Extracting prog: 22m20.375766169s
Minimizing prog: 1h9m18.394432414s
Simplifying prog options: 0s
Extracting C: 55.001891496s
Simplifying C: 9m18.42272992s


extracting reproducer from 26 programs
testing a last program of every proc
single: executing 5 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_IRQCHIP-syz_kvm_setup_syzos_vm$x86-ioctl$KVM_SET_USER_MEMORY_REGION-syz_kvm_add_vcpu$x86-ioctl$KVM_GET_VCPU_MMAP_SIZE-mmap$KVM_VCPU-ioctl$KVM_RUN
detailed listing:
executing program 0:
r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0xc, 0x0, 0xfec00000, 0x0, &(0x7f0000000000/0x1000)=nil})
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@code={0xa, 0x1a, {"488b04250000c0fef4"}}], 0x1a})
r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04)
mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$uac3-nanosleep-syz_open_dev$sndctrl-syz_open_dev$sndctrl-ioctl$SNDRV_CTL_IOCTL_TLV_READ-ioctl$SNDRV_CTL_IOCTL_TLV_READ-ioctl$SNDRV_CTL_IOCTL_TLV_READ-ioctl$SNDRV_CTL_IOCTL_TLV_READ-ioctl$SNDRV_CTL_IOCTL_TLV_READ-ioctl$SNDRV_CTL_IOCTL_TLV_READ-ioctl$SNDRV_CTL_IOCTL_TLV_READ-ioctl$SNDRV_CTL_IOCTL_TLV_READ-ioctl$SNDRV_CTL_IOCTL_TLV_READ-ioctl$SNDRV_CTL_IOCTL_TLV_READ
detailed listing:
executing program 0:
syz_usb_connect$uac3(0x3, 0x2c, &(0x7f0000000800)=ANY=[@ANYBLOB="12010002000000408205820540000102030109021a000101c0c310080b000101013061090400000001013000"], 0x0)
nanosleep(&(0x7f0000000000)={0x1}, 0x0)
r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0)
r1 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x1, 0x0)
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000200)={0x1, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000200)={0x2, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000200)={0x3, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000200)={0x4, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000200)={0x5, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r1, 0xc008551a, &(0x7f0000000200)={0x1, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r1, 0xc008551a, &(0x7f0000000200)={0x2, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r1, 0xc008551a, &(0x7f0000000200)={0x3, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r1, 0xc008551a, &(0x7f0000000200)={0x4, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r1, 0xc008551a, &(0x7f0000000200)={0x5, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-syz_open_dev$video-ioctl$VIDIOC_REQBUFS-ioctl$VIDIOC_QBUF-ioctl$VIDIOC_STREAMON
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff406d04000900000102030109021b0001010080fa0904000001ff000000090581010002010000"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x8, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000200)={0x2, 0x1, 0x1})
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000400)=@mmap={0x0, 0x1})
ioctl$VIDIOC_STREAMON(r0, 0x40045612, &(0x7f0000000500)=0x1)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-nanosleep-openat-write-openat-write-write-nanosleep
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b40401310000000000010902200001010080fa0904000002ff0000000705810200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
nanosleep(&(0x7f00000000c0)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/firmware/dvb-usb-dw3101.fw/loading\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/firmware/dvb-usb-dw3101.fw/data\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='A', 0x1)
write(r0, &(0x7f0000000200)='0', 0x1)
nanosleep(&(0x7f0000000240)={0x1}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-writev-nanosleep-openat-write-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000006000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000006000)='./sys\x00', &(0x7f0000006100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000006200)='./sys/module/psmouse/parameters/synaptics_intertouch\x00', 0x1, 0x0)
write(r0, &(0x7f0000006300)='1\x00', 0x2)
r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000006400), 0x2, 0x0)
write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000006502)={0x1, 0x1}, 0x2)
write$USERIO_CMD_REGISTER(r1, &(0x7f0000006500), 0x2)
writev(r1, &(0x7f0000002000)=[{&(0x7f0000003000)="02fa", 0x2}, {&(0x7f0000003002)="0200", 0x2}, {&(0x7f0000003002), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003004)="0205", 0x2}, {&(0x7f0000003006)="0247", 0x2}, {&(0x7f0000003008)="0207", 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f000000300a)="02aa", 0x2}, {&(0x7f0000003002), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003004), 0x2}, {&(0x7f0000003006), 0x2}, {&(0x7f0000003008), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003002), 0x2}, {&(0x7f0000003002), 0x2}, {&(0x7f0000003002), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f000000300c)="02c0", 0x2}, {&(0x7f0000003002), 0x2}, {&(0x7f0000003002), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003002), 0x2}, {&(0x7f0000003002), 0x2}, {&(0x7f0000003002), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003002), 0x2}, {&(0x7f000000300e)="0240", 0x2}, {&(0x7f0000003002), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003002), 0x2}, {&(0x7f0000003002), 0x2}, {&(0x7f0000003002), 0x2}], 0x5f)
nanosleep(&(0x7f0000006600)={0x1}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000006700)='./sys/bus/serio/devices/serio0/protocol\x00', 0x1, 0x0)
write(r2, &(0x7f0000006800)='bare\x00', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000006710)='./sys/bus/serio/devices/serio1/protocol\x00', 0x1, 0x0)
write(r3, &(0x7f0000006800)='bare\x00', 0x4)
r4 = openat(0xffffffffffffff9c, &(0x7f0000006720)='./sys/bus/serio/devices/serio2/protocol\x00', 0x1, 0x0)
write(r4, &(0x7f0000006800)='bare\x00', 0x4)

program did not crash
single: failed to extract reproducer
bisect: bisecting 26 programs with base timeout 30s
testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 30, 15, 16, 18, 5, 4, 15, 13, 6, 13, 2, 8, 13, 12, 6, 13, 15, 19, 12, 10, 16, 6, 29, 14, 9]
detailed listing:
executing program 1:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x0, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0)
nanosleep(&(0x7f0000000d00)={0x0, 0x1dcd6500}, 0x0)
r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000400)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000500)={<r2=>0x0}, 0x106, 0x2}}, 0x20)
write$RDMA_USER_CM_CMD_BIND_IP(r1, &(0x7f0000000600)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x1234, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, r2}}, 0x30)
write$RDMA_USER_CM_CMD_LISTEN(r1, &(0x7f0000000700)={0x7, 0x8, 0xfa00, {r2, 0x10}}, 0x10)
write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000800)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000900)={<r3=>0x0}, 0x106, 0x2}}, 0x20)
write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000a00)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, {0xa, 0x1234, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, r3, 0x3e8}}, 0x48)
write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r1, &(0x7f0000000b00)={0x4, 0x8, 0xfa00, {r3, 0x3e8}}, 0x10)
write$RDMA_USER_CM_CMD_CONNECT(r1, &(0x7f0000000c00)={0x6, 0x118, 0xfa00, {{0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, r3}}, 0x120)
executing program 1:
mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./ram1\x00', 0x8000, 0x101)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./ram1\x00', 0x2, 0x0)
pwrite64(r0, &(0x7f0000000000)="fc4e2ba9", 0x4, 0x3f0000)
pwrite64(r0, &(0x7f0000000000)='Z\x00\x00\x00', 0x4, 0x3f0008)
pwrite64(r0, &(0x7f0000000000)="01000000", 0x4, 0x3f0028)
pwrite64(r0, &(0x7f0000000000)="5d4f2ba9", 0x4, 0x3f0098)
pwrite64(r0, &(0x7f0000000000)="06000000", 0x4, 0x3f0210)
pwrite64(r0, &(0x7f0000000000)="fc4e2ba9", 0x4, 0xff0000)
pwrite64(r0, &(0x7f0000000000)='Z\x00\x00\x00', 0x4, 0xff0008)
pwrite64(r0, &(0x7f0000000000)="01000000", 0x4, 0xff0028)
pwrite64(r0, &(0x7f0000000000)="5d4f2ba9", 0x4, 0xff0098)
pwrite64(r0, &(0x7f0000000000)="06000000", 0x4, 0xff0210)
pwrite64(r0, &(0x7f0000000000)="fc4e2ba9", 0x4, 0x3ff0000)
pwrite64(r0, &(0x7f0000000000)='Z\x00\x00\x00', 0x4, 0x3ff0008)
pwrite64(r0, &(0x7f0000000000)="01000000", 0x4, 0x3ff0028)
pwrite64(r0, &(0x7f0000000000)="5d4f2ba9", 0x4, 0x3ff0098)
pwrite64(r0, &(0x7f0000000000)="06000000", 0x4, 0x3ff0210)
pwrite64(r0, &(0x7f0000000000)="fc4e2ba9", 0x4, 0x7ff0000)
pwrite64(r0, &(0x7f0000000000)='Z\x00\x00\x00', 0x4, 0x7ff0008)
pwrite64(r0, &(0x7f0000000000)="01000000", 0x4, 0x7ff0028)
pwrite64(r0, &(0x7f0000000000)="5d4f2ba9", 0x4, 0x7ff0098)
pwrite64(r0, &(0x7f0000000000)="06000000", 0x4, 0x7ff0210)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='md0\x00', 0x4)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='0.90', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r3, &(0x7f00000002c0)='1:1', 0x3)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000180)='0x1d6b\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000200)='0x0104\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/midi2.0\x00', 0x1ff)
symlinkat(&(0x7f00000002c0)='./config/usb_gadget/g1/functions/midi2.0\x00', 0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1/midi2.0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f00000003c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r3 = syz_open_dev$sndmidi(&(0x7f0000000400), 0x0, 0x2)
write$midi(r3, &(0x7f0000000440)='hello', 0x5)
executing program 1:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404c05c1060001010203010902200001010080fa0904000002ffffff000705810200020007050202000200"], 0x0)
syz_usb_ep_read(r0, 0x2, 0x100, &(0x7f0000000500)=""/256) (async)
syz_usb_ep_read(r0, 0x2, 0x100, &(0x7f0000000600)=""/256) (async)
syz_usb_ep_read(r0, 0x2, 0x100, &(0x7f0000000700)=""/256) (async)
syz_usb_ep_read(r0, 0x2, 0x100, &(0x7f0000000800)=""/256) (async)
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000100)="0000ff00ff00")
syz_usb_ep_write(r0, 0x81, 0x14, &(0x7f0000000106)="0000ffffff0a00f6d7290000000000000003fd00")
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000200)="0000ff00ff00")
syz_usb_ep_write(r0, 0x81, 0xd, &(0x7f0000000206)="0000ffffff0300fdd72b00fe00")
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000300)="0000ff00ff00")
syz_usb_ep_write(r0, 0x81, 0xe, &(0x7f0000000306)="0000ffffff0400fcd72101000700")
nanosleep(&(0x7f0000000400)={0x1}, 0x0)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000001000), r1)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000002000)={0x0, 0x0, &(0x7f0000002100)={&(0x7f0000002200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x1c}}, 0x0)
sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000003000)={0x0, 0x0, &(0x7f0000003100)={&(0x7f0000003200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/mapper/control\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x42, 0x1ff)
fallocate(r1, 0x0, 0x0, 0x1000000)
fallocate(r1, 0x11, 0x0, 0x1000000)
r2 = syz_open_dev$loop(&(0x7f0000000200), 0x0, 0x2)
ioctl$LOOP_SET_FD(r2, 0x4c00, r1)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file1\x00', 0x42, 0x1ff)
fallocate(r3, 0x0, 0x0, 0x1000000)
fallocate(r3, 0x11, 0x0, 0x1000000)
r4 = syz_open_dev$loop(&(0x7f0000000280), 0x1, 0x2)
ioctl$LOOP_SET_FD(r4, 0x4c00, r3)
ioctl(r0, 0xc138fd03, &(0x7f0000000000)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000006d79706f6f6c00")
write(r0, &(0x7f0000000138)="0000000000000000008000000000000000000000000000007468696e2d706f6f6c00000000000000373a3020373a3120313238203000", 0x36)
ioctl(r0, 0xc138fd09, &(0x7f0000000000)="0400000000000000000000006e01000038010000010000000000000000000000000000000000000000000000000000006d79706f6f6c00")
ioctl(r0, 0xc138fd06, &(0x7f0000000000)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000006d79706f6f6c00")
ioctl(r0, 0xc138fd06, &(0x7f0000000000)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000006d79706f6f6c00")
executing program 0:
r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402505a0a40000000000010902240001010080fa0904000002ff000000090581020002000000090502020002000000"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
nanosleep(&(0x7f0000000400)={0x1}, 0x0)
r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0xb, 0x2)
ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, &(0x7f0000000200)=@usbdevfs_driver={0x0, 0xc01c5564, &(0x7f0000000300)="050000000100000000040000000000000100"/28})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./nfsd/portlist\x00', 0x2, 0x0)
read(r0, &(0x7f0000000280)=""/5, 0x5)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x42, 0x1b6)
fallocate(r0, 0x0, 0x0, 0x10000)
pwrite64(r0, &(0x7f0000000100)="fc4e2ba901000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000a000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000008000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001b532ba90100"/260, 0x102, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000180), 0x0, 0x0)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='md123\x00', 0x6)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md123/md/metadata_version\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='1.1\x00', 0x4)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md123/md/new_dev\x00', 0x1, 0x0)
write(r4, &(0x7f0000000700)='7:0\x00', 0x4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md123/md/array_state\x00', 0x1, 0x0)
write(r5, &(0x7f0000000900)='active\x00', 0x7)
executing program 3:
r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x38, 0x1403, 0x405, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}}}, 0x0)
nanosleep(&(0x7f0000000d00)={0x1}, 0x0)
r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000400)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000500)={<r2=>0x0}, 0x106, 0x2}}, 0x20)
write$RDMA_USER_CM_CMD_BIND_IP(r1, &(0x7f0000000600)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x1234, 0x0, @loopback}, r2}}, 0x30)
write$RDMA_USER_CM_CMD_LISTEN(r1, &(0x7f0000000700)={0x7, 0x8, 0xfa00, {r2, 0x10}}, 0x10)
write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000800)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000900)={<r3=>0x0}, 0x106, 0x2}}, 0x20)
write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000a00)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @empty}, {0xa, 0x1234, 0x0, @loopback}, r3, 0x3e8}}, 0x48)
write$RDMA_USER_CM_CMD_GET_EVENT(r1, &(0x7f0000000e00)={0xc, 0x8, 0x150, {&(0x7f0000000f00)}}, 0x10)
write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r1, &(0x7f0000000b00)={0x4, 0x8, 0xfa00, {r3, 0x3e8}}, 0x10)
write$RDMA_USER_CM_CMD_GET_EVENT(r1, &(0x7f0000000e00)={0xc, 0x8, 0x150, {&(0x7f0000000f00)}}, 0x10)
write$RDMA_USER_CM_CMD_CONNECT(r1, &(0x7f0000000c00)={0x6, 0x118, 0xfa00, {{0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, r3}}, 0x120)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/midi2.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/midi2.0/ep.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/midi2.0/ep.1/block.0\x00', 0x1ff)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/my_nullb\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nullb/my_nullb/zoned\x00', 0x2, 0x0)
write(r0, &(0x7f0000000400)='1\x00', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nullb/my_nullb/power\x00', 0x2, 0x0)
write(r1, &(0x7f0000000600)='1\x00', 0x2)
r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000700), 0x2, 0x0)
pwrite64(r2, &(0x7f0000002000)='\x00'/4096, 0x1000, 0x0)
pwrite64(r2, &(0x7f0000001000)='SFOZ', 0x4, 0x0)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000700)=@nullb, &(0x7f0000000800)='./mnt\x00', &(0x7f0000000900)='zonefs\x00', 0x0, 0x0)
executing program 4:
r0 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000000)={'lo\x00', &(0x7f0000000080)=@ethtool_rxnfc={0x32, 0x1, 0x0, {0x1, @tcp_ip4_spec={@empty, @empty}, {0x0, @random}, @tcp_ip4_spec={@empty, @empty}, {0x0, @random}}}})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/hpet_acpi/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='PNP0103:00\x00', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/devices/PNP0103:00/driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='acpi-thermal\x00', 0xd)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/acpi-thermal/bind\x00', 0x1, 0x0)
write(r2, &(0x7f00000001c0)='PNP0103:00\x00', 0xb)
executing program 3:
syz_usb_connect$uac1(0x2, 0x9c, &(0x7f0000000000)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x20, 0xb05, 0x1743, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x8a, 0x3, 0x1, 0x9, 0x40, 0x3f, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xd2, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x8, 0x8, 0x5}, @format_type_i_continuous={0xe, 0x24, 0x2, 0x1, 0x2, 0x2, 0x10, 0x1, "80bb00", "80bb00"}]}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x1, 0x0, 0x0, {0x7, 0x25, 0x1, 0x0, 0x1, 0x1}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x8, 0x8, 0x5}, @format_type_i_continuous={0xe, 0x24, 0x2, 0x1, 0x2, 0x2, 0x10, 0x1, "80bb00", "80bb00"}]}, {{0x9, 0x5, 0x81, 0x5, 0x400, 0x1, 0x0, 0x0, {0x7, 0x25, 0x1, 0x0, 0x1, 0x1}}}}}}}}]}}, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0)
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000400)={0xb, 0x100, [0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000400)={0xc, 0x100, [0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000400)={0xd, 0x100, [0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000400)={0xe, 0x100, [0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000400)={0xf, 0x100, [0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000400)={0x10, 0x100, [0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000400)={0x11, 0x100, [0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000400)={0x12, 0x100, [0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000400)={0x13, 0x100, [0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000400)={0x14, 0x100, [0x0]})
executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0)
sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0)
nanosleep(&(0x7f00000002c0)={0x0, 0x2faf080}, &(0x7f0000000300))
syz_80211_inject_frame(&(0x7f0000000340)=@device_b, &(0x7f0000000380)=@mgmt_frame=@auth={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e)
nanosleep(&(0x7f00000003c0)={0x0, 0x2faf080}, &(0x7f0000000400))
syz_80211_inject_frame(&(0x7f0000000440)=@device_b, &(0x7f0000000480)=@mgmt_frame=@assoc_resp={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void}, 0x28)
nanosleep(&(0x7f00000004c0)={0x0, 0xbebc200}, &(0x7f0000000500))
sendmsg$NL80211_CMD_NEW_STATION(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)={0x50, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_STA_FLAGS2={0xc, 0x43, {0x40, 0x40}}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0xa}, @NL80211_ATTR_STA_SUPPORTED_RATES={0xc, 0x13, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x1}]}, 0x50}}, 0x0)
sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000006c0)={0x50, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_TDLS_ACTION={0x5}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_STATUS_CODE={0x6}, @NL80211_ATTR_TDLS_DIALOG_TOKEN={0x5}, @NL80211_ATTR_IE={0x4}, @NL80211_ATTR_TDLS_INITIATOR={0x4}, @NL80211_ATTR_TDLS_PEER_CAPABILITY={0x8}]}, 0x50}}, 0x0)
executing program 0:
r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="380000000314050400000000000000000900020073797a320000000008003c00736977001400330073797a3000"/56], 0x38}}, 0x0)
nanosleep(&(0x7f0000000000)={0x0, 0x10000000}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000240)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/infiniband/syz2\x00', 0x2, 0x0)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./img\x00', 0x42, 0x1ff)
write(r0, &(0x7f0000000200)="789c926c5560666060e0f99070678664eb0346060606c3c30a7763191818406c106002119c1c0c0c0ff223e4927bec77a665e6a4ea25e7e7a4fcffff5fb2f501483e2c3c2cb80caa969181a1f12d546f0a0326100289831466975c992e907cff5a314325431543364322430e430e432a435134d85c90fdbad7151b85a06e0161905b195859181842e32c4eea1f5a9e07728b01c21d2e4bde2bd941d531323038bec5623f567089ab7a2d163b4166b280ede46060687d7f6055c4d1e93f40761a22ecf473b13aad005587ec772e2cd670c1c41bef3c4a768af4b9515c59959d9893935a540c368f838181c160a779ff2e989f19d918d8ce5af17d6d39e494549158525264c800a120f673323030c86ceb3ff512613f03d3adb51c0fd0cc628299756b4fc49af71aa65660438c20661961370becf792bcebac58c20514beacb070f167e2cd3978e69813285c8c10e19232bf91e91b541d52b8286b60091705060601b085e70bdc2b79764d5cc8f01f3fc46207136e3b0430ece87494ca27d20e9f5526ab78a07630e3b6039404183818189835409a9c0ff058ed3cf12e0d6a963a963064410e43a3426e936da7bf5d0185a1f17f8cf40f0b6f36987aa6b0bacd58d27f5c64ef6d17a83aa4306791c212e65220719026cd1bf315991ed7bcc0c887ffb3ffa7feaffa9f2388d53d203bd8c1eee16260589d7c29004bdec8e6b7934f87aa63646058f81f6ab73a16f7a8c3c40576994eb8ee93cba15f925ba05f5c59a59b999b989e9a9e9a6764646c66606260606aa40ff63784fc0f080000ffffad9719da", 0x5000)
r1 = syz_open_dev$loop(&(0x7f0000000300), 0x0, 0x2)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0)
write(r2, &(0x7f0000000700)='/dev/loop0,4096\x00', 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000900)=@filename='mtd1\x00', &(0x7f0000000800)='./mnt\x00', &(0x7f0000000a00)='jffs2\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./mnt/test\x00', 0x42, 0x1ff)
write(r3, &(0x7f0000000c00)='A', 0x1000)
unlinkat(0xffffffffffffff9c, &(0x7f0000000b00)='./mnt/test\x00', 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000006000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000006000)='./sys\x00', &(0x7f0000006100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000006200)='./sys/module/psmouse/parameters/synaptics_intertouch\x00', 0x1, 0x0)
write(r0, &(0x7f0000006300)='1\x00', 0x2)
r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000006400), 0x2, 0x0)
write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000006502)={0x1, 0x1}, 0x2)
write$USERIO_CMD_REGISTER(r1, &(0x7f0000006500), 0x2)
writev(r1, &(0x7f0000002000)=[{&(0x7f0000003000)="02fa", 0x2}, {&(0x7f0000003002)="0200", 0x2}, {&(0x7f0000003002), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003004)="0205", 0x2}, {&(0x7f0000003006)="0247", 0x2}, {&(0x7f0000003008)="0207", 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f000000300a)="02aa", 0x2}, {&(0x7f0000003002), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003004), 0x2}, {&(0x7f0000003006), 0x2}, {&(0x7f0000003008), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003002), 0x2}, {&(0x7f0000003002), 0x2}, {&(0x7f0000003002), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f000000300c)="02c0", 0x2}, {&(0x7f0000003002), 0x2}, {&(0x7f0000003002), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003002), 0x2}, {&(0x7f0000003002), 0x2}, {&(0x7f0000003002), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003002), 0x2}, {&(0x7f000000300e)="0240", 0x2}, {&(0x7f0000003002), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003000), 0x2}, {&(0x7f0000003002), 0x2}, {&(0x7f0000003002), 0x2}, {&(0x7f0000003002), 0x2}], 0x5f)
nanosleep(&(0x7f0000006600)={0x1}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000006700)='./sys/bus/serio/devices/serio0/protocol\x00', 0x1, 0x0)
write(r2, &(0x7f0000006800)='bare\x00', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000006710)='./sys/bus/serio/devices/serio1/protocol\x00', 0x1, 0x0)
write(r3, &(0x7f0000006800)='bare\x00', 0x4)
r4 = openat(0xffffffffffffff9c, &(0x7f0000006720)='./sys/bus/serio/devices/serio2/protocol\x00', 0x1, 0x0)
write(r4, &(0x7f0000006800)='bare\x00', 0x4)
executing program 2:
r0 = syz_io_uring_setup(0x80, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000140)=<r2=>0x0, &(0x7f0000000180)=<r3=>0x0)
r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'\x00', 0x101})
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000280)='./sys\x00', &(0x7f00000002c0)='sysfs\x00', 0x0, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/net/tun0/queues/rx-0/rps_cpus\x00', 0x2, 0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000340)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd=r5, 0x0, &(0x7f00000003c0)=""/16, 0x10, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000400)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd=r5, 0x0, &(0x7f0000000480)=""/16, 0x10, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
syz_io_uring_submit(r1, r2, r3, &(0x7f00000004c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd=r5, 0x0, &(0x7f0000000540)=""/16, 0x10, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000580)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd=r5, 0x0, &(0x7f0000000600)=""/16, 0x10, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000640)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd=r5, 0x0, &(0x7f00000006c0)=""/16, 0x10, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000700)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd=r5, 0x0, &(0x7f0000000780)=""/16, 0x10, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
io_uring_enter(r0, 0x6, 0x0, 0x0, 0x0, 0x0)
ioctl$TUNSETQUEUE(r4, 0x400454d9, &(0x7f00000007c0)={'\x00', 0x400})
ioctl$TUNSETQUEUE(r4, 0x400454d9, &(0x7f0000000800)={'\x00', 0x200})
ioctl$TUNSETQUEUE(r4, 0x400454d9, &(0x7f0000000840)={'\x00', 0x400})
ioctl$TUNSETQUEUE(r4, 0x400454d9, &(0x7f0000000880)={'\x00', 0x200})
ioctl$TUNSETQUEUE(r4, 0x400454d9, &(0x7f00000008c0)={'\x00', 0x400})
ioctl$TUNSETQUEUE(r4, 0x400454d9, &(0x7f0000000900)={'\x00', 0x200})
executing program 4:
r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
r3 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04)
mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r3, 0x3, 0x11, r2, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000001000)="faf4", 0x2}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0xc1, 0x0, 0xffffffffffffffff}]})
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x38f, 0x0, 0x1}]})
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000100)={0x1, 0x0, [{0x186, 0x0, 0x5300c0}]})
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000140)={0x1, 0x0, [{0xc0010004, 0x0, 0xffffffffffffffff}]})
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000180)={0x1, 0x0, [{0xc0010000, 0x0, 0x5300c0}]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b40401310000000000010902200001010080fa0904000002ff0000000705810200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
nanosleep(&(0x7f00000000c0)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/firmware/dvb-usb-dw3101.fw/loading\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/firmware/dvb-usb-dw3101.fw/data\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='A', 0x1)
write(r0, &(0x7f0000000200)='0', 0x1)
nanosleep(&(0x7f0000000240)={0x1}, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/dlm\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/dlm/cluster\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/dlm/cluster/comms\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/dlm/cluster/comms/1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/dlm/cluster/comms/2\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/dlm/cluster/comms/1/local\x00', 0x2, 0x0)
write(r0, &(0x7f00000002c0)='1\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/dlm/cluster/comms/1/addr\x00', 0x1, 0x0)
write(r1, &(0x7f0000000340)="020052487f00000100"/128, 0x80)
r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/dlm/cluster/comms/2/addr\x00', 0x1, 0x0)
close(r2)
syz_io_uring_setup(0x20, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580))
openat$dlm_control(0xffffffffffffff9c, &(0x7f00000005c0), 0x2, 0x0)
executing program 4:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff406d04000900000102030109021b0001010080fa0904000001ff000000090581010002010000"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x8, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000200)={0x2, 0x1, 0x1})
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000400)=@mmap={0x0, 0x1})
ioctl$VIDIOC_STREAMON(r0, 0x40045612, &(0x7f0000000500)=0x1)
executing program 3:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000580)=[@in={0x2, 0x4e21, @local}], 0x10)
sendmsg$inet_sctp(r0, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000380)='N', 0x1}], 0x1, 0x0, 0x0, 0x804c040}, 0x1)
r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x28)
r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1800}}, &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94)
r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1c, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="180000000600000000000000fcffffff9500000000000000"], &(0x7f0000000180)='GPL\x00', 0x7, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r2, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94)
r4 = fspick(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', 0x0)
r5 = fsmount(r4, 0x0, 0x2)
setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000240)={0x0, 0x80000001, 0x30}, 0xc)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c)
r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r6, 0x0, 0x0)
write$bt_hci(r6, &(0x7f0000000000)=ANY=[@ANYBLOB="01"], 0x9)
r7 = dup(r0)
write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x111, 0x6}}, 0x20)
r8 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000016c0)=@newsa={0x138, 0x10, 0x1, 0xfff7fffe, 0x100, {{@in6=@remote, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@private2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x192, 0x6, 0x0, 0x8251c, 0x2, 0xfffffffffffffff8, 0xe2e237c}, {0x9, 0x0, 0x20000001f, 0xfffffffffffffffe}, {0x2, 0xfffffffc, 0xfff}, 0x70bd2a, 0x3504, 0x2, 0x1}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0)
r9 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c000000120001000000000000000000e000000200000400"/33], 0x3c}}, 0x0)
r10 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000005c0)={0x1b, 0x0, 0x0, 0x8001, 0x0, 0x1, 0x9, '\x00', 0x0, r7, 0x1, 0x3, 0x1}, 0x50)
r11 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000080)={'bond_slave_1\x00', <r12=>0x0})
sendmsg$nl_route(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4c0000001000ffff27bd7000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="15010000000000001c00128009000100766c616e000000000c0002800600", @ANYRES32=r12, @ANYBLOB='\b\x00'], 0x4c}, 0x1, 0x0, 0x0, 0x28815}, 0x8000002)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000980)={0x6, 0x1a, &(0x7f0000000740)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x4}, {{0x18, 0x1, 0x1, 0x0, r10}}, {}, [@cb_func={0x18, 0x8, 0x4, 0x0, 0x4}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7fff}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1602dcc24b511a4a}, {0x85, 0x0, 0x0, 0x18d}}}, &(0x7f0000000840)='GPL\x00', 0x1, 0x0, &(0x7f0000000880), 0x40f00, 0x2a, '\x00', r12, 0x25, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f00000008c0)={0x2, 0x5, 0xcb5, 0x1}, 0x10, 0x0, 0x0, 0x1, &(0x7f0000000900)=[r5], &(0x7f0000000940)=[{0x5, 0x5, 0xe, 0x8}], 0x10, 0xf8}, 0x94)
write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r7, &(0x7f0000000100)={0x4, 0x0, 0xfa00, {0xffffffffffffffff, 0xc068}}, 0x10)
setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000000)={0x7, 0x5404, 0x204, 0x5, 0x4, 0x1, 0x1, 0x80000001}, 0x20)
ioctl$XFS_IOC_PATH_TO_HANDLE(r0, 0xc01c5869, &(0x7f0000000480)={<r13=>r3, &(0x7f00000002c0)='\x00', 0x210042, &(0x7f0000000300)={@_ha_fsid={[0x1000, 0x7520131a]}, {0x72, 0x8, 0x1, 0x7}}, 0x81, &(0x7f00000003c0), &(0x7f0000000440)=0x3})
ioctl$BTRFS_IOC_BALANCE(r13, 0x5000940c, 0x0)
write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r7, &(0x7f0000000040)={0x4, 0x8, 0xfa00, {0xffffffffffffffff, 0x4}}, 0x10)
executing program 2:
syz_usb_connect$uac3(0x3, 0x2c, &(0x7f0000000800)=ANY=[@ANYBLOB="12010002000000408205820540000102030109021a000101c0c310080b000101013061090400000001013000"], 0x0)
nanosleep(&(0x7f0000000000)={0x1}, 0x0)
r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0)
r1 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x1, 0x0)
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000200)={0x1, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000200)={0x2, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000200)={0x3, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000200)={0x4, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000200)={0x5, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r1, 0xc008551a, &(0x7f0000000200)={0x1, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r1, 0xc008551a, &(0x7f0000000200)={0x2, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r1, 0xc008551a, &(0x7f0000000200)={0x3, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r1, 0xc008551a, &(0x7f0000000200)={0x4, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r1, 0xc008551a, &(0x7f0000000200)={0x5, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
executing program 3:
r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0xc, 0x0, 0xfec00000, 0x0, &(0x7f0000000000/0x1000)=nil})
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@code={0xa, 0x1a, {"488b04250000c0fef4"}}], 0x1a})
r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04)
mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 5 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_IRQCHIP-syz_kvm_setup_syzos_vm$x86-ioctl$KVM_SET_USER_MEMORY_REGION-syz_kvm_add_vcpu$x86-ioctl$KVM_GET_VCPU_MMAP_SIZE-mmap$KVM_VCPU-ioctl$KVM_RUN
detailed listing:
executing program 0:
r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0xc, 0x0, 0xfec00000, 0x0, &(0x7f0000000000/0x1000)=nil})
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@code={0xa, 0x1a, {"488b04250000c0fef4"}}], 0x1a})
r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04)
mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$uac3-nanosleep-syz_open_dev$sndctrl-syz_open_dev$sndctrl-ioctl$SNDRV_CTL_IOCTL_TLV_READ-ioctl$SNDRV_CTL_IOCTL_TLV_READ-ioctl$SNDRV_CTL_IOCTL_TLV_READ-ioctl$SNDRV_CTL_IOCTL_TLV_READ-ioctl$SNDRV_CTL_IOCTL_TLV_READ-ioctl$SNDRV_CTL_IOCTL_TLV_READ-ioctl$SNDRV_CTL_IOCTL_TLV_READ-ioctl$SNDRV_CTL_IOCTL_TLV_READ-ioctl$SNDRV_CTL_IOCTL_TLV_READ-ioctl$SNDRV_CTL_IOCTL_TLV_READ
detailed listing:
executing program 0:
syz_usb_connect$uac3(0x3, 0x2c, &(0x7f0000000800)=ANY=[@ANYBLOB="12010002000000408205820540000102030109021a000101c0c310080b000101013061090400000001013000"], 0x0)
nanosleep(&(0x7f0000000000)={0x1}, 0x0)
r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0)
r1 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x1, 0x0)
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000200)={0x1, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000200)={0x2, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000200)={0x3, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000200)={0x4, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000200)={0x5, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r1, 0xc008551a, &(0x7f0000000200)={0x1, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r1, 0xc008551a, &(0x7f0000000200)={0x2, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r1, 0xc008551a, &(0x7f0000000200)={0x3, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r1, 0xc008551a, &(0x7f0000000200)={0x4, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r1, 0xc008551a, &(0x7f0000000200)={0x5, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-syz_open_dev$video-ioctl$VIDIOC_REQBUFS-ioctl$VIDIOC_QBUF-ioctl$VIDIOC_STREAMON
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff406d04000900000102030109021b0001010080fa0904000001ff000000090581010002010000"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x8, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000200)={0x2, 0x1, 0x1})
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000400)=@mmap={0x0, 0x1})
ioctl$VIDIOC_STREAMON(r0, 0x40045612, &(0x7f0000000500)=0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-nanosleep-openat-write-openat-write-write-nanosleep
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b40401310000000000010902200001010080fa0904000002ff0000000705810200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
nanosleep(&(0x7f00000000c0)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/firmware/dvb-usb-dw3101.fw/loading\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/firmware/dvb-usb-dw3101.fw/data\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='A', 0x1)
write(r0, &(0x7f0000000200)='0', 0x1)
nanosleep(&(0x7f0000000240)={0x1}, 0x0)

program crashed: KASAN: slab-out-of-bounds Read in dw210x_op_rw
single: successfully extracted reproducer
found reproducer with 10 syscalls
minimizing guilty program
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-nanosleep-openat-write-openat-write-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b40401310000000000010902200001010080fa0904000002ff0000000705810200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
nanosleep(&(0x7f00000000c0)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/firmware/dvb-usb-dw3101.fw/loading\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/firmware/dvb-usb-dw3101.fw/data\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='A', 0x1)
write(r0, &(0x7f0000000200)='0', 0x1)

program crashed: KASAN: slab-out-of-bounds Read in dw210x_op_rw
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-nanosleep-openat-write-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b40401310000000000010902200001010080fa0904000002ff0000000705810200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
nanosleep(&(0x7f00000000c0)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/firmware/dvb-usb-dw3101.fw/loading\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/firmware/dvb-usb-dw3101.fw/data\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='A', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-nanosleep-openat-write-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b40401310000000000010902200001010080fa0904000002ff0000000705810200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
nanosleep(&(0x7f00000000c0)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/firmware/dvb-usb-dw3101.fw/loading\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1', 0x1)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/firmware/dvb-usb-dw3101.fw/data\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)='0', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-nanosleep-openat-write-write-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b40401310000000000010902200001010080fa0904000002ff0000000705810200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
nanosleep(&(0x7f00000000c0)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/firmware/dvb-usb-dw3101.fw/loading\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1', 0x1)
write(0xffffffffffffffff, &(0x7f00000001c0)='A', 0x1)
write(r0, &(0x7f0000000200)='0', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-nanosleep-openat-openat-write-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b40401310000000000010902200001010080fa0904000002ff0000000705810200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
nanosleep(&(0x7f00000000c0)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/firmware/dvb-usb-dw3101.fw/loading\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/firmware/dvb-usb-dw3101.fw/data\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='A', 0x1)
write(r0, &(0x7f0000000200)='0', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-nanosleep-write-openat-write-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b40401310000000000010902200001010080fa0904000002ff0000000705810200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
nanosleep(&(0x7f00000000c0)={0x1}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000140)='1', 0x1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/firmware/dvb-usb-dw3101.fw/data\x00', 0x2, 0x0)
write(r0, &(0x7f00000001c0)='A', 0x1)
write(0xffffffffffffffff, &(0x7f0000000200)='0', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b40401310000000000010902200001010080fa0904000002ff0000000705810200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/firmware/dvb-usb-dw3101.fw/loading\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/firmware/dvb-usb-dw3101.fw/data\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='A', 0x1)
write(r0, &(0x7f0000000200)='0', 0x1)

program crashed: KASAN: slab-out-of-bounds Read in dw210x_op_rw
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-openat-write-openat-write-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b40401310000000000010902200001010080fa0904000002ff0000000705810200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/firmware/dvb-usb-dw3101.fw/loading\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/firmware/dvb-usb-dw3101.fw/data\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='A', 0x1)
write(r0, &(0x7f0000000200)='0', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mount-openat-write-openat-write-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b40401310000000000010902200001010080fa0904000002ff0000000705810200020007058202000200"], 0x0)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/firmware/dvb-usb-dw3101.fw/loading\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/firmware/dvb-usb-dw3101.fw/data\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='A', 0x1)
write(r0, &(0x7f0000000200)='0', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/firmware/dvb-usb-dw3101.fw/loading\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/firmware/dvb-usb-dw3101.fw/data\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='A', 0x1)
write(r0, &(0x7f0000000200)='0', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/firmware/dvb-usb-dw3101.fw/loading\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/firmware/dvb-usb-dw3101.fw/data\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='A', 0x1)
write(r0, &(0x7f0000000200)='0', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/firmware/dvb-usb-dw3101.fw/loading\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/firmware/dvb-usb-dw3101.fw/data\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='A', 0x1)
write(r0, &(0x7f0000000200)='0', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b40401310000000000010902200001010080fa0904000002ff0000000705810200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ed)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/firmware/dvb-usb-dw3101.fw/loading\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/firmware/dvb-usb-dw3101.fw/data\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='A', 0x1)
write(r0, &(0x7f0000000200)='0', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b40401310000000000010902200001010080fa0904000002ff0000000705810200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, 0x0, &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/firmware/dvb-usb-dw3101.fw/loading\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/firmware/dvb-usb-dw3101.fw/data\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='A', 0x1)
write(r0, &(0x7f0000000200)='0', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b40401310000000000010902200001010080fa0904000002ff0000000705810200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000040)='./sys\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/firmware/dvb-usb-dw3101.fw/loading\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/firmware/dvb-usb-dw3101.fw/data\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='A', 0x1)
write(r0, &(0x7f0000000200)='0', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b40401310000000000010902200001010080fa0904000002ff0000000705810200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
write(r0, &(0x7f0000000140)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/firmware/dvb-usb-dw3101.fw/data\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='A', 0x1)
write(r0, &(0x7f0000000200)='0', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b40401310000000000010902200001010080fa0904000002ff0000000705810200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/firmware/dvb-usb-dw3101.fw/loading\x00', 0x2, 0x0)
write(r0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/firmware/dvb-usb-dw3101.fw/data\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='A', 0x1)
write(r0, &(0x7f0000000200)='0', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b40401310000000000010902200001010080fa0904000002ff0000000705810200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/firmware/dvb-usb-dw3101.fw/loading\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/firmware/dvb-usb-dw3101.fw/data\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='A', 0x1)
write(r0, &(0x7f0000000200)='0', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b40401310000000000010902200001010080fa0904000002ff0000000705810200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/firmware/dvb-usb-dw3101.fw/loading\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1', 0x1)
r1 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
write(r1, &(0x7f00000001c0)='A', 0x1)
write(r0, &(0x7f0000000200)='0', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b40401310000000000010902200001010080fa0904000002ff0000000705810200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/firmware/dvb-usb-dw3101.fw/loading\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/firmware/dvb-usb-dw3101.fw/dat\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='A', 0x1)
write(r0, &(0x7f0000000200)='0', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b40401310000000000010902200001010080fa0904000002ff0000000705810200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/firmware/dvb-usb-dw3101.fw/loading\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/firmware/dvb-usb-dw3101.fw/data\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
write(r0, &(0x7f0000000200)='0', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b40401310000000000010902200001010080fa0904000002ff0000000705810200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/firmware/dvb-usb-dw3101.fw/loading\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/firmware/dvb-usb-dw3101.fw/data\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0), 0x0)
write(r0, &(0x7f0000000200)='0', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b40401310000000000010902200001010080fa0904000002ff0000000705810200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/firmware/dvb-usb-dw3101.fw/loading\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/firmware/dvb-usb-dw3101.fw/data\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='A', 0x1)
write(r0, 0x0, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b40401310000000000010902200001010080fa0904000002ff0000000705810200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/firmware/dvb-usb-dw3101.fw/loading\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/firmware/dvb-usb-dw3101.fw/data\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='A', 0x1)
write(r0, &(0x7f0000000200), 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write-write
program crashed: KASAN: slab-out-of-bounds Read in dw210x_op_rw
simplifying C reproducer
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write-write
program crashed: KASAN: slab-out-of-bounds Read in dw210x_op_rw
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write-write
program crashed: KASAN: slab-out-of-bounds Read in dw210x_op_rw
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write-write
program crashed: KASAN: slab-out-of-bounds Read in dw210x_op_rw
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write-write
program crashed: KASAN: slab-out-of-bounds Read in dw210x_op_rw
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write-write
program crashed: KASAN: slab-out-of-bounds Read in dw210x_op_rw
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write-write
program crashed: KASAN: slab-out-of-bounds Read in dw210x_op_rw
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write-write
program crashed: KASAN: slab-out-of-bounds Read in dw210x_op_rw
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b40401310000000000010902200001010080fa0904000002ff0000000705810200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/firmware/dvb-usb-dw3101.fw/loading\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/firmware/dvb-usb-dw3101.fw/data\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='A', 0x1)
write(r0, &(0x7f0000000200)='0', 0x1)

program crashed: KASAN: slab-out-of-bounds Read in dw210x_op_rw
validation run: crashed=true
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b40401310000000000010902200001010080fa0904000002ff0000000705810200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/firmware/dvb-usb-dw3101.fw/loading\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/firmware/dvb-usb-dw3101.fw/data\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='A', 0x1)
write(r0, &(0x7f0000000200)='0', 0x1)

program did not crash
validation run: crashed=false
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b40401310000000000010902200001010080fa0904000002ff0000000705810200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/firmware/dvb-usb-dw3101.fw/loading\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/firmware/dvb-usb-dw3101.fw/data\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='A', 0x1)
write(r0, &(0x7f0000000200)='0', 0x1)

program crashed: KASAN: slab-out-of-bounds Read in dw210x_op_rw
validation run: crashed=true
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b40401310000000000010902200001010080fa0904000002ff0000000705810200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/firmware/dvb-usb-dw3101.fw/loading\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/firmware/dvb-usb-dw3101.fw/data\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='A', 0x1)
write(r0, &(0x7f0000000200)='0', 0x1)

program crashed: KASAN: slab-out-of-bounds Read in dw210x_op_rw
validation run: crashed=true
reproducing took 1h49m27.068163097s
repro crashed as (corrupted=false):
dvb-usb: found a 'DVBWorld DVB-C 3101 USB2.0' in cold state, will try to load a firmware
usb 1-1: Direct firmware load for dvb-usb-dw3101.fw failed with error -2
usb 1-1: Falling back to sysfs fallback for: dvb-usb-dw3101.fw
dvb-usb: [  106.713374][ T5694] dvb-usb: downloading firmware from file 'dvb-usb-dw3101.fw'
dw2102: start downloading DW210X firmware
==================================================================
BUG: KASAN: slab-out-of-bounds in dw210x_op_rw+0xb6/0x180 drivers/media/usb/dvb-usb/dw2102.c:102
Read of size 64 at addr ffff88802277dd60 by task kworker/0:5/5694

CPU: 0 UID: 0 PID: 5694 Comm: kworker/0:5 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200
 __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105
 dw210x_op_rw+0xb6/0x180 drivers/media/usb/dvb-usb/dw2102.c:102
 dw2102_load_firmware+0x2b4/0x970 drivers/media/usb/dvb-usb/dw2102.c:1906
 dvb_usb_download_firmware+0x1c3/0x270 drivers/media/usb/dvb-usb/dvb-usb-firmware.c:109
 dvb_usb_device_init+0xddf/0x2570 drivers/media/usb/dvb-usb/dvb-usb-init.c:298
 dw2102_probe+0x8a/0x270 drivers/media/usb/dvb-usb/dw2102.c:2594
 usb_probe_interface+0x653/0xc60 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c7/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3772
 usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268
 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c7/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3772
 usb_new_device+0x98d/0x1610 drivers/usb/core/hub.c:2695
 hub_port_connect drivers/usb/core/hub.c:5567 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
 port_event drivers/usb/core/hub.c:5871 [inline]
 hub_event+0x28cf/0x4cf0 drivers/usb/core/hub.c:5953
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 5694:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5334 [inline]
 __kmalloc_noprof+0x41a/0x780 mm/slub.c:5359
 _kmalloc_noprof include/linux/slab.h:992 [inline]
 dw2102_load_firmware+0x175/0x970 drivers/media/usb/dvb-usb/dw2102.c:1896
 dvb_usb_download_firmware+0x1c3/0x270 drivers/media/usb/dvb-usb/dvb-usb-firmware.c:109
 dvb_usb_device_init+0xddf/0x2570 drivers/media/usb/dvb-usb/dvb-usb-init.c:298
 dw2102_probe+0x8a/0x270 drivers/media/usb/dvb-usb/dw2102.c:2594
 usb_probe_interface+0x653/0xc60 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c7/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3772
 usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268
 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c7/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3772
 usb_new_device+0x98d/0x1610 drivers/usb/core/hub.c:2695
 hub_port_connect drivers/usb/core/hub.c:5567 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
 port_event drivers/usb/core/hub.c:5871 [inline]
 hub_event+0x28cf/0x4cf0 drivers/usb/core/hub.c:5953
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

The buggy address belongs to the object at ffff88802277dd60
 which belongs to the cache kmalloc-8 of size 8
The buggy address is located 0 bytes inside of
 allocated 1-byte region [ffff88802277dd60, ffff88802277dd61)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2277d
flags: 0x80000000000000(node=0|zone=1)
page_type: f5(slab)
raw: 0080000000000000 ffff88813ffb2500 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800800080 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 33, tgid 33 (kdevtmpfs), ts 5083390907, free_ts 5080528530
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
 prep_new_page mm/page_alloc.c:1867 [inline]
 get_page_from_freelist+0x262a/0x26a0 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
 alloc_slab_page mm/slub.c:3266 [inline]
 allocate_slab+0x79/0x5e0 mm/slub.c:3380
 new_slab mm/slub.c:3426 [inline]
 refill_objects+0x2d8/0x350 mm/slub.c:7310
 refill_sheaf mm/slub.c:2804 [inline]
 __pcs_replace_empty_main+0x330/0x690 mm/slub.c:4675
 alloc_from_pcs mm/slub.c:4773 [inline]
 slab_alloc_node mm/slub.c:4905 [inline]
 __do_kmalloc_node mm/slub.c:5333 [inline]
 __kmalloc_node_track_caller_noprof+0x62d/0x7c0 mm/slub.c:5471
 kmemdup_noprof+0x2b/0x70 mm/util.c:138
 kmemdup_noprof include/linux/fortify-string.h:715 [inline]
 xattr_dupval security/smack/smack_lsm.c:992 [inline]
 smack_inode_init_security+0x459/0x600 security/smack/smack_lsm.c:1070
 security_inode_init_security+0x208/0x3e0 security/security.c:1354
 shmem_mknod+0x1ea/0x340 mm/shmem.c:3814
 vfs_mknod+0x443/0x610 fs/namei.c:5135
 handle_create drivers/base/devtmpfs.c:232 [inline]
 handle drivers/base/devtmpfs.c:384 [inline]
 devtmpfs_work_loop+0x861/0xdf0 drivers/base/devtmpfs.c:399
 devtmpfsd+0x4d/0x50 drivers/base/devtmpfs.c:441
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
page last free pid 177 tgid 177 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1406 [inline]
 __free_frozen_pages+0x10e7/0x11c0 mm/page_alloc.c:2950
 __kasan_populate_vmalloc_do mm/kasan/shadow.c:393 [inline]
 __kasan_populate_vmalloc+0x1a8/0x1c0 mm/kasan/shadow.c:424
 kasan_populate_vmalloc include/linux/kasan.h:580 [inline]
 alloc_vmap_area+0xd1a/0x1420 mm/vmalloc.c:2123
 __get_vm_area_node+0x1f2/0x300 mm/vmalloc.c:3226
 __vmalloc_node_range_noprof+0x358/0x1730 mm/vmalloc.c:4042
 __vmalloc_node_noprof+0xc2/0x100 mm/vmalloc.c:4143
 alloc_thread_stack_node kernel/fork.c:359 [inline]
 dup_task_struct+0x2a0/0x8f0 kernel/fork.c:929
 copy_process+0x820/0x4390 kernel/fork.c:2115
 kernel_clone+0x2d2/0x8d0 kernel/fork.c:2748
 user_mode_thread+0x110/0x180 kernel/fork.c:2824
 call_usermodehelper_exec_work+0x5c/0x230 kernel/umh.c:171
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Memory state around the buggy address:
 ffff88802277dc00: 06 fc fc fc fa fc fc fc 06 fc fc fc 06 fc fc fc
 ffff88802277dc80: 06 fc fc fc 06 fc fc fc fa fc fc fc 06 fc fc fc
>ffff88802277dd00: 06 fc fc fc 06 fc fc fc 06 fc fc fc 01 fc fc fc
                                                       ^
 ffff88802277dd80: 06 fc fc fc 06 fc fc fc 06 fc fc fc 06 fc fc fc
 ffff88802277de00: fa fc fc fc 06 fc fc fc 06 fc fc fc 06 fc fc fc
==================================================================

final repro crashed as (corrupted=false):
dvb-usb: found a 'DVBWorld DVB-C 3101 USB2.0' in cold state, will try to load a firmware
usb 1-1: Direct firmware load for dvb-usb-dw3101.fw failed with error -2
usb 1-1: Falling back to sysfs fallback for: dvb-usb-dw3101.fw
dvb-usb: [  106.713374][ T5694] dvb-usb: downloading firmware from file 'dvb-usb-dw3101.fw'
dw2102: start downloading DW210X firmware
==================================================================
BUG: KASAN: slab-out-of-bounds in dw210x_op_rw+0xb6/0x180 drivers/media/usb/dvb-usb/dw2102.c:102
Read of size 64 at addr ffff88802277dd60 by task kworker/0:5/5694

CPU: 0 UID: 0 PID: 5694 Comm: kworker/0:5 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200
 __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105
 dw210x_op_rw+0xb6/0x180 drivers/media/usb/dvb-usb/dw2102.c:102
 dw2102_load_firmware+0x2b4/0x970 drivers/media/usb/dvb-usb/dw2102.c:1906
 dvb_usb_download_firmware+0x1c3/0x270 drivers/media/usb/dvb-usb/dvb-usb-firmware.c:109
 dvb_usb_device_init+0xddf/0x2570 drivers/media/usb/dvb-usb/dvb-usb-init.c:298
 dw2102_probe+0x8a/0x270 drivers/media/usb/dvb-usb/dw2102.c:2594
 usb_probe_interface+0x653/0xc60 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c7/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3772
 usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268
 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c7/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3772
 usb_new_device+0x98d/0x1610 drivers/usb/core/hub.c:2695
 hub_port_connect drivers/usb/core/hub.c:5567 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
 port_event drivers/usb/core/hub.c:5871 [inline]
 hub_event+0x28cf/0x4cf0 drivers/usb/core/hub.c:5953
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 5694:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5334 [inline]
 __kmalloc_noprof+0x41a/0x780 mm/slub.c:5359
 _kmalloc_noprof include/linux/slab.h:992 [inline]
 dw2102_load_firmware+0x175/0x970 drivers/media/usb/dvb-usb/dw2102.c:1896
 dvb_usb_download_firmware+0x1c3/0x270 drivers/media/usb/dvb-usb/dvb-usb-firmware.c:109
 dvb_usb_device_init+0xddf/0x2570 drivers/media/usb/dvb-usb/dvb-usb-init.c:298
 dw2102_probe+0x8a/0x270 drivers/media/usb/dvb-usb/dw2102.c:2594
 usb_probe_interface+0x653/0xc60 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c7/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3772
 usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268
 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c7/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3772
 usb_new_device+0x98d/0x1610 drivers/usb/core/hub.c:2695
 hub_port_connect drivers/usb/core/hub.c:5567 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
 port_event drivers/usb/core/hub.c:5871 [inline]
 hub_event+0x28cf/0x4cf0 drivers/usb/core/hub.c:5953
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

The buggy address belongs to the object at ffff88802277dd60
 which belongs to the cache kmalloc-8 of size 8
The buggy address is located 0 bytes inside of
 allocated 1-byte region [ffff88802277dd60, ffff88802277dd61)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2277d
flags: 0x80000000000000(node=0|zone=1)
page_type: f5(slab)
raw: 0080000000000000 ffff88813ffb2500 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800800080 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 33, tgid 33 (kdevtmpfs), ts 5083390907, free_ts 5080528530
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
 prep_new_page mm/page_alloc.c:1867 [inline]
 get_page_from_freelist+0x262a/0x26a0 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
 alloc_slab_page mm/slub.c:3266 [inline]
 allocate_slab+0x79/0x5e0 mm/slub.c:3380
 new_slab mm/slub.c:3426 [inline]
 refill_objects+0x2d8/0x350 mm/slub.c:7310
 refill_sheaf mm/slub.c:2804 [inline]
 __pcs_replace_empty_main+0x330/0x690 mm/slub.c:4675
 alloc_from_pcs mm/slub.c:4773 [inline]
 slab_alloc_node mm/slub.c:4905 [inline]
 __do_kmalloc_node mm/slub.c:5333 [inline]
 __kmalloc_node_track_caller_noprof+0x62d/0x7c0 mm/slub.c:5471
 kmemdup_noprof+0x2b/0x70 mm/util.c:138
 kmemdup_noprof include/linux/fortify-string.h:715 [inline]
 xattr_dupval security/smack/smack_lsm.c:992 [inline]
 smack_inode_init_security+0x459/0x600 security/smack/smack_lsm.c:1070
 security_inode_init_security+0x208/0x3e0 security/security.c:1354
 shmem_mknod+0x1ea/0x340 mm/shmem.c:3814
 vfs_mknod+0x443/0x610 fs/namei.c:5135
 handle_create drivers/base/devtmpfs.c:232 [inline]
 handle drivers/base/devtmpfs.c:384 [inline]
 devtmpfs_work_loop+0x861/0xdf0 drivers/base/devtmpfs.c:399
 devtmpfsd+0x4d/0x50 drivers/base/devtmpfs.c:441
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
page last free pid 177 tgid 177 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1406 [inline]
 __free_frozen_pages+0x10e7/0x11c0 mm/page_alloc.c:2950
 __kasan_populate_vmalloc_do mm/kasan/shadow.c:393 [inline]
 __kasan_populate_vmalloc+0x1a8/0x1c0 mm/kasan/shadow.c:424
 kasan_populate_vmalloc include/linux/kasan.h:580 [inline]
 alloc_vmap_area+0xd1a/0x1420 mm/vmalloc.c:2123
 __get_vm_area_node+0x1f2/0x300 mm/vmalloc.c:3226
 __vmalloc_node_range_noprof+0x358/0x1730 mm/vmalloc.c:4042
 __vmalloc_node_noprof+0xc2/0x100 mm/vmalloc.c:4143
 alloc_thread_stack_node kernel/fork.c:359 [inline]
 dup_task_struct+0x2a0/0x8f0 kernel/fork.c:929
 copy_process+0x820/0x4390 kernel/fork.c:2115
 kernel_clone+0x2d2/0x8d0 kernel/fork.c:2748
 user_mode_thread+0x110/0x180 kernel/fork.c:2824
 call_usermodehelper_exec_work+0x5c/0x230 kernel/umh.c:171
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Memory state around the buggy address:
 ffff88802277dc00: 06 fc fc fc fa fc fc fc 06 fc fc fc 06 fc fc fc
 ffff88802277dc80: 06 fc fc fc 06 fc fc fc fa fc fc fc 06 fc fc fc
>ffff88802277dd00: 06 fc fc fc 06 fc fc fc 06 fc fc fc 01 fc fc fc
                                                       ^
 ffff88802277dd80: 06 fc fc fc 06 fc fc fc 06 fc fc fc 06 fc fc fc
 ffff88802277de00: fa fc fc fc 06 fc fc fc 06 fc fc fc 06 fc fc fc
==================================================================