Extracting prog: 6m23.728475181s
Minimizing prog: 46m31.386467633s
Simplifying prog options: 3m8.618249507s
Extracting C: 1m51.651700309s
Simplifying C: 10m43.027538664s


extracting reproducer from 42 programs
testing a last program of every proc
single: executing 7 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_SET_STRING
detailed listing:
executing program 0:
r0 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='source\x00', 0x0, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$key-socket$nl_generic-prlimit64-bpf$PROG_LOAD-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-timerfd_create-sendmsg$key-sendmsg$key-sendmmsg
detailed listing:
executing program 0:
r0 = socket$key(0xf, 0x3, 0x2)
socket$nl_generic(0x10, 0x3, 0x10)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8)
r1 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
timerfd_create(0x9, 0x0)
sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0)
sendmsg$key(r0, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="02030609100000000000004c9e0000000200130002000000da16c167d803f1f805000600200000000a00060000000000ff0000000000000000001ffeff0001000003f1dc7f7c6e7c0200010000000000004000020000000005000500000000000a"], 0x80}}, 0x0)
sendmmsg(r0, &(0x7f0000000180), 0x400008a, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-sendmmsg$unix-sched_setattr-dup-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN-sendmsg-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-bpf$MAP_LOOKUP_BATCH
detailed listing:
executing program 0:
socketpair$unix(0x1, 0x3, 0x0, 0x0)
sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0)
sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0)
dup(0xffffffffffffffff)
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(0xffffffffffffffff, 0x3ba0, &(0x7f0000000100)={0x48})
sendmsg(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="f8000000000000000b01000003000000b38ad0fa5344f86392a8a624588a9ebd811192cbcbc48c43148a7cc72909723e83e74508dbd62d2652d78d6acf62b5eb8f161c8b04b3b2b547119b38e2badd726674a4693c080fe5c3492cb155656387a02c999695975d3d6137c986cb152d529c9225c772f2f854bf5ab89e259312dacf6b9debd2bf43be3dc19840f0c35b2d960ac50a9f2bcf98156f76700462166d7eb6416b2a7510be974b3f7a06c8927e28a62f708cce515c9c922c8c0c8daf4646e725d7282571b819097b58963d71992c2938f34c3516c547423d99a2f90f3a146a044cb732f4f4a0305c9d37fcb667e50000000000000028000000000000000000000000080000c133a12a91872b3730467c92a3a5050f02b82b0000000000500000000000000012010000ff030000ae15b1a3e016bb782adb738fa764d4487026530ac6f50e3b31ec875a38f17bac40e87117dbd6ba47cf721b216e5b8cb28d424f1b5ed9793f510000000000000028000000000000000a010000630a0000fa08ab919987305c8ad63785f4a4cb222436d50000000000100010000000000013010000090000006d8a8d100000000000000010010000040000005ea02cce80948ddbc5fc431709bb3c7637cd850c7d499c6c7f646556dae4149c416b46ca963bf1e82dedce1076c0f6977719364bf5e56410c1adcdfa56d37de0de7f51e3d77d91009a2be0fb597444fdc4736fb7a6b4a61cd9137c9d6273d7d519350f29bcd844c49df431e667cd1dacb7"], 0x1b8}, 0x4000c010)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0100000005000000fd0900008400000005", @ANYRES32=0x0], 0x50)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0xffffffffffffffff, 0x0, &(0x7f00000000c0), &(0x7f0000000240), 0x800, r0}, 0x38)
bpf$MAP_LOOKUP_BATCH(0x19, 0x0, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mknodat$null-memfd_secret-prctl$PR_SET_SYSCALL_USER_DISPATCH_ON-futimesat-openat$fuse-socket$nl_xfrm-sendmsg$nl_xfrm-ioctl$UBLK_U_CMD_END_USER_RECOVERY-openat$ublk_ctrl-syz_ublk_setup_io_uring-ioctl$UBLK_U_CMD_START_DEV-tgkill-mount$fuse-syz_fuse_handle_req-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-openat$iommufd-socket$nl_route-openat$tun-ioctl$TUNSETIFF-socket$unix-write-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103)
r1 = memfd_secret(0x0)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x63b1, &(0x7f0000006680))
futimesat(r1, 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x13c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in6=@empty, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e20, 0x0, 0x4e21, 0x2, 0xa, 0x0, 0x0, 0x21, 0x0, 0xee00}, {@in=@rand_addr=0x64010102, 0x4d6, 0x32}, @in=@multicast2, {0x0, 0x5, 0x0, 0x9, 0xffffffff00000005, 0x0, 0x80000001, 0x543}, {0x4, 0x7fffffffffffffff, 0x3, 0x1}, {0xffffffff}, 0x70bd2c, 0x3500, 0x2, 0x0, 0x0, 0x40}, [@algo_aead={0x4c, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x0, 0x40}}]}, 0x13c}, 0x1, 0x0, 0x0, 0x880}, 0x2014)
ioctl$UBLK_U_CMD_END_USER_RECOVERY(r1, 0xc0207511, &(0x7f00000004c0)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff})
openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r4 = syz_ublk_setup_io_uring(0x5a42, &(0x7f0000000040)={0x0, 0x0, 0x10, 0x1}, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140))
ioctl$UBLK_U_CMD_START_DEV(r1, 0xc0207506, &(0x7f00000005c0)={0x0, 0xffff, 0x0, 0x0, <r5=>0x0})
tgkill(0x0, r5, 0x2)
mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x12100b, &(0x7f00000007c0)=ANY=[@ANYRESHEX=0x0, @ANYRESHEX=r2, @ANYRESDEC=0x0, @ANYRES8=r4, @ANYRESDEC=0x0])
syz_fuse_handle_req(r2, 0x0, 0x0, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)={0x130, 0x0, 0x9, {0xffffffffffffffff, 0x40000008, 0x0, '\x00', {0x7ff, 0x1, 0x1, 0x800, 0xee01, 0x0, 0x1000, '\x00', 0xa, 0x8000, 0xb4ea, 0x4, {0x88007, 0xfffffff9}, {0xc7, 0x7f4a}, {0x1, 0x9}, {0x200000008, 0x9}, 0x8000, 0x4, 0x0, 0x9}}}})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0)
r6 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0)
ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x1})
socket$unix(0x1, 0x3, 0x0)
write(r7, &(0x7f0000000140)="000008004500001c123400004011e5c8ac141401ac14140204d204d2", 0x1c)
ioctl$HIDIOCSREPORT(r6, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program crashed: memory leak in __usbhid_submit_report
single: successfully extracted reproducer
found reproducer with 25 syscalls
minimizing guilty program
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mknodat$null-memfd_secret-prctl$PR_SET_SYSCALL_USER_DISPATCH_ON-futimesat-openat$fuse-socket$nl_xfrm-sendmsg$nl_xfrm-ioctl$UBLK_U_CMD_END_USER_RECOVERY-openat$ublk_ctrl-syz_ublk_setup_io_uring-ioctl$UBLK_U_CMD_START_DEV-tgkill-mount$fuse-syz_fuse_handle_req-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-openat$iommufd-socket$nl_route-openat$tun-ioctl$TUNSETIFF-socket$unix-write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103)
r1 = memfd_secret(0x0)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x63b1, &(0x7f0000006680))
futimesat(r1, 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x13c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in6=@empty, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e20, 0x0, 0x4e21, 0x2, 0xa, 0x0, 0x0, 0x21, 0x0, 0xee00}, {@in=@rand_addr=0x64010102, 0x4d6, 0x32}, @in=@multicast2, {0x0, 0x5, 0x0, 0x9, 0xffffffff00000005, 0x0, 0x80000001, 0x543}, {0x4, 0x7fffffffffffffff, 0x3, 0x1}, {0xffffffff}, 0x70bd2c, 0x3500, 0x2, 0x0, 0x0, 0x40}, [@algo_aead={0x4c, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x0, 0x40}}]}, 0x13c}, 0x1, 0x0, 0x0, 0x880}, 0x2014)
ioctl$UBLK_U_CMD_END_USER_RECOVERY(r1, 0xc0207511, &(0x7f00000004c0)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff})
openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r4 = syz_ublk_setup_io_uring(0x5a42, &(0x7f0000000040)={0x0, 0x0, 0x10, 0x1}, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140))
ioctl$UBLK_U_CMD_START_DEV(r1, 0xc0207506, &(0x7f00000005c0)={0x0, 0xffff, 0x0, 0x0, <r5=>0x0})
tgkill(0x0, r5, 0x2)
mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x12100b, &(0x7f00000007c0)=ANY=[@ANYRESHEX=0x0, @ANYRESHEX=r2, @ANYRESDEC=0x0, @ANYRES8=r4, @ANYRESDEC=0x0])
syz_fuse_handle_req(r2, 0x0, 0x0, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)={0x130, 0x0, 0x9, {0xffffffffffffffff, 0x40000008, 0x0, '\x00', {0x7ff, 0x1, 0x1, 0x800, 0xee01, 0x0, 0x1000, '\x00', 0xa, 0x8000, 0xb4ea, 0x4, {0x88007, 0xfffffff9}, {0xc7, 0x7f4a}, {0x1, 0x9}, {0x200000008, 0x9}, 0x8000, 0x4, 0x0, 0x9}}}})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0)
syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0)
ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x1})
socket$unix(0x1, 0x3, 0x0)
write(r6, &(0x7f0000000140)="000008004500001c123400004011e5c8ac141401ac14140204d204d2", 0x1c)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mknodat$null-memfd_secret-prctl$PR_SET_SYSCALL_USER_DISPATCH_ON-futimesat-openat$fuse-socket$nl_xfrm-sendmsg$nl_xfrm-ioctl$UBLK_U_CMD_END_USER_RECOVERY-openat$ublk_ctrl-syz_ublk_setup_io_uring-ioctl$UBLK_U_CMD_START_DEV-tgkill-mount$fuse-syz_fuse_handle_req-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-openat$iommufd-socket$nl_route-openat$tun-ioctl$TUNSETIFF-socket$unix-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103)
r1 = memfd_secret(0x0)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x63b1, &(0x7f0000006680))
futimesat(r1, 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x13c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in6=@empty, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e20, 0x0, 0x4e21, 0x2, 0xa, 0x0, 0x0, 0x21, 0x0, 0xee00}, {@in=@rand_addr=0x64010102, 0x4d6, 0x32}, @in=@multicast2, {0x0, 0x5, 0x0, 0x9, 0xffffffff00000005, 0x0, 0x80000001, 0x543}, {0x4, 0x7fffffffffffffff, 0x3, 0x1}, {0xffffffff}, 0x70bd2c, 0x3500, 0x2, 0x0, 0x0, 0x40}, [@algo_aead={0x4c, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x0, 0x40}}]}, 0x13c}, 0x1, 0x0, 0x0, 0x880}, 0x2014)
ioctl$UBLK_U_CMD_END_USER_RECOVERY(r1, 0xc0207511, &(0x7f00000004c0)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff})
openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r4 = syz_ublk_setup_io_uring(0x5a42, &(0x7f0000000040)={0x0, 0x0, 0x10, 0x1}, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140))
ioctl$UBLK_U_CMD_START_DEV(r1, 0xc0207506, &(0x7f00000005c0)={0x0, 0xffff, 0x0, 0x0, <r5=>0x0})
tgkill(0x0, r5, 0x2)
mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x12100b, &(0x7f00000007c0)=ANY=[@ANYRESHEX=0x0, @ANYRESHEX=r2, @ANYRESDEC=0x0, @ANYRES8=r4, @ANYRESDEC=0x0])
syz_fuse_handle_req(r2, 0x0, 0x0, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)={0x130, 0x0, 0x9, {0xffffffffffffffff, 0x40000008, 0x0, '\x00', {0x7ff, 0x1, 0x1, 0x800, 0xee01, 0x0, 0x1000, '\x00', 0xa, 0x8000, 0xb4ea, 0x4, {0x88007, 0xfffffff9}, {0xc7, 0x7f4a}, {0x1, 0x9}, {0x200000008, 0x9}, 0x8000, 0x4, 0x0, 0x9}}}})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0)
r6 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0)
ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x1})
socket$unix(0x1, 0x3, 0x0)
ioctl$HIDIOCSREPORT(r6, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program crashed: memory leak in __usbhid_submit_report
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mknodat$null-memfd_secret-prctl$PR_SET_SYSCALL_USER_DISPATCH_ON-futimesat-openat$fuse-socket$nl_xfrm-sendmsg$nl_xfrm-ioctl$UBLK_U_CMD_END_USER_RECOVERY-openat$ublk_ctrl-syz_ublk_setup_io_uring-ioctl$UBLK_U_CMD_START_DEV-tgkill-mount$fuse-syz_fuse_handle_req-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-openat$iommufd-socket$nl_route-openat$tun-ioctl$TUNSETIFF-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103)
r1 = memfd_secret(0x0)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x63b1, &(0x7f0000006680))
futimesat(r1, 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x13c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in6=@empty, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e20, 0x0, 0x4e21, 0x2, 0xa, 0x0, 0x0, 0x21, 0x0, 0xee00}, {@in=@rand_addr=0x64010102, 0x4d6, 0x32}, @in=@multicast2, {0x0, 0x5, 0x0, 0x9, 0xffffffff00000005, 0x0, 0x80000001, 0x543}, {0x4, 0x7fffffffffffffff, 0x3, 0x1}, {0xffffffff}, 0x70bd2c, 0x3500, 0x2, 0x0, 0x0, 0x40}, [@algo_aead={0x4c, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x0, 0x40}}]}, 0x13c}, 0x1, 0x0, 0x0, 0x880}, 0x2014)
ioctl$UBLK_U_CMD_END_USER_RECOVERY(r1, 0xc0207511, &(0x7f00000004c0)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff})
openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r4 = syz_ublk_setup_io_uring(0x5a42, &(0x7f0000000040)={0x0, 0x0, 0x10, 0x1}, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140))
ioctl$UBLK_U_CMD_START_DEV(r1, 0xc0207506, &(0x7f00000005c0)={0x0, 0xffff, 0x0, 0x0, <r5=>0x0})
tgkill(0x0, r5, 0x2)
mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x12100b, &(0x7f00000007c0)=ANY=[@ANYRESHEX=0x0, @ANYRESHEX=r2, @ANYRESDEC=0x0, @ANYRES8=r4, @ANYRESDEC=0x0])
syz_fuse_handle_req(r2, 0x0, 0x0, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)={0x130, 0x0, 0x9, {0xffffffffffffffff, 0x40000008, 0x0, '\x00', {0x7ff, 0x1, 0x1, 0x800, 0xee01, 0x0, 0x1000, '\x00', 0xa, 0x8000, 0xb4ea, 0x4, {0x88007, 0xfffffff9}, {0xc7, 0x7f4a}, {0x1, 0x9}, {0x200000008, 0x9}, 0x8000, 0x4, 0x0, 0x9}}}})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0)
r6 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0)
ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x1})
ioctl$HIDIOCSREPORT(r6, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program crashed: memory leak in __usbhid_submit_report
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mknodat$null-memfd_secret-prctl$PR_SET_SYSCALL_USER_DISPATCH_ON-futimesat-openat$fuse-socket$nl_xfrm-sendmsg$nl_xfrm-ioctl$UBLK_U_CMD_END_USER_RECOVERY-openat$ublk_ctrl-syz_ublk_setup_io_uring-ioctl$UBLK_U_CMD_START_DEV-tgkill-mount$fuse-syz_fuse_handle_req-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-openat$iommufd-socket$nl_route-openat$tun-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103)
r1 = memfd_secret(0x0)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x63b1, &(0x7f0000006680))
futimesat(r1, 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x13c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in6=@empty, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e20, 0x0, 0x4e21, 0x2, 0xa, 0x0, 0x0, 0x21, 0x0, 0xee00}, {@in=@rand_addr=0x64010102, 0x4d6, 0x32}, @in=@multicast2, {0x0, 0x5, 0x0, 0x9, 0xffffffff00000005, 0x0, 0x80000001, 0x543}, {0x4, 0x7fffffffffffffff, 0x3, 0x1}, {0xffffffff}, 0x70bd2c, 0x3500, 0x2, 0x0, 0x0, 0x40}, [@algo_aead={0x4c, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x0, 0x40}}]}, 0x13c}, 0x1, 0x0, 0x0, 0x880}, 0x2014)
ioctl$UBLK_U_CMD_END_USER_RECOVERY(r1, 0xc0207511, &(0x7f00000004c0)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff})
openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r4 = syz_ublk_setup_io_uring(0x5a42, &(0x7f0000000040)={0x0, 0x0, 0x10, 0x1}, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140))
ioctl$UBLK_U_CMD_START_DEV(r1, 0xc0207506, &(0x7f00000005c0)={0x0, 0xffff, 0x0, 0x0, <r5=>0x0})
tgkill(0x0, r5, 0x2)
mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x12100b, &(0x7f00000007c0)=ANY=[@ANYRESHEX=0x0, @ANYRESHEX=r2, @ANYRESDEC=0x0, @ANYRES8=r4, @ANYRESDEC=0x0])
syz_fuse_handle_req(r2, 0x0, 0x0, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)={0x130, 0x0, 0x9, {0xffffffffffffffff, 0x40000008, 0x0, '\x00', {0x7ff, 0x1, 0x1, 0x800, 0xee01, 0x0, 0x1000, '\x00', 0xa, 0x8000, 0xb4ea, 0x4, {0x88007, 0xfffffff9}, {0xc7, 0x7f4a}, {0x1, 0x9}, {0x200000008, 0x9}, 0x8000, 0x4, 0x0, 0x9}}}})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0)
r6 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0)
ioctl$HIDIOCSREPORT(r6, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program crashed: memory leak in __usbhid_submit_report
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mknodat$null-memfd_secret-prctl$PR_SET_SYSCALL_USER_DISPATCH_ON-futimesat-openat$fuse-socket$nl_xfrm-sendmsg$nl_xfrm-ioctl$UBLK_U_CMD_END_USER_RECOVERY-openat$ublk_ctrl-syz_ublk_setup_io_uring-ioctl$UBLK_U_CMD_START_DEV-tgkill-mount$fuse-syz_fuse_handle_req-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-openat$iommufd-socket$nl_route-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103)
r1 = memfd_secret(0x0)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x63b1, &(0x7f0000006680))
futimesat(r1, 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x13c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in6=@empty, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e20, 0x0, 0x4e21, 0x2, 0xa, 0x0, 0x0, 0x21, 0x0, 0xee00}, {@in=@rand_addr=0x64010102, 0x4d6, 0x32}, @in=@multicast2, {0x0, 0x5, 0x0, 0x9, 0xffffffff00000005, 0x0, 0x80000001, 0x543}, {0x4, 0x7fffffffffffffff, 0x3, 0x1}, {0xffffffff}, 0x70bd2c, 0x3500, 0x2, 0x0, 0x0, 0x40}, [@algo_aead={0x4c, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x0, 0x40}}]}, 0x13c}, 0x1, 0x0, 0x0, 0x880}, 0x2014)
ioctl$UBLK_U_CMD_END_USER_RECOVERY(r1, 0xc0207511, &(0x7f00000004c0)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff})
openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r4 = syz_ublk_setup_io_uring(0x5a42, &(0x7f0000000040)={0x0, 0x0, 0x10, 0x1}, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140))
ioctl$UBLK_U_CMD_START_DEV(r1, 0xc0207506, &(0x7f00000005c0)={0x0, 0xffff, 0x0, 0x0, <r5=>0x0})
tgkill(0x0, r5, 0x2)
mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x12100b, &(0x7f00000007c0)=ANY=[@ANYRESHEX=0x0, @ANYRESHEX=r2, @ANYRESDEC=0x0, @ANYRES8=r4, @ANYRESDEC=0x0])
syz_fuse_handle_req(r2, 0x0, 0x0, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)={0x130, 0x0, 0x9, {0xffffffffffffffff, 0x40000008, 0x0, '\x00', {0x7ff, 0x1, 0x1, 0x800, 0xee01, 0x0, 0x1000, '\x00', 0xa, 0x8000, 0xb4ea, 0x4, {0x88007, 0xfffffff9}, {0xc7, 0x7f4a}, {0x1, 0x9}, {0x200000008, 0x9}, 0x8000, 0x4, 0x0, 0x9}}}})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0)
r6 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
ioctl$HIDIOCSREPORT(r6, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program crashed: memory leak in __usbhid_submit_report
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mknodat$null-memfd_secret-prctl$PR_SET_SYSCALL_USER_DISPATCH_ON-futimesat-openat$fuse-socket$nl_xfrm-sendmsg$nl_xfrm-ioctl$UBLK_U_CMD_END_USER_RECOVERY-openat$ublk_ctrl-syz_ublk_setup_io_uring-ioctl$UBLK_U_CMD_START_DEV-tgkill-mount$fuse-syz_fuse_handle_req-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-openat$iommufd-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103)
r1 = memfd_secret(0x0)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x63b1, &(0x7f0000006680))
futimesat(r1, 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x13c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in6=@empty, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e20, 0x0, 0x4e21, 0x2, 0xa, 0x0, 0x0, 0x21, 0x0, 0xee00}, {@in=@rand_addr=0x64010102, 0x4d6, 0x32}, @in=@multicast2, {0x0, 0x5, 0x0, 0x9, 0xffffffff00000005, 0x0, 0x80000001, 0x543}, {0x4, 0x7fffffffffffffff, 0x3, 0x1}, {0xffffffff}, 0x70bd2c, 0x3500, 0x2, 0x0, 0x0, 0x40}, [@algo_aead={0x4c, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x0, 0x40}}]}, 0x13c}, 0x1, 0x0, 0x0, 0x880}, 0x2014)
ioctl$UBLK_U_CMD_END_USER_RECOVERY(r1, 0xc0207511, &(0x7f00000004c0)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff})
openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r4 = syz_ublk_setup_io_uring(0x5a42, &(0x7f0000000040)={0x0, 0x0, 0x10, 0x1}, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140))
ioctl$UBLK_U_CMD_START_DEV(r1, 0xc0207506, &(0x7f00000005c0)={0x0, 0xffff, 0x0, 0x0, <r5=>0x0})
tgkill(0x0, r5, 0x2)
mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x12100b, &(0x7f00000007c0)=ANY=[@ANYRESHEX=0x0, @ANYRESHEX=r2, @ANYRESDEC=0x0, @ANYRES8=r4, @ANYRESDEC=0x0])
syz_fuse_handle_req(r2, 0x0, 0x0, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)={0x130, 0x0, 0x9, {0xffffffffffffffff, 0x40000008, 0x0, '\x00', {0x7ff, 0x1, 0x1, 0x800, 0xee01, 0x0, 0x1000, '\x00', 0xa, 0x8000, 0xb4ea, 0x4, {0x88007, 0xfffffff9}, {0xc7, 0x7f4a}, {0x1, 0x9}, {0x200000008, 0x9}, 0x8000, 0x4, 0x0, 0x9}}}})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0)
r6 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$HIDIOCSREPORT(r6, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program crashed: memory leak in __usbhid_submit_report
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mknodat$null-memfd_secret-prctl$PR_SET_SYSCALL_USER_DISPATCH_ON-futimesat-openat$fuse-socket$nl_xfrm-sendmsg$nl_xfrm-ioctl$UBLK_U_CMD_END_USER_RECOVERY-openat$ublk_ctrl-syz_ublk_setup_io_uring-ioctl$UBLK_U_CMD_START_DEV-tgkill-mount$fuse-syz_fuse_handle_req-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103)
r1 = memfd_secret(0x0)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x63b1, &(0x7f0000006680))
futimesat(r1, 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x13c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in6=@empty, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e20, 0x0, 0x4e21, 0x2, 0xa, 0x0, 0x0, 0x21, 0x0, 0xee00}, {@in=@rand_addr=0x64010102, 0x4d6, 0x32}, @in=@multicast2, {0x0, 0x5, 0x0, 0x9, 0xffffffff00000005, 0x0, 0x80000001, 0x543}, {0x4, 0x7fffffffffffffff, 0x3, 0x1}, {0xffffffff}, 0x70bd2c, 0x3500, 0x2, 0x0, 0x0, 0x40}, [@algo_aead={0x4c, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x0, 0x40}}]}, 0x13c}, 0x1, 0x0, 0x0, 0x880}, 0x2014)
ioctl$UBLK_U_CMD_END_USER_RECOVERY(r1, 0xc0207511, &(0x7f00000004c0)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff})
openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r4 = syz_ublk_setup_io_uring(0x5a42, &(0x7f0000000040)={0x0, 0x0, 0x10, 0x1}, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140))
ioctl$UBLK_U_CMD_START_DEV(r1, 0xc0207506, &(0x7f00000005c0)={0x0, 0xffff, 0x0, 0x0, <r5=>0x0})
tgkill(0x0, r5, 0x2)
mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x12100b, &(0x7f00000007c0)=ANY=[@ANYRESHEX=0x0, @ANYRESHEX=r2, @ANYRESDEC=0x0, @ANYRES8=r4, @ANYRESDEC=0x0])
syz_fuse_handle_req(r2, 0x0, 0x0, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)={0x130, 0x0, 0x9, {0xffffffffffffffff, 0x40000008, 0x0, '\x00', {0x7ff, 0x1, 0x1, 0x800, 0xee01, 0x0, 0x1000, '\x00', 0xa, 0x8000, 0xb4ea, 0x4, {0x88007, 0xfffffff9}, {0xc7, 0x7f4a}, {0x1, 0x9}, {0x200000008, 0x9}, 0x8000, 0x4, 0x0, 0x9}}}})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0)
r6 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r6, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program crashed: memory leak in __usbhid_submit_report
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mknodat$null-memfd_secret-prctl$PR_SET_SYSCALL_USER_DISPATCH_ON-futimesat-openat$fuse-socket$nl_xfrm-sendmsg$nl_xfrm-ioctl$UBLK_U_CMD_END_USER_RECOVERY-openat$ublk_ctrl-syz_ublk_setup_io_uring-ioctl$UBLK_U_CMD_START_DEV-tgkill-mount$fuse-syz_fuse_handle_req-syz_usb_control_io$hid-syz_usb_control_io$hid-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103)
r1 = memfd_secret(0x0)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x63b1, &(0x7f0000006680))
futimesat(r1, 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x13c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in6=@empty, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e20, 0x0, 0x4e21, 0x2, 0xa, 0x0, 0x0, 0x21, 0x0, 0xee00}, {@in=@rand_addr=0x64010102, 0x4d6, 0x32}, @in=@multicast2, {0x0, 0x5, 0x0, 0x9, 0xffffffff00000005, 0x0, 0x80000001, 0x543}, {0x4, 0x7fffffffffffffff, 0x3, 0x1}, {0xffffffff}, 0x70bd2c, 0x3500, 0x2, 0x0, 0x0, 0x40}, [@algo_aead={0x4c, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x0, 0x40}}]}, 0x13c}, 0x1, 0x0, 0x0, 0x880}, 0x2014)
ioctl$UBLK_U_CMD_END_USER_RECOVERY(r1, 0xc0207511, &(0x7f00000004c0)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff})
openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r4 = syz_ublk_setup_io_uring(0x5a42, &(0x7f0000000040)={0x0, 0x0, 0x10, 0x1}, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140))
ioctl$UBLK_U_CMD_START_DEV(r1, 0xc0207506, &(0x7f00000005c0)={0x0, 0xffff, 0x0, 0x0, <r5=>0x0})
tgkill(0x0, r5, 0x2)
mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x12100b, &(0x7f00000007c0)=ANY=[@ANYRESHEX=0x0, @ANYRESHEX=r2, @ANYRESDEC=0x0, @ANYRES8=r4, @ANYRESDEC=0x0])
syz_fuse_handle_req(r2, 0x0, 0x0, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)={0x130, 0x0, 0x9, {0xffffffffffffffff, 0x40000008, 0x0, '\x00', {0x7ff, 0x1, 0x1, 0x800, 0xee01, 0x0, 0x1000, '\x00', 0xa, 0x8000, 0xb4ea, 0x4, {0x88007, 0xfffffff9}, {0xc7, 0x7f4a}, {0x1, 0x9}, {0x200000008, 0x9}, 0x8000, 0x4, 0x0, 0x9}}}})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0)
ioctl$HIDIOCSREPORT(0xffffffffffffffff, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mknodat$null-memfd_secret-prctl$PR_SET_SYSCALL_USER_DISPATCH_ON-futimesat-openat$fuse-socket$nl_xfrm-sendmsg$nl_xfrm-ioctl$UBLK_U_CMD_END_USER_RECOVERY-openat$ublk_ctrl-syz_ublk_setup_io_uring-ioctl$UBLK_U_CMD_START_DEV-tgkill-mount$fuse-syz_fuse_handle_req-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103)
r1 = memfd_secret(0x0)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x63b1, &(0x7f0000006680))
futimesat(r1, 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x13c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in6=@empty, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e20, 0x0, 0x4e21, 0x2, 0xa, 0x0, 0x0, 0x21, 0x0, 0xee00}, {@in=@rand_addr=0x64010102, 0x4d6, 0x32}, @in=@multicast2, {0x0, 0x5, 0x0, 0x9, 0xffffffff00000005, 0x0, 0x80000001, 0x543}, {0x4, 0x7fffffffffffffff, 0x3, 0x1}, {0xffffffff}, 0x70bd2c, 0x3500, 0x2, 0x0, 0x0, 0x40}, [@algo_aead={0x4c, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x0, 0x40}}]}, 0x13c}, 0x1, 0x0, 0x0, 0x880}, 0x2014)
ioctl$UBLK_U_CMD_END_USER_RECOVERY(r1, 0xc0207511, &(0x7f00000004c0)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff})
openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r4 = syz_ublk_setup_io_uring(0x5a42, &(0x7f0000000040)={0x0, 0x0, 0x10, 0x1}, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140))
ioctl$UBLK_U_CMD_START_DEV(r1, 0xc0207506, &(0x7f00000005c0)={0x0, 0xffff, 0x0, 0x0, <r5=>0x0})
tgkill(0x0, r5, 0x2)
mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x12100b, &(0x7f00000007c0)=ANY=[@ANYRESHEX=0x0, @ANYRESHEX=r2, @ANYRESDEC=0x0, @ANYRES8=r4, @ANYRESDEC=0x0])
syz_fuse_handle_req(r2, 0x0, 0x0, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)={0x130, 0x0, 0x9, {0xffffffffffffffff, 0x40000008, 0x0, '\x00', {0x7ff, 0x1, 0x1, 0x800, 0xee01, 0x0, 0x1000, '\x00', 0xa, 0x8000, 0xb4ea, 0x4, {0x88007, 0xfffffff9}, {0xc7, 0x7f4a}, {0x1, 0x9}, {0x200000008, 0x9}, 0x8000, 0x4, 0x0, 0x9}}}})
syz_usb_control_io$hid(r0, 0x0, 0x0)
r6 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r6, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mknodat$null-memfd_secret-prctl$PR_SET_SYSCALL_USER_DISPATCH_ON-futimesat-openat$fuse-socket$nl_xfrm-sendmsg$nl_xfrm-ioctl$UBLK_U_CMD_END_USER_RECOVERY-openat$ublk_ctrl-syz_ublk_setup_io_uring-ioctl$UBLK_U_CMD_START_DEV-tgkill-mount$fuse-syz_fuse_handle_req-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103)
r1 = memfd_secret(0x0)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x63b1, &(0x7f0000006680))
futimesat(r1, 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x13c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in6=@empty, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e20, 0x0, 0x4e21, 0x2, 0xa, 0x0, 0x0, 0x21, 0x0, 0xee00}, {@in=@rand_addr=0x64010102, 0x4d6, 0x32}, @in=@multicast2, {0x0, 0x5, 0x0, 0x9, 0xffffffff00000005, 0x0, 0x80000001, 0x543}, {0x4, 0x7fffffffffffffff, 0x3, 0x1}, {0xffffffff}, 0x70bd2c, 0x3500, 0x2, 0x0, 0x0, 0x40}, [@algo_aead={0x4c, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x0, 0x40}}]}, 0x13c}, 0x1, 0x0, 0x0, 0x880}, 0x2014)
ioctl$UBLK_U_CMD_END_USER_RECOVERY(r1, 0xc0207511, &(0x7f00000004c0)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff})
openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r4 = syz_ublk_setup_io_uring(0x5a42, &(0x7f0000000040)={0x0, 0x0, 0x10, 0x1}, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140))
ioctl$UBLK_U_CMD_START_DEV(r1, 0xc0207506, &(0x7f00000005c0)={0x0, 0xffff, 0x0, 0x0, <r5=>0x0})
tgkill(0x0, r5, 0x2)
mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x12100b, &(0x7f00000007c0)=ANY=[@ANYRESHEX=0x0, @ANYRESHEX=r2, @ANYRESDEC=0x0, @ANYRES8=r4, @ANYRESDEC=0x0])
syz_fuse_handle_req(r2, 0x0, 0x0, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)={0x130, 0x0, 0x9, {0xffffffffffffffff, 0x40000008, 0x0, '\x00', {0x7ff, 0x1, 0x1, 0x800, 0xee01, 0x0, 0x1000, '\x00', 0xa, 0x8000, 0xb4ea, 0x4, {0x88007, 0xfffffff9}, {0xc7, 0x7f4a}, {0x1, 0x9}, {0x200000008, 0x9}, 0x8000, 0x4, 0x0, 0x9}}}})
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0)
r6 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r6, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mknodat$null-memfd_secret-prctl$PR_SET_SYSCALL_USER_DISPATCH_ON-futimesat-openat$fuse-socket$nl_xfrm-sendmsg$nl_xfrm-ioctl$UBLK_U_CMD_END_USER_RECOVERY-openat$ublk_ctrl-syz_ublk_setup_io_uring-ioctl$UBLK_U_CMD_START_DEV-tgkill-mount$fuse-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103)
r1 = memfd_secret(0x0)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x63b1, &(0x7f0000006680))
futimesat(r1, 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x13c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in6=@empty, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e20, 0x0, 0x4e21, 0x2, 0xa, 0x0, 0x0, 0x21, 0x0, 0xee00}, {@in=@rand_addr=0x64010102, 0x4d6, 0x32}, @in=@multicast2, {0x0, 0x5, 0x0, 0x9, 0xffffffff00000005, 0x0, 0x80000001, 0x543}, {0x4, 0x7fffffffffffffff, 0x3, 0x1}, {0xffffffff}, 0x70bd2c, 0x3500, 0x2, 0x0, 0x0, 0x40}, [@algo_aead={0x4c, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x0, 0x40}}]}, 0x13c}, 0x1, 0x0, 0x0, 0x880}, 0x2014)
ioctl$UBLK_U_CMD_END_USER_RECOVERY(r1, 0xc0207511, &(0x7f00000004c0)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff})
openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r4 = syz_ublk_setup_io_uring(0x5a42, &(0x7f0000000040)={0x0, 0x0, 0x10, 0x1}, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140))
ioctl$UBLK_U_CMD_START_DEV(r1, 0xc0207506, &(0x7f00000005c0)={0x0, 0xffff, 0x0, 0x0, <r5=>0x0})
tgkill(0x0, r5, 0x2)
mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x12100b, &(0x7f00000007c0)=ANY=[@ANYRESHEX=0x0, @ANYRESHEX=r2, @ANYRESDEC=0x0, @ANYRES8=r4, @ANYRESDEC=0x0])
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0)
r6 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r6, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program crashed: memory leak in __usbhid_submit_report
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mknodat$null-memfd_secret-prctl$PR_SET_SYSCALL_USER_DISPATCH_ON-futimesat-openat$fuse-socket$nl_xfrm-sendmsg$nl_xfrm-ioctl$UBLK_U_CMD_END_USER_RECOVERY-openat$ublk_ctrl-syz_ublk_setup_io_uring-ioctl$UBLK_U_CMD_START_DEV-tgkill-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103)
r1 = memfd_secret(0x0)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x63b1, &(0x7f0000006680))
futimesat(r1, 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x13c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in6=@empty, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e20, 0x0, 0x4e21, 0x2, 0xa, 0x0, 0x0, 0x21, 0x0, 0xee00}, {@in=@rand_addr=0x64010102, 0x4d6, 0x32}, @in=@multicast2, {0x0, 0x5, 0x0, 0x9, 0xffffffff00000005, 0x0, 0x80000001, 0x543}, {0x4, 0x7fffffffffffffff, 0x3, 0x1}, {0xffffffff}, 0x70bd2c, 0x3500, 0x2, 0x0, 0x0, 0x40}, [@algo_aead={0x4c, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x0, 0x40}}]}, 0x13c}, 0x1, 0x0, 0x0, 0x880}, 0x2014)
ioctl$UBLK_U_CMD_END_USER_RECOVERY(r1, 0xc0207511, &(0x7f00000004c0)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff})
openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
syz_ublk_setup_io_uring(0x5a42, &(0x7f0000000040)={0x0, 0x0, 0x10, 0x1}, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140))
ioctl$UBLK_U_CMD_START_DEV(r1, 0xc0207506, &(0x7f00000005c0)={0x0, 0xffff, 0x0, 0x0, <r3=>0x0})
tgkill(0x0, r3, 0x2)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0)
r4 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r4, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program crashed: memory leak in __usbhid_submit_report
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mknodat$null-memfd_secret-prctl$PR_SET_SYSCALL_USER_DISPATCH_ON-futimesat-openat$fuse-socket$nl_xfrm-sendmsg$nl_xfrm-ioctl$UBLK_U_CMD_END_USER_RECOVERY-openat$ublk_ctrl-syz_ublk_setup_io_uring-ioctl$UBLK_U_CMD_START_DEV-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103)
r1 = memfd_secret(0x0)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x63b1, &(0x7f0000006680))
futimesat(r1, 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x13c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in6=@empty, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e20, 0x0, 0x4e21, 0x2, 0xa, 0x0, 0x0, 0x21, 0x0, 0xee00}, {@in=@rand_addr=0x64010102, 0x4d6, 0x32}, @in=@multicast2, {0x0, 0x5, 0x0, 0x9, 0xffffffff00000005, 0x0, 0x80000001, 0x543}, {0x4, 0x7fffffffffffffff, 0x3, 0x1}, {0xffffffff}, 0x70bd2c, 0x3500, 0x2, 0x0, 0x0, 0x40}, [@algo_aead={0x4c, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x0, 0x40}}]}, 0x13c}, 0x1, 0x0, 0x0, 0x880}, 0x2014)
ioctl$UBLK_U_CMD_END_USER_RECOVERY(r1, 0xc0207511, &(0x7f00000004c0)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff})
openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
syz_ublk_setup_io_uring(0x5a42, &(0x7f0000000040)={0x0, 0x0, 0x10, 0x1}, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140))
ioctl$UBLK_U_CMD_START_DEV(r1, 0xc0207506, &(0x7f00000005c0))
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0)
r3 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r3, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program crashed: memory leak in __usbhid_submit_report
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mknodat$null-memfd_secret-prctl$PR_SET_SYSCALL_USER_DISPATCH_ON-futimesat-openat$fuse-socket$nl_xfrm-sendmsg$nl_xfrm-ioctl$UBLK_U_CMD_END_USER_RECOVERY-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103)
r1 = memfd_secret(0x0)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x63b1, &(0x7f0000006680))
futimesat(r1, 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x13c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in6=@empty, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e20, 0x0, 0x4e21, 0x2, 0xa, 0x0, 0x0, 0x21, 0x0, 0xee00}, {@in=@rand_addr=0x64010102, 0x4d6, 0x32}, @in=@multicast2, {0x0, 0x5, 0x0, 0x9, 0xffffffff00000005, 0x0, 0x80000001, 0x543}, {0x4, 0x7fffffffffffffff, 0x3, 0x1}, {0xffffffff}, 0x70bd2c, 0x3500, 0x2, 0x0, 0x0, 0x40}, [@algo_aead={0x4c, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x0, 0x40}}]}, 0x13c}, 0x1, 0x0, 0x0, 0x880}, 0x2014)
ioctl$UBLK_U_CMD_END_USER_RECOVERY(r1, 0xc0207511, &(0x7f00000004c0)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff})
openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
syz_ublk_setup_io_uring(0x5a42, &(0x7f0000000040)={0x0, 0x0, 0x10, 0x1}, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140))
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0)
r3 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r3, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program crashed: memory leak in __usbhid_submit_report
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mknodat$null-memfd_secret-prctl$PR_SET_SYSCALL_USER_DISPATCH_ON-futimesat-openat$fuse-socket$nl_xfrm-sendmsg$nl_xfrm-ioctl$UBLK_U_CMD_END_USER_RECOVERY-openat$ublk_ctrl-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103)
r1 = memfd_secret(0x0)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x63b1, &(0x7f0000006680))
futimesat(r1, 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x13c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in6=@empty, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e20, 0x0, 0x4e21, 0x2, 0xa, 0x0, 0x0, 0x21, 0x0, 0xee00}, {@in=@rand_addr=0x64010102, 0x4d6, 0x32}, @in=@multicast2, {0x0, 0x5, 0x0, 0x9, 0xffffffff00000005, 0x0, 0x80000001, 0x543}, {0x4, 0x7fffffffffffffff, 0x3, 0x1}, {0xffffffff}, 0x70bd2c, 0x3500, 0x2, 0x0, 0x0, 0x40}, [@algo_aead={0x4c, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x0, 0x40}}]}, 0x13c}, 0x1, 0x0, 0x0, 0x880}, 0x2014)
ioctl$UBLK_U_CMD_END_USER_RECOVERY(r1, 0xc0207511, &(0x7f00000004c0)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff})
openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0)
r3 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r3, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program crashed: memory leak in __usbhid_submit_report
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mknodat$null-memfd_secret-prctl$PR_SET_SYSCALL_USER_DISPATCH_ON-futimesat-openat$fuse-socket$nl_xfrm-sendmsg$nl_xfrm-ioctl$UBLK_U_CMD_END_USER_RECOVERY-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103)
r1 = memfd_secret(0x0)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x63b1, &(0x7f0000006680))
futimesat(r1, 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x13c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in6=@empty, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e20, 0x0, 0x4e21, 0x2, 0xa, 0x0, 0x0, 0x21, 0x0, 0xee00}, {@in=@rand_addr=0x64010102, 0x4d6, 0x32}, @in=@multicast2, {0x0, 0x5, 0x0, 0x9, 0xffffffff00000005, 0x0, 0x80000001, 0x543}, {0x4, 0x7fffffffffffffff, 0x3, 0x1}, {0xffffffff}, 0x70bd2c, 0x3500, 0x2, 0x0, 0x0, 0x40}, [@algo_aead={0x4c, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x0, 0x40}}]}, 0x13c}, 0x1, 0x0, 0x0, 0x880}, 0x2014)
ioctl$UBLK_U_CMD_END_USER_RECOVERY(r1, 0xc0207511, &(0x7f00000004c0)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0)
r3 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r3, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program crashed: memory leak in __usbhid_submit_report
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mknodat$null-memfd_secret-prctl$PR_SET_SYSCALL_USER_DISPATCH_ON-futimesat-openat$fuse-socket$nl_xfrm-sendmsg$nl_xfrm-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103)
r1 = memfd_secret(0x0)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x63b1, &(0x7f0000006680))
futimesat(r1, 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x13c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in6=@empty, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e20, 0x0, 0x4e21, 0x2, 0xa, 0x0, 0x0, 0x21, 0x0, 0xee00}, {@in=@rand_addr=0x64010102, 0x4d6, 0x32}, @in=@multicast2, {0x0, 0x5, 0x0, 0x9, 0xffffffff00000005, 0x0, 0x80000001, 0x543}, {0x4, 0x7fffffffffffffff, 0x3, 0x1}, {0xffffffff}, 0x70bd2c, 0x3500, 0x2, 0x0, 0x0, 0x40}, [@algo_aead={0x4c, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x0, 0x40}}]}, 0x13c}, 0x1, 0x0, 0x0, 0x880}, 0x2014)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0)
r3 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r3, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program crashed: memory leak in __usbhid_submit_report
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mknodat$null-memfd_secret-prctl$PR_SET_SYSCALL_USER_DISPATCH_ON-futimesat-openat$fuse-socket$nl_xfrm-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103)
r1 = memfd_secret(0x0)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x63b1, &(0x7f0000006680))
futimesat(r1, 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
socket$nl_xfrm(0x10, 0x3, 0x6)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0)
r2 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program crashed: memory leak in __usbhid_submit_report
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mknodat$null-memfd_secret-prctl$PR_SET_SYSCALL_USER_DISPATCH_ON-futimesat-openat$fuse-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103)
r1 = memfd_secret(0x0)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x63b1, &(0x7f0000006680))
futimesat(r1, 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0)
r2 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program crashed: memory leak in __usbhid_submit_report
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mknodat$null-memfd_secret-prctl$PR_SET_SYSCALL_USER_DISPATCH_ON-futimesat-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103)
r1 = memfd_secret(0x0)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x63b1, &(0x7f0000006680))
futimesat(r1, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0)
r2 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program crashed: memory leak in __usbhid_submit_report
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mknodat$null-memfd_secret-prctl$PR_SET_SYSCALL_USER_DISPATCH_ON-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103)
memfd_secret(0x0)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x63b1, &(0x7f0000006680))
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0)
r1 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program crashed: memory leak in __usbhid_submit_report
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mknodat$null-memfd_secret-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103)
memfd_secret(0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0)
r1 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program crashed: memory leak in __usbhid_submit_report
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mknodat$null-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0)
r1 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program crashed: memory leak in __usbhid_submit_report
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0)
r1 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program crashed: memory leak in __usbhid_submit_report
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0)
r0 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r0, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0)
r1 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
r1 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0)
r1 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0}, 0x0)
r1 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0)
r1 = syz_open_dev$hiddev(0x0, 0x0, 0x0)
ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0)
r1 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r1, 0x400c4808, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
program did not crash
simplifying guilty program options
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0)
r1 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program crashed: memory leak in __usbhid_submit_report
extracting C reproducer
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
program crashed: memory leak in __usbhid_submit_report
simplifying C reproducer
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
program did not crash
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox: SandboxArg:0 Leak:true NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
program crashed: memory leak in __usbhid_submit_report
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox: SandboxArg:0 Leak:true NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
program crashed: memory leak in __usbhid_submit_report
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox: SandboxArg:0 Leak:true NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
program crashed: memory leak in __usbhid_submit_report
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox: SandboxArg:0 Leak:true NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
program crashed: memory leak in __usbhid_submit_report
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox: SandboxArg:0 Leak:true NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
program crashed: memory leak in __usbhid_submit_report
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox: SandboxArg:0 Leak:true NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0)
r1 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program crashed: memory leak in __usbhid_submit_report
validation run: crashed=true
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox: SandboxArg:0 Leak:true NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0)
r1 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program crashed: memory leak in __usbhid_submit_report
validation run: crashed=true
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox: SandboxArg:0 Leak:true NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0)
r1 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f0000000400)={0x2, 0x100})

program crashed: memory leak in __usbhid_submit_report
validation run: crashed=true
reproducing took 1h13m47.68235669s
repro crashed as (corrupted=false):
BUG: memory leak
unreferenced object 0xffff88810e302fb0 (size 8):
  comm "syz.6.23", pid 6050, jiffies 4294944097
  hex dump (first 8 bytes):
    00 00 00 00 00 00 00 00                          ........
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __do_kmalloc_node mm/slub.c:5413 [inline]
    __kmalloc_noprof+0x3fb/0x540 mm/slub.c:5439
    __usbhid_submit_report+0x362/0x4c0 drivers/hid/usbhid/hid-core.c:541
    usbhid_submit_report drivers/hid/usbhid/hid-core.c:640 [inline]
    usbhid_request+0x5b/0xa0 drivers/hid/usbhid/hid-core.c:1303
    hid_hw_request+0x3c/0x70 drivers/hid/hid-core.c:2531
    hiddev_ioctl+0x33e/0x9d0 drivers/hid/usbhid/hiddev.c:726
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88812b65d0f0 (size 8):
  comm "syz.5.22", pid 6058, jiffies 4294944103
  hex dump (first 8 bytes):
    00 00 00 00 00 00 00 00                          ........
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __do_kmalloc_node mm/slub.c:5413 [inline]
    __kmalloc_noprof+0x3fb/0x540 mm/slub.c:5439
    __usbhid_submit_report+0x362/0x4c0 drivers/hid/usbhid/hid-core.c:541
    usbhid_submit_report drivers/hid/usbhid/hid-core.c:640 [inline]
    usbhid_request+0x5b/0xa0 drivers/hid/usbhid/hid-core.c:1303
    hid_hw_request+0x3c/0x70 drivers/hid/hid-core.c:2531
    hiddev_ioctl+0x33e/0x9d0 drivers/hid/usbhid/hiddev.c:726
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888129618148 (size 8):
  comm "syz.2.19", pid 6052, jiffies 4294944103
  hex dump (first 8 bytes):
    00 00 00 00 00 00 00 00                          ........
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __do_kmalloc_node mm/slub.c:5413 [inline]
    __kmalloc_noprof+0x3fb/0x540 mm/slub.c:5439
    __usbhid_submit_report+0x362/0x4c0 drivers/hid/usbhid/hid-core.c:541
    usbhid_submit_report drivers/hid/usbhid/hid-core.c:640 [inline]
    usbhid_request+0x5b/0xa0 drivers/hid/usbhid/hid-core.c:1303
    hid_hw_request+0x3c/0x70 drivers/hid/hid-core.c:2531
    hiddev_ioctl+0x33e/0x9d0 drivers/hid/usbhid/hiddev.c:726
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888129dc5518 (size 8):
  comm "syz.4.21", pid 6055, jiffies 4294944103
  hex dump (first 8 bytes):
    00 00 00 00 00 00 00 00                          ........
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __do_kmalloc_node mm/slub.c:5413 [inline]
    __kmalloc_noprof+0x3fb/0x540 mm/slub.c:5439
    __usbhid_submit_report+0x362/0x4c0 drivers/hid/usbhid/hid-core.c:541
    usbhid_submit_report drivers/hid/usbhid/hid-core.c:640 [inline]
    usbhid_request+0x5b/0xa0 drivers/hid/usbhid/hid-core.c:1303
    hid_hw_request+0x3c/0x70 drivers/hid/hid-core.c:2531
    hiddev_ioctl+0x33e/0x9d0 drivers/hid/usbhid/hiddev.c:726
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88812b65d100 (size 8):
  comm "syz.1.24", pid 6065, jiffies 4294944233
  hex dump (first 8 bytes):
    00 00 00 00 00 00 00 00                          ........
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __do_kmalloc_node mm/slub.c:5413 [inline]
    __kmalloc_noprof+0x3fb/0x540 mm/slub.c:5439
    __usbhid_submit_report+0x362/0x4c0 drivers/hid/usbhid/hid-core.c:541
    usbhid_submit_report drivers/hid/usbhid/hid-core.c:640 [inline]
    usbhid_request+0x5b/0xa0 drivers/hid/usbhid/hid-core.c:1303
    hid_hw_request+0x3c/0x70 drivers/hid/hid-core.c:2531
    hiddev_ioctl+0x33e/0x9d0 drivers/hid/usbhid/hiddev.c:726
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

final repro crashed as (corrupted=false):
BUG: memory leak
unreferenced object 0xffff88810e302fb0 (size 8):
  comm "syz.6.23", pid 6050, jiffies 4294944097
  hex dump (first 8 bytes):
    00 00 00 00 00 00 00 00                          ........
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __do_kmalloc_node mm/slub.c:5413 [inline]
    __kmalloc_noprof+0x3fb/0x540 mm/slub.c:5439
    __usbhid_submit_report+0x362/0x4c0 drivers/hid/usbhid/hid-core.c:541
    usbhid_submit_report drivers/hid/usbhid/hid-core.c:640 [inline]
    usbhid_request+0x5b/0xa0 drivers/hid/usbhid/hid-core.c:1303
    hid_hw_request+0x3c/0x70 drivers/hid/hid-core.c:2531
    hiddev_ioctl+0x33e/0x9d0 drivers/hid/usbhid/hiddev.c:726
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88812b65d0f0 (size 8):
  comm "syz.5.22", pid 6058, jiffies 4294944103
  hex dump (first 8 bytes):
    00 00 00 00 00 00 00 00                          ........
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __do_kmalloc_node mm/slub.c:5413 [inline]
    __kmalloc_noprof+0x3fb/0x540 mm/slub.c:5439
    __usbhid_submit_report+0x362/0x4c0 drivers/hid/usbhid/hid-core.c:541
    usbhid_submit_report drivers/hid/usbhid/hid-core.c:640 [inline]
    usbhid_request+0x5b/0xa0 drivers/hid/usbhid/hid-core.c:1303
    hid_hw_request+0x3c/0x70 drivers/hid/hid-core.c:2531
    hiddev_ioctl+0x33e/0x9d0 drivers/hid/usbhid/hiddev.c:726
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888129618148 (size 8):
  comm "syz.2.19", pid 6052, jiffies 4294944103
  hex dump (first 8 bytes):
    00 00 00 00 00 00 00 00                          ........
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __do_kmalloc_node mm/slub.c:5413 [inline]
    __kmalloc_noprof+0x3fb/0x540 mm/slub.c:5439
    __usbhid_submit_report+0x362/0x4c0 drivers/hid/usbhid/hid-core.c:541
    usbhid_submit_report drivers/hid/usbhid/hid-core.c:640 [inline]
    usbhid_request+0x5b/0xa0 drivers/hid/usbhid/hid-core.c:1303
    hid_hw_request+0x3c/0x70 drivers/hid/hid-core.c:2531
    hiddev_ioctl+0x33e/0x9d0 drivers/hid/usbhid/hiddev.c:726
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888129dc5518 (size 8):
  comm "syz.4.21", pid 6055, jiffies 4294944103
  hex dump (first 8 bytes):
    00 00 00 00 00 00 00 00                          ........
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __do_kmalloc_node mm/slub.c:5413 [inline]
    __kmalloc_noprof+0x3fb/0x540 mm/slub.c:5439
    __usbhid_submit_report+0x362/0x4c0 drivers/hid/usbhid/hid-core.c:541
    usbhid_submit_report drivers/hid/usbhid/hid-core.c:640 [inline]
    usbhid_request+0x5b/0xa0 drivers/hid/usbhid/hid-core.c:1303
    hid_hw_request+0x3c/0x70 drivers/hid/hid-core.c:2531
    hiddev_ioctl+0x33e/0x9d0 drivers/hid/usbhid/hiddev.c:726
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88812b65d100 (size 8):
  comm "syz.1.24", pid 6065, jiffies 4294944233
  hex dump (first 8 bytes):
    00 00 00 00 00 00 00 00                          ........
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __do_kmalloc_node mm/slub.c:5413 [inline]
    __kmalloc_noprof+0x3fb/0x540 mm/slub.c:5439
    __usbhid_submit_report+0x362/0x4c0 drivers/hid/usbhid/hid-core.c:541
    usbhid_submit_report drivers/hid/usbhid/hid-core.c:640 [inline]
    usbhid_request+0x5b/0xa0 drivers/hid/usbhid/hid-core.c:1303
    hid_hw_request+0x3c/0x70 drivers/hid/hid-core.c:2531
    hiddev_ioctl+0x33e/0x9d0 drivers/hid/usbhid/hiddev.c:726
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF