Extracting prog: 1m48.019872471s
Minimizing prog: 17m46.380993226s
Simplifying prog options: 2m57.805314121s
Extracting C: 1m4.050324928s
Simplifying C: 0s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect-syz_usb_connect$uac1
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)
syz_usb_connect$uac1(0x0, 0xf0, 0x0, 0x0)

program crashed: KASAN: slab-out-of-bounds Write in gb_operation_message_alloc
single: successfully extracted reproducer
found reproducer with 8 syscalls
minimizing guilty program
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)

program crashed: KASAN: slab-out-of-bounds Write in gb_operation_message_alloc
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(0xffffffffffffffff, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(0xffffffffffffffff, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64], 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b")
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, 0x0, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, 0x0)
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x0, 0x0) (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x0, &(0x7f0000000040)) (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, 0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
program did not crash
simplifying guilty program options
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)

program crashed: KASAN: slab-out-of-bounds Write in gb_operation_message_alloc
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
program did not crash
testing program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)

program crashed: KASAN: slab-out-of-bounds Write in gb_operation_message_alloc
validation run: crashed=true
testing program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)

program crashed: KASAN: slab-out-of-bounds Write in gb_operation_message_alloc
validation run: crashed=true
testing program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$lan78xx-syz_usb_control_io$uac1-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB])
syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="621881105379a06b") (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x0)

program crashed: KASAN: slab-out-of-bounds Write in gb_operation_message_alloc
validation run: crashed=true
reproducing took 25m22.511082099s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-out-of-bounds in gb_operation_message_init drivers/greybus/operation.c:341 [inline]
BUG: KASAN: slab-out-of-bounds in gb_operation_message_alloc+0x224/0x258 drivers/greybus/operation.c:385
Write of size 2 at addr ffff0000c2e71222 by task swapper/1/0

CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 print_address_description+0xb0/0x238 mm/kasan/report.c:378
 print_report+0x68/0x84 mm/kasan/report.c:482
 kasan_report+0x8c/0xc4 mm/kasan/report.c:595
 __asan_report_store2_noabort+0x20/0x2c mm/kasan/report_generic.c:384
 gb_operation_message_init drivers/greybus/operation.c:341 [inline]
 gb_operation_message_alloc+0x224/0x258 drivers/greybus/operation.c:385
 gb_operation_create_common+0xa4/0x3b4 drivers/greybus/operation.c:532
 gb_operation_create_incoming drivers/greybus/operation.c:644 [inline]
 gb_connection_recv_request drivers/greybus/operation.c:926 [inline]
 gb_connection_recv+0x268/0xfd4 drivers/greybus/operation.c:1063
 greybus_data_rcvd+0x254/0x67c drivers/greybus/connection.c:89
 cport_in_callback+0x15c/0x298 drivers/greybus/es2.c:840
 __usb_hcd_giveback_urb+0x314/0x594 drivers/usb/core/hcd.c:1657
 usb_hcd_giveback_urb+0x100/0x350 drivers/usb/core/hcd.c:1741
 dummy_timer+0x570/0x2ba0 drivers/usb/gadget/udc/dummy_hcd.c:2023
 __run_hrtimer kernel/time/hrtimer.c:2074 [inline]
 __hrtimer_run_queues+0x310/0x998 kernel/time/hrtimer.c:2131
 hrtimer_run_softirq+0x1b4/0x2a8 kernel/time/hrtimer.c:2148
 handle_softirqs+0x324/0xcbc kernel/softirq.c:645
 __do_softirq+0x14/0x20 kernel/softirq.c:679
 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:78
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:901
 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:83
 invoke_softirq kernel/softirq.c:526 [inline]
 __irq_exit_rcu+0x10c/0x318 kernel/softirq.c:758
 irq_exit_rcu+0x14/0x84 kernel/softirq.c:775
 __el1_irq arch/arm64/kernel/entry-common.c:569 [inline]
 el1_interrupt+0x40/0x60 arch/arm64/kernel/entry-common.c:581
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:586
 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:602
 __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:26 [inline] (P)
 arch_local_irq_enable arch/arm64/include/asm/irqflags.h:48 [inline] (P)
 default_idle_call+0xa0/0xb8 kernel/sched/idle.c:129 (P)
 cpuidle_idle_call kernel/sched/idle.c:199 [inline]
 do_idle+0x1ec/0x450 kernel/sched/idle.c:355
 cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:454
 secondary_start_kernel+0x1bc/0x1e0 arch/arm64/kernel/smp.c:273
 __secondary_switched+0xc0/0xc4 arch/arm64/kernel/head.S:400

Allocated by task 0:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x40/0x78 mm/kasan/common.c:78
 kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:570
 poison_kmalloc_redzone mm/kasan/common.c:409 [inline]
 __kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:426
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5414 [inline]
 __kmalloc_noprof+0x34c/0x6c8 mm/slub.c:5439
 _kmalloc_noprof include/linux/slab.h:995 [inline]
 _kzalloc_noprof include/linux/slab.h:1312 [inline]
 gb_operation_message_alloc+0x90/0x258 drivers/greybus/operation.c:380
 gb_operation_create_common+0xa4/0x3b4 drivers/greybus/operation.c:532
 gb_operation_create_incoming drivers/greybus/operation.c:644 [inline]
 gb_connection_recv_request drivers/greybus/operation.c:926 [inline]
 gb_connection_recv+0x268/0xfd4 drivers/greybus/operation.c:1063
 greybus_data_rcvd+0x254/0x67c drivers/greybus/connection.c:89
 cport_in_callback+0x15c/0x298 drivers/greybus/es2.c:840
 __usb_hcd_giveback_urb+0x314/0x594 drivers/usb/core/hcd.c:1657
 usb_hcd_giveback_urb+0x100/0x350 drivers/usb/core/hcd.c:1741
 dummy_timer+0x570/0x2ba0 drivers/usb/gadget/udc/dummy_hcd.c:2023
 __run_hrtimer kernel/time/hrtimer.c:2074 [inline]
 __hrtimer_run_queues+0x310/0x998 kernel/time/hrtimer.c:2131
 hrtimer_run_softirq+0x1b4/0x2a8 kernel/time/hrtimer.c:2148
 handle_softirqs+0x324/0xcbc kernel/softirq.c:645
 __do_softirq+0x14/0x20 kernel/softirq.c:679

The buggy address belongs to the object at ffff0000c2e71220
 which belongs to the cache kmalloc-8 of size 8
The buggy address is located 2 bytes inside of
 allocated 3-byte region [ffff0000c2e71220, ffff0000c2e71223)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff0000c2e71440 pfn:0x102e71
flags: 0x5ffc00000000200(workingset|node=0|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 05ffc00000000200 ffff0000c0001500 ffff0000c0000348 fffffdffc31ab750
raw: ffff0000c2e71440 000000000080007e 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000c2e71100: 00 fc fc fc fa fc fc fc fa fc fc fc 00 fc fc fc
 ffff0000c2e71180: 00 fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc
>ffff0000c2e71200: fa fc fc fc 03 fc fc fc fa fc fc fc 00 fc fc fc
                               ^
 ffff0000c2e71280: 00 fc fc fc 00 fc fc fc 00 fc fc fc fa fc fc fc
 ffff0000c2e71300: 06 fc fc fc 06 fc fc fc 06 fc fc fc 06 fc fc fc
==================================================================
usb 1-1: failed to resubmit arpc in-urb: -19
usb 1-1: failed to resubmit arpc in-urb: -19
usb 1-1: failed to resubmit in-urb: -19
usb 1-1: failed to resubmit in-urb: -19
usb 1-1: failed to resubmit in-urb: -19
usb 1-1: failed to resubmit in-urb: -19

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-out-of-bounds in gb_operation_message_init drivers/greybus/operation.c:341 [inline]
BUG: KASAN: slab-out-of-bounds in gb_operation_message_alloc+0x224/0x258 drivers/greybus/operation.c:385
Write of size 2 at addr ffff0000c2e71222 by task swapper/1/0

CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 print_address_description+0xb0/0x238 mm/kasan/report.c:378
 print_report+0x68/0x84 mm/kasan/report.c:482
 kasan_report+0x8c/0xc4 mm/kasan/report.c:595
 __asan_report_store2_noabort+0x20/0x2c mm/kasan/report_generic.c:384
 gb_operation_message_init drivers/greybus/operation.c:341 [inline]
 gb_operation_message_alloc+0x224/0x258 drivers/greybus/operation.c:385
 gb_operation_create_common+0xa4/0x3b4 drivers/greybus/operation.c:532
 gb_operation_create_incoming drivers/greybus/operation.c:644 [inline]
 gb_connection_recv_request drivers/greybus/operation.c:926 [inline]
 gb_connection_recv+0x268/0xfd4 drivers/greybus/operation.c:1063
 greybus_data_rcvd+0x254/0x67c drivers/greybus/connection.c:89
 cport_in_callback+0x15c/0x298 drivers/greybus/es2.c:840
 __usb_hcd_giveback_urb+0x314/0x594 drivers/usb/core/hcd.c:1657
 usb_hcd_giveback_urb+0x100/0x350 drivers/usb/core/hcd.c:1741
 dummy_timer+0x570/0x2ba0 drivers/usb/gadget/udc/dummy_hcd.c:2023
 __run_hrtimer kernel/time/hrtimer.c:2074 [inline]
 __hrtimer_run_queues+0x310/0x998 kernel/time/hrtimer.c:2131
 hrtimer_run_softirq+0x1b4/0x2a8 kernel/time/hrtimer.c:2148
 handle_softirqs+0x324/0xcbc kernel/softirq.c:645
 __do_softirq+0x14/0x20 kernel/softirq.c:679
 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:78
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:901
 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:83
 invoke_softirq kernel/softirq.c:526 [inline]
 __irq_exit_rcu+0x10c/0x318 kernel/softirq.c:758
 irq_exit_rcu+0x14/0x84 kernel/softirq.c:775
 __el1_irq arch/arm64/kernel/entry-common.c:569 [inline]
 el1_interrupt+0x40/0x60 arch/arm64/kernel/entry-common.c:581
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:586
 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:602
 __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:26 [inline] (P)
 arch_local_irq_enable arch/arm64/include/asm/irqflags.h:48 [inline] (P)
 default_idle_call+0xa0/0xb8 kernel/sched/idle.c:129 (P)
 cpuidle_idle_call kernel/sched/idle.c:199 [inline]
 do_idle+0x1ec/0x450 kernel/sched/idle.c:355
 cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:454
 secondary_start_kernel+0x1bc/0x1e0 arch/arm64/kernel/smp.c:273
 __secondary_switched+0xc0/0xc4 arch/arm64/kernel/head.S:400

Allocated by task 0:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x40/0x78 mm/kasan/common.c:78
 kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:570
 poison_kmalloc_redzone mm/kasan/common.c:409 [inline]
 __kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:426
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5414 [inline]
 __kmalloc_noprof+0x34c/0x6c8 mm/slub.c:5439
 _kmalloc_noprof include/linux/slab.h:995 [inline]
 _kzalloc_noprof include/linux/slab.h:1312 [inline]
 gb_operation_message_alloc+0x90/0x258 drivers/greybus/operation.c:380
 gb_operation_create_common+0xa4/0x3b4 drivers/greybus/operation.c:532
 gb_operation_create_incoming drivers/greybus/operation.c:644 [inline]
 gb_connection_recv_request drivers/greybus/operation.c:926 [inline]
 gb_connection_recv+0x268/0xfd4 drivers/greybus/operation.c:1063
 greybus_data_rcvd+0x254/0x67c drivers/greybus/connection.c:89
 cport_in_callback+0x15c/0x298 drivers/greybus/es2.c:840
 __usb_hcd_giveback_urb+0x314/0x594 drivers/usb/core/hcd.c:1657
 usb_hcd_giveback_urb+0x100/0x350 drivers/usb/core/hcd.c:1741
 dummy_timer+0x570/0x2ba0 drivers/usb/gadget/udc/dummy_hcd.c:2023
 __run_hrtimer kernel/time/hrtimer.c:2074 [inline]
 __hrtimer_run_queues+0x310/0x998 kernel/time/hrtimer.c:2131
 hrtimer_run_softirq+0x1b4/0x2a8 kernel/time/hrtimer.c:2148
 handle_softirqs+0x324/0xcbc kernel/softirq.c:645
 __do_softirq+0x14/0x20 kernel/softirq.c:679

The buggy address belongs to the object at ffff0000c2e71220
 which belongs to the cache kmalloc-8 of size 8
The buggy address is located 2 bytes inside of
 allocated 3-byte region [ffff0000c2e71220, ffff0000c2e71223)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff0000c2e71440 pfn:0x102e71
flags: 0x5ffc00000000200(workingset|node=0|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 05ffc00000000200 ffff0000c0001500 ffff0000c0000348 fffffdffc31ab750
raw: ffff0000c2e71440 000000000080007e 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000c2e71100: 00 fc fc fc fa fc fc fc fa fc fc fc 00 fc fc fc
 ffff0000c2e71180: 00 fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc
>ffff0000c2e71200: fa fc fc fc 03 fc fc fc fa fc fc fc 00 fc fc fc
                               ^
 ffff0000c2e71280: 00 fc fc fc 00 fc fc fc 00 fc fc fc fa fc fc fc
 ffff0000c2e71300: 06 fc fc fc 06 fc fc fc 06 fc fc fc 06 fc fc fc
==================================================================
usb 1-1: failed to resubmit arpc in-urb: -19
usb 1-1: failed to resubmit arpc in-urb: -19
usb 1-1: failed to resubmit in-urb: -19
usb 1-1: failed to resubmit in-urb: -19
usb 1-1: failed to resubmit in-urb: -19
usb 1-1: failed to resubmit in-urb: -19