Extracting prog: 1m52.142786746s
Minimizing prog: 13m34.460215571s
Simplifying prog options: 0s
Extracting C: 1m3.045199823s
Simplifying C: 6m56.313070297s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404705352200000102030109022000010100c0010904000002000000000705020200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/usb/drivers/usbtest/new_id\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='0547 2235\n\x00', 0xa)

program crashed: BUG: unable to handle kernel paging request in usbtest_probe
single: successfully extracted reproducer
found reproducer with 5 syscalls
minimizing guilty program
testing program (duration=41.406571453s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404705352200000102030109022000010100c0010904000002000000000705020200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/usb/drivers/usbtest/new_id\x00', 0x1, 0x0)

program did not crash
testing program (duration=41.406571453s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404705352200000102030109022000010100c0010904000002000000000705020200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000200)='0547 2235\n\x00', 0xa)

program did not crash
testing program (duration=41.406571453s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404705352200000102030109022000010100c0010904000002000000000705020200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/usb/drivers/usbtest/new_id\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='0547 2235\n\x00', 0xa)

program did not crash
testing program (duration=41.406571453s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404705352200000102030109022000010100c0010904000002000000000705020200020007058202000200"], 0x0)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/usb/drivers/usbtest/new_id\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='0547 2235\n\x00', 0xa)

program did not crash
testing program (duration=41.406571453s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/usb/drivers/usbtest/new_id\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='0547 2235\n\x00', 0xa)

program did not crash
testing program (duration=41.406571453s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/usb/drivers/usbtest/new_id\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='0547 2235\n\x00', 0xa)

program did not crash
testing program (duration=41.406571453s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/usb/drivers/usbtest/new_id\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='0547 2235\n\x00', 0xa)

program did not crash
testing program (duration=41.406571453s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404705352200000102030109022000010100c0010904000002000000000705020200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/usb/drivers/usbtest/new_id\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='0547 2235\n\x00', 0xa)

program did not crash
testing program (duration=41.406571453s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404705352200000102030109022000010100c0010904000002000000000705020200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/usb/drivers/usbtest/new_id\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='0547 2235\n\x00', 0xa)

program did not crash
testing program (duration=41.406571453s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404705352200000102030109022000010100c0010904000002000000000705020200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/usb/drivers/usbtest/new_id\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='0547 2235\n\x00', 0xa)

program did not crash
testing program (duration=41.406571453s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404705352200000102030109022000010100c0010904000002000000000705020200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000200)='0547 2235\n\x00', 0xa)

program did not crash
testing program (duration=41.406571453s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404705352200000102030109022000010100c0010904000002000000000705020200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/usb/drivers/usbtest/new_id\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)

program did not crash
testing program (duration=41.406571453s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404705352200000102030109022000010100c0010904000002000000000705020200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/usb/drivers/usbtest/new_id\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200), 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=41.406571453s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
program crashed: BUG: unable to handle kernel paging request in usbtest_probe
simplifying C reproducer
testing compiled C program (duration=41.406571453s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
program crashed: BUG: unable to handle kernel paging request in usbtest_probe
testing compiled C program (duration=41.406571453s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
program did not crash
testing compiled C program (duration=41.406571453s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
program crashed: BUG: unable to handle kernel paging request in usbtest_probe
testing compiled C program (duration=41.406571453s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
program crashed: BUG: unable to handle kernel paging request in usbtest_probe
testing compiled C program (duration=41.406571453s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
program crashed: BUG: unable to handle kernel paging request in usbtest_probe
testing compiled C program (duration=41.406571453s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
program crashed: BUG: unable to handle kernel paging request in usbtest_probe
testing compiled C program (duration=41.406571453s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
program crashed: BUG: unable to handle kernel paging request in usbtest_probe
testing compiled C program (duration=41.406571453s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
program crashed: BUG: unable to handle kernel paging request in usbtest_probe
testing program (duration=41.406571453s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404705352200000102030109022000010100c0010904000002000000000705020200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/usb/drivers/usbtest/new_id\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='0547 2235\n\x00', 0xa)

program crashed: BUG: unable to handle kernel paging request in usbtest_probe
validation run: crashed=true
testing program (duration=41.406571453s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404705352200000102030109022000010100c0010904000002000000000705020200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/usb/drivers/usbtest/new_id\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='0547 2235\n\x00', 0xa)

program crashed: BUG: unable to handle kernel paging request in usbtest_probe
validation run: crashed=true
testing program (duration=41.406571453s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404705352200000102030109022000010100c0010904000002000000000705020200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/usb/drivers/usbtest/new_id\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='0547 2235\n\x00', 0xa)

program crashed: BUG: unable to handle kernel paging request in usbtest_probe
validation run: crashed=true
reproducing took 26m14.232765385s
repro crashed as (corrupted=false):
usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 1-1: Product: syz
usb 1-1: Manufacturer: syz
usb 1-1: SerialNumber: syz
Unable to handle kernel paging request at virtual address dfff800000000001
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
Mem abort info:
  ESR = 0x0000000096000005
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x05: level 1 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0
[dfff800000000001] address between user and kernel address ranges
Internal error: Oops: 0000000096000005 [#1]  SMP
Modules linked in:
CPU: 1 UID: 0 PID: 868 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
Workqueue: usb_hub_wq hub_event
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : usbtest_probe+0x40c/0xa6c drivers/usb/misc/usbtest.c:2822
lr : usbtest_probe+0x3f8/0xa6c drivers/usb/misc/usbtest.c:2822
sp : ffff800093bd6f20
x29: ffff800093bd6f50 x28: ffff0000cb2800b0 x27: dfff800000000000
x26: ffff80008730aba0 x25: 1fffe00019a32fda x24: ffff0000cb280000
x23: 1fffe00019a32fc0 x22: 000000000000000a x21: ffff0000cd197e00
x20: 0000000000000000 x19: ffff0000d15c1000 x18: 00000000ffffffff
x17: 00000000ffff0000 x16: ffff000000000000 x15: 0000000000000000
x14: 00000000ffff8000 x13: 00000000daca9355 x12: ffff800080137594
x11: ffff800080137594 x10: ffff800093bd6d18 x9 : 0000000000000000
x8 : 0000000000000001 x7 : 0000000000000000 x6 : 000000000000003f
x5 : 0000000000000040 x4 : 0000000000000001 x3 : ffff8000834e8364
x2 : 00000000ffffffff x1 : ffff0000c6c89d40 x0 : 0000000000000000
Call trace:
 usbtest_probe+0x40c/0xa6c drivers/usb/misc/usbtest.c:2822 (P)
 usb_probe_interface+0x308/0x788 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x29c/0x800 drivers/base/dd.c:706
 __driver_probe_device+0x1e0/0x350 drivers/base/dd.c:868
 driver_probe_device+0x6c/0x19c drivers/base/dd.c:898
 __device_attach_driver+0x198/0x2f8 drivers/base/dd.c:1026
 bus_for_each_drv+0x144/0x1dc drivers/base/bus.c:500
 __device_attach+0x248/0x390 drivers/base/dd.c:1098
 device_initial_probe+0x90/0xc8 drivers/base/dd.c:1153
 bus_probe_device+0x58/0x120 drivers/base/bus.c:620
 device_add+0x6cc/0x9e0 drivers/base/core.c:3772
 usb_set_configuration+0x1184/0x158c drivers/usb/core/message.c:2268
 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:250
 usb_probe_device+0x114/0x2b0 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x29c/0x800 drivers/base/dd.c:706
 __driver_probe_device+0x1e0/0x350 drivers/base/dd.c:868
 driver_probe_device+0x6c/0x19c drivers/base/dd.c:898
 __device_attach_driver+0x198/0x2f8 drivers/base/dd.c:1026
 bus_for_each_drv+0x144/0x1dc drivers/base/bus.c:500
 __device_attach+0x248/0x390 drivers/base/dd.c:1098
 device_initial_probe+0x90/0xc8 drivers/base/dd.c:1153
 bus_probe_device+0x58/0x120 drivers/base/bus.c:620
 device_add+0x6cc/0x9e0 drivers/base/core.c:3772
 usb_new_device+0x9bc/0x11f0 drivers/usb/core/hub.c:2695
 hub_port_connect drivers/usb/core/hub.c:5567 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
 port_event drivers/usb/core/hub.c:5871 [inline]
 hub_event+0x1ef0/0x39fc drivers/usb/core/hub.c:5953
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0x788/0x10b8 kernel/workqueue.c:3405
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3486
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:842
Code: 9745b896 14000016 91002a96 d343fec8 (38fb6908) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	9745b896 	bl	0xfffffffffd16e258
   4:	14000016 	b	0x5c
   8:	91002a96 	add	x22, x20, #0xa
   c:	d343fec8 	lsr	x8, x22, #3
* 10:	38fb6908 	ldrsb	w8, [x8, x27] <-- trapping instruction

final repro crashed as (corrupted=false):
usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 1-1: Product: syz
usb 1-1: Manufacturer: syz
usb 1-1: SerialNumber: syz
Unable to handle kernel paging request at virtual address dfff800000000001
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
Mem abort info:
  ESR = 0x0000000096000005
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x05: level 1 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0
[dfff800000000001] address between user and kernel address ranges
Internal error: Oops: 0000000096000005 [#1]  SMP
Modules linked in:
CPU: 1 UID: 0 PID: 868 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
Workqueue: usb_hub_wq hub_event
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : usbtest_probe+0x40c/0xa6c drivers/usb/misc/usbtest.c:2822
lr : usbtest_probe+0x3f8/0xa6c drivers/usb/misc/usbtest.c:2822
sp : ffff800093bd6f20
x29: ffff800093bd6f50 x28: ffff0000cb2800b0 x27: dfff800000000000
x26: ffff80008730aba0 x25: 1fffe00019a32fda x24: ffff0000cb280000
x23: 1fffe00019a32fc0 x22: 000000000000000a x21: ffff0000cd197e00
x20: 0000000000000000 x19: ffff0000d15c1000 x18: 00000000ffffffff
x17: 00000000ffff0000 x16: ffff000000000000 x15: 0000000000000000
x14: 00000000ffff8000 x13: 00000000daca9355 x12: ffff800080137594
x11: ffff800080137594 x10: ffff800093bd6d18 x9 : 0000000000000000
x8 : 0000000000000001 x7 : 0000000000000000 x6 : 000000000000003f
x5 : 0000000000000040 x4 : 0000000000000001 x3 : ffff8000834e8364
x2 : 00000000ffffffff x1 : ffff0000c6c89d40 x0 : 0000000000000000
Call trace:
 usbtest_probe+0x40c/0xa6c drivers/usb/misc/usbtest.c:2822 (P)
 usb_probe_interface+0x308/0x788 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x29c/0x800 drivers/base/dd.c:706
 __driver_probe_device+0x1e0/0x350 drivers/base/dd.c:868
 driver_probe_device+0x6c/0x19c drivers/base/dd.c:898
 __device_attach_driver+0x198/0x2f8 drivers/base/dd.c:1026
 bus_for_each_drv+0x144/0x1dc drivers/base/bus.c:500
 __device_attach+0x248/0x390 drivers/base/dd.c:1098
 device_initial_probe+0x90/0xc8 drivers/base/dd.c:1153
 bus_probe_device+0x58/0x120 drivers/base/bus.c:620
 device_add+0x6cc/0x9e0 drivers/base/core.c:3772
 usb_set_configuration+0x1184/0x158c drivers/usb/core/message.c:2268
 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:250
 usb_probe_device+0x114/0x2b0 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x29c/0x800 drivers/base/dd.c:706
 __driver_probe_device+0x1e0/0x350 drivers/base/dd.c:868
 driver_probe_device+0x6c/0x19c drivers/base/dd.c:898
 __device_attach_driver+0x198/0x2f8 drivers/base/dd.c:1026
 bus_for_each_drv+0x144/0x1dc drivers/base/bus.c:500
 __device_attach+0x248/0x390 drivers/base/dd.c:1098
 device_initial_probe+0x90/0xc8 drivers/base/dd.c:1153
 bus_probe_device+0x58/0x120 drivers/base/bus.c:620
 device_add+0x6cc/0x9e0 drivers/base/core.c:3772
 usb_new_device+0x9bc/0x11f0 drivers/usb/core/hub.c:2695
 hub_port_connect drivers/usb/core/hub.c:5567 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
 port_event drivers/usb/core/hub.c:5871 [inline]
 hub_event+0x1ef0/0x39fc drivers/usb/core/hub.c:5953
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0x788/0x10b8 kernel/workqueue.c:3405
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3486
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:842
Code: 9745b896 14000016 91002a96 d343fec8 (38fb6908) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	9745b896 	bl	0xfffffffffd16e258
   4:	14000016 	b	0x5c
   8:	91002a96 	add	x22, x20, #0xa
   c:	d343fec8 	lsr	x8, x22, #3
* 10:	38fb6908 	ldrsb	w8, [x8, x27] <-- trapping instruction