Extracting prog: 1m20.892988593s Minimizing prog: 12m15.802805123s Simplifying prog options: 0s Extracting C: 58.867473004s Simplifying C: 5m26.117965842s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io$printer-syz_open_dev$I2C-writev detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) writev(r1, &(0x7f0000002900)=[{&(0x7f0000000100)="ec", 0x1}], 0x1) program crashed: WARNING in dtv5100_i2c_msg/usb_submit_urb single: successfully extracted reproducer found reproducer with 5 syscalls minimizing guilty program testing program (duration=49.349962576s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io$printer-syz_open_dev$I2C detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) program did not crash testing program (duration=49.349962576s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io$printer-writev detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000002900)=[{&(0x7f0000000100)="ec", 0x1}], 0x1) program did not crash testing program (duration=49.349962576s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_open_dev$I2C-writev detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) writev(r1, &(0x7f0000002900)=[{&(0x7f0000000100)="ec", 0x1}], 0x1) program did not crash testing program (duration=49.349962576s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$printer-syz_open_dev$I2C-writev detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) writev(r1, &(0x7f0000002900)=[{&(0x7f0000000100)="ec", 0x1}], 0x1) program did not crash testing program (duration=49.349962576s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_control_io$uac1-syz_usb_control_io$printer-syz_open_dev$I2C-writev detailed listing: executing program 0: syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) writev(r0, &(0x7f0000002900)=[{&(0x7f0000000100)="ec", 0x1}], 0x1) program did not crash testing program (duration=49.349962576s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io$printer-syz_open_dev$I2C-writev detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x3c, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) writev(r1, &(0x7f0000002900)=[{&(0x7f0000000100)="ec", 0x1}], 0x1) program did not crash testing program (duration=49.349962576s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io$printer-syz_open_dev$I2C-writev detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) writev(r1, &(0x7f0000002900)=[{&(0x7f0000000100)="ec", 0x1}], 0x1) program did not crash testing program (duration=49.349962576s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io$printer-syz_open_dev$I2C-writev detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(0x0, 0x1, 0x402) writev(r1, &(0x7f0000002900)=[{&(0x7f0000000100)="ec", 0x1}], 0x1) program did not crash testing program (duration=49.349962576s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io$printer-syz_open_dev$I2C-writev detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) writev(r1, 0x0, 0x0) program did not crash testing program (duration=49.349962576s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io$printer-syz_open_dev$I2C-writev detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) writev(r1, &(0x7f0000002900)=[{0x0}], 0x1) program did not crash testing program (duration=49.349962576s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io$printer-syz_open_dev$I2C-writev detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) writev(r1, &(0x7f0000002900)=[{&(0x7f0000000100)}], 0x1) program did not crash extracting C reproducer testing compiled C program (duration=49.349962576s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io$printer-syz_open_dev$I2C-writev program crashed: WARNING in dtv5100_i2c_msg/usb_submit_urb simplifying C reproducer testing compiled C program (duration=49.349962576s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io$printer-syz_open_dev$I2C-writev program crashed: WARNING in dtv5100_i2c_msg/usb_submit_urb testing compiled C program (duration=49.349962576s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io$printer-syz_open_dev$I2C-writev program crashed: WARNING in dtv5100_i2c_msg/usb_submit_urb testing compiled C program (duration=49.349962576s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io$printer-syz_open_dev$I2C-writev program crashed: WARNING in dtv5100_i2c_msg/usb_submit_urb testing compiled C program (duration=49.349962576s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io$printer-syz_open_dev$I2C-writev program crashed: WARNING in dtv5100_i2c_msg/usb_submit_urb testing compiled C program (duration=49.349962576s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io$printer-syz_open_dev$I2C-writev program crashed: WARNING in dtv5100_i2c_msg/usb_submit_urb testing compiled C program (duration=49.349962576s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io$printer-syz_open_dev$I2C-writev program crashed: WARNING in dtv5100_i2c_msg/usb_submit_urb testing compiled C program (duration=49.349962576s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io$printer-syz_open_dev$I2C-writev program crashed: WARNING in dtv5100_i2c_msg/usb_submit_urb testing program (duration=49.349962576s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io$printer-syz_open_dev$I2C-writev detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) writev(r1, &(0x7f0000002900)=[{&(0x7f0000000100)="ec", 0x1}], 0x1) program crashed: WARNING in dtv5100_i2c_msg/usb_submit_urb validation run: crashed=true testing program (duration=49.349962576s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io$printer-syz_open_dev$I2C-writev detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) writev(r1, &(0x7f0000002900)=[{&(0x7f0000000100)="ec", 0x1}], 0x1) program crashed: WARNING in dtv5100_i2c_msg/usb_submit_urb validation run: crashed=true testing program (duration=49.349962576s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io$printer-syz_open_dev$I2C-writev detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) writev(r1, &(0x7f0000002900)=[{&(0x7f0000000100)="ec", 0x1}], 0x1) program crashed: WARNING in dtv5100_i2c_msg/usb_submit_urb validation run: crashed=true reproducing took 22m47.209728835s repro crashed as (corrupted=false): ------------[ cut here ]------------ usb 1-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0 WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1198/0x1458 drivers/usb/core/urb.c:411, CPU#1: syz.0.17/4919 Modules linked in: CPU: 1 UID: 0 PID: 4919 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026 pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : usb_submit_urb+0x1198/0x1458 drivers/usb/core/urb.c:411 lr : usb_submit_urb+0x1198/0x1458 drivers/usb/core/urb.c:411 sp : ffff8000974c74f0 x29: ffff8000974c7520 x28: dfff800000000000 x27: 0000000080000280 x26: 0000000000000000 x25: ffff0000d0c6f058 x24: ffff0000c1fa62a0 x23: ffff0000d122b1e0 x22: ffff80008721cba0 x21: ffff0000d0c6f000 x20: 0000000000000c00 x19: ffff0000dd216300 x18: 00000000ffffffff x17: ffff80008a74f000 x16: 0000000000000003 x15: ffff800080c9d80c x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000002 x9 : f3dfa91961b99500 x8 : f3dfa91961b99500 x7 : ffff80008048ce60 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f7010 x2 : 0000000100000000 x1 : ffff0000cd9e0000 x0 : 0000000000000000 Call trace: usb_submit_urb+0x1198/0x1458 drivers/usb/core/urb.c:411 (P) usb_start_wait_urb+0x104/0x478 drivers/usb/core/message.c:62 usb_internal_control_msg drivers/usb/core/message.c:117 [inline] usb_control_msg+0x1e8/0x378 drivers/usb/core/message.c:167 dtv5100_i2c_msg+0x1fc/0x2b8 drivers/media/usb/dvb-usb/dtv5100.c:65 dtv5100_i2c_xfer+0x17c/0x350 drivers/media/usb/dvb-usb/dtv5100.c:91 __i2c_transfer+0x610/0x1c6c drivers/i2c/i2c-core-base.c:-1 i2c_transfer+0x1cc/0x2e0 drivers/i2c/i2c-core-base.c:2343 i2c_transfer_buffer_flags+0xec/0x18c drivers/i2c/i2c-core-base.c:2371 i2c_master_send include/linux/i2c.h:109 [inline] i2cdev_write+0x114/0x1d8 drivers/i2c/i2c-dev.c:183 do_loop_readv_writev+0x24c/0x3dc fs/read_write.c:-1 vfs_writev+0x2c8/0x630 fs/read_write.c:1060 do_writev+0x134/0x2a8 fs/read_write.c:1104 __do_sys_writev fs/read_write.c:1172 [inline] __se_sys_writev fs/read_write.c:1169 [inline] __arm64_sys_writev+0x80/0x94 fs/read_write.c:1169 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594 irq event stamp: 2412 hardirqs last enabled at (2411): [] vprintk_store+0x924/0xb94 kernel/printk/printk.c:2385 hardirqs last disabled at (2412): [] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:425 softirqs last enabled at (2374): [] softirq_handle_end kernel/softirq.c:468 [inline] softirqs last enabled at (2374): [] handle_softirqs+0xc28/0xd98 kernel/softirq.c:650 softirqs last disabled at (2365): [] __do_softirq+0x14/0x20 kernel/softirq.c:656 ---[ end trace 0000000000000000 ]--- final repro crashed as (corrupted=false): ------------[ cut here ]------------ usb 1-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0 WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1198/0x1458 drivers/usb/core/urb.c:411, CPU#1: syz.0.17/4919 Modules linked in: CPU: 1 UID: 0 PID: 4919 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026 pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : usb_submit_urb+0x1198/0x1458 drivers/usb/core/urb.c:411 lr : usb_submit_urb+0x1198/0x1458 drivers/usb/core/urb.c:411 sp : ffff8000974c74f0 x29: ffff8000974c7520 x28: dfff800000000000 x27: 0000000080000280 x26: 0000000000000000 x25: ffff0000d0c6f058 x24: ffff0000c1fa62a0 x23: ffff0000d122b1e0 x22: ffff80008721cba0 x21: ffff0000d0c6f000 x20: 0000000000000c00 x19: ffff0000dd216300 x18: 00000000ffffffff x17: ffff80008a74f000 x16: 0000000000000003 x15: ffff800080c9d80c x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000002 x9 : f3dfa91961b99500 x8 : f3dfa91961b99500 x7 : ffff80008048ce60 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f7010 x2 : 0000000100000000 x1 : ffff0000cd9e0000 x0 : 0000000000000000 Call trace: usb_submit_urb+0x1198/0x1458 drivers/usb/core/urb.c:411 (P) usb_start_wait_urb+0x104/0x478 drivers/usb/core/message.c:62 usb_internal_control_msg drivers/usb/core/message.c:117 [inline] usb_control_msg+0x1e8/0x378 drivers/usb/core/message.c:167 dtv5100_i2c_msg+0x1fc/0x2b8 drivers/media/usb/dvb-usb/dtv5100.c:65 dtv5100_i2c_xfer+0x17c/0x350 drivers/media/usb/dvb-usb/dtv5100.c:91 __i2c_transfer+0x610/0x1c6c drivers/i2c/i2c-core-base.c:-1 i2c_transfer+0x1cc/0x2e0 drivers/i2c/i2c-core-base.c:2343 i2c_transfer_buffer_flags+0xec/0x18c drivers/i2c/i2c-core-base.c:2371 i2c_master_send include/linux/i2c.h:109 [inline] i2cdev_write+0x114/0x1d8 drivers/i2c/i2c-dev.c:183 do_loop_readv_writev+0x24c/0x3dc fs/read_write.c:-1 vfs_writev+0x2c8/0x630 fs/read_write.c:1060 do_writev+0x134/0x2a8 fs/read_write.c:1104 __do_sys_writev fs/read_write.c:1172 [inline] __se_sys_writev fs/read_write.c:1169 [inline] __arm64_sys_writev+0x80/0x94 fs/read_write.c:1169 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594 irq event stamp: 2412 hardirqs last enabled at (2411): [] vprintk_store+0x924/0xb94 kernel/printk/printk.c:2385 hardirqs last disabled at (2412): [] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:425 softirqs last enabled at (2374): [] softirq_handle_end kernel/softirq.c:468 [inline] softirqs last enabled at (2374): [] handle_softirqs+0xc28/0xd98 kernel/softirq.c:650 softirqs last disabled at (2365): [] __do_softirq+0x14/0x20 kernel/softirq.c:656 ---[ end trace 0000000000000000 ]---