Extracting prog: 59.76298242s
Minimizing prog: 11m9.779136166s
Simplifying prog options: 1m38.407568613s
Extracting C: 30.967198682s
Simplifying C: 0s
extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect-syz_usb_connect$uac1
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)
syz_usb_connect$uac1(0x0, 0xf0, 0x0, 0x0)
program crashed: KASAN: slab-out-of-bounds Write in gb_operation_message_alloc
single: successfully extracted reproducer
found reproducer with 8 syscalls
minimizing guilty program
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)
program crashed: KASAN: slab-out-of-bounds Write in gb_operation_message_alloc
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(0xffffffffffffffff, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(0xffffffffffffffff, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64], 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b")
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, 0x0, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, 0x0)
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x0, 0x0) (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x0, &(0x7f0000000040)) (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, 0x0, 0x0)
program did not crash
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
program did not crash
simplifying guilty program options
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)
program crashed: KASAN: slab-out-of-bounds Write in gb_operation_message_alloc
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
program did not crash
testing program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)
program crashed: KASAN: slab-out-of-bounds Write in gb_operation_message_alloc
validation run: crashed=true
testing program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)
program crashed: KASAN: slab-out-of-bounds Write in gb_operation_message_alloc
validation run: crashed=true
testing program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)
program did not crash
validation run: crashed=false
testing program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)
program crashed: KASAN: slab-out-of-bounds Write in gb_operation_message_alloc
validation run: crashed=true
reproducing took 16m57.288401457s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-out-of-bounds in gb_operation_message_init drivers/greybus/operation.c:341 [inline]
BUG: KASAN: slab-out-of-bounds in gb_operation_message_alloc+0x26e/0x2c0 drivers/greybus/operation.c:385
Write of size 2 at addr ffff888021751a82 by task swapper/1/0
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x13d/0x4b0 mm/kasan/report.c:482
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
gb_operation_message_init drivers/greybus/operation.c:341 [inline]
gb_operation_message_alloc+0x26e/0x2c0 drivers/greybus/operation.c:385
gb_operation_create_common+0x9f/0x710 drivers/greybus/operation.c:532
gb_operation_create_incoming drivers/greybus/operation.c:644 [inline]
gb_connection_recv_request drivers/greybus/operation.c:926 [inline]
gb_connection_recv+0x1dc/0x1050 drivers/greybus/operation.c:1063
greybus_data_rcvd+0x244/0x600 drivers/greybus/connection.c:89
cport_in_callback+0x1fb/0x280 drivers/greybus/es2.c:840
__usb_hcd_giveback_urb+0x38e/0x610 drivers/usb/core/hcd.c:1657
usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
dummy_timer+0xdb2/0x3700 drivers/usb/gadget/udc/dummy_hcd.c:2019
__run_hrtimer kernel/time/hrtimer.c:2074 [inline]
__hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2131
hrtimer_run_softirq+0x1ca/0x360 kernel/time/hrtimer.c:2148
handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645
__do_softirq kernel/softirq.c:679 [inline]
invoke_softirq kernel/softirq.c:519 [inline]
__irq_exit_rcu+0x16a/0x210 kernel/softirq.c:758
irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:finish_task_switch.isra.0+0x2ca/0x10d0 kernel/sched/core.c:5377
Code: b6 0a 00 00 41 c7 87 20 0e 00 00 00 00 00 00 0f 1f 44 00 00 49 8d 7f 48 e8 73 8c fc 09 e8 1e 27 3d 00 fb 48 8d bb 10 17 00 00 <48> b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 04 02 84
RSP: 0018:ffffc90000187c38 EFLAGS: 00000202
RAX: 00000000000778fb RBX: ffff88801f69cb00 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffffffff8e38ba9b RDI: ffff88801f69e210
RBP: ffffc90000187c90 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888027812580
R13: 0000000000000000 R14: ffffffff91455e04 R15: ffff88806a53bf00
context_switch kernel/sched/core.c:5529 [inline]
__schedule+0x1261/0x6920 kernel/sched/core.c:7277
schedule_idle+0x54/0x80 kernel/sched/core.c:7395
do_idle+0x365/0x5b0 kernel/sched/idle.c:384
cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:454
start_secondary+0x21d/0x2d0 arch/x86/kernel/smpboot.c:312
common_startup_64+0x13e/0x158
Allocated by task 0:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5414 [inline]
__kmalloc_noprof+0x32f/0x840 mm/slub.c:5439
_kmalloc_noprof include/linux/slab.h:995 [inline]
_kzalloc_noprof include/linux/slab.h:1312 [inline]
gb_operation_message_alloc+0x9b/0x2c0 drivers/greybus/operation.c:380
gb_operation_create_common+0x9f/0x710 drivers/greybus/operation.c:532
gb_operation_create_incoming drivers/greybus/operation.c:644 [inline]
gb_connection_recv_request drivers/greybus/operation.c:926 [inline]
gb_connection_recv+0x1dc/0x1050 drivers/greybus/operation.c:1063
greybus_data_rcvd+0x244/0x600 drivers/greybus/connection.c:89
cport_in_callback+0x1fb/0x280 drivers/greybus/es2.c:840
__usb_hcd_giveback_urb+0x38e/0x610 drivers/usb/core/hcd.c:1657
usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
dummy_timer+0xdb2/0x3700 drivers/usb/gadget/udc/dummy_hcd.c:2019
__run_hrtimer kernel/time/hrtimer.c:2074 [inline]
__hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2131
hrtimer_run_softirq+0x1ca/0x360 kernel/time/hrtimer.c:2148
handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645
__do_softirq kernel/softirq.c:679 [inline]
invoke_softirq kernel/softirq.c:519 [inline]
__irq_exit_rcu+0x16a/0x210 kernel/softirq.c:758
irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
The buggy address belongs to the object at ffff888021751a80
which belongs to the cache kmalloc-8 of size 8
The buggy address is located 2 bytes inside of
allocated 3-byte region [ffff888021751a80, ffff888021751a83)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x21751
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000000 ffff88801c042500 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000800080 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 2964644396
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871
prep_new_page mm/page_alloc.c:1879 [inline]
get_page_from_freelist+0x110d/0x35d0 mm/page_alloc.c:3943
__alloc_frozen_pages_noprof+0x2eb/0x3300 mm/page_alloc.c:5436
alloc_slab_page mm/slub.c:3347 [inline]
allocate_slab mm/slub.c:3462 [inline]
new_slab+0xa9/0x6e0 mm/slub.c:3513
refill_objects+0xe3/0x410 mm/slub.c:7417
refill_sheaf mm/slub.c:2885 [inline]
__pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4774
alloc_from_pcs mm/slub.c:4850 [inline]
slab_alloc_node mm/slub.c:4984 [inline]
__do_kmalloc_node mm/slub.c:5413 [inline]
__kmalloc_noprof+0x67c/0x840 mm/slub.c:5439
_kmalloc_noprof include/linux/slab.h:995 [inline]
_kzalloc_noprof include/linux/slab.h:1312 [inline]
acpi_ns_internalize_name+0x161/0x2e0 drivers/acpi/acpica/nsutils.c:331
acpi_ns_get_node_unlocked+0x18c/0x500 drivers/acpi/acpica/nsutils.c:666
acpi_ns_get_node+0x6c/0xf0 drivers/acpi/acpica/nsutils.c:726
acpi_ns_evaluate+0xb01/0x1670 drivers/acpi/acpica/nseval.c:62
acpi_evaluate_object+0x420/0xe00 drivers/acpi/acpica/nsxfeval.c:354
acpi_run_hpp drivers/pci/pci-acpi.c:726 [inline]
pci_acpi_program_hp_params+0x820/0x1600 drivers/pci/pci-acpi.c:788
pci_configure_device drivers/pci/probe.c:2463 [inline]
pci_device_add+0x890/0x1820 drivers/pci/probe.c:2730
pci_scan_single_device drivers/pci/probe.c:2794 [inline]
pci_scan_single_device+0x1d0/0x240 drivers/pci/probe.c:2780
pci_scan_slot+0x1c9/0x7c0 drivers/pci/probe.c:2877
page_owner free stack trace missing
Memory state around the buggy address:
ffff888021751980: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc
ffff888021751a00: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc
>ffff888021751a80: 03 fc fc fc fa fc fc fc fa fc fc fc 00 fc fc fc
^
ffff888021751b00: 04 fc fc fc 00 fc fc fc 04 fc fc fc 00 fc fc fc
ffff888021751b80: 07 fc fc fc 00 fc fc fc 04 fc fc fc 04 fc fc fc
==================================================================
----------------
Code disassembly (best guess):
0: b6 0a mov $0xa,%dh
2: 00 00 add %al,(%rax)
4: 41 c7 87 20 0e 00 00 movl $0x0,0xe20(%r15)
b: 00 00 00 00
f: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
14: 49 8d 7f 48 lea 0x48(%r15),%rdi
18: e8 73 8c fc 09 call 0x9fc8c90
1d: e8 1e 27 3d 00 call 0x3d2740
22: fb sti
23: 48 8d bb 10 17 00 00 lea 0x1710(%rbx),%rdi
* 2a: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax <-- trapping instruction
31: fc ff df
34: 48 89 fa mov %rdi,%rdx
37: 48 c1 ea 03 shr $0x3,%rdx
3b: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax
3f: 84 .byte 0x84
final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-out-of-bounds in gb_operation_message_init drivers/greybus/operation.c:341 [inline]
BUG: KASAN: slab-out-of-bounds in gb_operation_message_alloc+0x26e/0x2c0 drivers/greybus/operation.c:385
Write of size 2 at addr ffff888021751a82 by task swapper/1/0
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x13d/0x4b0 mm/kasan/report.c:482
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
gb_operation_message_init drivers/greybus/operation.c:341 [inline]
gb_operation_message_alloc+0x26e/0x2c0 drivers/greybus/operation.c:385
gb_operation_create_common+0x9f/0x710 drivers/greybus/operation.c:532
gb_operation_create_incoming drivers/greybus/operation.c:644 [inline]
gb_connection_recv_request drivers/greybus/operation.c:926 [inline]
gb_connection_recv+0x1dc/0x1050 drivers/greybus/operation.c:1063
greybus_data_rcvd+0x244/0x600 drivers/greybus/connection.c:89
cport_in_callback+0x1fb/0x280 drivers/greybus/es2.c:840
__usb_hcd_giveback_urb+0x38e/0x610 drivers/usb/core/hcd.c:1657
usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
dummy_timer+0xdb2/0x3700 drivers/usb/gadget/udc/dummy_hcd.c:2019
__run_hrtimer kernel/time/hrtimer.c:2074 [inline]
__hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2131
hrtimer_run_softirq+0x1ca/0x360 kernel/time/hrtimer.c:2148
handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645
__do_softirq kernel/softirq.c:679 [inline]
invoke_softirq kernel/softirq.c:519 [inline]
__irq_exit_rcu+0x16a/0x210 kernel/softirq.c:758
irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:finish_task_switch.isra.0+0x2ca/0x10d0 kernel/sched/core.c:5377
Code: b6 0a 00 00 41 c7 87 20 0e 00 00 00 00 00 00 0f 1f 44 00 00 49 8d 7f 48 e8 73 8c fc 09 e8 1e 27 3d 00 fb 48 8d bb 10 17 00 00 <48> b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 04 02 84
RSP: 0018:ffffc90000187c38 EFLAGS: 00000202
RAX: 00000000000778fb RBX: ffff88801f69cb00 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffffffff8e38ba9b RDI: ffff88801f69e210
RBP: ffffc90000187c90 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888027812580
R13: 0000000000000000 R14: ffffffff91455e04 R15: ffff88806a53bf00
context_switch kernel/sched/core.c:5529 [inline]
__schedule+0x1261/0x6920 kernel/sched/core.c:7277
schedule_idle+0x54/0x80 kernel/sched/core.c:7395
do_idle+0x365/0x5b0 kernel/sched/idle.c:384
cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:454
start_secondary+0x21d/0x2d0 arch/x86/kernel/smpboot.c:312
common_startup_64+0x13e/0x158
Allocated by task 0:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5414 [inline]
__kmalloc_noprof+0x32f/0x840 mm/slub.c:5439
_kmalloc_noprof include/linux/slab.h:995 [inline]
_kzalloc_noprof include/linux/slab.h:1312 [inline]
gb_operation_message_alloc+0x9b/0x2c0 drivers/greybus/operation.c:380
gb_operation_create_common+0x9f/0x710 drivers/greybus/operation.c:532
gb_operation_create_incoming drivers/greybus/operation.c:644 [inline]
gb_connection_recv_request drivers/greybus/operation.c:926 [inline]
gb_connection_recv+0x1dc/0x1050 drivers/greybus/operation.c:1063
greybus_data_rcvd+0x244/0x600 drivers/greybus/connection.c:89
cport_in_callback+0x1fb/0x280 drivers/greybus/es2.c:840
__usb_hcd_giveback_urb+0x38e/0x610 drivers/usb/core/hcd.c:1657
usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
dummy_timer+0xdb2/0x3700 drivers/usb/gadget/udc/dummy_hcd.c:2019
__run_hrtimer kernel/time/hrtimer.c:2074 [inline]
__hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2131
hrtimer_run_softirq+0x1ca/0x360 kernel/time/hrtimer.c:2148
handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645
__do_softirq kernel/softirq.c:679 [inline]
invoke_softirq kernel/softirq.c:519 [inline]
__irq_exit_rcu+0x16a/0x210 kernel/softirq.c:758
irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
The buggy address belongs to the object at ffff888021751a80
which belongs to the cache kmalloc-8 of size 8
The buggy address is located 2 bytes inside of
allocated 3-byte region [ffff888021751a80, ffff888021751a83)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x21751
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000000 ffff88801c042500 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000800080 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 2964644396
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871
prep_new_page mm/page_alloc.c:1879 [inline]
get_page_from_freelist+0x110d/0x35d0 mm/page_alloc.c:3943
__alloc_frozen_pages_noprof+0x2eb/0x3300 mm/page_alloc.c:5436
alloc_slab_page mm/slub.c:3347 [inline]
allocate_slab mm/slub.c:3462 [inline]
new_slab+0xa9/0x6e0 mm/slub.c:3513
refill_objects+0xe3/0x410 mm/slub.c:7417
refill_sheaf mm/slub.c:2885 [inline]
__pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4774
alloc_from_pcs mm/slub.c:4850 [inline]
slab_alloc_node mm/slub.c:4984 [inline]
__do_kmalloc_node mm/slub.c:5413 [inline]
__kmalloc_noprof+0x67c/0x840 mm/slub.c:5439
_kmalloc_noprof include/linux/slab.h:995 [inline]
_kzalloc_noprof include/linux/slab.h:1312 [inline]
acpi_ns_internalize_name+0x161/0x2e0 drivers/acpi/acpica/nsutils.c:331
acpi_ns_get_node_unlocked+0x18c/0x500 drivers/acpi/acpica/nsutils.c:666
acpi_ns_get_node+0x6c/0xf0 drivers/acpi/acpica/nsutils.c:726
acpi_ns_evaluate+0xb01/0x1670 drivers/acpi/acpica/nseval.c:62
acpi_evaluate_object+0x420/0xe00 drivers/acpi/acpica/nsxfeval.c:354
acpi_run_hpp drivers/pci/pci-acpi.c:726 [inline]
pci_acpi_program_hp_params+0x820/0x1600 drivers/pci/pci-acpi.c:788
pci_configure_device drivers/pci/probe.c:2463 [inline]
pci_device_add+0x890/0x1820 drivers/pci/probe.c:2730
pci_scan_single_device drivers/pci/probe.c:2794 [inline]
pci_scan_single_device+0x1d0/0x240 drivers/pci/probe.c:2780
pci_scan_slot+0x1c9/0x7c0 drivers/pci/probe.c:2877
page_owner free stack trace missing
Memory state around the buggy address:
ffff888021751980: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc
ffff888021751a00: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc
>ffff888021751a80: 03 fc fc fc fa fc fc fc fa fc fc fc 00 fc fc fc
^
ffff888021751b00: 04 fc fc fc 00 fc fc fc 04 fc fc fc 00 fc fc fc
ffff888021751b80: 07 fc fc fc 00 fc fc fc 04 fc fc fc 04 fc fc fc
==================================================================
----------------
Code disassembly (best guess):
0: b6 0a mov $0xa,%dh
2: 00 00 add %al,(%rax)
4: 41 c7 87 20 0e 00 00 movl $0x0,0xe20(%r15)
b: 00 00 00 00
f: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
14: 49 8d 7f 48 lea 0x48(%r15),%rdi
18: e8 73 8c fc 09 call 0x9fc8c90
1d: e8 1e 27 3d 00 call 0x3d2740
22: fb sti
23: 48 8d bb 10 17 00 00 lea 0x1710(%rbx),%rdi
* 2a: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax <-- trapping instruction
31: fc ff df
34: 48 89 fa mov %rdi,%rdx
37: 48 c1 ea 03 shr $0x3,%rdx
3b: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax
3f: 84 .byte 0x84