd7)
syz_usb_connect(0x0, 0x24, 0x0, 0x0)
executing program 0:
r0 = syz_open_dev$hidraw(&(0x7f0000000040), 0x9, 0x240c0)
ioctl$HIDIOCGRAWPHYS(r0, 0x80404805, 0x0)
r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000050cb5340450c10108e492940a80909021b00090000000009040002010035040009058dff86"], 0x0)
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
write$char_usb(r2, &(0x7f0000000080)='7', 0x1)
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000004600)={0x24, 0x0, 0x0, &(0x7f0000004580), 0x0}, 0x0)
write$char_usb(r2, &(0x7f0000000280)='L', 0x1)
syz_usb_connect(0x4, 0x0, 0x0, 0x0)
syz_usb_connect(0x3, 0x3f, &(0x7f0000000100)=ANY=[], 0x0)
syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x903d01)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
write$char_usb(r3, 0x0, 0x0)
r4 = syz_usb_connect$printer(0x4, 0x36, &(0x7f0000001740)=ANY=[@ANYRES8=r1, @ANYRESHEX=0x0, @ANYRES32=r0, @ANYRESDEC=r0, @ANYRESDEC=r3, @ANYBLOB="af381555f3db2ea59bcc8b256f579ffff171c1496b9009676c4363c0cf26664ecd376ebc2b8b09c706eb23616363f5960ef03b57554346be3465f40380524c368e3e261ed2c26d082efe8cd50003ff0c3f71b3247dd671ef23122357d4ee01f9f1484d11c44e9df6", @ANYBLOB="02bf449e0bea2cfed31d260fd6cbed443842d414a5b718745194bc2d94f5a952fe8914bdeb7d207ce9b18fcc"], 0x0)
syz_usb_disconnect(r4)
syz_usb_connect(0x2, 0x36, 0x0, 0x0)
syz_usb_disconnect(r1)
r5 = syz_open_dev$evdev(&(0x7f0000000580), 0x0, 0x303040)
ioctl$EVIOCGMASK(r5, 0x80104592, 0x0)
read$char_usb(r2, &(0x7f0000000500)=""/95, 0x5f)
executing program 2:
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000001c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0xffff1f0000000000)
executing program 3:
r0 = syz_usb_connect(0x0, 0x36, &(0x7f00000004c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a8230800090400bc6435fb4d00090503034d00ff99090805", @ANYRES32], &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]})
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_connect(0x0, 0x575, &(0x7f0000000780)=ANY=[@ANYBLOB="120100009ba23610030478faffc501"], 0x0)
read$char_usb(r1, &(0x7f0000000a80)=""/188, 0xba)
syz_open_dev$char_usb(0xc, 0xb4, 0xfffffffffffffffd)
syz_usb_disconnect(0xffffffffffffffff)
r2 = syz_usb_connect$cdc_ncm(0x0, 0x76, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x418000)
r3 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090000082502000000000000000109025c00020100f92a0904000001020900000524060001053408fa6e0d240f0100000000000d000a0006471a010000190581"], 0x0)
syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000fe07124081173809499b010203010902240001000000000904"], 0x0)
r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_disconnect(0xffffffffffffffff)
write$char_usb(r4, 0x0, 0x0)
syz_usb_disconnect(r3)
syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[], 0x0)
syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0)
r5 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x4b4, 0xbca1, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xe8, 0x1, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x7ffd, 0x0, 0x1, {0x22, 0xeb}}, {{{0x9, 0x5, 0x81, 0x3, 0x200}}}}}]}}]}}, 0x0)
syz_open_dev$evdev(0x0, 0x800, 0x20100)
syz_usb_control_io$hid(r5, 0x0, 0x0)
read$char_usb(r1, 0x0, 0x0)
syz_usb_disconnect(r0)
executing program 1:
r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120141014813442024040075ee69010203010902240001000010000904b8070259d1ca000905060200020d0006090582020002"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000380)={0x20, 0x15, 0x4, "abe763a8"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000640)={0x44, &(0x7f0000000200)={0x0, 0xc, 0x4, "ca258375"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000740)={0x44, &(0x7f0000000000)=ANY=[@ANYBLOB="601004"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000005c0)={0x1c, &(0x7f0000000100)={0x20, 0x14, 0x4, "00bd24ba"}, 0x0, 0x0})
executing program 2:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000001c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
syz_usb_connect(0x0, 0x3f, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000016038308c5109a8146e40102230109022d000100000000090400000303"], 0x0)
syz_usb_connect(0x0, 0x4a, 0x0, 0x0)
r1 = syz_usb_connect(0x3, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12013f383229a4e3814e7b9c015f068120010904ec0200ffffff0300"/43], &(0x7f0000000c80)={0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r1, &(0x7f0000001600)={0x24, 0x0, &(0x7f0000001540)=ANY=[@ANYBLOB="1b03020100000203"], 0x0, 0x0}, 0x0)
syz_usb_control_io$hid(r1, &(0x7f0000001300)={0x24, 0x0, &(0x7f00000010c0)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0)
syz_usb_control_io$uac3(r1, 0x0, &(0x7f0000000080)={0x44, &(0x7f0000000e00)={0x40, 0x19, 0x1a, "a22aa1124301c30dc44fa3a6c26419c8c8"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 3:
ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x55, &(0x7f0000000cc0)={{0x12, 0x1, 0x140, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x43, 0x1, 0x1, 0x8, 0x100, 0x2, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x2, 0x6, 0x0, 0x40, {{0x5}, {0x5, 0x24, 0x0, 0x9}, {0xd, 0x24, 0xf, 0x1, 0x2, 0x2, 0xea6, 0xc}, [@mdlm_detail={0x4, 0x24, 0x13, 0x1}, @mdlm_detail={0x4, 0x24, 0x13, 0x3}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x200, 0x9, 0xce, 0x10}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x2, 0x3, 0xc5}}}}}]}}]}}, 0x0)
executing program 0:
r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000040)={0x44, &(0x7f0000000180)={0x40, 0x17, 0x1, 'i'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000001c0)={0x1c, &(0x7f0000000940)=ANY=[], 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000500)={0x34, &(0x7f0000000300)={0x40, 0x12}, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f00000009c0)={0x84, &(0x7f0000000440)={0x40, 0x38}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000cc0)={0x84, &(0x7f00000008c0)={0x0, 0x12}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000800)={0x44, &(0x7f0000000540)={0x40, 0xe}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000700)=ANY=[@ANYBLOB="12010000000000408c0d220000000000000109022400010000000009040000010300000009210000000122050009058103"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, &(0x7f0000000740)={0x2c, &(0x7f0000000980)=ANY=[@ANYBLOB="00000001000000090090"], 0x0, 0x0, 0x0, 0x0}, 0x0)
r1 = syz_open_dev$hiddev(&(0x7f0000000100), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r1, 0x4018480c, &(0x7f0000000080)={0x2, 0xffffffff, 0x10000})
executing program 1:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000400)=ANY=[@ANYBLOB="12010000e4c5ad101d0620c0159c010203010902120001000000000904"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000340)=ANY=[@ANYBLOB="000003"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f0000000100)=ANY=[@ANYBLOB="000b0300"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 2:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005f8bfa"], 0x0)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0)
ioctl$EVIOCGKEYCODE_V2(r0, 0x80284504, &(0x7f0000000040)=""/95)
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100009ac0b620110f2110"], 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
read$char_usb(r1, &(0x7f00000001c0)=""/238, 0xee)
syz_usb_connect_ath9k(0x3, 0x0, 0x0, 0x0)
write$char_usb(0xffffffffffffffff, &(0x7f0000000040)="e2", 0x2250)
syz_open_dev$hiddev(0x0, 0x6, 0xa8000)
read$char_usb(r1, &(0x7f0000000100)=""/178, 0xb2)
syz_usb_ep_write(r0, 0x81, 0x15, &(0x7f00000002c0)="28d36689fb2134111f63db24e27edc54c2d14345c6")
read$char_usb(r1, &(0x7f0000000300)=""/215, 0xd7)
syz_usb_connect(0x0, 0x24, 0x0, 0x0)
program did not crash
replaying the whole log did not cause a kernel crash
single: executing 4 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect-syz_open_dev$char_usb-read$char_usb-syz_usb_connect_ath9k-write$char_usb-syz_open_dev$hiddev-read$char_usb-syz_usb_ep_write-read$char_usb-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100009ac0b620110f2110"], 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
read$char_usb(r1, &(0x7f00000001c0)=""/238, 0xee)
syz_usb_connect_ath9k(0x3, 0x0, 0x0, 0x0)
write$char_usb(0xffffffffffffffff, &(0x7f0000000040)="e2", 0x2250)
syz_open_dev$hiddev(0x0, 0x6, 0xa8000)
read$char_usb(r1, &(0x7f0000000100)=""/178, 0xb2)
syz_usb_ep_write(r0, 0x81, 0x15, &(0x7f00000002c0)="28d36689fb2134111f63db24e27edc54c2d14345c6")
read$char_usb(r1, &(0x7f0000000300)=""/215, 0xd7)
syz_usb_connect(0x0, 0x24, 0x0, 0x0)
program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect-syz_open_dev$evdev-ioctl$EVIOCGKEYCODE_V2
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005f8bfa"], 0x0)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0)
ioctl$EVIOCGKEYCODE_V2(r0, 0x80284504, &(0x7f0000000040)=""/95)
program crashed: WARNING in igorplugusb_probe/usb_submit_urb
single: successfully extracted reproducer
found reproducer with 4 syscalls
minimizing guilty program
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect-syz_open_dev$evdev
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005f8bfa"], 0x0)
syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0)
program crashed: WARNING in igorplugusb_probe/usb_submit_urb
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005f8bfa"], 0x0)
program crashed: WARNING in igorplugusb_probe/usb_submit_urb
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0)
program crashed: WARNING in igorplugusb_probe/usb_submit_urb
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, 0x0, 0x0)
program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x0)
program did not crash
extracting C reproducer
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: WARNING in igorplugusb_probe/usb_submit_urb
simplifying C reproducer
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: WARNING in igorplugusb_probe/usb_submit_urb
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: WARNING in igorplugusb_probe/usb_submit_urb
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: WARNING in igorplugusb_probe/usb_submit_urb
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: WARNING in igorplugusb_probe/usb_submit_urb
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: WARNING in igorplugusb_probe/usb_submit_urb
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: WARNING in igorplugusb_probe/usb_submit_urb
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: WARNING in igorplugusb_probe/usb_submit_urb
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0)
program crashed: WARNING in igorplugusb_probe/usb_submit_urb
validation run: crashed=true
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0)
program crashed: WARNING in igorplugusb_probe/usb_submit_urb
validation run: crashed=true
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0)
program crashed: WARNING in igorplugusb_probe/usb_submit_urb
validation run: crashed=true
reproducing took 45m29.625687997s
repro crashed as (corrupted=false):
Registered IR keymap rc-empty
rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0
input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input6
------------[ cut here ]------------
usb 1-1: BOGUS control dir, pipe 80000380 doesn't match bRequestType 60
WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1053/0x18b0 drivers/usb/core/urb.c:411, CPU#0: kworker/0:4/5935
Modules linked in:
CPU: 0 UID: 0 PID: 5935 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_submit_urb+0x1115/0x18b0 drivers/usb/core/urb.c:411
Code: 00 00 00 00 00 fc ff df 0f b6 44 05 00 84 c0 0f 85 91 05 00 00 45 0f b6 45 00 48 8b 7c 24 18 48 8b 74 24 10 4c 89 fa 44 89 f1 <67> 48 0f b9 3a 49 bf 00 00 00 00 00 fc ff df e9 c1 f2 ff ff 89 e9
RSP: 0018:ffffc90003416d58 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff88807205ea00 RCX: 0000000080000380
RDX: ffff8880282dd040 RSI: ffffffff8ca2a000 RDI: ffffffff90619150
RBP: 1ffff1100e27be08 R08: 0000000000000060 R09: 1ffff92000682d78
R10: dffffc0000000000 R11: fffff52000682d79 R12: ffff888033b7e100
R13: ffff8880713df040 R14: 0000000080000380 R15: ffff8880282dd040
FS: 0000000000000000(0000) GS:ffff888124de1000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3576b57e9c CR3: 000000007e6d2000 CR4: 00000000003526f0
Call Trace:
igorplugusb_cmd drivers/media/rc/igorplugusb.c:127 [inline]
igorplugusb_probe+0x812/0xc70 drivers/media/rc/igorplugusb.c:225
usb_probe_interface+0x668/0xc90 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:721
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:863
driver_probe_device+0x4f/0x240 drivers/base/dd.c:893
__device_attach_driver+0x279/0x430 drivers/base/dd.c:1021
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1093
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1148
bus_probe_device+0x12a/0x220 drivers/base/bus.c:613
device_add+0x7b6/0xb70 drivers/base/core.c:3692
usb_set_configuration+0x1a87/0x2110 drivers/usb/core/message.c:2266
usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
usb_probe_device+0x1c4/0x3b0 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:721
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:863
driver_probe_device+0x4f/0x240 drivers/base/dd.c:893
__device_attach_driver+0x279/0x430 drivers/base/dd.c:1021
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1093
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1148
bus_probe_device+0x12a/0x220 drivers/base/bus.c:613
device_add+0x7b6/0xb70 drivers/base/core.c:3692
usb_new_device+0xa08/0x16f0 drivers/usb/core/hub.c:2695
hub_port_connect drivers/usb/core/hub.c:5567 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x2a1c/0x4f30 drivers/usb/core/hub.c:5953
process_one_work+0x9ab/0x1780 kernel/workqueue.c:3288
process_scheduled_works kernel/workqueue.c:3379 [inline]
worker_thread+0xba8/0x11e0 kernel/workqueue.c:3465
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 00 00 add %al,(%rax)
4: 00 fc add %bh,%ah
6: ff lcall (bad)
7: df 0f fisttps (%rdi)
9: b6 44 mov $0x44,%dh
b: 05 00 84 c0 0f add $0xfc08400,%eax
10: 85 91 05 00 00 45 test %edx,0x45000005(%rcx)
16: 0f b6 45 00 movzbl 0x0(%rbp),%eax
1a: 48 8b 7c 24 18 mov 0x18(%rsp),%rdi
1f: 48 8b 74 24 10 mov 0x10(%rsp),%rsi
24: 4c 89 fa mov %r15,%rdx
27: 44 89 f1 mov %r14d,%ecx
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: 49 bf 00 00 00 00 00 movabs $0xdffffc0000000000,%r15
36: fc ff df
39: e9 c1 f2 ff ff jmp 0xfffff2ff
3e: 89 e9 mov %ebp,%ecx
final repro crashed as (corrupted=false):
Registered IR keymap rc-empty
rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0
input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input6
------------[ cut here ]------------
usb 1-1: BOGUS control dir, pipe 80000380 doesn't match bRequestType 60
WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1053/0x18b0 drivers/usb/core/urb.c:411, CPU#0: kworker/0:4/5935
Modules linked in:
CPU: 0 UID: 0 PID: 5935 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_submit_urb+0x1115/0x18b0 drivers/usb/core/urb.c:411
Code: 00 00 00 00 00 fc ff df 0f b6 44 05 00 84 c0 0f 85 91 05 00 00 45 0f b6 45 00 48 8b 7c 24 18 48 8b 74 24 10 4c 89 fa 44 89 f1 <67> 48 0f b9 3a 49 bf 00 00 00 00 00 fc ff df e9 c1 f2 ff ff 89 e9
RSP: 0018:ffffc90003416d58 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff88807205ea00 RCX: 0000000080000380
RDX: ffff8880282dd040 RSI: ffffffff8ca2a000 RDI: ffffffff90619150
RBP: 1ffff1100e27be08 R08: 0000000000000060 R09: 1ffff92000682d78
R10: dffffc0000000000 R11: fffff52000682d79 R12: ffff888033b7e100
R13: ffff8880713df040 R14: 0000000080000380 R15: ffff8880282dd040
FS: 0000000000000000(0000) GS:ffff888124de1000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3576b57e9c CR3: 000000007e6d2000 CR4: 00000000003526f0
Call Trace:
igorplugusb_cmd drivers/media/rc/igorplugusb.c:127 [inline]
igorplugusb_probe+0x812/0xc70 drivers/media/rc/igorplugusb.c:225
usb_probe_interface+0x668/0xc90 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:721
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:863
driver_probe_device+0x4f/0x240 drivers/base/dd.c:893
__device_attach_driver+0x279/0x430 drivers/base/dd.c:1021
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1093
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1148
bus_probe_device+0x12a/0x220 drivers/base/bus.c:613
device_add+0x7b6/0xb70 drivers/base/core.c:3692
usb_set_configuration+0x1a87/0x2110 drivers/usb/core/message.c:2266
usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
usb_probe_device+0x1c4/0x3b0 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:721
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:863
driver_probe_device+0x4f/0x240 drivers/base/dd.c:893
__device_attach_driver+0x279/0x430 drivers/base/dd.c:1021
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1093
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1148
bus_probe_device+0x12a/0x220 drivers/base/bus.c:613
device_add+0x7b6/0xb70 drivers/base/core.c:3692
usb_new_device+0xa08/0x16f0 drivers/usb/core/hub.c:2695
hub_port_connect drivers/usb/core/hub.c:5567 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x2a1c/0x4f30 drivers/usb/core/hub.c:5953
process_one_work+0x9ab/0x1780 kernel/workqueue.c:3288
process_scheduled_works kernel/workqueue.c:3379 [inline]
worker_thread+0xba8/0x11e0 kernel/workqueue.c:3465
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 00 00 add %al,(%rax)
4: 00 fc add %bh,%ah
6: ff lcall (bad)
7: df 0f fisttps (%rdi)
9: b6 44 mov $0x44,%dh
b: 05 00 84 c0 0f add $0xfc08400,%eax
10: 85 91 05 00 00 45 test %edx,0x45000005(%rcx)
16: 0f b6 45 00 movzbl 0x0(%rbp),%eax
1a: 48 8b 7c 24 18 mov 0x18(%rsp),%rdi
1f: 48 8b 74 24 10 mov 0x10(%rsp),%rsi
24: 4c 89 fa mov %r15,%rdx
27: 44 89 f1 mov %r14d,%ecx
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: 49 bf 00 00 00 00 00 movabs $0xdffffc0000000000,%r15
36: fc ff df
39: e9 c1 f2 ff ff jmp 0xfffff2ff
3e: 89 e9 mov %ebp,%ecx