Extracting prog: 33m48.117052619s
Minimizing prog: 4m20.695104984s
Simplifying prog options: 7m51.073182528s
Extracting C: 2m0.470907896s
Simplifying C: 0s


extracting reproducer from 18 programs
testing a last program of every proc
single: executing 4 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-mkdirat-mount-openat-openat
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000403419060700010102030109022700010100a0320904000003ff0000000705810200020007050202000200070583030a0001"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/ttyUSB0\x00', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/usb/drivers/f81232/1-1:1.0/power/control\x00', 0x2, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-openat-openat-openat-openat-openat-openat-openat-openat-openat$snapshot
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/usb/drivers/btusb/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/vhci/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/hci_vhci/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/serdev/drivers/hci_serdev/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/serdev/drivers/hci_uart/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/hci_uart/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/drivers/btintel/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/serial8250/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/usb/drivers/usb/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/usb/drivers/hub/unbind\x00', 0x1, 0x0)
openat$snapshot(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-nanosleep-socket$inet-ioctl$sock_inet_SIOCSIFFLAGS
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x1, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000083a0846100000010203010902270001010580000904000003ff0000050705810240000000070502024000000007058303080001"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
nanosleep(&(0x7f0000000700)={0x1}, 0x0)
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000800)={'syzkaller0\x00', 0x101})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-ioctl$USBDEVFS_GET_CAPABILITIES-syz_open_dev$usbfs-ioctl$USBDEVFS_GET_CAPABILITIES-syz_open_dev$usbfs-ioctl$USBDEVFS_GET_CAPABILITIES-syz_open_dev$usbfs-ioctl$USBDEVFS_GET_CAPABILITIES
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0xb, 0x2)
ioctl$USBDEVFS_GET_CAPABILITIES(r0, 0x8004551a, &(0x7f0000000100))
r1 = syz_open_dev$usbfs(&(0x7f0000000200), 0xc, 0x2)
ioctl$USBDEVFS_GET_CAPABILITIES(r1, 0x8004551a, &(0x7f0000000100))
r2 = syz_open_dev$usbfs(&(0x7f0000000300), 0x15, 0x2)
ioctl$USBDEVFS_GET_CAPABILITIES(r2, 0x8004551a, &(0x7f0000000100))
r3 = syz_open_dev$usbfs(&(0x7f0000000400), 0x16, 0x2)
ioctl$USBDEVFS_GET_CAPABILITIES(r3, 0x8004551a, &(0x7f0000000100))

program did not crash
single: failed to extract reproducer
bisect: bisecting 18 programs with base timeout 30s
testing program (duration=34s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 6, 38, 6, 5, 5, 8, 27, 2, 3, 3, 9, 5, 8, 1, 7, 13, 6]
detailed listing:
executing program 1:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040341902120001000000010902270001010080320904000003ffffff00070581020002000705010200020007058203400001"], 0x0)
syz_usb_control_io(r0, &(0x7f0000000100)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000200)={0x84, &(0x7f0000000300)={0x40, 0xc0, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, &(0x7f0000000100), &(0x7f0000000200)) (async)
syz_usb_control_io(r0, &(0x7f0000000100), &(0x7f0000000200)) (async)
syz_usb_control_io(r0, &(0x7f0000000100), &(0x7f0000000200))
syz_usb_control_io(r0, &(0x7f0000000100), &(0x7f0000000200))
syz_usb_control_io(r0, &(0x7f0000000100), &(0x7f0000000200))
syz_usb_control_io(r0, &(0x7f0000000100), &(0x7f0000000200))
syz_usb_control_io(r0, &(0x7f0000000100), &(0x7f0000000200))
syz_usb_control_io(r0, &(0x7f0000000100), &(0x7f0000000200))
syz_usb_control_io(r0, &(0x7f0000000100), &(0x7f0000000200))
syz_usb_control_io(r0, &(0x7f0000000100), &(0x7f0000000200))
syz_usb_control_io(r0, &(0x7f0000000100), &(0x7f0000000200))
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040c40700a000000102030109022000010100c00009040000020806ff000705010240000007058202400000"], 0x0)
nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0)
r0 = syz_open_dev$sg(&(0x7f0000000200), 0x2, 0x2)
r1 = syz_open_dev$sg(&(0x7f0000000240), 0x3, 0x2)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000300)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000000400)}, &(0x7f0000000500)="2a000000000000000100", &(0x7f0000000600), 0x2710, 0x0, 0x0, 0x0})
ioctl$SG_IO(r1, 0x2285, &(0x7f0000000300)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000000400)}, &(0x7f0000000500)="2a000000000000000100", &(0x7f0000000600), 0x2710, 0x0, 0x0, 0x0})
executing program 3:
mkdir(&(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='0x1d6b\n', 0x7)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, &(0x7f0000000700)='0x0104\n', 0x7)
close(r1)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a00)='fedcba9876543210\n', 0x11)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./config/usb_gadget/g1/strings/0x409/manufacturer\x00', 0x1, 0x0)
write(r3, &(0x7f0000000c00)='Linux Foundation\n', 0x11)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000d00)='./config/usb_gadget/g1/strings/0x409/product\x00', 0x1, 0x0)
write(r4, &(0x7f0000000e00)='Multifunction Gadget\n', 0x15)
close(r4)
mkdir(&(0x7f0000000f00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdir(&(0x7f0000001000)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000001100)='./config/usb_gadget/g1/configs/c.1/strings/0x409/configuration\x00', 0x1, 0x0)
write(r5, &(0x7f0000001200)='Conf 1\n', 0x7)
close(r5)
mkdir(&(0x7f0000001300)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff)
r6 = openat(0xffffffffffffff9c, &(0x7f0000001c00)='./config/usb_gadget/g1/functions/ecm.usb0/ifname\x00', 0x1, 0x0)
write(r6, &(0x7f0000001d00)='syzkaller%d\x00', 0xc)
close(r6)
symlink(&(0x7f0000001400)='./config/usb_gadget/g1/functions/ecm.usb0\x00', &(0x7f0000001500)='./config/usb_gadget/g1/configs/c.1/ecm.usb0\x00')
r7 = openat(0xffffffffffffff9c, &(0x7f0000001600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r7, &(0x7f0000001700)='dummy_udc.0\n', 0xc)
close(r7)
nanosleep(&(0x7f0000002000)={0x0, 0x1dcd6501}, 0x0)
r8 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000001800)={'syzkaller0\x00', <r9=>0x0})
ioctl$sock_inet_SIOCSIFFLAGS(r8, 0x8914, &(0x7f0000001900)={'syzkaller0\x00', 0x1})
bind$packet(r8, &(0x7f0000001a00)={0x11, 0x300, r9, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14)
write(r8, &(0x7f0000001b00)="0102030405060708090a0b0c0d0e0f11", 0x10)
executing program 2:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0)
syz_usb_disconnect(0x0)
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a00e58680001000000010902270001010080320904000003ff000000070581024000000705020240000007058303400001"], 0x0)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_ep_write(r0, 0x83, 0x8, &(0x7f0000000200)="000003434c000000")
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040fd0b0b000001010203010902200001010080320904000002ff0000000705010200020007058202000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)
syz_usb_ep_read(r0, 0x1, 0x27, &(0x7f0000000400))
syz_usb_ep_write(r0, 0x82, 0x27, &(0x7f0000000500)='\'\'\x00'/39)
syz_usb_ep_write(r0, 0x82, 0x27, &(0x7f0000000600)='\'#\x00'/39)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_clone(0x0, &(0x7f0000ff0000), 0x0, &(0x7f0000000000), &(0x7f0000000004), &(0x7f0000000008))
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000100)={0x0, &(0x7f0000000200)=[@enable_nested, @nested_create_vm={0x0}, @nested_intel_vmwrite_mask={0x0, 0x0, {0x0, @control32=0x401e, 0x0, 0x80}}, @nested_load_code={0x0, 0x0, {0x0, '9090c3'}}, @nested_vmlaunch={0x0}, @uexit], 0x30})
mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x11, r3, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x400000, &(0x7f000000c000/0x400000)=nil})
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='0x0525', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='0xa4a7', 0x6)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='000001', 0x6)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/acm.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff)
symlinkat(&(0x7f0000000440)='./config/usb_gadget/g1/functions/acm.usb0\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/configs/c.1/acm.usb0\x00')
r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r3, &(0x7f0000000540)='dummy_udc.0', 0xb)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000580)='./dev\x00', &(0x7f00000005c0)='devtmpfs\x00', 0x0, 0x0)
nanosleep(&(0x7f0000000600)={0x0, 0x1dcd6500}, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./dev/ttyGS0\x00', 0x2, 0x0)
ioctl$TCSBRK(r4, 0x5409, 0x0)
ioctl$TIOCSBRK(r4, 0x5427)
ioctl$TIOCCBRK(r4, 0x5428)
executing program 2:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000004c0)={0x0, 0x1, 0x6, 0x3, 0x0, 0x0, {0x2}, [@IPSET_ATTR_PROTOCOL]}}, 0x1, 0x0, 0x0, 0x810}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mysys\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./mysys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, &(0x7f0000000140))
openat(0xffffffffffffff9c, &(0x7f0000000180)='./mysys/class/i2c-dev/i2c-1/device/new_device\x00', 0x1, 0x0)
executing program 2:
mkdir(&(0x7f00000000c0)='./dev\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/ubi0\x00', 0x42, 0x1ff)
ioctl(r0, 0x40982f00, &(0x7f0000000140)="ffffffff0100000000001000000000000300040000000000766f6c3000"/160)
executing program 2:
r0 = socket$inet_icmp(0x2, 0x2, 0x1)
close(r0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$sock_timeval(r2, 0x1, 0x14, &(0x7f0000000100)={0x1, 0x30d40}, 0x10)
sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000004c0)={0x6c, 0x2, 0x6, 0x3, 0x0, 0x0, {0x2}, [@IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x1}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x2}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x4000}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}]}, 0x6c}, 0x1, 0x0, 0x0, 0x810}, 0x20004000)
recvmsg(r2, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0)
sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x64, 0x9, 0x6, 0x3, 0x0, 0x0, {0x2}, [@IPSET_ATTR_DATA={0x3c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @private=0xa010100}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x1388}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x3a98}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x6}, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x1}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x64}, 0x1, 0x0, 0x0, 0x810}, 0x20004000)
recvmsg(r2, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0)
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./my_debugfs\x00', 0x0)
mount(0x0, &(0x7f0000000440)='./my_debugfs\x00', &(0x7f0000000480)='debugfs\x00', 0x0, 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000004c0)='./my_debugfs\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000500)=""/1024, 0x400)
executing program 3:
r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0xb, 0x2)
ioctl$USBDEVFS_GET_CAPABILITIES(r0, 0x8004551a, &(0x7f0000000100))
r1 = syz_open_dev$usbfs(&(0x7f0000000200), 0xc, 0x2)
ioctl$USBDEVFS_GET_CAPABILITIES(r1, 0x8004551a, &(0x7f0000000100))
r2 = syz_open_dev$usbfs(&(0x7f0000000300), 0x15, 0x2)
ioctl$USBDEVFS_GET_CAPABILITIES(r2, 0x8004551a, &(0x7f0000000100))
r3 = syz_open_dev$usbfs(&(0x7f0000000400), 0x16, 0x2)
ioctl$USBDEVFS_GET_CAPABILITIES(r3, 0x8004551a, &(0x7f0000000100))
executing program 1:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407f1800010001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0)
executing program 0:
r0 = syz_usb_connect(0x1, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000083a0846100000010203010902270001010580000904000003ff0000050705810240000000070502024000000007058303080001"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
nanosleep(&(0x7f0000000700)={0x1}, 0x0)
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000800)={'syzkaller0\x00', 0x101})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/usb/drivers/btusb/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/vhci/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/hci_vhci/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/serdev/drivers/hci_serdev/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/serdev/drivers/hci_uart/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/hci_uart/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/drivers/btintel/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/serial8250/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/usb/drivers/usb/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/usb/drivers/hub/unbind\x00', 0x1, 0x0)
openat$snapshot(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
executing program 1:
syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000403419060700010102030109022700010100a0320904000003ff0000000705810200020007050202000200070583030a0001"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/ttyUSB0\x00', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/usb/drivers/f81232/1-1:1.0/power/control\x00', 0x2, 0x0)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 4 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-mkdirat-mount-openat-openat
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000403419060700010102030109022700010100a0320904000003ff0000000705810200020007050202000200070583030a0001"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/ttyUSB0\x00', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/usb/drivers/f81232/1-1:1.0/power/control\x00', 0x2, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-openat-openat-openat-openat-openat-openat-openat-openat-openat$snapshot
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/usb/drivers/btusb/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/vhci/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/hci_vhci/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/serdev/drivers/hci_serdev/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/serdev/drivers/hci_uart/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/hci_uart/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/drivers/btintel/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/serial8250/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/usb/drivers/usb/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/usb/drivers/hub/unbind\x00', 0x1, 0x0)
openat$snapshot(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-nanosleep-socket$inet-ioctl$sock_inet_SIOCSIFFLAGS
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x1, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000083a0846100000010203010902270001010580000904000003ff0000050705810240000000070502024000000007058303080001"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
nanosleep(&(0x7f0000000700)={0x1}, 0x0)
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000800)={'syzkaller0\x00', 0x101})

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-ioctl$USBDEVFS_GET_CAPABILITIES-syz_open_dev$usbfs-ioctl$USBDEVFS_GET_CAPABILITIES-syz_open_dev$usbfs-ioctl$USBDEVFS_GET_CAPABILITIES-syz_open_dev$usbfs-ioctl$USBDEVFS_GET_CAPABILITIES
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0xb, 0x2)
ioctl$USBDEVFS_GET_CAPABILITIES(r0, 0x8004551a, &(0x7f0000000100))
r1 = syz_open_dev$usbfs(&(0x7f0000000200), 0xc, 0x2)
ioctl$USBDEVFS_GET_CAPABILITIES(r1, 0x8004551a, &(0x7f0000000100))
r2 = syz_open_dev$usbfs(&(0x7f0000000300), 0x15, 0x2)
ioctl$USBDEVFS_GET_CAPABILITIES(r2, 0x8004551a, &(0x7f0000000100))
r3 = syz_open_dev$usbfs(&(0x7f0000000400), 0x16, 0x2)
ioctl$USBDEVFS_GET_CAPABILITIES(r3, 0x8004551a, &(0x7f0000000100))

program did not crash
single: failed to extract reproducer
bisect: bisecting 18 programs with base timeout 1m40s
testing program (duration=1m44s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 6, 38, 6, 5, 5, 8, 27, 2, 3, 3, 9, 5, 8, 1, 7, 13, 6]
detailed listing:
executing program 1:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040341902120001000000010902270001010080320904000003ffffff00070581020002000705010200020007058203400001"], 0x0)
syz_usb_control_io(r0, &(0x7f0000000100)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000200)={0x84, &(0x7f0000000300)={0x40, 0xc0, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, &(0x7f0000000100), &(0x7f0000000200)) (async)
syz_usb_control_io(r0, &(0x7f0000000100), &(0x7f0000000200)) (async)
syz_usb_control_io(r0, &(0x7f0000000100), &(0x7f0000000200))
syz_usb_control_io(r0, &(0x7f0000000100), &(0x7f0000000200))
syz_usb_control_io(r0, &(0x7f0000000100), &(0x7f0000000200))
syz_usb_control_io(r0, &(0x7f0000000100), &(0x7f0000000200))
syz_usb_control_io(r0, &(0x7f0000000100), &(0x7f0000000200))
syz_usb_control_io(r0, &(0x7f0000000100), &(0x7f0000000200))
syz_usb_control_io(r0, &(0x7f0000000100), &(0x7f0000000200))
syz_usb_control_io(r0, &(0x7f0000000100), &(0x7f0000000200))
syz_usb_control_io(r0, &(0x7f0000000100), &(0x7f0000000200))
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040c40700a000000102030109022000010100c00009040000020806ff000705010240000007058202400000"], 0x0)
nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0)
r0 = syz_open_dev$sg(&(0x7f0000000200), 0x2, 0x2)
r1 = syz_open_dev$sg(&(0x7f0000000240), 0x3, 0x2)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000300)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000000400)}, &(0x7f0000000500)="2a000000000000000100", &(0x7f0000000600), 0x2710, 0x0, 0x0, 0x0})
ioctl$SG_IO(r1, 0x2285, &(0x7f0000000300)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000000400)}, &(0x7f0000000500)="2a000000000000000100", &(0x7f0000000600), 0x2710, 0x0, 0x0, 0x0})
executing program 3:
mkdir(&(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='0x1d6b\n', 0x7)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, &(0x7f0000000700)='0x0104\n', 0x7)
close(r1)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a00)='fedcba9876543210\n', 0x11)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./config/usb_gadget/g1/strings/0x409/manufacturer\x00', 0x1, 0x0)
write(r3, &(0x7f0000000c00)='Linux Foundation\n', 0x11)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000d00)='./config/usb_gadget/g1/strings/0x409/product\x00', 0x1, 0x0)
write(r4, &(0x7f0000000e00)='Multifunction Gadget\n', 0x15)
close(r4)
mkdir(&(0x7f0000000f00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdir(&(0x7f0000001000)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000001100)='./config/usb_gadget/g1/configs/c.1/strings/0x409/configuration\x00', 0x1, 0x0)
write(r5, &(0x7f0000001200)='Conf 1\n', 0x7)
close(r5)
mkdir(&(0x7f0000001300)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff)
r6 = openat(0xffffffffffffff9c, &(0x7f0000001c00)='./config/usb_gadget/g1/functions/ecm.usb0/ifname\x00', 0x1, 0x0)
write(r6, &(0x7f0000001d00)='syzkaller%d\x00', 0xc)
close(r6)
symlink(&(0x7f0000001400)='./config/usb_gadget/g1/functions/ecm.usb0\x00', &(0x7f0000001500)='./config/usb_gadget/g1/configs/c.1/ecm.usb0\x00')
r7 = openat(0xffffffffffffff9c, &(0x7f0000001600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r7, &(0x7f0000001700)='dummy_udc.0\n', 0xc)
close(r7)
nanosleep(&(0x7f0000002000)={0x0, 0x1dcd6501}, 0x0)
r8 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000001800)={'syzkaller0\x00', <r9=>0x0})
ioctl$sock_inet_SIOCSIFFLAGS(r8, 0x8914, &(0x7f0000001900)={'syzkaller0\x00', 0x1})
bind$packet(r8, &(0x7f0000001a00)={0x11, 0x300, r9, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14)
write(r8, &(0x7f0000001b00)="0102030405060708090a0b0c0d0e0f11", 0x10)
executing program 2:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0)
syz_usb_disconnect(0x0)
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a00e58680001000000010902270001010080320904000003ff000000070581024000000705020240000007058303400001"], 0x0)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_ep_write(r0, 0x83, 0x8, &(0x7f0000000200)="000003434c000000")
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040fd0b0b000001010203010902200001010080320904000002ff0000000705010200020007058202000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)
syz_usb_ep_read(r0, 0x1, 0x27, &(0x7f0000000400))
syz_usb_ep_write(r0, 0x82, 0x27, &(0x7f0000000500)='\'\'\x00'/39)
syz_usb_ep_write(r0, 0x82, 0x27, &(0x7f0000000600)='\'#\x00'/39)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_clone(0x0, &(0x7f0000ff0000), 0x0, &(0x7f0000000000), &(0x7f0000000004), &(0x7f0000000008))
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000100)={0x0, &(0x7f0000000200)=[@enable_nested, @nested_create_vm={0x0}, @nested_intel_vmwrite_mask={0x0, 0x0, {0x0, @control32=0x401e, 0x0, 0x80}}, @nested_load_code={0x0, 0x0, {0x0, '9090c3'}}, @nested_vmlaunch={0x0}, @uexit], 0x30})
mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x11, r3, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x400000, &(0x7f000000c000/0x400000)=nil})
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='0x0525', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='0xa4a7', 0x6)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='000001', 0x6)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/acm.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff)
symlinkat(&(0x7f0000000440)='./config/usb_gadget/g1/functions/acm.usb0\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/configs/c.1/acm.usb0\x00')
r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r3, &(0x7f0000000540)='dummy_udc.0', 0xb)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000580)='./dev\x00', &(0x7f00000005c0)='devtmpfs\x00', 0x0, 0x0)
nanosleep(&(0x7f0000000600)={0x0, 0x1dcd6500}, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./dev/ttyGS0\x00', 0x2, 0x0)
ioctl$TCSBRK(r4, 0x5409, 0x0)
ioctl$TIOCSBRK(r4, 0x5427)
ioctl$TIOCCBRK(r4, 0x5428)
executing program 2:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000004c0)={0x0, 0x1, 0x6, 0x3, 0x0, 0x0, {0x2}, [@IPSET_ATTR_PROTOCOL]}}, 0x1, 0x0, 0x0, 0x810}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mysys\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./mysys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, &(0x7f0000000140))
openat(0xffffffffffffff9c, &(0x7f0000000180)='./mysys/class/i2c-dev/i2c-1/device/new_device\x00', 0x1, 0x0)
executing program 2:
mkdir(&(0x7f00000000c0)='./dev\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/ubi0\x00', 0x42, 0x1ff)
ioctl(r0, 0x40982f00, &(0x7f0000000140)="ffffffff0100000000001000000000000300040000000000766f6c3000"/160)
executing program 2:
r0 = socket$inet_icmp(0x2, 0x2, 0x1)
close(r0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$sock_timeval(r2, 0x1, 0x14, &(0x7f0000000100)={0x1, 0x30d40}, 0x10)
sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000004c0)={0x6c, 0x2, 0x6, 0x3, 0x0, 0x0, {0x2}, [@IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x1}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x2}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x4000}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}]}, 0x6c}, 0x1, 0x0, 0x0, 0x810}, 0x20004000)
recvmsg(r2, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0)
sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x64, 0x9, 0x6, 0x3, 0x0, 0x0, {0x2}, [@IPSET_ATTR_DATA={0x3c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @private=0xa010100}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x1388}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x3a98}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x6}, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x1}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x64}, 0x1, 0x0, 0x0, 0x810}, 0x20004000)
recvmsg(r2, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0)
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./my_debugfs\x00', 0x0)
mount(0x0, &(0x7f0000000440)='./my_debugfs\x00', &(0x7f0000000480)='debugfs\x00', 0x0, 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000004c0)='./my_debugfs\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000500)=""/1024, 0x400)
executing program 3:
r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0xb, 0x2)
ioctl$USBDEVFS_GET_CAPABILITIES(r0, 0x8004551a, &(0x7f0000000100))
r1 = syz_open_dev$usbfs(&(0x7f0000000200), 0xc, 0x2)
ioctl$USBDEVFS_GET_CAPABILITIES(r1, 0x8004551a, &(0x7f0000000100))
r2 = syz_open_dev$usbfs(&(0x7f0000000300), 0x15, 0x2)
ioctl$USBDEVFS_GET_CAPABILITIES(r2, 0x8004551a, &(0x7f0000000100))
r3 = syz_open_dev$usbfs(&(0x7f0000000400), 0x16, 0x2)
ioctl$USBDEVFS_GET_CAPABILITIES(r3, 0x8004551a, &(0x7f0000000100))
executing program 1:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407f1800010001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0)
executing program 0:
r0 = syz_usb_connect(0x1, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000083a0846100000010203010902270001010580000904000003ff0000050705810240000000070502024000000007058303080001"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
nanosleep(&(0x7f0000000700)={0x1}, 0x0)
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000800)={'syzkaller0\x00', 0x101})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/usb/drivers/btusb/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/vhci/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/hci_vhci/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/serdev/drivers/hci_serdev/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/serdev/drivers/hci_uart/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/hci_uart/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/drivers/btintel/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/serial8250/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/usb/drivers/usb/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/usb/drivers/hub/unbind\x00', 0x1, 0x0)
openat$snapshot(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
executing program 1:
syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000403419060700010102030109022700010100a0320904000003ff0000000705810200020007050202000200070583030a0001"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/ttyUSB0\x00', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/usb/drivers/f81232/1-1:1.0/power/control\x00', 0x2, 0x0)

program crashed: WARNING in usb_free_urb
bisect: bisecting 18 programs
bisect: split chunks (needed=false): <18>
bisect: split chunk #0 of len 18 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=1m43s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 27, 2, 3, 3, 9, 5, 8, 1, 7, 13, 6]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000100)={0x0, &(0x7f0000000200)=[@enable_nested, @nested_create_vm={0x0}, @nested_intel_vmwrite_mask={0x0, 0x0, {0x0, @control32=0x401e, 0x0, 0x80}}, @nested_load_code={0x0, 0x0, {0x0, '9090c3'}}, @nested_vmlaunch={0x0}, @uexit], 0x30})
mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x11, r3, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x400000, &(0x7f000000c000/0x400000)=nil})
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='0x0525', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='0xa4a7', 0x6)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='000001', 0x6)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/acm.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff)
symlinkat(&(0x7f0000000440)='./config/usb_gadget/g1/functions/acm.usb0\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/configs/c.1/acm.usb0\x00')
r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r3, &(0x7f0000000540)='dummy_udc.0', 0xb)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000580)='./dev\x00', &(0x7f00000005c0)='devtmpfs\x00', 0x0, 0x0)
nanosleep(&(0x7f0000000600)={0x0, 0x1dcd6500}, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./dev/ttyGS0\x00', 0x2, 0x0)
ioctl$TCSBRK(r4, 0x5409, 0x0)
ioctl$TIOCSBRK(r4, 0x5427)
ioctl$TIOCCBRK(r4, 0x5428)
executing program 2:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000004c0)={0x0, 0x1, 0x6, 0x3, 0x0, 0x0, {0x2}, [@IPSET_ATTR_PROTOCOL]}}, 0x1, 0x0, 0x0, 0x810}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mysys\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./mysys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, &(0x7f0000000140))
openat(0xffffffffffffff9c, &(0x7f0000000180)='./mysys/class/i2c-dev/i2c-1/device/new_device\x00', 0x1, 0x0)
executing program 2:
mkdir(&(0x7f00000000c0)='./dev\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/ubi0\x00', 0x42, 0x1ff)
ioctl(r0, 0x40982f00, &(0x7f0000000140)="ffffffff0100000000001000000000000300040000000000766f6c3000"/160)
executing program 2:
r0 = socket$inet_icmp(0x2, 0x2, 0x1)
close(r0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$sock_timeval(r2, 0x1, 0x14, &(0x7f0000000100)={0x1, 0x30d40}, 0x10)
sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000004c0)={0x6c, 0x2, 0x6, 0x3, 0x0, 0x0, {0x2}, [@IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x1}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x2}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x4000}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}]}, 0x6c}, 0x1, 0x0, 0x0, 0x810}, 0x20004000)
recvmsg(r2, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0)
sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x64, 0x9, 0x6, 0x3, 0x0, 0x0, {0x2}, [@IPSET_ATTR_DATA={0x3c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @private=0xa010100}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x1388}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x3a98}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x6}, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x1}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x64}, 0x1, 0x0, 0x0, 0x810}, 0x20004000)
recvmsg(r2, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0)
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./my_debugfs\x00', 0x0)
mount(0x0, &(0x7f0000000440)='./my_debugfs\x00', &(0x7f0000000480)='debugfs\x00', 0x0, 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000004c0)='./my_debugfs\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000500)=""/1024, 0x400)
executing program 3:
r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0xb, 0x2)
ioctl$USBDEVFS_GET_CAPABILITIES(r0, 0x8004551a, &(0x7f0000000100))
r1 = syz_open_dev$usbfs(&(0x7f0000000200), 0xc, 0x2)
ioctl$USBDEVFS_GET_CAPABILITIES(r1, 0x8004551a, &(0x7f0000000100))
r2 = syz_open_dev$usbfs(&(0x7f0000000300), 0x15, 0x2)
ioctl$USBDEVFS_GET_CAPABILITIES(r2, 0x8004551a, &(0x7f0000000100))
r3 = syz_open_dev$usbfs(&(0x7f0000000400), 0x16, 0x2)
ioctl$USBDEVFS_GET_CAPABILITIES(r3, 0x8004551a, &(0x7f0000000100))
executing program 1:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407f1800010001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0)
executing program 0:
r0 = syz_usb_connect(0x1, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000083a0846100000010203010902270001010580000904000003ff0000050705810240000000070502024000000007058303080001"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
nanosleep(&(0x7f0000000700)={0x1}, 0x0)
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000800)={'syzkaller0\x00', 0x101})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/usb/drivers/btusb/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/vhci/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/hci_vhci/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/serdev/drivers/hci_serdev/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/serdev/drivers/hci_uart/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/hci_uart/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/drivers/btintel/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/serial8250/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/usb/drivers/usb/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/usb/drivers/hub/unbind\x00', 0x1, 0x0)
openat$snapshot(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
executing program 1:
syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000403419060700010102030109022700010100a0320904000003ff0000000705810200020007050202000200070583030a0001"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/ttyUSB0\x00', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/usb/drivers/f81232/1-1:1.0/power/control\x00', 0x2, 0x0)

program crashed: WARNING in enable_work
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/3
testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 8, 1, 7, 13, 6]
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./my_debugfs\x00', 0x0)
mount(0x0, &(0x7f0000000440)='./my_debugfs\x00', &(0x7f0000000480)='debugfs\x00', 0x0, 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000004c0)='./my_debugfs\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000500)=""/1024, 0x400)
executing program 3:
r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0xb, 0x2)
ioctl$USBDEVFS_GET_CAPABILITIES(r0, 0x8004551a, &(0x7f0000000100))
r1 = syz_open_dev$usbfs(&(0x7f0000000200), 0xc, 0x2)
ioctl$USBDEVFS_GET_CAPABILITIES(r1, 0x8004551a, &(0x7f0000000100))
r2 = syz_open_dev$usbfs(&(0x7f0000000300), 0x15, 0x2)
ioctl$USBDEVFS_GET_CAPABILITIES(r2, 0x8004551a, &(0x7f0000000100))
r3 = syz_open_dev$usbfs(&(0x7f0000000400), 0x16, 0x2)
ioctl$USBDEVFS_GET_CAPABILITIES(r3, 0x8004551a, &(0x7f0000000100))
executing program 1:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407f1800010001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0)
executing program 0:
r0 = syz_usb_connect(0x1, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000083a0846100000010203010902270001010580000904000003ff0000050705810240000000070502024000000007058303080001"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
nanosleep(&(0x7f0000000700)={0x1}, 0x0)
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000800)={'syzkaller0\x00', 0x101})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/usb/drivers/btusb/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/vhci/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/hci_vhci/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/serdev/drivers/hci_serdev/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/serdev/drivers/hci_uart/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/hci_uart/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/drivers/btintel/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/serial8250/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/usb/drivers/usb/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/usb/drivers/hub/unbind\x00', 0x1, 0x0)
openat$snapshot(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
executing program 1:
syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000403419060700010102030109022700010100a0320904000003ff0000000705810200020007050202000200070583030a0001"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/ttyUSB0\x00', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/usb/drivers/f81232/1-1:1.0/power/control\x00', 0x2, 0x0)

program crashed: WARNING in usb_free_urb
bisect: the chunk can be dropped
bisect: testing without sub-chunk 3/3
bisect: split chunks (needed=true): <6>
bisect: split chunk #0 of len 6 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 13, 6]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x1, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000083a0846100000010203010902270001010580000904000003ff0000050705810240000000070502024000000007058303080001"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
nanosleep(&(0x7f0000000700)={0x1}, 0x0)
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000800)={'syzkaller0\x00', 0x101})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/usb/drivers/btusb/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/vhci/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/hci_vhci/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/serdev/drivers/hci_serdev/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/serdev/drivers/hci_uart/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/hci_uart/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/drivers/btintel/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/serial8250/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/usb/drivers/usb/unbind\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/usb/drivers/hub/unbind\x00', 0x1, 0x0)
openat$snapshot(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
executing program 1:
syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000403419060700010102030109022700010100a0320904000003ff0000000705810200020007050202000200070583030a0001"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/ttyUSB0\x00', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/usb/drivers/f81232/1-1:1.0/power/control\x00', 0x2, 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 8, 1]
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./my_debugfs\x00', 0x0)
mount(0x0, &(0x7f0000000440)='./my_debugfs\x00', &(0x7f0000000480)='debugfs\x00', 0x0, 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000004c0)='./my_debugfs\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000500)=""/1024, 0x400)
executing program 3:
r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0xb, 0x2)
ioctl$USBDEVFS_GET_CAPABILITIES(r0, 0x8004551a, &(0x7f0000000100))
r1 = syz_open_dev$usbfs(&(0x7f0000000200), 0xc, 0x2)
ioctl$USBDEVFS_GET_CAPABILITIES(r1, 0x8004551a, &(0x7f0000000100))
r2 = syz_open_dev$usbfs(&(0x7f0000000300), 0x15, 0x2)
ioctl$USBDEVFS_GET_CAPABILITIES(r2, 0x8004551a, &(0x7f0000000100))
r3 = syz_open_dev$usbfs(&(0x7f0000000400), 0x16, 0x2)
ioctl$USBDEVFS_GET_CAPABILITIES(r3, 0x8004551a, &(0x7f0000000100))
executing program 1:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407f1800010001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0)

program crashed: WARNING in usb_free_urb
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <3>
bisect: split chunk #0 of len 3 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 1:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407f1800010001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0)

program crashed: WARNING in corrupted
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 1 programs left: 

executing program 1:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407f1800010001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0)


bisect: trying to concatenate
bisect: concatenate 1 entries
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407f1800010001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0)

program crashed: WARNING in usb_free_urb
bisect: concatenation succeeded
found reproducer with 1 syscalls
minimizing guilty program
testing program (duration=1m25.783213756s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, 0x0, 0x0)

program did not crash
testing program (duration=1m25.783213756s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m25.783213756s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program did not crash
simplifying guilty program options
testing program (duration=1m25.783213756s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407f1800010001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0)

program crashed: WARNING in corrupted
extracting C reproducer
testing compiled C program (duration=1m25.783213756s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program did not crash
testing program (duration=1m25.783213756s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407f1800010001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0)

program crashed: WARNING in usb_free_urb
extracting C reproducer
testing compiled C program (duration=1m25.783213756s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program did not crash
testing program (duration=1m25.783213756s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407f1800010001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0)

program crashed: WARNING in usb_free_urb
validation run: crashed=true
testing program (duration=1m25.783213756s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407f1800010001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0)

program crashed: WARNING in usb_free_urb
validation run: crashed=true
testing program (duration=1m25.783213756s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407f1800010001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0)

program crashed: WARNING in usb_free_urb
validation run: crashed=true
reproducing took 54m41.726016353s
repro crashed as (corrupted=false):
------------[ cut here ]------------
!PageLargeKmalloc(page)
WARNING: mm/slub.c:6724 at free_large_kmalloc+0x97/0x110 mm/slub.c:6724, CPU#0: kworker/0:1/10
Modules linked in:
CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: usb_hub_wq hub_event
RIP: 0010:free_large_kmalloc+0x97/0x110 mm/slub.c:6724
Code: 8b 43 30 83 f8 ff 74 13 25 00 00 00 ff 3d 00 00 00 f8 75 7a c7 43 30 ff ff ff ff 48 89 df 89 ee 5b 41 5e 5d e9 4a af fc ff 90 <0f> 0b 90 48 89 df 48 c7 c6 c7 10 5a 8e 5b 41 5e 5d e9 93 ed fb fe
RSP: 0018:ffffc900000f6b08 EFLAGS: 00010206
RAX: 00000000ff000000 RBX: ffffea000187fc40 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffff888061ff1000 RDI: ffffea000187fc40
RBP: 0000000000000000 R08: ffff88807524d303 R09: 1ffff1100ea49a60
R10: dffffc0000000000 R11: ffffed100ea49a61 R12: 1ffff1100643ae82
R13: ffff88802b0f3b80 R14: ffff88807524d360 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff88812488f000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f718f270000 CR3: 0000000078202000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 urb_destroy drivers/usb/core/urb.c:25 [inline]
 kref_put include/linux/kref.h:65 [inline]
 usb_free_urb+0xd0/0x120 drivers/usb/core/urb.c:96
 smsusb_term_device+0x1d0/0x3d0 drivers/media/usb/siano/smsusb.c:352
 smsusb_init_device drivers/media/usb/siano/smsusb.c:497 [inline]
 smsusb_probe+0x1aba/0x2280 drivers/media/usb/siano/smsusb.c:575
 usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3776
 usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268
 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3776
 usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2708
 hub_port_connect drivers/usb/core/hub.c:5580 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5720 [inline]
 port_event drivers/usb/core/hub.c:5884 [inline]
 hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5966
 process_one_work kernel/workqueue.c:3387 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3470
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3551
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

final repro crashed as (corrupted=false):
------------[ cut here ]------------
!PageLargeKmalloc(page)
WARNING: mm/slub.c:6724 at free_large_kmalloc+0x97/0x110 mm/slub.c:6724, CPU#0: kworker/0:1/10
Modules linked in:
CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: usb_hub_wq hub_event
RIP: 0010:free_large_kmalloc+0x97/0x110 mm/slub.c:6724
Code: 8b 43 30 83 f8 ff 74 13 25 00 00 00 ff 3d 00 00 00 f8 75 7a c7 43 30 ff ff ff ff 48 89 df 89 ee 5b 41 5e 5d e9 4a af fc ff 90 <0f> 0b 90 48 89 df 48 c7 c6 c7 10 5a 8e 5b 41 5e 5d e9 93 ed fb fe
RSP: 0018:ffffc900000f6b08 EFLAGS: 00010206
RAX: 00000000ff000000 RBX: ffffea000187fc40 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffff888061ff1000 RDI: ffffea000187fc40
RBP: 0000000000000000 R08: ffff88807524d303 R09: 1ffff1100ea49a60
R10: dffffc0000000000 R11: ffffed100ea49a61 R12: 1ffff1100643ae82
R13: ffff88802b0f3b80 R14: ffff88807524d360 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff88812488f000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f718f270000 CR3: 0000000078202000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 urb_destroy drivers/usb/core/urb.c:25 [inline]
 kref_put include/linux/kref.h:65 [inline]
 usb_free_urb+0xd0/0x120 drivers/usb/core/urb.c:96
 smsusb_term_device+0x1d0/0x3d0 drivers/media/usb/siano/smsusb.c:352
 smsusb_init_device drivers/media/usb/siano/smsusb.c:497 [inline]
 smsusb_probe+0x1aba/0x2280 drivers/media/usb/siano/smsusb.c:575
 usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3776
 usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268
 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3776
 usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2708
 hub_port_connect drivers/usb/core/hub.c:5580 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5720 [inline]
 port_event drivers/usb/core/hub.c:5884 [inline]
 hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5966
 process_one_work kernel/workqueue.c:3387 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3470
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3551
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>