Extracting prog: 3m37.792246803s
Minimizing prog: 12m30.445968347s
Simplifying prog options: 1m25.452253793s
Extracting C: 55.556638484s
Simplifying C: 2m37.209964653s


extracting reproducer from 70 programs
testing a last program of every proc
single: executing 20 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_disconnect-syz_usb_connect-syz_open_dev$hiddev-syz_usb_disconnect
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000100)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_disconnect(r0)
syz_usb_connect(0x5, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x0)
syz_open_dev$hiddev(0x0, 0x80000000, 0x200200)
syz_usb_disconnect(0xffffffffffffffff)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect-syz_usb_disconnect-syz_usb_connect-syz_usb_connect$uac2-syz_usb_connect-syz_open_dev$char_usb-write$char_usb-syz_usb_control_io$hid-syz_usb_connect-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$hid-syz_usb_control_io$lan78xx-syz_usb_connect$midi
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f0000000500)={{0x12, 0x1, 0x110, 0x59, 0xa6, 0x90, 0x40, 0x46d, 0x920, 0x7855, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x95, 0x10, 0x99, "", [{{0x9, 0x4, 0x5b, 0x18, 0x0, 0x22, 0x1a, 0xd1, 0x1}}]}}]}}, 0x0)
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="1201500254300510b00d6968b373010203010902120001000000000904"], &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0})
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000c0780a402a1101007f9e0102030109022400010000000009040000020a"], 0x0)
r2 = syz_usb_connect$uac2(0x6, 0xb4, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x41e, 0x3263, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa2, 0x3, 0x1, 0x81, 0x40, 0x3, {0x8, 0xb, 0x2, 0x0, 0x1, 0x0, 0x20, 0x6}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x2, 0x1, 0x1d, 0x6}, [@source_unit={0x8, 0x24, 0xa, 0x5, 0x4, 0x9, 0x4, 0x4}, @selector_unit={0xc, 0x24, 0xb, 0xf8, 0x7, "caa4e8dbddb509"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_discrete={0x10, 0x24, 0x2, 0x1, 0x5, 0x4, 0x8, 0x60, "f19cf3276d5e27c5"}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x1, 0x9, 0x6, 0x9, 0x4}]}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0xc, 0x1, 0x0, {0x8, 0x25, 0x1, 0x0, 0xf, 0x0, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_continuous={0xc, 0x24, 0x2, 0x1, 0x7f, 0x2, 0x8, 0x3, "5dba33", "ea"}]}, {{0x9, 0x5, 0x82, 0x9, 0x40, 0x7, 0x2, 0x6, {0x8, 0x25, 0x1, 0x3, 0x3, 0x9a}}}}}}}}]}}, &(0x7f0000000580)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x250, 0x7, 0x6, 0x6, 0x10, 0x8a}, 0x17, &(0x7f00000001c0)={0x5, 0xf, 0x17, 0x2, [@ext_cap={0x7, 0x10, 0x2, 0x0, 0xd, 0xa, 0x8e}, @wireless={0xb, 0x10, 0x1, 0xc, 0x2d8189fb9b508ca2, 0x6, 0x36, 0x1, 0xf0}]}, 0x7, [{0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x1407}}, {0x1a, &(0x7f0000000280)=@string={0x1a, 0x3, "2145dad55af18d628a70c6e411b4b90212d850971162d2e0"}}, {0x44, &(0x7f00000002c0)=@string={0x44, 0x3, "b842f8d5eda8e42f7c2909473c88dd56936d68c18ebeddfd300916f71a283c4fbc73db5f678346c73da510728035d30ff0580c567251c638692a01b685273af8a233"}}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x810}}, {0x5a, &(0x7f0000000400)=@string={0x5a, 0x3, "a73c8f9cb481edf7ec8a8b6ba4ef81c26d7718e513efac7a79ec71dc911ced4507c0cd2d689be748897eaf9c4224b4273d60f45ca93c8c13cc78844cce98c19385b4afeb464fb67ea44db1d605cb8828057a1e87bd0bcbc7"}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x41d}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x436}}]})
r3 = syz_usb_connect(0x3, 0x2d, &(0x7f0000000000)=ANY=[@ANYRES16=r2], 0x0)
r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x10000)
write$char_usb(r4, 0x0, 0x0)
syz_usb_control_io$hid(r3, 0x0, 0x0)
syz_usb_connect(0x5, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="120100002d306c10ce0aff2001010102030109022400010000000009040000029e0238000d050d0000000000000905a8"], 0x0)
syz_usb_disconnect(r1)
r5 = syz_usb_connect(0x2, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="52010000ead4a320d118af1e6309010203010902240001f60720400904a67602ab52634a"], 0x0)
syz_usb_control_io$cdc_ecm(r5, &(0x7f0000000f40)={0x14, 0x0, &(0x7f0000000f00)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0)
syz_usb_control_io$hid(r5, 0x0, 0x0)
syz_usb_control_io$lan78xx(r5, 0x0, &(0x7f00000003c0)={0x34, &(0x7f0000000200)={0x40, 0x5, 0x2, "80c1"}, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_connect$midi(0x5, 0x31, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000403e13150840000102030109021f00010109100409040000010103000b09050503"], 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-read$char_usb-read$char_usb-syz_usb_ep_write$ath9k_ep1
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000012c0)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904000001faf40d000905820349"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
read$char_usb(r1, &(0x7f0000000480)=""/74, 0x49)
read$char_usb(r1, &(0x7f0000000480)=""/74, 0x4a)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x494, &(0x7f00000008c0)={[{0xad, 0x4e00, "a6abab894c3265bdc7fc71f365c8a4a329d5ebebcbc7936198f207ea92992fe26d4bb809dd3c31013d80d39ac8d10d2d2ece6b76e00e538472601a9a532903d576016aacfe5b3752bff467d33e8a8a5bfe2ae96da029c78bf00342fae8ea7df90c1e9b0c79a5d3700ef739c45ae3f943f4aecf0b5505528379d6ab699b88314c021ff6cd54afcc961c11bbcf0ee5c2b3dcb325cfb59fce618dbf06c7309a2df356be245aa1c3a22a98790ab08e"}, {0xfd, 0x4e00, "5edf7f3b377d5ce1a81ab0329d66b56e3c39d6aeb13b236486a733960a3d2e78ced1a21f4312c29424c235444fd707709c18b8042bfccb2996c026b63ae837fe4085b171e5f2a441c5036fe6165ade0799ceb2da4effff2955dc719d773a79729076b0470fdfb44e9cda583879a339d752db9083b9c54c58a61406629fc7197eaffdbd31eb7e236f6db2b22d8c18400c16b20b35c23c28587df129b3d6c57c3e93b5c4dc836c0652ce82189ffe0d59e00550eebc750ea06e5639a5521164d460abf8c59fcc65c60f10cb61e965f25cd24f44ee78f7a37a03d13598b09a68d718008099fd12635a0db134c65a4c28d5e9e1c2a4c7f0e8920085052053f0"}, {0x2d, 0x4e00, "26de7faa757f71226ce83aa903f67ffc877a1588ae1c89aa33345918459607484c5a9894e500eaa5acd529af6e"}, {0x195, 0x4e00, "c7f1aca2d6da8f5681d28bf422c8a0f8e2e38ef1a0043f48f6a031b2483f08949bc0972f60e06cfae4f2383bca5ff34a875e4d10d07d2a5497ca8d6f27f29b437e1832a2fe56a4ef16eb54749970bff19926f47df6439480f32dcd0de78e8be17db8c61597610c0719b5410000002d57528476aae0caf60156b412e8807af77322ea3f3e100fe929cd4e3f757e67a2b182b5f03cba8409703a605e2337eb404742ab6301a3dcfe660490e46529bb721f8aa1bbbacf864b27ed63ebd0ebd99d3d4e196a2d985849b61902180704e4d783d41b545c5ee69b5d834d5395bea53112c165c0d32d43f570809d451bfea492c3f231d9a14d3bec09fa06f43b66ed3d7e52655bd2dedbc127a5909e9fe4c88ae80f3745a96e921d35b4aeea6d6a218fb13eeead54f52044397338df7c27267ba5898b8d4e7718d56871744a95e18d35605745b9712261b6f13a2be379bf6abf9fe4df1941435ed3fbe147af53ff2648f1bae853c92ac6eca32ab14efb3c0e1a27776c9a96032b4f158e0a53d6e148b6bb452888f16b69852d67bfc936f53f2413612a5f4db9"}, {0xc5, 0x4e00, "00093e6ec88e4bc2eaf95048f08019a5ac958dfc3973aa56866b8d01a00380df9df5a077e20a684328ed44b29606b767a4389430fab67b177c5775a8f0e440d95325bdf5934fa007e92864a769e16faae140608106f37b3fd366dd3c4da2ffa26bd931146286c034fbc10ca18fda3efe23796421141250bb52e510183913d82199c471772f8db2def8a9f30fbd16b3548347cfc68922026937fa8a064dcd1c4771a9cb971c47463650f8f4a21f573325b05fbaf36a04999b874ef0c338c6a8a778ee22a07a"}, {0x3a, 0x4e00, "80d061164e66c0c2ff05bff6406895ed21ff6dd3b64211f242fb7f668686d37c0cafa3a5df8d9fa6b116dcd103de47b1045f9b859c1bb706123e"}]})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm-syz_open_dev$char_usb-syz_usb_control_io$uac1-syz_usb_control_io-read$char_usb-write$char_usb-syz_usb_disconnect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x5, 0x58, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x8e, 0x3a, 0xc6, 0x20, 0x694, 0x1, 0x7813, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x46, 0x2, 0xe, 0x6, 0x10, 0x3, "", [{{0x9, 0x4, 0x39, 0xd8, 0x1, 0x1a, 0xda, 0xa8, 0x8, [], [{{0x9, 0x5, 0x8, 0x10, 0x20, 0x7, 0x9, 0x80}}]}}, {{0x9, 0x4, 0xe4, 0x5, 0x3, 0xb9, 0x56, 0xda, 0x2, [], [{{0x9, 0x5, 0x8, 0x0, 0x400, 0x1, 0x12, 0xfc}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x7, 0x3, 0x9a, [@generic={0x7, 0x5, "d15b89f26d"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x40, 0x7a, 0xa, 0x84}}]}}]}}]}}, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, &(0x7f0000000bc0)={0x24, 0x0, &(0x7f0000000b00)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c01}}, 0x0, 0x0}, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000011c0)={0x24, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000001600)={0x24, 0x0, &(0x7f0000001540)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x44a}}, 0x0, 0x0}, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f00000001c0)={0x40, 0x8, 0x8, "fde61e0ee4a63b9e"}, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000002280)={0x84, &(0x7f0000001e00)={0x20, 0x14, 0x4, "348b35e5"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ncm(0xffffffffffffffff, &(0x7f0000000980)={0x14, 0x0, 0x0}, 0x0)
syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
read$char_usb(r1, &(0x7f0000000540)=""/99, 0x63)
write$char_usb(r1, 0x0, 0x0)
syz_usb_disconnect(r0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_connect$uac3-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_connect$uac3(0x5, 0xa6, &(0x7f0000000180)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0xe41, 0x4242, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x94, 0x3, 0x1, 0x48, 0x80, 0x5, {0x8, 0xb, 0x1, 0x1, 0x1, 0x24, 0x30, 0x80}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xb, 0xa, 0xab}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x9, 0x4, 0xe3, 0xf, "97b5c782d871"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x4, 0x1, 0x4, 0x9}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x1, 0x5}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x5, 0x2, 0xc, 0x1}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0xf, 0x40, 0x40, {0xa, 0x25, 0x25, 0x6, 0x81, 0xd6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x7, 0x9, 0x4, {0xa, 0x25, 0x25, 0x0, 0x3, 0x10}}}}}}}}]}}, 0x0)
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program crashed: UBSAN: array-index-out-of-bounds in aiptek_irq
single: successfully extracted reproducer
found reproducer with 8 syscalls
minimizing guilty program
testing program (duration=36.863573334s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_connect$uac3
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_connect$uac3(0x5, 0xa6, &(0x7f0000000180)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0xe41, 0x4242, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x94, 0x3, 0x1, 0x48, 0x80, 0x5, {0x8, 0xb, 0x1, 0x1, 0x1, 0x24, 0x30, 0x80}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xb, 0xa, 0xab}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x9, 0x4, 0xe3, 0xf, "97b5c782d871"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x4, 0x1, 0x4, 0x9}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x1, 0x5}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x5, 0x2, 0xc, 0x1}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0xf, 0x40, 0x40, {0xa, 0x25, 0x25, 0x6, 0x81, 0xd6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x7, 0x9, 0x4, {0xa, 0x25, 0x25, 0x0, 0x3, 0x10}}}}}}}}]}}, 0x0)

program did not crash
testing program (duration=36.863573334s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program did not crash
testing program (duration=36.863573334s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_connect$uac3-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_connect$uac3(0x5, 0xa6, &(0x7f0000000180)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0xe41, 0x4242, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x94, 0x3, 0x1, 0x48, 0x80, 0x5, {0x8, 0xb, 0x1, 0x1, 0x1, 0x24, 0x30, 0x80}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xb, 0xa, 0xab}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x9, 0x4, 0xe3, 0xf, "97b5c782d871"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x4, 0x1, 0x4, 0x9}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x1, 0x5}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x5, 0x2, 0xc, 0x1}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0xf, 0x40, 0x40, {0xa, 0x25, 0x25, 0x6, 0x81, 0xd6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x7, 0x9, 0x4, {0xa, 0x25, 0x25, 0x0, 0x3, 0x10}}}}}}}}]}}, 0x0)
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program did not crash
testing program (duration=36.863573334s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_connect$uac3-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_connect$uac3(0x5, 0xa6, &(0x7f0000000180)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0xe41, 0x4242, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x94, 0x3, 0x1, 0x48, 0x80, 0x5, {0x8, 0xb, 0x1, 0x1, 0x1, 0x24, 0x30, 0x80}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xb, 0xa, 0xab}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x9, 0x4, 0xe3, 0xf, "97b5c782d871"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x4, 0x1, 0x4, 0x9}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x1, 0x5}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x5, 0x2, 0xc, 0x1}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0xf, 0x40, 0x40, {0xa, 0x25, 0x25, 0x6, 0x81, 0xd6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x7, 0x9, 0x4, {0xa, 0x25, 0x25, 0x0, 0x3, 0x10}}}}}}}}]}}, 0x0)
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program did not crash
testing program (duration=36.863573334s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_connect$uac3-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_connect$uac3(0x5, 0xa6, &(0x7f0000000180)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0xe41, 0x4242, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x94, 0x3, 0x1, 0x48, 0x80, 0x5, {0x8, 0xb, 0x1, 0x1, 0x1, 0x24, 0x30, 0x80}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xb, 0xa, 0xab}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x9, 0x4, 0xe3, 0xf, "97b5c782d871"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x4, 0x1, 0x4, 0x9}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x1, 0x5}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x5, 0x2, 0xc, 0x1}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0xf, 0x40, 0x40, {0xa, 0x25, 0x25, 0x6, 0x81, 0xd6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x7, 0x9, 0x4, {0xa, 0x25, 0x25, 0x0, 0x3, 0x10}}}}}}}}]}}, 0x0)
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program did not crash
testing program (duration=36.863573334s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_connect$uac3-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_connect$uac3(0x5, 0xa6, &(0x7f0000000180)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0xe41, 0x4242, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x94, 0x3, 0x1, 0x48, 0x80, 0x5, {0x8, 0xb, 0x1, 0x1, 0x1, 0x24, 0x30, 0x80}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xb, 0xa, 0xab}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x9, 0x4, 0xe3, 0xf, "97b5c782d871"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x4, 0x1, 0x4, 0x9}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x1, 0x5}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x5, 0x2, 0xc, 0x1}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0xf, 0x40, 0x40, {0xa, 0x25, 0x25, 0x6, 0x81, 0xd6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x7, 0x9, 0x4, {0xa, 0x25, 0x25, 0x0, 0x3, 0x10}}}}}}}}]}}, 0x0)
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program did not crash
testing program (duration=36.863573334s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_connect$uac3-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_connect$uac3(0x5, 0xa6, &(0x7f0000000180)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0xe41, 0x4242, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x94, 0x3, 0x1, 0x48, 0x80, 0x5, {0x8, 0xb, 0x1, 0x1, 0x1, 0x24, 0x30, 0x80}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xb, 0xa, 0xab}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x9, 0x4, 0xe3, 0xf, "97b5c782d871"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x4, 0x1, 0x4, 0x9}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x1, 0x5}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x5, 0x2, 0xc, 0x1}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0xf, 0x40, 0x40, {0xa, 0x25, 0x25, 0x6, 0x81, 0xd6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x7, 0x9, 0x4, {0xa, 0x25, 0x25, 0x0, 0x3, 0x10}}}}}}}}]}}, 0x0)
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program did not crash
testing program (duration=36.863573334s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_connect$uac3-syz_usb_ep_write
detailed listing:
executing program 0:
syz_usb_disconnect(0xffffffffffffffff)
r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_connect$uac3(0x5, 0xa6, &(0x7f0000000180)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0xe41, 0x4242, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x94, 0x3, 0x1, 0x48, 0x80, 0x5, {0x8, 0xb, 0x1, 0x1, 0x1, 0x24, 0x30, 0x80}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xb, 0xa, 0xab}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x9, 0x4, 0xe3, 0xf, "97b5c782d871"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x4, 0x1, 0x4, 0x9}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x1, 0x5}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x5, 0x2, 0xc, 0x1}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0xf, 0x40, 0x40, {0xa, 0x25, 0x25, 0x6, 0x81, 0xd6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x7, 0x9, 0x4, {0xa, 0x25, 0x25, 0x0, 0x3, 0x10}}}}}}}}]}}, 0x0)
syz_usb_ep_write(0xffffffffffffffff, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program did not crash
testing program (duration=36.863573334s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_connect$uac3-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_connect$uac3(0x5, 0xa6, &(0x7f0000000180)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0xe41, 0x4242, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x94, 0x3, 0x1, 0x48, 0x80, 0x5, {0x8, 0xb, 0x1, 0x1, 0x1, 0x24, 0x30, 0x80}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xb, 0xa, 0xab}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x9, 0x4, 0xe3, 0xf, "97b5c782d871"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x4, 0x1, 0x4, 0x9}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x1, 0x5}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x5, 0x2, 0xc, 0x1}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0xf, 0x40, 0x40, {0xa, 0x25, 0x25, 0x6, 0x81, 0xd6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x7, 0x9, 0x4, {0xa, 0x25, 0x25, 0x0, 0x3, 0x10}}}}}}}}]}}, 0x0)
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program did not crash
testing program (duration=36.863573334s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_connect$uac3-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_connect$uac3(0x5, 0xa6, &(0x7f0000000180)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0xe41, 0x4242, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x94, 0x3, 0x1, 0x48, 0x80, 0x5, {0x8, 0xb, 0x1, 0x1, 0x1, 0x24, 0x30, 0x80}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xb, 0xa, 0xab}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x9, 0x4, 0xe3, 0xf, "97b5c782d871"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x4, 0x1, 0x4, 0x9}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x1, 0x5}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x5, 0x2, 0xc, 0x1}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0xf, 0x40, 0x40, {0xa, 0x25, 0x25, 0x6, 0x81, 0xd6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x7, 0x9, 0x4, {0xa, 0x25, 0x25, 0x0, 0x3, 0x10}}}}}}}}]}}, 0x0)
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program did not crash
testing program (duration=36.863573334s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_connect$uac3-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_connect$uac3(0x5, 0xa6, &(0x7f0000000180)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0xe41, 0x4242, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x94, 0x3, 0x1, 0x48, 0x80, 0x5, {0x8, 0xb, 0x1, 0x1, 0x1, 0x24, 0x30, 0x80}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xb, 0xa, 0xab}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x9, 0x4, 0xe3, 0xf, "97b5c782d871"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x4, 0x1, 0x4, 0x9}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x1, 0x5}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x5, 0x2, 0xc, 0x1}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0xf, 0x40, 0x40, {0xa, 0x25, 0x25, 0x6, 0x81, 0xd6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x7, 0x9, 0x4, {0xa, 0x25, 0x25, 0x0, 0x3, 0x10}}}}}}}}]}}, 0x0)
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program did not crash
testing program (duration=36.863573334s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_connect$uac3-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_connect$uac3(0x5, 0xa6, &(0x7f0000000180)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0xe41, 0x4242, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x94, 0x3, 0x1, 0x48, 0x80, 0x5, {0x8, 0xb, 0x1, 0x1, 0x1, 0x24, 0x30, 0x80}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xb, 0xa, 0xab}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x9, 0x4, 0xe3, 0xf, "97b5c782d871"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x4, 0x1, 0x4, 0x9}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x1, 0x5}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x5, 0x2, 0xc, 0x1}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0xf, 0x40, 0x40, {0xa, 0x25, 0x25, 0x6, 0x81, 0xd6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x7, 0x9, 0x4, {0xa, 0x25, 0x25, 0x0, 0x3, 0x10}}}}}}}}]}}, 0x0)
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program did not crash
testing program (duration=36.863573334s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_connect$uac3-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_connect$uac3(0x5, 0x0, 0x0, 0x0)
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program did not crash
testing program (duration=36.863573334s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_connect$uac3-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_connect$uac3(0x5, 0x80, &(0x7f0000000180)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0xe41, 0x4242, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x48, 0x80, 0x5, {0x8, 0xb, 0x1, 0x1, 0x1, 0x24, 0x30, 0x80}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xb, 0xa, 0xab}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0xf, 0x40, 0x40, {0xa, 0x25, 0x25, 0x6, 0x81, 0xd6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x7, 0x9, 0x4, {0xa, 0x25, 0x25, 0x0, 0x3, 0x10}}}}}}}}]}}, 0x0)
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program did not crash
testing program (duration=36.863573334s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_connect$uac3-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_connect$uac3(0x5, 0xa0, &(0x7f0000000180)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0xe41, 0x4242, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x8e, 0x3, 0x1, 0x48, 0x80, 0x5, {0x8, 0xb, 0x1, 0x1, 0x1, 0x24, 0x30, 0x80}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xb, 0xa, 0xab}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0x9, 0x4, 0xe3, 0xf}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x4, 0x1, 0x4, 0x9}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x1, 0x5}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x5, 0x2, 0xc, 0x1}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0xf, 0x40, 0x40, {0xa, 0x25, 0x25, 0x6, 0x81, 0xd6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x7, 0x9, 0x4, {0xa, 0x25, 0x25, 0x0, 0x3, 0x10}}}}}}}}]}}, 0x0)
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program did not crash
testing program (duration=36.863573334s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_connect$uac3-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_connect$uac3(0x5, 0xa6, &(0x7f0000000180)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0xe41, 0x4242, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x94, 0x3, 0x1, 0x48, 0x80, 0x5, {0x8, 0xb, 0x1, 0x1, 0x1, 0x24, 0x30, 0x80}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xb, 0xa, 0xab}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x9, 0x4, 0xe3, 0xf, "97b5c782d871"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x4, 0x1, 0x4, 0x9}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x1, 0x5}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x5, 0x2, 0xc, 0x1}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0xf, 0x40, 0x40, {0xa, 0x25, 0x25, 0x6, 0x81, 0xd6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x7, 0x9, 0x4, {0xa, 0x25, 0x25, 0x0, 0x3, 0x10}}}}}}}}]}}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x0, 0x0)

program did not crash
testing program (duration=36.863573334s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_connect$uac3-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_connect$uac3(0x5, 0xa6, &(0x7f0000000180)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0xe41, 0x4242, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x94, 0x3, 0x1, 0x48, 0x80, 0x5, {0x8, 0xb, 0x1, 0x1, 0x1, 0x24, 0x30, 0x80}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xb, 0xa, 0xab}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x9, 0x4, 0xe3, 0xf, "97b5c782d871"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x4, 0x1, 0x4, 0x9}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x1, 0x5}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x5, 0x2, 0xc, 0x1}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0xf, 0x40, 0x40, {0xa, 0x25, 0x25, 0x6, 0x81, 0xd6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x7, 0x9, 0x4, {0xa, 0x25, 0x25, 0x0, 0x3, 0x10}}}}}}}}]}}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x0, &(0x7f0000000100))

program did not crash
extracting C reproducer
testing compiled C program (duration=36.863573334s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_connect$uac3-syz_usb_ep_write
program did not crash
simplifying guilty program options
testing program (duration=36.863573334s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_connect$uac3-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_connect$uac3(0x5, 0xa6, &(0x7f0000000180)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0xe41, 0x4242, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x94, 0x3, 0x1, 0x48, 0x80, 0x5, {0x8, 0xb, 0x1, 0x1, 0x1, 0x24, 0x30, 0x80}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xb, 0xa, 0xab}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x9, 0x4, 0xe3, 0xf, "97b5c782d871"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x4, 0x1, 0x4, 0x9}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x1, 0x5}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x5, 0x2, 0xc, 0x1}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0xf, 0x40, 0x40, {0xa, 0x25, 0x25, 0x6, 0x81, 0xd6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x7, 0x9, 0x4, {0xa, 0x25, 0x25, 0x0, 0x3, 0x10}}}}}}}}]}}, 0x0)
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program crashed: UBSAN: array-index-out-of-bounds in aiptek_irq
extracting C reproducer
testing compiled C program (duration=36.863573334s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_connect$uac3-syz_usb_ep_write
program crashed: UBSAN: array-index-out-of-bounds in aiptek_irq
simplifying C reproducer
testing compiled C program (duration=36.863573334s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_connect$uac3-syz_usb_ep_write
program crashed: UBSAN: array-index-out-of-bounds in aiptek_irq
testing compiled C program (duration=36.863573334s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_connect$uac3-syz_usb_ep_write
program crashed: UBSAN: array-index-out-of-bounds in aiptek_irq
testing compiled C program (duration=36.863573334s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_connect$uac3-syz_usb_ep_write
program crashed: UBSAN: array-index-out-of-bounds in aiptek_irq
testing compiled C program (duration=36.863573334s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_connect$uac3-syz_usb_ep_write
program crashed: UBSAN: array-index-out-of-bounds in aiptek_irq
testing compiled C program (duration=36.863573334s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_connect$uac3-syz_usb_ep_write
program crashed: UBSAN: array-index-out-of-bounds in aiptek_irq
testing program (duration=36.863573334s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_connect$uac3-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_connect$uac3(0x5, 0xa6, &(0x7f0000000180)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0xe41, 0x4242, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x94, 0x3, 0x1, 0x48, 0x80, 0x5, {0x8, 0xb, 0x1, 0x1, 0x1, 0x24, 0x30, 0x80}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xb, 0xa, 0xab}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x9, 0x4, 0xe3, 0xf, "97b5c782d871"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x4, 0x1, 0x4, 0x9}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x1, 0x5}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x5, 0x2, 0xc, 0x1}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0xf, 0x40, 0x40, {0xa, 0x25, 0x25, 0x6, 0x81, 0xd6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x7, 0x9, 0x4, {0xa, 0x25, 0x25, 0x0, 0x3, 0x10}}}}}}}}]}}, 0x0)
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program crashed: UBSAN: array-index-out-of-bounds in aiptek_irq
validation run: crashed=true
testing program (duration=36.863573334s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_connect$uac3-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_connect$uac3(0x5, 0xa6, &(0x7f0000000180)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0xe41, 0x4242, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x94, 0x3, 0x1, 0x48, 0x80, 0x5, {0x8, 0xb, 0x1, 0x1, 0x1, 0x24, 0x30, 0x80}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xb, 0xa, 0xab}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x9, 0x4, 0xe3, 0xf, "97b5c782d871"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x4, 0x1, 0x4, 0x9}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x1, 0x5}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x5, 0x2, 0xc, 0x1}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0xf, 0x40, 0x40, {0xa, 0x25, 0x25, 0x6, 0x81, 0xd6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x7, 0x9, 0x4, {0xa, 0x25, 0x25, 0x0, 0x3, 0x10}}}}}}}}]}}, 0x0)
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program crashed: UBSAN: array-index-out-of-bounds in aiptek_irq
validation run: crashed=true
testing program (duration=36.863573334s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_connect$uac3-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_connect$uac3(0x5, 0xa6, &(0x7f0000000180)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0xe41, 0x4242, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x94, 0x3, 0x1, 0x48, 0x80, 0x5, {0x8, 0xb, 0x1, 0x1, 0x1, 0x24, 0x30, 0x80}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xb, 0xa, 0xab}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x9, 0x4, 0xe3, 0xf, "97b5c782d871"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x4, 0x1, 0x4, 0x9}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x1, 0x5}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x5, 0x2, 0xc, 0x1}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0xf, 0x40, 0x40, {0xa, 0x25, 0x25, 0x6, 0x81, 0xd6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x7, 0x9, 0x4, {0xa, 0x25, 0x25, 0x0, 0x3, 0x10}}}}}}}}]}}, 0x0)
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program crashed: UBSAN: array-index-out-of-bounds in aiptek_irq
validation run: crashed=true
reproducing took 22m40.469134173s
repro crashed as (corrupted=false):
================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 547 is out of range for type 'const int[34]'
CPU: 1 PID: 0 Comm: swapper/1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
 <IRQ>
 __dump_stack+0x21/0x24 lib/dump_stack.c:77
 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118
 dump_stack+0x15/0x1c lib/dump_stack.c:135
 ubsan_epilogue+0xe/0x40 lib/ubsan.c:148
 __ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:347
 aiptek_irq+0x1fdf/0x2860 drivers/input/tablet/aiptek.c:741
 __usb_hcd_giveback_urb+0x333/0x4f0 drivers/usb/core/hcd.c:1674
 usb_hcd_giveback_urb+0x119/0x410 drivers/usb/core/hcd.c:1748
 dummy_timer+0x8be/0x30e0 drivers/usb/gadget/udc/dummy_hcd.c:1986
 call_timer_fn+0x38/0x290 kernel/time/timer.c:1450
 expire_timers kernel/time/timer.c:1495 [inline]
 __run_timers+0x650/0x9e0 kernel/time/timer.c:1789
 run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1802
 __do_softirq+0x255/0x563 kernel/softirq.c:309
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x60/0x80 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:405 [inline]
 __irq_exit_rcu+0x128/0x150 kernel/softirq.c:435
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:447
 sysvec_apic_timer_interrupt+0xbf/0xe0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635
RIP: 0010:default_idle+0x12/0x20 arch/x86/kernel/process.c:718
Code: 44 2a 00 00 49 bd 00 00 00 00 00 fc ff df e9 67 ff ff ff e8 d0 f7 fa ff 55 48 89 e5 0f 1f 44 00 00 0f 00 2d b0 f6 61 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 55 48 89 e5 41 57 41 56
RSP: 0018:ffffc90000107db8 EFLAGS: 00000252
RAX: ffff8881f7100000 RBX: ffff888100293b40 RCX: 0000000000006fde
RDX: 0000000000000001 RSI: ffffffff85409040 RDI: ffffffff85409000
RBP: ffffc90000107db8 R08: ffff8881f71573d3 R09: 1ffff1103ee2ae7a
R10: dffffc0000000000 R11: ffffed103ee2ae7b R12: 0000000000000000
R13: 1ffff11020052768 R14: dffffc0000000000 R15: dffffc0000000000
 arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:709
 default_idle_call+0x71/0x1d0 kernel/sched/idle.c:114
 cpuidle_idle_call kernel/sched/idle.c:204 [inline]
 do_idle+0x217/0x620 kernel/sched/idle.c:328
 cpu_startup_entry+0x18/0x20 kernel/sched/idle.c:425
 start_secondary+0x2e9/0x3a0 arch/x86/kernel/smpboot.c:276
 secondary_startup_64_no_verify+0xad/0xbb
================================================================================
==================================================================
BUG: KASAN: global-out-of-bounds in aiptek_irq+0x1ffd/0x2860 drivers/input/tablet/aiptek.c:741
Read of size 4 at addr ffffffff855b380c by task swapper/1/0

CPU: 1 PID: 0 Comm: swapper/1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
 <IRQ>
 __dump_stack+0x21/0x24 lib/dump_stack.c:77
 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:435 [inline]
 kasan_report+0xe2/0x130 mm/kasan/report.c:452
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308
 aiptek_irq+0x1ffd/0x2860 drivers/input/tablet/aiptek.c:741
 __usb_hcd_giveback_urb+0x333/0x4f0 drivers/usb/core/hcd.c:1674
 usb_hcd_giveback_urb+0x119/0x410 drivers/usb/core/hcd.c:1748
 dummy_timer+0x8be/0x30e0 drivers/usb/gadget/udc/dummy_hcd.c:1986
 call_timer_fn+0x38/0x290 kernel/time/timer.c:1450
 expire_timers kernel/time/timer.c:1495 [inline]
 __run_timers+0x650/0x9e0 kernel/time/timer.c:1789
 run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1802
 __do_softirq+0x255/0x563 kernel/softirq.c:309
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x60/0x80 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:405 [inline]
 __irq_exit_rcu+0x128/0x150 kernel/softirq.c:435
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:447
 sysvec_apic_timer_interrupt+0xbf/0xe0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635
RIP: 0010:default_idle+0x12/0x20 arch/x86/kernel/process.c:718
Code: 44 2a 00 00 49 bd 00 00 00 00 00 fc ff df e9 67 ff ff ff e8 d0 f7 fa ff 55 48 89 e5 0f 1f 44 00 00 0f 00 2d b0 f6 61 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 55 48 89 e5 41 57 41 56
RSP: 0018:ffffc90000107db8 EFLAGS: 00000252
RAX: ffff8881f7100000 RBX: ffff888100293b40 RCX: 0000000000006fde
RDX: 0000000000000001 RSI: ffffffff85409040 RDI: ffffffff85409000
RBP: ffffc90000107db8 R08: ffff8881f71573d3 R09: 1ffff1103ee2ae7a
R10: dffffc0000000000 R11: ffffed103ee2ae7b R12: 0000000000000000
R13: 1ffff11020052768 R14: dffffc0000000000 R15: dffffc0000000000
 arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:709
 default_idle_call+0x71/0x1d0 kernel/sched/idle.c:114
 cpuidle_idle_call kernel/sched/idle.c:204 [inline]
 do_idle+0x217/0x620 kernel/sched/idle.c:328
 cpu_startup_entry+0x18/0x20 kernel/sched/idle.c:425
 start_secondary+0x2e9/0x3a0 arch/x86/kernel/smpboot.c:276
 secondary_startup_64_no_verify+0xad/0xbb

The buggy address belongs to the variable:
 .str.57+0xc/0x20

Memory state around the buggy address:
 ffffffff855b3700: 04 f9 f9 f9 00 f9 f9 f9 06 f9 f9 f9 07 f9 f9 f9
 ffffffff855b3780: 06 f9 f9 f9 00 04 f9 f9 05 f9 f9 f9 00 03 f9 f9
>ffffffff855b3800: 00 03 f9 f9 00 00 00 00 03 f9 f9 f9 f9 f9 f9 f9
                      ^
 ffffffff855b3880: 00 00 00 00 03 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
 ffffffff855b3900: 01 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 f9 f9 f9 f9
==================================================================
================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
index 548 is out of range for type 'const int[34]'
CPU: 1 PID: 0 Comm: swapper/1 Tainted: G    B             syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
 <IRQ>
 __dump_stack+0x21/0x24 lib/dump_stack.c:77
 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118
 dump_stack+0x15/0x1c lib/dump_stack.c:135
 ubsan_epilogue+0xe/0x40 lib/ubsan.c:148
 __ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:347
 aiptek_irq+0x1ebf/0x2860 drivers/input/tablet/aiptek.c:763
 __usb_hcd_giveback_urb+0x333/0x4f0 drivers/usb/core/hcd.c:1674
 usb_hcd_giveback_urb+0x119/0x410 drivers/usb/core/hcd.c:1748
 dummy_timer+0x8be/0x30e0 drivers/usb/gadget/udc/dummy_hcd.c:1986
 call_timer_fn+0x38/0x290 kernel/time/timer.c:1450
 expire_timers kernel/time/timer.c:1495 [inline]
 __run_timers+0x650/0x9e0 kernel/time/timer.c:1789
 run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1802
 __do_softirq+0x255/0x563 kernel/softirq.c:309
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x60/0x80 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:405 [inline]
 __irq_exit_rcu+0x128/0x150 kernel/softirq.c:435
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:447
 sysvec_apic_timer_interrupt+0xbf/0xe0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635
RIP: 0010:default_idle+0x12/0x20 arch/x86/kernel/process.c:718
Code: 44 2a 00 00 49 bd 00 00 00 00 00 fc ff df e9 67 ff ff ff e8 d0 f7 fa ff 55 48 89 e5 0f 1f 44 00 00 0f 00 2d b0 f6 61 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 55 48 89 e5 41 57 41 56
RSP: 0018:ffffc90000107db8 EFLAGS: 00000252
RAX: ffff8881f7100000 RBX: ffff888100293b40 RCX: 0000000000006fde
RDX: 0000000000000001 RSI: ffffffff85409040 RDI: ffffffff85409000
RBP: ffffc90000107db8 R08: ffff8881f71573d3 R09: 1ffff1103ee2ae7a
R10: dffffc0000000000 R11: ffffed103ee2ae7b R12: 0000000000000000
R13: 1ffff11020052768 R14: dffffc0000000000 R15: dffffc0000000000
 arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:709
 default_idle_call+0x71/0x1d0 kernel/sched/idle.c:114
 cpuidle_idle_call kernel/sched/idle.c:204 [inline]
 do_idle+0x217/0x620 kernel/sched/idle.c:328
 cpu_startup_entry+0x18/0x20 kernel/sched/idle.c:425
 start_secondary+0x2e9/0x3a0 arch/x86/kernel/smpboot.c:276
 secondary_startup_64_no_verify+0xad/0xbb
================================================================================
----------------
Code disassembly (best guess), 2 bytes skipped:
   0:	00 00                	add    %al,(%rax)
   2:	49 bd 00 00 00 00 00 	movabs $0xdffffc0000000000,%r13
   9:	fc ff df
   c:	e9 67 ff ff ff       	jmp    0xffffff78
  11:	e8 d0 f7 fa ff       	call   0xfffaf7e6
  16:	55                   	push   %rbp
  17:	48 89 e5             	mov    %rsp,%rbp
  1a:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
  1f:	0f 00 2d b0 f6 61 00 	verw   0x61f6b0(%rip)        # 0x61f6d6
  26:	fb                   	sti
  27:	f4                   	hlt
* 28:	5d                   	pop    %rbp <-- trapping instruction
  29:	c3                   	ret
  2a:	66 2e 0f 1f 84 00 00 	cs nopw 0x0(%rax,%rax,1)
  31:	00 00 00
  34:	66 90                	xchg   %ax,%ax
  36:	55                   	push   %rbp
  37:	48 89 e5             	mov    %rsp,%rbp
  3a:	41 57                	push   %r15
  3c:	41 56                	push   %r14

final repro crashed as (corrupted=false):
================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 547 is out of range for type 'const int[34]'
CPU: 1 PID: 0 Comm: swapper/1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
 <IRQ>
 __dump_stack+0x21/0x24 lib/dump_stack.c:77
 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118
 dump_stack+0x15/0x1c lib/dump_stack.c:135
 ubsan_epilogue+0xe/0x40 lib/ubsan.c:148
 __ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:347
 aiptek_irq+0x1fdf/0x2860 drivers/input/tablet/aiptek.c:741
 __usb_hcd_giveback_urb+0x333/0x4f0 drivers/usb/core/hcd.c:1674
 usb_hcd_giveback_urb+0x119/0x410 drivers/usb/core/hcd.c:1748
 dummy_timer+0x8be/0x30e0 drivers/usb/gadget/udc/dummy_hcd.c:1986
 call_timer_fn+0x38/0x290 kernel/time/timer.c:1450
 expire_timers kernel/time/timer.c:1495 [inline]
 __run_timers+0x650/0x9e0 kernel/time/timer.c:1789
 run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1802
 __do_softirq+0x255/0x563 kernel/softirq.c:309
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x60/0x80 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:405 [inline]
 __irq_exit_rcu+0x128/0x150 kernel/softirq.c:435
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:447
 sysvec_apic_timer_interrupt+0xbf/0xe0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635
RIP: 0010:default_idle+0x12/0x20 arch/x86/kernel/process.c:718
Code: 44 2a 00 00 49 bd 00 00 00 00 00 fc ff df e9 67 ff ff ff e8 d0 f7 fa ff 55 48 89 e5 0f 1f 44 00 00 0f 00 2d b0 f6 61 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 55 48 89 e5 41 57 41 56
RSP: 0018:ffffc90000107db8 EFLAGS: 00000252
RAX: ffff8881f7100000 RBX: ffff888100293b40 RCX: 0000000000006fde
RDX: 0000000000000001 RSI: ffffffff85409040 RDI: ffffffff85409000
RBP: ffffc90000107db8 R08: ffff8881f71573d3 R09: 1ffff1103ee2ae7a
R10: dffffc0000000000 R11: ffffed103ee2ae7b R12: 0000000000000000
R13: 1ffff11020052768 R14: dffffc0000000000 R15: dffffc0000000000
 arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:709
 default_idle_call+0x71/0x1d0 kernel/sched/idle.c:114
 cpuidle_idle_call kernel/sched/idle.c:204 [inline]
 do_idle+0x217/0x620 kernel/sched/idle.c:328
 cpu_startup_entry+0x18/0x20 kernel/sched/idle.c:425
 start_secondary+0x2e9/0x3a0 arch/x86/kernel/smpboot.c:276
 secondary_startup_64_no_verify+0xad/0xbb
================================================================================
==================================================================
BUG: KASAN: global-out-of-bounds in aiptek_irq+0x1ffd/0x2860 drivers/input/tablet/aiptek.c:741
Read of size 4 at addr ffffffff855b380c by task swapper/1/0

CPU: 1 PID: 0 Comm: swapper/1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
 <IRQ>
 __dump_stack+0x21/0x24 lib/dump_stack.c:77
 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:435 [inline]
 kasan_report+0xe2/0x130 mm/kasan/report.c:452
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308
 aiptek_irq+0x1ffd/0x2860 drivers/input/tablet/aiptek.c:741
 __usb_hcd_giveback_urb+0x333/0x4f0 drivers/usb/core/hcd.c:1674
 usb_hcd_giveback_urb+0x119/0x410 drivers/usb/core/hcd.c:1748
 dummy_timer+0x8be/0x30e0 drivers/usb/gadget/udc/dummy_hcd.c:1986
 call_timer_fn+0x38/0x290 kernel/time/timer.c:1450
 expire_timers kernel/time/timer.c:1495 [inline]
 __run_timers+0x650/0x9e0 kernel/time/timer.c:1789
 run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1802
 __do_softirq+0x255/0x563 kernel/softirq.c:309
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x60/0x80 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:405 [inline]
 __irq_exit_rcu+0x128/0x150 kernel/softirq.c:435
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:447
 sysvec_apic_timer_interrupt+0xbf/0xe0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635
RIP: 0010:default_idle+0x12/0x20 arch/x86/kernel/process.c:718
Code: 44 2a 00 00 49 bd 00 00 00 00 00 fc ff df e9 67 ff ff ff e8 d0 f7 fa ff 55 48 89 e5 0f 1f 44 00 00 0f 00 2d b0 f6 61 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 55 48 89 e5 41 57 41 56
RSP: 0018:ffffc90000107db8 EFLAGS: 00000252
RAX: ffff8881f7100000 RBX: ffff888100293b40 RCX: 0000000000006fde
RDX: 0000000000000001 RSI: ffffffff85409040 RDI: ffffffff85409000
RBP: ffffc90000107db8 R08: ffff8881f71573d3 R09: 1ffff1103ee2ae7a
R10: dffffc0000000000 R11: ffffed103ee2ae7b R12: 0000000000000000
R13: 1ffff11020052768 R14: dffffc0000000000 R15: dffffc0000000000
 arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:709
 default_idle_call+0x71/0x1d0 kernel/sched/idle.c:114
 cpuidle_idle_call kernel/sched/idle.c:204 [inline]
 do_idle+0x217/0x620 kernel/sched/idle.c:328
 cpu_startup_entry+0x18/0x20 kernel/sched/idle.c:425
 start_secondary+0x2e9/0x3a0 arch/x86/kernel/smpboot.c:276
 secondary_startup_64_no_verify+0xad/0xbb

The buggy address belongs to the variable:
 .str.57+0xc/0x20

Memory state around the buggy address:
 ffffffff855b3700: 04 f9 f9 f9 00 f9 f9 f9 06 f9 f9 f9 07 f9 f9 f9
 ffffffff855b3780: 06 f9 f9 f9 00 04 f9 f9 05 f9 f9 f9 00 03 f9 f9
>ffffffff855b3800: 00 03 f9 f9 00 00 00 00 03 f9 f9 f9 f9 f9 f9 f9
                      ^
 ffffffff855b3880: 00 00 00 00 03 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
 ffffffff855b3900: 01 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 f9 f9 f9 f9
==================================================================
================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
index 548 is out of range for type 'const int[34]'
CPU: 1 PID: 0 Comm: swapper/1 Tainted: G    B             syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
 <IRQ>
 __dump_stack+0x21/0x24 lib/dump_stack.c:77
 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118
 dump_stack+0x15/0x1c lib/dump_stack.c:135
 ubsan_epilogue+0xe/0x40 lib/ubsan.c:148
 __ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:347
 aiptek_irq+0x1ebf/0x2860 drivers/input/tablet/aiptek.c:763
 __usb_hcd_giveback_urb+0x333/0x4f0 drivers/usb/core/hcd.c:1674
 usb_hcd_giveback_urb+0x119/0x410 drivers/usb/core/hcd.c:1748
 dummy_timer+0x8be/0x30e0 drivers/usb/gadget/udc/dummy_hcd.c:1986
 call_timer_fn+0x38/0x290 kernel/time/timer.c:1450
 expire_timers kernel/time/timer.c:1495 [inline]
 __run_timers+0x650/0x9e0 kernel/time/timer.c:1789
 run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1802
 __do_softirq+0x255/0x563 kernel/softirq.c:309
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x60/0x80 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:405 [inline]
 __irq_exit_rcu+0x128/0x150 kernel/softirq.c:435
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:447
 sysvec_apic_timer_interrupt+0xbf/0xe0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635
RIP: 0010:default_idle+0x12/0x20 arch/x86/kernel/process.c:718
Code: 44 2a 00 00 49 bd 00 00 00 00 00 fc ff df e9 67 ff ff ff e8 d0 f7 fa ff 55 48 89 e5 0f 1f 44 00 00 0f 00 2d b0 f6 61 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 55 48 89 e5 41 57 41 56
RSP: 0018:ffffc90000107db8 EFLAGS: 00000252
RAX: ffff8881f7100000 RBX: ffff888100293b40 RCX: 0000000000006fde
RDX: 0000000000000001 RSI: ffffffff85409040 RDI: ffffffff85409000
RBP: ffffc90000107db8 R08: ffff8881f71573d3 R09: 1ffff1103ee2ae7a
R10: dffffc0000000000 R11: ffffed103ee2ae7b R12: 0000000000000000
R13: 1ffff11020052768 R14: dffffc0000000000 R15: dffffc0000000000
 arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:709
 default_idle_call+0x71/0x1d0 kernel/sched/idle.c:114
 cpuidle_idle_call kernel/sched/idle.c:204 [inline]
 do_idle+0x217/0x620 kernel/sched/idle.c:328
 cpu_startup_entry+0x18/0x20 kernel/sched/idle.c:425
 start_secondary+0x2e9/0x3a0 arch/x86/kernel/smpboot.c:276
 secondary_startup_64_no_verify+0xad/0xbb
================================================================================
----------------
Code disassembly (best guess), 2 bytes skipped:
   0:	00 00                	add    %al,(%rax)
   2:	49 bd 00 00 00 00 00 	movabs $0xdffffc0000000000,%r13
   9:	fc ff df
   c:	e9 67 ff ff ff       	jmp    0xffffff78
  11:	e8 d0 f7 fa ff       	call   0xfffaf7e6
  16:	55                   	push   %rbp
  17:	48 89 e5             	mov    %rsp,%rbp
  1a:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
  1f:	0f 00 2d b0 f6 61 00 	verw   0x61f6b0(%rip)        # 0x61f6d6
  26:	fb                   	sti
  27:	f4                   	hlt
* 28:	5d                   	pop    %rbp <-- trapping instruction
  29:	c3                   	ret
  2a:	66 2e 0f 1f 84 00 00 	cs nopw 0x0(%rax,%rax,1)
  31:	00 00 00
  34:	66 90                	xchg   %ax,%ax
  36:	55                   	push   %rbp
  37:	48 89 e5             	mov    %rsp,%rbp
  3a:	41 57                	push   %r15
  3c:	41 56                	push   %r14