Extracting prog: 4m12.720275508s Minimizing prog: 8m52.813118058s Simplifying prog options: 0s Extracting C: 33.46432247s Simplifying C: 14m10.37522146s extracting reproducer from 30 programs testing a last program of every proc single: executing 5 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$IPCTNL_MSG_EXP_NEW-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-write$uinput_user_dev-openat$kvm-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_SET_REGS-sendmsg$IPCTNL_MSG_EXP_NEW-openat$kvm-ioctl$KVM_RUN-ioctl$KVM_CREATE_VM-dup-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-syz_kvm_setup_cpu$x86-ioctl$KVM_RUN detailed listing: executing program 0: sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)={0x18, 0x0, 0x2, 0x301, 0x0, 0x0, {0x2, 0x0, 0x10}, [@CTA_EXPECT_NAT={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x40810}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a3100000000090003007379"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWRULE={0x20, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x48}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000004, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x5, 0x5, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={0x0, 0xc8}, 0x1, 0x0, 0x0, 0x24000801}, 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io$uac1-syz_usb_control_io$uac1-sendmsg$nl_generic-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x84, &(0x7f0000000000)=ANY=[@ANYBLOB="00000100000022"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYRESOCT, @ANYRES64], 0x14}}, 0x4) syz_usb_control_io(r0, 0x0, &(0x7f00000023c0)={0x84, &(0x7f00000000c0)=ANY=[@ANYBLOB="201104060000000101"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-setresuid-connect$inet6-socket$vsock_stream-set_mempolicy-timer_create-fcntl$lock-mprotect-timer_settime-mmap-socket$inet6_tcp-close-socket$inet6_mptcp-bind$inet6-listen-socket$inet_mptcp-connect$inet-accept-sendmsg$TEAM_CMD_OPTIONS_SET-recvfrom detailed listing: executing program 0: mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setresuid(0x0, 0xee01, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) set_mempolicy(0x3, &(0x7f0000000040)=0x3, 0x40) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r1) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x77c, @empty, 0x1}, 0x1c) listen(r2, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r4 = accept(r1, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[], 0xfffffdef}}, 0x1) recvfrom(r3, 0x0, 0x0, 0x4100, 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000200)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x10c4, 0x8acf, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x13, "", [{{0x9, 0x4, 0x0, 0x4, 0x9, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x9, 0x8, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x40, 0xfd}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000004c0)={0x2c, &(0x7f0000000280)=ANY=[@ANYBLOB="001128"], 0x0, 0x0, 0x0, 0x0}, 0x0) program crashed: general protection fault in u2fzero_rng_read single: successfully extracted reproducer found reproducer with 3 syscalls minimizing guilty program testing program (duration=45.191818116s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000200)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x10c4, 0x8acf, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x13, "", [{{0x9, 0x4, 0x0, 0x4, 0x9, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x9, 0x8, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x40, 0xfd}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) program did not crash testing program (duration=45.191818116s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000200)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x10c4, 0x8acf, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x13, "", [{{0x9, 0x4, 0x0, 0x4, 0x9, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x9, 0x8, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x40, 0xfd}}}}}]}}]}}, 0x0) syz_usb_control_io(r0, &(0x7f00000004c0)={0x2c, &(0x7f0000000280)=ANY=[@ANYBLOB="001128"], 0x0, 0x0, 0x0, 0x0}, 0x0) program did not crash testing program (duration=45.191818116s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_control_io$hid-syz_usb_control_io detailed listing: executing program 0: syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, &(0x7f00000004c0)={0x2c, &(0x7f0000000280)=ANY=[@ANYBLOB="001128"], 0x0, 0x0, 0x0, 0x0}, 0x0) program did not crash testing program (duration=45.191818116s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x2, 0x0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000004c0)={0x2c, &(0x7f0000000280)=ANY=[@ANYBLOB="001128"], 0x0, 0x0, 0x0, 0x0}, 0x0) program did not crash testing program (duration=45.191818116s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000200)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x10c4, 0x8acf, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x13, "", [{{0x9, 0x4, 0x0, 0x4, 0x9, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x9, 0x8, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x40, 0xfd}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) program did not crash testing program (duration=45.191818116s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000200)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x10c4, 0x8acf, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x13, "", [{{0x9, 0x4, 0x0, 0x4, 0x9, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x9, 0x8, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x40, 0xfd}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000004c0)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) program did not crash testing program (duration=45.191818116s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000200)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x10c4, 0x8acf, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x13, "", [{{0x9, 0x4, 0x0, 0x4, 0x9, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x9, 0x8, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x40, 0xfd}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000004c0)={0x2c, &(0x7f0000000280)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0}, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=45.191818116s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io program crashed: general protection fault in u2fzero_rng_read simplifying C reproducer testing compiled C program (duration=45.191818116s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io program crashed: general protection fault in u2fzero_rng_read testing compiled C program (duration=45.191818116s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io program crashed: general protection fault in u2fzero_rng_read testing compiled C program (duration=45.191818116s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io program did not crash testing compiled C program (duration=45.191818116s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io program crashed: general protection fault in u2fzero_rng_read testing compiled C program (duration=45.191818116s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io program crashed: general protection fault in u2fzero_rng_read testing compiled C program (duration=45.191818116s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io program did not crash testing compiled C program (duration=45.191818116s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io program crashed: general protection fault in u2fzero_rng_read testing compiled C program (duration=45.191818116s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io program crashed: general protection fault in u2fzero_rng_read testing compiled C program (duration=45.191818116s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io program did not crash testing compiled C program (duration=45.191818116s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io program did not crash testing compiled C program (duration=45.191818116s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io program crashed: general protection fault in corrupted a never seen crash title: general protection fault in corrupted, ignore testing compiled C program (duration=45.191818116s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io program crashed: general protection fault in u2fzero_rng_read testing compiled C program (duration=45.191818116s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io program crashed: general protection fault in corrupted a never seen crash title: general protection fault in corrupted, ignore testing compiled C program (duration=45.191818116s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:false Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io program crashed: general protection fault in u2fzero_rng_read testing compiled C program (duration=45.191818116s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io program crashed: general protection fault in u2fzero_rng_read testing program (duration=45.191818116s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000200)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x10c4, 0x8acf, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x13, "", [{{0x9, 0x4, 0x0, 0x4, 0x9, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x9, 0x8, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x40, 0xfd}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000004c0)={0x2c, &(0x7f0000000280)=ANY=[@ANYBLOB="001128"], 0x0, 0x0, 0x0, 0x0}, 0x0) program crashed: general protection fault in u2fzero_rng_read validation run: crashed=true testing program (duration=45.191818116s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000200)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x10c4, 0x8acf, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x13, "", [{{0x9, 0x4, 0x0, 0x4, 0x9, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x9, 0x8, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x40, 0xfd}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000004c0)={0x2c, &(0x7f0000000280)=ANY=[@ANYBLOB="001128"], 0x0, 0x0, 0x0, 0x0}, 0x0) program crashed: general protection fault in u2fzero_rng_read validation run: crashed=true testing program (duration=45.191818116s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000200)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x10c4, 0x8acf, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x13, "", [{{0x9, 0x4, 0x0, 0x4, 0x9, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x9, 0x8, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x40, 0xfd}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000004c0)={0x2c, &(0x7f0000000280)=ANY=[@ANYBLOB="001128"], 0x0, 0x0, 0x0, 0x0}, 0x0) program crashed: general protection fault in u2fzero_rng_read validation run: crashed=true reproducing took 30m27.816714187s repro crashed as (corrupted=false): hid-u2fzero 0003:10C4:8ACF.0001: unknown main item tag 0x0 hid-u2fzero 0003:10C4:8ACF.0001: unknown main item tag 0x0 hid-u2fzero 0003:10C4:8ACF.0001: unknown main item tag 0x0 hid-u2fzero 0003:10C4:8ACF.0001: unknown main item tag 0x0 hid-u2fzero 0003:10C4:8ACF.0001: unknown main item tag 0x0 hid-u2fzero 0003:10C4:8ACF.0001: hidraw0: USB HID v0.09 Device [HID 10c4:8acf] on usb-dummy_hcd.0-1/input0 hid-u2fzero 0003:10C4:8ACF.0001: U2F Zero LED initialised general protection fault, probably for non-canonical address 0xdffffc0000000015: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x00000000000000a8-0x00000000000000af] CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: usb_hub_wq hub_event RIP: 0010:u2fzero_recv drivers/hid/hid-u2fzero.c:116 [inline] RIP: 0010:u2fzero_rng_read+0x23e/0x710 drivers/hid/hid-u2fzero.c:202 Code: 24 74 0d 48 8b 3c 24 e8 20 5b 4b fa 48 8b 04 24 41 bf a8 00 00 00 4c 03 38 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ff e8 74 5b 4b fa 48 8d 44 24 60 49 89 07 RSP: 0018:ffffc90000cc69a0 EFLAGS: 00010202 RAX: 0000000000000015 RBX: 1ffff1100f8fa471 RCX: dffffc0000000000 RDX: 000000000000003b RSI: 0000000000000000 RDI: ffff88807e824d69 RBP: ffffc90000cc6b30 R08: 0000000000000000 R09: ffff88807e824d2e R10: dffffc0000000000 R11: ffffed100fd049ad R12: 1ffff1100f8fa405 R13: 1ffff92000198d3c R14: 1ffff1100f8fa406 R15: 00000000000000a8 FS: 0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b31963fff CR3: 000000002adcc000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rng_get_data drivers/char/hw_random/core.c:196 [inline] add_early_randomness+0x7a/0x150 drivers/char/hw_random/core.c:74 hwrng_register+0x406/0x490 drivers/char/hw_random/core.c:526 devm_hwrng_register+0x43/0xb0 drivers/char/hw_random/core.c:597 u2fzero_probe+0x26e/0x2f0 drivers/hid/hid-u2fzero.c:336 hid_device_probe+0x275/0x360 drivers/hid/hid-core.c:2355 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x276/0xc70 drivers/base/dd.c:595 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:775 driver_probe_device+0x4f/0x420 drivers/base/dd.c:805 __device_attach_driver+0x2b0/0x500 drivers/base/dd.c:927 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429 __device_attach+0x2a7/0x480 drivers/base/dd.c:999 bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489 device_add+0xbcf/0x1050 drivers/base/core.c:3427 hid_add_device+0x361/0x500 drivers/hid/hid-core.c:2507 usbhid_probe+0xbc5/0xf50 drivers/hid/usbhid/hid-core.c:1442 usb_probe_interface+0x5be/0xae0 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x276/0xc70 drivers/base/dd.c:595 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:775 driver_probe_device+0x4f/0x420 drivers/base/dd.c:805 __device_attach_driver+0x2b0/0x500 drivers/base/dd.c:927 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429 __device_attach+0x2a7/0x480 drivers/base/dd.c:999 bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489 device_add+0xbcf/0x1050 drivers/base/core.c:3427 usb_set_configuration+0x19d5/0x2030 drivers/usb/core/message.c:2223 usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238 usb_probe_device+0x126/0x250 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x276/0xc70 drivers/base/dd.c:595 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:775 driver_probe_device+0x4f/0x420 drivers/base/dd.c:805 __device_attach_driver+0x2b0/0x500 drivers/base/dd.c:927 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429 __device_attach+0x2a7/0x480 drivers/base/dd.c:999 bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489 device_add+0xbcf/0x1050 drivers/base/core.c:3427 usb_new_device+0x9f6/0x15d0 drivers/usb/core/hub.c:2632 hub_port_connect drivers/usb/core/hub.c:5497 [inline] hub_port_connect_change drivers/usb/core/hub.c:5637 [inline] port_event drivers/usb/core/hub.c:5799 [inline] hub_event+0x2b8d/0x5260 drivers/usb/core/hub.c:5881 process_one_work+0x867/0xff0 kernel/workqueue.c:2310 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 Modules linked in: ---[ end trace 7d027f7992d10eea ]--- RIP: 0010:u2fzero_recv drivers/hid/hid-u2fzero.c:116 [inline] RIP: 0010:u2fzero_rng_read+0x23e/0x710 drivers/hid/hid-u2fzero.c:202 Code: 24 74 0d 48 8b 3c 24 e8 20 5b 4b fa 48 8b 04 24 41 bf a8 00 00 00 4c 03 38 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ff e8 74 5b 4b fa 48 8d 44 24 60 49 89 07 RSP: 0018:ffffc90000cc69a0 EFLAGS: 00010202 RAX: 0000000000000015 RBX: 1ffff1100f8fa471 RCX: dffffc0000000000 RDX: 000000000000003b RSI: 0000000000000000 RDI: ffff88807e824d69 RBP: ffffc90000cc6b30 R08: 0000000000000000 R09: ffff88807e824d2e R10: dffffc0000000000 R11: ffffed100fd049ad R12: 1ffff1100f8fa405 R13: 1ffff92000198d3c R14: 1ffff1100f8fa406 R15: 00000000000000a8 FS: 0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b31963fff CR3: 000000002adcc000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 24 74 and $0x74,%al 2: 0d 48 8b 3c 24 or $0x243c8b48,%eax 7: e8 20 5b 4b fa call 0xfa4b5b2c c: 48 8b 04 24 mov (%rsp),%rax 10: 41 bf a8 00 00 00 mov $0xa8,%r15d 16: 4c 03 38 add (%rax),%r15 19: 4c 89 f8 mov %r15,%rax 1c: 48 c1 e8 03 shr $0x3,%rax 20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx 27: fc ff df * 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction 2e: 74 08 je 0x38 30: 4c 89 ff mov %r15,%rdi 33: e8 74 5b 4b fa call 0xfa4b5bac 38: 48 8d 44 24 60 lea 0x60(%rsp),%rax 3d: 49 89 07 mov %rax,(%r15) final repro crashed as (corrupted=false): hid-u2fzero 0003:10C4:8ACF.0001: unknown main item tag 0x0 hid-u2fzero 0003:10C4:8ACF.0001: unknown main item tag 0x0 hid-u2fzero 0003:10C4:8ACF.0001: unknown main item tag 0x0 hid-u2fzero 0003:10C4:8ACF.0001: unknown main item tag 0x0 hid-u2fzero 0003:10C4:8ACF.0001: unknown main item tag 0x0 hid-u2fzero 0003:10C4:8ACF.0001: hidraw0: USB HID v0.09 Device [HID 10c4:8acf] on usb-dummy_hcd.0-1/input0 hid-u2fzero 0003:10C4:8ACF.0001: U2F Zero LED initialised general protection fault, probably for non-canonical address 0xdffffc0000000015: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x00000000000000a8-0x00000000000000af] CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: usb_hub_wq hub_event RIP: 0010:u2fzero_recv drivers/hid/hid-u2fzero.c:116 [inline] RIP: 0010:u2fzero_rng_read+0x23e/0x710 drivers/hid/hid-u2fzero.c:202 Code: 24 74 0d 48 8b 3c 24 e8 20 5b 4b fa 48 8b 04 24 41 bf a8 00 00 00 4c 03 38 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ff e8 74 5b 4b fa 48 8d 44 24 60 49 89 07 RSP: 0018:ffffc90000cc69a0 EFLAGS: 00010202 RAX: 0000000000000015 RBX: 1ffff1100f8fa471 RCX: dffffc0000000000 RDX: 000000000000003b RSI: 0000000000000000 RDI: ffff88807e824d69 RBP: ffffc90000cc6b30 R08: 0000000000000000 R09: ffff88807e824d2e R10: dffffc0000000000 R11: ffffed100fd049ad R12: 1ffff1100f8fa405 R13: 1ffff92000198d3c R14: 1ffff1100f8fa406 R15: 00000000000000a8 FS: 0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b31963fff CR3: 000000002adcc000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rng_get_data drivers/char/hw_random/core.c:196 [inline] add_early_randomness+0x7a/0x150 drivers/char/hw_random/core.c:74 hwrng_register+0x406/0x490 drivers/char/hw_random/core.c:526 devm_hwrng_register+0x43/0xb0 drivers/char/hw_random/core.c:597 u2fzero_probe+0x26e/0x2f0 drivers/hid/hid-u2fzero.c:336 hid_device_probe+0x275/0x360 drivers/hid/hid-core.c:2355 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x276/0xc70 drivers/base/dd.c:595 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:775 driver_probe_device+0x4f/0x420 drivers/base/dd.c:805 __device_attach_driver+0x2b0/0x500 drivers/base/dd.c:927 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429 __device_attach+0x2a7/0x480 drivers/base/dd.c:999 bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489 device_add+0xbcf/0x1050 drivers/base/core.c:3427 hid_add_device+0x361/0x500 drivers/hid/hid-core.c:2507 usbhid_probe+0xbc5/0xf50 drivers/hid/usbhid/hid-core.c:1442 usb_probe_interface+0x5be/0xae0 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x276/0xc70 drivers/base/dd.c:595 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:775 driver_probe_device+0x4f/0x420 drivers/base/dd.c:805 __device_attach_driver+0x2b0/0x500 drivers/base/dd.c:927 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429 __device_attach+0x2a7/0x480 drivers/base/dd.c:999 bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489 device_add+0xbcf/0x1050 drivers/base/core.c:3427 usb_set_configuration+0x19d5/0x2030 drivers/usb/core/message.c:2223 usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238 usb_probe_device+0x126/0x250 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x276/0xc70 drivers/base/dd.c:595 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:775 driver_probe_device+0x4f/0x420 drivers/base/dd.c:805 __device_attach_driver+0x2b0/0x500 drivers/base/dd.c:927 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429 __device_attach+0x2a7/0x480 drivers/base/dd.c:999 bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489 device_add+0xbcf/0x1050 drivers/base/core.c:3427 usb_new_device+0x9f6/0x15d0 drivers/usb/core/hub.c:2632 hub_port_connect drivers/usb/core/hub.c:5497 [inline] hub_port_connect_change drivers/usb/core/hub.c:5637 [inline] port_event drivers/usb/core/hub.c:5799 [inline] hub_event+0x2b8d/0x5260 drivers/usb/core/hub.c:5881 process_one_work+0x867/0xff0 kernel/workqueue.c:2310 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 Modules linked in: ---[ end trace 7d027f7992d10eea ]--- RIP: 0010:u2fzero_recv drivers/hid/hid-u2fzero.c:116 [inline] RIP: 0010:u2fzero_rng_read+0x23e/0x710 drivers/hid/hid-u2fzero.c:202 Code: 24 74 0d 48 8b 3c 24 e8 20 5b 4b fa 48 8b 04 24 41 bf a8 00 00 00 4c 03 38 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ff e8 74 5b 4b fa 48 8d 44 24 60 49 89 07 RSP: 0018:ffffc90000cc69a0 EFLAGS: 00010202 RAX: 0000000000000015 RBX: 1ffff1100f8fa471 RCX: dffffc0000000000 RDX: 000000000000003b RSI: 0000000000000000 RDI: ffff88807e824d69 RBP: ffffc90000cc6b30 R08: 0000000000000000 R09: ffff88807e824d2e R10: dffffc0000000000 R11: ffffed100fd049ad R12: 1ffff1100f8fa405 R13: 1ffff92000198d3c R14: 1ffff1100f8fa406 R15: 00000000000000a8 FS: 0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b31963fff CR3: 000000002adcc000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 24 74 and $0x74,%al 2: 0d 48 8b 3c 24 or $0x243c8b48,%eax 7: e8 20 5b 4b fa call 0xfa4b5b2c c: 48 8b 04 24 mov (%rsp),%rax 10: 41 bf a8 00 00 00 mov $0xa8,%r15d 16: 4c 03 38 add (%rax),%r15 19: 4c 89 f8 mov %r15,%rax 1c: 48 c1 e8 03 shr $0x3,%rax 20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx 27: fc ff df * 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction 2e: 74 08 je 0x38 30: 4c 89 ff mov %r15,%rdi 33: e8 74 5b 4b fa call 0xfa4b5bac 38: 48 8d 44 24 60 lea 0x60(%rsp),%rax 3d: 49 89 07 mov %rax,(%r15)