Extracting prog: 1m58.218323052s
Minimizing prog: 7m37.466096193s
Simplifying prog options: 0s
Extracting C: 48.382149051s
Simplifying C: 12m45.432132667s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000101c1b021b00000000000109022400010000400009040000010300400009210000000122050009058103"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, &(0x7f0000000300)={0x2c, &(0x7f0000000080)={0x40, 0x31, 0x26, {0x26, 0xa, "12995da4dcffe78094ffa9d7cc1cb3a644021bf45c9116715431e440aacc995b0fc4deff"}}, 0x0, 0x0, 0x0, 0x0}, 0x0)

program crashed: WARNING: ODEBUG bug in corsair_remove
single: successfully extracted reproducer
found reproducer with 3 syscalls
minimizing guilty program
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000101c1b021b00000000000109022400010000400009040000010300400009210000000122050009058103"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000101c1b021b00000000000109022400010000400009040000010300400009210000000122050009058103"], 0x0)
syz_usb_control_io(r0, &(0x7f0000000300)={0x2c, &(0x7f0000000080)={0x40, 0x31, 0x26, {0x26, 0xa, "12995da4dcffe78094ffa9d7cc1cb3a644021bf45c9116715431e440aacc995b0fc4deff"}}, 0x0, 0x0, 0x0, 0x0}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_control_io$hid-syz_usb_control_io
detailed listing:
executing program 0:
syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000300)={0x2c, &(0x7f0000000080)={0x40, 0x31, 0x26, {0x26, 0xa, "12995da4dcffe78094ffa9d7cc1cb3a644021bf45c9116715431e440aacc995b0fc4deff"}}, 0x0, 0x0, 0x0, 0x0}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, &(0x7f0000000300)={0x2c, &(0x7f0000000080)={0x40, 0x31, 0x26, {0x26, 0xa, "12995da4dcffe78094ffa9d7cc1cb3a644021bf45c9116715431e440aacc995b0fc4deff"}}, 0x0, 0x0, 0x0, 0x0}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, &(0x7f0000000300)={0x2c, &(0x7f0000000080)={0x40, 0x31, 0x26, {0x26, 0xa, "12995da4dcffe78094ffa9d7cc1cb3a644021bf45c9116715431e440aacc995b0fc4deff"}}, 0x0, 0x0, 0x0, 0x0}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000101c1b021b00000000000109022400010000400009040000010300400009210000000122050009058103"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000101c1b021b00000000000109022400010000400009040000010300400009210000000122050009058103"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000101c1b021b00000000000109022400010000400009040000010300400009210000000122050009058103"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, &(0x7f0000000300)={0x2c, &(0x7f0000000080)={0x40, 0x31, 0x2, {0x2, 0xa}}, 0x0, 0x0, 0x0, 0x0}, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io
program crashed: WARNING: ODEBUG bug in corsair_remove
simplifying C reproducer
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io
program crashed: WARNING: ODEBUG bug in corsair_remove
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io
program crashed: WARNING: ODEBUG bug in corsair_remove
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io
program did not crash
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io
program crashed: WARNING: ODEBUG bug in corsair_remove
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io
program crashed: WARNING: ODEBUG bug in corsair_remove
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io
program crashed: WARNING: ODEBUG bug in corsair_remove
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io
program did not crash
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io
program crashed: WARNING: ODEBUG bug in corsair_remove
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io
program crashed: WARNING: ODEBUG bug in corrupted
a never seen crash title: WARNING: ODEBUG bug in corrupted, ignore
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io
program did not crash
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io
program crashed: WARNING: ODEBUG bug in corsair_remove
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io
program crashed: WARNING: ODEBUG bug in corsair_remove
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io
program crashed: WARNING: ODEBUG bug in corsair_remove
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io
program crashed: WARNING: ODEBUG bug in corsair_remove
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io
program did not crash
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000101c1b021b00000000000109022400010000400009040000010300400009210000000122050009058103"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, &(0x7f0000000300)={0x2c, &(0x7f0000000080)={0x40, 0x31, 0x26, {0x26, 0xa, "12995da4dcffe78094ffa9d7cc1cb3a644021bf45c9116715431e440aacc995b0fc4deff"}}, 0x0, 0x0, 0x0, 0x0}, 0x0)

program crashed: WARNING: ODEBUG bug in corsair_remove
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000101c1b021b00000000000109022400010000400009040000010300400009210000000122050009058103"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, &(0x7f0000000300)={0x2c, &(0x7f0000000080)={0x40, 0x31, 0x26, {0x26, 0xa, "12995da4dcffe78094ffa9d7cc1cb3a644021bf45c9116715431e440aacc995b0fc4deff"}}, 0x0, 0x0, 0x0, 0x0}, 0x0)

program crashed: WARNING: ODEBUG bug in corsair_remove
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000101c1b021b00000000000109022400010000400009040000010300400009210000000122050009058103"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, &(0x7f0000000300)={0x2c, &(0x7f0000000080)={0x40, 0x31, 0x26, {0x26, 0xa, "12995da4dcffe78094ffa9d7cc1cb3a644021bf45c9116715431e440aacc995b0fc4deff"}}, 0x0, 0x0, 0x0, 0x0}, 0x0)

program crashed: WARNING: ODEBUG bug in corsair_remove
validation run: crashed=true
reproducing took 25m34.450177504s
repro crashed as (corrupted=false):
usb 1-1: USB disconnect, device number 2
------------[ cut here ]------------
ODEBUG: free active (active state 0) object: 0000000002124814 object type: work_struct hint: k90_record_led_work+0x0/0x1d8 drivers/hid/hid-corsair.c:-1
WARNING: lib/debugobjects.c:632 at debug_print_object+0x160/0x1dc lib/debugobjects.c:629, CPU#0: kworker/0:1/10
Modules linked in:
CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Workqueue: usb_hub_wq hub_event
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : debug_print_object+0x160/0x1dc lib/debugobjects.c:629
lr : debug_print_object+0x160/0x1dc lib/debugobjects.c:629
sp : ffff80008ebd7070
x29: ffff80008ebd7070 x28: ffff0000c002ee00 x27: 1fffe000196902af
x26: ffff0000ce3f1400 x25: dfff800000000000 x24: ffff0000ce3f12c8
x23: ffff800086c8e9a0 x22: ffff8000846b8290 x21: ffff800086918860
x20: 0000000000000000 x19: ffff800086c8e4a0 x18: 00000000ffffffff
x17: 626f203431383432 x16: 3132303030303030 x15: 303030203a746365
x14: 000000000000087f x13: 0000000000000001 x12: 0000000000000003
x11: 0000000000000000 x10: 0000000000000002 x9 : e5baf3d5c1ad0d00
x8 : e5baf3d5c1ad0d00 x7 : ffff800080482944 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f3620
x2 : 0000000100000000 x1 : ffff0000c19fbb00 x0 : 0000000000000000
Call trace:
 debug_print_object+0x160/0x1dc lib/debugobjects.c:629 (P)
 __debug_check_no_obj_freed lib/debugobjects.c:1171 [inline]
 debug_check_no_obj_freed+0x22c/0x3a4 lib/debugobjects.c:1201
 slab_free_hook mm/slub.c:2679 [inline]
 slab_free mm/slub.c:6509 [inline]
 kfree+0x124/0x658 mm/slub.c:6802
 k90_cleanup_macro_functions drivers/hid/hid-corsair.c:547 [inline]
 corsair_remove+0xd8/0x214 drivers/hid/hid-corsair.c:602
 hid_device_remove+0xa0/0x170 drivers/hid/hid-core.c:2897
 device_remove+0xc4/0x134 drivers/base/dd.c:616
 __device_release_driver drivers/base/dd.c:1349 [inline]
 device_release_driver_internal+0x124/0x20c drivers/base/dd.c:1372
 device_release_driver+0x28/0x38 drivers/base/dd.c:1395
 bus_remove_device+0x2d0/0x400 drivers/base/bus.c:664
 device_del+0x3ec/0x71c drivers/base/core.c:3965
 hid_remove_device drivers/hid/hid-core.c:3126 [inline]
 hid_destroy_device+0x70/0x1a4 drivers/hid/hid-core.c:3148
 usbhid_disconnect+0xa0/0xe4 drivers/hid/usbhid/hid-core.c:1479
 usb_unbind_interface+0x180/0x6d4 drivers/usb/core/driver.c:461
 device_remove+0x114/0x134 drivers/base/dd.c:618
 __device_release_driver drivers/base/dd.c:1349 [inline]
 device_release_driver_internal+0x124/0x20c drivers/base/dd.c:1372
 device_release_driver+0x28/0x38 drivers/base/dd.c:1395
 bus_remove_device+0x2d0/0x400 drivers/base/bus.c:664
 device_del+0x3ec/0x71c drivers/base/core.c:3965
 usb_disable_device+0x24c/0x670 drivers/usb/core/message.c:1484
 usb_disconnect+0x230/0x6f8 drivers/usb/core/hub.c:2355
 hub_port_connect drivers/usb/core/hub.c:5425 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5725 [inline]
 port_event drivers/usb/core/hub.c:5889 [inline]
 hub_event+0x299c/0x39fc drivers/usb/core/hub.c:5971
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3479
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3560
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
irq event stamp: 46986
hardirqs last  enabled at (46985): [<ffff800080485edc>] vprintk_store+0x924/0xb94 kernel/printk/printk.c:2385
hardirqs last disabled at (46986): [<ffff80008686b974>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:483
softirqs last  enabled at (46912): [<ffff800084bbfa6c>] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:698
softirqs last disabled at (46910): [<ffff800084bbfa54>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (46910): [<ffff800084bbfa54>] __alloc_skb+0x1a8/0x610 net/core/skbuff.c:697
---[ end trace 0000000000000000 ]---

final repro crashed as (corrupted=false):
usb 1-1: USB disconnect, device number 2
------------[ cut here ]------------
ODEBUG: free active (active state 0) object: 0000000002124814 object type: work_struct hint: k90_record_led_work+0x0/0x1d8 drivers/hid/hid-corsair.c:-1
WARNING: lib/debugobjects.c:632 at debug_print_object+0x160/0x1dc lib/debugobjects.c:629, CPU#0: kworker/0:1/10
Modules linked in:
CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Workqueue: usb_hub_wq hub_event
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : debug_print_object+0x160/0x1dc lib/debugobjects.c:629
lr : debug_print_object+0x160/0x1dc lib/debugobjects.c:629
sp : ffff80008ebd7070
x29: ffff80008ebd7070 x28: ffff0000c002ee00 x27: 1fffe000196902af
x26: ffff0000ce3f1400 x25: dfff800000000000 x24: ffff0000ce3f12c8
x23: ffff800086c8e9a0 x22: ffff8000846b8290 x21: ffff800086918860
x20: 0000000000000000 x19: ffff800086c8e4a0 x18: 00000000ffffffff
x17: 626f203431383432 x16: 3132303030303030 x15: 303030203a746365
x14: 000000000000087f x13: 0000000000000001 x12: 0000000000000003
x11: 0000000000000000 x10: 0000000000000002 x9 : e5baf3d5c1ad0d00
x8 : e5baf3d5c1ad0d00 x7 : ffff800080482944 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f3620
x2 : 0000000100000000 x1 : ffff0000c19fbb00 x0 : 0000000000000000
Call trace:
 debug_print_object+0x160/0x1dc lib/debugobjects.c:629 (P)
 __debug_check_no_obj_freed lib/debugobjects.c:1171 [inline]
 debug_check_no_obj_freed+0x22c/0x3a4 lib/debugobjects.c:1201
 slab_free_hook mm/slub.c:2679 [inline]
 slab_free mm/slub.c:6509 [inline]
 kfree+0x124/0x658 mm/slub.c:6802
 k90_cleanup_macro_functions drivers/hid/hid-corsair.c:547 [inline]
 corsair_remove+0xd8/0x214 drivers/hid/hid-corsair.c:602
 hid_device_remove+0xa0/0x170 drivers/hid/hid-core.c:2897
 device_remove+0xc4/0x134 drivers/base/dd.c:616
 __device_release_driver drivers/base/dd.c:1349 [inline]
 device_release_driver_internal+0x124/0x20c drivers/base/dd.c:1372
 device_release_driver+0x28/0x38 drivers/base/dd.c:1395
 bus_remove_device+0x2d0/0x400 drivers/base/bus.c:664
 device_del+0x3ec/0x71c drivers/base/core.c:3965
 hid_remove_device drivers/hid/hid-core.c:3126 [inline]
 hid_destroy_device+0x70/0x1a4 drivers/hid/hid-core.c:3148
 usbhid_disconnect+0xa0/0xe4 drivers/hid/usbhid/hid-core.c:1479
 usb_unbind_interface+0x180/0x6d4 drivers/usb/core/driver.c:461
 device_remove+0x114/0x134 drivers/base/dd.c:618
 __device_release_driver drivers/base/dd.c:1349 [inline]
 device_release_driver_internal+0x124/0x20c drivers/base/dd.c:1372
 device_release_driver+0x28/0x38 drivers/base/dd.c:1395
 bus_remove_device+0x2d0/0x400 drivers/base/bus.c:664
 device_del+0x3ec/0x71c drivers/base/core.c:3965
 usb_disable_device+0x24c/0x670 drivers/usb/core/message.c:1484
 usb_disconnect+0x230/0x6f8 drivers/usb/core/hub.c:2355
 hub_port_connect drivers/usb/core/hub.c:5425 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5725 [inline]
 port_event drivers/usb/core/hub.c:5889 [inline]
 hub_event+0x299c/0x39fc drivers/usb/core/hub.c:5971
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3479
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3560
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
irq event stamp: 46986
hardirqs last  enabled at (46985): [<ffff800080485edc>] vprintk_store+0x924/0xb94 kernel/printk/printk.c:2385
hardirqs last disabled at (46986): [<ffff80008686b974>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:483
softirqs last  enabled at (46912): [<ffff800084bbfa6c>] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:698
softirqs last disabled at (46910): [<ffff800084bbfa54>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (46910): [<ffff800084bbfa54>] __alloc_skb+0x1a8/0x610 net/core/skbuff.c:697
---[ end trace 0000000000000000 ]---