Extracting prog: 14m24.475886767s Minimizing prog: 1h34m13.168852179s Simplifying prog options: 0s Extracting C: 1m18.311010451s Simplifying C: 7m54.505912897s extracting reproducer from 30 programs testing a last program of every proc single: executing 5 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ncm-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io$cdc_ncm-syz_usb_control_io$uac1-syz_usb_control_io$printer-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$uac1-syz_usb_control_io$cdc_ecm-syz_usb_control_io-syz_usb_control_io$printer-syz_usb_control_io$uac1-syz_usb_control_io$cdc_ncm-syz_usb_control_io$uac1 detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000600)=ANY=[@ANYBLOB="12010000a3b370086d04ae08581101020301090212000d0000000009"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000040)={0x84, &(0x7f0000000140)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000a80)={0x1c, &(0x7f0000000440)={0x0, 0xf, 0x1, "ed"}, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000001080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000b40)={0x44, &(0x7f0000000740)={0x60, 0x11}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000680)={0x44, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$uac1-syz_usb_control_io-syz_open_dev$evdev-ioctl$EVIOCGLED-syz_usb_control_io$uac1-syz_usb_control_io-syz_usb_connect-syz_usb_ep_write$ath9k_ep2-syz_open_dev$evdev-ioctl$EVIOCSFF-syz_usb_connect$hid-syz_usb_control_io-syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$cdc_ncm-syz_usb_control_io-syz_usb_control_io$cdc_ecm-syz_usb_control_io$cdc_ecm-syz_usb_control_io$hid-syz_usb_control_io$rtl8150-syz_usb_control_io$cdc_ncm-syz_usb_control_io$hid-syz_usb_control_io$uac1-syz_usb_control_io$uac3-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$uac1(0x0, 0xac, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000000000106b1d010140000102030109029a0003010000000904000000010100000a240100f9ff0201020c24020000000000000800000524050000082407000000009e0c240700000000a3e82f07070d240701040000fd80000000e80924030000000001"], 0x0) syz_usb_control_io(r0, &(0x7f0000000200)={0x2c, 0x0, &(0x7f0000000140)=ANY=[@ANYRESDEC=r0], 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x7, 0x10900) ioctl$EVIOCGLED(r1, 0x80404519, &(0x7f0000000940)=""/151) syz_usb_control_io$uac1(r0, &(0x7f0000001840)={0x14, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c40)={0x84, &(0x7f0000000740)=ANY=[@ANYBLOB="20e702"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_usb_connect(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) syz_usb_ep_write$ath9k_ep2(r2, 0x83, 0x8, &(0x7f0000000200)=ANY=[@ANYBLOB="bcea"]) r3 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) ioctl$EVIOCSFF(r3, 0x40304580, &(0x7f00000001c0)={0x0, 0xffff, 0x560c, {0x5, 0x5d5}, {0xfffa, 0x2}, @period={0x59, 0x2, 0x4, 0x6d, 0x9ee, {0x2, 0xfffb, 0xff7e, 0xa}, 0x0, 0x0}}) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000000000020030430600000000000010902240001000000000904010001030000000921000000012202000905810300"], 0x0) syz_usb_control_io(r4, 0x0, 0x0) r5 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000005c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r5, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000080)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r5, 0x0, 0x0) syz_usb_control_io$hid(r5, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000280)={0x20}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r5, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io$uac1(r5, 0x0, 0x0) syz_usb_control_io$uac3(r5, &(0x7f0000000500)={0x14, &(0x7f0000000400)={0x40, 0x2, 0x42, {0x42, 0xe, "048135f80114982367ccd119591bd67d1bed1de01024f3cba70ad4baf025860edd22deccc3c0112d1069b119cbe958ca11900c7fabb4983939ded67df7fe5f60"}}, &(0x7f00000004c0)={0x0, 0x3, 0xf, @string={0xf, 0x3, "7eb421a41cc33a7a2c8e0ad31e"}}}, &(0x7f0000000780)={0x44, &(0x7f0000000540)={0x0, 0x18, 0x18, "8b32e6ac98299b874e4c87096c2b5adef21f43f8be2868b2"}, &(0x7f0000000580)={0x0, 0xa, 0x1, 0x9}, &(0x7f00000005c0)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000600)={0x20, 0x81, 0x1, "a9"}, &(0x7f0000000640)={0x20, 0x82, 0x2, "b8f1"}, &(0x7f0000000800)=ANY=[@ANYBLOB="208301000000145da992aa8372fa4e1691d022751d47cbf9116a9667e4c80493566faa0895f18060475b4816620402b642e59fd1e3624fc8434bec731ae8ef7cc87994b430edf6b29abe0cffae5653862d52358f784439abf92acd483f8b14567bef52e3af5e7c3a3a4e65c305bdc4"], &(0x7f00000006c0)={0x20, 0x84, 0x4, "96f8d4f5"}, &(0x7f0000000700)={0x20, 0x85, 0x3, "7f1904"}}) syz_usb_control_io$hid(r4, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x2, {[@main=@item_012={0x1, 0x0, 0x0, "fe"}]}}, 0x0}, 0x0) syz_usb_control_io(r4, 0x0, &(0x7f0000000300)={0x84, &(0x7f0000000100)={0x60, 0x14, 0x1c, "5e6424818327b29f7e8a03b53ef7c938ee40357f76bbdb1baddc3c34"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) syz_usb_control_io$hid(r6, 0x0, &(0x7f0000000480)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="2001030000005d6bd474b75aa359c4966914e309af30b99dd33551c0bb96de1161319823db42fb8ec3bf8c8cf4115178"], 0x0}) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(r4, 0x0, &(0x7f0000000880)={0x84, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00M'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$hidraw-syz_usb_connect$cdc_ncm-syz_open_dev$char_usb-syz_usb_disconnect-write$char_usb-write$char_usb-syz_usb_connect-syz_usb_control_io$printer-ioctl$HIDIOCGUSAGE-syz_usb_connect-syz_open_dev$char_usb-write$char_usb-read$char_usb-syz_usb_connect$cdc_ncm-syz_usb_disconnect-syz_usb_connect-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io detailed listing: executing program 0: syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x418000) r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090000082502000000000000000109025c00020100f92a0904000001020900000524060001053408fa6e0d240f0100000000000d000a0006471a010000190581"], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(0xffffffffffffffff) write$char_usb(r1, 0x0, 0x0) write$char_usb(0xffffffffffffffff, 0x0, 0xfedd) r2 = syz_usb_connect(0x0, 0x3f, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, &(0x7f0000000100)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$HIDIOCGUSAGE(0xffffffffffffffff, 0xc0145b0e, &(0x7f0000000000)={0x100000, 0x0, 0xfffffffc}) syz_usb_connect(0x0, 0x2d, 0x0, 0x0) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x10000) write$char_usb(r3, &(0x7f0000000580), 0x0) read$char_usb(r3, 0x0, 0x0) syz_usb_connect$cdc_ncm(0x5, 0x72, 0x0, 0x0) syz_usb_disconnect(r0) r4 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYRESOCT=r0], 0x0) syz_usb_disconnect(r4) r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io(r4, 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-write$char_usb-syz_usb_connect$hid-syz_usb_control_io$uac3-syz_usb_control_io$cdc_ncm-syz_open_dev$evdev-ioctl$EVIOCSFF-write$char_usb-syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_open_dev$char_usb-syz_usb_disconnect-syz_usb_ep_write detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r0) write$char_usb(0xffffffffffffffff, &(0x7f0000000080), 0x0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc71f, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xe8, 0xb, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x7ffd, 0x0, 0x1, {0x22, 0x1e3}}, {{{0x9, 0x5, 0x81, 0x3, 0x38d707d343173689, 0x5, 0xa, 0x70}}}}}]}}]}}, 0x0) syz_usb_control_io$uac3(0xffffffffffffffff, 0x0, &(0x7f0000000440)={0x44, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)={0x20, 0x82, 0x3, "90873a"}, &(0x7f0000000300)=ANY=[@ANYBLOB="2083"], 0x0, 0x0}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000840)={0x44, 0x0, &(0x7f0000000340)={0x0, 0xa, 0x1, 0xc1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_open_dev$evdev(0x0, 0x2, 0x92bb00) ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000480)={0x54, 0x0, 0x2, {0xfffd, 0x1}, {0x3c, 0x2}}) write$char_usb(r2, &(0x7f0000000040)="e2", 0x2250) syz_usb_connect(0x3, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x9d, 0xbd, 0x45, 0x40, 0x10b9, 0x6000, 0xbe16, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x87, 0x9, 0x30, 0x7, "", [{{0x9, 0x4, 0x40, 0x19, 0x0, 0x3a, 0x92, 0xe0, 0x8}}]}}]}}, &(0x7f0000000cc0)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_connect(0x0, 0x10b, &(0x7f0000000000)=ANY=[], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(0xffffffffffffffff) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000300)='\x00') program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect-syz_usb_connect-syz_usb_control_io$printer-syz_usb_connect$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io$printer-syz_open_dev$evdev-ioctl$EVIOCGKEYCODE_V2-syz_usb_control_io$cdc_ncm-syz_usb_control_io$rtl8150-syz_usb_control_io$uac1-syz_usb_control_io$uac3 detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000001000)=ANY=[@ANYBLOB="1201000200000040501d4d610001000000010902200001010080320904000002ff00000007050102"], 0x0) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870fd00090582020002"], 0x0) syz_usb_connect(0x3, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d64ed1040206402d14e0102"], 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_connect$uac1(0x0, 0x8b, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x2b73, 0x29, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x79, 0x3, 0x1, 0x6, 0x0, 0x2, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xf, 0x11}, [@processing_unit={0x7, 0x24, 0x7, 0x6, 0x3, 0x4}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x8, 0x5, 0x4, {0x7, 0x25, 0x1, 0x0, 0x6, 0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0xd, 0x2, 0x4, 0x1, "d9cd", "d2"}, @as_header={0x7, 0x24, 0x1, 0x6, 0x4, 0x1}]}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x4, 0x5, 0x0, {0x7, 0x25, 0x1, 0xc, 0x3, 0x2}}}}}}}}]}}, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0x12, &(0x7f00000001c0)=ANY=[@ANYBLOB="a200004ef3b11f948ef66b0ee0b3d41b1b"]) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000100)={0x20, 0x90069109b15ef6c8, 0x1e, "4d61501d0100000000000000100000000000800700000000000038040000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000200)=ANY=[@ANYBLOB="403f0100000080"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000d80)={0x34, &(0x7f0000000a80)=ANY=[@ANYBLOB="401605"], 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x6081) ioctl$EVIOCGKEYCODE_V2(r2, 0x80284504, &(0x7f0000001040)=""/4096) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000140)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000240)={0x20, 0x80, 0x1c, {0x80a, 0x7, 0x4, 0x7, 0x5, 0x3, 0x7, 0x47, 0x14, 0x9, 0x7e4, 0x2}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000480)={0x2c, &(0x7f0000000240)=ANY=[@ANYBLOB="200f14"], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r1, &(0x7f00000004c0)={0x14, &(0x7f0000000280)={0x20, 0x11, 0x91, {0x91, 0xd, "708870958e9f9a561f7f318b66217f613f2268410323f6485fa88aca08e351edaa0e83fa7114aa44bb71075eba6e79b5cc155906272d526987d6f39c365312fa15dee6c46ed8921b735df155578153a60f31ff4b46d97f76ff74bb78046eaef6e139832112bd45869317434021b12a29f8082ea2f11b204520eec399a6ba4f254282247854f46ef93d49712cc03bc8"}}, &(0x7f0000000400)={0x0, 0x3, 0x62, @string={0x62, 0x3, "c9915d8abe89e74d6a74fa905696da76075c0d7398a0957080a3627ef12560eb37c35b64534642d529169850b2fe567d472f560b3d59849b81e3d026a9e02c3f960df8bae4a9b15fbf17b362e3fb9d6e561ed59e01922b452dd974a22597452c"}}}, &(0x7f0000000800)={0x44, &(0x7f0000000500)={0x20, 0x5, 0xb9, "932976361ac5d7bef74eaa6d9416b3841beb0b17331c025c5788a19a54f950a3c24104e175747f049a729dd5429fd30da0e44eddf5395b120e69310cbf82d392eef8b2b0293b489e2fedce6c348c5dd2c1edb8dceaacd5a69349860640313c0ac4c537ad3337bce066c93ad68aff428c295d0a4f68f58c8b142f21fb1e770ad5e7276b99b8cb4594cb54ffcb7803d6679daf493459e9c3aa6c546cb15afa447893cdb9b3d3fecd53e001c741b07c9844c8f993fba03f756a78"}, &(0x7f00000005c0)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000600)={0x0, 0x8, 0x1, 0xb}, &(0x7f0000000640)={0x20, 0x81, 0x1, "1d"}, &(0x7f0000000700)={0x20, 0x82, 0x2, "0e35"}, &(0x7f0000000740)={0x20, 0x83, 0x1, '3'}, &(0x7f0000000780)={0x20, 0x84, 0x3, "b0b3e0"}, &(0x7f00000007c0)={0x20, 0x85, 0x3, "3fd258"}}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000680)={0x44, &(0x7f0000000340)=ANY=[@ANYBLOB="400cf20200"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash single: failed to extract reproducer bisect: bisecting 30 programs with base timeout 30s testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [25, 1, 7, 20, 30, 17, 18, 1, 4, 40, 16, 17, 10, 20, 7, 16, 30, 18, 16, 20, 13, 25, 30, 40, 3, 16, 16, 20, 30, 20] detailed listing: executing program 3: syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12011003cb86e440f71d002579260102030109021b0002030c150509040506316fc37029c415b707"], &(0x7f0000000ec0)={0x0, 0x0, 0x0, 0x0}) syz_usb_connect$uac1(0x6, 0xcc, &(0x7f0000000880)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xba, 0x3, 0x1, 0x4, 0x0, 0xfd, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x1, 0x27}, [@selector_unit={0xb, 0x24, 0x5, 0x3, 0x4, "ea7b0ec6f8ed"}, @output_terminal={0x9, 0x24, 0x3, 0x2, 0x400, 0x4, 0x6}, @output_terminal={0x9, 0x24, 0x3, 0x1, 0x307, 0x2, 0x1, 0x68}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0xb, 0x24, 0x2, 0x2, 0x8, 0x5, 0x68, "97f6"}]}, {{0x9, 0x5, 0x1, 0x9, 0x1ff, 0x7e, 0x8, 0x8, {0x7, 0x25, 0x1, 0x0, 0x0, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x8, 0x5, 0x9, 0x7f}, @as_header={0x7, 0x24, 0x1, 0xb, 0x4, 0x2}, @format_type_i_continuous={0xd, 0x24, 0x2, 0x1, 0x5, 0x2, 0x5, 0x5, 'RX', 'l __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 strlen+0x93/0xa0 lib/string.c:402 __fortify_strlen include/linux/fortify-string.h:218 [inline] drm_property_add_enum+0x2d/0x590 drivers/gpu/drm/drm_property.c:396 drm_mode_create_tv_properties_legacy+0x3e9/0x4c0 drivers/gpu/drm/drm_connector.c:2216 gud_connector_add_tv_mode+0x1d7/0x2b0 drivers/gpu/drm/gud/gud_connector.c:402 gud_connector_add_properties drivers/gpu/drm/gud/gud_connector.c:525 [inline] gud_connector_create drivers/gpu/drm/gud/gud_connector.c:680 [inline] gud_get_connectors+0xbd9/0x1700 drivers/gpu/drm/gud/gud_connector.c:717 gud_probe+0x17aa/0x1c20 drivers/gpu/drm/gud/gud_drv.c:635 usb_probe_interface+0x386/0x9b0 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 usb_set_configuration+0xd97/0x1c60 drivers/usb/core/message.c:2268 usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250 usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 usb_new_device.part.0+0xcc2/0x1686 drivers/usb/core/hub.c:2708 usb_new_device drivers/usb/core/hub.c:5833 [inline] hub_port_connect drivers/usb/core/hub.c:5580 [inline] hub_port_connect_change drivers/usb/core/hub.c:5720 [inline] port_event drivers/usb/core/hub.c:5884 [inline] hub_event.cold+0x51a/0xe9d drivers/usb/core/hub.c:5966 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322 process_scheduled_works kernel/workqueue.c:3405 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 3449: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x35e/0x670 mm/slub.c:5489 _kmalloc_noprof include/linux/slab.h:988 [inline] gud_connector_add_tv_mode+0xac/0x2b0 drivers/gpu/drm/gud/gud_connector.c:385 gud_connector_add_properties drivers/gpu/drm/gud/gud_connector.c:525 [inline] gud_connector_create drivers/gpu/drm/gud/gud_connector.c:680 [inline] gud_get_connectors+0xbd9/0x1700 drivers/gpu/drm/gud/gud_connector.c:717 gud_probe+0x17aa/0x1c20 drivers/gpu/drm/gud/gud_drv.c:635 usb_probe_interface+0x386/0x9b0 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 usb_set_configuration+0xd97/0x1c60 drivers/usb/core/message.c:2268 usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250 usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 usb_new_device.part.0+0xcc2/0x1686 drivers/usb/core/hub.c:2708 usb_new_device drivers/usb/core/hub.c:5833 [inline] hub_port_connect drivers/usb/core/hub.c:5580 [inline] hub_port_connect_change drivers/usb/core/hub.c:5720 [inline] port_event drivers/usb/core/hub.c:5884 [inline] hub_event.cold+0x51a/0xe9d drivers/usb/core/hub.c:5966 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322 process_scheduled_works kernel/workqueue.c:3405 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the object at ffff888118e1e200 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 0 bytes to the right of allocated 256-byte region [ffff888118e1e200, ffff888118e1e300) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118e1e head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x200000000000040(head|node=0|zone=2) page_type: f5(slab) raw: 0200000000000040 ffff888100041b40 dead000000000100 dead000000000122 raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 head: 0200000000000040 ffff888100041b40 dead000000000100 dead000000000122 head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 head: 0200000000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 2858, tgid 2858 (udevadm), ts 18986008443, free_ts 0 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf25/0x3400 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x28f/0x2b90 mm/page_alloc.c:5304 alloc_slab_page mm/slub.c:3266 [inline] allocate_slab mm/slub.c:3380 [inline] new_slab+0xa2/0x670 mm/slub.c:3426 refill_objects+0xe3/0x410 mm/slub.c:7310 refill_sheaf mm/slub.c:2804 [inline] __pcs_replace_empty_main+0x376/0x680 mm/slub.c:4675 alloc_from_pcs mm/slub.c:4773 [inline] slab_alloc_node mm/slub.c:4905 [inline] __kmalloc_cache_noprof+0x50e/0x670 mm/slub.c:5485 _kmalloc_noprof include/linux/slab.h:988 [inline] inode_doinit_use_xattr+0x54/0x330 security/selinux/hooks.c:1377 inode_doinit_with_dentry+0x10e6/0x1320 security/selinux/hooks.c:1572 selinux_d_instantiate+0x26/0x40 security/selinux/hooks.c:6678 security_d_instantiate+0x62/0xc0 security/security.c:3704 d_splice_alias_ops+0xd7/0x15c0 fs/dcache.c:3244 kernfs_iop_lookup+0x23f/0x2d0 fs/kernfs/dir.c:1288 lookup_open fs/namei.c:4481 [inline] open_last_lookups fs/namei.c:4608 [inline] path_openat+0x241f/0x4280 fs/namei.c:4860 do_file_open+0x20e/0x430 fs/namei.c:4892 do_sys_openat2+0x10f/0x1e0 fs/open.c:1368 page_owner free stack trace missing Memory state around the buggy address: ffff888118e1e200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888118e1e280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff888118e1e300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff888118e1e380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888118e1e400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== final repro crashed as (corrupted=false): usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 ================================================================== BUG: KASAN: slab-out-of-bounds in strlen+0x93/0xa0 lib/string.c:402 Read of size 1 at addr ffff888118e1e300 by task kworker/0:2/3449 CPU: 0 UID: 0 PID: 3449 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(lazy) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 strlen+0x93/0xa0 lib/string.c:402 __fortify_strlen include/linux/fortify-string.h:218 [inline] drm_property_add_enum+0x2d/0x590 drivers/gpu/drm/drm_property.c:396 drm_mode_create_tv_properties_legacy+0x3e9/0x4c0 drivers/gpu/drm/drm_connector.c:2216 gud_connector_add_tv_mode+0x1d7/0x2b0 drivers/gpu/drm/gud/gud_connector.c:402 gud_connector_add_properties drivers/gpu/drm/gud/gud_connector.c:525 [inline] gud_connector_create drivers/gpu/drm/gud/gud_connector.c:680 [inline] gud_get_connectors+0xbd9/0x1700 drivers/gpu/drm/gud/gud_connector.c:717 gud_probe+0x17aa/0x1c20 drivers/gpu/drm/gud/gud_drv.c:635 usb_probe_interface+0x386/0x9b0 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 usb_set_configuration+0xd97/0x1c60 drivers/usb/core/message.c:2268 usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250 usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 usb_new_device.part.0+0xcc2/0x1686 drivers/usb/core/hub.c:2708 usb_new_device drivers/usb/core/hub.c:5833 [inline] hub_port_connect drivers/usb/core/hub.c:5580 [inline] hub_port_connect_change drivers/usb/core/hub.c:5720 [inline] port_event drivers/usb/core/hub.c:5884 [inline] hub_event.cold+0x51a/0xe9d drivers/usb/core/hub.c:5966 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322 process_scheduled_works kernel/workqueue.c:3405 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 3449: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x35e/0x670 mm/slub.c:5489 _kmalloc_noprof include/linux/slab.h:988 [inline] gud_connector_add_tv_mode+0xac/0x2b0 drivers/gpu/drm/gud/gud_connector.c:385 gud_connector_add_properties drivers/gpu/drm/gud/gud_connector.c:525 [inline] gud_connector_create drivers/gpu/drm/gud/gud_connector.c:680 [inline] gud_get_connectors+0xbd9/0x1700 drivers/gpu/drm/gud/gud_connector.c:717 gud_probe+0x17aa/0x1c20 drivers/gpu/drm/gud/gud_drv.c:635 usb_probe_interface+0x386/0x9b0 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 usb_set_configuration+0xd97/0x1c60 drivers/usb/core/message.c:2268 usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250 usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 usb_new_device.part.0+0xcc2/0x1686 drivers/usb/core/hub.c:2708 usb_new_device drivers/usb/core/hub.c:5833 [inline] hub_port_connect drivers/usb/core/hub.c:5580 [inline] hub_port_connect_change drivers/usb/core/hub.c:5720 [inline] port_event drivers/usb/core/hub.c:5884 [inline] hub_event.cold+0x51a/0xe9d drivers/usb/core/hub.c:5966 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322 process_scheduled_works kernel/workqueue.c:3405 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the object at ffff888118e1e200 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 0 bytes to the right of allocated 256-byte region [ffff888118e1e200, ffff888118e1e300) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118e1e head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x200000000000040(head|node=0|zone=2) page_type: f5(slab) raw: 0200000000000040 ffff888100041b40 dead000000000100 dead000000000122 raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 head: 0200000000000040 ffff888100041b40 dead000000000100 dead000000000122 head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 head: 0200000000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 2858, tgid 2858 (udevadm), ts 18986008443, free_ts 0 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf25/0x3400 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x28f/0x2b90 mm/page_alloc.c:5304 alloc_slab_page mm/slub.c:3266 [inline] allocate_slab mm/slub.c:3380 [inline] new_slab+0xa2/0x670 mm/slub.c:3426 refill_objects+0xe3/0x410 mm/slub.c:7310 refill_sheaf mm/slub.c:2804 [inline] __pcs_replace_empty_main+0x376/0x680 mm/slub.c:4675 alloc_from_pcs mm/slub.c:4773 [inline] slab_alloc_node mm/slub.c:4905 [inline] __kmalloc_cache_noprof+0x50e/0x670 mm/slub.c:5485 _kmalloc_noprof include/linux/slab.h:988 [inline] inode_doinit_use_xattr+0x54/0x330 security/selinux/hooks.c:1377 inode_doinit_with_dentry+0x10e6/0x1320 security/selinux/hooks.c:1572 selinux_d_instantiate+0x26/0x40 security/selinux/hooks.c:6678 security_d_instantiate+0x62/0xc0 security/security.c:3704 d_splice_alias_ops+0xd7/0x15c0 fs/dcache.c:3244 kernfs_iop_lookup+0x23f/0x2d0 fs/kernfs/dir.c:1288 lookup_open fs/namei.c:4481 [inline] open_last_lookups fs/namei.c:4608 [inline] path_openat+0x241f/0x4280 fs/namei.c:4860 do_file_open+0x20e/0x430 fs/namei.c:4892 do_sys_openat2+0x10f/0x1e0 fs/open.c:1368 page_owner free stack trace missing Memory state around the buggy address: ffff888118e1e200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888118e1e280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff888118e1e300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff888118e1e380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888118e1e400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================