Extracting prog: 21m2.840192726s
Minimizing prog: 1h46m28.62794318s
Simplifying prog options: 0s
Extracting C: 1m31.042636252s
Simplifying C: 1h17m3.418708839s


extracting reproducer from 44 programs
testing a last program of every proc
single: executing 9 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$media-syz_open_procfs-socket$nl_generic-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$sndseq-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_genetlink_get_family_id$wireguard-ioctl$ifreq_SIOCGIFINDEX_wireguard-sendmsg$inet-sendmsg$WG_CMD_SET_DEVICE
detailed listing:
executing program 0:
syz_open_dev$media(0x0, 0x1, 0x101080)
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x18, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94)
openat$sndseq(0xffffffffffffff9c, 0x0, 0x1)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r1, 0x0, 0x1}, 0x18)
r2 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff)
ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000080)={'wg2\x00', <r3=>0x0})
sendmsg$inet(r0, 0x0, 0x2010)
sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)={0xa0, r2, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @a}, @WGDEVICE_A_PEERS={0x58, 0x8, 0x0, 0x1, [{0x54, 0x0, 0x0, 0x1, [@WGPEER_A_PRESHARED_KEY={0x24, 0x2, "2767b524f45e9dfaf001c414581741c92349c3b6661d9864680582bd184ef1a6"}, @WGPEER_A_ALLOWEDIPS={0x8, 0x9, 0x0, 0x1, [{0x4}]}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @neg}]}]}, @WGDEVICE_A_FWMARK={0x8}, @WGDEVICE_A_IFINDEX={0x8, 0x1, r3}]}, 0xa0}}, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-socket$nl_rdma-syz_init_net_socket$nl_rdma-prlimit64-socket$nl_netfilter-sched_setscheduler-sched_setaffinity-prctl$PR_SCHED_CORE-syz_open_dev$MSR-socket$kcm-sendmsg$kcm-read$msr-sendmsg$netlink-socket$inet_udp-ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL-ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL
detailed listing:
executing program 0:
syz_io_uring_setup(0xd0, &(0x7f0000000480)={0x0, 0x58dc, 0x80, 0x40000100}, &(0x7f00000000c0), 0x0)
socket$nl_rdma(0x10, 0x3, 0x14)
r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8d}, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
sched_setaffinity(0x0, 0xffffffffffffff1a, &(0x7f0000000200)=0x400000bce)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$kcm(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000500)=[{0x0}], 0x1}, 0x80)
read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8)
sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="140000002500010000000000f1000000"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x4)
r3 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x8000, 0x700, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x1, 0x14, 0x67, 0x0, 0x0, 0x29, 0x0, @multicast1, @empty}}}})
ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r3, 0x89f3, &(0x7f0000000940)={'gretap0\x00', &(0x7f0000000000)={'ip_vti0\x00', 0x0, 0x0, 0x0, 0x0, 0x2, {{0x7, 0x4, 0x0, 0x1, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @empty, {[@rr={0x7, 0x7, 0x33, [@multicast2]}]}}}}})

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$fuse-mount-chdir-openat$autofs-open-setfsuid-ioctl$vim2m_VIDIOC_S_FMT-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setscheduler-socket$inet_smc-setsockopt$inet_tcp_TCP_CONGESTION-listen-close-ioctl$AUTOFS_DEV_IOCTL_CATATONIC-newfstatat-getsockname$packet-openat$ipvs-accept4$alg-bpf$BPF_BTF_LOAD-sendmmsg$unix
detailed listing:
executing program 0:
mkdir(&(0x7f0000000040)='./file1\x00', 0x0)
mount$fuse(0x0, 0x0, 0x0, 0x30000, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0])
mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400))
chdir(&(0x7f0000000080)='./file1\x00')
r0 = openat$autofs(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0)
r1 = open(&(0x7f0000000000)='.\x00', 0x0, 0x244)
setfsuid(0xee00)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0)
r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, 0x2}, 0x94)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r3 = getpid()
sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
r6 = socket$inet_smc(0x2b, 0x1, 0x0)
setsockopt$inet_tcp_TCP_CONGESTION(r6, 0x6, 0xd, &(0x7f00000000c0)='bic\x00', 0x4)
listen(r6, 0x4001)
close(r6)
ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r0, 0xc0189379, &(0x7f0000000200)={{0x1, 0x1, 0x18, r1}, './file0\x00'})
newfstatat(0xffffffffffffff9c, &(0x7f00000001c0)='./file1/file0\x00', 0x0, 0x6000)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14)
r7 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/nat_icmp_send\x00', 0x2, 0x0)
r8 = accept4$alg(r1, 0x0, 0x0, 0x0)
r9 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f00000016c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xb8, 0xb8, 0xc, [@typedef={0x7, 0x0, 0x0, 0x8, 0x3}, @struct={0xf, 0x7, 0x0, 0x4, 0x0, 0xfffffffb, [{0x1, 0x5, 0x7}, {0xa, 0x2, 0x2}, {0x6, 0x4, 0xfffffff9}, {0x9, 0x3, 0x7e9}, {0xe, 0x2, 0x8}, {0x5, 0x0, 0x7}, {0x3, 0x1, 0x6}]}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x4, 0x4, 0x8}}, @func={0xa, 0x0, 0x0, 0xc, 0x1}, @int={0xb, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1c, 0x4}, @typedef={0xb, 0x0, 0x0, 0x8, 0x5}, @fwd={0x1}]}, {0x0, [0x5f, 0x30, 0x0, 0x61, 0x0, 0x61, 0x2e, 0x0, 0x2e, 0x0]}}, &(0x7f00000017c0)=""/233, 0xdc, 0xe9, 0x0, 0x400, 0x10000}, 0x28)
sendmmsg$unix(0xffffffffffffffff, &(0x7f0000001980)=[{{&(0x7f0000000300)=@abs={0x1, 0x0, 0x4e22}, 0x6e, &(0x7f0000001640)=[{&(0x7f0000000440)="c4dcadbfbf5e7d6e92aac275b917aed284f29f30e6fca1eedd56650ec493cf51baaca2b4fa99f6dfef641e69a7853a3b12fb87de689807c2f0eca82928751ab9ccc9bb4453dcc2dfe4dcceb5071fd2ee0d84a8051836877bc18734f5ecf7b3cb9c95dcb8966a103792581340e306887ae555a3134a5dfaaec0ad19b6b7e7778f466bf9e26269619abee11aa904881f6fd5b155de3a57d180dccb662c81008f4ebc52c688400dbf40158c35f14d158193940d627962d6af57568fdb50a635177e8e654aabfb82f2e457faa47c4be9187694e6ffe4e04b311db6e86e8a9e557dfa57355e75", 0xe4}, {&(0x7f0000000380)="7d18994dfef1bbd4e2216c95d799e7f275584b643803373688c5a4747b24098a8f02127169e2238b9742d2575bf4b28d574d8c073e2823f64d81dcbe7f7f1ce196a316548ac7c9746cfc99eb7b", 0x4d}, {&(0x7f0000000540)="b3b64d91fe7d40f96d7b99badd26610c7bc7640bf9b9a9d247b3a5a2ffc935eda3b779c3c51d98460ad3a9c69957b5a32f28f06bc35f7a89ba3e24c3c787d88f8177ff3283f0a5df9dca6e97ca01d4c9a9a7c7", 0x53}, {&(0x7f00000005c0)="614114a4713c633303c69e449f6c820f09414e843ff4337dcb3db671102e5fb98e7f0dbdb370148baf69dcb9ac0198387b0555be8d1841c10653e7be40c0c9c67247e7", 0x43}, {&(0x7f0000000640)="bb701d7fb5e297dd866fc80b06dd70f18a7e14271d7e7a09603e5016be38db7e8f29d776a311c54ce212614f535c37d68f6a71f67c0a935c2f8e9e00a9009710569d0f82eb71feddcf114c4bf5f46c03e076a2375c14103124768f07d2d0a02481a7cc38823860006c3709d0d7c072696ca525696e1da166e32db0f68b2cf940be4769d08def282eeb64768e97236064615e47a3804e7aee7ddccc6acbfc73daad95f9a380868dfe2f562ecc4367e1d8bd607eb87ee59669d9092be0f298514d00620897b9964ff0785c5e1b0ede60b59040f5e2ab7b125474a1e1f74ed32c450d690446ff3da5051a566c5a1ca29a6b067e9ce7fb35ccece59ec1f5ebaa62a1629ebcb51395d8f778b13d018d524a38ce24d2b73e96fc40e20f8e38e1b8334f2be2509403e9e4a78a61cd9ed211fe63bf9de8178b3047b69af793f5e360bfb1386519c94c0ce6e40364a61c8e0e4b430bd890f3dae5157b28b92ac2e0dcf450e32ca7bfee44829bcf7af38a5f072f15ba22f549511c865ef1270cecf24456490254979ac2ba81da6a1b6339bc30a07464c8d1f9d2a06192100fef0ed0697abb5913eb9ef00c55b817a1d31aeca7bbf25ac9768f4797da17c6f9cb9bc8dd525c7ac5b4316fcc7694e61a03985c8b532f73626f845f1da149a9222ea6ceb380607fc52e999a243fd7720ce8ebcbf89ac59dc20d336fefa8696595df2798406661f3df0e1e5efb6750dd8b7e5ec059422ca33768665cdae5be3bd9f352a6fe8eae6bd2eb70fbdd037f4feb50ddbc21ad66ccf71f06061417436019e0db5c868112ef6e06c5d13732dfee15fce8b3717800723fb801878dcdb0aa75ab8d6ee47a06b3285845d672c39ceaf1c5309f50cd7ecff853c53e694ee3d92090b2c33b86bf3f9298995a1668687152765f49291be5b3744a14a55616b069081b0d395440f712744bbd6ad17d30a45c5be5023c6d5a32fc4b48b2013e7a2ea7a8a5ea8ccb3c9a2602f8c7a797464fd0caa35b3a46bf02a02f224f10325ac297108fc455cc1277dd32fc73874c8dad20b0c6c92e18e2bec669aee71513bcb43f76b3e83ed2485b96668db9fceed8c09461238f791923c271988d04f464415a086c71f711a6428eacce21fcaccb5d1b9af4013107b41fef61b596ec0e32772131e39eb1e866bad0d13e1f44ac19319acd73fc7ef6f188918c5502fa9e24187eb00be8931512da9f2ef4cc9660844561e87738dfb81d492b86e096dbd2b3a6ab7929a6e9d29ff9601f8d56ae2310d944a7be63c3c19e465c27a924c9a2cc0360054759c008da534bcd3d97218b3a1a140f25aa1b84974ccfa26726a3804ca6eace1e3bc1f68d5186dabc398c359d0ef4223108ac1aa2865e906f54144d06896e5bbcbce7b18449139a3af1dcd0eb9d7526d0ccbf65c931db49d7059cd41a5d9c9d2e802f43ea71f6aa6559ba3dce2a5d8759625aa3312c11d126ad259414b4d18c2f2901e1d694e976a307597b894b5b5da1c8fd4a411aa5fd302d3f9ef6757f4940c2b5b16734e51dfa4fbb2be5a583091caf974bae037ddd04ad0eec157fc67af50c3de458e567a0abb4fd62ee01a3fd0fcb41d542b612079450a77b1fbf1e543b1e376e67881b16f7dc74df510392fc56e6c796386cf08025936bc56671f225821be944d48eb463ed7b5cfb81bb185dedfbcb39084d9304cfc525ee3ce48fc09d948e968b4b7527e73d98671d3697afffbe8c8e755c49da9ffaa3db18762e85d4f44333d9e119f729ca6a7db677dce4bb05e6029738bd5eaee047f38154a590330a20005cdca5260642d61a05bfb9f88231bd9c9e1c6e41f2185bf9b7fdd2062c44ef26dfcc5214caed55bddb63849b2f8b6447a1d8341898f3188cd54ce36bec651ec95db8f8d8faa3b58c2ba3952f1009f1cd9426fb4ecce165cee899e4fabd04ee6993099ae46bbea9fcc5d613279d848556081b57002dafa962a3480a106e06dde818d162e02891fd72d93a5a13566c25ec8e56e9d0ace3eaa7567234759b08ce2e51083d2e9f6a3f85f6013e66210012dacc661b0a65e7198113ff6b24458111dd14a77c88d06525a9339dcd07f87d4dacdfb6d156bec3104c0dc9b0c155e8902b88d67cd6314e1db4b45c1eede897b6e2793609c31cf26c3781167c233e7b0dc056e206faf5cf6c820d9664cb3b4f8eb84d2c7e0d4caac323c0ef8dd83343274aed25f72a7b7f4df807ac1f030ed95e91ad3e5dc168df3b5b4649be4057173de990b4726f0975c403294b72b338abcbe8fa3801d0dd9778d0e9c840c3b03f4ddb3f8ad060a8861e33f945213d5d17a82095a5dbc0929053bdb1976243519e665ceaf191fa07872a32aefea5abd86b511e03bdcf920d6830f3e859849ad60b1e8c207374e320670fd04cda7c502532547d32cfe642dbae565404bd7b33725fe56ac03406c6bf624a0783b7fc7bef8657539426af10d977e1446952f208262fecb434faccc83233a2624fa0c507a71d7fc9987857a2699c148425a781a008d1dc8b702e99f63e78eeedf39a736a1f09b4160eeae6d5bf1bbda8669d56025fc9e51a03c254664be511e059589e8c97bfd29da7360097241f5a666f3531f3f8520c3872c636868bd35df1d3232e7a453d1ad4214d13214f51694557cfdca6be59ac28c49f5e0813b4b17d8fa2c0c3f46ddbecf8adccc3780380d630cb4c4d814c3e87ece8baa6aee74e2e21353291ceb6e607341f092aee1f13007f916a9211f635aed7fc96c936c3f45b977d8994a3c7d9b2b31bc140c58536f76a31d43955139be887ccb3510185ab1c2a17e419b8f8b6ed851734347568c5ed508dc76b81cd6f6f24f606d8a2d6eabb7ec46548754b1b7a0b1ecb79ab1ddaf9d58316600f764bd0d2d5a7f70ca8210b85640ea3a11aaca9f18b38ffde57f902ed5fbeb8ec30e7c9be8a72b73be5c4f14634a54e7fac75c4d0d418132a5b311faa0a1af47527eb5a74230d31e541d30fc28d221a8baf34856e7b895279f80ade0750466df653fe71b7274808f0bbd377dcbb9b17f54d11f95443acabb2d6d7726d1c7bf4061cb8c911efd84843c6fc878350cf5b26e0ddecc64aaa2286e9439578e0768aa90c9f77bca78e13a0b2223c4bf145a33edddf30e6d8cc7360ae93de24d84139d3f1a3193d847c69c7e4b8303c8b6f3151fd33318e638d45e254435cb38d5b36b81e55a0de17123cbba09b73ecf638a0d7d2eb732df3891440d2c9d214025e3b5493d83cee7f02ebe1baee27d351d43b9363f47ea0b81782a562fd25c80097810387856cdef752f861285f7db9eadaae3f43837bef6d9b4c2e1c2a2e43383dcb7e6c61aabf9c9c4b46cdbe80bf6f11c212f4f183d2cbc576cdf9c6f8b6442e2beb673aa4b30872c7cb67e5fd787abb6677ab6a0d5c9efd0823ae633a1532bdfbe1da6715bba9aaf791c4b731ca0ca912b4d9ba5f001186fc679e2c6bbcb543c8ad32184fb3fdd035f6e3da17b8a75abcc8c4e1c1c5cfc8dd6509f7790c289803fdea05a3cf45e1df27122c2280e49b35a7afdd9cc70947f46d47bbe9fc89d9f17d9085201948093c2d30836492e61f2aed9e2589bfe841005bcea11a0457884a970c81c36fc3bcbfd7352e604f9d9602032e468b57b0bfc87118b15859a78b294e2e4c7b4a530a1808517f283dad1a5079b9740b83132bc8602616af0a81565b7bafb2a872f6453d2219d7a8f2a981b21799e76cc98a16486821c69303d5d021395ec5c35979c2d11fef044b5cc4e8d04598112c30ec07501fc569d35d3633a7965f742897ce5538ede8a0a96fbb813da7579f37e9d4bcd453c2e3623be4011e3a9f332e830d436b3e3aadeff9dfcfcf77e1b887cb3d4f4a2d01c2e267ff145010c73599e90dd8b9983981d435a73f8d500fe35ae67cf194b6fe849a3ffcd9a1525f78ef8b9f518abb6ace3e39cce4ffd25b7c4c6ac46b902571c5fb440970c8368d16e1314efbe2b27e0bec0c4afac727763c679c3b371d6e6b13523891d76af3a7478410d41a86ad2948eee4c9d9dc278160daded899ec6c4bad32b599e3d26ece5a5222954fe768fb9a02a643212d2e6722e09bfb0a8610ecebecab51e5d646f0d5d5ebcc76f703574899e5d81064842ddc657c70fc68341d14cc4cf446eb57cb05ef2382e469797e4223be37e572ea1ada6396321b84551717e4e2ac86ffa909015fd4861f02a11143a3d24ca713132b2306f94884106504326434280abb37b2866b8f3d051bb113ff3a5d22658cfb7ad49237e615fc68fc739606f3a22067b7249f03917482586e2f4ea6e90f8d7a0cbf7900129bb829e7d68af37d949232eaaa30493af9617300887ea39fc5398c184edbb0f92b61ebaaf81814a44df7b12d1a0cad7d1b5e2f9b8e9437d4c77e19d0430f8d57c987cd68134578bdba576dada17a22e814c71cf0b04018d4c3d07193581a3b6496abb509159e5a2f8eb939af2a91a458bae2bc3e4d3b894253e9048d7c2d86ab94e70fb5b0a24170015e92d1a827b9868904b9b34652796644bfa4cbd689024f4b44908f2e4da5149260219cc24d59db703d9e2cc00a8d635f9e999175cbeaeacf882368a54778a26de071d9ef7c80bc1aa400694f8f291cf8505348deb758978e24e01be75c7190c9fbeb6fa26c608d1f03e408a6e35187304a7707ef0e73c065c8453cd06a33a708492dae3b4386447ed9f3d6d7cf69c34d0c73ea72766d9984276236e3f07db8f0d601c2b138e888b2c49a6d7e2ebf54319e06958701899e11d25db335cd91107519de92bfcfaedfe284f29ba74d115cbd8cb2e9fa0b3e8d783a39e2ecf549899dfa5d8775896836464829c1f621e854f6b52f7617c6cddb75294dd09186cc60ac47904c118c01a032411158a4946b1b4d29e0f3ab87005373f65067e5fbeb5d39b38efe1ef91f5137b3402a92d490c641c0c7447d5d486462802989196c5b723aa68e6f67619760e1d2df6c028a1f8906f20d4e3e6ced7d244ec115369c846f08501b5938023a3c0107a2233fa5935603b415c6d3399f7b11741bfcec898fd887da537966c39493c207da89dfa2b7dabb1b7550b5348b0a55e3dd253b0bf8747e84bffa5602b472b5363b61704013e244eb50d654e81ffe841bc10e038421627499552a348b92fe206a408d02dcb6a09ef0269e0bc0e149980b6cc8269acba6eeef775d19444638eeec3ac2608f940fc22a12ac622583939832f221d90bc6364ca7e24982c443e939a5c4dc64c95a93dfc617d35b9fe4ca28ffaa259d1c522672bad7816ecd6f141b8fe600a7fed0af2eaa46e718595eb5fdecbd56c9ec041f807b70f1d521b603461ebf77c5a2aeae5b3f330b9ced0d2c48f188900f44fb21e899c3b575f8f37682dd010867b002c82fac1bf2e23a5285819197d070e4b925b62550d8132c150fb9afa1dc0679ecef77206cc94450ad641ce66f7fd0584525ba2cf465cd35f1a6af554d2db56427f0c4d2cd9db1af994296955222bde2d0ddde2f5bf342b5753e02692368f1550c52adeca04439a84bf7c666a610f83684bfeacb9f61e191055f238be24398905e18b262dae9d387decb6051221db2de4784e5c4edc3e54bae3658329f704f995ff7d4523c6a4a0c6255bb9759f9a9f6dacfadbd58d7a20a7fc64f1a9b5172ae790fb225a4d18dac5ae84e5472d2f5f1876da98c32bb718190a5fd26aeb477b241fad4b0f187b8a2fc2b2c94ee51fd92035bf5ec8c45979e8d3f6e59492c257a5f494bc88d6e3d754c666cd245e704530e3b7bbeab3aec018c89", 0x1000}], 0x5, &(0x7f00000018c0)=[@rights={{0x24, 0x1, 0x1, [r6, r6, r5, r6, r7]}}, @rights={{0x18, 0x1, 0x1, [r4, r4]}}, @rights={{0x2c, 0x1, 0x1, [r8, r2, r6, r4, r1, r2, r2]}}, @rights={{0x20, 0x1, 0x1, [r9, r2, r0, r6]}}], 0x90, 0x4040846}}], 0x1, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-ioctl$F2FS_IOC_START_VOLATILE_WRITE-syz_usb_connect-syz_usb_control_io-syz_open_dev$tty1-ioctl$KIOCSOUND-syz_init_net_socket$bt_hci-socket$nl_route-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MSRS-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r2=>0x0})
r3 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r1, r2}, 0x10)
syz_emit_ethernet(0x3e, &(0x7f0000000000)={@empty, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xc, 0x0, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x66, 0x3, 0x0, 0x2f, 0x6, @remote, @loopback}}}}}}, 0x0)
ioctl$F2FS_IOC_START_VOLATILE_WRITE(r3, 0xf503, 0x0)
r4 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io(r4, 0x0, 0x0)
r5 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r5, 0x4b2f, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r6 = socket$nl_route(0x10, 0x3, 0x0)
r7 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0)
r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0)
r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x1)
ioctl$KVM_SET_MSRS(r9, 0xc008ae88, &(0x7f0000000080)=ANY=[@ANYBLOB])
sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x0)

program crashed: WARNING in cm109_urb_irq_callback/usb_submit_urb
single: successfully extracted reproducer
found reproducer with 18 syscalls
minimizing guilty program
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-ioctl$F2FS_IOC_START_VOLATILE_WRITE-syz_usb_connect-syz_usb_control_io-syz_open_dev$tty1-ioctl$KIOCSOUND-syz_init_net_socket$bt_hci-socket$nl_route-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MSRS
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r2=>0x0})
r3 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r1, r2}, 0x10)
syz_emit_ethernet(0x3e, &(0x7f0000000000)={@empty, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xc, 0x0, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x66, 0x3, 0x0, 0x2f, 0x6, @remote, @loopback}}}}}}, 0x0)
ioctl$F2FS_IOC_START_VOLATILE_WRITE(r3, 0xf503, 0x0)
r4 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io(r4, 0x0, 0x0)
r5 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r5, 0x4b2f, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
socket$nl_route(0x10, 0x3, 0x0)
r6 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x1)
ioctl$KVM_SET_MSRS(r8, 0xc008ae88, &(0x7f0000000080)=ANY=[@ANYBLOB])

program crashed: WARNING in cm109_urb_irq_callback/usb_submit_urb
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-ioctl$F2FS_IOC_START_VOLATILE_WRITE-syz_usb_connect-syz_usb_control_io-syz_open_dev$tty1-ioctl$KIOCSOUND-syz_init_net_socket$bt_hci-socket$nl_route-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r2=>0x0})
r3 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r1, r2}, 0x10)
syz_emit_ethernet(0x3e, &(0x7f0000000000)={@empty, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xc, 0x0, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x66, 0x3, 0x0, 0x2f, 0x6, @remote, @loopback}}}}}}, 0x0)
ioctl$F2FS_IOC_START_VOLATILE_WRITE(r3, 0xf503, 0x0)
r4 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io(r4, 0x0, 0x0)
r5 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r5, 0x4b2f, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
socket$nl_route(0x10, 0x3, 0x0)
r6 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x1)

program crashed: WARNING in cm109_urb_irq_callback/usb_submit_urb
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-ioctl$F2FS_IOC_START_VOLATILE_WRITE-syz_usb_connect-syz_usb_control_io-syz_open_dev$tty1-ioctl$KIOCSOUND-syz_init_net_socket$bt_hci-socket$nl_route-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r2=>0x0})
r3 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r1, r2}, 0x10)
syz_emit_ethernet(0x3e, &(0x7f0000000000)={@empty, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xc, 0x0, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x66, 0x3, 0x0, 0x2f, 0x6, @remote, @loopback}}}}}}, 0x0)
ioctl$F2FS_IOC_START_VOLATILE_WRITE(r3, 0xf503, 0x0)
r4 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io(r4, 0x0, 0x0)
r5 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r5, 0x4b2f, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
socket$nl_route(0x10, 0x3, 0x0)
r6 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)

program crashed: WARNING in cm109_urb_irq_callback/usb_submit_urb
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-ioctl$F2FS_IOC_START_VOLATILE_WRITE-syz_usb_connect-syz_usb_control_io-syz_open_dev$tty1-ioctl$KIOCSOUND-syz_init_net_socket$bt_hci-socket$nl_route-openat$kvm-ioctl$KVM_CREATE_VM
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r2=>0x0})
r3 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r1, r2}, 0x10)
syz_emit_ethernet(0x3e, &(0x7f0000000000)={@empty, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xc, 0x0, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x66, 0x3, 0x0, 0x2f, 0x6, @remote, @loopback}}}}}}, 0x0)
ioctl$F2FS_IOC_START_VOLATILE_WRITE(r3, 0xf503, 0x0)
r4 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io(r4, 0x0, 0x0)
r5 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r5, 0x4b2f, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
socket$nl_route(0x10, 0x3, 0x0)
r6 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)

program crashed: WARNING in cm109_urb_irq_callback/usb_submit_urb
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-ioctl$F2FS_IOC_START_VOLATILE_WRITE-syz_usb_connect-syz_usb_control_io-syz_open_dev$tty1-ioctl$KIOCSOUND-syz_init_net_socket$bt_hci-socket$nl_route-openat$kvm
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r2=>0x0})
r3 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r1, r2}, 0x10)
syz_emit_ethernet(0x3e, &(0x7f0000000000)={@empty, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xc, 0x0, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x66, 0x3, 0x0, 0x2f, 0x6, @remote, @loopback}}}}}}, 0x0)
ioctl$F2FS_IOC_START_VOLATILE_WRITE(r3, 0xf503, 0x0)
r4 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io(r4, 0x0, 0x0)
r5 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r5, 0x4b2f, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
socket$nl_route(0x10, 0x3, 0x0)
openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)

program crashed: WARNING in cm109_urb_irq_callback/usb_submit_urb
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-ioctl$F2FS_IOC_START_VOLATILE_WRITE-syz_usb_connect-syz_usb_control_io-syz_open_dev$tty1-ioctl$KIOCSOUND-syz_init_net_socket$bt_hci-socket$nl_route
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r2=>0x0})
r3 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r1, r2}, 0x10)
syz_emit_ethernet(0x3e, &(0x7f0000000000)={@empty, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xc, 0x0, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x66, 0x3, 0x0, 0x2f, 0x6, @remote, @loopback}}}}}}, 0x0)
ioctl$F2FS_IOC_START_VOLATILE_WRITE(r3, 0xf503, 0x0)
r4 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io(r4, 0x0, 0x0)
r5 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r5, 0x4b2f, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
socket$nl_route(0x10, 0x3, 0x0)

program crashed: WARNING in cm109_urb_irq_callback/usb_submit_urb
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-ioctl$F2FS_IOC_START_VOLATILE_WRITE-syz_usb_connect-syz_usb_control_io-syz_open_dev$tty1-ioctl$KIOCSOUND-syz_init_net_socket$bt_hci
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r2=>0x0})
r3 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r1, r2}, 0x10)
syz_emit_ethernet(0x3e, &(0x7f0000000000)={@empty, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xc, 0x0, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x66, 0x3, 0x0, 0x2f, 0x6, @remote, @loopback}}}}}}, 0x0)
ioctl$F2FS_IOC_START_VOLATILE_WRITE(r3, 0xf503, 0x0)
r4 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io(r4, 0x0, 0x0)
r5 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r5, 0x4b2f, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)

program crashed: WARNING in cm109_urb_irq_callback/usb_submit_urb
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-ioctl$F2FS_IOC_START_VOLATILE_WRITE-syz_usb_connect-syz_usb_control_io-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r2=>0x0})
r3 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r1, r2}, 0x10)
syz_emit_ethernet(0x3e, &(0x7f0000000000)={@empty, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xc, 0x0, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x66, 0x3, 0x0, 0x2f, 0x6, @remote, @loopback}}}}}}, 0x0)
ioctl$F2FS_IOC_START_VOLATILE_WRITE(r3, 0xf503, 0x0)
r4 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io(r4, 0x0, 0x0)
r5 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r5, 0x4b2f, 0x0)

program crashed: WARNING in cm109_urb_irq_callback/usb_submit_urb
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-ioctl$F2FS_IOC_START_VOLATILE_WRITE-syz_usb_connect-syz_usb_control_io-syz_open_dev$tty1
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r2=>0x0})
r3 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r1, r2}, 0x10)
syz_emit_ethernet(0x3e, &(0x7f0000000000)={@empty, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xc, 0x0, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x66, 0x3, 0x0, 0x2f, 0x6, @remote, @loopback}}}}}}, 0x0)
ioctl$F2FS_IOC_START_VOLATILE_WRITE(r3, 0xf503, 0x0)
r4 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io(r4, 0x0, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x1)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-ioctl$F2FS_IOC_START_VOLATILE_WRITE-syz_usb_connect-syz_usb_control_io-ioctl$KIOCSOUND
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r2=>0x0})
r3 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r1, r2}, 0x10)
syz_emit_ethernet(0x3e, &(0x7f0000000000)={@empty, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xc, 0x0, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x66, 0x3, 0x0, 0x2f, 0x6, @remote, @loopback}}}}}}, 0x0)
ioctl$F2FS_IOC_START_VOLATILE_WRITE(r3, 0xf503, 0x0)
r4 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io(r4, 0x0, 0x0)
ioctl$KIOCSOUND(0xffffffffffffffff, 0x4b2f, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-ioctl$F2FS_IOC_START_VOLATILE_WRITE-syz_usb_connect-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r2=>0x0})
r3 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r1, r2}, 0x10)
syz_emit_ethernet(0x3e, &(0x7f0000000000)={@empty, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xc, 0x0, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x66, 0x3, 0x0, 0x2f, 0x6, @remote, @loopback}}}}}}, 0x0)
ioctl$F2FS_IOC_START_VOLATILE_WRITE(r3, 0xf503, 0x0)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
r4 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r4, 0x4b2f, 0x0)

program crashed: WARNING in cm109_input_open/usb_submit_urb
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-ioctl$F2FS_IOC_START_VOLATILE_WRITE-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r2=>0x0})
r3 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r1, r2}, 0x10)
syz_emit_ethernet(0x3e, &(0x7f0000000000)={@empty, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xc, 0x0, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x66, 0x3, 0x0, 0x2f, 0x6, @remote, @loopback}}}}}}, 0x0)
ioctl$F2FS_IOC_START_VOLATILE_WRITE(r3, 0xf503, 0x0)
r4 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r4, 0x4b2f, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-syz_usb_connect-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r2=>0x0})
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r1, r2}, 0x10)
syz_emit_ethernet(0x3e, &(0x7f0000000000)={@empty, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xc, 0x0, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x66, 0x3, 0x0, 0x2f, 0x6, @remote, @loopback}}}}}}, 0x0)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
r3 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r3, 0x4b2f, 0x0)

program crashed: BUG: corrupted list in usb_hcd_link_urb_to_ep
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_usb_connect-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r2=>0x0})
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r1, r2}, 0x10)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
r3 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r3, 0x4b2f, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-syz_emit_ethernet-syz_usb_connect-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00'})
syz_emit_ethernet(0x3e, &(0x7f0000000000)={@empty, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xc, 0x0, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x66, 0x3, 0x0, 0x2f, 0x6, @remote, @loopback}}}}}}, 0x0)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r1, 0x4b2f, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-syz_usb_connect-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r0}, 0x10)
syz_emit_ethernet(0x3e, &(0x7f0000000000)={@empty, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xc, 0x0, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x66, 0x3, 0x0, 0x2f, 0x6, @remote, @loopback}}}}}}, 0x0)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r1, 0x4b2f, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-syz_usb_connect-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r1=>0x0})
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={0xffffffffffffffff, r1}, 0x10)
syz_emit_ethernet(0x3e, &(0x7f0000000000)={@empty, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xc, 0x0, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x66, 0x3, 0x0, 0x2f, 0x6, @remote, @loopback}}}}}}, 0x0)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
r2 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r2, 0x4b2f, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-syz_usb_connect-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r1=>0x0})
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r0, r1}, 0x10)
syz_emit_ethernet(0x3e, &(0x7f0000000000)={@empty, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xc, 0x0, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x66, 0x3, 0x0, 0x2f, 0x6, @remote, @loopback}}}}}}, 0x0)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
r2 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r2, 0x4b2f, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-syz_usb_connect-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0)
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r1}, 0x10)
syz_emit_ethernet(0x3e, &(0x7f0000000000)={@empty, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xc, 0x0, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x66, 0x3, 0x0, 0x2f, 0x6, @remote, @loopback}}}}}}, 0x0)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
r2 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r2, 0x4b2f, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-syz_usb_connect-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00'})
bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0)
syz_emit_ethernet(0x3e, &(0x7f0000000000)={@empty, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xc, 0x0, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x66, 0x3, 0x0, 0x2f, 0x6, @remote, @loopback}}}}}}, 0x0)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r1, 0x4b2f, 0x0)

program crashed: BUG: corrupted list in usb_hcd_link_urb_to_ep
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-syz_usb_connect-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00'})
bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r1, 0x4b2f, 0x0)

program crashed: BUG: corrupted list in usb_hcd_link_urb_to_ep
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-syz_usb_connect-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00'})
bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
syz_usb_connect(0x0, 0x2d, 0x0, 0x0)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r1, 0x4b2f, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-syz_usb_connect-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00'})
bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB], 0x0)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r1, 0x4b2f, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-syz_usb_connect-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00'})
bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB, @ANYBLOB="8fcf"], 0x0)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r1, 0x4b2f, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-syz_usb_connect-syz_open_dev$tty1-ioctl$KIOCSOUND
program crashed: WARNING in cm109_input_open/usb_submit_urb
simplifying C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-syz_usb_connect-syz_open_dev$tty1-ioctl$KIOCSOUND
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-syz_usb_connect-syz_open_dev$tty1-ioctl$KIOCSOUND
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-syz_usb_connect-syz_open_dev$tty1-ioctl$KIOCSOUND
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-syz_usb_connect-syz_open_dev$tty1-ioctl$KIOCSOUND
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-syz_usb_connect-syz_open_dev$tty1-ioctl$KIOCSOUND
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-syz_usb_connect-syz_open_dev$tty1-ioctl$KIOCSOUND
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-syz_usb_connect-syz_open_dev$tty1-ioctl$KIOCSOUND
program crashed: WARNING in cm109_input_open/usb_submit_urb
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-syz_usb_connect-syz_open_dev$tty1-ioctl$KIOCSOUND
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-syz_usb_connect-syz_open_dev$tty1-ioctl$KIOCSOUND
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-syz_usb_connect-syz_open_dev$tty1-ioctl$KIOCSOUND
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-syz_usb_connect-syz_open_dev$tty1-ioctl$KIOCSOUND
program crashed: BUG: corrupted list in usb_hcd_link_urb_to_ep
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-syz_usb_connect-syz_open_dev$tty1-ioctl$KIOCSOUND
program crashed: WARNING in cm109_input_open/usb_submit_urb
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-syz_usb_connect-syz_open_dev$tty1-ioctl$KIOCSOUND
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-syz_usb_connect-syz_open_dev$tty1-ioctl$KIOCSOUND
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-syz_usb_connect-syz_open_dev$tty1-ioctl$KIOCSOUND
program crashed: WARNING in cm109_input_open/usb_submit_urb
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-syz_usb_connect-syz_open_dev$tty1-ioctl$KIOCSOUND
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
reproducing took 3h26m5.929515456s
repro crashed as (corrupted=false):
cm109 2-1:0.8: invalid payload size 0, expected 4
input: CM109 USB driver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.8/input/input206
------------[ cut here ]------------
URB ffff8880604e3700 submitted while active
WARNING: CPU: 1 PID: 917 at drivers/usb/core/urb.c:379 usb_submit_urb+0x152b/0x1790 drivers/usb/core/urb.c:379
Modules linked in:
CPU: 1 UID: 0 PID: 917 Comm: kworker/1:2 Not tainted 6.16.0-rc3-syzkaller-00044-g7595b66ae9de #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_submit_urb+0x152b/0x1790 drivers/usb/core/urb.c:379
Code: fd eb cb bb fe ff ff ff e9 70 f3 ff ff e8 8d 8c 86 fa c6 05 cf ea 5a 09 01 90 48 c7 c7 00 1c 73 8c 48 89 de e8 86 4f 45 fa 90 <0f> 0b 90 90 e9 b6 fe ff ff bb f8 ff ff ff e9 40 f3 ff ff 48 89 ef
RSP: 0018:ffffc90003a16e98 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff8880604e3700 RCX: ffffffff817ae248
RDX: ffff888026ba0000 RSI: ffffffff817ae255 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: ffff88803176b810
R13: ffff88803176b8a0 R14: ffff88803176b850 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff888124852000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5e65291110 CR3: 000000001b961000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 cm109_input_open+0x271/0x480 drivers/input/misc/cm109.c:566
 input_open_device+0x230/0x390 drivers/input/input.c:600
 kbd_connect+0x103/0x160 drivers/tty/vt/keyboard.c:1584
 input_attach_handler.isra.0+0x181/0x260 drivers/input/input.c:993
 input_register_device+0xa84/0x1130 drivers/input/input.c:2412
 cm109_usb_probe+0x122f/0x17c0 drivers/input/misc/cm109.c:797
 usb_probe_interface+0x303/0x9c0 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:579 [inline]
 really_probe+0x241/0xa90 drivers/base/dd.c:657
 __driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
 __device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:462
 __device_attach+0x1e4/0x4b0 drivers/base/dd.c:1029
 bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
 device_add+0x1148/0x1a70 drivers/base/core.c:3692
 usb_set_configuration+0x1187/0x1e20 drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0xb1/0x110 drivers/usb/core/generic.c:250
 usb_probe_device+0xef/0x3e0 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:579 [inline]
 really_probe+0x241/0xa90 drivers/base/dd.c:657
 __driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
 __device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:462
 __device_attach+0x1e4/0x4b0 drivers/base/dd.c:1029
 bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
 device_add+0x1148/0x1a70 drivers/base/core.c:3692
 usb_new_device+0xd07/0x1a20 drivers/usb/core/hub.c:2663
 hub_port_connect drivers/usb/core/hub.c:5535 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5675 [inline]
 port_event drivers/usb/core/hub.c:5835 [inline]
 hub_event+0x2eb7/0x4fa0 drivers/usb/core/hub.c:5917
 process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3321 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
 kthread+0x3c2/0x780 kernel/kthread.c:464
 ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

final repro crashed as (corrupted=false):
cm109 2-1:0.8: invalid payload size 0, expected 4
input: CM109 USB driver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.8/input/input206
------------[ cut here ]------------
URB ffff8880604e3700 submitted while active
WARNING: CPU: 1 PID: 917 at drivers/usb/core/urb.c:379 usb_submit_urb+0x152b/0x1790 drivers/usb/core/urb.c:379
Modules linked in:
CPU: 1 UID: 0 PID: 917 Comm: kworker/1:2 Not tainted 6.16.0-rc3-syzkaller-00044-g7595b66ae9de #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_submit_urb+0x152b/0x1790 drivers/usb/core/urb.c:379
Code: fd eb cb bb fe ff ff ff e9 70 f3 ff ff e8 8d 8c 86 fa c6 05 cf ea 5a 09 01 90 48 c7 c7 00 1c 73 8c 48 89 de e8 86 4f 45 fa 90 <0f> 0b 90 90 e9 b6 fe ff ff bb f8 ff ff ff e9 40 f3 ff ff 48 89 ef
RSP: 0018:ffffc90003a16e98 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff8880604e3700 RCX: ffffffff817ae248
RDX: ffff888026ba0000 RSI: ffffffff817ae255 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: ffff88803176b810
R13: ffff88803176b8a0 R14: ffff88803176b850 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff888124852000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5e65291110 CR3: 000000001b961000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 cm109_input_open+0x271/0x480 drivers/input/misc/cm109.c:566
 input_open_device+0x230/0x390 drivers/input/input.c:600
 kbd_connect+0x103/0x160 drivers/tty/vt/keyboard.c:1584
 input_attach_handler.isra.0+0x181/0x260 drivers/input/input.c:993
 input_register_device+0xa84/0x1130 drivers/input/input.c:2412
 cm109_usb_probe+0x122f/0x17c0 drivers/input/misc/cm109.c:797
 usb_probe_interface+0x303/0x9c0 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:579 [inline]
 really_probe+0x241/0xa90 drivers/base/dd.c:657
 __driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
 __device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:462
 __device_attach+0x1e4/0x4b0 drivers/base/dd.c:1029
 bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
 device_add+0x1148/0x1a70 drivers/base/core.c:3692
 usb_set_configuration+0x1187/0x1e20 drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0xb1/0x110 drivers/usb/core/generic.c:250
 usb_probe_device+0xef/0x3e0 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:579 [inline]
 really_probe+0x241/0xa90 drivers/base/dd.c:657
 __driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
 __device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:462
 __device_attach+0x1e4/0x4b0 drivers/base/dd.c:1029
 bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
 device_add+0x1148/0x1a70 drivers/base/core.c:3692
 usb_new_device+0xd07/0x1a20 drivers/usb/core/hub.c:2663
 hub_port_connect drivers/usb/core/hub.c:5535 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5675 [inline]
 port_event drivers/usb/core/hub.c:5835 [inline]
 hub_event+0x2eb7/0x4fa0 drivers/usb/core/hub.c:5917
 process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3321 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
 kthread+0x3c2/0x780 kernel/kthread.c:464
 ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>