Extracting prog: 7m23.130404323s
Minimizing prog: 1h0m50.554648172s
Simplifying prog options: 14m12.519465953s
Extracting C: 5m6.703323786s
Simplifying C: 0s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b00010000000009046b00016a93f000090588"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x0, 0x0)

program did not crash
program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b00010000000009046b00016a93f000090588"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x0, 0x0)

program crashed: BUG: corrupted list in usb_hcd_link_urb_to_ep
single: successfully extracted reproducer
found reproducer with 4 syscalls
minimizing guilty program
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b00010000000009046b00016a93f000090588"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-openat
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b00010000000009046b00016a93f000090588"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mount-openat
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b00010000000009046b00016a93f000090588"], 0x0)
mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b00010000000009046b00016a93f000090588"], 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b00010000000009046b00016a93f000090588"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b00010000000009046b00016a93f000090588"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000500)='./dev\x00', 0x0, 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b00010000000009046b00016a93f000090588"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
simplifying guilty program options
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b00010000000009046b00016a93f000090588"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x0, 0x0)

program crashed: BUG: corrupted list in usb_hcd_link_urb_to_ep
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b00010000000009046b00016a93f000090588"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b00010000000009046b00016a93f000090588"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x0, 0x0)

program crashed: BUG: corrupted list in usb_hcd_link_urb_to_ep
validation run: crashed=true
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b00010000000009046b00016a93f000090588"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x0, 0x0)

program did not crash
validation run: crashed=false
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b00010000000009046b00016a93f000090588"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x0, 0x0)

program did not crash
validation run: crashed=false
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b00010000000009046b00016a93f000090588"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x0, 0x0)

program crashed: BUG: corrupted list in usb_hcd_link_urb_to_ep
validation run: crashed=true
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b00010000000009046b00016a93f000090588"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x0, 0x0)

program crashed: BUG: corrupted list in usb_hcd_link_urb_to_ep
validation run: crashed=true
reproducing took 1h52m17.016566073s
repro crashed as (corrupted=false):
list_add double add: new=ffff88802548f818, prev=ffff88802548f818, next=ffff88802a60c078.
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:35!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 3 UID: 0 PID: 5908 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:__list_add_valid_or_report.cold+0x34/0x36 lib/list_debug.c:35
Code: eb ff 90 0f 0b 48 c7 c7 00 41 62 8c e8 5a cc eb ff 90 0f 0b 48 89 d9 4c 89 ea 48 89 ee 48 c7 c7 40 43 62 8c e8 42 cc eb ff 90 <0f> 0b 48 89 de 48 c7 c7 00 44 62 8c e8 30 cc eb ff 90 0f 0b 48 89
RSP: 0000:ffffc900005f8888 EFLAGS: 00010086
RAX: 0000000000000058 RBX: ffff88802a60c078 RCX: 0000000000000000
RDX: 0000000000000058 RSI: ffffffff81e9b0c9 RDI: fffff520000bf102
RBP: ffff88802548f818 R08: 0000000000000007 R09: 0000000000000000
R10: 8000000000000102 R11: 0000000000000001 R12: ffff88802a60c080
R13: ffff88802548f818 R14: 0000000000000000 R15: ffff88802548f818
FS:  0000000000000000(0000) GS:ffff888096c52000(0063) knlGS:000000005764e480
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 000000002e463fff CR3: 000000004ddf1000 CR4: 0000000000352ef0
Call Trace:
 <IRQ>
 __list_add_valid include/linux/list.h:104 [inline]
 __list_add include/linux/list.h:169 [inline]
 list_add_tail include/linux/list.h:206 [inline]
 usb_hcd_link_urb_to_ep+0x220/0x3a0 drivers/usb/core/hcd.c:1154
 dummy_urb_enqueue+0x2b5/0x880 drivers/usb/gadget/udc/dummy_hcd.c:1314
 usb_hcd_submit_urb+0x268/0x2150 drivers/usb/core/hcd.c:1542
 usb_submit_urb+0x827/0x19b0 drivers/usb/core/urb.c:586
 keyspan_usa49_send_setup.isra.0+0x72c/0xf10 drivers/usb/serial/keyspan.c:2466
 usa49_glocont_callback+0x18d/0x260 drivers/usb/serial/keyspan.c:1047
 __usb_hcd_giveback_urb+0x38e/0x610 drivers/usb/core/hcd.c:1657
 usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
 dummy_timer+0xdaf/0x3820 drivers/usb/gadget/udc/dummy_hcd.c:2023
 __run_hrtimer kernel/time/hrtimer.c:2074 [inline]
 __hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2131
 hrtimer_run_softirq+0x1ca/0x360 kernel/time/hrtimer.c:2148
 handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0x16a/0x210 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:syscall_enter_from_user_mode_work include/linux/entry-common.h:144 [inline]
RIP: 0010:do_int80_emulation+0xfb/0x650 arch/x86/entry/syscall_32.c:165
Code: 0f 85 63 05 00 00 8b 43 50 48 c7 43 50 da ff ff ff 48 89 43 78 41 83 4c 24 10 02 4c 63 6b 78 e8 9b 8c 43 f6 fb 4d 8b 74 24 08 <41> f6 c6 bf 74 45 41 f6 c6 20 0f 85 83 02 00 00 41 f6 c6 80 0f 85
RSP: 0000:ffffc900064d7f10 EFLAGS: 00000206
RAX: 000000000016d581 RBX: ffffc900064d7f48 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8e392c04 RDI: ffffffff8c624080
RBP: ffffc900064d7f38 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888021b88000
R13: 0000000000000072 R14: 0000000000000000 R15: 0000000000000000
 asm_int80_emulation+0x1a/0x20 arch/x86/include/asm/idtentry.h:598
RIP: 0023:0xf71175eb
Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53
RSP: 002b:00000000ffaba22c EFLAGS: 00000246 ORIG_RAX: 0000000000000072
RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00000000ffaba3c8
RDX: 0000000040000001 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_add_valid_or_report.cold+0x34/0x36 lib/list_debug.c:35
Code: eb ff 90 0f 0b 48 c7 c7 00 41 62 8c e8 5a cc eb ff 90 0f 0b 48 89 d9 4c 89 ea 48 89 ee 48 c7 c7 40 43 62 8c e8 42 cc eb ff 90 <0f> 0b 48 89 de 48 c7 c7 00 44 62 8c e8 30 cc eb ff 90 0f 0b 48 89
RSP: 0000:ffffc900005f8888 EFLAGS: 00010086
RAX: 0000000000000058 RBX: ffff88802a60c078 RCX: 0000000000000000
RDX: 0000000000000058 RSI: ffffffff81e9b0c9 RDI: fffff520000bf102
RBP: ffff88802548f818 R08: 0000000000000007 R09: 0000000000000000
R10: 8000000000000102 R11: 0000000000000001 R12: ffff88802a60c080
R13: ffff88802548f818 R14: 0000000000000000 R15: ffff88802548f818
FS:  0000000000000000(0000) GS:ffff888096c52000(0063) knlGS:000000005764e480
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 000000002e463fff CR3: 000000004ddf1000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
   0:	0f 85 63 05 00 00    	jne    0x569
   6:	8b 43 50             	mov    0x50(%rbx),%eax
   9:	48 c7 43 50 da ff ff 	movq   $0xffffffffffffffda,0x50(%rbx)
  10:	ff
  11:	48 89 43 78          	mov    %rax,0x78(%rbx)
  15:	41 83 4c 24 10 02    	orl    $0x2,0x10(%r12)
  1b:	4c 63 6b 78          	movslq 0x78(%rbx),%r13
  1f:	e8 9b 8c 43 f6       	call   0xf6438cbf
  24:	fb                   	sti
  25:	4d 8b 74 24 08       	mov    0x8(%r12),%r14
* 2a:	41 f6 c6 bf          	test   $0xbf,%r14b <-- trapping instruction
  2e:	74 45                	je     0x75
  30:	41 f6 c6 20          	test   $0x20,%r14b
  34:	0f 85 83 02 00 00    	jne    0x2bd
  3a:	41 f6 c6 80          	test   $0x80,%r14b
  3e:	0f                   	.byte 0xf
  3f:	85                   	.byte 0x85

final repro crashed as (corrupted=false):
list_add double add: new=ffff88802548f818, prev=ffff88802548f818, next=ffff88802a60c078.
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:35!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 3 UID: 0 PID: 5908 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:__list_add_valid_or_report.cold+0x34/0x36 lib/list_debug.c:35
Code: eb ff 90 0f 0b 48 c7 c7 00 41 62 8c e8 5a cc eb ff 90 0f 0b 48 89 d9 4c 89 ea 48 89 ee 48 c7 c7 40 43 62 8c e8 42 cc eb ff 90 <0f> 0b 48 89 de 48 c7 c7 00 44 62 8c e8 30 cc eb ff 90 0f 0b 48 89
RSP: 0000:ffffc900005f8888 EFLAGS: 00010086
RAX: 0000000000000058 RBX: ffff88802a60c078 RCX: 0000000000000000
RDX: 0000000000000058 RSI: ffffffff81e9b0c9 RDI: fffff520000bf102
RBP: ffff88802548f818 R08: 0000000000000007 R09: 0000000000000000
R10: 8000000000000102 R11: 0000000000000001 R12: ffff88802a60c080
R13: ffff88802548f818 R14: 0000000000000000 R15: ffff88802548f818
FS:  0000000000000000(0000) GS:ffff888096c52000(0063) knlGS:000000005764e480
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 000000002e463fff CR3: 000000004ddf1000 CR4: 0000000000352ef0
Call Trace:
 <IRQ>
 __list_add_valid include/linux/list.h:104 [inline]
 __list_add include/linux/list.h:169 [inline]
 list_add_tail include/linux/list.h:206 [inline]
 usb_hcd_link_urb_to_ep+0x220/0x3a0 drivers/usb/core/hcd.c:1154
 dummy_urb_enqueue+0x2b5/0x880 drivers/usb/gadget/udc/dummy_hcd.c:1314
 usb_hcd_submit_urb+0x268/0x2150 drivers/usb/core/hcd.c:1542
 usb_submit_urb+0x827/0x19b0 drivers/usb/core/urb.c:586
 keyspan_usa49_send_setup.isra.0+0x72c/0xf10 drivers/usb/serial/keyspan.c:2466
 usa49_glocont_callback+0x18d/0x260 drivers/usb/serial/keyspan.c:1047
 __usb_hcd_giveback_urb+0x38e/0x610 drivers/usb/core/hcd.c:1657
 usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
 dummy_timer+0xdaf/0x3820 drivers/usb/gadget/udc/dummy_hcd.c:2023
 __run_hrtimer kernel/time/hrtimer.c:2074 [inline]
 __hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2131
 hrtimer_run_softirq+0x1ca/0x360 kernel/time/hrtimer.c:2148
 handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0x16a/0x210 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:syscall_enter_from_user_mode_work include/linux/entry-common.h:144 [inline]
RIP: 0010:do_int80_emulation+0xfb/0x650 arch/x86/entry/syscall_32.c:165
Code: 0f 85 63 05 00 00 8b 43 50 48 c7 43 50 da ff ff ff 48 89 43 78 41 83 4c 24 10 02 4c 63 6b 78 e8 9b 8c 43 f6 fb 4d 8b 74 24 08 <41> f6 c6 bf 74 45 41 f6 c6 20 0f 85 83 02 00 00 41 f6 c6 80 0f 85
RSP: 0000:ffffc900064d7f10 EFLAGS: 00000206
RAX: 000000000016d581 RBX: ffffc900064d7f48 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8e392c04 RDI: ffffffff8c624080
RBP: ffffc900064d7f38 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888021b88000
R13: 0000000000000072 R14: 0000000000000000 R15: 0000000000000000
 asm_int80_emulation+0x1a/0x20 arch/x86/include/asm/idtentry.h:598
RIP: 0023:0xf71175eb
Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53
RSP: 002b:00000000ffaba22c EFLAGS: 00000246 ORIG_RAX: 0000000000000072
RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00000000ffaba3c8
RDX: 0000000040000001 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_add_valid_or_report.cold+0x34/0x36 lib/list_debug.c:35
Code: eb ff 90 0f 0b 48 c7 c7 00 41 62 8c e8 5a cc eb ff 90 0f 0b 48 89 d9 4c 89 ea 48 89 ee 48 c7 c7 40 43 62 8c e8 42 cc eb ff 90 <0f> 0b 48 89 de 48 c7 c7 00 44 62 8c e8 30 cc eb ff 90 0f 0b 48 89
RSP: 0000:ffffc900005f8888 EFLAGS: 00010086
RAX: 0000000000000058 RBX: ffff88802a60c078 RCX: 0000000000000000
RDX: 0000000000000058 RSI: ffffffff81e9b0c9 RDI: fffff520000bf102
RBP: ffff88802548f818 R08: 0000000000000007 R09: 0000000000000000
R10: 8000000000000102 R11: 0000000000000001 R12: ffff88802a60c080
R13: ffff88802548f818 R14: 0000000000000000 R15: ffff88802548f818
FS:  0000000000000000(0000) GS:ffff888096c52000(0063) knlGS:000000005764e480
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 000000002e463fff CR3: 000000004ddf1000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
   0:	0f 85 63 05 00 00    	jne    0x569
   6:	8b 43 50             	mov    0x50(%rbx),%eax
   9:	48 c7 43 50 da ff ff 	movq   $0xffffffffffffffda,0x50(%rbx)
  10:	ff
  11:	48 89 43 78          	mov    %rax,0x78(%rbx)
  15:	41 83 4c 24 10 02    	orl    $0x2,0x10(%r12)
  1b:	4c 63 6b 78          	movslq 0x78(%rbx),%r13
  1f:	e8 9b 8c 43 f6       	call   0xf6438cbf
  24:	fb                   	sti
  25:	4d 8b 74 24 08       	mov    0x8(%r12),%r14
* 2a:	41 f6 c6 bf          	test   $0xbf,%r14b <-- trapping instruction
  2e:	74 45                	je     0x75
  30:	41 f6 c6 20          	test   $0x20,%r14b
  34:	0f 85 83 02 00 00    	jne    0x2bd
  3a:	41 f6 c6 80          	test   $0x80,%r14b
  3e:	0f                   	.byte 0xf
  3f:	85                   	.byte 0x85