Extracting prog: 1m38.564398985s
Minimizing prog: 21m13.829717772s
Simplifying prog options: 0s
Extracting C: 50.845223376s
Simplifying C: 5m49.40751368s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xc70, 0xf00e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x16}}, {{{0x9, 0x5, 0x81, 0x3, 0x40}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x22, 0x16, {[@global=@item_012={0x1, 0x1, 0x0, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @main=@item_012={0x1, 0x0, 0xa, "01"}, @global=@item_012={0x1, 0x1, 0x8, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @global=@item_012={0x1, 0x1, 0x1, '\x00'}, @global=@item_012={0x2, 0x1, 0x2, "ff00"}, @global=@item_012={0x1, 0x1, 0x7, '\b'}, @global=@item_012={0x1, 0x1, 0x9, '@'}, @main=@item_012={0x1, 0x0, 0x8, "02"}, @main=@item_012={0x0, 0x0, 0xc}]}}, 0x0}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x41, &(0x7f0000000500)="0100"/65)

program crashed: KASAN: slab-out-of-bounds Read in aqc_raw_event
single: successfully extracted reproducer
found reproducer with 4 syscalls
minimizing guilty program
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xc70, 0xf00e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x16}}, {{{0x9, 0x5, 0x81, 0x3, 0x40}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x22, 0x16, {[@global=@item_012={0x1, 0x1, 0x0, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @main=@item_012={0x1, 0x0, 0xa, "01"}, @global=@item_012={0x1, 0x1, 0x8, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @global=@item_012={0x1, 0x1, 0x1, '\x00'}, @global=@item_012={0x2, 0x1, 0x2, "ff00"}, @global=@item_012={0x1, 0x1, 0x7, '\b'}, @global=@item_012={0x1, 0x1, 0x9, '@'}, @main=@item_012={0x1, 0x0, 0x8, "02"}, @main=@item_012={0x0, 0x0, 0xc}]}}, 0x0}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xc70, 0xf00e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x16}}, {{{0x9, 0x5, 0x81, 0x3, 0x40}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_ep_write(r0, 0x81, 0x41, &(0x7f0000000500)="0100"/65)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xc70, 0xf00e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x16}}, {{{0x9, 0x5, 0x81, 0x3, 0x40}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x22, 0x16, {[@global=@item_012={0x1, 0x1, 0x0, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @main=@item_012={0x1, 0x0, 0xa, "01"}, @global=@item_012={0x1, 0x1, 0x8, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @global=@item_012={0x1, 0x1, 0x1, '\x00'}, @global=@item_012={0x2, 0x1, 0x2, "ff00"}, @global=@item_012={0x1, 0x1, 0x7, '\b'}, @global=@item_012={0x1, 0x1, 0x9, '@'}, @main=@item_012={0x1, 0x0, 0x8, "02"}, @main=@item_012={0x0, 0x0, 0xc}]}}, 0x0}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x41, &(0x7f0000000500)="0100"/65)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_ep_write
detailed listing:
executing program 0:
syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x22, 0x16, {[@global=@item_012={0x1, 0x1, 0x0, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @main=@item_012={0x1, 0x0, 0xa, "01"}, @global=@item_012={0x1, 0x1, 0x8, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @global=@item_012={0x1, 0x1, 0x1, '\x00'}, @global=@item_012={0x2, 0x1, 0x2, "ff00"}, @global=@item_012={0x1, 0x1, 0x7, '\b'}, @global=@item_012={0x1, 0x1, 0x9, '@'}, @main=@item_012={0x1, 0x0, 0x8, "02"}, @main=@item_012={0x0, 0x0, 0xc}]}}, 0x0}, 0x0)
syz_usb_ep_write(0xffffffffffffffff, 0x81, 0x41, &(0x7f0000000500)="0100"/65)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x22, 0x16, {[@global=@item_012={0x1, 0x1, 0x0, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @main=@item_012={0x1, 0x0, 0xa, "01"}, @global=@item_012={0x1, 0x1, 0x8, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @global=@item_012={0x1, 0x1, 0x1, '\x00'}, @global=@item_012={0x2, 0x1, 0x2, "ff00"}, @global=@item_012={0x1, 0x1, 0x7, '\b'}, @global=@item_012={0x1, 0x1, 0x9, '@'}, @main=@item_012={0x1, 0x0, 0x8, "02"}, @main=@item_012={0x0, 0x0, 0xc}]}}, 0x0}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x41, &(0x7f0000000500)="0100"/65)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xc70, 0xf00e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x16}}, {{{0x9, 0x5, 0x81, 0x3, 0x40}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_ep_write(r0, 0x81, 0x41, &(0x7f0000000500)="0100"/65)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xc70, 0xf00e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x16}}, {{{0x9, 0x5, 0x81, 0x3, 0x40}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x41, &(0x7f0000000500)="0100"/65)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xc70, 0xf00e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x16}}, {{{0x9, 0x5, 0x81, 0x3, 0x40}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000100), 0x0}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x41, &(0x7f0000000500)="0100"/65)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xc70, 0xf00e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x16}}, {{{0x9, 0x5, 0x81, 0x3, 0x40}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x22, 0x6, {[@global=@item_012={0x1, 0x1, 0x0, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @main=@item_012={0x1, 0x0, 0xa, "01"}]}}, 0x0}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x41, &(0x7f0000000500)="0100"/65)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xc70, 0xf00e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x16}}, {{{0x9, 0x5, 0x81, 0x3, 0x40}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x22, 0xf, {[@global=@item_012={0x1, 0x1, 0x0, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @main=@item_012={0x1, 0x0, 0xa, "01"}, @global=@item_012={0x1, 0x1, 0x8, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @global=@item_012={0x1, 0x1, 0x1, '\x00'}, @global=@item_012={0x2, 0x1, 0x2, "ff00"}]}}, 0x0}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x41, &(0x7f0000000500)="0100"/65)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xc70, 0xf00e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x16}}, {{{0x9, 0x5, 0x81, 0x3, 0x40}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x22, 0x15, {[@global=@item_012={0x1, 0x1, 0x0, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @main=@item_012={0x1, 0x0, 0xa, "01"}, @global=@item_012={0x1, 0x1, 0x8, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @global=@item_012={0x1, 0x1, 0x1, '\x00'}, @global=@item_012={0x2, 0x1, 0x2, "ff00"}, @global=@item_012={0x1, 0x1, 0x7, '\b'}, @global=@item_012={0x1, 0x1, 0x9, '@'}, @main=@item_012={0x0, 0x0, 0x8}, @main=@item_012={0x0, 0x0, 0xc}]}}, 0x0}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x41, &(0x7f0000000500)="0100"/65)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xc70, 0xf00e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x16}}, {{{0x9, 0x5, 0x81, 0x3, 0x40}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x22, 0x15, {[@global=@item_012={0x1, 0x1, 0x0, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @main=@item_012={0x1, 0x0, 0xa, "01"}, @global=@item_012={0x1, 0x1, 0x8, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @global=@item_012={0x1, 0x1, 0x1, '\x00'}, @global=@item_012={0x2, 0x1, 0x2, "ff00"}, @global=@item_012={0x1, 0x1, 0x7, '\b'}, @global=@item_012={0x0, 0x1, 0x9}, @main=@item_012={0x1, 0x0, 0x8, "02"}, @main=@item_012={0x0, 0x0, 0xc}]}}, 0x0}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x41, &(0x7f0000000500)="0100"/65)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xc70, 0xf00e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x16}}, {{{0x9, 0x5, 0x81, 0x3, 0x40}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x22, 0x15, {[@global=@item_012={0x1, 0x1, 0x0, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @main=@item_012={0x1, 0x0, 0xa, "01"}, @global=@item_012={0x1, 0x1, 0x8, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @global=@item_012={0x1, 0x1, 0x1, '\x00'}, @global=@item_012={0x2, 0x1, 0x2, "ff00"}, @global=@item_012={0x0, 0x1, 0x7}, @global=@item_012={0x1, 0x1, 0x9, '@'}, @main=@item_012={0x1, 0x0, 0x8, "02"}, @main=@item_012={0x0, 0x0, 0xc}]}}, 0x0}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x41, &(0x7f0000000500)="0100"/65)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xc70, 0xf00e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x16}}, {{{0x9, 0x5, 0x81, 0x3, 0x40}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x22, 0x14, {[@global=@item_012={0x1, 0x1, 0x0, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @main=@item_012={0x1, 0x0, 0xa, "01"}, @global=@item_012={0x1, 0x1, 0x8, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @global=@item_012={0x1, 0x1, 0x1, '\x00'}, @global=@item_012={0x0, 0x1, 0x2}, @global=@item_012={0x1, 0x1, 0x7, '\b'}, @global=@item_012={0x1, 0x1, 0x9, '@'}, @main=@item_012={0x1, 0x0, 0x8, "02"}, @main=@item_012={0x0, 0x0, 0xc}]}}, 0x0}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x41, &(0x7f0000000500)="0100"/65)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xc70, 0xf00e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x16}}, {{{0x9, 0x5, 0x81, 0x3, 0x40}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x22, 0x15, {[@global=@item_012={0x1, 0x1, 0x0, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @main=@item_012={0x1, 0x0, 0xa, "01"}, @global=@item_012={0x1, 0x1, 0x8, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @global=@item_012={0x0, 0x1, 0x1}, @global=@item_012={0x2, 0x1, 0x2, "ff00"}, @global=@item_012={0x1, 0x1, 0x7, '\b'}, @global=@item_012={0x1, 0x1, 0x9, '@'}, @main=@item_012={0x1, 0x0, 0x8, "02"}, @main=@item_012={0x0, 0x0, 0xc}]}}, 0x0}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x41, &(0x7f0000000500)="0100"/65)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xc70, 0xf00e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x16}}, {{{0x9, 0x5, 0x81, 0x3, 0x40}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x22, 0x15, {[@global=@item_012={0x1, 0x1, 0x0, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @main=@item_012={0x1, 0x0, 0xa, "01"}, @global=@item_012={0x1, 0x1, 0x8, "01"}, @local, @global=@item_012={0x1, 0x1, 0x1, '\x00'}, @global=@item_012={0x2, 0x1, 0x2, "ff00"}, @global=@item_012={0x1, 0x1, 0x7, '\b'}, @global=@item_012={0x1, 0x1, 0x9, '@'}, @main=@item_012={0x1, 0x0, 0x8, "02"}, @main=@item_012={0x0, 0x0, 0xc}]}}, 0x0}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x41, &(0x7f0000000500)="0100"/65)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xc70, 0xf00e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x16}}, {{{0x9, 0x5, 0x81, 0x3, 0x40}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x22, 0x15, {[@global=@item_012={0x1, 0x1, 0x0, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @main=@item_012={0x1, 0x0, 0xa, "01"}, @global=@item_012={0x0, 0x1, 0x8}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @global=@item_012={0x1, 0x1, 0x1, '\x00'}, @global=@item_012={0x2, 0x1, 0x2, "ff00"}, @global=@item_012={0x1, 0x1, 0x7, '\b'}, @global=@item_012={0x1, 0x1, 0x9, '@'}, @main=@item_012={0x1, 0x0, 0x8, "02"}, @main=@item_012={0x0, 0x0, 0xc}]}}, 0x0}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x41, &(0x7f0000000500)="0100"/65)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xc70, 0xf00e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x16}}, {{{0x9, 0x5, 0x81, 0x3, 0x40}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x22, 0x15, {[@global=@item_012={0x1, 0x1, 0x0, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @main=@item_012={0x0, 0x0, 0xa}, @global=@item_012={0x1, 0x1, 0x8, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @global=@item_012={0x1, 0x1, 0x1, '\x00'}, @global=@item_012={0x2, 0x1, 0x2, "ff00"}, @global=@item_012={0x1, 0x1, 0x7, '\b'}, @global=@item_012={0x1, 0x1, 0x9, '@'}, @main=@item_012={0x1, 0x0, 0x8, "02"}, @main=@item_012={0x0, 0x0, 0xc}]}}, 0x0}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x41, &(0x7f0000000500)="0100"/65)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xc70, 0xf00e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x16}}, {{{0x9, 0x5, 0x81, 0x3, 0x40}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x22, 0x15, {[@global=@item_012={0x1, 0x1, 0x0, "01"}, @local, @main=@item_012={0x1, 0x0, 0xa, "01"}, @global=@item_012={0x1, 0x1, 0x8, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @global=@item_012={0x1, 0x1, 0x1, '\x00'}, @global=@item_012={0x2, 0x1, 0x2, "ff00"}, @global=@item_012={0x1, 0x1, 0x7, '\b'}, @global=@item_012={0x1, 0x1, 0x9, '@'}, @main=@item_012={0x1, 0x0, 0x8, "02"}, @main=@item_012={0x0, 0x0, 0xc}]}}, 0x0}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x41, &(0x7f0000000500)="0100"/65)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xc70, 0xf00e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x16}}, {{{0x9, 0x5, 0x81, 0x3, 0x40}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x22, 0x15, {[@global, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @main=@item_012={0x1, 0x0, 0xa, "01"}, @global=@item_012={0x1, 0x1, 0x8, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @global=@item_012={0x1, 0x1, 0x1, '\x00'}, @global=@item_012={0x2, 0x1, 0x2, "ff00"}, @global=@item_012={0x1, 0x1, 0x7, '\b'}, @global=@item_012={0x1, 0x1, 0x9, '@'}, @main=@item_012={0x1, 0x0, 0x8, "02"}, @main=@item_012={0x0, 0x0, 0xc}]}}, 0x0}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x41, &(0x7f0000000500)="0100"/65)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xc70, 0xf00e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x16}}, {{{0x9, 0x5, 0x81, 0x3, 0x40}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x22, 0x16, {[@global=@item_012={0x1, 0x1, 0x0, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @main=@item_012={0x1, 0x0, 0xa, "01"}, @global=@item_012={0x1, 0x1, 0x8, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @global=@item_012={0x1, 0x1, 0x1, '\x00'}, @global=@item_012={0x2, 0x1, 0x2, "ff00"}, @global=@item_012={0x1, 0x1, 0x7, '\b'}, @global=@item_012={0x1, 0x1, 0x9, '@'}, @main=@item_012={0x1, 0x0, 0x8, "02"}, @main=@item_012={0x0, 0x0, 0xc}]}}, 0x0}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x0, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xc70, 0xf00e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x16}}, {{{0x9, 0x5, 0x81, 0x3, 0x40}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x22, 0x16, {[@global=@item_012={0x1, 0x1, 0x0, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @main=@item_012={0x1, 0x0, 0xa, "01"}, @global=@item_012={0x1, 0x1, 0x8, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @global=@item_012={0x1, 0x1, 0x1, '\x00'}, @global=@item_012={0x2, 0x1, 0x2, "ff00"}, @global=@item_012={0x1, 0x1, 0x7, '\b'}, @global=@item_012={0x1, 0x1, 0x9, '@'}, @main=@item_012={0x1, 0x0, 0x8, "02"}, @main=@item_012={0x0, 0x0, 0xc}]}}, 0x0}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x0, &(0x7f0000000500))

program did not crash
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_ep_write
program crashed: KASAN: slab-out-of-bounds Read in aqc_raw_event
simplifying C reproducer
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_ep_write
program crashed: KASAN: slab-out-of-bounds Read in aqc_raw_event
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_ep_write
program crashed: KASAN: slab-out-of-bounds Read in aqc_raw_event
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_ep_write
program crashed: KASAN: slab-out-of-bounds Read in aqc_raw_event
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_ep_write
program crashed: KASAN: slab-out-of-bounds Read in aqc_raw_event
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_ep_write
program crashed: KASAN: slab-out-of-bounds Read in aqc_raw_event
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_ep_write
program crashed: KASAN: slab-out-of-bounds Read in aqc_raw_event
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_ep_write
program crashed: KASAN: slab-out-of-bounds Read in aqc_raw_event
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xc70, 0xf00e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x16}}, {{{0x9, 0x5, 0x81, 0x3, 0x40}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x22, 0x16, {[@global=@item_012={0x1, 0x1, 0x0, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @main=@item_012={0x1, 0x0, 0xa, "01"}, @global=@item_012={0x1, 0x1, 0x8, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @global=@item_012={0x1, 0x1, 0x1, '\x00'}, @global=@item_012={0x2, 0x1, 0x2, "ff00"}, @global=@item_012={0x1, 0x1, 0x7, '\b'}, @global=@item_012={0x1, 0x1, 0x9, '@'}, @main=@item_012={0x1, 0x0, 0x8, "02"}, @main=@item_012={0x0, 0x0, 0xc}]}}, 0x0}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x41, &(0x7f0000000500)="0100"/65)

program crashed: KASAN: slab-out-of-bounds Read in aqc_raw_event
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xc70, 0xf00e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x16}}, {{{0x9, 0x5, 0x81, 0x3, 0x40}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x22, 0x16, {[@global=@item_012={0x1, 0x1, 0x0, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @main=@item_012={0x1, 0x0, 0xa, "01"}, @global=@item_012={0x1, 0x1, 0x8, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @global=@item_012={0x1, 0x1, 0x1, '\x00'}, @global=@item_012={0x2, 0x1, 0x2, "ff00"}, @global=@item_012={0x1, 0x1, 0x7, '\b'}, @global=@item_012={0x1, 0x1, 0x9, '@'}, @main=@item_012={0x1, 0x0, 0x8, "02"}, @main=@item_012={0x0, 0x0, 0xc}]}}, 0x0}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x41, &(0x7f0000000500)="0100"/65)

program crashed: KASAN: slab-out-of-bounds Read in aqc_raw_event
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xc70, 0xf00e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x16}}, {{{0x9, 0x5, 0x81, 0x3, 0x40}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x22, 0x16, {[@global=@item_012={0x1, 0x1, 0x0, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @main=@item_012={0x1, 0x0, 0xa, "01"}, @global=@item_012={0x1, 0x1, 0x8, "01"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @global=@item_012={0x1, 0x1, 0x1, '\x00'}, @global=@item_012={0x2, 0x1, 0x2, "ff00"}, @global=@item_012={0x1, 0x1, 0x7, '\b'}, @global=@item_012={0x1, 0x1, 0x9, '@'}, @main=@item_012={0x1, 0x0, 0x8, "02"}, @main=@item_012={0x0, 0x0, 0xc}]}}, 0x0}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x41, &(0x7f0000000500)="0100"/65)

program crashed: KASAN: slab-out-of-bounds Read in aqc_raw_event
validation run: crashed=true
reproducing took 31m38.563792693s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-out-of-bounds in get_unaligned_be16 include/linux/unaligned.h:48 [inline]
BUG: KASAN: slab-out-of-bounds in aqc_raw_event+0x334/0x2220 drivers/hwmon/aquacomputer_d5next.c:1345
Read of size 2 at addr ffff0000dd54d1d7 by task swapper/1/0

CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 print_address_description+0xb0/0x238 mm/kasan/report.c:378
 print_report+0x68/0x84 mm/kasan/report.c:482
 kasan_report+0x8c/0xc4 mm/kasan/report.c:595
 __asan_report_load_n_noabort+0x1c/0x28 mm/kasan/report_generic.c:391
 get_unaligned_be16 include/linux/unaligned.h:48 [inline]
 aqc_raw_event+0x334/0x2220 drivers/hwmon/aquacomputer_d5next.c:1345
 __hid_input_report+0x32c/0x408 drivers/hid/hid-core.c:2175
 hid_safe_input_report+0x50/0x68 drivers/hid/hid-core.c:2227
 hid_irq_in+0x3dc/0x718 drivers/hid/usbhid/hid-core.c:287
 __usb_hcd_giveback_urb+0x314/0x594 drivers/usb/core/hcd.c:1657
 usb_hcd_giveback_urb+0x100/0x350 drivers/usb/core/hcd.c:1741
 dummy_timer+0x570/0x2ba0 drivers/usb/gadget/udc/dummy_hcd.c:2019
 __run_hrtimer kernel/time/hrtimer.c:2074 [inline]
 __hrtimer_run_queues+0x314/0xbe0 kernel/time/hrtimer.c:2131
 hrtimer_run_softirq+0x1b4/0x2a8 kernel/time/hrtimer.c:2148
 handle_softirqs+0x2ec/0xd98 kernel/softirq.c:645
 __do_softirq+0x14/0x20 kernel/softirq.c:679
 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:78
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:885
 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:83
 invoke_softirq kernel/softirq.c:526 [inline]
 __irq_exit_rcu+0x1ac/0x428 kernel/softirq.c:758
 irq_exit_rcu+0x14/0x84 kernel/softirq.c:775
 __el1_irq arch/arm64/kernel/entry-common.c:531 [inline]
 el1_interrupt+0x40/0x60 arch/arm64/kernel/entry-common.c:543
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:548
 el1h_64_irq+0x6c/0x70 arch/arm64/kernel/entry.S:586
 __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:26 [inline] (P)
 arch_local_irq_enable arch/arm64/include/asm/irqflags.h:48 [inline] (P)
 default_idle_call+0xd0/0xfc kernel/sched/idle.c:129 (P)
 cpuidle_idle_call kernel/sched/idle.c:199 [inline]
 do_idle+0x1ec/0x450 kernel/sched/idle.c:355
 cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:454
 secondary_start_kernel+0x1bc/0x1e0 arch/arm64/kernel/smp.c:273
 __secondary_switched+0xc0/0xc4 arch/arm64/kernel/head.S:401

Allocated by task 4757:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x40/0x78 mm/kasan/common.c:78
 kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:570
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5414 [inline]
 __kmalloc_noprof+0x34c/0x6c8 mm/slub.c:5439
 _kmalloc_noprof include/linux/slab.h:995 [inline]
 hcd_buffer_alloc+0xfc/0x1fc drivers/usb/core/buffer.c:134
 usb_alloc_coherent+0x6c/0x94 drivers/usb/core/usb.c:1011
 hid_alloc_buffers drivers/hid/usbhid/hid-core.c:859 [inline]
 usbhid_start+0x688/0x1b08 drivers/hid/usbhid/hid-core.c:1108
 hid_hw_start+0x6c/0x124 drivers/hid/hid-core.c:2431
 aqc_probe+0x108/0x2324 drivers/hwmon/aquacomputer_d5next.c:1536
 __hid_device_probe drivers/hid/hid-core.c:2839 [inline]
 hid_device_probe+0x35c/0x61c drivers/hid/hid-core.c:2878
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x29c/0x800 drivers/base/dd.c:706
 __driver_probe_device+0x1e0/0x350 drivers/base/dd.c:868
 driver_probe_device+0x6c/0x19c drivers/base/dd.c:898
 __device_attach_driver+0x198/0x2f8 drivers/base/dd.c:1026
 bus_for_each_drv+0x144/0x1dc drivers/base/bus.c:500
 __device_attach+0x248/0x390 drivers/base/dd.c:1098
 device_initial_probe+0x90/0xc8 drivers/base/dd.c:1153
 bus_probe_device+0x58/0x120 drivers/base/bus.c:620
 device_add+0x6cc/0x9e0 drivers/base/core.c:3776
 hid_add_device+0x254/0x3b8 drivers/hid/hid-core.c:3065
 usbhid_probe+0x83c/0xbac drivers/hid/usbhid/hid-core.c:1452
 usb_probe_interface+0x374/0x834 drivers/usb/core/driver.c:399
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x29c/0x800 drivers/base/dd.c:706
 __driver_probe_device+0x1e0/0x350 drivers/base/dd.c:868
 driver_probe_device+0x6c/0x19c drivers/base/dd.c:898
 __device_attach_driver+0x198/0x2f8 drivers/base/dd.c:1026
 bus_for_each_drv+0x144/0x1dc drivers/base/bus.c:500
 __device_attach+0x248/0x390 drivers/base/dd.c:1098
 device_initial_probe+0x90/0xc8 drivers/base/dd.c:1153
 bus_probe_device+0x58/0x120 drivers/base/bus.c:620
 device_add+0x6cc/0x9e0 drivers/base/core.c:3776
 usb_set_configuration+0x1184/0x158c drivers/usb/core/message.c:2268
 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:250
 usb_probe_device+0x114/0x2b0 drivers/usb/core/driver.c:293
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x29c/0x800 drivers/base/dd.c:706
 __driver_probe_device+0x1e0/0x350 drivers/base/dd.c:868
 driver_probe_device+0x6c/0x19c drivers/base/dd.c:898
 __device_attach_driver+0x198/0x2f8 drivers/base/dd.c:1026
 bus_for_each_drv+0x144/0x1dc drivers/base/bus.c:500
 __device_attach+0x248/0x390 drivers/base/dd.c:1098
 device_initial_probe+0x90/0xc8 drivers/base/dd.c:1153
 bus_probe_device+0x58/0x120 drivers/base/bus.c:620
 device_add+0x6cc/0x9e0 drivers/base/core.c:3776
 usb_new_device+0x9c4/0x11f8 drivers/usb/core/hub.c:2708
 hub_port_connect drivers/usb/core/hub.c:5580 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5720 [inline]
 port_event drivers/usb/core/hub.c:5884 [inline]
 hub_event+0x1ef0/0x39fc drivers/usb/core/hub.c:5966
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3479
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3560
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838

The buggy address belongs to the object at ffff0000dd54d180
 which belongs to the cache kmalloc-96 of size 96
The buggy address is located 22 bytes to the right of
 allocated 65-byte region [ffff0000dd54d180, ffff0000dd54d1c1)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11d54d
flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 05ffc00000000000 ffff0000c0001280 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000dd54d080: 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc fc
 ffff0000dd54d100: 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc fc
>ffff0000dd54d180: 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc fc
                                                 ^
 ffff0000dd54d200: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
 ffff0000dd54d280: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
==================================================================

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-out-of-bounds in get_unaligned_be16 include/linux/unaligned.h:48 [inline]
BUG: KASAN: slab-out-of-bounds in aqc_raw_event+0x334/0x2220 drivers/hwmon/aquacomputer_d5next.c:1345
Read of size 2 at addr ffff0000dd54d1d7 by task swapper/1/0

CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 print_address_description+0xb0/0x238 mm/kasan/report.c:378
 print_report+0x68/0x84 mm/kasan/report.c:482
 kasan_report+0x8c/0xc4 mm/kasan/report.c:595
 __asan_report_load_n_noabort+0x1c/0x28 mm/kasan/report_generic.c:391
 get_unaligned_be16 include/linux/unaligned.h:48 [inline]
 aqc_raw_event+0x334/0x2220 drivers/hwmon/aquacomputer_d5next.c:1345
 __hid_input_report+0x32c/0x408 drivers/hid/hid-core.c:2175
 hid_safe_input_report+0x50/0x68 drivers/hid/hid-core.c:2227
 hid_irq_in+0x3dc/0x718 drivers/hid/usbhid/hid-core.c:287
 __usb_hcd_giveback_urb+0x314/0x594 drivers/usb/core/hcd.c:1657
 usb_hcd_giveback_urb+0x100/0x350 drivers/usb/core/hcd.c:1741
 dummy_timer+0x570/0x2ba0 drivers/usb/gadget/udc/dummy_hcd.c:2019
 __run_hrtimer kernel/time/hrtimer.c:2074 [inline]
 __hrtimer_run_queues+0x314/0xbe0 kernel/time/hrtimer.c:2131
 hrtimer_run_softirq+0x1b4/0x2a8 kernel/time/hrtimer.c:2148
 handle_softirqs+0x2ec/0xd98 kernel/softirq.c:645
 __do_softirq+0x14/0x20 kernel/softirq.c:679
 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:78
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:885
 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:83
 invoke_softirq kernel/softirq.c:526 [inline]
 __irq_exit_rcu+0x1ac/0x428 kernel/softirq.c:758
 irq_exit_rcu+0x14/0x84 kernel/softirq.c:775
 __el1_irq arch/arm64/kernel/entry-common.c:531 [inline]
 el1_interrupt+0x40/0x60 arch/arm64/kernel/entry-common.c:543
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:548
 el1h_64_irq+0x6c/0x70 arch/arm64/kernel/entry.S:586
 __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:26 [inline] (P)
 arch_local_irq_enable arch/arm64/include/asm/irqflags.h:48 [inline] (P)
 default_idle_call+0xd0/0xfc kernel/sched/idle.c:129 (P)
 cpuidle_idle_call kernel/sched/idle.c:199 [inline]
 do_idle+0x1ec/0x450 kernel/sched/idle.c:355
 cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:454
 secondary_start_kernel+0x1bc/0x1e0 arch/arm64/kernel/smp.c:273
 __secondary_switched+0xc0/0xc4 arch/arm64/kernel/head.S:401

Allocated by task 4757:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x40/0x78 mm/kasan/common.c:78
 kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:570
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5414 [inline]
 __kmalloc_noprof+0x34c/0x6c8 mm/slub.c:5439
 _kmalloc_noprof include/linux/slab.h:995 [inline]
 hcd_buffer_alloc+0xfc/0x1fc drivers/usb/core/buffer.c:134
 usb_alloc_coherent+0x6c/0x94 drivers/usb/core/usb.c:1011
 hid_alloc_buffers drivers/hid/usbhid/hid-core.c:859 [inline]
 usbhid_start+0x688/0x1b08 drivers/hid/usbhid/hid-core.c:1108
 hid_hw_start+0x6c/0x124 drivers/hid/hid-core.c:2431
 aqc_probe+0x108/0x2324 drivers/hwmon/aquacomputer_d5next.c:1536
 __hid_device_probe drivers/hid/hid-core.c:2839 [inline]
 hid_device_probe+0x35c/0x61c drivers/hid/hid-core.c:2878
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x29c/0x800 drivers/base/dd.c:706
 __driver_probe_device+0x1e0/0x350 drivers/base/dd.c:868
 driver_probe_device+0x6c/0x19c drivers/base/dd.c:898
 __device_attach_driver+0x198/0x2f8 drivers/base/dd.c:1026
 bus_for_each_drv+0x144/0x1dc drivers/base/bus.c:500
 __device_attach+0x248/0x390 drivers/base/dd.c:1098
 device_initial_probe+0x90/0xc8 drivers/base/dd.c:1153
 bus_probe_device+0x58/0x120 drivers/base/bus.c:620
 device_add+0x6cc/0x9e0 drivers/base/core.c:3776
 hid_add_device+0x254/0x3b8 drivers/hid/hid-core.c:3065
 usbhid_probe+0x83c/0xbac drivers/hid/usbhid/hid-core.c:1452
 usb_probe_interface+0x374/0x834 drivers/usb/core/driver.c:399
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x29c/0x800 drivers/base/dd.c:706
 __driver_probe_device+0x1e0/0x350 drivers/base/dd.c:868
 driver_probe_device+0x6c/0x19c drivers/base/dd.c:898
 __device_attach_driver+0x198/0x2f8 drivers/base/dd.c:1026
 bus_for_each_drv+0x144/0x1dc drivers/base/bus.c:500
 __device_attach+0x248/0x390 drivers/base/dd.c:1098
 device_initial_probe+0x90/0xc8 drivers/base/dd.c:1153
 bus_probe_device+0x58/0x120 drivers/base/bus.c:620
 device_add+0x6cc/0x9e0 drivers/base/core.c:3776
 usb_set_configuration+0x1184/0x158c drivers/usb/core/message.c:2268
 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:250
 usb_probe_device+0x114/0x2b0 drivers/usb/core/driver.c:293
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x29c/0x800 drivers/base/dd.c:706
 __driver_probe_device+0x1e0/0x350 drivers/base/dd.c:868
 driver_probe_device+0x6c/0x19c drivers/base/dd.c:898
 __device_attach_driver+0x198/0x2f8 drivers/base/dd.c:1026
 bus_for_each_drv+0x144/0x1dc drivers/base/bus.c:500
 __device_attach+0x248/0x390 drivers/base/dd.c:1098
 device_initial_probe+0x90/0xc8 drivers/base/dd.c:1153
 bus_probe_device+0x58/0x120 drivers/base/bus.c:620
 device_add+0x6cc/0x9e0 drivers/base/core.c:3776
 usb_new_device+0x9c4/0x11f8 drivers/usb/core/hub.c:2708
 hub_port_connect drivers/usb/core/hub.c:5580 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5720 [inline]
 port_event drivers/usb/core/hub.c:5884 [inline]
 hub_event+0x1ef0/0x39fc drivers/usb/core/hub.c:5966
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3479
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3560
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838

The buggy address belongs to the object at ffff0000dd54d180
 which belongs to the cache kmalloc-96 of size 96
The buggy address is located 22 bytes to the right of
 allocated 65-byte region [ffff0000dd54d180, ffff0000dd54d1c1)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11d54d
flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 05ffc00000000000 ffff0000c0001280 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000dd54d080: 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc fc
 ffff0000dd54d100: 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc fc
>ffff0000dd54d180: 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc fc
                                                 ^
 ffff0000dd54d200: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
 ffff0000dd54d280: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
==================================================================