Extracting prog: 6m51.694458167s
Minimizing prog: 27m11.226171018s
Simplifying prog options: 6m14.76160819s
Extracting C: 1m22.912871028s
Simplifying C: 0s


extracting reproducer from 67 programs
testing a last program of every proc
single: executing 17 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-socket$inet_smc-setsockopt$inet_buf-setsockopt$sock_int-setsockopt$inet_tcp_TCP_REPAIR-bpf$MAP_CREATE-setsockopt$inet_tcp_TCP_REPAIR_QUEUE-syz_usb_connect-connect$inet-sendmmsg-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-syz_ublk_setup_io_uring-symlink-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-sched_setattr-landlock_create_ruleset-landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH-open_tree-fchdir-creat-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-semctl$IPC_SET-semctl$IPC_STAT-sendmsg$NFT_MSG_GETSETELEM-socket$inet-socket$inet6_tcp
detailed listing:
executing program 0:
syz_io_uring_setup(0x10f, &(0x7f0000000140)={0x0, 0xb423, 0x0, 0x5, 0x199}, 0x0, 0x0, 0x0) (async)
r0 = socket$inet_smc(0x2b, 0x1, 0x0)
setsockopt$inet_buf(r0, 0x0, 0x8008000000010, &(0x7f0000005e40)="17000000020001000003d68c5ee17688a2003208020300ecff3f0200000300000a000000009afc5ad9485bbb6a880000d6c8db0000dba67e060180000a0000f10607bdff59100ac45761407a681f009cee4a5acb3da400001fb700674f19b44e09f9315033bf79ac2dff060115003901000000000000ea000000000000000009ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e000"/184, 0xb8) (async)
setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000300)=0x3, 0x4) (async)
setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) (async)
bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0500000003000000e27f00000100000001010000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="050000000000002010006612e2c4508d195c0432c2"], 0x50) (async)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f00000000c0)=0x2, 0x4)
syz_usb_connect(0x2, 0x4a, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000544fb2f00090582eb100000000102000905", @ANYBLOB="fa36"], 0x0)
connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x3a}}, 0x10) (async)
sendmmsg(r0, &(0x7f0000005180)=[{{0x0, 0x0, &(0x7f0000005140)=[{&(0x7f0000003b40)="fd3ad492dd5acdab7d1ccd5394ab06f345c2368e633d363a2c95544ccb45c28fad7043a4f39a335337d73b5d8dd7a814b1a3d6bf2c872d6f2bae6e9ba19ef9588aa44638a492f5213ae118b10b0295a4e0295cecd1c92e993c872e742b92a0c9e28f14442f439ba83b", 0x69}, {&(0x7f0000004140)="8d976e8077a96f90f6ad50eec96a245e278f06f03c513d49abf63f3f6876264a4dccb9e96a861a1d1c8b2d5f50324816632e88f72c4f993b78001b57bffae1c324bf51c0f2fc70e05c6cf9d009cf4ba301946fce2066e652a4066efbc3579220712ba15267758f7245204b92a9815d8aff74c9f9bc25600302edd01c60ef71e53a5a0a9c89d99f21a24ac1b72bde73e8bde9df87b805d25551678e939c973fb2dbe5dcb28c7e098752ddef0b2f927918052c2916fc717d7e9f67b2067aa285916da8a3a98483f88c7a8c530872554f2169921736338cf5fd42d72906d08a7075569fde1f1e2f4d372205baa67a5c2e715a3c71de76f73de0552e0fcb4597227bc6aeb716829f66fc3eafdb9abc75b793c6dc55e56833b9e3d41b0baa13409723fd04c459f2637c98ea239f57a926d19d9eda33ffd5de920646108a282d7fca7b24cf3dc156f652240fa3d01f265d76ea3f9057122860542530642bd94cfb6570751146f2942ef6637b159e6a34d43de10b9220d1da40fbc209807b13d6a3d313f164655151261922f1475a5cd1b52caaa7e26e06ba9755ebb9e54902e69e8c1bfd58d7b023f5b934f828b0399983ae7296c7fbc1afe986d188bace32bb4b17fb3c7dabfa75227c99f1932a4b6aab9a232a54b6d09ada743876d5cbc56cebfb04068c25e8b2a843c353c67f264a0f26fa75f208db59f2c22a91f0b137c247b0c31c6130b7a0ac86a01d8b683c619ae4eec0893e6587c5435a9671021371f8d3456a6ff107883ff3e56a028a375982dc38c1f75d4efd389c212adf45da38c1d8dc9f347e142832cb64cf74aac6af5cf4f50ec5981f516b3a8267ab4b0c6b15f90481ad10cebb98f04ad38153f54370598cff7b018344d177a25aba5407e15b1f8baec47c8b57f45d174d37e0cb451eba37427a5b92a0eb6191220d9f1a57b3795169f8a361022b77b258b3b653d232418db06d26f7160a485d3a672373902ba3209d371a62373e5ccbf1d34c77b319d5177006766820d5267e87c2af8b3bdb90d47e34f040a93afb1783378df6a3e0d3b8ede514deed84fd942be2591cbe89c102e052a59459627a140780fbe1ca3c5fb5ef46782c281e2b2507d092e3dee62b51966432c2e87f51bee7ea797468c1193cd882a525947e3d35bd93095ac1caf733d7a0167b7e4a6fbe26e586bf36673233191112f50b66122092df40f05ed2d7bba4c6dc1abeb86879314345088223a8c0e1d7927901747bc565de2b6735db945691c4d4f3e6c06962c5f911fe2db3f8be65e1c4526aeafba428d85f0e4b0f9adf067f3cb288f3107134f32cc677cd9db9e2c00bccc15750a817838c024e37a3b79ef75fbb250d6ec373d9d15848ce0daeb3be09f4a23200664c6ce7221b872cc67bd657c88e39f817c6e11e8041688538b7ec3aabd7ff25b5fdcd3a73952ffcd111c49637d4a7b9f6bcdb1cf3a06dfb57cadb13547ee03302ced5b3b72ce2389b329a41ee4fa5b81db8321cfc8e780956a54d35cd9c5db8c794b2afe65f63c61fc9fe6b57cdd74290fb3dba536ae8c46d26e07b6f6d407500afd81d4906e62a4f954ac8b3a2910730acfb1ba18a42c09844e22b63df0213ffea3456b7005568132fd2de1bb9f45ae5c7f01585ea1213564dee13d22b82e194420bd349bf068f98f2e4f6ed84354eca19d39f0f6a3f05a9a59f9e8d1ec375771c800098db71d11e66f38ec664b2a124296a78d073a8c4a333a07aa38c9dafc87dc8e0b2b3685abb732f4960e9004a4e9d2c382c41d5bf6f41d668f8b3efca1b2565fb7533bbb9ee305b4e3dd64fb17d69b3200ca6d7bdac3e37bcad421c05f35de04fac1e448d998fe43e4a93daab25d61b4d67d001f9a8a2a90261c376243fdf68bd58d71f4d878b968ddf0798753cff21a853c7331cb305dddc58dccb6b6d73545a79dc2beba5bfcb75d5d1e7557c81aab9e785669c1a950d77f1d2cdb70e013edff987b69457fd76a414e231c0faea64a8bf7919924096d4f77299f6291879d04bd74fe245ebf66369921d9b410879c8ca0ab0f239a9a905d901539756e1a959c3fde242faa96f81b95d45863da7bb618882bb8431b2f6f96c903bdf77060255d2adab07fe55", 0x5e0}], 0x2}}], 0x1, 0x4000001) (async)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]})
syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0xd1ec, 0x0, 0x2, 0x158}, 0x0, &(0x7f0000000280), &(0x7f0000000140)) (async)
symlink(&(0x7f0000000180)='./file1\x00', &(0x7f0000000040)='./file0\x00')
connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) (async)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) (async)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) (async)
r1 = landlock_create_ruleset(&(0x7f00000002c0)={0x7f6e}, 0x18, 0x0)
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r1, 0x1, &(0x7f0000000000)={0x210a}, 0x0) (async)
r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901)
fchdir(r2) (async)
creat(&(0x7f00000000c0)='./file0\x00', 0xdafbe5d6891b6fc) (async)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4040000)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async)
semctl$IPC_SET(0x0, 0x0, 0x1, &(0x7f0000000040)={{0x0, 0x0, 0x0, 0x0, 0x100, 0x4}, 0x0, 0x81, 0x0, 0x0, 0x4, 0x0, 0x848a})
semctl$IPC_STAT(0x0, 0x0, 0x2, &(0x7f0000000140)=""/80)
sendmsg$NFT_MSG_GETSETELEM(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="300000000d0a010800000000000004000a00fffe0900020073797a31000000000900020073797a310000000004"], 0x30}, 0x1, 0x0, 0x0, 0x4044840}, 0x8000) (async)
socket$inet(0xa, 0x801, 0x84)
socket$inet6_tcp(0xa, 0x1, 0x0)

program did not crash
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socketpair$tipc-ioctl$F2FS_IOC_MOVE_RANGE-socket$nl_generic-syz_genetlink_get_family_id$tipc-sendmsg$NFULNL_MSG_CONFIG-syz_usb_connect-sendmsg$TIPC_CMD_SHOW_PORTS-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040))
ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc01cf509, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180), r1)
sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="2400000001040102000000c9fd000000000000000800034000010400050001"], 0x24}, 0x1, 0x0, 0x0, 0x20008000}, 0x0)
syz_usb_connect(0x2, 0x239, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000e388d640697a01006ba8010203010902270201020010000904"], 0x0)
sendmsg$TIPC_CMD_SHOW_PORTS(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r2, 0xe01, 0x70bd2d, 0x25dfdbfc}, 0x1c}}, 0x24048800)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'macvlan0\x00', <r3=>0x0})
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newlink={0x48, 0x10, 0x503, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xe315}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r3}, @IFLA_ADDRESS={0xa, 0x1, @remote}]}, 0x48}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$uac2-syz_open_dev$dri-ioctl$DRM_IOCTL_WAIT_VBLANK-socket$packet-syz_io_uring_setup-socket$inet6_udp-connect$inet6-syz_ublk_setup_io_uring-syz_io_uring_submit-io_uring_enter-socket$inet6_tcp-bind$inet6-listen-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-getpid-set_mempolicy-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-bpf$BPF_GET_PROG_INFO-mmap-socket$inet6_tcp-openat$ptmx-ioctl$TCSETS-openat$nullb-openat$adsp1-syz_open_dev$sndctrl-ioctl$SNDRV_CTL_IOCTL_ELEM_READ-openat$nullb-ioctl$BLKZEROOUT
detailed listing:
executing program 0:
syz_usb_connect$uac2(0x2, 0xa8, &(0x7f0000000280)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x582, 0x4c, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x96, 0x3, 0x1, 0x5, 0x30, 0x9, {0x8, 0xb, 0x0, 0x1, 0x1, 0x7, 0x20, 0x8c}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x4000, 0x4, 0x1d, 0x7}, [@source_unit={0x8, 0x24, 0xa, 0x0, 0x1, 0xff, 0x23}, @output_terminal={0xc, 0x24, 0x3, 0x2, 0x307, 0x0, 0x4, 0x0, 0x7, 0x81}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x3, 0xb, 0x4, {0x8, 0x25, 0x1, 0x0, 0x0, 0x40, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x4, 0x1ccc, 0x5}, @as_header={0x10, 0x24, 0x1, 0x2, 0x1, 0x0, 0x4, 0x8, 0xb8, 0x3}]}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x40, 0x6, 0x3, {0x8, 0x25, 0x1, 0x82, 0x3, 0xf3, 0x6}}}}}}}}]}}, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0})
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0)
ioctl$DRM_IOCTL_WAIT_VBLANK(r0, 0xc018643a, &(0x7f0000000140)={0x1})
socket$packet(0x11, 0x3, 0x300)
r1 = syz_io_uring_setup(0xf00, &(0x7f0000000140)={0x0, 0x8740, 0x10000, 0x1, 0x81}, &(0x7f00000001c0), &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000080)=<r3=>0x0)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$inet6(r4, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @local}, 0xb}, 0x1c)
syz_ublk_setup_io_uring(0xe0a, &(0x7f0000000380)={0x0, 0x9de0, 0x0, 0x3, 0x379, 0x0, r1}, &(0x7f0000000400)=<r5=>0x0, &(0x7f0000000500), &(0x7f0000000540))
syz_io_uring_submit(r5, r2, r3, &(0x7f0000000280)=@IORING_OP_SENDMSG_ZC={0x30, 0x8, 0x28, r4, 0x0, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x835e, 0x20880, 0x0, {0x1}})
io_uring_enter(r1, 0x2000, 0xfffffffa, 0x9, 0x0, 0x0)
r6 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r6, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x58)
listen(r6, 0x5)
r7 = syz_open_dev$loop(&(0x7f00000014c0), 0x4, 0x2)
ioctl$LOOP_CONFIGURE(r7, 0x4c0a, &(0x7f0000001540)={0xffffffffffffffff, 0x9, {0x0, 0x0, 0x0, 0xbb, 0x1b99, 0x0, 0x3, 0x4, 0x13, "b7f8ada941fbfa24b230324b3122fe227031c9fb2622e97099e554942542690fb0219cbefea4d3a5c75b831367cbd848f5a1b04aff3568c826ed63af1057abf6", "e5774ce57e1395c66549c09e1a753713979872f8b081a61f3a2ce683ee7b6ead66b72f1365216f05a2ea09d6cd61fc85ebf757186da4d22874517bf0100dd87b", "8cbcf6468f994f1274302174ba4d9ee37a68f48b1ba174b75fe8178e0debfa0a", [0x80000000, 0xffffffffffffff4e]}})
getpid()
set_mempolicy(0x5, &(0x7f0000000000)=0x2, 0x6)
r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x5, 0x46, 0x43, 0x1, 0x0, 0xffffffffffffffff, 0x3}, 0x50)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000600), &(0x7f0000001600), 0x1, r8}, 0x38)
bpf$BPF_GET_PROG_INFO(0x4, &(0x7f0000000140)={r8, 0xe0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6770c000)
socket$inet6_tcp(0xa, 0x1, 0x0)
r9 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x202, 0x0)
ioctl$TCSETS(r9, 0x40045431, &(0x7f0000000dc0)={0x0, 0x3, 0x1000002, 0x0, 0x1, "d52c2000000102000300ecffffff0100"})
openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0)
openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0301, 0x0)
r10 = syz_open_dev$sndctrl(&(0x7f0000000240), 0x1, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r10, 0xc2c45512, &(0x7f0000000340)={{0x3, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x0, 0xffffffff, 0xffff, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x200080, 0x4000, 0x3, 0x0, 0xfffffffc, 0x0, 0x5, 0x0, 0x0, 0x0, 0x1fb, 0x0, 0xffffffff, 0xfffffffe, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x20, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffdffc7, 0x8, 0xffff, 0x3, 0x401, 0x5, 0x3, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x65, 0x80000001, 0x0, 0x0, 0x5, 0xf1e9, 0x0, 0x0, 0x2147, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x4, 0x0, 0x0, 0x0, 0x1ff, 0xfffffffc, 0x0, 0x0, 0x7, 0x0, 0xffffffff, 0x5, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x800, 0x1, 0x0, 0x0, 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x200040]})
r11 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x40001, 0x0)
ioctl$BLKZEROOUT(r11, 0x127f, &(0x7f0000000240)={0x600, 0x1000000})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-pause-syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io$lan78xx
detailed listing:
executing program 0:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x4, 0x0, 0x7fff0000}]})
pause()
r0 = syz_usb_connect(0x5, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000092ecc620ac0500773aeb010203010902240001000020000904c40102fffd018009050202100202000009058202"], 0x0)
syz_usb_control_io$uac1(r0, &(0x7f0000000000)={0x14, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0003060000000603"]}, 0x0)
syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000003c0)={0x1c, &(0x7f0000000140)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 64)
lseek(0xffffffffffffffff, 0xbf85, 0x1) (rerun: 64)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)

program crashed: KASAN: slab-use-after-free Write in rtsx_usb_ms_handle_req
single: successfully extracted reproducer
found reproducer with 10 syscalls
minimizing guilty program
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 64)
lseek(0xffffffffffffffff, 0xbf85, 0x1) (rerun: 64)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program crashed: KASAN: slab-use-after-free Write in rtsx_usb_ms_handle_req
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 64)
lseek(0xffffffffffffffff, 0xbf85, 0x1) (rerun: 64)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 64)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
lseek(0xffffffffffffffff, 0xbf85, 0x1) (rerun: 64)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 64)
lseek(0xffffffffffffffff, 0xbf85, 0x1) (rerun: 64)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 64)
lseek(0xffffffffffffffff, 0xbf85, 0x1) (rerun: 64)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 64)
lseek(0xffffffffffffffff, 0xbf85, 0x1) (rerun: 64)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program crashed: KASAN: slab-use-after-free Read in rtsx_usb_ms_handle_req
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 64)
lseek(0xffffffffffffffff, 0xbf85, 0x1) (rerun: 64)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 64)
lseek(0xffffffffffffffff, 0xbf85, 0x1) (rerun: 64)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program crashed: KASAN: slab-use-after-free Write in rtsx_usb_ms_handle_req
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
syz_usb_ep_read(0xffffffffffffffff, 0x1, 0x0, 0x0)
syz_usb_ep_write(0xffffffffffffffff, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(0xffffffffffffffff, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(0xffffffffffffffff, 0x82, 0x0, 0x0) (async, rerun: 64)
lseek(0xffffffffffffffff, 0xbf85, 0x1) (rerun: 64)
syz_usb_ep_read(0xffffffffffffffff, 0x1, 0x0, 0x0) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0)
lseek(0xffffffffffffffff, 0xbf85, 0x1)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 64)
lseek(0xffffffffffffffff, 0xbf85, 0x1) (rerun: 64)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 64)
lseek(0xffffffffffffffff, 0xbf85, 0x1) (rerun: 64)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 64)
lseek(0xffffffffffffffff, 0xbf85, 0x1) (rerun: 64)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 64)
lseek(0xffffffffffffffff, 0xbf85, 0x1) (rerun: 64)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 64)
lseek(0xffffffffffffffff, 0xbf85, 0x1) (rerun: 64)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 64)
lseek(0xffffffffffffffff, 0xbf85, 0x1) (rerun: 64)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (rerun: 64)
lseek(0xffffffffffffffff, 0xbf85, 0x1) (rerun: 64)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async)
lseek(0xffffffffffffffff, 0xbf85, 0x1) (rerun: 64)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program crashed: KASAN: slab-use-after-free Write in rtsx_usb_ms_handle_req
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async)
lseek(0xffffffffffffffff, 0xbf85, 0x1)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program crashed: KASAN: slab-use-after-free Read in rtsx_usb_ms_handle_req
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async)
lseek(0xffffffffffffffff, 0xbf85, 0x1)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
program did not crash
simplifying guilty program options
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async)
lseek(0xffffffffffffffff, 0xbf85, 0x1)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async)
lseek(0xffffffffffffffff, 0xbf85, 0x1)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async)
lseek(0xffffffffffffffff, 0xbf85, 0x1)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async)
lseek(0xffffffffffffffff, 0xbf85, 0x1)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async)
lseek(0xffffffffffffffff, 0xbf85, 0x1)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program crashed: KASAN: slab-use-after-free Read in rtsx_usb_ms_handle_req
validation run: crashed=true
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async)
lseek(0xffffffffffffffff, 0xbf85, 0x1)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
validation run: crashed=false
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async)
lseek(0xffffffffffffffff, 0xbf85, 0x1)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program crashed: KASAN: slab-use-after-free Write in rtsx_usb_ms_handle_req
validation run: crashed=true
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async)
lseek(0xffffffffffffffff, 0xbf85, 0x1)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
validation run: crashed=false
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async)
lseek(0xffffffffffffffff, 0xbf85, 0x1)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
validation run: crashed=false
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async)
lseek(0xffffffffffffffff, 0xbf85, 0x1)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
validation run: crashed=false
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async)
lseek(0xffffffffffffffff, 0xbf85, 0x1)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
validation run: crashed=false
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async)
lseek(0xffffffffffffffff, 0xbf85, 0x1)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
validation run: crashed=false
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async)
lseek(0xffffffffffffffff, 0xbf85, 0x1)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
validation run: crashed=false
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async)
lseek(0xffffffffffffffff, 0xbf85, 0x1)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
validation run: crashed=false
reproducing took 55m18.970464016s
repro crashed as (corrupted=true):
==================================================================
BUG: KASAN: slab-use-after-free in rtsx_usb_ms_handle_req+0x1095/0x1900 drivers/memstick/host/rtsx_usb_ms.c:-1
Write of size 4 at addr ffff88807cf92074 by task kworker/0:5/5729

CPU: 0 UID: 0 PID: 5729 Comm: kworker/0:5 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events rtsx

report is corrupted, running repro again
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async)
lseek(0xffffffffffffffff, 0xbf85, 0x1)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
report is corrupted, running repro again
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async)
lseek(0xffffffffffffffff, 0xbf85, 0x1)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
report is corrupted, running repro again
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-lseek-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async)
lseek(0xffffffffffffffff, 0xbf85, 0x1)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
final repro crashed as (corrupted=true):
==================================================================
BUG: KASAN: slab-use-after-free in rtsx_usb_ms_handle_req+0x1095/0x1900 drivers/memstick/host/rtsx_usb_ms.c:-1
Write of size 4 at addr ffff88807cf92074 by task kworker/0:5/5729

CPU: 0 UID: 0 PID: 5729 Comm: kworker/0:5 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events rtsx