Extracting prog: 1h14m46.225103898s
Minimizing prog: 11m27.907759617s
Simplifying prog options: 0s
Extracting C: 1m9.162666735s
Simplifying C: 21m42.068005425s


extracting reproducer from 30 programs
testing a last program of every proc
single: executing 5 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_clone-socket-mmap-wait4
detailed listing:
executing program 0:
r0 = syz_clone(0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = socket(0x18, 0x3, 0x2)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x13, r1, 0x42795000)
wait4(r0, &(0x7f0000001240), 0x80000000, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON-mmap-madvise-execve
detailed listing:
executing program 0:
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680))
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9)
execve(0x0, 0x0, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io-openat$tun
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000101e04003100002200000109022400010000000009040000010300000009210000000122050009058103"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, &(0x7f0000000640)={0x2c, &(0x7f0000000440)={0x20, 0x9, 0x41, {0x41, 0x22, "20de13e0fef710ba45b3a8f23ef645306523f794e963787c028cd37e610ee66988525fab90f4d6967b141604569298cba3a6d19fbf36b87787e153ab889c0c"}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000c00)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0x40, 0x9, 0x1, 0xf4}, &(0x7f00000009c0)={0x40, 0xb, 0x2, "f386"}, &(0x7f0000000a00)={0x40, 0xf, 0x2, 0x2}, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b40)={0x40, 0x1c, 0x1, 0x1}, 0x0, 0x0})
openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902"], 0x0)
syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000086d044fc1ffffed00000109022400010000000009040000010300030009210000000122050009058103"], 0x0)
syz_usb_disconnect(r0)
syz_usb_connect(0x5, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000009a65d0860040800"], 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-nanosleep
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)

program did not crash
single: failed to extract reproducer
bisect: bisecting 30 programs with base timeout 30s
testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280)='0', 0x1)
socket(0x2b, 0x1, 0x0)
executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)
lsetxattr$system_posix_acl(&(0x7f00000003c0)='./bus\x00', &(0x7f0000000540)='system.posix_acl_access\x00', &(0x7f00000000c0)={{}, {}, [], {0x4, 0x1}, [], {0x10, 0x6}}, 0x24, 0x0)
getxattr(&(0x7f0000000140)='./bus\x00', &(0x7f00000001c0)=@known='system.posix_acl_access\x00', 0x0, 0x0)
executing program 2:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000005c0)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870fd00090582020002"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
ioctl$HIDIOCGUSAGE(0xffffffffffffffff, 0x40025b0c, &(0x7f0000000000)={0x1, 0xfffffffe, 0x7, 0x0, 0x110001})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xa8, &(0x7f0000000000)=ANY=[@ANYBLOB="a200004ef3b11f948ef66b0ee0b3d41b1b"])
executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000005c0)='map_files\x00')
r1 = landlock_create_ruleset(&(0x7f00000000c0)={0x100}, 0x18, 0x0)
landlock_restrict_self(r1, 0x0)
openat(r0, &(0x7f0000000600)='./file1\x00', 0x40042, 0x0)
executing program 0:
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680))
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15)
ptrace$pokeuser(0x6, 0x0, 0x2, 0x8)
executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', <r1=>0x0})
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000bd7000001600000200000008000300", @ANYRES32=r1, @ANYBLOB="0c0099000200000025000000080026006c0900000800a0006c0900000800270001"], 0x40}, 0x1, 0x0, 0x0, 0x8001}, 0x4040000)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0xc048aeca, &(0x7f0000000580))
executing program 3:
mlockall(0x2)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x42, 0x1ff)
mmap$IORING_OFF_SQ_RING(0xfffff000, 0x2000, 0x2000003, 0x12, r0, 0x0)
munlockall()
executing program 0:
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3)
capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x0, 0x0, 0xffffb9e3, 0x5})
r0 = creat(&(0x7f00000016c0)='./file0\x00', 0x63)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000001a40)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x0, 0x0, r0}, 0x68)
executing program 3:
r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000080)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_SENDMSG_ZC={0x30, 0x0, 0x2c, 0xffffffffffffffff, 0x0, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0x3, 0x11, 0x1})
ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc014563b, &(0x7f0000000cc0)={0xa, {0x800, 0x7b, 0x1000}})
io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 0:
r0 = socket$kcm(0x11, 0x20000000000000a, 0x300)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff})
sendmsg$tipc(r1, &(0x7f0000003a00)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x9}}, 0x10, &(0x7f0000000b40)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000001a00), 0x101d0}], 0x4}, 0x0)
recvmsg(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000000)=""/90, 0xffa3}, {&(0x7f0000000100)=""/176, 0xb0}, {&(0x7f0000000380)=""/66, 0x42}, {&(0x7f00000005c0)=""/217, 0xd9}], 0x4}, 0x0)
executing program 3:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={<r0=>0xffffffffffffffff})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={<r1=>0xffffffffffffffff})
close_range(r1, 0xffffffffffffffff, 0x2)
dup3(r0, r1, 0x80000)
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 0:
r0 = socket$inet(0x2, 0x2, 0x0)
setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000740)={@multicast2, @local}, 0xc)
setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000400)={0x4, {{0x2, 0x4e23, @multicast2}}}, 0x88)
setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f00000000c0)={@multicast2, @local}, 0x10)
executing program 0:
r0 = syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902"], 0x0)
syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000086d044fc1ffffed00000109022400010000000009040000010300030009210000000122050009058103"], 0x0)
syz_usb_disconnect(r0)
syz_usb_connect(0x5, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000009a65d0860040800"], 0x0)
executing program 1:
setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x1b, &(0x7f00000000c0)={@mcast1, 0x2, 0x1, 0x3}, 0x1f)
r0 = add_key$user(&(0x7f0000000380), &(0x7f0000000000), &(0x7f00000003c0)='X', 0x1, 0xfffffffffffffffe)
r1 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd)
keyctl$dh_compute(0x17, &(0x7f0000000100)={r0, r1, r1}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'streebog512-generic\x00'}})
executing program 1:
r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r0)
ptrace$pokeuser(0x6, r0, 0x388, 0x7ffffffffd)
ptrace$pokeuser(0x6, r0, 0x388, 0x3000000)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x8f, 0xec000000, 0xcd}]})
executing program 2:
pipe(&(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
readv(r0, &(0x7f0000000a40)=[{&(0x7f0000000a80)=""/4103, 0x2ed}], 0x1)
io_setup(0x3ff, &(0x7f0000000500)=<r2=>0x0)
io_submit(r2, 0xf000, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f00000001c0)='m', 0xfffffdfc}])
executing program 1:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000)
executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x309c0, 0x0)
setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x1}, 0x8)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
openat2$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', &(0x7f0000000140)={0x474082, 0x5c, 0x8}, 0x18)
executing program 1:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000101e04003100002200000109022400010000000009040000010300000009210000000122050009058103"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, &(0x7f0000000640)={0x2c, &(0x7f0000000440)={0x20, 0x9, 0x41, {0x41, 0x22, "20de13e0fef710ba45b3a8f23ef645306523f794e963787c028cd37e610ee66988525fab90f4d6967b141604569298cba3a6d19fbf36b87787e153ab889c0c"}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000c00)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0x40, 0x9, 0x1, 0xf4}, &(0x7f00000009c0)={0x40, 0xb, 0x2, "f386"}, &(0x7f0000000a00)={0x40, 0xf, 0x2, 0x2}, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b40)={0x40, 0x1c, 0x1, 0x1}, 0x0, 0x0})
openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0)
executing program 4:
openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0)
r0 = syz_io_uring_setup(0xf00, &(0x7f0000000140)={0x0, 0x5961, 0x10000, 0x0, 0x4e}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000080)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
io_uring_enter(r0, 0x2000, 0xffbffffb, 0x89, 0x0, 0x0)
executing program 4:
r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002)
r1 = fcntl$dupfd(r0, 0x0, r0)
write$sndseq(r1, &(0x7f0000000180)=[{0x0, 0x0, 0x0, 0x8, @time={0x8, 0x1}, {0x0, 0xff}, {0x0, 0xfe}, @queue={0x1, {0x6, 0x4}}}, {0x0, 0x0, 0x0, 0x0, @time={0x0, 0x8}, {0x6}, {}, @note={0x58, 0x3, 0x7, 0xe, 0x8}}], 0x38)
ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000c00))
executing program 4:
r0 = socket$inet6_sctp(0xa, 0x801, 0x84)
sendmmsg$inet6(r0, &(0x7f0000006040)=[{{&(0x7f0000001140)={0xa, 0x4e24, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, 0x4}, 0x1c, &(0x7f0000001280)=[{&(0x7f00000010c0)="b3", 0x1}], 0x1}}, {{&(0x7f0000000280)={0xa, 0x4e20, 0x600000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xdefa}, 0x1c, &(0x7f00000036c0)=[{&(0x7f00000002c0)="13", 0x1}], 0x1}}], 0x2, 0x44051)
shutdown(r0, 0x1)
setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r0, 0x84, 0x23, &(0x7f0000001040), 0x8)
executing program 4:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', 0x0, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
getdents64(r0, 0x0, 0x0)
getdents64(r0, &(0x7f0000002280)=""/233, 0xe9)
executing program 2:
r0 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', <r1=>0x0})
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c00000013000100000000000000000007000001", @ANYRES32=r1, @ANYBLOB="00000000000000001c001a8018000580140006"], 0x3c}, 0x1, 0x0, 0x0, 0x4080}, 0x4004000)
executing program 4:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000600)=0x9, 0x4)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000000040)=0x7, 0x4)
listen(r0, 0x7)
executing program 2:
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680))
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9)
execve(0x0, 0x0, 0x0)
executing program 4:
r0 = syz_clone(0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = socket(0x18, 0x3, 0x2)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x13, r1, 0x42795000)
wait4(r0, &(0x7f0000001240), 0x80000000, 0x0)

program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
bisect: bisecting 30 programs
bisect: split chunks (needed=false): <30>
bisect: split chunk #0 of len 30 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=35s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4]
detailed listing:
executing program 0:
r0 = socket$kcm(0x11, 0x20000000000000a, 0x300)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff})
sendmsg$tipc(r1, &(0x7f0000003a00)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x9}}, 0x10, &(0x7f0000000b40)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000001a00), 0x101d0}], 0x4}, 0x0)
recvmsg(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000000)=""/90, 0xffa3}, {&(0x7f0000000100)=""/176, 0xb0}, {&(0x7f0000000380)=""/66, 0x42}, {&(0x7f00000005c0)=""/217, 0xd9}], 0x4}, 0x0)
executing program 3:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={<r0=>0xffffffffffffffff})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={<r1=>0xffffffffffffffff})
close_range(r1, 0xffffffffffffffff, 0x2)
dup3(r0, r1, 0x80000)
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 0:
r0 = socket$inet(0x2, 0x2, 0x0)
setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000740)={@multicast2, @local}, 0xc)
setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000400)={0x4, {{0x2, 0x4e23, @multicast2}}}, 0x88)
setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f00000000c0)={@multicast2, @local}, 0x10)
executing program 0:
r0 = syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902"], 0x0)
syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000086d044fc1ffffed00000109022400010000000009040000010300030009210000000122050009058103"], 0x0)
syz_usb_disconnect(r0)
syz_usb_connect(0x5, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000009a65d0860040800"], 0x0)
executing program 1:
setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x1b, &(0x7f00000000c0)={@mcast1, 0x2, 0x1, 0x3}, 0x1f)
r0 = add_key$user(&(0x7f0000000380), &(0x7f0000000000), &(0x7f00000003c0)='X', 0x1, 0xfffffffffffffffe)
r1 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd)
keyctl$dh_compute(0x17, &(0x7f0000000100)={r0, r1, r1}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'streebog512-generic\x00'}})
executing program 1:
r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r0)
ptrace$pokeuser(0x6, r0, 0x388, 0x7ffffffffd)
ptrace$pokeuser(0x6, r0, 0x388, 0x3000000)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x8f, 0xec000000, 0xcd}]})
executing program 2:
pipe(&(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
readv(r0, &(0x7f0000000a40)=[{&(0x7f0000000a80)=""/4103, 0x2ed}], 0x1)
io_setup(0x3ff, &(0x7f0000000500)=<r2=>0x0)
io_submit(r2, 0xf000, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f00000001c0)='m', 0xfffffdfc}])
executing program 1:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000)
executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x309c0, 0x0)
setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x1}, 0x8)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
openat2$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', &(0x7f0000000140)={0x474082, 0x5c, 0x8}, 0x18)
executing program 1:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000101e04003100002200000109022400010000000009040000010300000009210000000122050009058103"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, &(0x7f0000000640)={0x2c, &(0x7f0000000440)={0x20, 0x9, 0x41, {0x41, 0x22, "20de13e0fef710ba45b3a8f23ef645306523f794e963787c028cd37e610ee66988525fab90f4d6967b141604569298cba3a6d19fbf36b87787e153ab889c0c"}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000c00)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0x40, 0x9, 0x1, 0xf4}, &(0x7f00000009c0)={0x40, 0xb, 0x2, "f386"}, &(0x7f0000000a00)={0x40, 0xf, 0x2, 0x2}, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b40)={0x40, 0x1c, 0x1, 0x1}, 0x0, 0x0})
openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0)
executing program 4:
openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0)
r0 = syz_io_uring_setup(0xf00, &(0x7f0000000140)={0x0, 0x5961, 0x10000, 0x0, 0x4e}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000080)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
io_uring_enter(r0, 0x2000, 0xffbffffb, 0x89, 0x0, 0x0)
executing program 4:
r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002)
r1 = fcntl$dupfd(r0, 0x0, r0)
write$sndseq(r1, &(0x7f0000000180)=[{0x0, 0x0, 0x0, 0x8, @time={0x8, 0x1}, {0x0, 0xff}, {0x0, 0xfe}, @queue={0x1, {0x6, 0x4}}}, {0x0, 0x0, 0x0, 0x0, @time={0x0, 0x8}, {0x6}, {}, @note={0x58, 0x3, 0x7, 0xe, 0x8}}], 0x38)
ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000c00))
executing program 4:
r0 = socket$inet6_sctp(0xa, 0x801, 0x84)
sendmmsg$inet6(r0, &(0x7f0000006040)=[{{&(0x7f0000001140)={0xa, 0x4e24, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, 0x4}, 0x1c, &(0x7f0000001280)=[{&(0x7f00000010c0)="b3", 0x1}], 0x1}}, {{&(0x7f0000000280)={0xa, 0x4e20, 0x600000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xdefa}, 0x1c, &(0x7f00000036c0)=[{&(0x7f00000002c0)="13", 0x1}], 0x1}}], 0x2, 0x44051)
shutdown(r0, 0x1)
setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r0, 0x84, 0x23, &(0x7f0000001040), 0x8)
executing program 4:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', 0x0, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
getdents64(r0, 0x0, 0x0)
getdents64(r0, &(0x7f0000002280)=""/233, 0xe9)
executing program 2:
r0 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', <r1=>0x0})
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c00000013000100000000000000000007000001", @ANYRES32=r1, @ANYBLOB="00000000000000001c001a8018000580140006"], 0x3c}, 0x1, 0x0, 0x0, 0x4080}, 0x4004000)
executing program 4:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000600)=0x9, 0x4)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000000040)=0x7, 0x4)
listen(r0, 0x7)
executing program 2:
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680))
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9)
execve(0x0, 0x0, 0x0)
executing program 4:
r0 = syz_clone(0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = socket(0x18, 0x3, 0x2)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x13, r1, 0x42795000)
wait4(r0, &(0x7f0000001240), 0x80000000, 0x0)

program did not crash
bisect: testing without sub-chunk 2/3
testing program (duration=35s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280)='0', 0x1)
socket(0x2b, 0x1, 0x0)
executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)
lsetxattr$system_posix_acl(&(0x7f00000003c0)='./bus\x00', &(0x7f0000000540)='system.posix_acl_access\x00', &(0x7f00000000c0)={{}, {}, [], {0x4, 0x1}, [], {0x10, 0x6}}, 0x24, 0x0)
getxattr(&(0x7f0000000140)='./bus\x00', &(0x7f00000001c0)=@known='system.posix_acl_access\x00', 0x0, 0x0)
executing program 2:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000005c0)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870fd00090582020002"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
ioctl$HIDIOCGUSAGE(0xffffffffffffffff, 0x40025b0c, &(0x7f0000000000)={0x1, 0xfffffffe, 0x7, 0x0, 0x110001})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xa8, &(0x7f0000000000)=ANY=[@ANYBLOB="a200004ef3b11f948ef66b0ee0b3d41b1b"])
executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000005c0)='map_files\x00')
r1 = landlock_create_ruleset(&(0x7f00000000c0)={0x100}, 0x18, 0x0)
landlock_restrict_self(r1, 0x0)
openat(r0, &(0x7f0000000600)='./file1\x00', 0x40042, 0x0)
executing program 0:
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680))
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15)
ptrace$pokeuser(0x6, 0x0, 0x2, 0x8)
executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', <r1=>0x0})
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000bd7000001600000200000008000300", @ANYRES32=r1, @ANYBLOB="0c0099000200000025000000080026006c0900000800a0006c0900000800270001"], 0x40}, 0x1, 0x0, 0x0, 0x8001}, 0x4040000)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0xc048aeca, &(0x7f0000000580))
executing program 3:
mlockall(0x2)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x42, 0x1ff)
mmap$IORING_OFF_SQ_RING(0xfffff000, 0x2000, 0x2000003, 0x12, r0, 0x0)
munlockall()
executing program 0:
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3)
capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x0, 0x0, 0xffffb9e3, 0x5})
r0 = creat(&(0x7f00000016c0)='./file0\x00', 0x63)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000001a40)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x0, 0x0, r0}, 0x68)
executing program 3:
r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000080)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_SENDMSG_ZC={0x30, 0x0, 0x2c, 0xffffffffffffffff, 0x0, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0x3, 0x11, 0x1})
ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc014563b, &(0x7f0000000cc0)={0xa, {0x800, 0x7b, 0x1000}})
io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x309c0, 0x0)
setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x1}, 0x8)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
openat2$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', &(0x7f0000000140)={0x474082, 0x5c, 0x8}, 0x18)
executing program 1:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000101e04003100002200000109022400010000000009040000010300000009210000000122050009058103"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, &(0x7f0000000640)={0x2c, &(0x7f0000000440)={0x20, 0x9, 0x41, {0x41, 0x22, "20de13e0fef710ba45b3a8f23ef645306523f794e963787c028cd37e610ee66988525fab90f4d6967b141604569298cba3a6d19fbf36b87787e153ab889c0c"}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000c00)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0x40, 0x9, 0x1, 0xf4}, &(0x7f00000009c0)={0x40, 0xb, 0x2, "f386"}, &(0x7f0000000a00)={0x40, 0xf, 0x2, 0x2}, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b40)={0x40, 0x1c, 0x1, 0x1}, 0x0, 0x0})
openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0)
executing program 4:
openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0)
r0 = syz_io_uring_setup(0xf00, &(0x7f0000000140)={0x0, 0x5961, 0x10000, 0x0, 0x4e}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000080)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
io_uring_enter(r0, 0x2000, 0xffbffffb, 0x89, 0x0, 0x0)
executing program 4:
r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002)
r1 = fcntl$dupfd(r0, 0x0, r0)
write$sndseq(r1, &(0x7f0000000180)=[{0x0, 0x0, 0x0, 0x8, @time={0x8, 0x1}, {0x0, 0xff}, {0x0, 0xfe}, @queue={0x1, {0x6, 0x4}}}, {0x0, 0x0, 0x0, 0x0, @time={0x0, 0x8}, {0x6}, {}, @note={0x58, 0x3, 0x7, 0xe, 0x8}}], 0x38)
ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000c00))
executing program 4:
r0 = socket$inet6_sctp(0xa, 0x801, 0x84)
sendmmsg$inet6(r0, &(0x7f0000006040)=[{{&(0x7f0000001140)={0xa, 0x4e24, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, 0x4}, 0x1c, &(0x7f0000001280)=[{&(0x7f00000010c0)="b3", 0x1}], 0x1}}, {{&(0x7f0000000280)={0xa, 0x4e20, 0x600000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xdefa}, 0x1c, &(0x7f00000036c0)=[{&(0x7f00000002c0)="13", 0x1}], 0x1}}], 0x2, 0x44051)
shutdown(r0, 0x1)
setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r0, 0x84, 0x23, &(0x7f0000001040), 0x8)
executing program 4:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', 0x0, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
getdents64(r0, 0x0, 0x0)
getdents64(r0, &(0x7f0000002280)=""/233, 0xe9)
executing program 2:
r0 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', <r1=>0x0})
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c00000013000100000000000000000007000001", @ANYRES32=r1, @ANYBLOB="00000000000000001c001a8018000580140006"], 0x3c}, 0x1, 0x0, 0x0, 0x4080}, 0x4004000)
executing program 4:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000600)=0x9, 0x4)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000000040)=0x7, 0x4)
listen(r0, 0x7)
executing program 2:
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680))
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9)
execve(0x0, 0x0, 0x0)
executing program 4:
r0 = syz_clone(0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = socket(0x18, 0x3, 0x2)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x13, r1, 0x42795000)
wait4(r0, &(0x7f0000001240), 0x80000000, 0x0)

program did not crash
bisect: testing without sub-chunk 3/3
testing program (duration=35s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280)='0', 0x1)
socket(0x2b, 0x1, 0x0)
executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)
lsetxattr$system_posix_acl(&(0x7f00000003c0)='./bus\x00', &(0x7f0000000540)='system.posix_acl_access\x00', &(0x7f00000000c0)={{}, {}, [], {0x4, 0x1}, [], {0x10, 0x6}}, 0x24, 0x0)
getxattr(&(0x7f0000000140)='./bus\x00', &(0x7f00000001c0)=@known='system.posix_acl_access\x00', 0x0, 0x0)
executing program 2:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000005c0)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870fd00090582020002"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
ioctl$HIDIOCGUSAGE(0xffffffffffffffff, 0x40025b0c, &(0x7f0000000000)={0x1, 0xfffffffe, 0x7, 0x0, 0x110001})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xa8, &(0x7f0000000000)=ANY=[@ANYBLOB="a200004ef3b11f948ef66b0ee0b3d41b1b"])
executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000005c0)='map_files\x00')
r1 = landlock_create_ruleset(&(0x7f00000000c0)={0x100}, 0x18, 0x0)
landlock_restrict_self(r1, 0x0)
openat(r0, &(0x7f0000000600)='./file1\x00', 0x40042, 0x0)
executing program 0:
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680))
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15)
ptrace$pokeuser(0x6, 0x0, 0x2, 0x8)
executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', <r1=>0x0})
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000bd7000001600000200000008000300", @ANYRES32=r1, @ANYBLOB="0c0099000200000025000000080026006c0900000800a0006c0900000800270001"], 0x40}, 0x1, 0x0, 0x0, 0x8001}, 0x4040000)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0xc048aeca, &(0x7f0000000580))
executing program 3:
mlockall(0x2)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x42, 0x1ff)
mmap$IORING_OFF_SQ_RING(0xfffff000, 0x2000, 0x2000003, 0x12, r0, 0x0)
munlockall()
executing program 0:
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3)
capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x0, 0x0, 0xffffb9e3, 0x5})
r0 = creat(&(0x7f00000016c0)='./file0\x00', 0x63)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000001a40)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x0, 0x0, r0}, 0x68)
executing program 3:
r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000080)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_SENDMSG_ZC={0x30, 0x0, 0x2c, 0xffffffffffffffff, 0x0, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0x3, 0x11, 0x1})
ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc014563b, &(0x7f0000000cc0)={0xa, {0x800, 0x7b, 0x1000}})
io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 0:
r0 = socket$kcm(0x11, 0x20000000000000a, 0x300)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff})
sendmsg$tipc(r1, &(0x7f0000003a00)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x9}}, 0x10, &(0x7f0000000b40)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000001a00), 0x101d0}], 0x4}, 0x0)
recvmsg(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000000)=""/90, 0xffa3}, {&(0x7f0000000100)=""/176, 0xb0}, {&(0x7f0000000380)=""/66, 0x42}, {&(0x7f00000005c0)=""/217, 0xd9}], 0x4}, 0x0)
executing program 3:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={<r0=>0xffffffffffffffff})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={<r1=>0xffffffffffffffff})
close_range(r1, 0xffffffffffffffff, 0x2)
dup3(r0, r1, 0x80000)
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 0:
r0 = socket$inet(0x2, 0x2, 0x0)
setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000740)={@multicast2, @local}, 0xc)
setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000400)={0x4, {{0x2, 0x4e23, @multicast2}}}, 0x88)
setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f00000000c0)={@multicast2, @local}, 0x10)
executing program 0:
r0 = syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902"], 0x0)
syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000086d044fc1ffffed00000109022400010000000009040000010300030009210000000122050009058103"], 0x0)
syz_usb_disconnect(r0)
syz_usb_connect(0x5, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000009a65d0860040800"], 0x0)
executing program 1:
setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x1b, &(0x7f00000000c0)={@mcast1, 0x2, 0x1, 0x3}, 0x1f)
r0 = add_key$user(&(0x7f0000000380), &(0x7f0000000000), &(0x7f00000003c0)='X', 0x1, 0xfffffffffffffffe)
r1 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd)
keyctl$dh_compute(0x17, &(0x7f0000000100)={r0, r1, r1}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'streebog512-generic\x00'}})
executing program 1:
r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r0)
ptrace$pokeuser(0x6, r0, 0x388, 0x7ffffffffd)
ptrace$pokeuser(0x6, r0, 0x388, 0x3000000)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x8f, 0xec000000, 0xcd}]})
executing program 2:
pipe(&(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
readv(r0, &(0x7f0000000a40)=[{&(0x7f0000000a80)=""/4103, 0x2ed}], 0x1)
io_setup(0x3ff, &(0x7f0000000500)=<r2=>0x0)
io_submit(r2, 0xf000, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f00000001c0)='m', 0xfffffdfc}])
executing program 1:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000)

program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <10>, <10>
bisect: split chunk #0 of len 10 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4]
detailed listing:
executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', <r1=>0x0})
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000bd7000001600000200000008000300", @ANYRES32=r1, @ANYBLOB="0c0099000200000025000000080026006c0900000800a0006c0900000800270001"], 0x40}, 0x1, 0x0, 0x0, 0x8001}, 0x4040000)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0xc048aeca, &(0x7f0000000580))
executing program 3:
mlockall(0x2)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x42, 0x1ff)
mmap$IORING_OFF_SQ_RING(0xfffff000, 0x2000, 0x2000003, 0x12, r0, 0x0)
munlockall()
executing program 0:
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3)
capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x0, 0x0, 0xffffb9e3, 0x5})
r0 = creat(&(0x7f00000016c0)='./file0\x00', 0x63)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000001a40)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x0, 0x0, r0}, 0x68)
executing program 3:
r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000080)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_SENDMSG_ZC={0x30, 0x0, 0x2c, 0xffffffffffffffff, 0x0, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0x3, 0x11, 0x1})
ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc014563b, &(0x7f0000000cc0)={0xa, {0x800, 0x7b, 0x1000}})
io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 0:
r0 = socket$kcm(0x11, 0x20000000000000a, 0x300)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff})
sendmsg$tipc(r1, &(0x7f0000003a00)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x9}}, 0x10, &(0x7f0000000b40)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000001a00), 0x101d0}], 0x4}, 0x0)
recvmsg(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000000)=""/90, 0xffa3}, {&(0x7f0000000100)=""/176, 0xb0}, {&(0x7f0000000380)=""/66, 0x42}, {&(0x7f00000005c0)=""/217, 0xd9}], 0x4}, 0x0)
executing program 3:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={<r0=>0xffffffffffffffff})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={<r1=>0xffffffffffffffff})
close_range(r1, 0xffffffffffffffff, 0x2)
dup3(r0, r1, 0x80000)
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 0:
r0 = socket$inet(0x2, 0x2, 0x0)
setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000740)={@multicast2, @local}, 0xc)
setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000400)={0x4, {{0x2, 0x4e23, @multicast2}}}, 0x88)
setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f00000000c0)={@multicast2, @local}, 0x10)
executing program 0:
r0 = syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902"], 0x0)
syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000086d044fc1ffffed00000109022400010000000009040000010300030009210000000122050009058103"], 0x0)
syz_usb_disconnect(r0)
syz_usb_connect(0x5, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000009a65d0860040800"], 0x0)
executing program 1:
setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x1b, &(0x7f00000000c0)={@mcast1, 0x2, 0x1, 0x3}, 0x1f)
r0 = add_key$user(&(0x7f0000000380), &(0x7f0000000000), &(0x7f00000003c0)='X', 0x1, 0xfffffffffffffffe)
r1 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd)
keyctl$dh_compute(0x17, &(0x7f0000000100)={r0, r1, r1}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'streebog512-generic\x00'}})
executing program 1:
r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r0)
ptrace$pokeuser(0x6, r0, 0x388, 0x7ffffffffd)
ptrace$pokeuser(0x6, r0, 0x388, 0x3000000)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x8f, 0xec000000, 0xcd}]})
executing program 2:
pipe(&(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
readv(r0, &(0x7f0000000a40)=[{&(0x7f0000000a80)=""/4103, 0x2ed}], 0x1)
io_setup(0x3ff, &(0x7f0000000500)=<r2=>0x0)
io_submit(r2, 0xf000, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f00000001c0)='m', 0xfffffdfc}])
executing program 1:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000)

program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #1 of len 10 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 4, 4, 4, 4, 4, 4, 4, 4]
detailed listing:
executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', <r1=>0x0})
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000bd7000001600000200000008000300", @ANYRES32=r1, @ANYBLOB="0c0099000200000025000000080026006c0900000800a0006c0900000800270001"], 0x40}, 0x1, 0x0, 0x0, 0x8001}, 0x4040000)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0xc048aeca, &(0x7f0000000580))
executing program 3:
mlockall(0x2)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x42, 0x1ff)
mmap$IORING_OFF_SQ_RING(0xfffff000, 0x2000, 0x2000003, 0x12, r0, 0x0)
munlockall()
executing program 0:
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3)
capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x0, 0x0, 0xffffb9e3, 0x5})
r0 = creat(&(0x7f00000016c0)='./file0\x00', 0x63)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000001a40)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x0, 0x0, r0}, 0x68)
executing program 3:
r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000080)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_SENDMSG_ZC={0x30, 0x0, 0x2c, 0xffffffffffffffff, 0x0, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0x3, 0x11, 0x1})
ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc014563b, &(0x7f0000000cc0)={0xa, {0x800, 0x7b, 0x1000}})
io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 1:
setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x1b, &(0x7f00000000c0)={@mcast1, 0x2, 0x1, 0x3}, 0x1f)
r0 = add_key$user(&(0x7f0000000380), &(0x7f0000000000), &(0x7f00000003c0)='X', 0x1, 0xfffffffffffffffe)
r1 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd)
keyctl$dh_compute(0x17, &(0x7f0000000100)={r0, r1, r1}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'streebog512-generic\x00'}})
executing program 1:
r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r0)
ptrace$pokeuser(0x6, r0, 0x388, 0x7ffffffffd)
ptrace$pokeuser(0x6, r0, 0x388, 0x3000000)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x8f, 0xec000000, 0xcd}]})
executing program 2:
pipe(&(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
readv(r0, &(0x7f0000000a40)=[{&(0x7f0000000a80)=""/4103, 0x2ed}], 0x1)
io_setup(0x3ff, &(0x7f0000000500)=<r2=>0x0)
io_submit(r2, 0xf000, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f00000001c0)='m', 0xfffffdfc}])
executing program 1:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 4, 4, 4, 4, 4, 4, 4, 4]
detailed listing:
executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', <r1=>0x0})
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000bd7000001600000200000008000300", @ANYRES32=r1, @ANYBLOB="0c0099000200000025000000080026006c0900000800a0006c0900000800270001"], 0x40}, 0x1, 0x0, 0x0, 0x8001}, 0x4040000)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0xc048aeca, &(0x7f0000000580))
executing program 3:
mlockall(0x2)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x42, 0x1ff)
mmap$IORING_OFF_SQ_RING(0xfffff000, 0x2000, 0x2000003, 0x12, r0, 0x0)
munlockall()
executing program 0:
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3)
capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x0, 0x0, 0xffffb9e3, 0x5})
r0 = creat(&(0x7f00000016c0)='./file0\x00', 0x63)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000001a40)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x0, 0x0, r0}, 0x68)
executing program 3:
r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000080)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_SENDMSG_ZC={0x30, 0x0, 0x2c, 0xffffffffffffffff, 0x0, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0x3, 0x11, 0x1})
ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc014563b, &(0x7f0000000cc0)={0xa, {0x800, 0x7b, 0x1000}})
io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 0:
r0 = socket$kcm(0x11, 0x20000000000000a, 0x300)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff})
sendmsg$tipc(r1, &(0x7f0000003a00)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x9}}, 0x10, &(0x7f0000000b40)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000001a00), 0x101d0}], 0x4}, 0x0)
recvmsg(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000000)=""/90, 0xffa3}, {&(0x7f0000000100)=""/176, 0xb0}, {&(0x7f0000000380)=""/66, 0x42}, {&(0x7f00000005c0)=""/217, 0xd9}], 0x4}, 0x0)
executing program 3:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={<r0=>0xffffffffffffffff})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={<r1=>0xffffffffffffffff})
close_range(r1, 0xffffffffffffffff, 0x2)
dup3(r0, r1, 0x80000)
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 0:
r0 = socket$inet(0x2, 0x2, 0x0)
setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000740)={@multicast2, @local}, 0xc)
setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000400)={0x4, {{0x2, 0x4e23, @multicast2}}}, 0x88)
setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f00000000c0)={@multicast2, @local}, 0x10)
executing program 0:
r0 = syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902"], 0x0)
syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000086d044fc1ffffed00000109022400010000000009040000010300030009210000000122050009058103"], 0x0)
syz_usb_disconnect(r0)
syz_usb_connect(0x5, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000009a65d0860040800"], 0x0)

program did not crash
bisect: split chunks (needed=true): <5>, <5>, <5>
bisect: split chunk #0 of len 5 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4]
detailed listing:
executing program 0:
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3)
capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x0, 0x0, 0xffffb9e3, 0x5})
r0 = creat(&(0x7f00000016c0)='./file0\x00', 0x63)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000001a40)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x0, 0x0, r0}, 0x68)
executing program 3:
r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000080)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_SENDMSG_ZC={0x30, 0x0, 0x2c, 0xffffffffffffffff, 0x0, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0x3, 0x11, 0x1})
ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc014563b, &(0x7f0000000cc0)={0xa, {0x800, 0x7b, 0x1000}})
io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 0:
r0 = socket$kcm(0x11, 0x20000000000000a, 0x300)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff})
sendmsg$tipc(r1, &(0x7f0000003a00)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x9}}, 0x10, &(0x7f0000000b40)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000001a00), 0x101d0}], 0x4}, 0x0)
recvmsg(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000000)=""/90, 0xffa3}, {&(0x7f0000000100)=""/176, 0xb0}, {&(0x7f0000000380)=""/66, 0x42}, {&(0x7f00000005c0)=""/217, 0xd9}], 0x4}, 0x0)
executing program 3:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={<r0=>0xffffffffffffffff})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={<r1=>0xffffffffffffffff})
close_range(r1, 0xffffffffffffffff, 0x2)
dup3(r0, r1, 0x80000)
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 0:
r0 = socket$inet(0x2, 0x2, 0x0)
setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000740)={@multicast2, @local}, 0xc)
setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000400)={0x4, {{0x2, 0x4e23, @multicast2}}}, 0x88)
setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f00000000c0)={@multicast2, @local}, 0x10)
executing program 0:
r0 = syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902"], 0x0)
syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000086d044fc1ffffed00000109022400010000000009040000010300030009210000000122050009058103"], 0x0)
syz_usb_disconnect(r0)
syz_usb_connect(0x5, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000009a65d0860040800"], 0x0)
executing program 1:
setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x1b, &(0x7f00000000c0)={@mcast1, 0x2, 0x1, 0x3}, 0x1f)
r0 = add_key$user(&(0x7f0000000380), &(0x7f0000000000), &(0x7f00000003c0)='X', 0x1, 0xfffffffffffffffe)
r1 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd)
keyctl$dh_compute(0x17, &(0x7f0000000100)={r0, r1, r1}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'streebog512-generic\x00'}})
executing program 1:
r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r0)
ptrace$pokeuser(0x6, r0, 0x388, 0x7ffffffffd)
ptrace$pokeuser(0x6, r0, 0x388, 0x3000000)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x8f, 0xec000000, 0xcd}]})
executing program 2:
pipe(&(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
readv(r0, &(0x7f0000000a40)=[{&(0x7f0000000a80)=""/4103, 0x2ed}], 0x1)
io_setup(0x3ff, &(0x7f0000000500)=<r2=>0x0)
io_submit(r2, 0xf000, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f00000001c0)='m', 0xfffffdfc}])
executing program 1:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4]
detailed listing:
executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', <r1=>0x0})
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000bd7000001600000200000008000300", @ANYRES32=r1, @ANYBLOB="0c0099000200000025000000080026006c0900000800a0006c0900000800270001"], 0x40}, 0x1, 0x0, 0x0, 0x8001}, 0x4040000)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0xc048aeca, &(0x7f0000000580))
executing program 3:
mlockall(0x2)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x42, 0x1ff)
mmap$IORING_OFF_SQ_RING(0xfffff000, 0x2000, 0x2000003, 0x12, r0, 0x0)
munlockall()
executing program 0:
r0 = socket$kcm(0x11, 0x20000000000000a, 0x300)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff})
sendmsg$tipc(r1, &(0x7f0000003a00)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x9}}, 0x10, &(0x7f0000000b40)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000001a00), 0x101d0}], 0x4}, 0x0)
recvmsg(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000000)=""/90, 0xffa3}, {&(0x7f0000000100)=""/176, 0xb0}, {&(0x7f0000000380)=""/66, 0x42}, {&(0x7f00000005c0)=""/217, 0xd9}], 0x4}, 0x0)
executing program 3:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={<r0=>0xffffffffffffffff})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={<r1=>0xffffffffffffffff})
close_range(r1, 0xffffffffffffffff, 0x2)
dup3(r0, r1, 0x80000)
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 0:
r0 = socket$inet(0x2, 0x2, 0x0)
setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000740)={@multicast2, @local}, 0xc)
setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000400)={0x4, {{0x2, 0x4e23, @multicast2}}}, 0x88)
setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f00000000c0)={@multicast2, @local}, 0x10)
executing program 0:
r0 = syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902"], 0x0)
syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000086d044fc1ffffed00000109022400010000000009040000010300030009210000000122050009058103"], 0x0)
syz_usb_disconnect(r0)
syz_usb_connect(0x5, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000009a65d0860040800"], 0x0)
executing program 1:
setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x1b, &(0x7f00000000c0)={@mcast1, 0x2, 0x1, 0x3}, 0x1f)
r0 = add_key$user(&(0x7f0000000380), &(0x7f0000000000), &(0x7f00000003c0)='X', 0x1, 0xfffffffffffffffe)
r1 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd)
keyctl$dh_compute(0x17, &(0x7f0000000100)={r0, r1, r1}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'streebog512-generic\x00'}})
executing program 1:
r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r0)
ptrace$pokeuser(0x6, r0, 0x388, 0x7ffffffffd)
ptrace$pokeuser(0x6, r0, 0x388, 0x3000000)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x8f, 0xec000000, 0xcd}]})
executing program 2:
pipe(&(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
readv(r0, &(0x7f0000000a40)=[{&(0x7f0000000a80)=""/4103, 0x2ed}], 0x1)
io_setup(0x3ff, &(0x7f0000000500)=<r2=>0x0)
io_submit(r2, 0xf000, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f00000001c0)='m', 0xfffffdfc}])
executing program 1:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000)

program did not crash
bisect: split chunk #1 of len 5 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4]
detailed listing:
executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', <r1=>0x0})
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000bd7000001600000200000008000300", @ANYRES32=r1, @ANYBLOB="0c0099000200000025000000080026006c0900000800a0006c0900000800270001"], 0x40}, 0x1, 0x0, 0x0, 0x8001}, 0x4040000)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0xc048aeca, &(0x7f0000000580))
executing program 3:
mlockall(0x2)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x42, 0x1ff)
mmap$IORING_OFF_SQ_RING(0xfffff000, 0x2000, 0x2000003, 0x12, r0, 0x0)
munlockall()
executing program 0:
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3)
capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x0, 0x0, 0xffffb9e3, 0x5})
r0 = creat(&(0x7f00000016c0)='./file0\x00', 0x63)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000001a40)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x0, 0x0, r0}, 0x68)
executing program 3:
r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000080)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_SENDMSG_ZC={0x30, 0x0, 0x2c, 0xffffffffffffffff, 0x0, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0x3, 0x11, 0x1})
ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc014563b, &(0x7f0000000cc0)={0xa, {0x800, 0x7b, 0x1000}})
io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 0:
r0 = socket$inet(0x2, 0x2, 0x0)
setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000740)={@multicast2, @local}, 0xc)
setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000400)={0x4, {{0x2, 0x4e23, @multicast2}}}, 0x88)
setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f00000000c0)={@multicast2, @local}, 0x10)
executing program 0:
r0 = syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902"], 0x0)
syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000086d044fc1ffffed00000109022400010000000009040000010300030009210000000122050009058103"], 0x0)
syz_usb_disconnect(r0)
syz_usb_connect(0x5, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000009a65d0860040800"], 0x0)
executing program 1:
setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x1b, &(0x7f00000000c0)={@mcast1, 0x2, 0x1, 0x3}, 0x1f)
r0 = add_key$user(&(0x7f0000000380), &(0x7f0000000000), &(0x7f00000003c0)='X', 0x1, 0xfffffffffffffffe)
r1 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd)
keyctl$dh_compute(0x17, &(0x7f0000000100)={r0, r1, r1}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'streebog512-generic\x00'}})
executing program 1:
r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r0)
ptrace$pokeuser(0x6, r0, 0x388, 0x7ffffffffd)
ptrace$pokeuser(0x6, r0, 0x388, 0x3000000)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x8f, 0xec000000, 0xcd}]})
executing program 2:
pipe(&(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
readv(r0, &(0x7f0000000a40)=[{&(0x7f0000000a80)=""/4103, 0x2ed}], 0x1)
io_setup(0x3ff, &(0x7f0000000500)=<r2=>0x0)
io_submit(r2, 0xf000, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f00000001c0)='m', 0xfffffdfc}])
executing program 1:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4]
detailed listing:
executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', <r1=>0x0})
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000bd7000001600000200000008000300", @ANYRES32=r1, @ANYBLOB="0c0099000200000025000000080026006c0900000800a0006c0900000800270001"], 0x40}, 0x1, 0x0, 0x0, 0x8001}, 0x4040000)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0xc048aeca, &(0x7f0000000580))
executing program 3:
mlockall(0x2)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x42, 0x1ff)
mmap$IORING_OFF_SQ_RING(0xfffff000, 0x2000, 0x2000003, 0x12, r0, 0x0)
munlockall()
executing program 0:
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3)
capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x0, 0x0, 0xffffb9e3, 0x5})
r0 = creat(&(0x7f00000016c0)='./file0\x00', 0x63)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000001a40)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x0, 0x0, r0}, 0x68)
executing program 3:
r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000080)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_SENDMSG_ZC={0x30, 0x0, 0x2c, 0xffffffffffffffff, 0x0, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0x3, 0x11, 0x1})
ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc014563b, &(0x7f0000000cc0)={0xa, {0x800, 0x7b, 0x1000}})
io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 0:
r0 = socket$kcm(0x11, 0x20000000000000a, 0x300)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff})
sendmsg$tipc(r1, &(0x7f0000003a00)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x9}}, 0x10, &(0x7f0000000b40)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000001a00), 0x101d0}], 0x4}, 0x0)
recvmsg(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000000)=""/90, 0xffa3}, {&(0x7f0000000100)=""/176, 0xb0}, {&(0x7f0000000380)=""/66, 0x42}, {&(0x7f00000005c0)=""/217, 0xd9}], 0x4}, 0x0)
executing program 3:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={<r0=>0xffffffffffffffff})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={<r1=>0xffffffffffffffff})
close_range(r1, 0xffffffffffffffff, 0x2)
dup3(r0, r1, 0x80000)
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 1:
setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x1b, &(0x7f00000000c0)={@mcast1, 0x2, 0x1, 0x3}, 0x1f)
r0 = add_key$user(&(0x7f0000000380), &(0x7f0000000000), &(0x7f00000003c0)='X', 0x1, 0xfffffffffffffffe)
r1 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd)
keyctl$dh_compute(0x17, &(0x7f0000000100)={r0, r1, r1}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'streebog512-generic\x00'}})
executing program 1:
r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r0)
ptrace$pokeuser(0x6, r0, 0x388, 0x7ffffffffd)
ptrace$pokeuser(0x6, r0, 0x388, 0x3000000)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x8f, 0xec000000, 0xcd}]})
executing program 2:
pipe(&(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
readv(r0, &(0x7f0000000a40)=[{&(0x7f0000000a80)=""/4103, 0x2ed}], 0x1)
io_setup(0x3ff, &(0x7f0000000500)=<r2=>0x0)
io_submit(r2, 0xf000, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f00000001c0)='m', 0xfffffdfc}])
executing program 1:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000)

program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
bisect: the chunk can be dropped
bisect: split chunk #2 of len 5 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 4, 4, 4, 4, 4, 4, 4, 4]
detailed listing:
executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', <r1=>0x0})
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000bd7000001600000200000008000300", @ANYRES32=r1, @ANYBLOB="0c0099000200000025000000080026006c0900000800a0006c0900000800270001"], 0x40}, 0x1, 0x0, 0x0, 0x8001}, 0x4040000)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0xc048aeca, &(0x7f0000000580))
executing program 3:
mlockall(0x2)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x42, 0x1ff)
mmap$IORING_OFF_SQ_RING(0xfffff000, 0x2000, 0x2000003, 0x12, r0, 0x0)
munlockall()
executing program 0:
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3)
capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x0, 0x0, 0xffffb9e3, 0x5})
r0 = creat(&(0x7f00000016c0)='./file0\x00', 0x63)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000001a40)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x0, 0x0, r0}, 0x68)
executing program 3:
r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000080)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_SENDMSG_ZC={0x30, 0x0, 0x2c, 0xffffffffffffffff, 0x0, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0x3, 0x11, 0x1})
ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc014563b, &(0x7f0000000cc0)={0xa, {0x800, 0x7b, 0x1000}})
io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 0:
r0 = socket$kcm(0x11, 0x20000000000000a, 0x300)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff})
sendmsg$tipc(r1, &(0x7f0000003a00)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x9}}, 0x10, &(0x7f0000000b40)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000001a00), 0x101d0}], 0x4}, 0x0)
recvmsg(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000000)=""/90, 0xffa3}, {&(0x7f0000000100)=""/176, 0xb0}, {&(0x7f0000000380)=""/66, 0x42}, {&(0x7f00000005c0)=""/217, 0xd9}], 0x4}, 0x0)
executing program 3:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={<r0=>0xffffffffffffffff})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={<r1=>0xffffffffffffffff})
close_range(r1, 0xffffffffffffffff, 0x2)
dup3(r0, r1, 0x80000)
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 2:
pipe(&(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
readv(r0, &(0x7f0000000a40)=[{&(0x7f0000000a80)=""/4103, 0x2ed}], 0x1)
io_setup(0x3ff, &(0x7f0000000500)=<r2=>0x0)
io_submit(r2, 0xf000, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f00000001c0)='m', 0xfffffdfc}])
executing program 1:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4]
detailed listing:
executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', <r1=>0x0})
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000bd7000001600000200000008000300", @ANYRES32=r1, @ANYBLOB="0c0099000200000025000000080026006c0900000800a0006c0900000800270001"], 0x40}, 0x1, 0x0, 0x0, 0x8001}, 0x4040000)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0xc048aeca, &(0x7f0000000580))
executing program 3:
mlockall(0x2)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x42, 0x1ff)
mmap$IORING_OFF_SQ_RING(0xfffff000, 0x2000, 0x2000003, 0x12, r0, 0x0)
munlockall()
executing program 0:
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3)
capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x0, 0x0, 0xffffb9e3, 0x5})
r0 = creat(&(0x7f00000016c0)='./file0\x00', 0x63)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000001a40)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x0, 0x0, r0}, 0x68)
executing program 3:
r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000080)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_SENDMSG_ZC={0x30, 0x0, 0x2c, 0xffffffffffffffff, 0x0, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0x3, 0x11, 0x1})
ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc014563b, &(0x7f0000000cc0)={0xa, {0x800, 0x7b, 0x1000}})
io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 0:
r0 = socket$kcm(0x11, 0x20000000000000a, 0x300)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff})
sendmsg$tipc(r1, &(0x7f0000003a00)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x9}}, 0x10, &(0x7f0000000b40)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000001a00), 0x101d0}], 0x4}, 0x0)
recvmsg(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000000)=""/90, 0xffa3}, {&(0x7f0000000100)=""/176, 0xb0}, {&(0x7f0000000380)=""/66, 0x42}, {&(0x7f00000005c0)=""/217, 0xd9}], 0x4}, 0x0)
executing program 3:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={<r0=>0xffffffffffffffff})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={<r1=>0xffffffffffffffff})
close_range(r1, 0xffffffffffffffff, 0x2)
dup3(r0, r1, 0x80000)
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 1:
setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x1b, &(0x7f00000000c0)={@mcast1, 0x2, 0x1, 0x3}, 0x1f)
r0 = add_key$user(&(0x7f0000000380), &(0x7f0000000000), &(0x7f00000003c0)='X', 0x1, 0xfffffffffffffffe)
r1 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd)
keyctl$dh_compute(0x17, &(0x7f0000000100)={r0, r1, r1}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'streebog512-generic\x00'}})
executing program 1:
r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r0)
ptrace$pokeuser(0x6, r0, 0x388, 0x7ffffffffd)
ptrace$pokeuser(0x6, r0, 0x388, 0x3000000)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x8f, 0xec000000, 0xcd}]})

program did not crash
bisect: split chunks (needed=true): <3>, <2>, <3>, <3>, <2>
bisect: split chunk #0 of len 3 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4]
detailed listing:
executing program 3:
mlockall(0x2)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x42, 0x1ff)
mmap$IORING_OFF_SQ_RING(0xfffff000, 0x2000, 0x2000003, 0x12, r0, 0x0)
munlockall()
executing program 0:
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3)
capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x0, 0x0, 0xffffb9e3, 0x5})
r0 = creat(&(0x7f00000016c0)='./file0\x00', 0x63)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000001a40)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x0, 0x0, r0}, 0x68)
executing program 3:
r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000080)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_SENDMSG_ZC={0x30, 0x0, 0x2c, 0xffffffffffffffff, 0x0, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0x3, 0x11, 0x1})
ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc014563b, &(0x7f0000000cc0)={0xa, {0x800, 0x7b, 0x1000}})
io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 0:
r0 = socket$kcm(0x11, 0x20000000000000a, 0x300)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff})
sendmsg$tipc(r1, &(0x7f0000003a00)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x9}}, 0x10, &(0x7f0000000b40)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000001a00), 0x101d0}], 0x4}, 0x0)
recvmsg(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000000)=""/90, 0xffa3}, {&(0x7f0000000100)=""/176, 0xb0}, {&(0x7f0000000380)=""/66, 0x42}, {&(0x7f00000005c0)=""/217, 0xd9}], 0x4}, 0x0)
executing program 3:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={<r0=>0xffffffffffffffff})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={<r1=>0xffffffffffffffff})
close_range(r1, 0xffffffffffffffff, 0x2)
dup3(r0, r1, 0x80000)
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 1:
setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x1b, &(0x7f00000000c0)={@mcast1, 0x2, 0x1, 0x3}, 0x1f)
r0 = add_key$user(&(0x7f0000000380), &(0x7f0000000000), &(0x7f00000003c0)='X', 0x1, 0xfffffffffffffffe)
r1 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd)
keyctl$dh_compute(0x17, &(0x7f0000000100)={r0, r1, r1}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'streebog512-generic\x00'}})
executing program 1:
r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r0)
ptrace$pokeuser(0x6, r0, 0x388, 0x7ffffffffd)
ptrace$pokeuser(0x6, r0, 0x388, 0x3000000)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x8f, 0xec000000, 0xcd}]})
executing program 2:
pipe(&(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
readv(r0, &(0x7f0000000a40)=[{&(0x7f0000000a80)=""/4103, 0x2ed}], 0x1)
io_setup(0x3ff, &(0x7f0000000500)=<r2=>0x0)
io_submit(r2, 0xf000, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f00000001c0)='m', 0xfffffdfc}])
executing program 1:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000)

program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #1 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 4, 4, 4, 4, 4, 4, 4, 4]
detailed listing:
executing program 3:
mlockall(0x2)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x42, 0x1ff)
mmap$IORING_OFF_SQ_RING(0xfffff000, 0x2000, 0x2000003, 0x12, r0, 0x0)
munlockall()
executing program 3:
r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000080)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_SENDMSG_ZC={0x30, 0x0, 0x2c, 0xffffffffffffffff, 0x0, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0x3, 0x11, 0x1})
ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc014563b, &(0x7f0000000cc0)={0xa, {0x800, 0x7b, 0x1000}})
io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 0:
r0 = socket$kcm(0x11, 0x20000000000000a, 0x300)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff})
sendmsg$tipc(r1, &(0x7f0000003a00)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x9}}, 0x10, &(0x7f0000000b40)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000001a00), 0x101d0}], 0x4}, 0x0)
recvmsg(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000000)=""/90, 0xffa3}, {&(0x7f0000000100)=""/176, 0xb0}, {&(0x7f0000000380)=""/66, 0x42}, {&(0x7f00000005c0)=""/217, 0xd9}], 0x4}, 0x0)
executing program 3:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={<r0=>0xffffffffffffffff})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={<r1=>0xffffffffffffffff})
close_range(r1, 0xffffffffffffffff, 0x2)
dup3(r0, r1, 0x80000)
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 1:
setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x1b, &(0x7f00000000c0)={@mcast1, 0x2, 0x1, 0x3}, 0x1f)
r0 = add_key$user(&(0x7f0000000380), &(0x7f0000000000), &(0x7f00000003c0)='X', 0x1, 0xfffffffffffffffe)
r1 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd)
keyctl$dh_compute(0x17, &(0x7f0000000100)={r0, r1, r1}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'streebog512-generic\x00'}})
executing program 1:
r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r0)
ptrace$pokeuser(0x6, r0, 0x388, 0x7ffffffffd)
ptrace$pokeuser(0x6, r0, 0x388, 0x3000000)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x8f, 0xec000000, 0xcd}]})
executing program 2:
pipe(&(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
readv(r0, &(0x7f0000000a40)=[{&(0x7f0000000a80)=""/4103, 0x2ed}], 0x1)
io_setup(0x3ff, &(0x7f0000000500)=<r2=>0x0)
io_submit(r2, 0xf000, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f00000001c0)='m', 0xfffffdfc}])
executing program 1:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000)

program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #2 of len 3 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 4, 4, 4, 4, 4, 4]
detailed listing:
executing program 3:
mlockall(0x2)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x42, 0x1ff)
mmap$IORING_OFF_SQ_RING(0xfffff000, 0x2000, 0x2000003, 0x12, r0, 0x0)
munlockall()
executing program 3:
r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000080)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_SENDMSG_ZC={0x30, 0x0, 0x2c, 0xffffffffffffffff, 0x0, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0x3, 0x11, 0x1})
ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc014563b, &(0x7f0000000cc0)={0xa, {0x800, 0x7b, 0x1000}})
io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 1:
setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x1b, &(0x7f00000000c0)={@mcast1, 0x2, 0x1, 0x3}, 0x1f)
r0 = add_key$user(&(0x7f0000000380), &(0x7f0000000000), &(0x7f00000003c0)='X', 0x1, 0xfffffffffffffffe)
r1 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd)
keyctl$dh_compute(0x17, &(0x7f0000000100)={r0, r1, r1}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'streebog512-generic\x00'}})
executing program 1:
r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r0)
ptrace$pokeuser(0x6, r0, 0x388, 0x7ffffffffd)
ptrace$pokeuser(0x6, r0, 0x388, 0x3000000)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x8f, 0xec000000, 0xcd}]})
executing program 2:
pipe(&(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
readv(r0, &(0x7f0000000a40)=[{&(0x7f0000000a80)=""/4103, 0x2ed}], 0x1)
io_setup(0x3ff, &(0x7f0000000500)=<r2=>0x0)
io_submit(r2, 0xf000, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f00000001c0)='m', 0xfffffdfc}])
executing program 1:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000)

program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #3 of len 3 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 4, 4, 4, 4]
detailed listing:
executing program 3:
mlockall(0x2)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x42, 0x1ff)
mmap$IORING_OFF_SQ_RING(0xfffff000, 0x2000, 0x2000003, 0x12, r0, 0x0)
munlockall()
executing program 3:
r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000080)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_SENDMSG_ZC={0x30, 0x0, 0x2c, 0xffffffffffffffff, 0x0, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0x3, 0x11, 0x1})
ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc014563b, &(0x7f0000000cc0)={0xa, {0x800, 0x7b, 0x1000}})
io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x8f, 0xec000000, 0xcd}]})
executing program 2:
pipe(&(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
readv(r0, &(0x7f0000000a40)=[{&(0x7f0000000a80)=""/4103, 0x2ed}], 0x1)
io_setup(0x3ff, &(0x7f0000000500)=<r2=>0x0)
io_submit(r2, 0xf000, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f00000001c0)='m', 0xfffffdfc}])
executing program 1:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000)

program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #4 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 4, 4, 4]
detailed listing:
executing program 3:
mlockall(0x2)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x42, 0x1ff)
mmap$IORING_OFF_SQ_RING(0xfffff000, 0x2000, 0x2000003, 0x12, r0, 0x0)
munlockall()
executing program 3:
r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000080)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_SENDMSG_ZC={0x30, 0x0, 0x2c, 0xffffffffffffffff, 0x0, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0x3, 0x11, 0x1})
ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc014563b, &(0x7f0000000cc0)={0xa, {0x800, 0x7b, 0x1000}})
io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x8f, 0xec000000, 0xcd}]})
executing program 1:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000)

program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <1>, <1>, <1>, <1>, <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: split chunk #1 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: split chunk #2 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: split chunk #3 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: split chunk #4 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 5 programs left: 

executing program 3:
mlockall(0x2)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x42, 0x1ff)
mmap$IORING_OFF_SQ_RING(0xfffff000, 0x2000, 0x2000003, 0x12, r0, 0x0)
munlockall()
executing program 3:
r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000080)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_SENDMSG_ZC={0x30, 0x0, 0x2c, 0xffffffffffffffff, 0x0, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0x3, 0x11, 0x1})
ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc014563b, &(0x7f0000000cc0)={0xa, {0x800, 0x7b, 0x1000}})
io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x8f, 0xec000000, 0xcd}]})
executing program 1:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000)


bisect: trying to concatenate
bisect: concatenate 5 entries
minimizing program #0 before concatenation
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 4, 4, 4, 4]
detailed listing:
executing program 0:
mlockall(0x2)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x42, 0x1ff)
mmap$IORING_OFF_SQ_RING(0xfffff000, 0x2000, 0x2000003, 0x12, r0, 0x0)
executing program 3:
r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000080)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_SENDMSG_ZC={0x30, 0x0, 0x2c, 0xffffffffffffffff, 0x0, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0x3, 0x11, 0x1})
ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc014563b, &(0x7f0000000cc0)={0xa, {0x800, 0x7b, 0x1000}})
io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x8f, 0xec000000, 0xcd}]})
executing program 1:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000)

program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 4, 4, 4, 4]
detailed listing:
executing program 0:
mlockall(0x2)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x42, 0x1ff)
executing program 3:
r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000080)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_SENDMSG_ZC={0x30, 0x0, 0x2c, 0xffffffffffffffff, 0x0, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0x3, 0x11, 0x1})
ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc014563b, &(0x7f0000000cc0)={0xa, {0x800, 0x7b, 0x1000}})
io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x8f, 0xec000000, 0xcd}]})
executing program 1:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000)

program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 4, 4, 4, 4]
detailed listing:
executing program 0:
mlockall(0x2)
executing program 3:
r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000080)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_SENDMSG_ZC={0x30, 0x0, 0x2c, 0xffffffffffffffff, 0x0, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0x3, 0x11, 0x1})
ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc014563b, &(0x7f0000000cc0)={0xa, {0x800, 0x7b, 0x1000}})
io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x8f, 0xec000000, 0xcd}]})
executing program 1:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000)

program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 4, 4, 4]
detailed listing:
executing program 0:
executing program 3:
r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000080)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_SENDMSG_ZC={0x30, 0x0, 0x2c, 0xffffffffffffffff, 0x0, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0x3, 0x11, 0x1})
ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc014563b, &(0x7f0000000cc0)={0xa, {0x800, 0x7b, 0x1000}})
io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x8f, 0xec000000, 0xcd}]})
executing program 1:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000)

program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
minimized 4 calls -> 0 calls
minimizing program #1 before concatenation
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 3, 4, 4, 4]
detailed listing:
executing program 3:
executing program 0:
syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r0=>0x0, &(0x7f0000000000)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
syz_io_uring_submit(r0, r1, r2, &(0x7f0000000280)=@IORING_OP_SENDMSG_ZC={0x30, 0x0, 0x2c, 0xffffffffffffffff, 0x0, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0x3, 0x11, 0x1})
ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc014563b, &(0x7f0000000cc0)={0xa, {0x800, 0x7b, 0x1000}})
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x8f, 0xec000000, 0xcd}]})
executing program 1:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000)

program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 2, 4, 4, 4]
detailed listing:
executing program 3:
executing program 0:
syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r0=>0x0, &(0x7f0000000000)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
syz_io_uring_submit(r0, r1, r2, &(0x7f0000000280)=@IORING_OP_SENDMSG_ZC={0x30, 0x0, 0x2c, 0xffffffffffffffff, 0x0, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0x3, 0x11, 0x1})
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x8f, 0xec000000, 0xcd}]})
executing program 1:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000)

program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 1, 4, 4, 4]
detailed listing:
executing program 3:
executing program 0:
syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100), &(0x7f0000000000), &(0x7f0000000080))
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x8f, 0xec000000, 0xcd}]})
executing program 1:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000)

program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 4, 4, 4]
detailed listing:
executing program 3:
executing program 0:
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x8f, 0xec000000, 0xcd}]})
executing program 1:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000)

program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
minimized 4 calls -> 0 calls
minimizing program #2 before concatenation
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 3, 4, 4]
detailed listing:
executing program 3:
executing program 3:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x8f, 0xec000000, 0xcd}]})
executing program 1:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000)

program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 2, 4, 4]
detailed listing:
executing program 3:
executing program 3:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x8f, 0xec000000, 0xcd}]})
executing program 1:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 2, 4, 4]
detailed listing:
executing program 3:
executing program 3:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x8f, 0xec000000, 0xcd}]})
executing program 1:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 2, 4, 4]
detailed listing:
executing program 3:
executing program 3:
executing program 0:
syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x8f, 0xec000000, 0xcd}]})
executing program 1:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000)

program did not crash
minimized 4 calls -> 3 calls
minimizing program #3 before concatenation
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 3, 3, 4]
detailed listing:
executing program 3:
executing program 3:
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
executing program 1:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000)

program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 3, 2, 4]
detailed listing:
executing program 3:
executing program 3:
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
executing program 1:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000)

program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 3, 1, 4]
detailed listing:
executing program 3:
executing program 3:
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
executing program 1:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000)

program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 3, 0, 4]
detailed listing:
executing program 3:
executing program 3:
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
executing program 0:
executing program 1:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x1000)

program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
minimized 4 calls -> 0 calls
minimizing program #4 before concatenation
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 3, 0, 3]
detailed listing:
executing program 3:
executing program 3:
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
executing program 1:
executing program 0:
r0 = syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000003c0)={r1, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}})

program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 3, 0, 2]
detailed listing:
executing program 3:
executing program 3:
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
executing program 1:
executing program 0:
syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf)

program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 3, 0, 1]
detailed listing:
executing program 3:
executing program 3:
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
executing program 1:
executing program 0:
syz_open_dev$loop(&(0x7f0000000080), 0x440, 0x888e2)

program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 3, 0, 0]
detailed listing:
executing program 3:
executing program 3:
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)
executing program 1:
executing program 0:

program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
minimized 4 calls -> 0 calls
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)

program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
bisect: concatenation succeeded
found reproducer with 3 syscalls
minimizing guilty program
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_control_io$hid-syz_usb_control_io$hid
detailed listing:
executing program 0:
syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x34, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0}, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid
program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
simplifying C reproducer
testing compiled C program (duration=46.5s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid
program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
testing compiled C program (duration=46.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid
program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
testing compiled C program (duration=46.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid
program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
testing compiled C program (duration=46.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid
program did not crash
testing compiled C program (duration=46.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid
program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
testing compiled C program (duration=46.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid
program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
testing compiled C program (duration=46.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid
program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
testing compiled C program (duration=46.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid
program did not crash
testing compiled C program (duration=46.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid
program did not crash
testing compiled C program (duration=46.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid
program did not crash
testing compiled C program (duration=46.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid
program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
testing compiled C program (duration=46.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid
program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
testing compiled C program (duration=46.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid
program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
testing compiled C program (duration=46.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid
program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
testing compiled C program (duration=46.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid
program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
testing compiled C program (duration=46.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid
program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
testing program (duration=46.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)

program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
validation run: crashed=true
testing program (duration=46.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)

program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
validation run: crashed=true
testing program (duration=46.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122cb000705810308000a"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022cb0000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff0075089501910285920905150026ff0075089501910285940906150026ff0075089501910285950907150026ff0075089501910285960908150026ff0075089501910285810909150026ff0075089501910285a3090a150026ff0075089501910285a4090b150026ff0075089501910285b3090c150026ff0075089501910285b4090d150026ff007508950191028593090e150026ff00750895019102c0"], 0x0}, 0x0)

program crashed: KASAN: slab-out-of-bounds Read in hid_dump_input
validation run: crashed=true
reproducing took 1h54m23.191815094s
repro crashed as (corrupted=false):
hid-picolcd 0003:04D8:C002.0001: offset (1) exceeds report_count (1)
==================================================================
BUG: KASAN: slab-out-of-bounds in hid_dump_input+0xcb/0xd0 drivers/hid/hid-debug.c:3132
Read of size 4 at addr ffff8880781683c0 by task kworker/1:3/5344

CPU: 1 UID: 0 PID: 5344 Comm: kworker/1:3 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events fb_deferred_io_work
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 hid_dump_input+0xcb/0xd0 drivers/hid/hid-debug.c:3132
 hid_set_field+0xd3/0x440 drivers/hid/hid-core.c:1936
 picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:112 [inline]
 picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
 picolcd_fb_deferred_io+0x6d5/0x1880 drivers/hid/hid-picolcd_fb.c:403
 fb_deferred_io_work+0x1cf/0x310 drivers/video/fbdev/core/fb_defio.c:405
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 5679:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5334 [inline]
 __kvmalloc_node_noprof+0x53f/0x860 mm/slub.c:6905
 hid_register_field drivers/hid/hid-core.c:133 [inline]
 hid_add_field+0x70a/0x1840 drivers/hid/hid-core.c:340
 hid_parser_main+0x2e1/0xd50 drivers/hid/hid-core.c:-1
 hid_parse_collections drivers/hid/hid-core.c:1291 [inline]
 hid_open_report+0x884/0xf00 drivers/hid/hid-core.c:1384
 hid_parse include/linux/hid.h:1206 [inline]
 picolcd_probe+0x177/0x16c0 drivers/hid/hid-picolcd_core.c:547
 __hid_device_probe drivers/hid/hid-core.c:2829 [inline]
 hid_device_probe+0x42c/0x7c0 drivers/hid/hid-core.c:2866
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3772
 hid_add_device+0x272/0x3e0 drivers/hid/hid-core.c:3010
 usbhid_probe+0x9d4/0xde0 drivers/hid/usbhid/hid-core.c:1452
 usb_probe_interface+0x653/0xc60 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3772
 usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268
 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3772
 usb_new_device+0x99d/0x1620 drivers/usb/core/hub.c:2695
 hub_port_connect drivers/usb/core/hub.c:5567 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
 port_event drivers/usb/core/hub.c:5871 [inline]
 hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5953
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

The buggy address belongs to the object at ffff888078168300
 which belongs to the cache kmalloc-192 of size 192
The buggy address is located 16 bytes to the right of
 allocated 176-byte region [ffff888078168300, ffff8880781683b0)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888078168600 pfn:0x78168
flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000200 ffff88813fe3e3c0 ffff88813fe3d288 ffff88813fe3d288
raw: ffff888078168600 0000000800100006 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5679, tgid 5679 (kworker/1:5), ts 92994444898, free_ts 92993959317
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
 prep_new_page mm/page_alloc.c:1867 [inline]
 get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
 alloc_slab_page mm/slub.c:3266 [inline]
 allocate_slab+0x79/0x5e0 mm/slub.c:3380
 new_slab mm/slub.c:3426 [inline]
 refill_objects+0x2d5/0x350 mm/slub.c:7310
 refill_sheaf mm/slub.c:2804 [inline]
 __pcs_replace_empty_main+0x2bf/0x6b0 mm/slub.c:4675
 alloc_from_pcs mm/slub.c:4773 [inline]
 slab_alloc_node mm/slub.c:4905 [inline]
 __do_kmalloc_node mm/slub.c:5333 [inline]
 __kvmalloc_node_noprof+0x66b/0x860 mm/slub.c:6905
 hid_register_field drivers/hid/hid-core.c:133 [inline]
 hid_add_field+0x70a/0x1840 drivers/hid/hid-core.c:340
 hid_parser_main+0x2e1/0xd50 drivers/hid/hid-core.c:-1
 hid_parse_collections drivers/hid/hid-core.c:1291 [inline]
 hid_open_report+0x884/0xf00 drivers/hid/hid-core.c:1384
 hid_parse include/linux/hid.h:1206 [inline]
 picolcd_probe+0x177/0x16c0 drivers/hid/hid-picolcd_core.c:547
 __hid_device_probe drivers/hid/hid-core.c:2829 [inline]
 hid_device_probe+0x42c/0x7c0 drivers/hid/hid-core.c:2866
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
page last free pid 5679 tgid 5679 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1406 [inline]
 __free_frozen_pages+0xc1e/0xd10 mm/page_alloc.c:2950
 ___free_pages_bulk mm/kasan/shadow.c:333 [inline]
 __kasan_populate_vmalloc_do mm/kasan/shadow.c:385 [inline]
 __kasan_populate_vmalloc+0x12d/0x1c0 mm/kasan/shadow.c:424
 kasan_populate_vmalloc include/linux/kasan.h:580 [inline]
 alloc_vmap_area+0xd1a/0x1420 mm/vmalloc.c:2123
 __get_vm_area_node+0x1f2/0x300 mm/vmalloc.c:3226
 __vmalloc_node_range_noprof+0x358/0x1730 mm/vmalloc.c:4042
 __vmalloc_node_noprof mm/vmalloc.c:4143 [inline]
 vzalloc_noprof+0xb2/0xe0 mm/vmalloc.c:4221
 hid_parse_collections drivers/hid/hid-core.c:1262 [inline]
 hid_open_report+0x2c4/0xf00 drivers/hid/hid-core.c:1384
 hid_parse include/linux/hid.h:1206 [inline]
 picolcd_probe+0x177/0x16c0 drivers/hid/hid-picolcd_core.c:547
 __hid_device_probe drivers/hid/hid-core.c:2829 [inline]
 hid_device_probe+0x42c/0x7c0 drivers/hid/hid-core.c:2866
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153

Memory state around the buggy address:
 ffff888078168280: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
 ffff888078168300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888078168380: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
                                           ^
 ffff888078168400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888078168480: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
==================================================================

final repro crashed as (corrupted=false):
hid-picolcd 0003:04D8:C002.0001: offset (1) exceeds report_count (1)
==================================================================
BUG: KASAN: slab-out-of-bounds in hid_dump_input+0xcb/0xd0 drivers/hid/hid-debug.c:3132
Read of size 4 at addr ffff8880781683c0 by task kworker/1:3/5344

CPU: 1 UID: 0 PID: 5344 Comm: kworker/1:3 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events fb_deferred_io_work
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 hid_dump_input+0xcb/0xd0 drivers/hid/hid-debug.c:3132
 hid_set_field+0xd3/0x440 drivers/hid/hid-core.c:1936
 picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:112 [inline]
 picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
 picolcd_fb_deferred_io+0x6d5/0x1880 drivers/hid/hid-picolcd_fb.c:403
 fb_deferred_io_work+0x1cf/0x310 drivers/video/fbdev/core/fb_defio.c:405
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 5679:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5334 [inline]
 __kvmalloc_node_noprof+0x53f/0x860 mm/slub.c:6905
 hid_register_field drivers/hid/hid-core.c:133 [inline]
 hid_add_field+0x70a/0x1840 drivers/hid/hid-core.c:340
 hid_parser_main+0x2e1/0xd50 drivers/hid/hid-core.c:-1
 hid_parse_collections drivers/hid/hid-core.c:1291 [inline]
 hid_open_report+0x884/0xf00 drivers/hid/hid-core.c:1384
 hid_parse include/linux/hid.h:1206 [inline]
 picolcd_probe+0x177/0x16c0 drivers/hid/hid-picolcd_core.c:547
 __hid_device_probe drivers/hid/hid-core.c:2829 [inline]
 hid_device_probe+0x42c/0x7c0 drivers/hid/hid-core.c:2866
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3772
 hid_add_device+0x272/0x3e0 drivers/hid/hid-core.c:3010
 usbhid_probe+0x9d4/0xde0 drivers/hid/usbhid/hid-core.c:1452
 usb_probe_interface+0x653/0xc60 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3772
 usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268
 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3772
 usb_new_device+0x99d/0x1620 drivers/usb/core/hub.c:2695
 hub_port_connect drivers/usb/core/hub.c:5567 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
 port_event drivers/usb/core/hub.c:5871 [inline]
 hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5953
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

The buggy address belongs to the object at ffff888078168300
 which belongs to the cache kmalloc-192 of size 192
The buggy address is located 16 bytes to the right of
 allocated 176-byte region [ffff888078168300, ffff8880781683b0)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888078168600 pfn:0x78168
flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000200 ffff88813fe3e3c0 ffff88813fe3d288 ffff88813fe3d288
raw: ffff888078168600 0000000800100006 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5679, tgid 5679 (kworker/1:5), ts 92994444898, free_ts 92993959317
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
 prep_new_page mm/page_alloc.c:1867 [inline]
 get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
 alloc_slab_page mm/slub.c:3266 [inline]
 allocate_slab+0x79/0x5e0 mm/slub.c:3380
 new_slab mm/slub.c:3426 [inline]
 refill_objects+0x2d5/0x350 mm/slub.c:7310
 refill_sheaf mm/slub.c:2804 [inline]
 __pcs_replace_empty_main+0x2bf/0x6b0 mm/slub.c:4675
 alloc_from_pcs mm/slub.c:4773 [inline]
 slab_alloc_node mm/slub.c:4905 [inline]
 __do_kmalloc_node mm/slub.c:5333 [inline]
 __kvmalloc_node_noprof+0x66b/0x860 mm/slub.c:6905
 hid_register_field drivers/hid/hid-core.c:133 [inline]
 hid_add_field+0x70a/0x1840 drivers/hid/hid-core.c:340
 hid_parser_main+0x2e1/0xd50 drivers/hid/hid-core.c:-1
 hid_parse_collections drivers/hid/hid-core.c:1291 [inline]
 hid_open_report+0x884/0xf00 drivers/hid/hid-core.c:1384
 hid_parse include/linux/hid.h:1206 [inline]
 picolcd_probe+0x177/0x16c0 drivers/hid/hid-picolcd_core.c:547
 __hid_device_probe drivers/hid/hid-core.c:2829 [inline]
 hid_device_probe+0x42c/0x7c0 drivers/hid/hid-core.c:2866
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
page last free pid 5679 tgid 5679 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1406 [inline]
 __free_frozen_pages+0xc1e/0xd10 mm/page_alloc.c:2950
 ___free_pages_bulk mm/kasan/shadow.c:333 [inline]
 __kasan_populate_vmalloc_do mm/kasan/shadow.c:385 [inline]
 __kasan_populate_vmalloc+0x12d/0x1c0 mm/kasan/shadow.c:424
 kasan_populate_vmalloc include/linux/kasan.h:580 [inline]
 alloc_vmap_area+0xd1a/0x1420 mm/vmalloc.c:2123
 __get_vm_area_node+0x1f2/0x300 mm/vmalloc.c:3226
 __vmalloc_node_range_noprof+0x358/0x1730 mm/vmalloc.c:4042
 __vmalloc_node_noprof mm/vmalloc.c:4143 [inline]
 vzalloc_noprof+0xb2/0xe0 mm/vmalloc.c:4221
 hid_parse_collections drivers/hid/hid-core.c:1262 [inline]
 hid_open_report+0x2c4/0xf00 drivers/hid/hid-core.c:1384
 hid_parse include/linux/hid.h:1206 [inline]
 picolcd_probe+0x177/0x16c0 drivers/hid/hid-picolcd_core.c:547
 __hid_device_probe drivers/hid/hid-core.c:2829 [inline]
 hid_device_probe+0x42c/0x7c0 drivers/hid/hid-core.c:2866
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153

Memory state around the buggy address:
 ffff888078168280: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
 ffff888078168300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888078168380: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
                                           ^
 ffff888078168400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888078168480: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
==================================================================