Extracting prog: 5m40.930389845s Minimizing prog: 22m50.09173513s Simplifying prog options: 8m0.174864045s Extracting C: 1m11.018590873s Simplifying C: 0s extracting reproducer from 30 programs testing a last program of every proc single: executing 5 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect$cdc_ncm-syz_usb_control_io$uac1-syz_usb_control_io$cdc_ecm-syz_usb_control_io$printer-socket$inet6_tcp-bind$inet6-sendto$inet6-syz_usb_control_io-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect(0x4, 0x4c, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x31, 0x7b, 0x6f, 0x10, 0xbb4, 0xa49, 0x50ab, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3a, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xb9, 0x0, 0x0, 0xfe, 0x8e, 0xf5, 0x0, [@cdc_ecm={{0xa, 0x24, 0x6, 0x0, 0x0, "a4c5db9b1c"}, {0x5, 0x24, 0x0, 0x7}, {0xd, 0x24, 0xf, 0x1, 0x10, 0xfff, 0x5, 0xa0}, [@mbim={0xc, 0x24, 0x1b, 0x3, 0xf20, 0x4, 0x2, 0x2}]}]}}]}}]}}, 0x0) syz_usb_connect$cdc_ncm(0x6, 0x7d, &(0x7f00000001c0)={{0x12, 0x1, 0x110, 0x2, 0x0, 0x0, 0xff, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6b, 0x2, 0x1, 0x5, 0x80, 0x6, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0x6}, {0xd, 0x24, 0xf, 0x1, 0x4, 0xfff4, 0xfff2, 0x6}, {0x6, 0x24, 0x1a, 0xd}, [@acm={0x4, 0x24, 0x2, 0x3}, @acm={0x4, 0x24, 0x2, 0x4}, @network_terminal={0x7, 0x24, 0xa, 0x0, 0x14, 0x8}]}, {{0x9, 0x5, 0x81, 0x3, 0x8, 0xff, 0x84, 0x5}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10, 0x69, 0x6, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x4, 0x6, 0x5}}}}}}}]}}, &(0x7f0000000600)={0xa, &(0x7f0000000240)={0xa, 0x6, 0x300, 0x3, 0x0, 0x40, 0x10, 0xff}, 0x39, &(0x7f0000000280)={0x5, 0xf, 0x39, 0x2, [@ss_container_id={0x14, 0x10, 0x4, 0x5, "a016af3e3d229bb81f6f7849711ab88a"}, @ssp_cap={0x20, 0x10, 0xa, 0xf7, 0x5, 0x6, 0x1100f, 0xfff2, [0x30, 0x0, 0xff0000, 0x0, 0x30]}]}, 0x8, [{0xee, &(0x7f00000002c0)=@string={0xee, 0x3, "924cd7288690c36dc97c2535cf0e288d1c1e39b8b7b3cab31441980b61a01e993477c75e19d1b5d094e8a3f0d0189cd10565b1142a900c033665382f70be11804f936cbb98b850962ed229f7a57f96a82eaa80027d6f4cb795131c6298ede9b4830d00f4e20d11c052b8801491b053103ba14710700f4469fd60c4e9e34c7135cdc6f1ed42bc238e6c3933ad6db1f878e2f7ab5a0e52cea860a674acec346ef57bbd611204281074a0ee43a7ee2f25cdacefeda84caf09eca33cc33a746e7915c08561577c0e4f91af46ca9ae990501b9c78e81a3f32338c30fc836d946b802830fe6746feb4d8f3b85f8523"}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0xc14}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x500a}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x827}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x446}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x1004}}, {0x3a, &(0x7f0000000580)=@string={0x3a, 0x3, "e4960f9da4f00cd0f467bb7296e5d8f1c92876e93ccfa3006924b102dea1d0958508b61d43a52edf30e601500f4d841872a98587218785b1"}}, {0x4, &(0x7f00000005c0)=@lang_id={0x4, 0x3, 0x408}}]}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000040)={0x44, &(0x7f00000000c0)=ANY=[@ANYRES16=r0, @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2, 0x0, @rand_addr, 0x400000}, 0x1c) sendto$inet6(r1, &(0x7f0000000000)="71e1a25206ce62b5828919e80f8a9c5fd0962d255dbbadb9c070475be6940dd3f7ddb6b06adae5b3bc00561c6c99898e6e", 0x31, 0x8085, &(0x7f0000000180)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x5}, 0x1c) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000540)={0x2c, &(0x7f0000000400)={0x20, 0xf, 0x3, "ed8c58"}, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$F2FS_IOC_MOVE_RANGE-setsockopt$inet_sctp_SCTP_AUTOCLOSE-socket$inet_sctp-getsockopt$inet_sctp_SCTP_RECVNXTINFO-socket$unix-ioctl$sock_SIOCADDRT-getsockopt$SO_COOKIE-getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM-setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET-syz_usb_connect-syz_genetlink_get_family_id$tipc-sendmsg$TIPC_CMD_SET_LINK_WINDOW-setsockopt$SO_BINDTODEVICE-sendmsg$inet_sctp-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-ioctl$SG_GET_KEEP_ORPHAN-getsockopt$inet_sctp_SCTP_NODELAY-write$RDMA_USER_CM_CMD_CREATE_ID-write$RDMA_USER_CM_CMD_QUERY_ROUTE-socket$inet_sctp-sendmsg$inet_sctp-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$SECCOMP_IOCTL_NOTIF_RECV-ioctl$BLKTRACESETUP-socket$inet6-setsockopt$sock_int-bpf$OBJ_GET_PROG-ioctl$FS_IOC_FSSETXATTR-setsockopt$SO_BINDTODEVICE-getsockopt$netlink detailed listing: executing program 0: ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000000)={0xffffffffffffffff, 0x800, 0x8b5b, 0xffff}) setsockopt$inet_sctp_SCTP_AUTOCLOSE(r0, 0x84, 0x4, &(0x7f0000000040)=0x60000000, 0x4) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000080), &(0x7f00000000c0)=0x4) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCADDRT(r2, 0x890b, &(0x7f0000000140)={0x0, @rc={0x1f, @any, 0x4}, @qipcrtr={0x2a, 0x0, 0x4001}, @l2={0x1f, 0x1, @any, 0xe4f2, 0x1}, 0x5, 0x0, 0x0, 0x0, 0x171, &(0x7f0000000100)='team_slave_1\x00', 0x802f, 0xfffffffffffffffb, 0x6}) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f00000001c0), &(0x7f0000000200)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000240)={0xff5c, 0x4, 0xc, 0x62d, 0xf10, 0x7, 0x5, 0x0, 0x0}, &(0x7f0000000280)=0x20) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f00000002c0)={r3, 0x6}, 0x8) syz_usb_connect(0x3, 0x6f3, &(0x7f0000000300)={{0x12, 0x1, 0x300, 0xe1, 0xf, 0xbd, 0xff, 0x1b3d, 0x14a, 0x6129, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e1, 0x4, 0x3, 0x3, 0xb8, 0x2, [{{0x9, 0x4, 0x7a, 0xe8, 0xf, 0x65, 0x40, 0x1c, 0x2, [], [{{0x9, 0x5, 0xb, 0x1, 0x400, 0x9, 0x7f, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x5, 0x8}]}}, {{0x9, 0x5, 0xa, 0x2, 0x10, 0x7, 0xd, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x1, 0x2}]}}, {{0x9, 0x5, 0x9, 0x10, 0x20, 0x0, 0x9, 0x7}}, {{0x9, 0x5, 0xc, 0x8, 0x3ff, 0x0, 0x7, 0x80}}, {{0x9, 0x5, 0xd, 0x3, 0x400, 0x9c, 0x80, 0x8a}}, {{0x9, 0x5, 0xf, 0x10, 0x40, 0x8, 0x6, 0x1}}, {{0x9, 0x5, 0x4, 0x4, 0x40, 0x2, 0x2, 0x19}}, {{0x9, 0x5, 0xb, 0x1, 0x40, 0x2, 0xe, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0x2, 0x200}, @uac_iso={0x7, 0x25, 0x1, 0x1, 0x5, 0xff11}]}}, {{0x9, 0x5, 0xf, 0x0, 0x8, 0xff, 0x7, 0x7}}, {{0x9, 0x5, 0x3, 0x3, 0x20, 0x1, 0x2, 0x4, [@generic={0x92, 0x31, "9f471214371ae4bbb63b716d0aca4061348bbd37433f5be07df5751f6d1b1dac405882919b7db45e243af376f7e7428492384cdecf92058293227949e1cb490c78f28f3c20854217a113410fb1a3e48d965c9049d01dbd62ccfd7d1c58a97f5ca41a1f2ad58e04e634a8047aa94a46f7519bd801aedc401b9d2fde8a7d55d83331c5b1aec9647468c2d09973a62bd4af"}]}}, {{0x9, 0x5, 0xb, 0x10, 0x600, 0x5, 0x8d, 0x2, [@generic={0x7, 0x1, "df2cc6ed5c"}]}}, {{0x9, 0x5, 0xb, 0x8, 0x10, 0xae, 0x9, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x9, 0x2}]}}, {{0x9, 0x5, 0xd, 0x10, 0x20, 0x8, 0x6, 0x70, [@generic={0x91, 0x1, "d8d54d59fd6bbe6fb9b54a19edca3fb5ec4ad90fc7457c7bbd24332b7f6176411bca52e78226545683a3b2b286add05f17f3a9364f66f0c2a569ecdfa7b48a17f804cb527df7d52302686ee07f8482362d4cdbd831b26b8530b5bdfb44c3d352f778f54f7137cfea703ca6fed1059ae8becedf551b570c92b21a3efa58197bdb5d1f68747de362846b59ca22c7a97a"}]}}, {{0x9, 0x5, 0x7, 0x0, 0x200, 0xca, 0x7, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0x2, 0x3ae8}]}}, {{0x9, 0x5, 0x6, 0x8, 0x200, 0x3, 0x1, 0xd, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x3, 0x5}]}}]}}, {{0x9, 0x4, 0xc1, 0xc2, 0xf, 0x2a, 0x0, 0xb9, 0x75, [@uac_as], [{{0x9, 0x5, 0x3, 0x10, 0x10, 0x2, 0x5, 0xd4, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x5, 0x2}, @generic={0x101, 0x10, "8a443d8d34fe5e06be6e6a4bac79e0da5ae971f4ec4b84c20396bc53b6a0f7dd8d4e9aa22e7785ce6d73af67caa96ba934f22c0558e52fc4d31e033d517d93b5efe09c4fa761b15d1c75a1992334c55c4dacfcfd0872bab0b2449ba1c55069d7e77a7029d7d8d99f317ca385f455f58cdfbae6b8de7568841035af6f565b82ddb8e10d18617e214e69a8927f95b20f2ef7a04f63a81fa62f513c3e82bdc9a575e6427673c426bd9c7e31d947a36d8036ba60adc9237f6e925288802046744c537f7bf5814d1706a2c3ed562174ba561e47713febb9c4849805b94b45954711a14b9c06efea93ff75c90d579f2a79ce8197a50f3e3875acabd9701aed456df5"}]}}, {{0x9, 0x5, 0x9, 0xc, 0x20, 0x1, 0xba, 0x75, [@generic={0x48, 0x10, "ddbf6e542b0c6ceb10cb588d508f79509496b2f02a24eedd972895696d2122371747fa7259c0f52f453b9db0fc669b0be7ad8366633f8d21a503023613f60d3e0d2da919bea3"}, @uac_iso={0x7, 0x25, 0x1, 0x81, 0x0, 0xb}]}}, {{0x9, 0x5, 0x4, 0xc, 0x8, 0x10, 0x4, 0x2, [@generic={0x96, 0x1d, "fa942ad291d22c47d096cf8ef66581c33d7345a3b00abfa941ddead2e5cfce194660093d5042d66a812533aacbbd38bba21377896ab0465ae272ac6904a203dcb8bc610169ab24baf825bab466ea100ab45b8776bcca8e9c42bfda1892ec5d4dcbe5aad75fc3ad5597eb96178fce6433272308bec4262310d731db0983cd2c0634890d7a90ab1d139a112942db202515e455e0eb"}, @uac_iso={0x7, 0x25, 0x1, 0x2, 0x8, 0x1}]}}, {{0x9, 0x5, 0x0, 0x0, 0x20, 0x3, 0xc, 0x1, [@generic={0x49, 0x30, "2b1edcf22226804ab2d2215347e3fca7e51ede1c3ed6f98556167348f1614b0d2456888d7aec0b5ad858f80c3eb6820e249e7a78395e47d7631357ee7b42adb995830be45ee154"}]}}, {{0x9, 0x5, 0x4ec826332fcfd9ad, 0x0, 0x10, 0xfe, 0x80, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x40, 0x4}]}}, {{0x9, 0x5, 0xd, 0xc, 0x8, 0x3}}, {{0x9, 0x5, 0xf, 0x1, 0x10, 0x5, 0x7, 0x40, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x4, 0x9}]}}, {{0x9, 0x5, 0x3, 0x10, 0x400, 0x1, 0x4, 0x6, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x6, 0x262}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x1, 0x1}]}}, {{0x9, 0x5, 0x80, 0x10, 0x3ff, 0x7b, 0x3, 0xd}}, {{0x9, 0x5, 0x80, 0x0, 0x3ff, 0xff, 0x3, 0x6, [@generic={0xd1, 0x2, "fe536f9965799d1040ed960431dc87a6e378067a91d2a144e73f5410b838bdb642ca7c3add627a8754d9f2937db1b749e730aed0ac9b77d11a0f0dae3a1d76a3fc4187805fe87abd460cbcf9db28e60e31a6bfa890ff8029006bd1eb633794f9e77376e0aaf8ce6ae8112984ac058ab288b1a8a495cd58e5b4e101eed52cab4caa9988dfcbc48c0bf53a84be42063bec5403bbbd40f89f5a50bb1085a7d435f3d66edd8991afc23936f0b38106c324bf2c56ef6de2c8076f713809eca517e4019844d11c8c9e9ca4cbbf8d9839a93b"}]}}, {{0x9, 0x5, 0xe, 0x10, 0x0, 0x2b, 0x4, 0x7}}, {{0x9, 0x5, 0xe, 0x0, 0x10, 0x40, 0xff, 0x9}}, {{0x9, 0x5, 0x5, 0x1, 0x10, 0x7, 0x7, 0xe}}, {{0x9, 0x5, 0x8, 0x0, 0x3ff, 0x4, 0x7, 0x18, [@generic={0x73, 0x1, "54315b7454624456080ad3007f7bc3d6ba0155f74895764d6ca7c56a61aa1a23cd376f84ffa4b5c779cb429ab829ebfc8cecc1ed0e6838aef848815002f97d9d2e4e258aa40243e80f7d27762d694d8209da1ab5efbc6a6f22ee02c6296c8c9224cd2b1653ca132a5da61915bdbe3f2f81"}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x57, 0x1000}]}}, {{0x9, 0x5, 0x0, 0x10, 0x10, 0x9, 0x2, 0x4}}]}}, {{0x9, 0x4, 0x7, 0xa, 0x1, 0xcb, 0xe3, 0x85, 0xb0, [@cdc_ncm={{0x8, 0x24, 0x6, 0x0, 0x1, "3df174"}, {0x5, 0x24, 0x0, 0x4}, {0xd, 0x24, 0xf, 0x1, 0x7, 0x8001, 0x0, 0xb}, {0x6, 0x24, 0x1a, 0x5, 0x31}, [@mbim={0xc, 0x24, 0x1b, 0x2, 0x9, 0x0, 0x3, 0x1, 0x23}]}, @uac_as={[@format_type_ii_discrete={0xe, 0x24, 0x2, 0x2, 0x8, 0x6, 0x5, "1ed6596337"}]}], [{{0x9, 0x5, 0xd, 0x8, 0x8, 0xfb, 0x4, 0x80}}]}}, {{0x9, 0x4, 0x82, 0x1, 0x0, 0x6a, 0xfd, 0x4d, 0x8, [@cdc_ecm={{0xb, 0x24, 0x6, 0x0, 0x0, "647a3579a86a"}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0x3, 0xfff, 0x1, 0x6}}, @cdc_ncm={{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x6, 0x6f, 0x8}, {0x6, 0x24, 0x1a, 0x2, 0x8}, [@call_mgmt={0x5, 0x24, 0x1, 0x2, 0x8}, @acm={0x4, 0x24, 0x2, 0x6}, @mbim={0xc, 0x24, 0x1b, 0x3, 0x1, 0x80, 0x1, 0x6, 0xbd}, @mdlm={0x15, 0x24, 0x12, 0xfffc}]}]}}]}}]}}, &(0x7f0000000c00)={0xa, &(0x7f0000000a00)={0xa, 0x6, 0x310, 0x80, 0x6, 0x1, 0x20}, 0x7c, &(0x7f0000000a40)={0x5, 0xf, 0x7c, 0x6, [@ss_container_id={0x14, 0x10, 0x4, 0xe, "d454f16c56641d6aa94b4e41029f2fcc"}, @ssp_cap={0x10, 0x10, 0xa, 0x8, 0x1, 0x2, 0xf00, 0x9, [0x0]}, @ssp_cap={0x24, 0x10, 0xa, 0x2, 0x6, 0x918d, 0xf000, 0x9, [0xff60, 0x0, 0xf, 0x3f00, 0x0, 0x3f3f]}, @ssp_cap={0x18, 0x10, 0xa, 0x6, 0x3, 0x0, 0x0, 0xb0, [0xff00c0, 0xffc000, 0xff81cf]}, @ss_container_id={0x14, 0x10, 0x4, 0xa9, "a77847d6692b3aa3089b2bb781f3dafa"}, @ptm_cap={0x3}]}, 0x5, [{0x4, &(0x7f0000000ac0)=@lang_id={0x4, 0x3, 0x405}}, {0x4, &(0x7f0000000b00)=@lang_id={0x4, 0x3, 0x2401}}, {0xc, &(0x7f0000000b40)=@string={0xc, 0x3, "ada89da0c31175792031"}}, {0x4, &(0x7f0000000b80)=@lang_id={0x4, 0x3, 0x40c}}, {0x4, &(0x7f0000000bc0)=@lang_id={0x4, 0x3, 0x42f}}]}) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000cc0), r0) sendmsg$TIPC_CMD_SET_LINK_WINDOW(r0, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x30, r4, 0x10, 0x70bd28, 0x25dfdbff, {{}, {}, {0x14, 0x18, {0xb5d1, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x40}, 0x4000040) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000dc0)='nicvf0\x00', 0x10) sendmsg$inet_sctp(r1, &(0x7f0000001040)={&(0x7f0000000e00)=@in6={0xa, 0x4e23, 0x8, @mcast1, 0x5}, 0x1c, &(0x7f0000000ec0)=[{&(0x7f0000000e40)="e32dcf48228964b20e5b8dd0bdb18746b2c5d2fc39eeabb150715e32564c74d755f101089f8d52123586845f68f9cf698ca00dc531387040f36fe8e1b5f481099cf28a8d88115727af7ad0", 0x4b}], 0x1, &(0x7f0000000f00)=[@authinfo={0x18, 0x84, 0x6, {0x6}}, @init={0x18, 0x84, 0x0, {0x397, 0x2, 0x7, 0x91}}, @dstaddrv6={0x20, 0x84, 0x8, @private2}, @sndinfo={0x20, 0x84, 0x2, {0x3, 0x8000, 0x0, 0x0, r3}}, @sndrcv={0x30, 0x84, 0x1, {0x1, 0x7f, 0xc00c, 0x8, 0x5, 0x6c, 0x7, 0x6, r3}}, @init={0x18, 0x84, 0x0, {0x3, 0x0, 0x4, 0x2}}, @init={0x18, 0x84, 0x0, {0x7, 0x8000, 0x7, 0xfffc}}, @sndrcv={0x30, 0x84, 0x1, {0x3ff, 0x8, 0xb, 0x7fffffff, 0xffffffd9, 0xdb9, 0x3, 0x3, r3}}, @init={0x18, 0x84, 0x0, {0x8000, 0x5, 0x81, 0x6}}, @dstaddrv4={0x18, 0x84, 0x7, @local}], 0x130, 0x801}, 0x4000050) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r0, 0xc0189375, &(0x7f0000001080)={{0x1, 0x1, 0x18, r2}, './file0\x00'}) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f00000010c0)) getsockopt$inet_sctp_SCTP_NODELAY(r5, 0x84, 0x3, &(0x7f0000001100), &(0x7f0000001140)=0x4) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000013c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000001380)={0xffffffffffffffff}, 0x2, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f0000001400)={0x5, 0x10, 0xfa00, {&(0x7f0000001180), r6, 0x1}}, 0x18) r7 = socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$inet_sctp(r7, &(0x7f0000001780)={&(0x7f0000001440)=@in6={0xa, 0x4e24, 0xdd, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x8}, 0x1c, &(0x7f0000001680)=[{&(0x7f0000001480)}, {&(0x7f00000014c0)="0b9443286ed7c6f940154a45da22f480f4f29727fa4bbad2c0e07648453490ba80e26fbeb9f042a567845a1b7795a664d844225dce82f28af3bd8d941c588579b89cc19acbc46ae5ca28b782741d4d3ef0f06e585fd6fbf1cff4675dfeba5fbf2eb8f71c1ffeb205fd509a693b41130ec5f06fc7ff3093f5c1a59f44e71287f472edfde4956b9f903a17aca477af5f0b34b491b922fd25a75a33f3916403ef7aa131dd35925315dd269e951c3fef101eaa91a0697f78e9365a1108a49670be199f9e416888e053ca09f090842c45e529db01ab4ffde0697a", 0xd8}, {&(0x7f00000015c0)="07a3a336d199288476d6f69b1c1fc6ee6356ca2e265877f48625b6308f96412b48528c088b1bffb93d2be5a4196e4f5ecaa7821716965527dc72119e4a3bff1666be047bbd662a3ef652f0f494f1fb99980860ef506017350e14ad461b039dd2b7c4f83a1cc2726ae2dfe43114d37ed8a539855a88c3c733ab42d86c08389d9c19e7d4b7edcf5b92cb9efbf557a91637e4e4e4e75d8a4aa564d478fb74fddc831907ac6bd8dbcf16b686b8619727466ee7dba8b88f602160b630d8195e22", 0xbe}], 0x3, &(0x7f00000016c0)=[@dstaddrv6={0x20, 0x84, 0x8, @private0={0xfc, 0x0, '\x00', 0x1}}, @sndinfo={0x20, 0x84, 0x2, {0x0, 0x4, 0x9a49, 0x400, r3}}, @sndinfo={0x20, 0x84, 0x2, {0x8, 0x200, 0x9, 0x8001}}, @prinfo={0x18, 0x84, 0x5, {0x20, 0x9}}, @dstaddrv6={0x20, 0x84, 0x8, @mcast1}], 0x98, 0x2000c010}, 0x90) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f00000017c0)={0x10200, 0x2, 0x4000, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r5, 0xc0502100, &(0x7f0000001800)={0x0, 0x0}) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000001880)={'\x00', 0x5, 0x5, 0x7ff, 0xcac9, 0x9a, r8}) r9 = socket$inet6(0xa, 0x3, 0xa) setsockopt$sock_int(r2, 0x1, 0x1, &(0x7f0000001900)=0x40, 0x4) r10 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000001980)=@o_path={&(0x7f0000001940)='./file0\x00', 0x0, 0x4000, r2}, 0x18) ioctl$FS_IOC_FSSETXATTR(r10, 0x401c5820, &(0x7f00000019c0)={0xf, 0xff, 0x4, 0x10000, 0x8}) setsockopt$SO_BINDTODEVICE(r9, 0x1, 0x19, &(0x7f0000001a00)='bridge0\x00', 0x10) getsockopt$netlink(r5, 0x10e, 0x7, &(0x7f0000001a40), &(0x7f0000001a80)) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-socket$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-sched_setattr-socket$netlink-socket-bind$inet-openat$tun-ioctl$TUNSETIFF-mmap-socketpair$nbd-ioctl$SIOCSIFHWADDR-pread64-sendmsg$nl_route-ioctl$USBDEVFS_DISCONNECT_CLAIM-socketpair$nbd-socket-setsockopt$packet_tx_ring-recvmmsg$unix-syz_usb_connect-sendmmsg-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-close_range-ioctl$TUNSETLINK-ioctl$SIOCSIFHWADDR detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20800, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'pim6reg1\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) socket$netlink(0x10, 0x3, 0xa) r4 = socket(0x15, 0x5, 0x0) bind$inet(r4, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x7002}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r6, 0x8914, 0x0) pread64(r5, &(0x7f0000002200)=""/89, 0x59, 0x10000) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)=@newlink={0x5c, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x37c13, 0x71a2b}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x14, 0x7, @loopback}]}}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x56}, @IFLA_TXQLEN={0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x1}, 0x20040040) ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, &(0x7f00000001c0)={0x7, 0x1, "9f4124e97cdf8607accbd3ee700be6a5996964ba9992a7a7e665251c40d747a039777a4e9eef1032a0ffe0accb2b3b677fceb40db406b7d926d463bcecf2c7cb97e31bb6a10629eb8ff6761bc86a87a41a50498799027e1a6f62e86d23f18e428a671414642cc02c86cb3bff0e8ecac0d1486c78978efc6a171a2df5d20f6f88900bef0716729f7188db2216a341b692a4ae0d415fa9506f3cbcc35a457bd126f8c7cc5f151ccd8e77ec0daae44e27ffce045d998c9dcddf291d7ffdc00e96999c9c7b6b27620ddd5627dd5937365fedc2e690dc2f5a0ea6cc408de017a1057b70d2bb091e743179be33941896217130e4ae90f2d6c85193cfe7531beabe5d44"}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r9, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) recvmmsg$unix(r9, &(0x7f0000004400)=[{{0x0, 0x0, &(0x7f0000001480)=[{&(0x7f0000000300)=""/41, 0x29}], 0x1}}], 0x1, 0x0, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000004c0)=ANY=[@ANYBLOB="12010000292966085e04840263f80102030109022400010000000909042600021197f80009050e00ff03817f0609b71a04cbc247f1da"], 0x0) sendmmsg(r9, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) r10 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) close_range(r10, r7, 0x0) ioctl$TUNSETLINK(r0, 0x400454cd, 0x18) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000140)={'pim6reg1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$printer-syz_usb_control_io$cdc_ecm detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000980)=ANY=[@ANYBLOB="120100009080e140fc044a500243010203010902120001000000000904"], 0x0) syz_usb_control_io(r0, &(0x7f0000000300)={0x2c, &(0x7f0000000000)={0x0, 0x31, 0xda, {0xda, 0x0, "dddcc61a3185e376406f8155f869aa475ccd3a60c53c8b84a1c416a1e33d4c7d8ac87bf8f7ac680256a1f6ba4e3250c12ca6a1909dcaab8f4d3751d53193cf9c4368e44b5f697dd8335a585ca91c109fdd790b2aebd7b7d4ef2fb47683e95170a33f6266ed5a27d22e97b7ebebe9e29571c655a483267ddecbd37af8c00a53733037f98a6f5cd842c8352f5d96b71f0b89cae4e86381799b20e7df62c41acb39f6a56fd911de8afcbc7bb642e47c6820a5a705bf1c2b289ac243627d6c203d5f570615b01ad6b00cce7dd69b80c184509c4f4bc19f5812f1"}}, &(0x7f0000000100)={0x0, 0x3, 0x62, @string={0x62, 0x3, "3e582ef263cb52b5e5e638e8456d44990b3fb7afc850b8397c38c1b79fe138b5c932cdec4d847bab260abab74e9b5b7604eb0801ea2a62e814876ce29a191132345c1025ce9f5d4428592f8fc639f0741841230450c2388662510165c17901a1"}}, &(0x7f00000001c0)={0x0, 0xf, 0xa4, {0x5, 0xf, 0xa4, 0x5, [@generic={0x82, 0x10, 0xb, "b5c2351e76a0f94a1ccf8b4ab83e09c4cc9b63d94b217b4674472faff0ee8f27073fdc25515082493a0d30370b9b9a8cd4837aed9d0cff64a840fa94fed76c3537127ea084482fcb8b6686176829e1ad0e979ee914fdca592726a0308da402a8e3f7962dcd6b84e3bdde4004e32989fdf9a1aada82ce4f72df8b95c6e89dfe"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x9, 0x67, 0x4, 0x3}, @ptm_cap={0x3}, @ptm_cap={0x3}, @generic={0xd, 0x10, 0x1, "2d206f2b6ce29235eed3"}]}}, &(0x7f0000000280)={0x20, 0x29, 0xf, {0xf, 0x29, 0x2, 0x10, 0x4, 0x2, "978e3f81", "e9b0d209"}}, &(0x7f00000002c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x7f, 0x2, 0x0, 0x6, 0xe, 0xc641, 0x5}}}, &(0x7f0000000800)={0x84, &(0x7f0000000340)={0x0, 0x17, 0x6d, "e060d1fbaf53c86c0b52101eb0d05ad4c2e1dc96215e9a2a2727f996a67c3d2280053b1cb8d1b4cbc3a3418290742d7913c9cb567d088f9cffd30388282eb8039ce3757a353bd05dc1904ee28b32c982fb826f6353d21717cb0ff44ad277d2a7bae168effa92310d6937a131cb"}, &(0x7f0000000400)={0x0, 0xa, 0x1, 0x7}, &(0x7f0000000440)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x2, 0x4}}, &(0x7f00000004c0)={0x20, 0x0, 0x4, {0x100, 0x80}}, &(0x7f0000000500)={0x40, 0x7, 0x2, 0x4}, &(0x7f0000000540)={0x40, 0x9, 0x1, 0xf4}, &(0x7f0000000580)={0x40, 0xb, 0x2, "d537"}, &(0x7f00000005c0)={0x40, 0xf, 0x2, 0x24}, &(0x7f0000000600)={0x40, 0x13, 0x6, @random="3bb58448eba9"}, &(0x7f0000000640)={0x40, 0x17, 0x6, @local}, &(0x7f0000000680)={0x40, 0x19, 0x2, "8936"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x400}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x8}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x5}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x6}}) syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000180)={0x40, 0xe, 0x47, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f00000003c0)={0x34, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, &(0x7f00000014c0)={0x34, &(0x7f00000006c0)=ANY=[@ANYBLOB="2006010000009e"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ncm-syz_usb_control_io$printer-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000a500e9406b06f92094ff010203010902121001000000000904"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f0000000300)={0x0, 0x0, 0x2, "6d10"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000680)={0x34, &(0x7f00000003c0)=ANY=[@ANYBLOB="000706020000889a70e69f94"], 0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 64) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f0000000240)={0x0, 0x16, 0x2, "be1a"}, 0x0, 0x0, 0x0, 0x0}) (rerun: 64) program crashed: UBSAN: shift-out-of-bounds in ax88772_bind single: successfully extracted reproducer found reproducer with 4 syscalls minimizing guilty program testing program (duration=45.849701904s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ncm-syz_usb_control_io$printer detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000a500e9406b06f92094ff010203010902121001000000000904"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f0000000300)={0x0, 0x0, 0x2, "6d10"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000680)={0x34, &(0x7f00000003c0)=ANY=[@ANYBLOB="000706020000889a70e69f94"], 0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 64) program did not crash testing program (duration=45.849701904s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ncm-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000a500e9406b06f92094ff010203010902121001000000000904"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f0000000300)={0x0, 0x0, 0x2, "6d10"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f0000000240)={0x0, 0x16, 0x2, "be1a"}, 0x0, 0x0, 0x0, 0x0}) (rerun: 64) program did not crash testing program (duration=45.849701904s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$printer-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000a500e9406b06f92094ff010203010902121001000000000904"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000680)={0x34, &(0x7f00000003c0)=ANY=[@ANYBLOB="000706020000889a70e69f94"], 0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 64) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f0000000240)={0x0, 0x16, 0x2, "be1a"}, 0x0, 0x0, 0x0, 0x0}) (rerun: 64) program crashed: UBSAN: shift-out-of-bounds in ax88772_bind testing program (duration=45.849701904s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_control_io$printer-syz_usb_control_io$hid detailed listing: executing program 0: syz_usb_control_io$printer(0xffffffffffffffff, 0x0, &(0x7f0000000680)={0x34, &(0x7f00000003c0)=ANY=[@ANYBLOB="000706020000889a70e69f94"], 0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 64) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f0000000240)={0x0, 0x16, 0x2, "be1a"}, 0x0, 0x0, 0x0, 0x0}) (rerun: 64) program did not crash testing program (duration=45.849701904s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$printer-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000a500e9406b06f92094ff010203010902121001000000000904"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000680)={0x34, &(0x7f00000003c0)=ANY=[@ANYBLOB="000706020000889a70e69f94"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f0000000240)={0x0, 0x16, 0x2, "be1a"}, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=45.849701904s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$printer-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000680)={0x34, &(0x7f00000003c0)=ANY=[@ANYBLOB="000706020000889a70e69f94"], 0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 64) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f0000000240)={0x0, 0x16, 0x2, "be1a"}, 0x0, 0x0, 0x0, 0x0}) (rerun: 64) program did not crash testing program (duration=45.849701904s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$printer-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000340)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000680)={0x34, &(0x7f00000003c0)=ANY=[@ANYBLOB="000706020000889a70e69f94"], 0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 64) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f0000000240)={0x0, 0x16, 0x2, "be1a"}, 0x0, 0x0, 0x0, 0x0}) (rerun: 64) program did not crash testing program (duration=45.849701904s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$printer-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000a500e9406b06f92094ff010203010902121001000000000904"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) (async, rerun: 64) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f0000000240)={0x0, 0x16, 0x2, "be1a"}, 0x0, 0x0, 0x0, 0x0}) (rerun: 64) program did not crash testing program (duration=45.849701904s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$printer-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000a500e9406b06f92094ff010203010902121001000000000904"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000680)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 64) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f0000000240)={0x0, 0x16, 0x2, "be1a"}, 0x0, 0x0, 0x0, 0x0}) (rerun: 64) program did not crash testing program (duration=45.849701904s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$printer-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000a500e9406b06f92094ff010203010902121001000000000904"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000680)={0x34, &(0x7f00000003c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 64) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f0000000240)={0x0, 0x16, 0x2, "be1a"}, 0x0, 0x0, 0x0, 0x0}) (rerun: 64) program did not crash testing program (duration=45.849701904s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$printer-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000a500e9406b06f92094ff010203010902121001000000000904"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000680)={0x34, &(0x7f00000003c0)=ANY=[@ANYBLOB="000706020000889a70e69f94"], 0x0, 0x0, 0x0, 0x0, 0x0}) (rerun: 64) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f0000000240)={0x0, 0x16, 0x2, "be1a"}, 0x0, 0x0, 0x0, 0x0}) (rerun: 64) program crashed: UBSAN: shift-out-of-bounds in ax88772_bind testing program (duration=45.849701904s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$printer-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000a500e9406b06f92094ff010203010902121001000000000904"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000680)={0x34, &(0x7f00000003c0)=ANY=[@ANYBLOB="000706020000889a70e69f94"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f0000000240)={0x0, 0x16, 0x2, "be1a"}, 0x0, 0x0, 0x0, 0x0}) (rerun: 64) program did not crash testing program (duration=45.849701904s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$printer-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000a500e9406b06f92094ff010203010902121001000000000904"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000680)={0x34, &(0x7f00000003c0)=ANY=[@ANYBLOB="000706020000889a70e69f94"], 0x0, 0x0, 0x0, 0x0, 0x0}) (rerun: 64) syz_usb_control_io$hid(r0, 0x0, 0x0) (rerun: 64) program did not crash testing program (duration=45.849701904s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$printer-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000a500e9406b06f92094ff010203010902121001000000000904"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000680)={0x34, &(0x7f00000003c0)=ANY=[@ANYBLOB="000706020000889a70e69f94"], 0x0, 0x0, 0x0, 0x0, 0x0}) (rerun: 64) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000005c0)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}) (rerun: 64) program did not crash testing program (duration=45.849701904s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$printer-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000a500e9406b06f92094ff010203010902121001000000000904"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000680)={0x34, &(0x7f00000003c0)=ANY=[@ANYBLOB="000706020000889a70e69f94"], 0x0, 0x0, 0x0, 0x0, 0x0}) (rerun: 64) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f0000000240)={0x0, 0x16}, 0x0, 0x0, 0x0, 0x0}) (rerun: 64) program did not crash testing program (duration=45.849701904s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$printer-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000a500e9406b06f92094ff010203010902121001000000000904"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000680)={0x34, &(0x7f00000003c0)=ANY=[@ANYBLOB="000706020000889a70e69f94"], 0x0, 0x0, 0x0, 0x0, 0x0}) (rerun: 64) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f0000000240)={0x0, 0x16, 0x2, "be1a"}, 0x0, 0x0, 0x0, 0x0}) program crashed: UBSAN: shift-out-of-bounds in ax88772_bind extracting C reproducer testing compiled C program (duration=45.849701904s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$printer-syz_usb_control_io$hid program did not crash simplifying guilty program options testing program (duration=45.849701904s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$printer-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000a500e9406b06f92094ff010203010902121001000000000904"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000680)={0x34, &(0x7f00000003c0)=ANY=[@ANYBLOB="000706020000889a70e69f94"], 0x0, 0x0, 0x0, 0x0, 0x0}) (rerun: 64) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f0000000240)={0x0, 0x16, 0x2, "be1a"}, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=45.849701904s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$printer-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000a500e9406b06f92094ff010203010902121001000000000904"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000680)={0x34, &(0x7f00000003c0)=ANY=[@ANYBLOB="000706020000889a70e69f94"], 0x0, 0x0, 0x0, 0x0, 0x0}) (rerun: 64) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f0000000240)={0x0, 0x16, 0x2, "be1a"}, 0x0, 0x0, 0x0, 0x0}) program crashed: UBSAN: shift-out-of-bounds in ax88772_bind extracting C reproducer testing compiled C program (duration=45.849701904s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$printer-syz_usb_control_io$hid program did not crash testing program (duration=45.849701904s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$printer-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000a500e9406b06f92094ff010203010902121001000000000904"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000680)={0x34, &(0x7f00000003c0)=ANY=[@ANYBLOB="000706020000889a70e69f94"], 0x0, 0x0, 0x0, 0x0, 0x0}) (rerun: 64) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f0000000240)={0x0, 0x16, 0x2, "be1a"}, 0x0, 0x0, 0x0, 0x0}) program crashed: UBSAN: shift-out-of-bounds in ax88772_bind extracting C reproducer testing compiled C program (duration=45.849701904s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$printer-syz_usb_control_io$hid program did not crash testing program (duration=45.849701904s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$printer-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000a500e9406b06f92094ff010203010902121001000000000904"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000680)={0x34, &(0x7f00000003c0)=ANY=[@ANYBLOB="000706020000889a70e69f94"], 0x0, 0x0, 0x0, 0x0, 0x0}) (rerun: 64) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f0000000240)={0x0, 0x16, 0x2, "be1a"}, 0x0, 0x0, 0x0, 0x0}) program crashed: UBSAN: shift-out-of-bounds in ax88772_bind validation run: crashed=true testing program (duration=45.849701904s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$printer-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000a500e9406b06f92094ff010203010902121001000000000904"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000680)={0x34, &(0x7f00000003c0)=ANY=[@ANYBLOB="000706020000889a70e69f94"], 0x0, 0x0, 0x0, 0x0, 0x0}) (rerun: 64) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f0000000240)={0x0, 0x16, 0x2, "be1a"}, 0x0, 0x0, 0x0, 0x0}) program crashed: UBSAN: shift-out-of-bounds in ax88772_bind validation run: crashed=true testing program (duration=45.849701904s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$printer-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000a500e9406b06f92094ff010203010902121001000000000904"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000680)={0x34, &(0x7f00000003c0)=ANY=[@ANYBLOB="000706020000889a70e69f94"], 0x0, 0x0, 0x0, 0x0, 0x0}) (rerun: 64) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f0000000240)={0x0, 0x16, 0x2, "be1a"}, 0x0, 0x0, 0x0, 0x0}) program crashed: UBSAN: shift-out-of-bounds in ax88772_bind validation run: crashed=true reproducing took 41m39.971022767s repro crashed as (corrupted=false): asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 asix 1-1:0.0 (unnamed net_device) (uninitialized): Error reading RX_CTL register: ffffffb9 asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 asix 1-1:0.0 (unnamed net_device) (uninitialized): Error reading Medium Status register: ffffffb9 ------------[ cut here ]------------ UBSAN: shift-out-of-bounds in drivers/net/usb/asix_devices.c:679:27 shift exponent 154 is too large for 64-bit type 'unsigned long' CPU: 0 UID: 0 PID: 5906 Comm: kworker/0:4 Not tainted 6.17.0-rc1-syzkaller-00211-g90d970cade8e #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 Workqueue: usb_hub_wq hub_event Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 ubsan_epilogue+0xa/0x40 lib/ubsan.c:233 __ubsan_handle_shift_out_of_bounds+0x386/0x410 lib/ubsan.c:494 ax88772_init_mdio drivers/net/usb/asix_devices.c:679 [inline] ax88772_bind+0xdcf/0xfa0 drivers/net/usb/asix_devices.c:910 usbnet_probe+0xa96/0x2870 drivers/net/usb/usbnet.c:1781 usb_probe_interface+0x668/0xc30 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x26a/0x9e0 drivers/base/dd.c:659 __driver_probe_device+0x18c/0x2f0 drivers/base/dd.c:801 driver_probe_device+0x4f/0x430 drivers/base/dd.c:831 __device_attach_driver+0x2ce/0x530 drivers/base/dd.c:959 bus_for_each_drv+0x251/0x2e0 drivers/base/bus.c:462 __device_attach+0x2b8/0x400 drivers/base/dd.c:1031 bus_probe_device+0x185/0x260 drivers/base/bus.c:537 device_add+0x7b6/0xb50 drivers/base/core.c:3689 usb_set_configuration+0x1a87/0x20e0 drivers/usb/core/message.c:2210 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c1/0x390 drivers/usb/core/driver.c:291 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x26a/0x9e0 drivers/base/dd.c:659 __driver_probe_device+0x18c/0x2f0 drivers/base/dd.c:801 driver_probe_device+0x4f/0x430 drivers/base/dd.c:831 __device_attach_driver+0x2ce/0x530 drivers/base/dd.c:959 bus_for_each_drv+0x251/0x2e0 drivers/base/bus.c:462 __device_attach+0x2b8/0x400 drivers/base/dd.c:1031 bus_probe_device+0x185/0x260 drivers/base/bus.c:537 device_add+0x7b6/0xb50 drivers/base/core.c:3689 usb_new_device+0xa39/0x16f0 drivers/usb/core/hub.c:2694 hub_port_connect drivers/usb/core/hub.c:5566 [inline] hub_port_connect_change drivers/usb/core/hub.c:5706 [inline] port_event drivers/usb/core/hub.c:5870 [inline] hub_event+0x2958/0x4a20 drivers/usb/core/hub.c:5952 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400 kthread+0x70e/0x8a0 kernel/kthread.c:463 ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ---[ end trace ]--- final repro crashed as (corrupted=false): asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 asix 1-1:0.0 (unnamed net_device) (uninitialized): Error reading RX_CTL register: ffffffb9 asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 asix 1-1:0.0 (unnamed net_device) (uninitialized): Error reading Medium Status register: ffffffb9 ------------[ cut here ]------------ UBSAN: shift-out-of-bounds in drivers/net/usb/asix_devices.c:679:27 shift exponent 154 is too large for 64-bit type 'unsigned long' CPU: 0 UID: 0 PID: 5906 Comm: kworker/0:4 Not tainted 6.17.0-rc1-syzkaller-00211-g90d970cade8e #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 Workqueue: usb_hub_wq hub_event Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 ubsan_epilogue+0xa/0x40 lib/ubsan.c:233 __ubsan_handle_shift_out_of_bounds+0x386/0x410 lib/ubsan.c:494 ax88772_init_mdio drivers/net/usb/asix_devices.c:679 [inline] ax88772_bind+0xdcf/0xfa0 drivers/net/usb/asix_devices.c:910 usbnet_probe+0xa96/0x2870 drivers/net/usb/usbnet.c:1781 usb_probe_interface+0x668/0xc30 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x26a/0x9e0 drivers/base/dd.c:659 __driver_probe_device+0x18c/0x2f0 drivers/base/dd.c:801 driver_probe_device+0x4f/0x430 drivers/base/dd.c:831 __device_attach_driver+0x2ce/0x530 drivers/base/dd.c:959 bus_for_each_drv+0x251/0x2e0 drivers/base/bus.c:462 __device_attach+0x2b8/0x400 drivers/base/dd.c:1031 bus_probe_device+0x185/0x260 drivers/base/bus.c:537 device_add+0x7b6/0xb50 drivers/base/core.c:3689 usb_set_configuration+0x1a87/0x20e0 drivers/usb/core/message.c:2210 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c1/0x390 drivers/usb/core/driver.c:291 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x26a/0x9e0 drivers/base/dd.c:659 __driver_probe_device+0x18c/0x2f0 drivers/base/dd.c:801 driver_probe_device+0x4f/0x430 drivers/base/dd.c:831 __device_attach_driver+0x2ce/0x530 drivers/base/dd.c:959 bus_for_each_drv+0x251/0x2e0 drivers/base/bus.c:462 __device_attach+0x2b8/0x400 drivers/base/dd.c:1031 bus_probe_device+0x185/0x260 drivers/base/bus.c:537 device_add+0x7b6/0xb50 drivers/base/core.c:3689 usb_new_device+0xa39/0x16f0 drivers/usb/core/hub.c:2694 hub_port_connect drivers/usb/core/hub.c:5566 [inline] hub_port_connect_change drivers/usb/core/hub.c:5706 [inline] port_event drivers/usb/core/hub.c:5870 [inline] hub_event+0x2958/0x4a20 drivers/usb/core/hub.c:5952 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400 kthread+0x70e/0x8a0 kernel/kthread.c:463 ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ---[ end trace ]---