Extracting prog: 7m8.535221215s
Minimizing prog: 1h36m0.617906351s
Simplifying prog options: 14m59.647052142s
Extracting C: 5m35.402910932s
Simplifying C: 0s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_usb_connect-openat-mount$fuse
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x2, 0x4e, &(0x7f0000000500)=ANY=[@ANYBLOB="12010002ff000040cd06310100010102030109023c00010100a0320904000006"], &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0})
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x2, 0x0)
mount$fuse(0x0, 0x0, 0x0, 0x2200453, 0x0)

program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_usb_connect-openat-mount$fuse
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x2, 0x4e, &(0x7f0000000500)=ANY=[@ANYBLOB="12010002ff000040cd06310100010102030109023c00010100a0320904000006"], &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0})
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x2, 0x0)
mount$fuse(0x0, 0x0, 0x0, 0x2200453, 0x0)

program crashed: BUG: corrupted list in usb_hcd_link_urb_to_ep
single: successfully extracted reproducer
found reproducer with 5 syscalls
minimizing guilty program
testing program (duration=8m26.190383623s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_usb_connect-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x2, 0x4e, &(0x7f0000000500)=ANY=[@ANYBLOB="12010002ff000040cd06310100010102030109023c00010100a0320904000006"], &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0})
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x2, 0x0)

program crashed: BUG: corrupted list in usb_hcd_link_urb_to_ep
testing program (duration=8m26.190383623s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_usb_connect
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x2, 0x4e, &(0x7f0000000500)=ANY=[@ANYBLOB="12010002ff000040cd06310100010102030109023c00010100a0320904000006"], &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=8m26.190383623s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x2, 0x0)

program did not crash
testing program (duration=8m26.190383623s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-syz_usb_connect-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
syz_usb_connect(0x2, 0x4e, &(0x7f0000000500)=ANY=[@ANYBLOB="12010002ff000040cd06310100010102030109023c00010100a0320904000006"], &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0})
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x2, 0x0)

program did not crash
testing program (duration=8m26.190383623s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-syz_usb_connect-openat
detailed listing:
executing program 0:
mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x2, 0x4e, &(0x7f0000000500)=ANY=[@ANYBLOB="12010002ff000040cd06310100010102030109023c00010100a0320904000006"], &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0})
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x2, 0x0)

program did not crash
testing program (duration=8m26.190383623s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_usb_connect-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x2, 0x4e, &(0x7f0000000500)=ANY=[@ANYBLOB="12010002ff000040cd06310100010102030109023c00010100a0320904000006"], &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0})
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x2, 0x0)

program did not crash
testing program (duration=8m26.190383623s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_usb_connect-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x2, 0x4e, &(0x7f0000000500)=ANY=[@ANYBLOB="12010002ff000040cd06310100010102030109023c00010100a0320904000006"], &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0})
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x2, 0x0)

program did not crash
testing program (duration=8m26.190383623s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_usb_connect-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000300)='./dev\x00', 0x0, 0x0, 0x0)
syz_usb_connect(0x2, 0x4e, &(0x7f0000000500)=ANY=[@ANYBLOB="12010002ff000040cd06310100010102030109023c00010100a0320904000006"], &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0})
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x2, 0x0)

program did not crash
testing program (duration=8m26.190383623s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_usb_connect-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x2, 0x4e, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0})
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x2, 0x0)

program did not crash
testing program (duration=8m26.190383623s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_usb_connect-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x2, 0x4e, &(0x7f0000000500)=ANY=[@ANYBLOB], &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0})
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x2, 0x0)

program did not crash
testing program (duration=8m26.190383623s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_usb_connect-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x2, 0x4e, &(0x7f0000000500)=ANY=[@ANYBLOB="12010002ff000040cd06310100010102030109023c00010100a0320904000006"], 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x2, 0x0)

program did not crash
testing program (duration=8m26.190383623s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_usb_connect-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x2, 0x4e, &(0x7f0000000500)=ANY=[@ANYBLOB="12010002ff000040cd06310100010102030109023c00010100a0320904000006"], &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0})
openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=8m26.190383623s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_usb_connect-openat
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
simplifying guilty program options
testing program (duration=8m26.190383623s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_usb_connect-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x2, 0x4e, &(0x7f0000000500)=ANY=[@ANYBLOB="12010002ff000040cd06310100010102030109023c00010100a0320904000006"], &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0})
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x2, 0x0)

program crashed: BUG: corrupted list in usb_hcd_link_urb_to_ep
extracting C reproducer
testing compiled C program (duration=8m26.190383623s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_usb_connect-openat
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing program (duration=8m26.190383623s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_usb_connect-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x2, 0x4e, &(0x7f0000000500)=ANY=[@ANYBLOB="12010002ff000040cd06310100010102030109023c00010100a0320904000006"], &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0})
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x2, 0x0)

program did not crash
testing program (duration=8m26.190383623s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_usb_connect-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x2, 0x4e, &(0x7f0000000500)=ANY=[@ANYBLOB="12010002ff000040cd06310100010102030109023c00010100a0320904000006"], &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0})
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x2, 0x0)

program did not crash
validation run: crashed=false
testing program (duration=8m26.190383623s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_usb_connect-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x2, 0x4e, &(0x7f0000000500)=ANY=[@ANYBLOB="12010002ff000040cd06310100010102030109023c00010100a0320904000006"], &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0})
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x2, 0x0)

program did not crash
validation run: crashed=false
testing program (duration=8m26.190383623s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_usb_connect-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x2, 0x4e, &(0x7f0000000500)=ANY=[@ANYBLOB="12010002ff000040cd06310100010102030109023c00010100a0320904000006"], &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0})
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x2, 0x0)

program did not crash
validation run: crashed=false
testing program (duration=8m26.190383623s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_usb_connect-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x2, 0x4e, &(0x7f0000000500)=ANY=[@ANYBLOB="12010002ff000040cd06310100010102030109023c00010100a0320904000006"], &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0})
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x2, 0x0)

program crashed: BUG: corrupted list in usb_hcd_link_urb_to_ep
validation run: crashed=true
testing program (duration=8m26.190383623s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_usb_connect-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x2, 0x4e, &(0x7f0000000500)=ANY=[@ANYBLOB="12010002ff000040cd06310100010102030109023c00010100a0320904000006"], &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0})
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x2, 0x0)

program crashed: BUG: corrupted list in usb_hcd_link_urb_to_ep
validation run: crashed=true
testing program (duration=8m26.190383623s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_usb_connect-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x2, 0x4e, &(0x7f0000000500)=ANY=[@ANYBLOB="12010002ff000040cd06310100010102030109023c00010100a0320904000006"], &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0})
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x2, 0x0)

program crashed: BUG: corrupted list in usb_hcd_link_urb_to_ep
validation run: crashed=true
reproducing took 2h40m10.440320246s
repro crashed as (corrupted=false):
list_add double add: new=ffff0000c8eee218, prev=ffff0000c8eee218, next=ffff0000da3be078.
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:37!
Internal error: Oops - BUG: 00000000f2000800 [#1]  SMP
Modules linked in:
CPU: 0 UID: 0 PID: 6712 Comm: syz.4.1598 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
pstate: 634000c5 (nZCv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : __list_add_valid_or_report+0xbc/0x148 lib/list_debug.c:35
lr : __list_add_valid_or_report+0xbc/0x148 lib/list_debug.c:35
sp : ffff8000929a7700
x29: ffff8000929a7700 x28: 1fffe0001940c842 x27: 1fffe0001940c880
x26: 1fffe0001b477c10 x25: ffff0000c8eee218 x24: ffff0000da3be080
x23: 1fffe000191ddc43 x22: dfff800000000000 x21: ffff0000c8eee218
x20: ffff0000c8eee218 x19: ffff0000da3be078 x18: 1fffe00034bb7428
x17: 3831326565653863 x16: 3030303066666666 x15: 3d76657270202c38
x14: 3132656565386330 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000003 x9 : 5ffe9f7061c30e00
x8 : 5ffe9f7061c30e00 x7 : ffff80008048e8f8 x6 : 0000000000000000
x5 : 0000000000000001 x4 : 0000000000000000 x3 : ffff800080499634
x2 : 0000000100000002 x1 : ffff0000cc928000 x0 : 0000000000000058
Call trace:
 __list_add_valid_or_report+0xbc/0x148 lib/list_debug.c:35 (P)
 __list_add_valid include/linux/list.h:96 [inline]
 __list_add include/linux/list.h:158 [inline]
 list_add_tail include/linux/list.h:191 [inline]
 usb_hcd_link_urb_to_ep+0x17c/0x2d0 drivers/usb/core/hcd.c:1154
 dummy_urb_enqueue+0x250/0x690 drivers/usb/gadget/udc/dummy_hcd.c:1310
 usb_hcd_submit_urb+0x2dc/0x169c drivers/usb/core/hcd.c:1542
 usb_submit_urb+0xd44/0x1458 drivers/usb/core/urb.c:586
 keyspan_usa49_send_setup+0x780/0xce0 drivers/usb/serial/keyspan.c:2466
 keyspan_send_setup+0x11c/0x178 drivers/usb/serial/keyspan.c:2763
 keyspan_dtr_rts+0x8c/0xdc drivers/usb/serial/keyspan.c:1577
 serial_port_dtr_rts+0x90/0xac drivers/usb/serial/usb-serial.c:768
 tty_port_lower_dtr_rts drivers/tty/tty_port.c:471 [inline]
 tty_port_shutdown+0x130/0x204 drivers/tty/tty_port.c:369
 tty_port_close+0x54/0x110 drivers/tty/tty_port.c:705
 serial_close+0x5c/0xc8 drivers/usb/serial/usb-serial.c:326
 tty_release+0x2c4/0xffc drivers/tty/tty_io.c:1745
 __fput+0x338/0x74c fs/file_table.c:512
 ____fput+0x20/0x30 fs/file_table.c:540
 task_work_run+0x1cc/0x25c kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:70 [inline]
 exit_to_user_mode_loop+0x10c/0x17c kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 arm64_syscall_exit_to_user_mode arch/arm64/kernel/entry-common.c:88 [inline]
 el0_svc+0x18c/0x260 arch/arm64/kernel/entry-common.c:739
 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:757
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590
Code: aa1503e1 aa1403e2 aa1303e3 979c1e5a (d4210000) 
---[ end trace 0000000000000000 ]---

final repro crashed as (corrupted=false):
list_add double add: new=ffff0000c8eee218, prev=ffff0000c8eee218, next=ffff0000da3be078.
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:37!
Internal error: Oops - BUG: 00000000f2000800 [#1]  SMP
Modules linked in:
CPU: 0 UID: 0 PID: 6712 Comm: syz.4.1598 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
pstate: 634000c5 (nZCv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : __list_add_valid_or_report+0xbc/0x148 lib/list_debug.c:35
lr : __list_add_valid_or_report+0xbc/0x148 lib/list_debug.c:35
sp : ffff8000929a7700
x29: ffff8000929a7700 x28: 1fffe0001940c842 x27: 1fffe0001940c880
x26: 1fffe0001b477c10 x25: ffff0000c8eee218 x24: ffff0000da3be080
x23: 1fffe000191ddc43 x22: dfff800000000000 x21: ffff0000c8eee218
x20: ffff0000c8eee218 x19: ffff0000da3be078 x18: 1fffe00034bb7428
x17: 3831326565653863 x16: 3030303066666666 x15: 3d76657270202c38
x14: 3132656565386330 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000003 x9 : 5ffe9f7061c30e00
x8 : 5ffe9f7061c30e00 x7 : ffff80008048e8f8 x6 : 0000000000000000
x5 : 0000000000000001 x4 : 0000000000000000 x3 : ffff800080499634
x2 : 0000000100000002 x1 : ffff0000cc928000 x0 : 0000000000000058
Call trace:
 __list_add_valid_or_report+0xbc/0x148 lib/list_debug.c:35 (P)
 __list_add_valid include/linux/list.h:96 [inline]
 __list_add include/linux/list.h:158 [inline]
 list_add_tail include/linux/list.h:191 [inline]
 usb_hcd_link_urb_to_ep+0x17c/0x2d0 drivers/usb/core/hcd.c:1154
 dummy_urb_enqueue+0x250/0x690 drivers/usb/gadget/udc/dummy_hcd.c:1310
 usb_hcd_submit_urb+0x2dc/0x169c drivers/usb/core/hcd.c:1542
 usb_submit_urb+0xd44/0x1458 drivers/usb/core/urb.c:586
 keyspan_usa49_send_setup+0x780/0xce0 drivers/usb/serial/keyspan.c:2466
 keyspan_send_setup+0x11c/0x178 drivers/usb/serial/keyspan.c:2763
 keyspan_dtr_rts+0x8c/0xdc drivers/usb/serial/keyspan.c:1577
 serial_port_dtr_rts+0x90/0xac drivers/usb/serial/usb-serial.c:768
 tty_port_lower_dtr_rts drivers/tty/tty_port.c:471 [inline]
 tty_port_shutdown+0x130/0x204 drivers/tty/tty_port.c:369
 tty_port_close+0x54/0x110 drivers/tty/tty_port.c:705
 serial_close+0x5c/0xc8 drivers/usb/serial/usb-serial.c:326
 tty_release+0x2c4/0xffc drivers/tty/tty_io.c:1745
 __fput+0x338/0x74c fs/file_table.c:512
 ____fput+0x20/0x30 fs/file_table.c:540
 task_work_run+0x1cc/0x25c kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:70 [inline]
 exit_to_user_mode_loop+0x10c/0x17c kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 arm64_syscall_exit_to_user_mode arch/arm64/kernel/entry-common.c:88 [inline]
 el0_svc+0x18c/0x260 arch/arm64/kernel/entry-common.c:739
 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:757
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590
Code: aa1503e1 aa1403e2 aa1303e3 979c1e5a (d4210000) 
---[ end trace 0000000000000000 ]---