Extracting prog: 53m34.231054801s Minimizing prog: 2h42m12.118938296s Simplifying prog options: 7m34.193073986s Extracting C: 4m2.164517462s Simplifying C: 26m41.925940253s extracting reproducer from 51 programs testing a last program of every proc single: executing 11 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_mptcp-connect$inet-socket$nl_generic-socket-socket$inet_tcp-setsockopt$inet_tcp_int-bind$inet-connect$inet-setsockopt$inet_tcp_TCP_REPAIR_OPTIONS-setsockopt$inet_tcp_TCP_REPAIR-socket$inet6_sctp-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST-setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO-getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER-sendto$inet-mmap-recvfrom$inet-socketpair$unix-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-connect$inet-sendmmsg$inet detailed listing: executing program 0: r0 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x10, 0x3, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f00000001c0), 0x4) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000300)={0x0, 0x10, &(0x7f0000000280)=[@in={0x2, 0x4e24, @private=0xa010100}]}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, &(0x7f0000000000)={0x1, 0x0, 0x2, 0x3, r5}, 0x10) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000140)={r5, 0xbc}, &(0x7f0000000200)=0x8) sendto$inet(r2, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) recvfrom$inet(r2, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r7, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x0, 0xfffd, 0x0, 0x9, 0x5}, {0x12, 0x2, 0x0, 0x401, 0x8001, 0x1400}, 0xa5, 0x5, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x7fffffff}]}}]}, 0x60}}, 0x44080) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000380)=@newqdisc={0x38, 0x24, 0xd0f, 0x70bd2c, 0x25dfdbfe, {0x60, 0x0, 0x0, r7, {}, {0xffe0, 0xa}, {0xfff3, 0xe}}, [@qdisc_kind_options=@q_pfifo={{0xa}, {0x8, 0x2, 0x7}}]}, 0x38}, 0x1, 0x0, 0x0, 0x55}, 0xc010) connect$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000005240)=[{{0x0, 0x0, 0x0}, 0xfffffdef}], 0x4000095, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6-open-openat$dir-socket$kcm-sendmsg$kcm-syz_ublk_setup_io_uring-ioctl$sock_inet_SIOCSIFFLAGS-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_io_uring-syz_io_uring_submit-syz_ublk_setup_queues-sendmsg$NFT_BATCH-bpf$PROG_LOAD detailed listing: executing program 0: socket$inet6(0xa, 0x2, 0x0) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x108843, 0x98) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x10103c, 0x140) r1 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000740)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00120c00014002080c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x0) r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000400)={0x0, 0x30b5, 0x80, 0x0, 0x158}, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0, &(0x7f0000000140)=0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'wg1\x00', 0x800}) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup(r8) syz_ublk_setup_io_uring(0x4bc8, &(0x7f0000000180)={0x0, 0xad34, 0x10000, 0x3, 0x5b, 0x0, r0}, &(0x7f0000000280)=0x0, &(0x7f0000000300), &(0x7f0000000500)) syz_io_uring_submit(r10, r4, r5, &(0x7f0000000a80)=@IORING_OP_STATX={0x15, 0x1, 0x0, r9, &(0x7f0000000600), &(0x7f0000000700)='./file0\x00', 0x200, 0x800, 0x0, {0x0, r6}}) syz_ublk_setup_queues(r9, r7, &(0x7f0000000580)={0x0, 0xa191, 0x800, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x4000, 0x2100, 0x385, 0x0, r9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0x2, 0x100ae}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x0, 0x0, 0x1f0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xac1b, 0x8200, 0x2, 0x250}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, r0, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff6, 0x0, 0x0, 0x0}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-ioctl$USBDEVFS_IOCTL-syz_clone-prctl$PR_SCHED_CORE-syz_open_dev$usbfs-openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-socket$packet-ioctl$sock_SIOCGIFINDEX-sendto$packet-io_uring_setup-bpf$BPF_BTF_LOAD-io_uring_enter-ioctl$USBDEVFS_IOCTL-madvise-ioctl$USBDEVFS_CLEAR_HALT detailed listing: executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x8c0002) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000200)) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) syz_open_dev$usbfs(0x0, 0x9, 0x24080) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x3}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r5, {0x0, 0x7}, {0x1, 0xb}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x21, 0x4}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x240448a4}, 0x4890) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r6, &(0x7f0000000140)="05", 0x1, 0x4040094, &(0x7f00000000c0)={0x11, 0x10, r7, 0x1, 0x0, 0x6, @multicast}, 0x14) r8 = io_uring_setup(0x6858, &(0x7f0000000100)={0x0, 0x40f0ce, 0x3480, 0x0, 0x22d}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x4, [@restrict={0x0, 0x0, 0x0, 0xb, 0x2}, @fwd={0x2, 0x0, 0x0, 0x12}]}, {0x0, [0x0, 0x61]}}, 0x0, 0x34, 0x0, 0xa}, 0x28) io_uring_enter(r8, 0x0, 0xcb, 0xf, &(0x7f0000000000)={[0x20]}, 0x18) ioctl$USBDEVFS_IOCTL(r0, 0x80045505, &(0x7f0000000040)=@usbdevfs_connect) madvise(0xffffffffffffffff, 0x0, 0x19) ioctl$USBDEVFS_CLEAR_HALT(r0, 0x80045515, &(0x7f0000000000)={0x8, 0x1}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-socket$nl_route-socket$nl_netfilter-socketpair$unix-connect$unix-sendmmsg$unix-socket$nl_generic-syz_genetlink_get_family_id$l2tp-sendmsg$L2TP_CMD_TUNNEL_CREATE-recvmmsg-prctl$PR_SCHED_CORE-syz_open_dev$video-ioctl$VIDIOC_S_SELECTION-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN-openat$tun-ioctl$TUNSETIFF-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl$IOMMU_HWPT_ALLOC$TEST-socket$nl_route-madvise-setsockopt$MRT6_ADD_MFC-sendto$inet6-socket$netlink detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201100100000008100801000000000000010902240001000000000904000801030000000921ff7f250200000023535200eaccf23886"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="170928bd7000000000080009000100000008000a0000000000060002000080000008001700", @ANYRES32, @ANYBLOB], 0x3c}, 0x1, 0x620b}, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$video(&(0x7f0000000040), 0x8, 0x101840) ioctl$VIDIOC_S_SELECTION(r5, 0xc040565f, &(0x7f0000000080)={0xa, 0x0, 0x1, {0xe7ff, 0x1, 0x406, 0x870}}) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r6, 0x3ba0, &(0x7f0000000740)={0x48, 0x2, r7, 0x0, 0x0, 0x0, 0x0}) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r10 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000002c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r11, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) sendmsg$nl_route_sched(r10, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtfilter={0x4c, 0x2c, 0xd3f, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, r11, {0xb, 0x4}, {0x0, 0x9}, {0xf, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0x1c, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8848}, @TCA_FLOWER_KEY_MPLS_OPTS={0x10, 0x63, 0x0, 0x1, @TCA_FLOWER_KEY_MPLS_OPTS_LSE={0xc, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_MPLS_OPT_LSE_DEPTH={0x5, 0x1, 0x5}]}}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x1}, 0x20040054) ioctl$IOMMU_IOAS_MAP$PAGES(r6, 0x3b85, &(0x7f0000000000)={0x28, 0x7, r7, 0x0, &(0x7f0000c00000/0x400000)=nil, 0x400000, 0x1004000}) ioctl$IOMMU_HWPT_ALLOC$TEST(r6, 0x3b89, &(0x7f0000000140)={0x28, 0x6, r8, r7, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000180)}) socket$nl_route(0x10, 0x3, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0xcc, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000008, &(0x7f00000001c0)={0xa, 0x4e20, 0x8, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4}, 0xffffffffffffff18) socket$netlink(0x10, 0x3, 0xf) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-setsockopt$inet_tcp_buf-sendmsg$nl_route-socket$nl_generic-sendmsg$nl_generic-sendmsg$nl_generic-syz_usb_connect$lan78xx-syz_usb_control_io$lan78xx-syz_usb_control_io$lan78xx-syz_usb_control_io$lan78xx-syz_usb_control_io$lan78xx-syz_usb_connect-syz_usb_control_io$cdc_ncm-syz_usb_control_io$hid-syz_usb_control_io$lan78xx-syz_usb_control_io$lan78xx-socket$inet6-close_range-socket-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-socket$inet6-connect$inet6-openat$kvm-ioctl$KVM_CREATE_VM-dup-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-sendmsg$nl_generic detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x6) setsockopt$inet_tcp_buf(r0, 0x6, 0x5, &(0x7f0000000040)='esk\x00', 0x4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000021000100"], 0x28}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000003f000500010000000000000001010000000000000f0001006f76732d7302080000000000080002"], 0x30}}, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[], 0x58}}, 0x0) r2 = syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r2, 0x0, &(0x7f0000000100)={0x34, &(0x7f0000000140)={0xc0, 0xa1}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r2, 0x0, 0x0) syz_usb_control_io$lan78xx(r2, 0x0, &(0x7f0000000300)={0x34, &(0x7f0000000340)={0x40, 0xa0}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r2, 0x0, 0x0) r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="12010000a9d8ca08450c038064f9010243010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ncm(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, 0x0, &(0x7f0000000f40)={0x2c, &(0x7f0000000cc0)=ANY=[@ANYBLOB="c01601"], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r2, 0x0, &(0x7f0000000600)={0x34, &(0x7f0000000640)={0xc0, 0xa1}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r2, 0x0, &(0x7f0000000700)={0x34, &(0x7f0000000740)={0xc0, 0xa1}, 0x0, 0x0, 0x0, 0x0, 0x0}) socket$inet6(0xa, 0x2, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) socket(0x11, 0x2, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r6 = socket$inet6(0xa, 0x1, 0x8010000000000084) connect$inet6(r6, &(0x7f00000001c0)={0xa, 0x4e22, 0x1, @private0, 0x8}, 0x1c) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = dup(r8) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r10, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, &(0x7f0000002380)="c744240000000080c744240200000000c7442406000000000f011424b9a90900000f320f32c744240005000000c744240200000100c7442406000000000f01142448b802000000000000000f23d80f21f835400000a00f23f866b806018ec067430f01c248b800180000000000000f23d80f21f835800000100f23f82e0f1c440a0966b89a008ee0", 0x88}], 0x1, 0x11, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): signalfd4-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-timer_create-fcntl$lock-mprotect-socket-read$alg-timer_settime detailed listing: executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000140)={[0xffeffffffffffffa]}, 0x8, 0x800) r1 = syz_io_uring_setup(0xf08, &(0x7f0000000400)={0x0, 0x8000595d, 0x1000, 0x20002, 0x3c7, 0x0, r0}, &(0x7f0000000100)=0x0, &(0x7f0000001080)=0x0, &(0x7f0000000340)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_POLL_ADD={0x6, 0x10, 0x0, @fd=r0, 0x0, 0x0, 0x0, {0x110a}, 0x1}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r6 = socket(0x1e, 0x4, 0x0) read$alg(r6, &(0x7f0000000300)=""/74, 0x4a) (fail_nth: 20) timer_settime(r5, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): signalfd4-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-timer_create-fcntl$lock-mprotect-socket-read$alg-timer_settime detailed listing: executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000140)={[0xffeffffffffffffa]}, 0x8, 0x800) r1 = syz_io_uring_setup(0xf08, &(0x7f0000000400)={0x0, 0x8000595d, 0x1000, 0x20002, 0x3c7, 0x0, r0}, &(0x7f0000000100)=0x0, &(0x7f0000001080)=0x0, &(0x7f0000000340)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_POLL_ADD={0x6, 0x10, 0x0, @fd=r0, 0x0, 0x0, 0x0, {0x110a}, 0x1}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r6 = socket(0x1e, 0x4, 0x0) read$alg(r6, &(0x7f0000000300)=""/74, 0x4a) (fail_nth: 20) timer_settime(r5, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-socket-setsockopt$sock_int-epoll_ctl$EPOLL_CTL_ADD-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_open_dev$evdev-syz_usb_connect$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-ioctl$USBDEVFS_RELEASE_PORT-syz_open_procfs-openat-ioctl$EVIOCSFF-write$char_usb-ioctl$EVIOCSKEYCODE_V2-ioctl$EVIOCGKEYCODE_V2-syz_usb_ep_write detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) r1 = epoll_create1(0x0) r2 = socket$unix(0x1, 0x1, 0x0) close(r2) socket(0x2000000000000021, 0x2, 0x10000000000002) setsockopt$sock_int(r2, 0x1, 0x2e, &(0x7f0000000040)=0x80, 0x4) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000100)={0x8002a000}) syz_usb_connect(0x0, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b061000010102030109022e0001010080fa0904"], 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000140)) r3 = syz_open_dev$evdev(0x0, 0x4, 0x10000) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) syz_usb_connect$hid(0x2, 0x3f, &(0x7f00000001c0)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x5ac, 0x25b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x9, 0x10, 0x4, "", [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x3, 0x1, 0x2, 0x9, {0x9, 0x21, 0x3, 0xb9, 0x1, {0x22, 0x7b1}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x6, 0x9, 0x5}}, [{{0x9, 0x5, 0x2, 0x3, 0x20, 0x6, 0x3f, 0x6}}]}}}]}}]}}, &(0x7f0000000380)={0xa, &(0x7f0000000240)={0xa, 0x6, 0xdbe338692840613e, 0x5, 0x7, 0x0, 0xf7}, 0x11, &(0x7f0000000280)={0x5, 0xf, 0x11, 0x1, [@ssp_cap={0xc, 0x10, 0xa, 0x8, 0x0, 0x6, 0x1e000, 0x7}]}, 0x2, [{0x0, 0x0}, {0x0, 0x0}]}) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002212000000"], 0x0}, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0xfffffffffffffd7f, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) ioctl$USBDEVFS_RELEASE_PORT(r5, 0x80045519, &(0x7f0000000000)=0x7) r6 = syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') openat(r6, &(0x7f0000000c00)='auth.unix.ip/channel\x00', 0x2, 0x0) ioctl$EVIOCSFF(r6, 0x40304580, &(0x7f00000003c0)={0x55, 0x8000, 0xfffd, {0x0, 0x1}, {0x53, 0x2}, @cond=[{0x1ff, 0x6, 0x3, 0x800, 0xc7, 0x2}, {0xffff, 0x5, 0x1, 0x4046, 0x6, 0x81}]}) write$char_usb(0xffffffffffffffff, &(0x7f0000000040)="e2", 0x2250) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, &(0x7f00000000c0)={0x2, 0x2, 0x0, 0xd, "4620f63a4e6b5c9b4410b99e0e549fcfdeb92566761ad1c34ca4a1abe476fa96"}) ioctl$EVIOCGKEYCODE_V2(r3, 0x80284504, &(0x7f00000011c0)=""/270) syz_usb_ep_write(r0, 0x81, 0x17, &(0x7f0000000220)="830d00000000000000000000ff06fad50333010107ec00") program crashed: INFO: task hung in pn533_finalize_setup program crashed: INFO: task hung in pn533_finalize_setup single: successfully extracted reproducer found reproducer with 26 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-socket-setsockopt$sock_int-epoll_ctl$EPOLL_CTL_ADD-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_open_dev$evdev-syz_usb_connect$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-ioctl$USBDEVFS_RELEASE_PORT-syz_open_procfs-openat-ioctl$EVIOCSFF-write$char_usb-ioctl$EVIOCSKEYCODE_V2-ioctl$EVIOCGKEYCODE_V2 detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) r1 = epoll_create1(0x0) r2 = socket$unix(0x1, 0x1, 0x0) close(r2) socket(0x2000000000000021, 0x2, 0x10000000000002) setsockopt$sock_int(r2, 0x1, 0x2e, &(0x7f0000000040)=0x80, 0x4) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000100)={0x8002a000}) syz_usb_connect(0x0, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b061000010102030109022e0001010080fa0904"], 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000140)) r3 = syz_open_dev$evdev(0x0, 0x4, 0x10000) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) syz_usb_connect$hid(0x2, 0x3f, &(0x7f00000001c0)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x5ac, 0x25b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x9, 0x10, 0x4, "", [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x3, 0x1, 0x2, 0x9, {0x9, 0x21, 0x3, 0xb9, 0x1, {0x22, 0x7b1}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x6, 0x9, 0x5}}, [{{0x9, 0x5, 0x2, 0x3, 0x20, 0x6, 0x3f, 0x6}}]}}}]}}]}}, &(0x7f0000000380)={0xa, &(0x7f0000000240)={0xa, 0x6, 0xdbe338692840613e, 0x5, 0x7, 0x0, 0xf7}, 0x11, &(0x7f0000000280)={0x5, 0xf, 0x11, 0x1, [@ssp_cap={0xc, 0x10, 0xa, 0x8, 0x0, 0x6, 0x1e000, 0x7}]}, 0x2, [{0x0, 0x0}, {0x0, 0x0}]}) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002212000000"], 0x0}, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0xfffffffffffffd7f, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) ioctl$USBDEVFS_RELEASE_PORT(r5, 0x80045519, &(0x7f0000000000)=0x7) r6 = syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') openat(r6, &(0x7f0000000c00)='auth.unix.ip/channel\x00', 0x2, 0x0) ioctl$EVIOCSFF(r6, 0x40304580, &(0x7f00000003c0)={0x55, 0x8000, 0xfffd, {0x0, 0x1}, {0x53, 0x2}, @cond=[{0x1ff, 0x6, 0x3, 0x800, 0xc7, 0x2}, {0xffff, 0x5, 0x1, 0x4046, 0x6, 0x81}]}) write$char_usb(0xffffffffffffffff, &(0x7f0000000040)="e2", 0x2250) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, &(0x7f00000000c0)={0x2, 0x2, 0x0, 0xd, "4620f63a4e6b5c9b4410b99e0e549fcfdeb92566761ad1c34ca4a1abe476fa96"}) ioctl$EVIOCGKEYCODE_V2(r3, 0x80284504, &(0x7f00000011c0)=""/270) program crashed: INFO: task hung in pn533_usb_probe testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-socket-setsockopt$sock_int-epoll_ctl$EPOLL_CTL_ADD-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_open_dev$evdev-syz_usb_connect$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-ioctl$USBDEVFS_RELEASE_PORT-syz_open_procfs-openat-ioctl$EVIOCSFF-write$char_usb-ioctl$EVIOCSKEYCODE_V2 detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) r1 = epoll_create1(0x0) r2 = socket$unix(0x1, 0x1, 0x0) close(r2) socket(0x2000000000000021, 0x2, 0x10000000000002) setsockopt$sock_int(r2, 0x1, 0x2e, &(0x7f0000000040)=0x80, 0x4) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000100)={0x8002a000}) syz_usb_connect(0x0, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b061000010102030109022e0001010080fa0904"], 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000140)) syz_open_dev$evdev(0x0, 0x4, 0x10000) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) syz_usb_connect$hid(0x2, 0x3f, &(0x7f00000001c0)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x5ac, 0x25b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x9, 0x10, 0x4, "", [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x3, 0x1, 0x2, 0x9, {0x9, 0x21, 0x3, 0xb9, 0x1, {0x22, 0x7b1}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x6, 0x9, 0x5}}, [{{0x9, 0x5, 0x2, 0x3, 0x20, 0x6, 0x3f, 0x6}}]}}}]}}]}}, &(0x7f0000000380)={0xa, &(0x7f0000000240)={0xa, 0x6, 0xdbe338692840613e, 0x5, 0x7, 0x0, 0xf7}, 0x11, &(0x7f0000000280)={0x5, 0xf, 0x11, 0x1, [@ssp_cap={0xc, 0x10, 0xa, 0x8, 0x0, 0x6, 0x1e000, 0x7}]}, 0x2, [{0x0, 0x0}, {0x0, 0x0}]}) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002212000000"], 0x0}, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0xfffffffffffffd7f, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) ioctl$USBDEVFS_RELEASE_PORT(r4, 0x80045519, &(0x7f0000000000)=0x7) r5 = syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') openat(r5, &(0x7f0000000c00)='auth.unix.ip/channel\x00', 0x2, 0x0) ioctl$EVIOCSFF(r5, 0x40304580, &(0x7f00000003c0)={0x55, 0x8000, 0xfffd, {0x0, 0x1}, {0x53, 0x2}, @cond=[{0x1ff, 0x6, 0x3, 0x800, 0xc7, 0x2}, {0xffff, 0x5, 0x1, 0x4046, 0x6, 0x81}]}) write$char_usb(0xffffffffffffffff, &(0x7f0000000040)="e2", 0x2250) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, &(0x7f00000000c0)={0x2, 0x2, 0x0, 0xd, "4620f63a4e6b5c9b4410b99e0e549fcfdeb92566761ad1c34ca4a1abe476fa96"}) program crashed: INFO: task hung in pn533_usb_probe testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-socket-setsockopt$sock_int-epoll_ctl$EPOLL_CTL_ADD-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_open_dev$evdev-syz_usb_connect$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-ioctl$USBDEVFS_RELEASE_PORT-syz_open_procfs-openat-ioctl$EVIOCSFF-write$char_usb detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) r1 = epoll_create1(0x0) r2 = socket$unix(0x1, 0x1, 0x0) close(r2) socket(0x2000000000000021, 0x2, 0x10000000000002) setsockopt$sock_int(r2, 0x1, 0x2e, &(0x7f0000000040)=0x80, 0x4) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000100)={0x8002a000}) syz_usb_connect(0x0, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b061000010102030109022e0001010080fa0904"], 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000140)) syz_open_dev$evdev(0x0, 0x4, 0x10000) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) syz_usb_connect$hid(0x2, 0x3f, &(0x7f00000001c0)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x5ac, 0x25b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x9, 0x10, 0x4, "", [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x3, 0x1, 0x2, 0x9, {0x9, 0x21, 0x3, 0xb9, 0x1, {0x22, 0x7b1}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x6, 0x9, 0x5}}, [{{0x9, 0x5, 0x2, 0x3, 0x20, 0x6, 0x3f, 0x6}}]}}}]}}]}}, &(0x7f0000000380)={0xa, &(0x7f0000000240)={0xa, 0x6, 0xdbe338692840613e, 0x5, 0x7, 0x0, 0xf7}, 0x11, &(0x7f0000000280)={0x5, 0xf, 0x11, 0x1, [@ssp_cap={0xc, 0x10, 0xa, 0x8, 0x0, 0x6, 0x1e000, 0x7}]}, 0x2, [{0x0, 0x0}, {0x0, 0x0}]}) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002212000000"], 0x0}, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0xfffffffffffffd7f, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) ioctl$USBDEVFS_RELEASE_PORT(r4, 0x80045519, &(0x7f0000000000)=0x7) r5 = syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') openat(r5, &(0x7f0000000c00)='auth.unix.ip/channel\x00', 0x2, 0x0) ioctl$EVIOCSFF(r5, 0x40304580, &(0x7f00000003c0)={0x55, 0x8000, 0xfffd, {0x0, 0x1}, {0x53, 0x2}, @cond=[{0x1ff, 0x6, 0x3, 0x800, 0xc7, 0x2}, {0xffff, 0x5, 0x1, 0x4046, 0x6, 0x81}]}) write$char_usb(0xffffffffffffffff, &(0x7f0000000040)="e2", 0x2250) program crashed: INFO: task hung in pn533_usb_probe testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-socket-setsockopt$sock_int-epoll_ctl$EPOLL_CTL_ADD-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_open_dev$evdev-syz_usb_connect$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-ioctl$USBDEVFS_RELEASE_PORT-syz_open_procfs-openat-ioctl$EVIOCSFF detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) r1 = epoll_create1(0x0) r2 = socket$unix(0x1, 0x1, 0x0) close(r2) socket(0x2000000000000021, 0x2, 0x10000000000002) setsockopt$sock_int(r2, 0x1, 0x2e, &(0x7f0000000040)=0x80, 0x4) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000100)={0x8002a000}) syz_usb_connect(0x0, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b061000010102030109022e0001010080fa0904"], 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000140)) syz_open_dev$evdev(0x0, 0x4, 0x10000) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) syz_usb_connect$hid(0x2, 0x3f, &(0x7f00000001c0)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x5ac, 0x25b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x9, 0x10, 0x4, "", [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x3, 0x1, 0x2, 0x9, {0x9, 0x21, 0x3, 0xb9, 0x1, {0x22, 0x7b1}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x6, 0x9, 0x5}}, [{{0x9, 0x5, 0x2, 0x3, 0x20, 0x6, 0x3f, 0x6}}]}}}]}}]}}, &(0x7f0000000380)={0xa, &(0x7f0000000240)={0xa, 0x6, 0xdbe338692840613e, 0x5, 0x7, 0x0, 0xf7}, 0x11, &(0x7f0000000280)={0x5, 0xf, 0x11, 0x1, [@ssp_cap={0xc, 0x10, 0xa, 0x8, 0x0, 0x6, 0x1e000, 0x7}]}, 0x2, [{0x0, 0x0}, {0x0, 0x0}]}) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002212000000"], 0x0}, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0xfffffffffffffd7f, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) ioctl$USBDEVFS_RELEASE_PORT(r4, 0x80045519, &(0x7f0000000000)=0x7) r5 = syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') openat(r5, &(0x7f0000000c00)='auth.unix.ip/channel\x00', 0x2, 0x0) ioctl$EVIOCSFF(r5, 0x40304580, &(0x7f00000003c0)={0x55, 0x8000, 0xfffd, {0x0, 0x1}, {0x53, 0x2}, @cond=[{0x1ff, 0x6, 0x3, 0x800, 0xc7, 0x2}, {0xffff, 0x5, 0x1, 0x4046, 0x6, 0x81}]}) program crashed: INFO: task hung in pn533_usb_probe testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-socket-setsockopt$sock_int-epoll_ctl$EPOLL_CTL_ADD-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_open_dev$evdev-syz_usb_connect$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-ioctl$USBDEVFS_RELEASE_PORT-syz_open_procfs-openat detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) r1 = epoll_create1(0x0) r2 = socket$unix(0x1, 0x1, 0x0) close(r2) socket(0x2000000000000021, 0x2, 0x10000000000002) setsockopt$sock_int(r2, 0x1, 0x2e, &(0x7f0000000040)=0x80, 0x4) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000100)={0x8002a000}) syz_usb_connect(0x0, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b061000010102030109022e0001010080fa0904"], 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000140)) syz_open_dev$evdev(0x0, 0x4, 0x10000) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) syz_usb_connect$hid(0x2, 0x3f, &(0x7f00000001c0)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x5ac, 0x25b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x9, 0x10, 0x4, "", [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x3, 0x1, 0x2, 0x9, {0x9, 0x21, 0x3, 0xb9, 0x1, {0x22, 0x7b1}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x6, 0x9, 0x5}}, [{{0x9, 0x5, 0x2, 0x3, 0x20, 0x6, 0x3f, 0x6}}]}}}]}}]}}, &(0x7f0000000380)={0xa, &(0x7f0000000240)={0xa, 0x6, 0xdbe338692840613e, 0x5, 0x7, 0x0, 0xf7}, 0x11, &(0x7f0000000280)={0x5, 0xf, 0x11, 0x1, [@ssp_cap={0xc, 0x10, 0xa, 0x8, 0x0, 0x6, 0x1e000, 0x7}]}, 0x2, [{0x0, 0x0}, {0x0, 0x0}]}) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002212000000"], 0x0}, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0xfffffffffffffd7f, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) ioctl$USBDEVFS_RELEASE_PORT(r4, 0x80045519, &(0x7f0000000000)=0x7) r5 = syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') openat(r5, &(0x7f0000000c00)='auth.unix.ip/channel\x00', 0x2, 0x0) program crashed: INFO: task hung in pn533_usb_probe testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-socket-setsockopt$sock_int-epoll_ctl$EPOLL_CTL_ADD-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_open_dev$evdev-syz_usb_connect$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-ioctl$USBDEVFS_RELEASE_PORT-syz_open_procfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) r1 = epoll_create1(0x0) r2 = socket$unix(0x1, 0x1, 0x0) close(r2) socket(0x2000000000000021, 0x2, 0x10000000000002) setsockopt$sock_int(r2, 0x1, 0x2e, &(0x7f0000000040)=0x80, 0x4) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000100)={0x8002a000}) syz_usb_connect(0x0, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b061000010102030109022e0001010080fa0904"], 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000140)) syz_open_dev$evdev(0x0, 0x4, 0x10000) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) syz_usb_connect$hid(0x2, 0x3f, &(0x7f00000001c0)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x5ac, 0x25b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x9, 0x10, 0x4, "", [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x3, 0x1, 0x2, 0x9, {0x9, 0x21, 0x3, 0xb9, 0x1, {0x22, 0x7b1}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x6, 0x9, 0x5}}, [{{0x9, 0x5, 0x2, 0x3, 0x20, 0x6, 0x3f, 0x6}}]}}}]}}]}}, &(0x7f0000000380)={0xa, &(0x7f0000000240)={0xa, 0x6, 0xdbe338692840613e, 0x5, 0x7, 0x0, 0xf7}, 0x11, &(0x7f0000000280)={0x5, 0xf, 0x11, 0x1, [@ssp_cap={0xc, 0x10, 0xa, 0x8, 0x0, 0x6, 0x1e000, 0x7}]}, 0x2, [{0x0, 0x0}, {0x0, 0x0}]}) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002212000000"], 0x0}, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0xfffffffffffffd7f, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) ioctl$USBDEVFS_RELEASE_PORT(r4, 0x80045519, &(0x7f0000000000)=0x7) syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') program crashed: INFO: task hung in pn533_usb_probe testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-socket-setsockopt$sock_int-epoll_ctl$EPOLL_CTL_ADD-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_open_dev$evdev-syz_usb_connect$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-ioctl$USBDEVFS_RELEASE_PORT detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) r1 = epoll_create1(0x0) r2 = socket$unix(0x1, 0x1, 0x0) close(r2) socket(0x2000000000000021, 0x2, 0x10000000000002) setsockopt$sock_int(r2, 0x1, 0x2e, &(0x7f0000000040)=0x80, 0x4) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000100)={0x8002a000}) syz_usb_connect(0x0, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b061000010102030109022e0001010080fa0904"], 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000140)) syz_open_dev$evdev(0x0, 0x4, 0x10000) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) syz_usb_connect$hid(0x2, 0x3f, &(0x7f00000001c0)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x5ac, 0x25b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x9, 0x10, 0x4, "", [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x3, 0x1, 0x2, 0x9, {0x9, 0x21, 0x3, 0xb9, 0x1, {0x22, 0x7b1}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x6, 0x9, 0x5}}, [{{0x9, 0x5, 0x2, 0x3, 0x20, 0x6, 0x3f, 0x6}}]}}}]}}]}}, &(0x7f0000000380)={0xa, &(0x7f0000000240)={0xa, 0x6, 0xdbe338692840613e, 0x5, 0x7, 0x0, 0xf7}, 0x11, &(0x7f0000000280)={0x5, 0xf, 0x11, 0x1, [@ssp_cap={0xc, 0x10, 0xa, 0x8, 0x0, 0x6, 0x1e000, 0x7}]}, 0x2, [{0x0, 0x0}, {0x0, 0x0}]}) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002212000000"], 0x0}, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0xfffffffffffffd7f, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) ioctl$USBDEVFS_RELEASE_PORT(r4, 0x80045519, &(0x7f0000000000)=0x7) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-socket-setsockopt$sock_int-epoll_ctl$EPOLL_CTL_ADD-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_open_dev$evdev-syz_usb_connect$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) r1 = epoll_create1(0x0) r2 = socket$unix(0x1, 0x1, 0x0) close(r2) socket(0x2000000000000021, 0x2, 0x10000000000002) setsockopt$sock_int(r2, 0x1, 0x2e, &(0x7f0000000040)=0x80, 0x4) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000100)={0x8002a000}) syz_usb_connect(0x0, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b061000010102030109022e0001010080fa0904"], 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000140)) syz_open_dev$evdev(0x0, 0x4, 0x10000) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) syz_usb_connect$hid(0x2, 0x3f, &(0x7f00000001c0)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x5ac, 0x25b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x9, 0x10, 0x4, "", [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x3, 0x1, 0x2, 0x9, {0x9, 0x21, 0x3, 0xb9, 0x1, {0x22, 0x7b1}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x6, 0x9, 0x5}}, [{{0x9, 0x5, 0x2, 0x3, 0x20, 0x6, 0x3f, 0x6}}]}}}]}}]}}, &(0x7f0000000380)={0xa, &(0x7f0000000240)={0xa, 0x6, 0xdbe338692840613e, 0x5, 0x7, 0x0, 0xf7}, 0x11, &(0x7f0000000280)={0x5, 0xf, 0x11, 0x1, [@ssp_cap={0xc, 0x10, 0xa, 0x8, 0x0, 0x6, 0x1e000, 0x7}]}, 0x2, [{0x0, 0x0}, {0x0, 0x0}]}) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002212000000"], 0x0}, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0xfffffffffffffd7f, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') program crashed: INFO: task hung in pn533_usb_probe testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-socket-setsockopt$sock_int-epoll_ctl$EPOLL_CTL_ADD-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_open_dev$evdev-syz_usb_connect$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_open_procfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) r1 = epoll_create1(0x0) r2 = socket$unix(0x1, 0x1, 0x0) close(r2) socket(0x2000000000000021, 0x2, 0x10000000000002) setsockopt$sock_int(r2, 0x1, 0x2e, &(0x7f0000000040)=0x80, 0x4) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000100)={0x8002a000}) syz_usb_connect(0x0, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b061000010102030109022e0001010080fa0904"], 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000140)) syz_open_dev$evdev(0x0, 0x4, 0x10000) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) syz_usb_connect$hid(0x2, 0x3f, &(0x7f00000001c0)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x5ac, 0x25b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x9, 0x10, 0x4, "", [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x3, 0x1, 0x2, 0x9, {0x9, 0x21, 0x3, 0xb9, 0x1, {0x22, 0x7b1}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x6, 0x9, 0x5}}, [{{0x9, 0x5, 0x2, 0x3, 0x20, 0x6, 0x3f, 0x6}}]}}}]}}]}}, &(0x7f0000000380)={0xa, &(0x7f0000000240)={0xa, 0x6, 0xdbe338692840613e, 0x5, 0x7, 0x0, 0xf7}, 0x11, &(0x7f0000000280)={0x5, 0xf, 0x11, 0x1, [@ssp_cap={0xc, 0x10, 0xa, 0x8, 0x0, 0x6, 0x1e000, 0x7}]}, 0x2, [{0x0, 0x0}, {0x0, 0x0}]}) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002212000000"], 0x0}, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0xfffffffffffffd7f, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-socket-setsockopt$sock_int-epoll_ctl$EPOLL_CTL_ADD-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_open_dev$evdev-syz_usb_connect$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-syz_usb_connect$hid-syz_usb_control_io$hid-syz_open_dev$usbfs-syz_open_procfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) r1 = epoll_create1(0x0) r2 = socket$unix(0x1, 0x1, 0x0) close(r2) socket(0x2000000000000021, 0x2, 0x10000000000002) setsockopt$sock_int(r2, 0x1, 0x2e, &(0x7f0000000040)=0x80, 0x4) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000100)={0x8002a000}) syz_usb_connect(0x0, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b061000010102030109022e0001010080fa0904"], 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000140)) syz_open_dev$evdev(0x0, 0x4, 0x10000) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) syz_usb_connect$hid(0x2, 0x3f, &(0x7f00000001c0)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x5ac, 0x25b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x9, 0x10, 0x4, "", [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x3, 0x1, 0x2, 0x9, {0x9, 0x21, 0x3, 0xb9, 0x1, {0x22, 0x7b1}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x6, 0x9, 0x5}}, [{{0x9, 0x5, 0x2, 0x3, 0x20, 0x6, 0x3f, 0x6}}]}}}]}}]}}, &(0x7f0000000380)={0xa, &(0x7f0000000240)={0xa, 0x6, 0xdbe338692840613e, 0x5, 0x7, 0x0, 0xf7}, 0x11, &(0x7f0000000280)={0x5, 0xf, 0x11, 0x1, [@ssp_cap={0xc, 0x10, 0xa, 0x8, 0x0, 0x6, 0x1e000, 0x7}]}, 0x2, [{0x0, 0x0}, {0x0, 0x0}]}) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002212000000"], 0x0}, 0x0) syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-socket-setsockopt$sock_int-epoll_ctl$EPOLL_CTL_ADD-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_open_dev$evdev-syz_usb_connect$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-syz_usb_connect$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) r1 = epoll_create1(0x0) r2 = socket$unix(0x1, 0x1, 0x0) close(r2) socket(0x2000000000000021, 0x2, 0x10000000000002) setsockopt$sock_int(r2, 0x1, 0x2e, &(0x7f0000000040)=0x80, 0x4) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000100)={0x8002a000}) syz_usb_connect(0x0, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b061000010102030109022e0001010080fa0904"], 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000140)) syz_open_dev$evdev(0x0, 0x4, 0x10000) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) syz_usb_connect$hid(0x2, 0x3f, &(0x7f00000001c0)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x5ac, 0x25b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x9, 0x10, 0x4, "", [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x3, 0x1, 0x2, 0x9, {0x9, 0x21, 0x3, 0xb9, 0x1, {0x22, 0x7b1}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x6, 0x9, 0x5}}, [{{0x9, 0x5, 0x2, 0x3, 0x20, 0x6, 0x3f, 0x6}}]}}}]}}]}}, &(0x7f0000000380)={0xa, &(0x7f0000000240)={0xa, 0x6, 0xdbe338692840613e, 0x5, 0x7, 0x0, 0xf7}, 0x11, &(0x7f0000000280)={0x5, 0xf, 0x11, 0x1, [@ssp_cap={0xc, 0x10, 0xa, 0x8, 0x0, 0x6, 0x1e000, 0x7}]}, 0x2, [{0x0, 0x0}, {0x0, 0x0}]}) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0xfffffffffffffd7f, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') program crashed: INFO: task hung in pn533_usb_probe testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-socket-setsockopt$sock_int-epoll_ctl$EPOLL_CTL_ADD-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_open_dev$evdev-syz_usb_connect$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) r1 = epoll_create1(0x0) r2 = socket$unix(0x1, 0x1, 0x0) close(r2) socket(0x2000000000000021, 0x2, 0x10000000000002) setsockopt$sock_int(r2, 0x1, 0x2e, &(0x7f0000000040)=0x80, 0x4) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000100)={0x8002a000}) syz_usb_connect(0x0, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b061000010102030109022e0001010080fa0904"], 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000140)) syz_open_dev$evdev(0x0, 0x4, 0x10000) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0xfffffffffffffd7f, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') program crashed: INFO: task hung in pn533_usb_probe testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-socket-setsockopt$sock_int-epoll_ctl$EPOLL_CTL_ADD-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_open_dev$evdev-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) r1 = epoll_create1(0x0) r2 = socket$unix(0x1, 0x1, 0x0) close(r2) socket(0x2000000000000021, 0x2, 0x10000000000002) setsockopt$sock_int(r2, 0x1, 0x2e, &(0x7f0000000040)=0x80, 0x4) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000100)={0x8002a000}) syz_usb_connect(0x0, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b061000010102030109022e0001010080fa0904"], 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000140)) syz_open_dev$evdev(0x0, 0x4, 0x10000) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0xfffffffffffffd7f, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') program crashed: INFO: task hung in pn533_usb_probe testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-socket-setsockopt$sock_int-epoll_ctl$EPOLL_CTL_ADD-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_open_dev$evdev-syz_usb_connect$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) r1 = epoll_create1(0x0) r2 = socket$unix(0x1, 0x1, 0x0) close(r2) socket(0x2000000000000021, 0x2, 0x10000000000002) setsockopt$sock_int(r2, 0x1, 0x2e, &(0x7f0000000040)=0x80, 0x4) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000100)={0x8002a000}) syz_usb_connect(0x0, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b061000010102030109022e0001010080fa0904"], 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000140)) syz_open_dev$evdev(0x0, 0x4, 0x10000) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0xfffffffffffffd7f, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-socket-setsockopt$sock_int-epoll_ctl$EPOLL_CTL_ADD-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_open_dev$evdev-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) r1 = epoll_create1(0x0) r2 = socket$unix(0x1, 0x1, 0x0) close(r2) socket(0x2000000000000021, 0x2, 0x10000000000002) setsockopt$sock_int(r2, 0x1, 0x2e, &(0x7f0000000040)=0x80, 0x4) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000100)={0x8002a000}) syz_usb_connect(0x0, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b061000010102030109022e0001010080fa0904"], 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000140)) syz_open_dev$evdev(0x0, 0x4, 0x10000) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0xfffffffffffffd7f, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') program crashed: INFO: task hung in pn533_usb_probe testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-socket-setsockopt$sock_int-epoll_ctl$EPOLL_CTL_ADD-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) r1 = epoll_create1(0x0) r2 = socket$unix(0x1, 0x1, 0x0) close(r2) socket(0x2000000000000021, 0x2, 0x10000000000002) setsockopt$sock_int(r2, 0x1, 0x2e, &(0x7f0000000040)=0x80, 0x4) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000100)={0x8002a000}) syz_usb_connect(0x0, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b061000010102030109022e0001010080fa0904"], 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000140)) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0xfffffffffffffd7f, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') program crashed: INFO: task hung in pn533_usb_probe testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-socket-setsockopt$sock_int-epoll_ctl$EPOLL_CTL_ADD-syz_usb_connect-syz_usb_ep_read-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) r1 = epoll_create1(0x0) r2 = socket$unix(0x1, 0x1, 0x0) close(r2) socket(0x2000000000000021, 0x2, 0x10000000000002) setsockopt$sock_int(r2, 0x1, 0x2e, &(0x7f0000000040)=0x80, 0x4) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000100)={0x8002a000}) syz_usb_connect(0x0, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b061000010102030109022e0001010080fa0904"], 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0xfffffffffffffd7f, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') program crashed: INFO: task hung in pn533_usb_probe testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-socket-setsockopt$sock_int-epoll_ctl$EPOLL_CTL_ADD-syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs detailed listing: executing program 0: syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) r0 = epoll_create1(0x0) r1 = socket$unix(0x1, 0x1, 0x0) close(r1) socket(0x2000000000000021, 0x2, 0x10000000000002) setsockopt$sock_int(r1, 0x1, 0x2e, &(0x7f0000000040)=0x80, 0x4) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000100)={0x8002a000}) syz_usb_connect(0x0, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b061000010102030109022e0001010080fa0904"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0xfffffffffffffd7f, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-socket-setsockopt$sock_int-epoll_ctl$EPOLL_CTL_ADD-syz_usb_ep_read-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) r1 = epoll_create1(0x0) r2 = socket$unix(0x1, 0x1, 0x0) close(r2) socket(0x2000000000000021, 0x2, 0x10000000000002) setsockopt$sock_int(r2, 0x1, 0x2e, &(0x7f0000000040)=0x80, 0x4) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000100)={0x8002a000}) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0xfffffffffffffd7f, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') program crashed: INFO: task hung in pn533_usb_probe testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-socket-setsockopt$sock_int-syz_usb_ep_read-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) epoll_create1(0x0) r1 = socket$unix(0x1, 0x1, 0x0) close(r1) socket(0x2000000000000021, 0x2, 0x10000000000002) setsockopt$sock_int(r1, 0x1, 0x2e, &(0x7f0000000040)=0x80, 0x4) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0xfffffffffffffd7f, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') program crashed: INFO: task hung in pn533_usb_probe testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-socket-syz_usb_ep_read-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) epoll_create1(0x0) r1 = socket$unix(0x1, 0x1, 0x0) close(r1) socket(0x2000000000000021, 0x2, 0x10000000000002) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0xfffffffffffffd7f, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') program crashed: INFO: task hung in pn533_usb_probe testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-syz_usb_ep_read-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) epoll_create1(0x0) r1 = socket$unix(0x1, 0x1, 0x0) close(r1) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0xfffffffffffffd7f, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') program crashed: INFO: task hung in pn533_usb_probe testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-syz_usb_ep_read-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) epoll_create1(0x0) socket$unix(0x1, 0x1, 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0xfffffffffffffd7f, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-close-syz_usb_ep_read-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) epoll_create1(0x0) close(0xffffffffffffffff) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0xfffffffffffffd7f, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$unix-close-syz_usb_ep_read-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) r1 = socket$unix(0x1, 0x1, 0x0) close(r1) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0xfffffffffffffd7f, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): epoll_create1-socket$unix-close-syz_usb_ep_read-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs detailed listing: executing program 0: epoll_create1(0x0) r0 = socket$unix(0x1, 0x1, 0x0) close(r0) syz_usb_ep_read(0xffffffffffffffff, 0x2, 0x40, &(0x7f0000000100)) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0xfffffffffffffd7f, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-syz_usb_ep_read-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, 0x0, 0x0) epoll_create1(0x0) r1 = socket$unix(0x1, 0x1, 0x0) close(r1) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0xfffffffffffffd7f, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-syz_usb_ep_read-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) epoll_create1(0x0) r1 = socket$unix(0x1, 0x1, 0x0) close(r1) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0xfffffffffffffd7f, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-syz_usb_ep_read-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) epoll_create1(0x0) r1 = socket$unix(0x1, 0x1, 0x0) close(r1) syz_usb_ep_read(r0, 0x2, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0xfffffffffffffd7f, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-syz_usb_ep_read-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) epoll_create1(0x0) r1 = socket$unix(0x1, 0x1, 0x0) close(r1) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') program crashed: INFO: task hung in pn533_usb_probe testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-syz_usb_ep_read-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) epoll_create1(0x0) r1 = socket$unix(0x1, 0x1, 0x0) close(r1) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$usbfs(0x0, 0x1ff, 0xa001) syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-syz_usb_ep_read-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) epoll_create1(0x0) r1 = socket$unix(0x1, 0x1, 0x0) close(r1) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) syz_open_procfs(0x0, 0x0) program crashed: INFO: task hung in pn533_usb_probe extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-syz_usb_ep_read-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs program crashed: no output from test machine a never seen crash title: no output from test machine, ignore simplifying guilty program options testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-syz_usb_ep_read-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) epoll_create1(0x0) r1 = socket$unix(0x1, 0x1, 0x0) close(r1) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) syz_open_procfs(0x0, 0x0) program crashed: INFO: task hung in pn533_usb_probe extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-syz_usb_ep_read-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs program crashed: INFO: task hung in pn533_usb_probe simplifying C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-syz_usb_ep_read-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs program crashed: INFO: task hung in pn533_usb_probe testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-syz_usb_ep_read-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs program crashed: INFO: task hung in pn533_usb_probe testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-syz_usb_ep_read-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs program crashed: INFO: task hung in pn533_usb_probe testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-syz_usb_ep_read-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs program crashed: INFO: task hung in pn533_usb_probe testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-syz_usb_ep_read-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs program crashed: INFO: task hung in pn533_usb_probe testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-syz_usb_ep_read-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs program crashed: INFO: task hung in pn533_usb_probe testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-syz_usb_ep_read-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs program crashed: INFO: task hung in pn533_usb_probe testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-syz_usb_ep_read-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) epoll_create1(0x0) r1 = socket$unix(0x1, 0x1, 0x0) close(r1) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) syz_open_procfs(0x0, 0x0) program crashed: INFO: task hung in pn533_usb_probe validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-syz_usb_ep_read-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) epoll_create1(0x0) r1 = socket$unix(0x1, 0x1, 0x0) close(r1) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) syz_open_procfs(0x0, 0x0) program crashed: INFO: task hung in pn533_usb_probe validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-socket$unix-close-syz_usb_ep_read-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$usbfs-syz_open_procfs detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) epoll_create1(0x0) r1 = socket$unix(0x1, 0x1, 0x0) close(r1) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa001) syz_open_procfs(0x0, 0x0) program crashed: INFO: task hung in pn533_usb_probe validation run: crashed=true reproducing took 4h26m38.992076542s repro crashed as (corrupted=false): INFO: task kworker/0:1:10 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kwor task:kworker/0:1 state:D stack:24384 pid:10 tgid:10 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5520 [inline] __schedule+0x17db/0x58f0 kernel/sched/core.c:7270 __schedule_loop kernel/sched/core.c:7347 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7362 schedule_timeout+0xc0/0x2c0 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common kernel/sched/completion.c:121 [inline] wait_for_common kernel/sched/completion.c:132 [inline] wait_for_completion+0x2ca/0x5e0 kernel/sched/completion.c:153 pn533_acr122_poweron_rdr drivers/nfc/pn533/usb.c:419 [inline] pn533_usb_probe+0xbc9/0x10e0 drivers/nfc/pn533/usb.c:544 usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2708 hub_port_connect drivers/usb/core/hub.c:5580 [inline] hub_port_connect_change drivers/usb/core/hub.c:5720 [inline] port_event drivers/usb/core/hub.c:5884 [inline] hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5966 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task syz.0.17:5840 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.17 state:D stack:27400 pid:5840 tgid:5840 ppid:5751 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5520 [inline] __schedule+0x17db/0x58f0 kernel/sched/core.c:7270 __schedule_loop kernel/sched/core.c:7347 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7362 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7419 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c1/0x1550 kernel/locking/mutex.c:821 device_lock include/linux/device.h:1104 [inline] usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 chrdev_open+0x4d9/0x600 fs/char_dev.c:411 do_dentry_open+0x816/0x1380 fs/open.c:996 vfs_open+0x3b/0x340 fs/open.c:1101 do_open fs/namei.c:4837 [inline] path_openat+0x1443/0x1d60 fs/namei.c:5000 do_file_open+0x23e/0x4a0 fs/namei.c:5029 do_sys_openat2+0x115/0x200 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1434 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc13fb5e98e RSP: 002b:00007ffc257b8338 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 000055555f482500 RCX: 00007fc13fb5e98e RDX: 000000000000a001 RSI: 00007ffc257b8410 RDI: ffffffffffffff9c RBP: 00007ffc257b8410 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd R13: 00007fc13fe25fac R14: 00007fc13fe25fa0 R15: 00007fc13fe25fa0 Showing all locks held in the system: locks held by kworker/0:0/9: 5, on CPU#0: #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888029d141d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff888029d141d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5912 #3: ffff88807e81d1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88807e81d1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff888028d221a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff888028d221a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 locks held by kworker/0:1/10: 5, on CPU#0: #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5912 #3: ffff8880341491d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff8880341491d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88807f52f1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88807f52f1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 locks held by pr/ttyS0/16: 2, last CPU#0: #0: ffffffff8ec362b8 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:314 [inline] #0: ffffffff8ec362b8 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:439 [inline] #0: ffffffff8ec362b8 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x30/0x60 kernel/printk/printk.c:291 #1: ffffffff9ad33098 (&port_lock_key){-.-.}-{3:3}, at: __uart_port_lock_irqsave include/linux/serial_core.h:613 [inline] #1: ffffffff9ad33098 (&port_lock_key){-.-.}-{3:3}, at: univ8250_console_device_lock+0x67/0xc0 drivers/tty/serial/8250/8250_core.c:413 locks held by khungtaskd/31: 1, last CPU#1: #0: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6837 locks held by kworker/1:1/44: 5, on CPU#1: #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90000b47c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000b47c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000b47c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90000b47c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888029e701d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff888029e701d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5912 #3: ffff88807dbd71d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88807dbd71d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88807b3901a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88807b3901a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 locks held by kworker/u8:3/50: 2, last CPU#0: #0: ffff888031efc940 ((wq_completion)bat_events){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888031efc940 ((wq_completion)bat_events){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888031efc940 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888031efc940 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90000bb7c40 ((work_completion)(&(&bat_priv->dat.work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000bb7c40 ((work_completion)(&(&bat_priv->dat.work)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000bb7c40 ((work_completion)(&(&bat_priv->dat.work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90000bb7c40 ((work_completion)(&(&bat_priv->dat.work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 locks held by kworker/1:2/922: 5, on CPU#1: #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90004bcfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90004bcfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90004bcfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90004bcfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888029e0a1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff888029e0a1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5912 #3: ffff8880312871d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff8880312871d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff888032aae1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff888032aae1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 locks held by getty/5372: 2, on CPU#0: #0: ffff8880345fb0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211 locks held by kworker/1:3/5733: 5, on CPU#1: #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900035bfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900035bfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900035bfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900035bfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888029ced1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff888029ced1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5912 #3: ffff8880725bc1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff8880725bc1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88802bb381a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88802bb381a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 locks held by kworker/0:4/5773: 5, on CPU#0: #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000332fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000332fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000332fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000332fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888029f2d1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff888029f2d1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5912 #3: ffff88802b72d1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88802b72d1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88802bbce1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88802bbce1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 locks held by kworker/1:4/5835: 5, on CPU#1: #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000344fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000344fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000344fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000344fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888029e971d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff888029e971d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5912 #3: ffff8880741001d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff8880741001d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff8880596641a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff8880596641a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 locks held by syz.0.17/5840: 1, on CPU#1: #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.1.18/5886: 1, on CPU#0: #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.2.19/5923: 1, on CPU#0: #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by kworker/0:6/5952: 5, on CPU#0: #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000342fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000342fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000342fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000342fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888029fa31d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff888029fa31d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5912 #3: ffff888025d031d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff888025d031d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88807b47f1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88807b47f1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 locks held by syz.3.20/5963: 1, on CPU#1: #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.4.21/6013: 1, on CPU#1: #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.5.22/6057: 1, on CPU#0: #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by kworker/1:8/6060: 5, on CPU#1: #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000388fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000388fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000388fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000388fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888029fd21d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff888029fd21d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5912 #3: ffff88802b9a21d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88802b9a21d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff8880299181a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff8880299181a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 locks held by syz.6.23/6103: 1, on CPU#0: #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.7.24/6149: 1, on CPU#0: #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.8.25/6199: 1, on CPU#1: #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123 nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xfd7/0x1030 kernel/hung_task.c:561 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 50 Comm: kworker/u8:3 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: bat_events batadv_dat_purge RIP: 0010:__lock_acquire+0x6ff/0x2e50 kernel/locking/lockdep.c:5224 Code: ba 08 00 00 00 e8 81 47 00 00 31 ed 85 c0 0f 84 93 0d 00 00 83 3d d0 a0 fa 18 00 75 13 48 63 44 24 10 48 0f a3 05 e1 10 f7 12 <0f> 83 45 1f 00 00 48 8b 3c 24 48 8b 9f 98 0b 00 00 48 83 7c 24 18 RSP: 0018:ffffc900000076d8 EFLAGS: 00000047 RAX: 0000000000000007 RBX: ffff88801b742b88 RCX: ffffffff943b3a48 RDX: 0000000000000008 RSI: ffff88801b742b68 RDI: ffff88801b741f40 RBP: 0000000000000000 R08: e600000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: ffffffff8ed5c6e0 R12: 0000000000000003 R13: 0000000000000000 R14: ffff88801b742b68 R15: 0000000000000003 FS: 0000000000000000(0000) GS:ffff888124cd8000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555f061dba38 CR3: 0000000070986000 CR4: 00000000003526f0 Call Trace: lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5908 rcu_lock_acquire include/linux/rcupdate.h:309 [inline] rcu_read_lock include/linux/rcupdate.h:849 [inline] class_rcu_constructor include/linux/rcupdate.h:1216 [inline] unwind_next_frame+0xac/0x2550 arch/x86/kernel/unwind_orc.c:495 arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2748 [inline] __rcu_free_sheaf_prepare+0x12d/0x2a0 mm/slub.c:3009 rcu_free_sheaf+0x31/0x200 mm/slub.c:6052 rcu_do_batch kernel/rcu/tree.c:2650 [inline] rcu_core+0x926/0x1260 kernel/rcu/tree.c:2919 handle_softirqs+0x226/0x860 kernel/softirq.c:645 do_softirq+0x77/0xd0 kernel/softirq.c:546 __local_bh_enable_ip+0x100/0x140 kernel/softirq.c:473 spin_unlock_bh include/linux/spinlock.h:407 [inline] __batadv_dat_purge net/batman-adv/distributed-arp-table.c:252 [inline] batadv_dat_purge+0x2d7/0x3c0 net/batman-adv/distributed-arp-table.c:271 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 final repro crashed as (corrupted=false): INFO: task kworker/0:1:10 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kwor task:kworker/0:1 state:D stack:24384 pid:10 tgid:10 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5520 [inline] __schedule+0x17db/0x58f0 kernel/sched/core.c:7270 __schedule_loop kernel/sched/core.c:7347 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7362 schedule_timeout+0xc0/0x2c0 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common kernel/sched/completion.c:121 [inline] wait_for_common kernel/sched/completion.c:132 [inline] wait_for_completion+0x2ca/0x5e0 kernel/sched/completion.c:153 pn533_acr122_poweron_rdr drivers/nfc/pn533/usb.c:419 [inline] pn533_usb_probe+0xbc9/0x10e0 drivers/nfc/pn533/usb.c:544 usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2708 hub_port_connect drivers/usb/core/hub.c:5580 [inline] hub_port_connect_change drivers/usb/core/hub.c:5720 [inline] port_event drivers/usb/core/hub.c:5884 [inline] hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5966 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task syz.0.17:5840 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.17 state:D stack:27400 pid:5840 tgid:5840 ppid:5751 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5520 [inline] __schedule+0x17db/0x58f0 kernel/sched/core.c:7270 __schedule_loop kernel/sched/core.c:7347 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7362 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7419 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c1/0x1550 kernel/locking/mutex.c:821 device_lock include/linux/device.h:1104 [inline] usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 chrdev_open+0x4d9/0x600 fs/char_dev.c:411 do_dentry_open+0x816/0x1380 fs/open.c:996 vfs_open+0x3b/0x340 fs/open.c:1101 do_open fs/namei.c:4837 [inline] path_openat+0x1443/0x1d60 fs/namei.c:5000 do_file_open+0x23e/0x4a0 fs/namei.c:5029 do_sys_openat2+0x115/0x200 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1434 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc13fb5e98e RSP: 002b:00007ffc257b8338 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 000055555f482500 RCX: 00007fc13fb5e98e RDX: 000000000000a001 RSI: 00007ffc257b8410 RDI: ffffffffffffff9c RBP: 00007ffc257b8410 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd R13: 00007fc13fe25fac R14: 00007fc13fe25fa0 R15: 00007fc13fe25fa0 Showing all locks held in the system: locks held by kworker/0:0/9: 5, on CPU#0: #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888029d141d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff888029d141d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5912 #3: ffff88807e81d1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88807e81d1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff888028d221a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff888028d221a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 locks held by kworker/0:1/10: 5, on CPU#0: #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5912 #3: ffff8880341491d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff8880341491d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88807f52f1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88807f52f1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 locks held by pr/ttyS0/16: 2, last CPU#0: #0: ffffffff8ec362b8 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:314 [inline] #0: ffffffff8ec362b8 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:439 [inline] #0: ffffffff8ec362b8 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x30/0x60 kernel/printk/printk.c:291 #1: ffffffff9ad33098 (&port_lock_key){-.-.}-{3:3}, at: __uart_port_lock_irqsave include/linux/serial_core.h:613 [inline] #1: ffffffff9ad33098 (&port_lock_key){-.-.}-{3:3}, at: univ8250_console_device_lock+0x67/0xc0 drivers/tty/serial/8250/8250_core.c:413 locks held by khungtaskd/31: 1, last CPU#1: #0: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6837 locks held by kworker/1:1/44: 5, on CPU#1: #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90000b47c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000b47c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000b47c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90000b47c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888029e701d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff888029e701d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5912 #3: ffff88807dbd71d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88807dbd71d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88807b3901a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88807b3901a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 locks held by kworker/u8:3/50: 2, last CPU#0: #0: ffff888031efc940 ((wq_completion)bat_events){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888031efc940 ((wq_completion)bat_events){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888031efc940 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888031efc940 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90000bb7c40 ((work_completion)(&(&bat_priv->dat.work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000bb7c40 ((work_completion)(&(&bat_priv->dat.work)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000bb7c40 ((work_completion)(&(&bat_priv->dat.work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90000bb7c40 ((work_completion)(&(&bat_priv->dat.work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 locks held by kworker/1:2/922: 5, on CPU#1: #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90004bcfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90004bcfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90004bcfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90004bcfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888029e0a1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff888029e0a1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5912 #3: ffff8880312871d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff8880312871d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff888032aae1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff888032aae1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 locks held by getty/5372: 2, on CPU#0: #0: ffff8880345fb0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211 locks held by kworker/1:3/5733: 5, on CPU#1: #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900035bfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900035bfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900035bfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900035bfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888029ced1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff888029ced1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5912 #3: ffff8880725bc1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff8880725bc1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88802bb381a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88802bb381a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 locks held by kworker/0:4/5773: 5, on CPU#0: #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000332fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000332fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000332fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000332fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888029f2d1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff888029f2d1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5912 #3: ffff88802b72d1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88802b72d1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88802bbce1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88802bbce1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 locks held by kworker/1:4/5835: 5, on CPU#1: #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000344fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000344fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000344fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000344fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888029e971d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff888029e971d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5912 #3: ffff8880741001d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff8880741001d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff8880596641a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff8880596641a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 locks held by syz.0.17/5840: 1, on CPU#1: #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.1.18/5886: 1, on CPU#0: #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.2.19/5923: 1, on CPU#0: #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by kworker/0:6/5952: 5, on CPU#0: #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000342fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000342fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000342fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000342fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888029fa31d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff888029fa31d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5912 #3: ffff888025d031d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff888025d031d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88807b47f1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88807b47f1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 locks held by syz.3.20/5963: 1, on CPU#1: #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.4.21/6013: 1, on CPU#1: #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.5.22/6057: 1, on CPU#0: #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by kworker/1:8/6060: 5, on CPU#1: #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801eeee140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000388fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000388fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000388fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000388fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888029fd21d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff888029fd21d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5912 #3: ffff88802b9a21d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88802b9a21d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff8880299181a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff8880299181a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 locks held by syz.6.23/6103: 1, on CPU#0: #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.7.24/6149: 1, on CPU#0: #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.8.25/6199: 1, on CPU#1: #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff888029c381d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123 nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xfd7/0x1030 kernel/hung_task.c:561 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 50 Comm: kworker/u8:3 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: bat_events batadv_dat_purge RIP: 0010:__lock_acquire+0x6ff/0x2e50 kernel/locking/lockdep.c:5224 Code: ba 08 00 00 00 e8 81 47 00 00 31 ed 85 c0 0f 84 93 0d 00 00 83 3d d0 a0 fa 18 00 75 13 48 63 44 24 10 48 0f a3 05 e1 10 f7 12 <0f> 83 45 1f 00 00 48 8b 3c 24 48 8b 9f 98 0b 00 00 48 83 7c 24 18 RSP: 0018:ffffc900000076d8 EFLAGS: 00000047 RAX: 0000000000000007 RBX: ffff88801b742b88 RCX: ffffffff943b3a48 RDX: 0000000000000008 RSI: ffff88801b742b68 RDI: ffff88801b741f40 RBP: 0000000000000000 R08: e600000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: ffffffff8ed5c6e0 R12: 0000000000000003 R13: 0000000000000000 R14: ffff88801b742b68 R15: 0000000000000003 FS: 0000000000000000(0000) GS:ffff888124cd8000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555f061dba38 CR3: 0000000070986000 CR4: 00000000003526f0 Call Trace: lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5908 rcu_lock_acquire include/linux/rcupdate.h:309 [inline] rcu_read_lock include/linux/rcupdate.h:849 [inline] class_rcu_constructor include/linux/rcupdate.h:1216 [inline] unwind_next_frame+0xac/0x2550 arch/x86/kernel/unwind_orc.c:495 arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2748 [inline] __rcu_free_sheaf_prepare+0x12d/0x2a0 mm/slub.c:3009 rcu_free_sheaf+0x31/0x200 mm/slub.c:6052 rcu_do_batch kernel/rcu/tree.c:2650 [inline] rcu_core+0x926/0x1260 kernel/rcu/tree.c:2919 handle_softirqs+0x226/0x860 kernel/softirq.c:645 do_softirq+0x77/0xd0 kernel/softirq.c:546 __local_bh_enable_ip+0x100/0x140 kernel/softirq.c:473 spin_unlock_bh include/linux/spinlock.h:407 [inline] __batadv_dat_purge net/batman-adv/distributed-arp-table.c:252 [inline] batadv_dat_purge+0x2d7/0x3c0 net/batman-adv/distributed-arp-table.c:271 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245