Extracting prog: 19m27.990043834s
Minimizing prog: 3h17m35.066835658s
Simplifying prog options: 19m2.265341144s
Extracting C: 5m13.510530892s
Simplifying C: 0s


extracting reproducer from 30 programs
testing a last program of every proc
single: executing 5 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect-syz_usb_connect-syz_usb_control_io$rtl8150-syz_usb_control_io$uac1-syz_usb_connect$uac1-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$cdc_ncm-syz_usb_connect$cdc_ecm-syz_usb_control_io$cdc_ecm-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$sierra_net-syz_usb_control_io$lan78xx-syz_usb_control_io$lan78xx-syz_usb_control_io$cdc_ncm-syz_usb_control_io-syz_usb_control_io$cdc_ecm-syz_usb_control_io$uac1-syz_usb_control_io$hid-syz_usb_control_io$hid
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201b03d000000408a25887606090400000203ea000009210000000000000000001000000000"], 0x0)
syz_usb_disconnect(0xffffffffffffffff) (async)
r1 = syz_usb_connect(0x3, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x9d, 0xbd, 0x45, 0x40, 0x10b9, 0x6000, 0xbe16, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x87, 0x9, 0x30, 0x7, "", [{{0x9, 0x4, 0x40, 0x19, 0x0, 0x3a, 0x92, 0xe0, 0x8}}]}}]}}, &(0x7f0000000cc0)={0x0, 0x0, 0x0, 0x0})
r2 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100009f187620ef170372362e010203010902240001000010000904bc00029e8833000905020200020200000905820220"], 0x0)
syz_usb_control_io$rtl8150(r2, 0x0, &(0x7f00000029c0)={0x2c, &(0x7f0000000400)=ANY=[@ANYRES16=r2, @ANYRES64=r2], 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io$uac1(r2, 0x0, &(0x7f0000002640)={0x44, &(0x7f0000000000)={0x20, 0xe, 0x2, "02cf"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_connect$uac1(0x2, 0x72, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x2b73, 0x3c, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x60, 0x3, 0x1, 0x1, 0x70, 0x9, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x2, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0x9, 0xf0, 0xf5, {0x7, 0x25, 0x1, 0xc, 0x81, 0x2}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0xfa, 0x8, 0x4, {0x7, 0x25, 0x1, 0xc, 0x7, 0x3e0d}}}}}}}}]}}, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0})
syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="120100021da277402a1101002fcc010203010902240001011550f509042481029284739f09ee020208000b0709090505"], 0x0) (async)
syz_usb_control_io(r2, 0x0, &(0x7f0000000580)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000840)={0x40, 0xb, 0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io$cdc_ncm(r2, 0x0, &(0x7f00000000c0)={0x44, &(0x7f0000000300)=ANY=[@ANYBLOB="000e02"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
r3 = syz_usb_connect$cdc_ecm(0x3, 0x5e, &(0x7f0000000380)={{0x12, 0x1, 0x110, 0x2, 0x0, 0x0, 0xff, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x4c, 0x1, 0x1, 0x5, 0xa0, 0xb3, "", [{{0x9, 0x4, 0x0, 0x6, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x8, 0x24, 0x6, 0x0, 0x0, "02f3f7"}, {0x5, 0x24, 0x0, 0x7fff}, {0xd, 0x24, 0xf, 0x1, 0xb0, 0x9, 0xfffa, 0x8}, [@call_mgmt={0x5, 0x24, 0x1, 0x0, 0x2a}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x20, 0x1, 0xb, 0x5}}], {{0x9, 0x5, 0x82, 0x2, 0x200, 0x7, 0xc3, 0xe}}, {{0x9, 0x5, 0x3, 0x2, 0x400, 0xa3, 0x3, 0x2}}}}}]}}]}}, &(0x7f0000000700)={0xa, &(0x7f0000000440)={0xa, 0x6, 0x310, 0x6, 0xa1, 0x3, 0x10, 0x81}, 0xc, &(0x7f0000000480)={0x5, 0xf, 0xc, 0x1, [@ext_cap={0x7, 0x10, 0x2, 0x14, 0x9, 0x0, 0x1000}]}, 0x2, [{0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x80c}}, {0x86, &(0x7f0000000640)=@string={0x86, 0x3, "a015353fd7ec18d8a3cf3dacf0f4eacf377385e54bd2fc21eba93283b680fb555c00d1ccec4371db8aa69514da0375951f2ea925910c2e3511677ec653c397c66f676bfd7d23d9e90bcacecb9196f539cc56eb32cea8e591c73ca1317f10497eb49c2a0327e242606d661ac96d6d49861e930560093201068f6a40bd976c932fd33cff62"}}]})
syz_usb_control_io$cdc_ecm(r3, &(0x7f00000007c0)={0x14, &(0x7f0000000a40)=ANY=[@ANYBLOB="20240a0000000a039023b00c15abb98b3ec6f18d878db40b405e663c89dc3fc0de37f0926807c88adf14d8f8bd1c06a3b27e317f9e96021aeb0820061a7de7f09bf040a5b2d9517f9b9c91a470b2c1c6c17a0e45ea14024f1d70620849bcaccc2fc902f9c15756d823b2116ec524b451bac9c372307fc08d9fc2946b7d00cb769442fcc208649b72fc9969108254aca7c516051dbfe662ab7406552bfa6a52d9f0bbbfe1ddd5310cbeeae6243874047f1799ab71baf5"], &(0x7f0000000780)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000a00)={0x1c, &(0x7f0000000880)={0x0, 0x8, 0xe7, "3e304d86d919334c9624c61267e94e9801b30ae7e3fc983b74a7ab42d5e60ae9cfa1dd3cba69901e6f577a56fccdaa7118e623c84e235712ea552f3eefbb77cf28a9eb920bfe10f4a8c1ae1f91de299765713979c515615c8d9b64678c4fb31c2c7ba0d76559511eaff68d279422a4e16c5bae26381964ae2ebf37ef0570f322a0140bdbd83a2bf22e6a89466a701f78b50fad69885ed0dfa4f18d591a6800e5d422062c31a61385f9922ee21de35d1149e1a11988272046cedbcb49d1ff4d86e768767b206ded023db6ed497f05c411c18090233f6009c9507f1ae621672ddd293bdf65d815fe"}, &(0x7f0000000980)={0x0, 0xa, 0x1, 0xda}, &(0x7f00000009c0)={0x0, 0x8, 0x1, 0x3e}}) (async)
syz_usb_control_io$hid(r2, 0x0, &(0x7f0000000f80)={0x2c, &(0x7f0000000d80)={0x0, 0x12, 0x5, "713c9009c2"}, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r2, 0x0, 0x0)
syz_usb_control_io$sierra_net(r2, &(0x7f0000000c40)={0x14, &(0x7f0000000b00)={0x40, 0x30, 0xcb, {0xcb, 0x6, "33b1d98c0d0d6c18cbfcb7f303830406e3bdd27cf13ada45af9278f0151a9e143715af52e9869bd57fb52c4e9f2d81a1c1014fcc43127b13fddf2455a55932bf552c7562977bbe184894945a0e6f4601d7064250354385487fe94aa6daa8a45edcef255b8f3f1d0bf9c3ac71e36f159e13cd6a3e194d76199eb03712b70c2732e806d6229be697ae359463cedb6c339906fde66c38f7a54c1c62db47972007334648306f0c70483535d88c9e9f53ca767d1862bd25db373b17bfd6b2807e119ea0441e05031a08c18b"}}, &(0x7f0000000c00)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x400a}}}, &(0x7f0000001440)={0x1c, &(0x7f0000000c80)={0x40, 0x31, 0x25, "70e02f1db292a7d25706e2a9affe1cab34bb14515a375827c4ec5660de482be62ecfff9386"}, &(0x7f0000000fc0)={0xa1, 0x1, 0x400, "fff5563dfba9b45aeaf2f0bc3c2b4fbb0128e626241911be960da8e46844cff5fde80f8dd0aec2a09e0d22c82a8c63d8cf944e8502a3a7ed33f5dfc80c0d42e0fd07b2b6a313616fb49d82dd4a99e4926593a89457ae785326af3e38803c36c969506aeb6924ee002e8665598f9d26e0e5139ec199517d79a57f3d09716c322987c5b3e06c1adbf4b21f120b499a7b5400a194ccfabb27ba0826ca9e332e295c23ba7e88b3703b0ed20f83e46806513c7b3e1dd1d2690c7f324ec545e152b9ffaf71a2c123c478f1c4baa294bf78734c9e12f5607c190043d752f6658f396707058ad753b8a4bf234804e12e2158cc87a8c1ab6c222f9b6cc15bd6e5c6b558f33b81995da0508f82a0cb98fd961735ace1c50b5c5abb9017065ef846e73696a295f2e3a50702ee42cb54f78f08a0b9d3751481bbff8ba3c18f9cb7e08c87ec6a8591b0fecb590d4d2f9bdbca3a1f781592589700bdd7c43afbc2abeff615959c856917ad9a3a6c4bcf18e9187d2fceaeb97e6a0800a13a9e52170d002e0f52522e844120635a53cc45e892b81d6f4c567e2c1fe6a0c2475157499bd023912f0faf0e11dbced1c1690b3e6950e7b2187402fd6222e68f5f606a624fa1f062cafead5fae326fe63677be4c9b3c5f7f02f012677ecaf30cca4f145fa13943f40cd71a797e29f98317e6b00f499bb2ac9c434e9daadf86ffedf09355742a6456305925471476e39f47fe29e7360d20dd742fa6bbffaafc4095ae87a3e6a0be21ef862633fc3b479b43c59d09e5e9f0426ff0b0e6b1c70dd372cf72e8068a37daf7c0b61fc480d7aabf5fd5e0f6ef38b44cd9c1e66ff82ab187dc4dc32171ab3959780ae99593aa7231af2dec7ee71b46d097c46b8f3bc7abf8035977fc525d4d25cb96c90c3bb7c341d8ab75e0378d91e822e77d0a44c30a4887c225b19ec6604f495e31e3c2f90131fbefda27e569082395a357a3688a4624e8194977ea8c1d7b81c46de9cc47d5908de7cfbbde3e1642af114b214784ec5fdbf6fb560da991a98ab6c548eae4cf017c6e266aead3be480d79af4679e5213e200c7aae7ccadb08bffdcc265d4fc10dbf00173add30b692ac984318e7dff01e7a4cef2d185fd9dc24a1497d236f753259682938a519326e8e981c93795448df1a17936f74235849757a88396a6bcdf7bbd4541727e30362a081618be6af731681baabc6bda490a7875a5a440f49b93428a8e5c0b788e1e53a3e1545f04e3a89370d2632651eb1e86589a810963db5eec457500604f316209be018840cc65a85d07463556cbf7afc6eb3987cd59ed15877229defebbd3f75e1a2f531a199be3b2dbd9ac91dfaffa4a8feba053da2f691f4000262f41a5bcb35002f76ea6d8173e2a4f4d0eaee91697033536b84a2d7b8a5c488b4737cf5e827b7d5abe8ac2b2058c609f78e7c02cef7"}, &(0x7f0000001400)={0x21, 0x0, 0x4, "4aa68b4a"}}) (async)
syz_usb_control_io$lan78xx(r2, 0x0, 0x0) (async)
syz_usb_control_io$lan78xx(r2, 0x0, 0x0) (async)
syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) (async)
syz_usb_control_io(r1, &(0x7f00000016c0)={0x2c, &(0x7f0000000d00)={0x20, 0x1, 0x4f, {0x4f, 0x23, "87cd1667dcc7e82b8c9862caef8b1f13702f39c446b909637c9a2609890717458dfd6c2e8f2a602f2121bf9c97132568c06959be8b10497e7b7d145d88e796d86f85f7714068f0b9e79a18c04d"}}, &(0x7f0000000dc0)={0x0, 0x3, 0x8f, @string={0x8f, 0x3, "de67bbcc8e867fd978680c6e3b518d8b92ff2641f20f23a88ea1994c3b6f1e6aaf8561ac5edb3ddfebd6d6baa4985cb686ba5ab16b538d200b53bd542290a68725aea53b430e9b2517b87fcb3889dc13cb6d69193c81e464cb9768148df5cce99bfaeb6cfc55bf423f2662fe0d6b2dadae5a1f58842c5e7cd6b351ed3e982f8fea5f7aca76277bd4cb3f46599a"}}, &(0x7f0000001480)={0x0, 0xf, 0x17d, {0x5, 0xf, 0x17d, 0x6, [@generic={0x72, 0x10, 0x1, "96a097714fbff3155b6f8fa493d66157b3aa641478a62c36e27d3c0a48dd2ef74181aac68b2d8efa732df25ed71df6d41e41ed81b4d309f83f30b6326d24f4363ae33482394e902aae3c8c3b0ad9ddfafd2a7f9a643a82b8827718bea24a26af320fc0f5cbff7db860a372be2f9508"}, @wireless={0xb, 0x10, 0x1, 0x8, 0x0, 0x8, 0x0, 0x8001, 0x1}, @generic={0xe3, 0x10, 0x3, "f1041c2285a5dbeb626b5ab5c486bf41418b5838468a48cfcd0774067728f81ec892ad189832d95fbb4e568bfbfb977d0a52f6951028d7169c037b8f4ba1a0954c31201124243282d760513b730149d562da067a83193188327fcf83adf0ecd9784467e969133600e7628118ba61e5bb49ade23c8b3c3264250be5aafc0be9603a49962c55fd960ced638fa7f5cb7bb27fe06544ef909ab85660e0ff18c71c88aaf1dd1af7b230d12cd2b6e78c9172ca0669a45760bcb62460897d3c64b2713909db500dc463dbd13a86ebb1d5700cdd4d353cfa53477067a5ef3a0e5b7565aa"}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x2, 0x5, 0x0, 0x19}, @ptm_cap={0x3}, @wireless={0xb, 0x10, 0x1, 0xc, 0x4, 0xfa, 0x7f, 0x0, 0x4}]}}, &(0x7f0000001640)={0x20, 0x29, 0xf, {0xf, 0x29, 0x0, 0x8, 0x1, 0x8, "1ed983b8", "e5117ad4"}}, &(0x7f0000001680)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xc, 0x18, 0x1, 0x6, 0xb7, 0x1ff, 0x8}}}, &(0x7f0000001b80)={0x84, &(0x7f0000001700)={0x0, 0xb, 0xa1, "36988a790f9a5caf8d9dc5275686fc73c9781ac5674ffdd28e24212ce070b5f7a35d242222e63206d8cf8bfcb50dbbd9e2df72af1c3e481276b8642b7743f23cfbde1cb226411b31a69c2c0e07653e094dc23fef06a5944b6fbc6a2bc54911d17b2b1000d9be4a60de19c1122c24b74162aee2278a2aeea3b037173c52b6e654addafaca3bfa79c12657579d2f40e2680d1b9c89a270dd65ac3715ce7fbbb3fa3d"}, &(0x7f00000017c0)={0x0, 0xa, 0x1, 0xc}, &(0x7f0000001800)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000001840)={0x20, 0x0, 0x4, {0x2, 0x4}}, &(0x7f0000001880)={0x20, 0x0, 0x4, {0x1c0, 0x1}}, &(0x7f00000018c0)={0x40, 0x7, 0x2, 0x7}, &(0x7f0000001900)={0x40, 0x9, 0x1, 0x80}, &(0x7f0000001940)={0x40, 0xb, 0x2, "16e6"}, &(0x7f0000001980)={0x40, 0xf, 0x2, 0xf8}, &(0x7f00000019c0)={0x40, 0x13, 0x6, @broadcast}, &(0x7f0000001a00)={0x40, 0x17, 0x6, @remote}, &(0x7f0000001a40)={0x40, 0x19, 0x2, "015c"}, &(0x7f0000001a80)={0x40, 0x1a, 0x2, 0xfffb}, &(0x7f0000001ac0)={0x40, 0x1c, 0x1}, &(0x7f0000001b00)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000001b40)={0x40, 0x21, 0x1, 0x9}}) (async)
syz_usb_control_io$cdc_ecm(r2, &(0x7f00000001c0)={0x14, &(0x7f0000000140)={0x40, 0x24, 0x17, {0x17, 0x24, "d2d7fd64b27245a08de4dddd2c554ad7df0ef9057d"}}, &(0x7f0000000180)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000340)={0x1c, &(0x7f0000000200)={0x0, 0x30, 0x56, "ae80ae1ed6607679cb41551db93be9701ea00ebc7fd5a4c06bb93c69e1f128497365f3e38549f01d5d8ae083de2a21617d45d48ee578e2a135aaf3f23fa1357e60812ae45698670ece42946b36ac1afc150b0834d893"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0x8d}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0x7}})
syz_usb_control_io$uac1(r2, 0x0, 0x0) (async)
syz_usb_control_io$hid(r0, 0x0, 0x0) (async)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_connect-syz_usb_connect-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_read-syz_usb_connect$hid-syz_open_dev$hidraw-read$hidraw-syz_usb_connect-syz_usb_control_io$sierra_net-syz_usb_control_io$cdc_ecm-syz_usb_control_io$uac1-syz_usb_control_io$printer-syz_usb_connect$uac3-syz_usb_disconnect-syz_usb_control_io$lan78xx-syz_usb_connect$hid-syz_usb_connect$uac2-syz_usb_connect$cdc_ncm-syz_usb_disconnect-syz_open_dev$char_usb-syz_usb_control_io$hid-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000c0780a402a1101007f9e0102030109022400010000000009040000020a6bc50009f40522"], 0x0)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0)
syz_usb_disconnect(r1)
syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x18d1, 0x503c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0}}]}}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64)
syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000001500)=ANY=[@ANYBLOB="12010000000000407d1ef62c00000000000109022400010000000009040000010300020009210000000122070009058103"], 0x0)
r3 = syz_open_dev$hidraw(&(0x7f0000000040), 0x1803, 0x301)
read$hidraw(r3, &(0x7f0000000140)=""/254, 0xfe)
r4 = syz_usb_connect(0x0, 0x24, &(0x7f00000012c0)=ANY=[@ANYBLOB="12010000c6700610f71400058544010203010902120001000000000904"], 0x0)
syz_usb_control_io$sierra_net(r4, 0x0, &(0x7f0000000380)={0x1c, &(0x7f0000000f40)=ANY=[], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r4, 0x0, 0x0)
syz_usb_control_io$uac1(r4, 0x0, 0x0)
syz_usb_control_io$printer(r4, 0x0, 0x0)
syz_usb_connect$uac3(0x5, 0x8c, 0x0, 0x0)
syz_usb_disconnect(0xffffffffffffffff)
syz_usb_control_io$lan78xx(r4, &(0x7f0000000cc0)={0x14, 0x0, 0x0}, 0x0)
syz_usb_connect$hid(0x1, 0x36, &(0x7f00000007c0)={{0x12, 0x1, 0x240, 0x0, 0x0, 0x0, 0x40, 0xb05, 0x1866, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x7, 0xa0, 0x6, "", [{{0x9, 0x4, 0x0, 0xfc, 0x2, 0x3, 0x1, 0x1, 0xb9, {0x9, 0x21, 0xe75, 0x1, 0x1, {0x22, 0x549}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x5, 0x4, 0x9}}}}}]}}]}}, &(0x7f0000001340)={0x0, 0x0, 0x0, 0x0})
syz_usb_connect$uac2(0x5, 0x83, &(0x7f0000000880)=ANY=[@ANYBLOB], 0x0)
syz_usb_connect$cdc_ncm(0x0, 0x6e, 0x0, 0x0)
syz_usb_disconnect(0xffffffffffffffff)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_control_io$hid(r2, 0x0, 0x0)
syz_usb_control_io(r2, &(0x7f0000000400)={0x2c, &(0x7f0000000000)={0x0, 0x30, 0x8, {0x8, 0x22, "59a1b95388e8"}}, 0x0, 0x0, 0x0, 0x0}, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCGUCODE-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) (async)
r1 = syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x5, &(0x7f0000000180)={0x5, 0xf, 0x5}})
syz_usb_disconnect(r1)
r2 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000105804105000000000000109022d00010700000009040005050300000009210002080122940309058103"], 0x0)
syz_usb_control_io(r2, 0x0, 0x0) (async)
syz_usb_control_io$hid(r2, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
r3 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0)
ioctl$HIDIOCGUCODE(r3, 0xc018480d, &(0x7f00000000c0)={0x3, 0x100, 0x0, 0x7, 0x100000, 0x1})
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0) (async)
syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000e00)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8f, 0x2b73, 0x23, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x4, 0x40, 0x2, {0x8, 0xb, 0x1, 0x2, 0x1, 0x5, 0x20, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x5409, 0xb, 0x9, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x2, 0x1, 0x80, {0x8, 0x25, 0x1, 0x80, 0x0, 0x6, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x81, 0x6, 0x9, {0x8, 0x25, 0x1, 0x82, 0x3c, 0x3, 0x9}}}}}}}}]}}, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}, 0x16})

program crashed: KASAN: slab-use-after-free Read in report_descriptor_read
single: successfully extracted reproducer
found reproducer with 12 syscalls
minimizing guilty program
testing program (duration=7m50.654793325s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCGUCODE-syz_usb_connect$cdc_ecm
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) (async)
r1 = syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x5, &(0x7f0000000180)={0x5, 0xf, 0x5}})
syz_usb_disconnect(r1)
r2 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000105804105000000000000109022d00010700000009040005050300000009210002080122940309058103"], 0x0)
syz_usb_control_io(r2, 0x0, 0x0) (async)
syz_usb_control_io$hid(r2, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
r3 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0)
ioctl$HIDIOCGUCODE(r3, 0xc018480d, &(0x7f00000000c0)={0x3, 0x100, 0x0, 0x7, 0x100000, 0x1})
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0) (async)

program did not crash
testing program (duration=7m50.654793325s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCGUCODE-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) (async)
r1 = syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x5, &(0x7f0000000180)={0x5, 0xf, 0x5}})
syz_usb_disconnect(r1)
r2 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000105804105000000000000109022d00010700000009040005050300000009210002080122940309058103"], 0x0)
syz_usb_control_io(r2, 0x0, 0x0) (async)
syz_usb_control_io$hid(r2, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
r3 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0)
ioctl$HIDIOCGUCODE(r3, 0xc018480d, &(0x7f00000000c0)={0x3, 0x100, 0x0, 0x7, 0x100000, 0x1})
syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000e00)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8f, 0x2b73, 0x23, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x4, 0x40, 0x2, {0x8, 0xb, 0x1, 0x2, 0x1, 0x5, 0x20, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x5409, 0xb, 0x9, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x2, 0x1, 0x80, {0x8, 0x25, 0x1, 0x80, 0x0, 0x6, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x81, 0x6, 0x9, {0x8, 0x25, 0x1, 0x82, 0x3c, 0x3, 0x9}}}}}}}}]}}, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}, 0x16})

program did not crash
testing program (duration=7m50.654793325s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_open_dev$hiddev-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) (async)
r1 = syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x5, &(0x7f0000000180)={0x5, 0xf, 0x5}})
syz_usb_disconnect(r1)
r2 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000105804105000000000000109022d00010700000009040005050300000009210002080122940309058103"], 0x0)
syz_usb_control_io(r2, 0x0, 0x0) (async)
syz_usb_control_io$hid(r2, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0) (async)
syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000e00)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8f, 0x2b73, 0x23, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x4, 0x40, 0x2, {0x8, 0xb, 0x1, 0x2, 0x1, 0x5, 0x20, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x5409, 0xb, 0x9, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x2, 0x1, 0x80, {0x8, 0x25, 0x1, 0x80, 0x0, 0x6, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x81, 0x6, 0x9, {0x8, 0x25, 0x1, 0x82, 0x3c, 0x3, 0x9}}}}}}}}]}}, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}, 0x16})

program crashed: KASAN: slab-use-after-free Read in report_descriptor_read
testing program (duration=7m50.654793325s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) (async)
r1 = syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x5, &(0x7f0000000180)={0x5, 0xf, 0x5}})
syz_usb_disconnect(r1)
r2 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000105804105000000000000109022d00010700000009040005050300000009210002080122940309058103"], 0x0)
syz_usb_control_io(r2, 0x0, 0x0) (async)
syz_usb_control_io$hid(r2, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0) (async)
syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000e00)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8f, 0x2b73, 0x23, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x4, 0x40, 0x2, {0x8, 0xb, 0x1, 0x2, 0x1, 0x5, 0x20, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x5409, 0xb, 0x9, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x2, 0x1, 0x80, {0x8, 0x25, 0x1, 0x80, 0x0, 0x6, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x81, 0x6, 0x9, {0x8, 0x25, 0x1, 0x82, 0x3c, 0x3, 0x9}}}}}}}}]}}, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}, 0x16})

program crashed: KASAN: slab-use-after-free Read in report_descriptor_read
testing program (duration=7m50.654793325s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) (async)
r1 = syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x5, &(0x7f0000000180)={0x5, 0xf, 0x5}})
syz_usb_disconnect(r1)
r2 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000105804105000000000000109022d00010700000009040005050300000009210002080122940309058103"], 0x0)
syz_usb_control_io(r2, 0x0, 0x0) (async)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0) (async)
syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000e00)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8f, 0x2b73, 0x23, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x4, 0x40, 0x2, {0x8, 0xb, 0x1, 0x2, 0x1, 0x5, 0x20, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x5409, 0xb, 0x9, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x2, 0x1, 0x80, {0x8, 0x25, 0x1, 0x80, 0x0, 0x6, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x81, 0x6, 0x9, {0x8, 0x25, 0x1, 0x82, 0x3c, 0x3, 0x9}}}}}}}}]}}, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}, 0x16})

program did not crash
testing program (duration=7m50.654793325s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) (async)
r1 = syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x5, &(0x7f0000000180)={0x5, 0xf, 0x5}})
syz_usb_disconnect(r1)
r2 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000105804105000000000000109022d00010700000009040005050300000009210002080122940309058103"], 0x0)
syz_usb_control_io$hid(r2, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0) (async)
syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000e00)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8f, 0x2b73, 0x23, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x4, 0x40, 0x2, {0x8, 0xb, 0x1, 0x2, 0x1, 0x5, 0x20, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x5409, 0xb, 0x9, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x2, 0x1, 0x80, {0x8, 0x25, 0x1, 0x80, 0x0, 0x6, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x81, 0x6, 0x9, {0x8, 0x25, 0x1, 0x82, 0x3c, 0x3, 0x9}}}}}}}}]}}, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}, 0x16})

program did not crash
testing program (duration=7m50.654793325s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_disconnect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) (async)
r1 = syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x5, &(0x7f0000000180)={0x5, 0xf, 0x5}})
syz_usb_disconnect(r1)
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) (async)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0) (async)
syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000e00)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8f, 0x2b73, 0x23, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x4, 0x40, 0x2, {0x8, 0xb, 0x1, 0x2, 0x1, 0x5, 0x20, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x5409, 0xb, 0x9, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x2, 0x1, 0x80, {0x8, 0x25, 0x1, 0x80, 0x0, 0x6, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x81, 0x6, 0x9, {0x8, 0x25, 0x1, 0x82, 0x3c, 0x3, 0x9}}}}}}}}]}}, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}, 0x16})

program crashed: KASAN: slab-use-after-free Read in report_descriptor_read
testing program (duration=7m50.654793325s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) (async)
syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x5, &(0x7f0000000180)={0x5, 0xf, 0x5}})
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) (async)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0) (async)
syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000e00)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8f, 0x2b73, 0x23, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x4, 0x40, 0x2, {0x8, 0xb, 0x1, 0x2, 0x1, 0x5, 0x20, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x5409, 0xb, 0x9, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x2, 0x1, 0x80, {0x8, 0x25, 0x1, 0x80, 0x0, 0x6, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x81, 0x6, 0x9, {0x8, 0x25, 0x1, 0x82, 0x3c, 0x3, 0x9}}}}}}}}]}}, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}, 0x16})

program crashed: KASAN: slab-use-after-free Read in report_descriptor_read
testing program (duration=7m50.654793325s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) (async)
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) (async)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0) (async)
syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000e00)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8f, 0x2b73, 0x23, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x4, 0x40, 0x2, {0x8, 0xb, 0x1, 0x2, 0x1, 0x5, 0x20, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x5409, 0xb, 0x9, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x2, 0x1, 0x80, {0x8, 0x25, 0x1, 0x80, 0x0, 0x6, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x81, 0x6, 0x9, {0x8, 0x25, 0x1, 0x82, 0x3c, 0x3, 0x9}}}}}}}}]}}, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}, 0x16})

VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying
program did not crash
testing program (duration=7m50.654793325s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x5, &(0x7f0000000180)={0x5, 0xf, 0x5}})
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) (async)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0) (async)
syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000e00)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8f, 0x2b73, 0x23, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x4, 0x40, 0x2, {0x8, 0xb, 0x1, 0x2, 0x1, 0x5, 0x20, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x5409, 0xb, 0x9, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x2, 0x1, 0x80, {0x8, 0x25, 0x1, 0x80, 0x0, 0x6, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x81, 0x6, 0x9, {0x8, 0x25, 0x1, 0x82, 0x3c, 0x3, 0x9}}}}}}}}]}}, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}, 0x16})

program did not crash
testing program (duration=7m50.654793325s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) (async)
syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x5, &(0x7f0000000180)={0x5, 0xf, 0x5}})
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) (async)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0) (async)
syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000e00)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8f, 0x2b73, 0x23, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x4, 0x40, 0x2, {0x8, 0xb, 0x1, 0x2, 0x1, 0x5, 0x20, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x5409, 0xb, 0x9, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x2, 0x1, 0x80, {0x8, 0x25, 0x1, 0x80, 0x0, 0x6, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x81, 0x6, 0x9, {0x8, 0x25, 0x1, 0x82, 0x3c, 0x3, 0x9}}}}}}}}]}}, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}, 0x16})

program did not crash
testing program (duration=7m50.654793325s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) (async)
syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x5, &(0x7f0000000180)={0x5, 0xf, 0x5}})
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) (async)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0) (async)
syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000e00)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8f, 0x2b73, 0x23, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x4, 0x40, 0x2, {0x8, 0xb, 0x1, 0x2, 0x1, 0x5, 0x20, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x5409, 0xb, 0x9, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x2, 0x1, 0x80, {0x8, 0x25, 0x1, 0x80, 0x0, 0x6, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x81, 0x6, 0x9, {0x8, 0x25, 0x1, 0x82, 0x3c, 0x3, 0x9}}}}}}}}]}}, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}, 0x16})

program did not crash
testing program (duration=7m50.654793325s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0)
syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x5, &(0x7f0000000180)={0x5, 0xf, 0x5}})
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0)
syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000e00)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8f, 0x2b73, 0x23, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x4, 0x40, 0x2, {0x8, 0xb, 0x1, 0x2, 0x1, 0x5, 0x20, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x5409, 0xb, 0x9, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x2, 0x1, 0x80, {0x8, 0x25, 0x1, 0x80, 0x0, 0x6, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x81, 0x6, 0x9, {0x8, 0x25, 0x1, 0x82, 0x3c, 0x3, 0x9}}}}}}}}]}}, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}, 0x16})

program crashed: KASAN: slab-use-after-free Read in report_descriptor_read
testing program (duration=7m50.654793325s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0)
syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x5, &(0x7f0000000180)={0x5, 0xf, 0x5}})
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0)
syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000e00)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8f, 0x2b73, 0x23, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x4, 0x40, 0x2, {0x8, 0xb, 0x1, 0x2, 0x1, 0x5, 0x20, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x5409, 0xb, 0x9, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x2, 0x1, 0x80, {0x8, 0x25, 0x1, 0x80, 0x0, 0x6, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x81, 0x6, 0x9, {0x8, 0x25, 0x1, 0x82, 0x3c, 0x3, 0x9}}}}}}}}]}}, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}, 0x16})

program did not crash
testing program (duration=7m50.654793325s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x5, &(0x7f0000000180)={0x5, 0xf, 0x5}})
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0)
syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000e00)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8f, 0x2b73, 0x23, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x4, 0x40, 0x2, {0x8, 0xb, 0x1, 0x2, 0x1, 0x5, 0x20, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x5409, 0xb, 0x9, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x2, 0x1, 0x80, {0x8, 0x25, 0x1, 0x80, 0x0, 0x6, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x81, 0x6, 0x9, {0x8, 0x25, 0x1, 0x82, 0x3c, 0x3, 0x9}}}}}}}}]}}, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}, 0x16})

program did not crash
testing program (duration=7m50.654793325s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x5, &(0x7f0000000180)={0x5, 0xf, 0x5}})
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0)
syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000e00)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8f, 0x2b73, 0x23, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x4, 0x40, 0x2, {0x8, 0xb, 0x1, 0x2, 0x1, 0x5, 0x20, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x5409, 0xb, 0x9, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x2, 0x1, 0x80, {0x8, 0x25, 0x1, 0x80, 0x0, 0x6, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x81, 0x6, 0x9, {0x8, 0x25, 0x1, 0x82, 0x3c, 0x3, 0x9}}}}}}}}]}}, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}, 0x16})

program did not crash
testing program (duration=7m50.654793325s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0}, 0x0)
syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x5, &(0x7f0000000180)={0x5, 0xf, 0x5}})
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0)
syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000e00)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8f, 0x2b73, 0x23, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x4, 0x40, 0x2, {0x8, 0xb, 0x1, 0x2, 0x1, 0x5, 0x20, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x5409, 0xb, 0x9, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x2, 0x1, 0x80, {0x8, 0x25, 0x1, 0x80, 0x0, 0x6, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x81, 0x6, 0x9, {0x8, 0x25, 0x1, 0x82, 0x3c, 0x3, 0x9}}}}}}}}]}}, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}, 0x16})

program did not crash
testing program (duration=7m50.654793325s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0)
syz_usb_connect(0x5, 0x24, 0x0, &(0x7f00000000c0)={0x0, 0x0, 0x5, &(0x7f0000000180)={0x5, 0xf, 0x5}})
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0)
syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000e00)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8f, 0x2b73, 0x23, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x4, 0x40, 0x2, {0x8, 0xb, 0x1, 0x2, 0x1, 0x5, 0x20, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x5409, 0xb, 0x9, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x2, 0x1, 0x80, {0x8, 0x25, 0x1, 0x80, 0x0, 0x6, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x81, 0x6, 0x9, {0x8, 0x25, 0x1, 0x82, 0x3c, 0x3, 0x9}}}}}}}}]}}, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}, 0x16})

program did not crash
testing program (duration=7m50.654793325s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0)
syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB], &(0x7f00000000c0)={0x0, 0x0, 0x5, &(0x7f0000000180)={0x5, 0xf, 0x5}})
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0)
syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000e00)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8f, 0x2b73, 0x23, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x4, 0x40, 0x2, {0x8, 0xb, 0x1, 0x2, 0x1, 0x5, 0x20, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x5409, 0xb, 0x9, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x2, 0x1, 0x80, {0x8, 0x25, 0x1, 0x80, 0x0, 0x6, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x81, 0x6, 0x9, {0x8, 0x25, 0x1, 0x82, 0x3c, 0x3, 0x9}}}}}}}}]}}, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}, 0x16})

program did not crash
testing program (duration=7m50.654793325s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0)
syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], 0x0)
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0)
syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000e00)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8f, 0x2b73, 0x23, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x4, 0x40, 0x2, {0x8, 0xb, 0x1, 0x2, 0x1, 0x5, 0x20, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x5409, 0xb, 0x9, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x2, 0x1, 0x80, {0x8, 0x25, 0x1, 0x80, 0x0, 0x6, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x81, 0x6, 0x9, {0x8, 0x25, 0x1, 0x82, 0x3c, 0x3, 0x9}}}}}}}}]}}, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}, 0x16})

program did not crash
testing program (duration=7m50.654793325s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0)
syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0)
syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000e00)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8f, 0x2b73, 0x23, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x4, 0x40, 0x2, {0x8, 0xb, 0x1, 0x2, 0x1, 0x5, 0x20, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x5409, 0xb, 0x9, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x2, 0x1, 0x80, {0x8, 0x25, 0x1, 0x80, 0x0, 0x6, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x81, 0x6, 0x9, {0x8, 0x25, 0x1, 0x82, 0x3c, 0x3, 0x9}}}}}}}}]}}, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}, 0x16})

program crashed: KASAN: slab-use-after-free Read in report_descriptor_read
testing program (duration=7m50.654793325s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0)
syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0)
syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000e00)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8f, 0x2b73, 0x23, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x4, 0x40, 0x2, {0x8, 0xb, 0x1, 0x2, 0x1, 0x5, 0x20, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x5409, 0xb, 0x9, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x2, 0x1, 0x80, {0x8, 0x25, 0x1, 0x80, 0x0, 0x6, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x81, 0x6, 0x9, {0x8, 0x25, 0x1, 0x82, 0x3c, 0x3, 0x9}}}}}}}}]}}, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}, 0x16})

program did not crash
testing program (duration=7m50.654793325s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0)
syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0)
syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000e00)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8f, 0x2b73, 0x23, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x4, 0x40, 0x2, {0x8, 0xb, 0x1, 0x2, 0x1, 0x5, 0x20, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x5409, 0xb, 0x9, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x2, 0x1, 0x80, {0x8, 0x25, 0x1, 0x80, 0x0, 0x6, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x81, 0x6, 0x9, {0x8, 0x25, 0x1, 0x82, 0x3c, 0x3, 0x9}}}}}}}}]}}, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}, 0x16})

program did not crash
testing program (duration=7m50.654793325s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0)
syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0}, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0)
syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000e00)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8f, 0x2b73, 0x23, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x4, 0x40, 0x2, {0x8, 0xb, 0x1, 0x2, 0x1, 0x5, 0x20, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x5409, 0xb, 0x9, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x2, 0x1, 0x80, {0x8, 0x25, 0x1, 0x80, 0x0, 0x6, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x81, 0x6, 0x9, {0x8, 0x25, 0x1, 0x82, 0x3c, 0x3, 0x9}}}}}}}}]}}, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}, 0x16})

program did not crash
testing program (duration=7m50.654793325s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0)
syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0)
syz_usb_connect$uac2(0x5, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}})

program crashed: KASAN: slab-use-after-free Read in report_descriptor_read
testing program (duration=7m50.654793325s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0)
syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0)
syz_usb_connect$uac2(0x5, 0x0, 0x0, 0x0)

program did not crash
testing program (duration=7m50.654793325s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0)
syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0)
syz_usb_connect$uac2(0x5, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0})

program did not crash
extracting C reproducer
testing compiled C program (duration=7m50.654793325s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
simplifying guilty program options
testing program (duration=7m50.654793325s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0)
syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0)
syz_usb_connect$uac2(0x5, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}})

program crashed: KASAN: slab-use-after-free Read in report_descriptor_read
extracting C reproducer
testing compiled C program (duration=7m50.654793325s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing program (duration=7m50.654793325s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0)
syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0)
syz_usb_connect$uac2(0x5, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}})

program did not crash
testing program (duration=7m50.654793325s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0)
syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0)
syz_usb_connect$uac2(0x5, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}})

program did not crash
validation run: crashed=false
testing program (duration=7m50.654793325s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0)
syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0)
syz_usb_connect$uac2(0x5, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}})

program did not crash
validation run: crashed=false
testing program (duration=7m50.654793325s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0)
syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0)
syz_usb_connect$uac2(0x5, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}})

program did not crash
validation run: crashed=false
testing program (duration=7m50.654793325s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0)
syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0)
syz_usb_connect$uac2(0x5, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}})

program crashed: KASAN: slab-use-after-free Read in report_descriptor_read
validation run: crashed=true
testing program (duration=7m50.654793325s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0)
syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0)
syz_usb_connect$uac2(0x5, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}})

program did not crash
validation run: crashed=false
testing program (duration=7m50.654793325s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0)
syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0)
syz_usb_connect$uac2(0x5, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}})

program crashed: KASAN: slab-use-after-free Read in report_descriptor_read
validation run: crashed=true
testing program (duration=7m50.654793325s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$cdc_ecm-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0)
syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120110036392351ef2f210108713e1b121efb6cad4002bdc790cf43cd0e7218c9c1a8bd3ffd0bb6560"], &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
syz_usb_connect$cdc_ecm(0x2, 0x56, 0x0, 0x0)
syz_usb_connect$uac2(0x5, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}})

program crashed: KASAN: slab-use-after-free Read in report_descriptor_read
validation run: crashed=true
reproducing took 4h45m11.228512287s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-use-after-free in report_descriptor_read+0xbb/0x100 drivers/hid/hid-core.c:2272
Read of size 24 at addr ffff888114e379c0 by task fido_id/6322

CPU: 1 UID: 0 PID: 6322 Comm: fido_id Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
 check_region_inline mm/kasan/generic.c:186 [inline]
 kasan_check_range+0x10f/0x1e0 mm/kasan/generic.c:200
 __asan_memcpy+0x23/0x60 mm/kasan/shadow.c:105
 report_descriptor_read+0xbb/0x100 drivers/hid/hid-core.c:2272
 sysfs_kf_bin_read+0x156/0x210 fs/sysfs/file.c:102
 kernfs_file_read_iter fs/kernfs/file.c:262 [inline]
 kernfs_fop_read_iter+0x32b/0x610 fs/kernfs/file.c:291
 new_sync_read fs/read_write.c:493 [inline]
 vfs_read+0x82e/0xb40 fs/read_write.c:574
 ksys_read+0x12a/0x250 fs/read_write.c:716
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x10b/0x7f0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3e86a68407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007fff13725ee0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f3e8697a880 RCX: 00007f3e86a68407
RDX: 0000000000001000 RSI: 00007fff13725f30 RDI: 0000000000000004
RBP: 000055fd6a2032c0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 000055fd6a2024c0
R13: 00007fff13725f30 R14: 0000000000000004 R15: 000055fd2f55e4d8
 </TASK>

Allocated by task 5780:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5334 [inline]
 __kmalloc_node_track_caller_noprof+0x318/0x7d0 mm/slub.c:5471
 kmemdup_noprof+0x29/0x60 mm/util.c:138
 kmemdup_noprof include/linux/fortify-string.h:715 [inline]
 hid_open_report+0x214/0x810 drivers/hid/hid-core.c:1376
 hid_parse include/linux/hid.h:1206 [inline]
 lg_probe+0x246/0x7e0 drivers/hid/hid-lg.c:783
 __hid_device_probe drivers/hid/hid-core.c:2829 [inline]
 hid_device_probe+0x50e/0x800 drivers/hid/hid-core.c:2866
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868
 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026
 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098
 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x64/0x160 drivers/base/bus.c:620
 device_add+0x121d/0x1970 drivers/base/core.c:3772
 hid_add_device+0x2bf/0x440 drivers/hid/hid-core.c:3010
 usbhid_probe+0xa64/0x10b0 drivers/hid/usbhid/hid-core.c:1452
 usb_probe_interface+0x386/0x9b0 drivers/usb/core/driver.c:399
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868
 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026
 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098
 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x64/0x160 drivers/base/bus.c:620
 device_add+0x121d/0x1970 drivers/base/core.c:3772
 usb_set_configuration+0xd97/0x1c60 drivers/usb/core/message.c:2268
 usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250
 usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:293
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868
 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026
 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098
 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x64/0x160 drivers/base/bus.c:620
 device_add+0x121d/0x1970 drivers/base/core.c:3772
 usb_new_device.part.0+0xcc2/0x1686 drivers/usb/core/hub.c:2708
 usb_new_device drivers/usb/core/hub.c:5833 [inline]
 hub_port_connect drivers/usb/core/hub.c:5580 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5720 [inline]
 port_event drivers/usb/core/hub.c:5884 [inline]
 hub_event.cold+0x51a/0xe9d drivers/usb/core/hub.c:5966
 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
 process_scheduled_works kernel/workqueue.c:3405 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

The buggy address belongs to the object at ffff888114e379c0
 which belongs to the cache kmalloc-32 of size 32
The buggy address is located 0 bytes inside of
 freed 32-byte region [ffff888114e379c0, ffff888114e379e0)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x114e37
flags: 0x200000000000000(node=0|zone=2)
page_type: f5(slab)
raw: 0200000000000000 ffff888100041780 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800400040 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 0, tgid 0 (swapper/1), ts 11842906152, free_ts 0
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859
 prep_new_page mm/page_alloc.c:1867 [inline]
 get_page_from_freelist+0xf25/0x3400 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x28f/0x2b90 mm/page_alloc.c:5304
 alloc_slab_page mm/slub.c:3266 [inline]
 allocate_slab mm/slub.c:3380 [inline]
 new_slab+0xa2/0x670 mm/slub.c:3426
 refill_objects+0xe3/0x410 mm/slub.c:7310
 refill_sheaf mm/slub.c:2804 [inline]
 __pcs_replace_empty_main+0x376/0x680 mm/slub.c:4675
 alloc_from_pcs mm/slub.c:4773 [inline]
 slab_alloc_node mm/slub.c:4905 [inline]
 __kmalloc_cache_noprof+0x50e/0x670 mm/slub.c:5485
 _kmalloc_noprof include/linux/slab.h:988 [inline]
 slab_free_hook mm/slub.c:2629 [inline]
 slab_free mm/slub.c:6377 [inline]
 kmem_cache_free+0x3f3/0x650 mm/slub.c:6504
 mempool_free+0xde/0x130 mm/mempool.c:704
 bio_put_percpu_cache block/bio.c:831 [inline]
 bio_put+0x3a0/0x680 block/bio.c:850
 bio_endio_bh fs/buffer.c:151 [inline]
 bh_end_read+0xc0/0x110 fs/buffer.c:188
 bio_endio+0x5f6/0x730 block/bio.c:1819
 blk_update_request+0x2df/0xdf0 block/blk-mq.c:1016
 scsi_end_request+0x7c/0x9b0 drivers/scsi/scsi_lib.c:671
 scsi_io_completion+0xc0/0x12d0 drivers/scsi/scsi_lib.c:1112
 scsi_complete+0x3dd/0x560 drivers/scsi/scsi_lib.c:1592
page_owner free stack trace missing

Memory state around the buggy address:
 ffff888114e37880: 00 00 04 fc fc fc fc fc 00 00 04 fc fc fc fc fc
 ffff888114e37900: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc
>ffff888114e37980: fa fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
                                           ^
 ffff888114e37a00: fa fb fb fb fc fc fc fc 00 00 04 fc fc fc fc fc
 ffff888114e37a80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
==================================================================

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-use-after-free in report_descriptor_read+0xbb/0x100 drivers/hid/hid-core.c:2272
Read of size 24 at addr ffff888114e379c0 by task fido_id/6322

CPU: 1 UID: 0 PID: 6322 Comm: fido_id Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
 check_region_inline mm/kasan/generic.c:186 [inline]
 kasan_check_range+0x10f/0x1e0 mm/kasan/generic.c:200
 __asan_memcpy+0x23/0x60 mm/kasan/shadow.c:105
 report_descriptor_read+0xbb/0x100 drivers/hid/hid-core.c:2272
 sysfs_kf_bin_read+0x156/0x210 fs/sysfs/file.c:102
 kernfs_file_read_iter fs/kernfs/file.c:262 [inline]
 kernfs_fop_read_iter+0x32b/0x610 fs/kernfs/file.c:291
 new_sync_read fs/read_write.c:493 [inline]
 vfs_read+0x82e/0xb40 fs/read_write.c:574
 ksys_read+0x12a/0x250 fs/read_write.c:716
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x10b/0x7f0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3e86a68407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007fff13725ee0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f3e8697a880 RCX: 00007f3e86a68407
RDX: 0000000000001000 RSI: 00007fff13725f30 RDI: 0000000000000004
RBP: 000055fd6a2032c0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 000055fd6a2024c0
R13: 00007fff13725f30 R14: 0000000000000004 R15: 000055fd2f55e4d8
 </TASK>

Allocated by task 5780:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5334 [inline]
 __kmalloc_node_track_caller_noprof+0x318/0x7d0 mm/slub.c:5471
 kmemdup_noprof+0x29/0x60 mm/util.c:138
 kmemdup_noprof include/linux/fortify-string.h:715 [inline]
 hid_open_report+0x214/0x810 drivers/hid/hid-core.c:1376
 hid_parse include/linux/hid.h:1206 [inline]
 lg_probe+0x246/0x7e0 drivers/hid/hid-lg.c:783
 __hid_device_probe drivers/hid/hid-core.c:2829 [inline]
 hid_device_probe+0x50e/0x800 drivers/hid/hid-core.c:2866
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868
 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026
 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098
 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x64/0x160 drivers/base/bus.c:620
 device_add+0x121d/0x1970 drivers/base/core.c:3772
 hid_add_device+0x2bf/0x440 drivers/hid/hid-core.c:3010
 usbhid_probe+0xa64/0x10b0 drivers/hid/usbhid/hid-core.c:1452
 usb_probe_interface+0x386/0x9b0 drivers/usb/core/driver.c:399
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868
 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026
 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098
 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x64/0x160 drivers/base/bus.c:620
 device_add+0x121d/0x1970 drivers/base/core.c:3772
 usb_set_configuration+0xd97/0x1c60 drivers/usb/core/message.c:2268
 usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250
 usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:293
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868
 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026
 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098
 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x64/0x160 drivers/base/bus.c:620
 device_add+0x121d/0x1970 drivers/base/core.c:3772
 usb_new_device.part.0+0xcc2/0x1686 drivers/usb/core/hub.c:2708
 usb_new_device drivers/usb/core/hub.c:5833 [inline]
 hub_port_connect drivers/usb/core/hub.c:5580 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5720 [inline]
 port_event drivers/usb/core/hub.c:5884 [inline]
 hub_event.cold+0x51a/0xe9d drivers/usb/core/hub.c:5966
 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
 process_scheduled_works kernel/workqueue.c:3405 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

The buggy address belongs to the object at ffff888114e379c0
 which belongs to the cache kmalloc-32 of size 32
The buggy address is located 0 bytes inside of
 freed 32-byte region [ffff888114e379c0, ffff888114e379e0)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x114e37
flags: 0x200000000000000(node=0|zone=2)
page_type: f5(slab)
raw: 0200000000000000 ffff888100041780 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800400040 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 0, tgid 0 (swapper/1), ts 11842906152, free_ts 0
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859
 prep_new_page mm/page_alloc.c:1867 [inline]
 get_page_from_freelist+0xf25/0x3400 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x28f/0x2b90 mm/page_alloc.c:5304
 alloc_slab_page mm/slub.c:3266 [inline]
 allocate_slab mm/slub.c:3380 [inline]
 new_slab+0xa2/0x670 mm/slub.c:3426
 refill_objects+0xe3/0x410 mm/slub.c:7310
 refill_sheaf mm/slub.c:2804 [inline]
 __pcs_replace_empty_main+0x376/0x680 mm/slub.c:4675
 alloc_from_pcs mm/slub.c:4773 [inline]
 slab_alloc_node mm/slub.c:4905 [inline]
 __kmalloc_cache_noprof+0x50e/0x670 mm/slub.c:5485
 _kmalloc_noprof include/linux/slab.h:988 [inline]
 slab_free_hook mm/slub.c:2629 [inline]
 slab_free mm/slub.c:6377 [inline]
 kmem_cache_free+0x3f3/0x650 mm/slub.c:6504
 mempool_free+0xde/0x130 mm/mempool.c:704
 bio_put_percpu_cache block/bio.c:831 [inline]
 bio_put+0x3a0/0x680 block/bio.c:850
 bio_endio_bh fs/buffer.c:151 [inline]
 bh_end_read+0xc0/0x110 fs/buffer.c:188
 bio_endio+0x5f6/0x730 block/bio.c:1819
 blk_update_request+0x2df/0xdf0 block/blk-mq.c:1016
 scsi_end_request+0x7c/0x9b0 drivers/scsi/scsi_lib.c:671
 scsi_io_completion+0xc0/0x12d0 drivers/scsi/scsi_lib.c:1112
 scsi_complete+0x3dd/0x560 drivers/scsi/scsi_lib.c:1592
page_owner free stack trace missing

Memory state around the buggy address:
 ffff888114e37880: 00 00 04 fc fc fc fc fc 00 00 04 fc fc fc fc fc
 ffff888114e37900: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc
>ffff888114e37980: fa fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
                                           ^
 ffff888114e37a00: fa fb fb fb fc fc fc fc 00 00 04 fc fc fc fc fc
 ffff888114e37a80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
==================================================================