Extracting prog: 5m18.296666839s
Minimizing prog: 1h11m40.060120371s
Simplifying prog options: 0s
Extracting C: 1m54.71784636s
Simplifying C: 10m42.389325668s


extracting reproducer from 24 programs
testing a last program of every proc
single: executing 4 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$KVM_GET_STATS_FD_vm-socket$packet-ioctl$sock_SIOCGIFINDEX-sendto$packet-socket$packet-setsockopt$packet_int-openat$kvm-ioctl$KVM_CREATE_VM-preadv-ioctl$KVM_CAP_EXIT_ON_EMULATION_FAILURE-ioctl$KVM_CREATE_VCPU
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x5e, 0xc9, 0x5e, 0x20, 0x7ca, 0xb800, 0x76b, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x2, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x41, 0x2, 0x0, 0x3}}]}}]}}, 0x0)
r0 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece)
r1 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'ip6tnl0\x00', <r2=>0x0})
sendto$packet(r1, &(0x7f00000002c0)="05", 0x1, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r2, 0x1, 0xff, 0x6, @multicast}, 0x14)
r3 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_int(r3, 0x107, 0x13, &(0x7f0000000000)=0x80000, 0x4)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
preadv(r3, &(0x7f0000000080)=[{&(0x7f0000000040)=""/43, 0x2b}], 0x1, 0x9, 0xff)
ioctl$KVM_CAP_EXIT_ON_EMULATION_FAILURE(r5, 0x4068aea3, &(0x7f00000000c0)={0xcc, 0x0, 0x1})
ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-openat$tun-ioctl$TUNSETIFF-socket$kcm-ioctl$TUNSETLINK-ioctl$SIOCSIFHWADDR-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_XCRS-syz_usb_connect-syz_kvm_setup_cpu$x86-socket-sendto$inet6-ioctl$KVM_SET_GUEST_DEBUG_x86-ioctl$KVM_RUN
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x8ab43, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r3 = socket$kcm(0x2, 0x3, 0x2)
ioctl$TUNSETLINK(r2, 0x400454cd, 0x334) (async)
ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast})
r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2)
ioctl$KVM_SET_XCRS(r4, 0x4188aea7, &(0x7f0000000040)={0xf, 0xfff, [{0x1b10f3cf, 0x0, 0x6}, {0x19fc9256, 0x0, 0xf}, {0x3, 0x0, 0x7}, {0x800, 0x0, 0x1}, {0xfa93, 0x0, 0xd7d1}, {0x2, 0x0, 0xfacc}, {0xb, 0x0, 0xfffffffeffffffff}, {0x0, 0x0, 0x7}, {0xf, 0x0, 0x9}, {0xfffffff9, 0x0, 0x1ff}, {0x0, 0x0, 0x6}, {0x1, 0x0, 0x10000}, {0x5}, {0x2}, {0x8001, 0x0, 0x7}, {0x5, 0x0, 0x9b5}]}) (async)
syz_usb_connect(0x3, 0x2d, &(0x7f00000003c0)={{0x12, 0x1, 0x0, 0xd3, 0xcc, 0xb5, 0x10, 0x13b1, 0x42, 0x2b29, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0xfc, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xf, 0x0, 0x1, 0xe7, 0x11, 0xe1, 0x0, [], [{{0x9, 0x5, 0x83, 0x0, 0x3ff, 0x3, 0x7, 0x4}}]}}]}}]}}, 0x0) (async)
syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000fd4000/0x18000)=nil, &(0x7f0000000000)=[@text32={0x20, &(0x7f0000000bc0)="f30f21f866baf80cb88cf6828cef66bafc0c66b80d0066ef0f013d505500000f083e0fc79c258d00c0fe0f060f20d835080000000f22d8ff32c4e17b1117c4e295008382000000", 0x47}], 0x1, 0x40, 0x0, 0x0) (async)
r5 = socket(0x40000000015, 0x5, 0x0)
sendto$inet6(r5, 0x0, 0x0, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x43}}, 0x4}, 0x1c)
ioctl$KVM_SET_GUEST_DEBUG_x86(r4, 0x4048ae9b, &(0x7f00000005c0)={0x3, 0x0, {[0x5, 0x6, 0x3, 0x0, 0x8, 0x8b, 0xb4, 0x2]}})
ioctl$KVM_RUN(r4, 0xae80, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-openat$udambuf-syz_init_net_socket$nl_generic-syz_usb_connect-add_key$keyring-request_key-add_key-syz_genetlink_get_family_id$nl802154-socket$nl_netfilter-keyctl$unlink-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-openat$ttynull-ioctl$TCSETSF2-ioctl$TIOCSTI-ioctl$sock_SIOCETHTOOL-sendmsg$NL802154_CMD_DEL_SEC_KEY-openat$tun-ioctl$TUNSETIFF-write$tun-syz_clone-getpgid-syz_pidfd_open-pidfd_send_signal-connect$pppl2tp-openat$ttynull-socket$kcm-sendmsg$kcm-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c9741, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x1})
openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_usb_connect(0x0, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="12011001e07ddb406d0490092c4b0102030109818e41a0970c401709048308000101c104"], 0x0)
r2 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffb)
r3 = request_key(&(0x7f0000000240)='encrypted\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000280)='\x00\xa8\xd8~3[q\x1f\x80\xc8\xcd\xd0\xa6\xd2G\xbb}\x1b\xd40\xb7\x1c^T\xb9\xeb\xda1\a]2F\x02\x8f\x0f\xb9K\x06S\xae\xac\x8d\xa89\xf9A\xe85\x93\xd8\xa0L8\x87\x16\xc8\xd7:\xeb\x19\xb1\xb7\xf4\x8c\xa0\xf6\xee\xdf\xf0\x11Y\x81p\xa3b\x8dvHf\xea\xe9\xe5\xce\xcb\x05\xef\x82\x8cYXo\x0e\xa2\b\x1c\xeb;J\x81c\x91[\x8a\x81O\x93g\xd9\xaf\x97\x99\t\xe6?#\x85', r2)
add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, r2)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000fc0), r1)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
keyctl$unlink(0x9, r3, r2)
r5 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x37)
ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2)
r6 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000140), 0x82084, 0x0)
ioctl$TCSETSF2(r6, 0x402c542d, &(0x7f0000000100)={0x10001, 0xe7, 0x2, 0xff, 0x7, "ea71061d0000000001000200", 0x0, 0xb52})
ioctl$TIOCSTI(r6, 0x5412, &(0x7f0000000180)=0x2)
ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000f80)={'wlan1\x00', &(0x7f0000000f40)=@ethtool_stats={0x1d, 0x70}})
sendmsg$NL802154_CMD_DEL_SEC_KEY(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000300)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0x24040801}, 0x20040000)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
write$tun(r7, &(0x7f00000005c0)={@val={0x0, 0x800}, @val={0x3, 0x5, 0x7, 0x2, 0x80, 0x6}, @ipv6=@generic={0x4, 0x6, "84e437", 0x60, 0x0, 0x1, @rand_addr=' \x01\x00', @mcast2, {[], "f0db043c0bdd5fa862ab40e05a5dd2c234dc7773e3831178a890b2a83c13e6f5d1ec7ad9739f588cc88c83a9f836eb8045335fd06dd485c2446031e6847afe2d67d567703ef49b27e9e4936532e95fc00244b2e3f5d127b50a7c3001ae37c96c"}}}, 0x96)
r8 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
r9 = getpgid(r8)
r10 = syz_pidfd_open(r9, 0x0)
pidfd_send_signal(r10, 0x0, 0x0, 0x4)
connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @rand_addr=0x64010100}, 0xb}}, 0x26)
openat$ttynull(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
r11 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000000)="d8000000100081", 0x7}], 0x1}, 0x20000880)
write$cgroup_subtree(r11, &(0x7f00000001c0)=ANY=[@ANYRES8=r0], 0xfe33)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_ADD-set_mempolicy-getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS-userfaultfd-userfaultfd-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-syz_open_dev$tty1-ioctl$KIOCSOUND-ioctl$KIOCSOUND-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$devlink-syz_genetlink_get_family_id$devlink-sendmsg$DEVLINK_CMD_RATE_SET-ioctl$AUTOFS_DEV_IOCTL_EXPIRE-ioctl$AUTOFS_DEV_IOCTL_EXPIRE-sendmsg$rds-ioctl$UFFDIO_API-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-socket-sendmsg$IPCTNL_MSG_EXP_GET-sendmsg$IPCTNL_MSG_EXP_GET-sendmsg$nl_generic-write$uinput_user_dev-syz_open_dev$vim2m-ppoll-ioctl$UFFDIO_COPY
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1)
sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf250100000008000100ffffffff3400048005000300010000000500030002000000050003000500000005000300050000000500030080ff00008a55049d4983a6200800020002"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
set_mempolicy(0x2, &(0x7f0000000080)=0x4716, 0x3)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000780)={0x0, @in6={{0xa, 0x4e24, 0x401, @mcast2, 0xfffffff8}}, 0x0, 0xdc}, &(0x7f0000000840)=0x90)
userfaultfd(0x801) (async)
r3 = userfaultfd(0x801)
r4 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r4, 0x0, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x3) (async)
r5 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r5, 0x4b2f, 0x7f) (async)
ioctl$KIOCSOUND(r5, 0x4b2f, 0x7f)
socket$nl_generic(0x10, 0x3, 0x10) (async)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff) (async)
r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_RATE_SET(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES16=r7, @ANYBLOB="010000000000000000002d00000008005800000000000e0001006e657464657673696d0000000f0002006e657464657673696d300000"], 0x3c}}, 0x0)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000100)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) (async)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000100)={{0x1, 0x1, 0x18, <r8=>r5}, './file0\x00'})
sendmsg$rds(r8, &(0x7f0000000740)={&(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x3f}}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000180)=""/86, 0x56}, {&(0x7f0000000240)=""/95, 0x5f}, {&(0x7f0000000300)=""/60, 0x3c}, {&(0x7f0000000340)=""/132, 0x84}, {&(0x7f0000000400)=""/150, 0x96}, {&(0x7f00000004c0)=""/59, 0x3b}, {&(0x7f0000000580)=""/81, 0x51}, {&(0x7f0000000600)=""/141, 0x8d}], 0x8, 0x0, 0x0, 0x40000}, 0x800)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) (async)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4})
r9 = socket(0x10, 0x3, 0x0)
sendmsg$IPCTNL_MSG_EXP_GET(r9, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000540)={0x44, 0x1, 0x2, 0x7cbbda779fe004e1, 0x0, 0x0, {0xa}, [@CTA_EXPECT_MASTER={0x30, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}}}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000014}, 0x4000840) (async)
sendmsg$IPCTNL_MSG_EXP_GET(r9, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000540)={0x44, 0x1, 0x2, 0x7cbbda779fe004e1, 0x0, 0x0, {0xa}, [@CTA_EXPECT_MASTER={0x30, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}}}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000014}, 0x4000840)
sendmsg$nl_generic(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="640000001900010000000000fbdbdf251d01"], 0x64}, 0x1, 0x0, 0x0, 0x5}, 0x0)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0x1, 0x8, 0x7fffffff, 0x2, 0x80007, 0x7f, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x7, 0x3, 0x0, 0x5, 0x24, 0x1, 0x7, 0x3c5b, 0x1, 0x24, 0x6, 0x1, 0x5, 0xffffffff, 0xe661, 0x4, 0x7, 0x89d2, 0x8, 0x4c74, 0x80000000, 0x40000, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0xd, 0x407, 0x5, 0x3e, 0x2000008f, 0x4006, 0x6, 0x80000000, 0x0, 0x4, 0x8, 0x400, 0x80, 0x0, 0x4, 0x7, 0x8, 0x4, 0xfffffffe, 0x40], [0x10000007, 0xf0000000, 0x8000012f, 0x8004, 0x5, 0x6, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bf, 0x3, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0x10, 0x312, 0xd, 0xea4, 0xffffffff, 0x4, 0x7, 0x7fff, 0x5a7c, 0x420, 0x401, 0x6, 0x0, 0xff, 0x1, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0x4, 0x4, 0x20009, 0x8, 0x9, 0x9, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0xfffffffe, 0x7, 0x9, 0x5, 0x3, 0x8, 0x1, 0x3, 0x6c0, 0xbc45, 0x48c93690, 0x2, 0x3], [0x7, 0x408, 0x8004, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x9, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x10000, 0x3, 0x5, 0x3e7, 0x7, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x0, 0x1, 0x800003, 0x200, 0x7e, 0x7, 0x4, 0x2950bfaf, 0xffe, 0xa2, 0x7, 0xa9, 0x5, 0x9, 0xac8, 0x2000af, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0x0, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x6, 0x80a2f1, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0x8000b, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce7, 0x9, 0x2, 0x57, 0x5, 0x3, 0x101, 0x10001, 0x4, 0x7fff, 0xffff, 0x2000a620, 0x2, 0x5, 0x1, 0x2, 0x5, 0xe7, 0x6, 0x16, 0xfffffffe, 0x80000003, 0x6, 0x4, 0xc8, 0x9, 0xfffff000, 0x10000, 0x3, 0x7e, 0xfd, 0x95ff, 0x7, 0xaf, 0x8, 0x6, 0xffffffff, 0x5, 0x5, 0x8, 0x30b1d693, 0x5, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0x6, 0xfff]}, 0x45c)
syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fffffff, 0x2)
ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0)
ioctl$UFFDIO_COPY(r3, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000800000/0x800000)=nil, &(0x7f00006e8000/0x4000)=nil, 0x800000, 0x1, 0x900})

program crashed: WARNING in cm109_urb_irq_callback
single: successfully extracted reproducer
found reproducer with 37 syscalls
minimizing guilty program
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_ADD-set_mempolicy-getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS-userfaultfd-userfaultfd-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-syz_open_dev$tty1-ioctl$KIOCSOUND-ioctl$KIOCSOUND-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$devlink-syz_genetlink_get_family_id$devlink-sendmsg$DEVLINK_CMD_RATE_SET-ioctl$AUTOFS_DEV_IOCTL_EXPIRE-ioctl$AUTOFS_DEV_IOCTL_EXPIRE-sendmsg$rds-ioctl$UFFDIO_API-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-socket-sendmsg$IPCTNL_MSG_EXP_GET-sendmsg$IPCTNL_MSG_EXP_GET-sendmsg$nl_generic-write$uinput_user_dev-syz_open_dev$vim2m-ppoll
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1)
sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf250100000008000100ffffffff3400048005000300010000000500030002000000050003000500000005000300050000000500030080ff00008a55049d4983a6200800020002"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
set_mempolicy(0x2, &(0x7f0000000080)=0x4716, 0x3)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000780)={0x0, @in6={{0xa, 0x4e24, 0x401, @mcast2, 0xfffffff8}}, 0x0, 0xdc}, &(0x7f0000000840)=0x90)
userfaultfd(0x801) (async)
r3 = userfaultfd(0x801)
r4 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r4, 0x0, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x3) (async)
r5 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r5, 0x4b2f, 0x7f) (async)
ioctl$KIOCSOUND(r5, 0x4b2f, 0x7f)
socket$nl_generic(0x10, 0x3, 0x10) (async)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff) (async)
r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_RATE_SET(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES16=r7, @ANYBLOB="010000000000000000002d00000008005800000000000e0001006e657464657673696d0000000f0002006e657464657673696d300000"], 0x3c}}, 0x0)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000100)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) (async)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000100)={{0x1, 0x1, 0x18, <r8=>r5}, './file0\x00'})
sendmsg$rds(r8, &(0x7f0000000740)={&(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x3f}}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000180)=""/86, 0x56}, {&(0x7f0000000240)=""/95, 0x5f}, {&(0x7f0000000300)=""/60, 0x3c}, {&(0x7f0000000340)=""/132, 0x84}, {&(0x7f0000000400)=""/150, 0x96}, {&(0x7f00000004c0)=""/59, 0x3b}, {&(0x7f0000000580)=""/81, 0x51}, {&(0x7f0000000600)=""/141, 0x8d}], 0x8, 0x0, 0x0, 0x40000}, 0x800)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) (async)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4})
r9 = socket(0x10, 0x3, 0x0)
sendmsg$IPCTNL_MSG_EXP_GET(r9, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000540)={0x44, 0x1, 0x2, 0x7cbbda779fe004e1, 0x0, 0x0, {0xa}, [@CTA_EXPECT_MASTER={0x30, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}}}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000014}, 0x4000840) (async)
sendmsg$IPCTNL_MSG_EXP_GET(r9, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000540)={0x44, 0x1, 0x2, 0x7cbbda779fe004e1, 0x0, 0x0, {0xa}, [@CTA_EXPECT_MASTER={0x30, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}}}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000014}, 0x4000840)
sendmsg$nl_generic(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="640000001900010000000000fbdbdf251d01"], 0x64}, 0x1, 0x0, 0x0, 0x5}, 0x0)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0x1, 0x8, 0x7fffffff, 0x2, 0x80007, 0x7f, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x7, 0x3, 0x0, 0x5, 0x24, 0x1, 0x7, 0x3c5b, 0x1, 0x24, 0x6, 0x1, 0x5, 0xffffffff, 0xe661, 0x4, 0x7, 0x89d2, 0x8, 0x4c74, 0x80000000, 0x40000, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0xd, 0x407, 0x5, 0x3e, 0x2000008f, 0x4006, 0x6, 0x80000000, 0x0, 0x4, 0x8, 0x400, 0x80, 0x0, 0x4, 0x7, 0x8, 0x4, 0xfffffffe, 0x40], [0x10000007, 0xf0000000, 0x8000012f, 0x8004, 0x5, 0x6, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bf, 0x3, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0x10, 0x312, 0xd, 0xea4, 0xffffffff, 0x4, 0x7, 0x7fff, 0x5a7c, 0x420, 0x401, 0x6, 0x0, 0xff, 0x1, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0x4, 0x4, 0x20009, 0x8, 0x9, 0x9, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0xfffffffe, 0x7, 0x9, 0x5, 0x3, 0x8, 0x1, 0x3, 0x6c0, 0xbc45, 0x48c93690, 0x2, 0x3], [0x7, 0x408, 0x8004, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x9, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x10000, 0x3, 0x5, 0x3e7, 0x7, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x0, 0x1, 0x800003, 0x200, 0x7e, 0x7, 0x4, 0x2950bfaf, 0xffe, 0xa2, 0x7, 0xa9, 0x5, 0x9, 0xac8, 0x2000af, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0x0, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x6, 0x80a2f1, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0x8000b, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce7, 0x9, 0x2, 0x57, 0x5, 0x3, 0x101, 0x10001, 0x4, 0x7fff, 0xffff, 0x2000a620, 0x2, 0x5, 0x1, 0x2, 0x5, 0xe7, 0x6, 0x16, 0xfffffffe, 0x80000003, 0x6, 0x4, 0xc8, 0x9, 0xfffff000, 0x10000, 0x3, 0x7e, 0xfd, 0x95ff, 0x7, 0xaf, 0x8, 0x6, 0xffffffff, 0x5, 0x5, 0x8, 0x30b1d693, 0x5, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0x6, 0xfff]}, 0x45c)
syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fffffff, 0x2)
ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0)

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_ADD-set_mempolicy-getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS-userfaultfd-userfaultfd-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-syz_open_dev$tty1-ioctl$KIOCSOUND-ioctl$KIOCSOUND-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$devlink-syz_genetlink_get_family_id$devlink-sendmsg$DEVLINK_CMD_RATE_SET-ioctl$AUTOFS_DEV_IOCTL_EXPIRE-ioctl$AUTOFS_DEV_IOCTL_EXPIRE-sendmsg$rds-ioctl$UFFDIO_API-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-socket-sendmsg$IPCTNL_MSG_EXP_GET-sendmsg$IPCTNL_MSG_EXP_GET-sendmsg$nl_generic-write$uinput_user_dev-syz_open_dev$vim2m
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1)
sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf250100000008000100ffffffff3400048005000300010000000500030002000000050003000500000005000300050000000500030080ff00008a55049d4983a6200800020002"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
set_mempolicy(0x2, &(0x7f0000000080)=0x4716, 0x3)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000780)={0x0, @in6={{0xa, 0x4e24, 0x401, @mcast2, 0xfffffff8}}, 0x0, 0xdc}, &(0x7f0000000840)=0x90)
userfaultfd(0x801) (async)
r3 = userfaultfd(0x801)
r4 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r4, 0x0, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x3) (async)
r5 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r5, 0x4b2f, 0x7f) (async)
ioctl$KIOCSOUND(r5, 0x4b2f, 0x7f)
socket$nl_generic(0x10, 0x3, 0x10) (async)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff) (async)
r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_RATE_SET(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES16=r7, @ANYBLOB="010000000000000000002d00000008005800000000000e0001006e657464657673696d0000000f0002006e657464657673696d300000"], 0x3c}}, 0x0)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000100)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) (async)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000100)={{0x1, 0x1, 0x18, <r8=>r5}, './file0\x00'})
sendmsg$rds(r8, &(0x7f0000000740)={&(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x3f}}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000180)=""/86, 0x56}, {&(0x7f0000000240)=""/95, 0x5f}, {&(0x7f0000000300)=""/60, 0x3c}, {&(0x7f0000000340)=""/132, 0x84}, {&(0x7f0000000400)=""/150, 0x96}, {&(0x7f00000004c0)=""/59, 0x3b}, {&(0x7f0000000580)=""/81, 0x51}, {&(0x7f0000000600)=""/141, 0x8d}], 0x8, 0x0, 0x0, 0x40000}, 0x800)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) (async)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4})
r9 = socket(0x10, 0x3, 0x0)
sendmsg$IPCTNL_MSG_EXP_GET(r9, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000540)={0x44, 0x1, 0x2, 0x7cbbda779fe004e1, 0x0, 0x0, {0xa}, [@CTA_EXPECT_MASTER={0x30, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}}}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000014}, 0x4000840) (async)
sendmsg$IPCTNL_MSG_EXP_GET(r9, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000540)={0x44, 0x1, 0x2, 0x7cbbda779fe004e1, 0x0, 0x0, {0xa}, [@CTA_EXPECT_MASTER={0x30, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}}}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000014}, 0x4000840)
sendmsg$nl_generic(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="640000001900010000000000fbdbdf251d01"], 0x64}, 0x1, 0x0, 0x0, 0x5}, 0x0)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0x1, 0x8, 0x7fffffff, 0x2, 0x80007, 0x7f, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x7, 0x3, 0x0, 0x5, 0x24, 0x1, 0x7, 0x3c5b, 0x1, 0x24, 0x6, 0x1, 0x5, 0xffffffff, 0xe661, 0x4, 0x7, 0x89d2, 0x8, 0x4c74, 0x80000000, 0x40000, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0xd, 0x407, 0x5, 0x3e, 0x2000008f, 0x4006, 0x6, 0x80000000, 0x0, 0x4, 0x8, 0x400, 0x80, 0x0, 0x4, 0x7, 0x8, 0x4, 0xfffffffe, 0x40], [0x10000007, 0xf0000000, 0x8000012f, 0x8004, 0x5, 0x6, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bf, 0x3, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0x10, 0x312, 0xd, 0xea4, 0xffffffff, 0x4, 0x7, 0x7fff, 0x5a7c, 0x420, 0x401, 0x6, 0x0, 0xff, 0x1, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0x4, 0x4, 0x20009, 0x8, 0x9, 0x9, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0xfffffffe, 0x7, 0x9, 0x5, 0x3, 0x8, 0x1, 0x3, 0x6c0, 0xbc45, 0x48c93690, 0x2, 0x3], [0x7, 0x408, 0x8004, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x9, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x10000, 0x3, 0x5, 0x3e7, 0x7, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x0, 0x1, 0x800003, 0x200, 0x7e, 0x7, 0x4, 0x2950bfaf, 0xffe, 0xa2, 0x7, 0xa9, 0x5, 0x9, 0xac8, 0x2000af, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0x0, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x6, 0x80a2f1, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0x8000b, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce7, 0x9, 0x2, 0x57, 0x5, 0x3, 0x101, 0x10001, 0x4, 0x7fff, 0xffff, 0x2000a620, 0x2, 0x5, 0x1, 0x2, 0x5, 0xe7, 0x6, 0x16, 0xfffffffe, 0x80000003, 0x6, 0x4, 0xc8, 0x9, 0xfffff000, 0x10000, 0x3, 0x7e, 0xfd, 0x95ff, 0x7, 0xaf, 0x8, 0x6, 0xffffffff, 0x5, 0x5, 0x8, 0x30b1d693, 0x5, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0x6, 0xfff]}, 0x45c)
syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fffffff, 0x2)

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_ADD-set_mempolicy-getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS-userfaultfd-userfaultfd-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-syz_open_dev$tty1-ioctl$KIOCSOUND-ioctl$KIOCSOUND-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$devlink-syz_genetlink_get_family_id$devlink-sendmsg$DEVLINK_CMD_RATE_SET-ioctl$AUTOFS_DEV_IOCTL_EXPIRE-ioctl$AUTOFS_DEV_IOCTL_EXPIRE-sendmsg$rds-ioctl$UFFDIO_API-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-socket-sendmsg$IPCTNL_MSG_EXP_GET-sendmsg$IPCTNL_MSG_EXP_GET-sendmsg$nl_generic-write$uinput_user_dev
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1)
sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf250100000008000100ffffffff3400048005000300010000000500030002000000050003000500000005000300050000000500030080ff00008a55049d4983a6200800020002"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
set_mempolicy(0x2, &(0x7f0000000080)=0x4716, 0x3)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000780)={0x0, @in6={{0xa, 0x4e24, 0x401, @mcast2, 0xfffffff8}}, 0x0, 0xdc}, &(0x7f0000000840)=0x90)
userfaultfd(0x801) (async)
r3 = userfaultfd(0x801)
r4 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r4, 0x0, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x3) (async)
r5 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r5, 0x4b2f, 0x7f) (async)
ioctl$KIOCSOUND(r5, 0x4b2f, 0x7f)
socket$nl_generic(0x10, 0x3, 0x10) (async)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff) (async)
r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_RATE_SET(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES16=r7, @ANYBLOB="010000000000000000002d00000008005800000000000e0001006e657464657673696d0000000f0002006e657464657673696d300000"], 0x3c}}, 0x0)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000100)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) (async)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000100)={{0x1, 0x1, 0x18, <r8=>r5}, './file0\x00'})
sendmsg$rds(r8, &(0x7f0000000740)={&(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x3f}}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000180)=""/86, 0x56}, {&(0x7f0000000240)=""/95, 0x5f}, {&(0x7f0000000300)=""/60, 0x3c}, {&(0x7f0000000340)=""/132, 0x84}, {&(0x7f0000000400)=""/150, 0x96}, {&(0x7f00000004c0)=""/59, 0x3b}, {&(0x7f0000000580)=""/81, 0x51}, {&(0x7f0000000600)=""/141, 0x8d}], 0x8, 0x0, 0x0, 0x40000}, 0x800)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) (async)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4})
r9 = socket(0x10, 0x3, 0x0)
sendmsg$IPCTNL_MSG_EXP_GET(r9, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000540)={0x44, 0x1, 0x2, 0x7cbbda779fe004e1, 0x0, 0x0, {0xa}, [@CTA_EXPECT_MASTER={0x30, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}}}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000014}, 0x4000840) (async)
sendmsg$IPCTNL_MSG_EXP_GET(r9, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000540)={0x44, 0x1, 0x2, 0x7cbbda779fe004e1, 0x0, 0x0, {0xa}, [@CTA_EXPECT_MASTER={0x30, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}}}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000014}, 0x4000840)
sendmsg$nl_generic(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="640000001900010000000000fbdbdf251d01"], 0x64}, 0x1, 0x0, 0x0, 0x5}, 0x0)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0x1, 0x8, 0x7fffffff, 0x2, 0x80007, 0x7f, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x7, 0x3, 0x0, 0x5, 0x24, 0x1, 0x7, 0x3c5b, 0x1, 0x24, 0x6, 0x1, 0x5, 0xffffffff, 0xe661, 0x4, 0x7, 0x89d2, 0x8, 0x4c74, 0x80000000, 0x40000, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0xd, 0x407, 0x5, 0x3e, 0x2000008f, 0x4006, 0x6, 0x80000000, 0x0, 0x4, 0x8, 0x400, 0x80, 0x0, 0x4, 0x7, 0x8, 0x4, 0xfffffffe, 0x40], [0x10000007, 0xf0000000, 0x8000012f, 0x8004, 0x5, 0x6, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bf, 0x3, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0x10, 0x312, 0xd, 0xea4, 0xffffffff, 0x4, 0x7, 0x7fff, 0x5a7c, 0x420, 0x401, 0x6, 0x0, 0xff, 0x1, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0x4, 0x4, 0x20009, 0x8, 0x9, 0x9, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0xfffffffe, 0x7, 0x9, 0x5, 0x3, 0x8, 0x1, 0x3, 0x6c0, 0xbc45, 0x48c93690, 0x2, 0x3], [0x7, 0x408, 0x8004, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x9, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x10000, 0x3, 0x5, 0x3e7, 0x7, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x0, 0x1, 0x800003, 0x200, 0x7e, 0x7, 0x4, 0x2950bfaf, 0xffe, 0xa2, 0x7, 0xa9, 0x5, 0x9, 0xac8, 0x2000af, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0x0, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x6, 0x80a2f1, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0x8000b, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce7, 0x9, 0x2, 0x57, 0x5, 0x3, 0x101, 0x10001, 0x4, 0x7fff, 0xffff, 0x2000a620, 0x2, 0x5, 0x1, 0x2, 0x5, 0xe7, 0x6, 0x16, 0xfffffffe, 0x80000003, 0x6, 0x4, 0xc8, 0x9, 0xfffff000, 0x10000, 0x3, 0x7e, 0xfd, 0x95ff, 0x7, 0xaf, 0x8, 0x6, 0xffffffff, 0x5, 0x5, 0x8, 0x30b1d693, 0x5, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0x6, 0xfff]}, 0x45c)

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_ADD-set_mempolicy-getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS-userfaultfd-userfaultfd-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-syz_open_dev$tty1-ioctl$KIOCSOUND-ioctl$KIOCSOUND-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$devlink-syz_genetlink_get_family_id$devlink-sendmsg$DEVLINK_CMD_RATE_SET-ioctl$AUTOFS_DEV_IOCTL_EXPIRE-ioctl$AUTOFS_DEV_IOCTL_EXPIRE-sendmsg$rds-ioctl$UFFDIO_API-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-socket-sendmsg$IPCTNL_MSG_EXP_GET-sendmsg$IPCTNL_MSG_EXP_GET-sendmsg$nl_generic
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1)
sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf250100000008000100ffffffff3400048005000300010000000500030002000000050003000500000005000300050000000500030080ff00008a55049d4983a6200800020002"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
set_mempolicy(0x2, &(0x7f0000000080)=0x4716, 0x3)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000780)={0x0, @in6={{0xa, 0x4e24, 0x401, @mcast2, 0xfffffff8}}, 0x0, 0xdc}, &(0x7f0000000840)=0x90)
userfaultfd(0x801) (async)
r3 = userfaultfd(0x801)
r4 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r4, 0x0, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x3) (async)
r5 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r5, 0x4b2f, 0x7f) (async)
ioctl$KIOCSOUND(r5, 0x4b2f, 0x7f)
socket$nl_generic(0x10, 0x3, 0x10) (async)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff) (async)
r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_RATE_SET(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES16=r7, @ANYBLOB="010000000000000000002d00000008005800000000000e0001006e657464657673696d0000000f0002006e657464657673696d300000"], 0x3c}}, 0x0)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000100)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) (async)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000100)={{0x1, 0x1, 0x18, <r8=>r5}, './file0\x00'})
sendmsg$rds(r8, &(0x7f0000000740)={&(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x3f}}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000180)=""/86, 0x56}, {&(0x7f0000000240)=""/95, 0x5f}, {&(0x7f0000000300)=""/60, 0x3c}, {&(0x7f0000000340)=""/132, 0x84}, {&(0x7f0000000400)=""/150, 0x96}, {&(0x7f00000004c0)=""/59, 0x3b}, {&(0x7f0000000580)=""/81, 0x51}, {&(0x7f0000000600)=""/141, 0x8d}], 0x8, 0x0, 0x0, 0x40000}, 0x800)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) (async)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4})
r9 = socket(0x10, 0x3, 0x0)
sendmsg$IPCTNL_MSG_EXP_GET(r9, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000540)={0x44, 0x1, 0x2, 0x7cbbda779fe004e1, 0x0, 0x0, {0xa}, [@CTA_EXPECT_MASTER={0x30, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}}}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000014}, 0x4000840) (async)
sendmsg$IPCTNL_MSG_EXP_GET(r9, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000540)={0x44, 0x1, 0x2, 0x7cbbda779fe004e1, 0x0, 0x0, {0xa}, [@CTA_EXPECT_MASTER={0x30, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}}}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000014}, 0x4000840)
sendmsg$nl_generic(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="640000001900010000000000fbdbdf251d01"], 0x64}, 0x1, 0x0, 0x0, 0x5}, 0x0)

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_ADD-set_mempolicy-getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS-userfaultfd-userfaultfd-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-syz_open_dev$tty1-ioctl$KIOCSOUND-ioctl$KIOCSOUND-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$devlink-syz_genetlink_get_family_id$devlink-sendmsg$DEVLINK_CMD_RATE_SET-ioctl$AUTOFS_DEV_IOCTL_EXPIRE-ioctl$AUTOFS_DEV_IOCTL_EXPIRE-sendmsg$rds-ioctl$UFFDIO_API-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-socket-sendmsg$IPCTNL_MSG_EXP_GET-sendmsg$IPCTNL_MSG_EXP_GET
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1)
sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf250100000008000100ffffffff3400048005000300010000000500030002000000050003000500000005000300050000000500030080ff00008a55049d4983a6200800020002"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
set_mempolicy(0x2, &(0x7f0000000080)=0x4716, 0x3)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000780)={0x0, @in6={{0xa, 0x4e24, 0x401, @mcast2, 0xfffffff8}}, 0x0, 0xdc}, &(0x7f0000000840)=0x90)
userfaultfd(0x801) (async)
r3 = userfaultfd(0x801)
r4 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r4, 0x0, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x3) (async)
r5 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r5, 0x4b2f, 0x7f) (async)
ioctl$KIOCSOUND(r5, 0x4b2f, 0x7f)
socket$nl_generic(0x10, 0x3, 0x10) (async)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff) (async)
r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_RATE_SET(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES16=r7, @ANYBLOB="010000000000000000002d00000008005800000000000e0001006e657464657673696d0000000f0002006e657464657673696d300000"], 0x3c}}, 0x0)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000100)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) (async)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000100)={{0x1, 0x1, 0x18, <r8=>r5}, './file0\x00'})
sendmsg$rds(r8, &(0x7f0000000740)={&(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x3f}}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000180)=""/86, 0x56}, {&(0x7f0000000240)=""/95, 0x5f}, {&(0x7f0000000300)=""/60, 0x3c}, {&(0x7f0000000340)=""/132, 0x84}, {&(0x7f0000000400)=""/150, 0x96}, {&(0x7f00000004c0)=""/59, 0x3b}, {&(0x7f0000000580)=""/81, 0x51}, {&(0x7f0000000600)=""/141, 0x8d}], 0x8, 0x0, 0x0, 0x40000}, 0x800)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) (async)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4})
r9 = socket(0x10, 0x3, 0x0)
sendmsg$IPCTNL_MSG_EXP_GET(r9, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000540)={0x44, 0x1, 0x2, 0x7cbbda779fe004e1, 0x0, 0x0, {0xa}, [@CTA_EXPECT_MASTER={0x30, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}}}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000014}, 0x4000840) (async)
sendmsg$IPCTNL_MSG_EXP_GET(r9, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000540)={0x44, 0x1, 0x2, 0x7cbbda779fe004e1, 0x0, 0x0, {0xa}, [@CTA_EXPECT_MASTER={0x30, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}}}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000014}, 0x4000840)

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_ADD-set_mempolicy-getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS-userfaultfd-userfaultfd-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-syz_open_dev$tty1-ioctl$KIOCSOUND-ioctl$KIOCSOUND-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$devlink-syz_genetlink_get_family_id$devlink-sendmsg$DEVLINK_CMD_RATE_SET-ioctl$AUTOFS_DEV_IOCTL_EXPIRE-ioctl$AUTOFS_DEV_IOCTL_EXPIRE-sendmsg$rds-ioctl$UFFDIO_API-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-socket-sendmsg$IPCTNL_MSG_EXP_GET
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1)
sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf250100000008000100ffffffff3400048005000300010000000500030002000000050003000500000005000300050000000500030080ff00008a55049d4983a6200800020002"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
set_mempolicy(0x2, &(0x7f0000000080)=0x4716, 0x3)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000780)={0x0, @in6={{0xa, 0x4e24, 0x401, @mcast2, 0xfffffff8}}, 0x0, 0xdc}, &(0x7f0000000840)=0x90)
userfaultfd(0x801) (async)
r3 = userfaultfd(0x801)
r4 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r4, 0x0, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x3) (async)
r5 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r5, 0x4b2f, 0x7f) (async)
ioctl$KIOCSOUND(r5, 0x4b2f, 0x7f)
socket$nl_generic(0x10, 0x3, 0x10) (async)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff) (async)
r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_RATE_SET(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES16=r7, @ANYBLOB="010000000000000000002d00000008005800000000000e0001006e657464657673696d0000000f0002006e657464657673696d300000"], 0x3c}}, 0x0)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000100)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) (async)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000100)={{0x1, 0x1, 0x18, <r8=>r5}, './file0\x00'})
sendmsg$rds(r8, &(0x7f0000000740)={&(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x3f}}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000180)=""/86, 0x56}, {&(0x7f0000000240)=""/95, 0x5f}, {&(0x7f0000000300)=""/60, 0x3c}, {&(0x7f0000000340)=""/132, 0x84}, {&(0x7f0000000400)=""/150, 0x96}, {&(0x7f00000004c0)=""/59, 0x3b}, {&(0x7f0000000580)=""/81, 0x51}, {&(0x7f0000000600)=""/141, 0x8d}], 0x8, 0x0, 0x0, 0x40000}, 0x800)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) (async)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4})
r9 = socket(0x10, 0x3, 0x0)
sendmsg$IPCTNL_MSG_EXP_GET(r9, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000540)={0x44, 0x1, 0x2, 0x7cbbda779fe004e1, 0x0, 0x0, {0xa}, [@CTA_EXPECT_MASTER={0x30, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}}}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000014}, 0x4000840) (async)

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_ADD-set_mempolicy-getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS-userfaultfd-userfaultfd-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-syz_open_dev$tty1-ioctl$KIOCSOUND-ioctl$KIOCSOUND-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$devlink-syz_genetlink_get_family_id$devlink-sendmsg$DEVLINK_CMD_RATE_SET-ioctl$AUTOFS_DEV_IOCTL_EXPIRE-ioctl$AUTOFS_DEV_IOCTL_EXPIRE-sendmsg$rds-ioctl$UFFDIO_API-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-socket
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1)
sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf250100000008000100ffffffff3400048005000300010000000500030002000000050003000500000005000300050000000500030080ff00008a55049d4983a6200800020002"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
set_mempolicy(0x2, &(0x7f0000000080)=0x4716, 0x3)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000780)={0x0, @in6={{0xa, 0x4e24, 0x401, @mcast2, 0xfffffff8}}, 0x0, 0xdc}, &(0x7f0000000840)=0x90)
userfaultfd(0x801) (async)
r3 = userfaultfd(0x801)
r4 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r4, 0x0, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x3) (async)
r5 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r5, 0x4b2f, 0x7f) (async)
ioctl$KIOCSOUND(r5, 0x4b2f, 0x7f)
socket$nl_generic(0x10, 0x3, 0x10) (async)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff) (async)
r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_RATE_SET(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES16=r7, @ANYBLOB="010000000000000000002d00000008005800000000000e0001006e657464657673696d0000000f0002006e657464657673696d300000"], 0x3c}}, 0x0)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000100)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) (async)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000100)={{0x1, 0x1, 0x18, <r8=>r5}, './file0\x00'})
sendmsg$rds(r8, &(0x7f0000000740)={&(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x3f}}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000180)=""/86, 0x56}, {&(0x7f0000000240)=""/95, 0x5f}, {&(0x7f0000000300)=""/60, 0x3c}, {&(0x7f0000000340)=""/132, 0x84}, {&(0x7f0000000400)=""/150, 0x96}, {&(0x7f00000004c0)=""/59, 0x3b}, {&(0x7f0000000580)=""/81, 0x51}, {&(0x7f0000000600)=""/141, 0x8d}], 0x8, 0x0, 0x0, 0x40000}, 0x800)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) (async)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4})
socket(0x10, 0x3, 0x0)

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_ADD-set_mempolicy-getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS-userfaultfd-userfaultfd-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-syz_open_dev$tty1-ioctl$KIOCSOUND-ioctl$KIOCSOUND-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$devlink-syz_genetlink_get_family_id$devlink-sendmsg$DEVLINK_CMD_RATE_SET-ioctl$AUTOFS_DEV_IOCTL_EXPIRE-ioctl$AUTOFS_DEV_IOCTL_EXPIRE-sendmsg$rds-ioctl$UFFDIO_API-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1)
sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf250100000008000100ffffffff3400048005000300010000000500030002000000050003000500000005000300050000000500030080ff00008a55049d4983a6200800020002"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
set_mempolicy(0x2, &(0x7f0000000080)=0x4716, 0x3)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000780)={0x0, @in6={{0xa, 0x4e24, 0x401, @mcast2, 0xfffffff8}}, 0x0, 0xdc}, &(0x7f0000000840)=0x90)
userfaultfd(0x801) (async)
r3 = userfaultfd(0x801)
r4 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r4, 0x0, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x3) (async)
r5 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r5, 0x4b2f, 0x7f) (async)
ioctl$KIOCSOUND(r5, 0x4b2f, 0x7f)
socket$nl_generic(0x10, 0x3, 0x10) (async)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff) (async)
r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_RATE_SET(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES16=r7, @ANYBLOB="010000000000000000002d00000008005800000000000e0001006e657464657673696d0000000f0002006e657464657673696d300000"], 0x3c}}, 0x0)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000100)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) (async)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000100)={{0x1, 0x1, 0x18, <r8=>r5}, './file0\x00'})
sendmsg$rds(r8, &(0x7f0000000740)={&(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x3f}}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000180)=""/86, 0x56}, {&(0x7f0000000240)=""/95, 0x5f}, {&(0x7f0000000300)=""/60, 0x3c}, {&(0x7f0000000340)=""/132, 0x84}, {&(0x7f0000000400)=""/150, 0x96}, {&(0x7f00000004c0)=""/59, 0x3b}, {&(0x7f0000000580)=""/81, 0x51}, {&(0x7f0000000600)=""/141, 0x8d}], 0x8, 0x0, 0x0, 0x40000}, 0x800)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) (async)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4})

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_ADD-set_mempolicy-getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS-userfaultfd-userfaultfd-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-syz_open_dev$tty1-ioctl$KIOCSOUND-ioctl$KIOCSOUND-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$devlink-syz_genetlink_get_family_id$devlink-sendmsg$DEVLINK_CMD_RATE_SET-ioctl$AUTOFS_DEV_IOCTL_EXPIRE-ioctl$AUTOFS_DEV_IOCTL_EXPIRE-sendmsg$rds-ioctl$UFFDIO_API-ioctl$UFFDIO_API
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1)
sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf250100000008000100ffffffff3400048005000300010000000500030002000000050003000500000005000300050000000500030080ff00008a55049d4983a6200800020002"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
set_mempolicy(0x2, &(0x7f0000000080)=0x4716, 0x3)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000780)={0x0, @in6={{0xa, 0x4e24, 0x401, @mcast2, 0xfffffff8}}, 0x0, 0xdc}, &(0x7f0000000840)=0x90)
userfaultfd(0x801) (async)
r3 = userfaultfd(0x801)
r4 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r4, 0x0, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x3) (async)
r5 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r5, 0x4b2f, 0x7f) (async)
ioctl$KIOCSOUND(r5, 0x4b2f, 0x7f)
socket$nl_generic(0x10, 0x3, 0x10) (async)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff) (async)
r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_RATE_SET(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES16=r7, @ANYBLOB="010000000000000000002d00000008005800000000000e0001006e657464657673696d0000000f0002006e657464657673696d300000"], 0x3c}}, 0x0)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000100)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) (async)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000100)={{0x1, 0x1, 0x18, <r8=>r5}, './file0\x00'})
sendmsg$rds(r8, &(0x7f0000000740)={&(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x3f}}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000180)=""/86, 0x56}, {&(0x7f0000000240)=""/95, 0x5f}, {&(0x7f0000000300)=""/60, 0x3c}, {&(0x7f0000000340)=""/132, 0x84}, {&(0x7f0000000400)=""/150, 0x96}, {&(0x7f00000004c0)=""/59, 0x3b}, {&(0x7f0000000580)=""/81, 0x51}, {&(0x7f0000000600)=""/141, 0x8d}], 0x8, 0x0, 0x0, 0x40000}, 0x800)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) (async)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0))

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_ADD-set_mempolicy-getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS-userfaultfd-userfaultfd-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-syz_open_dev$tty1-ioctl$KIOCSOUND-ioctl$KIOCSOUND-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$devlink-syz_genetlink_get_family_id$devlink-sendmsg$DEVLINK_CMD_RATE_SET-ioctl$AUTOFS_DEV_IOCTL_EXPIRE-ioctl$AUTOFS_DEV_IOCTL_EXPIRE-sendmsg$rds-ioctl$UFFDIO_API
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1)
sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf250100000008000100ffffffff3400048005000300010000000500030002000000050003000500000005000300050000000500030080ff00008a55049d4983a6200800020002"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
set_mempolicy(0x2, &(0x7f0000000080)=0x4716, 0x3)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000780)={0x0, @in6={{0xa, 0x4e24, 0x401, @mcast2, 0xfffffff8}}, 0x0, 0xdc}, &(0x7f0000000840)=0x90)
userfaultfd(0x801) (async)
r3 = userfaultfd(0x801)
r4 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r4, 0x0, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x3) (async)
r5 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r5, 0x4b2f, 0x7f) (async)
ioctl$KIOCSOUND(r5, 0x4b2f, 0x7f)
socket$nl_generic(0x10, 0x3, 0x10) (async)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff) (async)
r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_RATE_SET(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES16=r7, @ANYBLOB="010000000000000000002d00000008005800000000000e0001006e657464657673696d0000000f0002006e657464657673696d300000"], 0x3c}}, 0x0)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000100)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) (async)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000100)={{0x1, 0x1, 0x18, <r8=>r5}, './file0\x00'})
sendmsg$rds(r8, &(0x7f0000000740)={&(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x3f}}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000180)=""/86, 0x56}, {&(0x7f0000000240)=""/95, 0x5f}, {&(0x7f0000000300)=""/60, 0x3c}, {&(0x7f0000000340)=""/132, 0x84}, {&(0x7f0000000400)=""/150, 0x96}, {&(0x7f00000004c0)=""/59, 0x3b}, {&(0x7f0000000580)=""/81, 0x51}, {&(0x7f0000000600)=""/141, 0x8d}], 0x8, 0x0, 0x0, 0x40000}, 0x800)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) (async)

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_ADD-set_mempolicy-getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS-userfaultfd-userfaultfd-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-syz_open_dev$tty1-ioctl$KIOCSOUND-ioctl$KIOCSOUND-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$devlink-syz_genetlink_get_family_id$devlink-sendmsg$DEVLINK_CMD_RATE_SET-ioctl$AUTOFS_DEV_IOCTL_EXPIRE-ioctl$AUTOFS_DEV_IOCTL_EXPIRE-sendmsg$rds
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1)
sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf250100000008000100ffffffff3400048005000300010000000500030002000000050003000500000005000300050000000500030080ff00008a55049d4983a6200800020002"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
set_mempolicy(0x2, &(0x7f0000000080)=0x4716, 0x3)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000780)={0x0, @in6={{0xa, 0x4e24, 0x401, @mcast2, 0xfffffff8}}, 0x0, 0xdc}, &(0x7f0000000840)=0x90)
userfaultfd(0x801) (async)
userfaultfd(0x801)
r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r3, 0x0, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x3) (async)
r4 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r4, 0x4b2f, 0x7f) (async)
ioctl$KIOCSOUND(r4, 0x4b2f, 0x7f)
socket$nl_generic(0x10, 0x3, 0x10) (async)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff) (async)
r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_RATE_SET(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES16=r6, @ANYBLOB="010000000000000000002d00000008005800000000000e0001006e657464657673696d0000000f0002006e657464657673696d300000"], 0x3c}}, 0x0)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000100)={{0x1, 0x1, 0x18, r4}, './file0\x00'}) (async)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000100)={{0x1, 0x1, 0x18, <r7=>r4}, './file0\x00'})
sendmsg$rds(r7, &(0x7f0000000740)={&(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x3f}}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000180)=""/86, 0x56}, {&(0x7f0000000240)=""/95, 0x5f}, {&(0x7f0000000300)=""/60, 0x3c}, {&(0x7f0000000340)=""/132, 0x84}, {&(0x7f0000000400)=""/150, 0x96}, {&(0x7f00000004c0)=""/59, 0x3b}, {&(0x7f0000000580)=""/81, 0x51}, {&(0x7f0000000600)=""/141, 0x8d}], 0x8, 0x0, 0x0, 0x40000}, 0x800)

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_ADD-set_mempolicy-getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS-userfaultfd-userfaultfd-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-syz_open_dev$tty1-ioctl$KIOCSOUND-ioctl$KIOCSOUND-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$devlink-syz_genetlink_get_family_id$devlink-sendmsg$DEVLINK_CMD_RATE_SET-ioctl$AUTOFS_DEV_IOCTL_EXPIRE-ioctl$AUTOFS_DEV_IOCTL_EXPIRE
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1)
sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf250100000008000100ffffffff3400048005000300010000000500030002000000050003000500000005000300050000000500030080ff00008a55049d4983a6200800020002"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
set_mempolicy(0x2, &(0x7f0000000080)=0x4716, 0x3)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000780)={0x0, @in6={{0xa, 0x4e24, 0x401, @mcast2, 0xfffffff8}}, 0x0, 0xdc}, &(0x7f0000000840)=0x90)
userfaultfd(0x801) (async)
userfaultfd(0x801)
r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r3, 0x0, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x3) (async)
r4 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r4, 0x4b2f, 0x7f) (async)
ioctl$KIOCSOUND(r4, 0x4b2f, 0x7f)
socket$nl_generic(0x10, 0x3, 0x10) (async)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff) (async)
r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_RATE_SET(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES16=r6, @ANYBLOB="010000000000000000002d00000008005800000000000e0001006e657464657673696d0000000f0002006e657464657673696d300000"], 0x3c}}, 0x0)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000100)={{0x1, 0x1, 0x18, r4}, './file0\x00'}) (async)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000100)={{0x1, 0x1, 0x18, r4}, './file0\x00'})

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_ADD-set_mempolicy-getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS-userfaultfd-userfaultfd-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-syz_open_dev$tty1-ioctl$KIOCSOUND-ioctl$KIOCSOUND-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$devlink-syz_genetlink_get_family_id$devlink-sendmsg$DEVLINK_CMD_RATE_SET-ioctl$AUTOFS_DEV_IOCTL_EXPIRE
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1)
sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf250100000008000100ffffffff3400048005000300010000000500030002000000050003000500000005000300050000000500030080ff00008a55049d4983a6200800020002"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
set_mempolicy(0x2, &(0x7f0000000080)=0x4716, 0x3)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000780)={0x0, @in6={{0xa, 0x4e24, 0x401, @mcast2, 0xfffffff8}}, 0x0, 0xdc}, &(0x7f0000000840)=0x90)
userfaultfd(0x801) (async)
userfaultfd(0x801)
r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r3, 0x0, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x3) (async)
r4 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r4, 0x4b2f, 0x7f) (async)
ioctl$KIOCSOUND(r4, 0x4b2f, 0x7f)
socket$nl_generic(0x10, 0x3, 0x10) (async)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff) (async)
r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_RATE_SET(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES16=r6, @ANYBLOB="010000000000000000002d00000008005800000000000e0001006e657464657673696d0000000f0002006e657464657673696d300000"], 0x3c}}, 0x0)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000100)={{0x1, 0x1, 0x18, r4}, './file0\x00'}) (async)

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_ADD-set_mempolicy-getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS-userfaultfd-userfaultfd-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-syz_open_dev$tty1-ioctl$KIOCSOUND-ioctl$KIOCSOUND-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$devlink-syz_genetlink_get_family_id$devlink-sendmsg$DEVLINK_CMD_RATE_SET
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1)
sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf250100000008000100ffffffff3400048005000300010000000500030002000000050003000500000005000300050000000500030080ff00008a55049d4983a6200800020002"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
set_mempolicy(0x2, &(0x7f0000000080)=0x4716, 0x3)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000780)={0x0, @in6={{0xa, 0x4e24, 0x401, @mcast2, 0xfffffff8}}, 0x0, 0xdc}, &(0x7f0000000840)=0x90)
userfaultfd(0x801) (async)
userfaultfd(0x801)
r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r3, 0x0, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x3) (async)
r4 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r4, 0x4b2f, 0x7f) (async)
ioctl$KIOCSOUND(r4, 0x4b2f, 0x7f)
socket$nl_generic(0x10, 0x3, 0x10) (async)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff) (async)
r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_RATE_SET(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES16=r6, @ANYBLOB="010000000000000000002d00000008005800000000000e0001006e657464657673696d0000000f0002006e657464657673696d300000"], 0x3c}}, 0x0)

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_ADD-set_mempolicy-getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS-userfaultfd-userfaultfd-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-syz_open_dev$tty1-ioctl$KIOCSOUND-ioctl$KIOCSOUND-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$devlink-syz_genetlink_get_family_id$devlink
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1)
sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf250100000008000100ffffffff3400048005000300010000000500030002000000050003000500000005000300050000000500030080ff00008a55049d4983a6200800020002"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
set_mempolicy(0x2, &(0x7f0000000080)=0x4716, 0x3)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000780)={0x0, @in6={{0xa, 0x4e24, 0x401, @mcast2, 0xfffffff8}}, 0x0, 0xdc}, &(0x7f0000000840)=0x90)
userfaultfd(0x801) (async)
userfaultfd(0x801)
r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r3, 0x0, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x3) (async)
r4 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r4, 0x4b2f, 0x7f) (async)
ioctl$KIOCSOUND(r4, 0x4b2f, 0x7f)
socket$nl_generic(0x10, 0x3, 0x10) (async)
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff) (async)
syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff)

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_ADD-set_mempolicy-getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS-userfaultfd-userfaultfd-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-syz_open_dev$tty1-ioctl$KIOCSOUND-ioctl$KIOCSOUND-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$devlink
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1)
sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf250100000008000100ffffffff3400048005000300010000000500030002000000050003000500000005000300050000000500030080ff00008a55049d4983a6200800020002"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
set_mempolicy(0x2, &(0x7f0000000080)=0x4716, 0x3)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000780)={0x0, @in6={{0xa, 0x4e24, 0x401, @mcast2, 0xfffffff8}}, 0x0, 0xdc}, &(0x7f0000000840)=0x90)
userfaultfd(0x801) (async)
userfaultfd(0x801)
r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r3, 0x0, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x3) (async)
r4 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r4, 0x4b2f, 0x7f) (async)
ioctl$KIOCSOUND(r4, 0x4b2f, 0x7f)
socket$nl_generic(0x10, 0x3, 0x10) (async)
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff) (async)

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_ADD-set_mempolicy-getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS-userfaultfd-userfaultfd-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-syz_open_dev$tty1-ioctl$KIOCSOUND-ioctl$KIOCSOUND-socket$nl_generic-socket$nl_generic
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1)
sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf250100000008000100ffffffff3400048005000300010000000500030002000000050003000500000005000300050000000500030080ff00008a55049d4983a6200800020002"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
set_mempolicy(0x2, &(0x7f0000000080)=0x4716, 0x3)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000780)={0x0, @in6={{0xa, 0x4e24, 0x401, @mcast2, 0xfffffff8}}, 0x0, 0xdc}, &(0x7f0000000840)=0x90)
userfaultfd(0x801) (async)
userfaultfd(0x801)
r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r3, 0x0, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x3) (async)
r4 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r4, 0x4b2f, 0x7f) (async)
ioctl$KIOCSOUND(r4, 0x4b2f, 0x7f)
socket$nl_generic(0x10, 0x3, 0x10) (async)
socket$nl_generic(0x10, 0x3, 0x10)

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_ADD-set_mempolicy-getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS-userfaultfd-userfaultfd-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-syz_open_dev$tty1-ioctl$KIOCSOUND-ioctl$KIOCSOUND-socket$nl_generic
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1)
sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf250100000008000100ffffffff3400048005000300010000000500030002000000050003000500000005000300050000000500030080ff00008a55049d4983a6200800020002"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
set_mempolicy(0x2, &(0x7f0000000080)=0x4716, 0x3)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000780)={0x0, @in6={{0xa, 0x4e24, 0x401, @mcast2, 0xfffffff8}}, 0x0, 0xdc}, &(0x7f0000000840)=0x90)
userfaultfd(0x801) (async)
userfaultfd(0x801)
r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r3, 0x0, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x3) (async)
r4 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r4, 0x4b2f, 0x7f) (async)
ioctl$KIOCSOUND(r4, 0x4b2f, 0x7f)
socket$nl_generic(0x10, 0x3, 0x10) (async)

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_ADD-set_mempolicy-getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS-userfaultfd-userfaultfd-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-syz_open_dev$tty1-ioctl$KIOCSOUND-ioctl$KIOCSOUND
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1)
sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf250100000008000100ffffffff3400048005000300010000000500030002000000050003000500000005000300050000000500030080ff00008a55049d4983a6200800020002"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
set_mempolicy(0x2, &(0x7f0000000080)=0x4716, 0x3)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000780)={0x0, @in6={{0xa, 0x4e24, 0x401, @mcast2, 0xfffffff8}}, 0x0, 0xdc}, &(0x7f0000000840)=0x90)
userfaultfd(0x801) (async)
userfaultfd(0x801)
r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r3, 0x0, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x3) (async)
r4 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r4, 0x4b2f, 0x7f) (async)
ioctl$KIOCSOUND(r4, 0x4b2f, 0x7f)

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_ADD-set_mempolicy-getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS-userfaultfd-userfaultfd-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1)
sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf250100000008000100ffffffff3400048005000300010000000500030002000000050003000500000005000300050000000500030080ff00008a55049d4983a6200800020002"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
set_mempolicy(0x2, &(0x7f0000000080)=0x4716, 0x3)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000780)={0x0, @in6={{0xa, 0x4e24, 0x401, @mcast2, 0xfffffff8}}, 0x0, 0xdc}, &(0x7f0000000840)=0x90)
userfaultfd(0x801) (async)
userfaultfd(0x801)
r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r3, 0x0, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x3) (async)
r4 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r4, 0x4b2f, 0x7f) (async)

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_ADD-set_mempolicy-getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS-userfaultfd-userfaultfd-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-syz_open_dev$tty1
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1)
sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf250100000008000100ffffffff3400048005000300010000000500030002000000050003000500000005000300050000000500030080ff00008a55049d4983a6200800020002"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
set_mempolicy(0x2, &(0x7f0000000080)=0x4716, 0x3)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000780)={0x0, @in6={{0xa, 0x4e24, 0x401, @mcast2, 0xfffffff8}}, 0x0, 0xdc}, &(0x7f0000000840)=0x90)
userfaultfd(0x801) (async)
userfaultfd(0x801)
r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r3, 0x0, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x3) (async)
syz_open_dev$tty1(0xc, 0x4, 0x3)

program did not crash
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_ADD-set_mempolicy-getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS-userfaultfd-userfaultfd-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1)
sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf250100000008000100ffffffff3400048005000300010000000500030002000000050003000500000005000300050000000500030080ff00008a55049d4983a6200800020002"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
set_mempolicy(0x2, &(0x7f0000000080)=0x4716, 0x3)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000780)={0x0, @in6={{0xa, 0x4e24, 0x401, @mcast2, 0xfffffff8}}, 0x0, 0xdc}, &(0x7f0000000840)=0x90)
userfaultfd(0x801) (async)
userfaultfd(0x801)
r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r3, 0x0, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x3) (async)
ioctl$KIOCSOUND(0xffffffffffffffff, 0x4b2f, 0x7f) (async)

program did not crash
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_ADD-set_mempolicy-getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS-userfaultfd-userfaultfd-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1)
sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf250100000008000100ffffffff3400048005000300010000000500030002000000050003000500000005000300050000000500030080ff00008a55049d4983a6200800020002"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
set_mempolicy(0x2, &(0x7f0000000080)=0x4716, 0x3)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000780)={0x0, @in6={{0xa, 0x4e24, 0x401, @mcast2, 0xfffffff8}}, 0x0, 0xdc}, &(0x7f0000000840)=0x90)
userfaultfd(0x801) (async)
userfaultfd(0x801)
r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r3, 0x0, 0x0)
r4 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r4, 0x4b2f, 0x7f) (async)

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_ADD-set_mempolicy-getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS-userfaultfd-userfaultfd-syz_usb_connect-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1)
sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf250100000008000100ffffffff3400048005000300010000000500030002000000050003000500000005000300050000000500030080ff00008a55049d4983a6200800020002"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
set_mempolicy(0x2, &(0x7f0000000080)=0x4716, 0x3)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000780)={0x0, @in6={{0xa, 0x4e24, 0x401, @mcast2, 0xfffffff8}}, 0x0, 0xdc}, &(0x7f0000000840)=0x90)
userfaultfd(0x801) (async)
userfaultfd(0x801)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
r3 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r3, 0x4b2f, 0x7f) (async)

program did not crash
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_ADD-set_mempolicy-getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS-userfaultfd-userfaultfd-syz_usb_control_io$hid-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1)
sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf250100000008000100ffffffff3400048005000300010000000500030002000000050003000500000005000300050000000500030080ff00008a55049d4983a6200800020002"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
set_mempolicy(0x2, &(0x7f0000000080)=0x4716, 0x3)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000780)={0x0, @in6={{0xa, 0x4e24, 0x401, @mcast2, 0xfffffff8}}, 0x0, 0xdc}, &(0x7f0000000840)=0x90)
userfaultfd(0x801) (async)
userfaultfd(0x801)
syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r3, 0x4b2f, 0x7f) (async)

program did not crash
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_ADD-set_mempolicy-getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS-userfaultfd-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1)
sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf250100000008000100ffffffff3400048005000300010000000500030002000000050003000500000005000300050000000500030080ff00008a55049d4983a6200800020002"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
set_mempolicy(0x2, &(0x7f0000000080)=0x4716, 0x3)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000780)={0x0, @in6={{0xa, 0x4e24, 0x401, @mcast2, 0xfffffff8}}, 0x0, 0xdc}, &(0x7f0000000840)=0x90)
userfaultfd(0x801) (async)
r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r3, 0x0, 0x0)
r4 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r4, 0x4b2f, 0x7f) (async)

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_ADD-set_mempolicy-getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1)
sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf250100000008000100ffffffff3400048005000300010000000500030002000000050003000500000005000300050000000500030080ff00008a55049d4983a6200800020002"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
set_mempolicy(0x2, &(0x7f0000000080)=0x4716, 0x3)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000780)={0x0, @in6={{0xa, 0x4e24, 0x401, @mcast2, 0xfffffff8}}, 0x0, 0xdc}, &(0x7f0000000840)=0x90)
r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r3, 0x0, 0x0)
r4 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r4, 0x4b2f, 0x7f) (async)

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_ADD-set_mempolicy-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1)
sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf250100000008000100ffffffff3400048005000300010000000500030002000000050003000500000005000300050000000500030080ff00008a55049d4983a6200800020002"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
set_mempolicy(0x2, &(0x7f0000000080)=0x4716, 0x3)
r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r3, 0x0, 0x0)
r4 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r4, 0x4b2f, 0x7f) (async)

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_ADD-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1)
sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf250100000008000100ffffffff3400048005000300010000000500030002000000050003000500000005000300050000000500030080ff00008a55049d4983a6200800020002"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r3, 0x0, 0x0)
r4 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r4, 0x4b2f, 0x7f) (async)

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_cipso-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1)
r2 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r2, 0x0, 0x0)
r3 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r3, 0x4b2f, 0x7f) (async)

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
r2 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r2, 0x4b2f, 0x7f) (async)

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_init_net_socket$nl_generic-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
r2 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r2, 0x4b2f, 0x7f) (async)

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-close-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
close(0x3)
r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
r2 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r2, 0x4b2f, 0x7f) (async)

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-bind$alg-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
r2 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r2, 0x4b2f, 0x7f) (async)

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$alg-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
socket$alg(0x26, 0x5, 0x0)
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r1, 0x4b2f, 0x7f) (async)

program did not crash
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-bind$alg-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r1, 0x4b2f, 0x7f) (async)

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r1, 0x4b2f, 0x7f) (async)

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r1, 0x4b2f, 0x7f)

program crashed: WARNING in cm109_urb_irq_callback
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
bind$alg(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r1, 0x4b2f, 0x7f)

program did not crash
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
r0 = syz_usb_connect(0x0, 0x2d, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r1, 0x4b2f, 0x7f)

program did not crash
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r1, 0x4b2f, 0x7f)

program did not crash
testing program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB, @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r1, 0x4b2f, 0x7f)

program did not crash
extracting C reproducer
testing compiled C program (duration=49.469853243s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-ioctl$KIOCSOUND
program crashed: WARNING in cm109_urb_irq_callback
simplifying C reproducer
testing compiled C program (duration=49.469853243s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-ioctl$KIOCSOUND
program crashed: WARNING in cm109_urb_irq_callback
testing compiled C program (duration=49.469853243s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-ioctl$KIOCSOUND
program crashed: WARNING in cm109_urb_irq_callback
testing compiled C program (duration=49.469853243s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-ioctl$KIOCSOUND
program crashed: WARNING in cm109_urb_irq_callback
testing compiled C program (duration=49.469853243s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-ioctl$KIOCSOUND
program crashed: WARNING in cm109_urb_irq_callback
testing compiled C program (duration=49.469853243s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-ioctl$KIOCSOUND
program crashed: WARNING in cm109_urb_irq_callback
testing compiled C program (duration=49.469853243s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-ioctl$KIOCSOUND
program did not crash
testing compiled C program (duration=49.469853243s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-ioctl$KIOCSOUND
program did not crash
testing program (duration=49.469853243s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r1, 0x4b2f, 0x7f)

program crashed: WARNING in cm109_urb_irq_callback
validation run: crashed=true
testing program (duration=49.469853243s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r1, 0x4b2f, 0x7f)

program crashed: WARNING in cm109_urb_irq_callback
validation run: crashed=true
testing program (duration=49.469853243s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io$hid-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58)
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$KIOCSOUND(r1, 0x4b2f, 0x7f)

program crashed: WARNING in cm109_urb_irq_callback
validation run: crashed=true
reproducing took 1h35m51.852954988s
repro crashed as (corrupted=false):
cm109 1-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff88814d189b00 submitted while active
WARNING: drivers/usb/core/urb.c:380 at 0x0, CPU#0: syz.0.17/5996
Modules linked in:
CPU: 0 UID: 0 PID: 5996 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:usb_submit_urb+0x7e/0x18d0 drivers/usb/core/urb.c:380
Code: 89 f0 48 c1 e8 03 42 80 3c 38 00 74 08 4c 89 f7 e8 67 4e 21 fb 49 83 3e 00 74 40 e8 bc fe ba fa 48 8d 3d 75 5b c5 08 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 a1 fe ba fa eb 05 e8 9a fe
RSP: 0018:ffffc90000007878 EFLAGS: 00010046
RAX: ffffffff8706e144 RBX: ffff88814d189b00 RCX: ffff888030e35b80
RDX: 0000000000000100 RSI: ffff88814d189b00 RDI: ffffffff8fcc3cc0
RBP: 000000000000000f R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52000000f00 R12: 0000000000000820
R13: ffff8880308b1030 R14: ffff88814d189b08 R15: dffffc0000000000
FS:  000055556f9b7500(0000) GS:ffff888125a3e000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1a28b909c0 CR3: 0000000076fda000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 cm109_submit_ctl drivers/input/misc/cm109.c:380 [inline]
 cm109_urb_irq_callback+0x709/0xcd0 drivers/input/misc/cm109.c:431
 __usb_hcd_giveback_urb+0x376/0x540 drivers/usb/core/hcd.c:1661
 dummy_timer+0x85f/0x45b0 drivers/usb/gadget/udc/dummy_hcd.c:1995
 __run_hrtimer kernel/time/hrtimer.c:1777 [inline]
 __hrtimer_run_queues+0x51c/0xc30 kernel/time/hrtimer.c:1841
 hrtimer_run_softirq+0x187/0x2b0 kernel/time/hrtimer.c:1858
 handle_softirqs+0x27d/0x850 kernel/softirq.c:626
 __do_softirq kernel/softirq.c:660 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:727
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:743
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xa8/0x110 kernel/locking/spinlock.c:194
Code: 74 05 e8 eb f6 64 f6 48 c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f6 44 24 21 02 75 4f f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 <e8> a3 7f 2c f6 65 8b 05 2c 61 59 07 85 c0 74 40 48 c7 04 24 0e 36
RSP: 0018:ffffc900042df9c0 EFLAGS: 00000206
RAX: c88f4121c9456400 RBX: 0000000000000a02 RCX: c88f4121c9456400
RDX: 0000000000000006 RSI: ffffffff8da6f16a RDI: 0000000000000001
RBP: ffffc900042dfa50 R08: ffffffff8fbf8277 R09: 1ffffffff1f7f04e
R10: dffffc0000000000 R11: fffffbfff1f7f04f R12: dffffc0000000000
R13: ffff888028c63600 R14: ffffffff8efc1340 R15: 1ffff9200085bf38
 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
 usb_hcd_poll_rh_status+0x406/0x620 drivers/usb/core/hcd.c:762
 dummy_pullup+0x19b/0x200 drivers/usb/gadget/udc/dummy_hcd.c:928
 usb_gadget_disconnect_locked+0x143/0x490 drivers/usb/gadget/udc/core.c:780
 gadget_unbind_driver+0xc7/0x460 drivers/usb/gadget/udc/core.c:1685
 device_remove drivers/base/dd.c:569 [inline]
 __device_release_driver drivers/base/dd.c:1274 [inline]
 device_release_driver_internal+0x46f/0x800 drivers/base/dd.c:1297
 driver_detach+0x1f3/0x2d0 drivers/base/dd.c:1360
 bus_remove_driver+0x226/0x320 drivers/base/bus.c:785
 usb_gadget_unregister_driver+0x4e/0x70 drivers/usb/gadget/udc/core.c:1751
 raw_release+0xd7/0x260 drivers/usb/gadget/legacy/raw_gadget.c:463
 __fput+0x44c/0xa70 fs/file_table.c:468
 task_work_run+0x1d4/0x260 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:44 [inline]
 exit_to_user_mode_loop+0xff/0x4f0 kernel/entry/common.c:75
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
 do_syscall_64+0x2e3/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2cf278f749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc35b7c9b8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00000000000247d0 RCX: 00007f2cf278f749
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000535b7ccaf
R10: 0000001b2fe20000 R11: 0000000000000246 R12: 00007f2cf29e5fac
R13: 00007f2cf29e5fa0 R14: ffffffffffffffff R15: 0000000000000003
 </TASK>
----------------
Code disassembly (best guess):
   0:	89 f0                	mov    %esi,%eax
   2:	48 c1 e8 03          	shr    $0x3,%rax
   6:	42 80 3c 38 00       	cmpb   $0x0,(%rax,%r15,1)
   b:	74 08                	je     0x15
   d:	4c 89 f7             	mov    %r14,%rdi
  10:	e8 67 4e 21 fb       	call   0xfb214e7c
  15:	49 83 3e 00          	cmpq   $0x0,(%r14)
  19:	74 40                	je     0x5b
  1b:	e8 bc fe ba fa       	call   0xfabafedc
  20:	48 8d 3d 75 5b c5 08 	lea    0x8c55b75(%rip),%rdi        # 0x8c55b9c
  27:	48 89 de             	mov    %rbx,%rsi
* 2a:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2f:	b8 f0 ff ff ff       	mov    $0xfffffff0,%eax
  34:	eb 11                	jmp    0x47
  36:	e8 a1 fe ba fa       	call   0xfabafedc
  3b:	eb 05                	jmp    0x42
  3d:	e8                   	.byte 0xe8
  3e:	9a                   	(bad)
  3f:	fe                   	.byte 0xfe

final repro crashed as (corrupted=false):
cm109 1-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff88814d189b00 submitted while active
WARNING: drivers/usb/core/urb.c:380 at 0x0, CPU#0: syz.0.17/5996
Modules linked in:
CPU: 0 UID: 0 PID: 5996 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:usb_submit_urb+0x7e/0x18d0 drivers/usb/core/urb.c:380
Code: 89 f0 48 c1 e8 03 42 80 3c 38 00 74 08 4c 89 f7 e8 67 4e 21 fb 49 83 3e 00 74 40 e8 bc fe ba fa 48 8d 3d 75 5b c5 08 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 a1 fe ba fa eb 05 e8 9a fe
RSP: 0018:ffffc90000007878 EFLAGS: 00010046
RAX: ffffffff8706e144 RBX: ffff88814d189b00 RCX: ffff888030e35b80
RDX: 0000000000000100 RSI: ffff88814d189b00 RDI: ffffffff8fcc3cc0
RBP: 000000000000000f R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52000000f00 R12: 0000000000000820
R13: ffff8880308b1030 R14: ffff88814d189b08 R15: dffffc0000000000
FS:  000055556f9b7500(0000) GS:ffff888125a3e000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1a28b909c0 CR3: 0000000076fda000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 cm109_submit_ctl drivers/input/misc/cm109.c:380 [inline]
 cm109_urb_irq_callback+0x709/0xcd0 drivers/input/misc/cm109.c:431
 __usb_hcd_giveback_urb+0x376/0x540 drivers/usb/core/hcd.c:1661
 dummy_timer+0x85f/0x45b0 drivers/usb/gadget/udc/dummy_hcd.c:1995
 __run_hrtimer kernel/time/hrtimer.c:1777 [inline]
 __hrtimer_run_queues+0x51c/0xc30 kernel/time/hrtimer.c:1841
 hrtimer_run_softirq+0x187/0x2b0 kernel/time/hrtimer.c:1858
 handle_softirqs+0x27d/0x850 kernel/softirq.c:626
 __do_softirq kernel/softirq.c:660 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:727
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:743
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xa8/0x110 kernel/locking/spinlock.c:194
Code: 74 05 e8 eb f6 64 f6 48 c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f6 44 24 21 02 75 4f f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 <e8> a3 7f 2c f6 65 8b 05 2c 61 59 07 85 c0 74 40 48 c7 04 24 0e 36
RSP: 0018:ffffc900042df9c0 EFLAGS: 00000206
RAX: c88f4121c9456400 RBX: 0000000000000a02 RCX: c88f4121c9456400
RDX: 0000000000000006 RSI: ffffffff8da6f16a RDI: 0000000000000001
RBP: ffffc900042dfa50 R08: ffffffff8fbf8277 R09: 1ffffffff1f7f04e
R10: dffffc0000000000 R11: fffffbfff1f7f04f R12: dffffc0000000000
R13: ffff888028c63600 R14: ffffffff8efc1340 R15: 1ffff9200085bf38
 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
 usb_hcd_poll_rh_status+0x406/0x620 drivers/usb/core/hcd.c:762
 dummy_pullup+0x19b/0x200 drivers/usb/gadget/udc/dummy_hcd.c:928
 usb_gadget_disconnect_locked+0x143/0x490 drivers/usb/gadget/udc/core.c:780
 gadget_unbind_driver+0xc7/0x460 drivers/usb/gadget/udc/core.c:1685
 device_remove drivers/base/dd.c:569 [inline]
 __device_release_driver drivers/base/dd.c:1274 [inline]
 device_release_driver_internal+0x46f/0x800 drivers/base/dd.c:1297
 driver_detach+0x1f3/0x2d0 drivers/base/dd.c:1360
 bus_remove_driver+0x226/0x320 drivers/base/bus.c:785
 usb_gadget_unregister_driver+0x4e/0x70 drivers/usb/gadget/udc/core.c:1751
 raw_release+0xd7/0x260 drivers/usb/gadget/legacy/raw_gadget.c:463
 __fput+0x44c/0xa70 fs/file_table.c:468
 task_work_run+0x1d4/0x260 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:44 [inline]
 exit_to_user_mode_loop+0xff/0x4f0 kernel/entry/common.c:75
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
 do_syscall_64+0x2e3/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2cf278f749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc35b7c9b8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00000000000247d0 RCX: 00007f2cf278f749
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000535b7ccaf
R10: 0000001b2fe20000 R11: 0000000000000246 R12: 00007f2cf29e5fac
R13: 00007f2cf29e5fa0 R14: ffffffffffffffff R15: 0000000000000003
 </TASK>
----------------
Code disassembly (best guess):
   0:	89 f0                	mov    %esi,%eax
   2:	48 c1 e8 03          	shr    $0x3,%rax
   6:	42 80 3c 38 00       	cmpb   $0x0,(%rax,%r15,1)
   b:	74 08                	je     0x15
   d:	4c 89 f7             	mov    %r14,%rdi
  10:	e8 67 4e 21 fb       	call   0xfb214e7c
  15:	49 83 3e 00          	cmpq   $0x0,(%r14)
  19:	74 40                	je     0x5b
  1b:	e8 bc fe ba fa       	call   0xfabafedc
  20:	48 8d 3d 75 5b c5 08 	lea    0x8c55b75(%rip),%rdi        # 0x8c55b9c
  27:	48 89 de             	mov    %rbx,%rsi
* 2a:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2f:	b8 f0 ff ff ff       	mov    $0xfffffff0,%eax
  34:	eb 11                	jmp    0x47
  36:	e8 a1 fe ba fa       	call   0xfabafedc
  3b:	eb 05                	jmp    0x42
  3d:	e8                   	.byte 0xe8
  3e:	9a                   	(bad)
  3f:	fe                   	.byte 0xfe