Extracting prog: 2m49.457354616s Minimizing prog: 19m55.720667114s Simplifying prog options: 0s Extracting C: 58.55120122s Simplifying C: 5m41.392574542s extracting reproducer from 79 programs testing a last program of every proc single: executing 29 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$MAP_CREATE-prlimit64-sched_setscheduler-prlimit64-getpid-sched_setaffinity-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL-bpf$BPF_RAW_TRACEPOINT_OPEN-prctl$PR_SET_SECCOMP-bpf$PROG_LOAD_XDP-bpf$MAP_CREATE-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000500000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) prlimit64(0x0, 0xe, 0x0, 0x0) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f0000000480), 0x400034f, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000000040000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x1, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r5}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x20, r7, 0x9c3fa077fa966179, 0xfffffffd, 0x0, {{0x7e}, {@void, @val={0xc, 0x99, {0x916d, 0x17}}}}}, 0x20}, 0x1, 0x3d04}, 0x4000054) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00'}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x40, 0x7ffc1ffb}]}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000005700000095"], 0x0}, 0x90) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="17000000000000000400000003"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r8], 0x0}, 0x90) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r9}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) r10 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r10}, 0x18) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-madvise-bpf$MAP_CREATE-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-madvise-syz_usb_connect$uac1 detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000200)={{0x12, 0x1, 0x0, 0xcf, 0xf8, 0xa3, 0x40, 0x4e6, 0x6, 0x100, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xe, 0x0, 0x0, 0xf4, 0xde, 0x1}}]}}]}}, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="16000000000000000400000005"], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='block_plug\x00', r2}, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='block_plug\x00', r3}, 0x10) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) syz_usb_connect$uac1(0x6, 0xd4, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xc2, 0x3, 0x1, 0x0, 0x90, 0x3, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x7, 0x2}, [@extension_unit={0xc, 0x24, 0x8, 0x3, 0x7, 0x80, "db6664eca2"}, @mixer_unit={0x7, 0x24, 0x4, 0x5, 0x0, '\b\"'}, @extension_unit={0xa, 0x24, 0x8, 0x1, 0x6, 0x5, "28f7b1"}, @selector_unit={0xb, 0x24, 0x5, 0x1, 0x2, "62f83c2f1b32"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0xd, 0x24, 0x2, 0x1, 0x7, 0x3, 0x9, 0x5, "41412bd2bf"}, @format_type_i_continuous={0xc, 0x24, 0x2, 0x1, 0x2b, 0x2, 0x8, 0x7, "0e", "853a1c"}, @as_header={0x7, 0x24, 0x1, 0x8, 0xff, 0x5}, @format_type_ii_discrete={0xa, 0x24, 0x2, 0x2, 0x2, 0x6, 0xd, "bf"}, @as_header={0x7, 0x24, 0x1, 0x4, 0xb5, 0x5}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x7, 0x2, 0x1, 0x7, 'O', "d3"}]}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0xdd, 0x5, 0x3, {0x7, 0x25, 0x1, 0x0, 0x7, 0x6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x2, 0x3, 0xe, {0x7, 0x25, 0x1, 0x80, 0x8, 0xc2}}}}}}}]}}, &(0x7f0000000600)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x300, 0x0, 0x9, 0x9, 0x20, 0x1}, 0x14a, &(0x7f0000000240)={0x5, 0xf, 0x14a, 0x5, [@ext_cap={0x7, 0x10, 0x2, 0x14, 0x1, 0x8, 0x4}, @generic={0x5d, 0x10, 0xb, "d55dccaf089bb9e60535231b697cfa250f2259bfc50cf24f0da588b8b1feb349d9fa2c4fcbaec2be6bf3cd01e0b34f02a49170223e725d5d2cd357b36248e4347472208c9a89e297377608e0300c7afde49e10292fdf5083efc2"}, @ss_container_id={0x14, 0x10, 0x4, 0xdd, "8058e1c63b2e78855f6924ffcd909155"}, @generic={0xb9, 0x10, 0x4, "8158a643b82d2a50133d72af421841ebeced47daab7519b3f818ec3711332eeb1a3672d2454ac76526b5ebcdeb6ecba7c0c90759a9e8af0f1d4519b9379ce8cf2ce62d774a441daf3c1a1d859ec209b9a015a5281a8f8b84052961d9aec27c20c489e3ad5e1b317ff8c8eb8285516cb54d24e5b358147d8bc9f6c4096ac4c2d095ac777c6dc8e60d7b8e8a4c03d93c068f4e8bb0c1e58d43859096b4a2aa21ca88075f89daf7ddb505b040ce736b5251ec0c3cbaff8c"}, @ss_container_id={0x14, 0x10, 0x4, 0xb, "4694e190c0526d669e6dff297350c215"}]}, 0x8, [{0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x40b}}, {0xc, &(0x7f0000000180)=@string={0xc, 0x3, "967850a71c6328525cc0"}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x812}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x443}}, {0x15, &(0x7f0000000400)=@string={0x15, 0x3, "d484c03793c1a807782257ac4285cb1bdb781a"}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0xf4ff}}, {0x5d, &(0x7f0000000480)=@string={0x5d, 0x3, "c6b149b0935cdda4a9d46f1a00ca947753a9c21bd996b4c0e28e63d88a95cca2449dbda9b46a3b8386979e1344c7816e6ad416eab3254f3fe4061a89ee1e3c1d31b09dc9c78054b3f6ac1bc0407a5e809eb800623ca7c090d7becf"}}, {0xe3, &(0x7f0000000500)=@string={0xe3, 0x3, "ff42651e605ce332ea93ff72703132efabc545c34800cdc0ae8cb9f76f24102f0d9f2f19285ce618961a8ab3eafecfcab02310b8d17759d08e49c8d2cf028e1899041a6b85e9563b2b0976cfea8948146570a150cef18d3709421d8b9dc3142849d55bf80bf0b06fc8b29873a458cdf9cd82539f49f2f330909e60ca7523ed5e4e10b911a61683901fc12357923b189e4f5e49c851c2174710abab09937aeab5e22847afcfce48921c618560f3e95ceffb5de9c0b9738de91fa6b80e2b2afa73c8d6998507ad0277e22bae0f003cf54dfa2563f9d82cf09aedab976ba3d51d09b4"}}]}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-socketpair$nbd-openat$rfkill-writev-ioctl$SIOCSIFHWADDR-syz_open_dev$usbmon-mmap-syz_io_uring_setup-syz_clone-syz_usb_connect$uac1 detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r2}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0}, &(0x7f0000000080), &(0x7f0000000280)=r1}, 0x20) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096010006010083000000002a90a02710000000b3813e25031bdde840"], 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r2}, 0x18) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x602, 0x0) writev(r5, &(0x7f0000000440)=[{&(0x7f0000000040)="93d90400000300", 0x7}, {&(0x7f0000000380)="0000ed13a08a54", 0x7}], 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8924, &(0x7f0000000000)={'bridge_slave_0\x00', @random="010000201000"}) r6 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x12, r6, 0xc3d33000) syz_io_uring_setup(0x690e, &(0x7f0000000c40)={0x0, 0x1c05, 0x0, 0x0, 0x315}, &(0x7f0000000cc0), &(0x7f0000000d00)) syz_clone(0xa0001000, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$uac1(0x5, 0xc1, &(0x7f0000000340)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0xff, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xaf, 0x3, 0x1, 0x30, 0x80, 0x81, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x1000}, [@input_terminal={0xc, 0x24, 0x2, 0x3, 0x200, 0x5, 0xac, 0x1, 0x4, 0x4}, @mixer_unit={0xa, 0x24, 0x4, 0x2, 0x0, "cc18c7a619"}, @processing_unit={0x9, 0x24, 0x7, 0x2, 0x2, 0x5, "8563"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x7be, 0xd, 0x0, 0x4, {0x7, 0x25, 0x1, 0x1, 0x9, 0x2}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0xb, 0x24, 0x2, 0x2, 0xfada, 0xf, 0x58, "accd"}, @format_type_i_continuous={0x9, 0x24, 0x2, 0x1, 0x1, 0x3, 0x80, 0x3, "aa"}, @format_type_ii_discrete={0x10, 0x24, 0x2, 0x2, 0xffff, 0x8001, 0x5, "b84afc57bfc1b2"}, @format_type_i_continuous={0xd, 0x24, 0x2, 0x1, 0x0, 0x3, 0x0, 0xb, "0e38", "c51c9c"}]}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x3, 0x8, 0x2, {0x7, 0x25, 0x1, 0x3, 0x9, 0x1}}}}}}}]}}, &(0x7f0000000b80)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x300, 0x2, 0x9, 0x8, 0xff, 0x8}, 0x60, &(0x7f00000005c0)={0x5, 0xf, 0x60, 0x6, [@ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0xe, 0x3, 0x40, 0x2}, @wireless={0xb, 0x10, 0x1, 0x2, 0xa4, 0xfb, 0x4, 0xfeff, 0x1}, @ext_cap={0x7, 0x10, 0x2, 0x4, 0x7, 0x9, 0xff}, @ssp_cap={0x18, 0x10, 0xa, 0x8, 0x3, 0x3, 0xf000, 0x0, [0xc000, 0xff00c0, 0xffc0ff]}, @ssp_cap={0x24, 0x10, 0xa, 0x1, 0x6, 0x37, 0xf000, 0x26b5, [0xff0000, 0x0, 0xff000f, 0xa340b374e3e3d64d, 0xff0000, 0xff0030]}]}, 0xa, [{0x58, &(0x7f0000000640)=@string={0x58, 0x3, "846cffd15ac8f053c93c2dcf53de1b2c566ebcdae6fc80c04fcb95a6cbc310e4fec7f6d5d5574e3c3cfed365c43b1ced2b1a83c600a9302a71ada054361dcb7bd6d10e94aa9ad9e1c32ffea84a3dde4cb9d0f81a9949"}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x427}}, {0x4, &(0x7f0000000780)=@lang_id={0x4, 0x3, 0x94754b6b0da73445}}, {0x4, &(0x7f00000007c0)=@string={0x4, 0x3, "9061"}}, {0xac, &(0x7f0000000800)=@string={0xac, 0x3, "640a235f9865c386e49a4ef43b4ecf378a1728843f7d8fa7d109dc460854f8159d4339d2c41669ae94633b1fb835017ab1dc6e59842990313be3df38aa5eeb6044d27578080f05872a342742b51d35772435e467a7ea37ec7fc0e251f16a6d3fe8589cf614a58a15a704606ea51f26d99dc1c602635382b0a3b8acce0fd6cb7e0faa165c40c303cb7f105ceb22a6dcad703bb84e17cb89c0f07d732228e32536c2dcda61ac1da32b8192"}}, {0x4, &(0x7f00000008c0)=@lang_id={0x4, 0x3, 0x41b}}, {0x4, &(0x7f0000000900)=@lang_id={0x4, 0x3, 0x401}}, {0x102, &(0x7f0000000a00)=@string={0x102, 0x3, "faa0c09988074440cfed10255b2a3997dbe9a2ce632860eef722da89883280bba1a03f51af080ff438eb844ddaa3debc1df9c39a81b459f03982fd3a61c567d612250439a0c5534865b7b7237536f169cd4e28ac9ac38e939ee1e5a2071f2fab66c0161a813994d06f73d0e37d8c384d98caa0f00451f2ee3991ad7bfd0460c3790497914bc65e1be76af6ac19408e41123eeb5ba169c74cf44e07317894a6a7933085a4328d4ce70e41f8fdaf8be9aefddb3d1ac64371c61e73a19eff0e2f4bbb345382da8872585756da38fb91b134c24bdb6c3747bad98c95c1f1781955a32eaad7259e3375fa45bb6695c304441cb0e67c7931eb987cfaede85a1ab8efe6"}}, {0x75, &(0x7f0000000940)=@string={0x75, 0x3, "465406b2cc23ef1bb89fcbe24d8f7d0eecf0f665d8dc14d93bfc77930884b2892ad4fe57a6d492458bc1e2822aefe0bae047946137bdde15cbf7a7f94ac917799ce0af5ff55de337e186b6a1a8ccd0fcb1aa51105b8c8c7ac4732e67a1b4ece7b6b0baad21a8e54c374aa05806144c374db46a"}}, {0x3c, &(0x7f0000000b40)=@string={0x3c, 0x3, "576dfb7d9673eb2ee39dacbf32ac47c5732caaa71b95269fb33101d5eebe1589a9a24fe21d88dec0ac8c26e459128e1512e29ae3e200bd2e49b5"}}]}) program crashed: KASAN: slab-out-of-bounds Read in mon_bin_event single: successfully extracted reproducer found reproducer with 19 syscalls minimizing guilty program testing program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-socketpair$nbd-openat$rfkill-writev-ioctl$SIOCSIFHWADDR-syz_open_dev$usbmon-mmap-syz_io_uring_setup-syz_clone detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r2}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0}, &(0x7f0000000080), &(0x7f0000000280)=r1}, 0x20) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096010006010083000000002a90a02710000000b3813e25031bdde840"], 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r2}, 0x18) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x602, 0x0) writev(r5, &(0x7f0000000440)=[{&(0x7f0000000040)="93d90400000300", 0x7}, {&(0x7f0000000380)="0000ed13a08a54", 0x7}], 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8924, &(0x7f0000000000)={'bridge_slave_0\x00', @random="010000201000"}) r6 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x12, r6, 0xc3d33000) syz_io_uring_setup(0x690e, &(0x7f0000000c40)={0x0, 0x1c05, 0x0, 0x0, 0x315}, &(0x7f0000000cc0), &(0x7f0000000d00)) syz_clone(0xa0001000, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0) program crashed: KASAN: slab-out-of-bounds Read in mon_bin_event testing program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-socketpair$nbd-openat$rfkill-writev-ioctl$SIOCSIFHWADDR-syz_open_dev$usbmon-mmap-syz_io_uring_setup detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r2}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0}, &(0x7f0000000080), &(0x7f0000000280)=r1}, 0x20) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096010006010083000000002a90a02710000000b3813e25031bdde840"], 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r2}, 0x18) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x602, 0x0) writev(r5, &(0x7f0000000440)=[{&(0x7f0000000040)="93d90400000300", 0x7}, {&(0x7f0000000380)="0000ed13a08a54", 0x7}], 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8924, &(0x7f0000000000)={'bridge_slave_0\x00', @random="010000201000"}) r6 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x12, r6, 0xc3d33000) syz_io_uring_setup(0x690e, &(0x7f0000000c40)={0x0, 0x1c05, 0x0, 0x0, 0x315}, &(0x7f0000000cc0), &(0x7f0000000d00)) program crashed: KASAN: slab-out-of-bounds Read in mon_bin_event testing program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-socketpair$nbd-openat$rfkill-writev-ioctl$SIOCSIFHWADDR-syz_open_dev$usbmon-mmap detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r2}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0}, &(0x7f0000000080), &(0x7f0000000280)=r1}, 0x20) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096010006010083000000002a90a02710000000b3813e25031bdde840"], 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r2}, 0x18) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x602, 0x0) writev(r5, &(0x7f0000000440)=[{&(0x7f0000000040)="93d90400000300", 0x7}, {&(0x7f0000000380)="0000ed13a08a54", 0x7}], 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8924, &(0x7f0000000000)={'bridge_slave_0\x00', @random="010000201000"}) r6 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x12, r6, 0xc3d33000) program crashed: KASAN: slab-out-of-bounds Read in mon_bin_event testing program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-socketpair$nbd-openat$rfkill-writev-ioctl$SIOCSIFHWADDR-syz_open_dev$usbmon detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r2}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0}, &(0x7f0000000080), &(0x7f0000000280)=r1}, 0x20) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096010006010083000000002a90a02710000000b3813e25031bdde840"], 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r2}, 0x18) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x602, 0x0) writev(r5, &(0x7f0000000440)=[{&(0x7f0000000040)="93d90400000300", 0x7}, {&(0x7f0000000380)="0000ed13a08a54", 0x7}], 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8924, &(0x7f0000000000)={'bridge_slave_0\x00', @random="010000201000"}) syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) program did not crash testing program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-socketpair$nbd-openat$rfkill-writev-ioctl$SIOCSIFHWADDR-mmap detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r2}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0}, &(0x7f0000000080), &(0x7f0000000280)=r1}, 0x20) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096010006010083000000002a90a02710000000b3813e25031bdde840"], 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r2}, 0x18) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x602, 0x0) writev(r5, &(0x7f0000000440)=[{&(0x7f0000000040)="93d90400000300", 0x7}, {&(0x7f0000000380)="0000ed13a08a54", 0x7}], 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8924, &(0x7f0000000000)={'bridge_slave_0\x00', @random="010000201000"}) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x12, 0xffffffffffffffff, 0xc3d33000) program did not crash testing program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-socketpair$nbd-openat$rfkill-writev-syz_open_dev$usbmon-mmap detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r2}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0}, &(0x7f0000000080), &(0x7f0000000280)=r1}, 0x20) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096010006010083000000002a90a02710000000b3813e25031bdde840"], 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r2}, 0x18) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) r4 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x602, 0x0) writev(r4, &(0x7f0000000440)=[{&(0x7f0000000040)="93d90400000300", 0x7}, {&(0x7f0000000380)="0000ed13a08a54", 0x7}], 0x2) r5 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x12, r5, 0xc3d33000) program crashed: KASAN: slab-out-of-bounds Read in mon_bin_event testing program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-socketpair$nbd-openat$rfkill-syz_open_dev$usbmon-mmap detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r2}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0}, &(0x7f0000000080), &(0x7f0000000280)=r1}, 0x20) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096010006010083000000002a90a02710000000b3813e25031bdde840"], 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r2}, 0x18) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x602, 0x0) r4 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x12, r4, 0xc3d33000) program crashed: KASAN: slab-out-of-bounds Read in mon_bin_event testing program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-socketpair$nbd-syz_open_dev$usbmon-mmap detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r2}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0}, &(0x7f0000000080), &(0x7f0000000280)=r1}, 0x20) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096010006010083000000002a90a02710000000b3813e25031bdde840"], 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r2}, 0x18) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) r4 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x12, r4, 0xc3d33000) program crashed: KASAN: slab-out-of-bounds Read in mon_bin_event testing program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_open_dev$usbmon-mmap detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r2}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0}, &(0x7f0000000080), &(0x7f0000000280)=r1}, 0x20) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096010006010083000000002a90a02710000000b3813e25031bdde840"], 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r2}, 0x18) r4 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x12, r4, 0xc3d33000) program crashed: KASAN: slab-out-of-bounds Read in mon_bin_event testing program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-bpf$PROG_LOAD-syz_open_dev$usbmon-mmap detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r2}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0}, &(0x7f0000000080), &(0x7f0000000280)=r1}, 0x20) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096010006010083000000002a90a02710000000b3813e25031bdde840"], 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x12, r4, 0xc3d33000) program crashed: KASAN: slab-out-of-bounds Read in mon_bin_event testing program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$usbmon-mmap detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r2}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0}, &(0x7f0000000080), &(0x7f0000000280)=r1}, 0x20) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096010006010083000000002a90a02710000000b3813e25031bdde840"], 0x0}, 0x0) r4 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x12, r4, 0xc3d33000) program crashed: KASAN: slab-out-of-bounds Read in mon_bin_event testing program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_usb_connect$hid-syz_usb_control_io$hid-syz_open_dev$usbmon-mmap detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r2}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0}, &(0x7f0000000080), &(0x7f0000000280)=r1}, 0x20) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) r4 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x12, r4, 0xc3d33000) program did not crash testing program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_usb_connect$hid-syz_usb_control_io$hid-syz_open_dev$usbmon-mmap detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r2}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0}, &(0x7f0000000080), &(0x7f0000000280)=r1}, 0x20) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096010006010083000000002a90a02710000000b3813e25031bdde840"], 0x0}, 0x0) r4 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x12, r4, 0xc3d33000) program did not crash testing program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$usbmon-mmap detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r2}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0}, &(0x7f0000000080), &(0x7f0000000280)=r1}, 0x20) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096010006010083000000002a90a02710000000b3813e25031bdde840"], 0x0}, 0x0) r3 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x12, r3, 0xc3d33000) program did not crash testing program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$usbmon-mmap detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r1}, 0x10) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096010006010083000000002a90a02710000000b3813e25031bdde840"], 0x0}, 0x0) r3 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x12, r3, 0xc3d33000) program crashed: KASAN: slab-out-of-bounds Read in mon_bin_event testing program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_LOAD-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$usbmon-mmap detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096010006010083000000002a90a02710000000b3813e25031bdde840"], 0x0}, 0x0) r2 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x12, r2, 0xc3d33000) program crashed: KASAN: slab-out-of-bounds Read in mon_bin_event testing program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$usbmon-mmap detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096010006010083000000002a90a02710000000b3813e25031bdde840"], 0x0}, 0x0) r2 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x12, r2, 0xc3d33000) program crashed: KASAN: slab-out-of-bounds Read in mon_bin_event testing program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$usbmon-mmap detailed listing: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000005"], 0x48) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096010006010083000000002a90a02710000000b3813e25031bdde840"], 0x0}, 0x0) r1 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x12, r1, 0xc3d33000) program crashed: KASAN: slab-out-of-bounds Read in mon_bin_event testing program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$usbmon-mmap detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096010006010083000000002a90a02710000000b3813e25031bdde840"], 0x0}, 0x0) r1 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x12, r1, 0xc3d33000) program crashed: KASAN: slab-out-of-bounds Read in mon_bin_event testing program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$usbmon-mmap detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096010006010083000000002a90a02710000000b3813e25031bdde840"], 0x0}, 0x0) r1 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x12, r1, 0xc3d33000) program did not crash testing program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$usbmon-mmap detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096010006010083000000002a90a02710000000b3813e25031bdde840"], 0x0}, 0x0) r1 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x12, r1, 0xc3d33000) program did not crash testing program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$usbmon-mmap detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x12, r1, 0xc3d33000) program did not crash testing program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$usbmon-mmap detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x12, r1, 0xc3d33000) program did not crash testing program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$usbmon-mmap detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x0}, 0x0) r1 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x12, r1, 0xc3d33000) program did not crash testing program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$usbmon-mmap detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096010006010083000000002a90a02710000000b3813e25031bdde840"], 0x0}, 0x0) r1 = syz_open_dev$usbmon(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x12, r1, 0xc3d33000) program did not crash extracting C reproducer testing compiled C program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$usbmon-mmap program crashed: KASAN: slab-out-of-bounds Read in mon_bin_event simplifying C reproducer testing compiled C program (duration=37.241612425s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$usbmon-mmap program did not crash testing compiled C program (duration=37.241612425s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$usbmon-mmap program did not crash testing compiled C program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$usbmon-mmap program did not crash testing compiled C program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$usbmon-mmap program crashed: KASAN: slab-out-of-bounds Read in mon_bin_event testing compiled C program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$usbmon-mmap program did not crash testing compiled C program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$usbmon-mmap program crashed: KASAN: slab-out-of-bounds Read in mon_bin_event testing compiled C program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$usbmon-mmap program crashed: KASAN: slab-out-of-bounds Read in mon_bin_event testing program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$usbmon-mmap detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096010006010083000000002a90a02710000000b3813e25031bdde840"], 0x0}, 0x0) r1 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x12, r1, 0xc3d33000) program crashed: KASAN: slab-out-of-bounds Read in mon_bin_event validation run: crashed=true testing program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$usbmon-mmap detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096010006010083000000002a90a02710000000b3813e25031bdde840"], 0x0}, 0x0) r1 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x12, r1, 0xc3d33000) program crashed: KASAN: slab-out-of-bounds Read in mon_bin_event validation run: crashed=true testing program (duration=37.241612425s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$usbmon-mmap detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096010006010083000000002a90a02710000000b3813e25031bdde840"], 0x0}, 0x0) r1 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x12, r1, 0xc3d33000) program crashed: KASAN: slab-out-of-bounds Read in mon_bin_event validation run: crashed=true reproducing took 31m18.593515333s repro crashed as (corrupted=false): microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 microsoft 0003:045E:07DA.0002: unsupported Resolution Multiplier 0 ================================================================== BUG: KASAN: slab-out-of-bounds in mon_copy_to_buff drivers/usb/mon/mon_bin.c:249 [inline] BUG: KASAN: slab-out-of-bounds in mon_bin_get_data drivers/usb/mon/mon_bin.c:417 [inline] BUG: KASAN: slab-out-of-bounds in mon_bin_event+0x1307/0x24e0 drivers/usb/mon/mon_bin.c:603 Read of size 2944 at addr ffff888105fa3641 by task kworker/0:2/60 CPU: 0 PID: 60 Comm: kworker/0:2 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2025 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:88 dump_stack_lvl+0xee/0x150 lib/dump_stack.c:106 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:427 [inline] kasan_report+0xf1/0x140 mm/kasan/report.c:444 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x280/0x290 mm/kasan/generic.c:189 memcpy+0x2d/0x70 mm/kasan/shadow.c:65 mon_copy_to_buff drivers/usb/mon/mon_bin.c:249 [inline] mon_bin_get_data drivers/usb/mon/mon_bin.c:417 [inline] mon_bin_event+0x1307/0x24e0 drivers/usb/mon/mon_bin.c:603 mon_bin_submit+0x27/0x30 drivers/usb/mon/mon_bin.c:623 mon_bus_submit drivers/usb/mon/mon_main.c:91 [inline] mon_submit+0x185/0x200 drivers/usb/mon/mon_main.c:103 usbmon_urb_submit include/linux/usb/hcd.h:733 [inline] usb_hcd_submit_urb+0x117/0x1780 drivers/usb/core/hcd.c:1544 usb_submit_urb+0x1226/0x1900 drivers/usb/core/urb.c:594 usb_start_wait_urb+0x117/0x2f0 drivers/usb/core/message.c:58 usb_internal_control_msg drivers/usb/core/message.c:102 [inline] usb_control_msg+0x241/0x3f0 drivers/usb/core/message.c:153 usbhid_set_raw_report drivers/hid/usbhid/hid-core.c:926 [inline] usbhid_raw_request+0x453/0x580 drivers/hid/usbhid/hid-core.c:1297 __hid_request+0x1d2/0x390 drivers/hid/hid-core.c:1737 hidinput_change_resolution_multipliers drivers/hid/hid-input.c:1711 [inline] hidinput_connect+0x1e20/0x2ce0 drivers/hid/hid-input.c:2027 hid_connect+0x458/0xdf0 drivers/hid/hid-core.c:1968 hid_hw_start+0xaa/0x130 drivers/hid/hid-core.c:2075 ms_probe+0x190/0x460 drivers/hid/hid-microsoft.c:391 hid_device_probe+0x287/0x380 drivers/hid/hid-core.c:2303 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x285/0x970 drivers/base/dd.c:595 __driver_probe_device+0x198/0x280 drivers/base/dd.c:755 driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785 __device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907 bus_for_each_drv+0x175/0x200 drivers/base/bus.c:429 __device_attach+0x2a2/0x400 drivers/base/dd.c:979 device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489 device_add+0xb31/0xed0 drivers/base/core.c:3422 hid_add_device+0x356/0x4b0 drivers/hid/hid-core.c:2453 usbhid_probe+0xb2e/0xee0 drivers/hid/usbhid/hid-core.c:1427 usb_probe_interface+0x5ff/0xae0 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x285/0x970 drivers/base/dd.c:595 __driver_probe_device+0x198/0x280 drivers/base/dd.c:755 driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785 __device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907 bus_for_each_drv+0x175/0x200 drivers/base/bus.c:429 __device_attach+0x2a2/0x400 drivers/base/dd.c:979 device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489 device_add+0xb31/0xed0 drivers/base/core.c:3422 usb_set_configuration+0x19c2/0x1f10 drivers/usb/core/message.c:2165 usb_generic_driver_probe+0x91/0x150 drivers/usb/core/generic.c:238 usb_probe_device+0x148/0x260 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x285/0x970 drivers/base/dd.c:595 __driver_probe_device+0x198/0x280 drivers/base/dd.c:755 driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785 __device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907 bus_for_each_drv+0x175/0x200 drivers/base/bus.c:429 __device_attach+0x2a2/0x400 drivers/base/dd.c:979 device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489 device_add+0xb31/0xed0 drivers/base/core.c:3422 usb_new_device+0xd06/0x1620 drivers/usb/core/hub.c:2610 hub_port_connect drivers/usb/core/hub.c:5525 [inline] hub_port_connect_change drivers/usb/core/hub.c:5665 [inline] port_event drivers/usb/core/hub.c:5815 [inline] hub_event+0x27d8/0x42c0 drivers/usb/core/hub.c:5897 process_one_work+0x6be/0xba0 kernel/workqueue.c:2325 worker_thread+0xa59/0x1200 kernel/workqueue.c:2472 kthread+0x411/0x500 kernel/kthread.c:337 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 Allocated by task 60: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:433 [inline] ____kasan_kmalloc mm/kasan/common.c:512 [inline] __kasan_kmalloc+0xda/0x110 mm/kasan/common.c:521 kasan_kmalloc include/linux/kasan.h:227 [inline] __kmalloc+0x13d/0x2c0 mm/slub.c:4431 kmalloc include/linux/slab.h:621 [inline] kzalloc include/linux/slab.h:747 [inline] hid_alloc_report_buf drivers/hid/hid-core.c:1663 [inline] __hid_request+0x9a/0x390 drivers/hid/hid-core.c:1728 hidinput_change_resolution_multipliers drivers/hid/hid-input.c:1711 [inline] hidinput_connect+0x1e20/0x2ce0 drivers/hid/hid-input.c:2027 hid_connect+0x458/0xdf0 drivers/hid/hid-core.c:1968 hid_hw_start+0xaa/0x130 drivers/hid/hid-core.c:2075 ms_probe+0x190/0x460 drivers/hid/hid-microsoft.c:391 hid_device_probe+0x287/0x380 drivers/hid/hid-core.c:2303 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x285/0x970 drivers/base/dd.c:595 __driver_probe_device+0x198/0x280 drivers/base/dd.c:755 driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785 __device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907 bus_for_each_drv+0x175/0x200 drivers/base/bus.c:429 __device_attach+0x2a2/0x400 drivers/base/dd.c:979 device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489 device_add+0xb31/0xed0 drivers/base/core.c:3422 hid_add_device+0x356/0x4b0 drivers/hid/hid-core.c:2453 usbhid_probe+0xb2e/0xee0 drivers/hid/usbhid/hid-core.c:1427 usb_probe_interface+0x5ff/0xae0 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x285/0x970 drivers/base/dd.c:595 __driver_probe_device+0x198/0x280 drivers/base/dd.c:755 driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785 __device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907 bus_for_each_drv+0x175/0x200 drivers/base/bus.c:429 __device_attach+0x2a2/0x400 drivers/base/dd.c:979 device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489 device_add+0xb31/0xed0 drivers/base/core.c:3422 usb_set_configuration+0x19c2/0x1f10 drivers/usb/core/message.c:2165 usb_generic_driver_probe+0x91/0x150 drivers/usb/core/generic.c:238 usb_probe_device+0x148/0x260 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x285/0x970 drivers/base/dd.c:595 __driver_probe_device+0x198/0x280 drivers/base/dd.c:755 driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785 __device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907 bus_for_each_drv+0x175/0x200 drivers/base/bus.c:429 __device_attach+0x2a2/0x400 drivers/base/dd.c:979 device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489 device_add+0xb31/0xed0 drivers/base/core.c:3422 usb_new_device+0xd06/0x1620 drivers/usb/core/hub.c:2610 hub_port_connect drivers/usb/core/hub.c:5525 [inline] hub_port_connect_change drivers/usb/core/hub.c:5665 [inline] port_event drivers/usb/core/hub.c:5815 [inline] hub_event+0x27d8/0x42c0 drivers/usb/core/hub.c:5897 process_one_work+0x6be/0xba0 kernel/workqueue.c:2325 worker_thread+0xa59/0x1200 kernel/workqueue.c:2472 kthread+0x411/0x500 kernel/kthread.c:337 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 The buggy address belongs to the object at ffff888105fa3640 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 1 bytes inside of 8-byte region [ffff888105fa3640, ffff888105fa3648) The buggy address belongs to the page: page:ffffea000417e8c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105fa3 flags: 0x4000000000000200(slab|zone=1) raw: 4000000000000200 dead000000000100 dead000000000122 ffff888100042300 raw: 0000000000000000 0000000080660066 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 1340279454, free_ts 0 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x192/0x1b0 mm/page_alloc.c:2605 prep_new_page+0x1c/0x110 mm/page_alloc.c:2611 get_page_from_freelist+0x2cc5/0x2d50 mm/page_alloc.c:4485 __alloc_pages+0x18f/0x440 mm/page_alloc.c:5795 alloc_slab_page mm/slub.c:-1 [inline] allocate_slab mm/slub.c:1932 [inline] new_slab+0xa1/0x4d0 mm/slub.c:1995 ___slab_alloc+0x381/0x810 mm/slub.c:3028 __slab_alloc+0x49/0x90 mm/slub.c:3115 slab_alloc_node mm/slub.c:3206 [inline] slab_alloc mm/slub.c:3250 [inline] __kmalloc+0x16a/0x2c0 mm/slub.c:4427 kmalloc include/linux/slab.h:621 [inline] kzalloc include/linux/slab.h:747 [inline] acpi_os_allocate_zeroed include/acpi/platform/aclinuxex.h:57 [inline] acpi_ns_internalize_name+0x2bc/0x3a0 drivers/acpi/acpica/nsutils.c:331 acpi_ns_get_node_unlocked drivers/acpi/acpica/nsutils.c:666 [inline] acpi_ns_get_node+0x1a0/0x340 drivers/acpi/acpica/nsutils.c:726 acpi_get_handle+0x17e/0x290 drivers/acpi/acpica/nsxfname.c:98 acpi_has_method+0x83/0xd0 drivers/acpi/utils.c:553 acpi_bay_match+0x78/0x1d0 drivers/acpi/scan.c:1150 acpi_set_pnp_ids drivers/acpi/scan.c:1359 [inline] acpi_init_device_object+0x1bd2/0x2580 drivers/acpi/scan.c:1751 acpi_add_single_object+0xee/0x16f0 drivers/acpi/scan.c:1797 acpi_bus_check_add+0x314/0x790 drivers/acpi/scan.c:2056 page_owner free stack trace missing Memory state around the buggy address: ffff888105fa3500: fb fc fc fc fc fb fc fc fc fc fb fc fc fc fc fb ffff888105fa3580: fc fc fc fc fb fc fc fc fc fb fc fc fc fc fb fc >ffff888105fa3600: fc fc fc fb fc fc fc fc 07 fc fc fc fc fb fc fc ^ ffff888105fa3680: fc fc fb fc fc fc fc fb fc fc fc fc fb fc fc fc ffff888105fa3700: fc fb fc fc fc fc fb fc fc fc fc fb fc fc fc fc ================================================================== microsoft 0003:045E:07DA.0002: No inputs registered, leaving microsoft 0003:045E:07DA.0002: hidraw2: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.1-1/input0 microsoft 0003:045E:07DA.0002: no inputs found microsoft 0003:045E:07DA.0002: could not initialize ff, continuing anyway usb 2-1: USB disconnect, device number 2 usb 2-1: new high-speed USB device number 3 using dummy_hcd usb 2-1: Using ep0 maxpacket: 16 usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 usb 2-1: config 0 descriptor?? microsoft 0003:045E:07DA.0008: ignoring exceeding usage max microsoft 0003:045E:07DA.0008: unknown main item tag 0x0 microsoft 0003:045E:07DA.0008: unknown main item tag 0x0 microsoft 0003:045E:07DA.0008: unknown main item tag 0x0 microsoft 0003:045E:07DA.0008: unknown main item tag 0x0 microsoft 0003:045E:07DA.0008: unknown main item tag 0x0 microsoft 0003:045E:07DA.0008: unsupported Resolution Multiplier 0 microsoft 0003:045E:07DA.0008: No inputs registered, leaving microsoft 0003:045E:07DA.0008: hidraw1: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.1-1/input0 microsoft 0003:045E:07DA.0008: no inputs found microsoft 0003:045E:07DA.0008: could not initialize ff, continuing anyway usb 2-1: USB disconnect, device number 3 usb 7-1: new high-speed USB device number 4 using dummy_hcd usb 7-1: Using ep0 maxpacket: 16 usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 usb 7-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 usb 7-1: config 0 descriptor?? microsoft 0003:045E:07DA.000E: ignoring exceeding usage max microsoft 0003:045E:07DA.000E: unknown main item tag 0x0 microsoft 0003:045E:07DA.000E: unknown main item tag 0x0 microsoft 0003:045E:07DA.000E: unknown main item tag 0x0 microsoft 0003:045E:07DA.000E: unknown main item tag 0x0 microsoft 0003:045E:07DA.000E: unknown main item tag 0x0 microsoft 0003:045E:07DA.000E: unsupported Resolution Multiplier 0 microsoft 0003:045E:07DA.000E: No inputs registered, leaving microsoft 0003:045E:07DA.000E: hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.6-1/input0 microsoft 0003:045E:07DA.000E: no inputs found microsoft 0003:045E:07DA.000E: could not initialize ff, continuing anyway usb 7-1: USB disconnect, device number 4 final repro crashed as (corrupted=false): microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 microsoft 0003:045E:07DA.0002: unsupported Resolution Multiplier 0 ================================================================== BUG: KASAN: slab-out-of-bounds in mon_copy_to_buff drivers/usb/mon/mon_bin.c:249 [inline] BUG: KASAN: slab-out-of-bounds in mon_bin_get_data drivers/usb/mon/mon_bin.c:417 [inline] BUG: KASAN: slab-out-of-bounds in mon_bin_event+0x1307/0x24e0 drivers/usb/mon/mon_bin.c:603 Read of size 2944 at addr ffff888105fa3641 by task kworker/0:2/60 CPU: 0 PID: 60 Comm: kworker/0:2 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2025 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:88 dump_stack_lvl+0xee/0x150 lib/dump_stack.c:106 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:427 [inline] kasan_report+0xf1/0x140 mm/kasan/report.c:444 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x280/0x290 mm/kasan/generic.c:189 memcpy+0x2d/0x70 mm/kasan/shadow.c:65 mon_copy_to_buff drivers/usb/mon/mon_bin.c:249 [inline] mon_bin_get_data drivers/usb/mon/mon_bin.c:417 [inline] mon_bin_event+0x1307/0x24e0 drivers/usb/mon/mon_bin.c:603 mon_bin_submit+0x27/0x30 drivers/usb/mon/mon_bin.c:623 mon_bus_submit drivers/usb/mon/mon_main.c:91 [inline] mon_submit+0x185/0x200 drivers/usb/mon/mon_main.c:103 usbmon_urb_submit include/linux/usb/hcd.h:733 [inline] usb_hcd_submit_urb+0x117/0x1780 drivers/usb/core/hcd.c:1544 usb_submit_urb+0x1226/0x1900 drivers/usb/core/urb.c:594 usb_start_wait_urb+0x117/0x2f0 drivers/usb/core/message.c:58 usb_internal_control_msg drivers/usb/core/message.c:102 [inline] usb_control_msg+0x241/0x3f0 drivers/usb/core/message.c:153 usbhid_set_raw_report drivers/hid/usbhid/hid-core.c:926 [inline] usbhid_raw_request+0x453/0x580 drivers/hid/usbhid/hid-core.c:1297 __hid_request+0x1d2/0x390 drivers/hid/hid-core.c:1737 hidinput_change_resolution_multipliers drivers/hid/hid-input.c:1711 [inline] hidinput_connect+0x1e20/0x2ce0 drivers/hid/hid-input.c:2027 hid_connect+0x458/0xdf0 drivers/hid/hid-core.c:1968 hid_hw_start+0xaa/0x130 drivers/hid/hid-core.c:2075 ms_probe+0x190/0x460 drivers/hid/hid-microsoft.c:391 hid_device_probe+0x287/0x380 drivers/hid/hid-core.c:2303 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x285/0x970 drivers/base/dd.c:595 __driver_probe_device+0x198/0x280 drivers/base/dd.c:755 driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785 __device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907 bus_for_each_drv+0x175/0x200 drivers/base/bus.c:429 __device_attach+0x2a2/0x400 drivers/base/dd.c:979 device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489 device_add+0xb31/0xed0 drivers/base/core.c:3422 hid_add_device+0x356/0x4b0 drivers/hid/hid-core.c:2453 usbhid_probe+0xb2e/0xee0 drivers/hid/usbhid/hid-core.c:1427 usb_probe_interface+0x5ff/0xae0 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x285/0x970 drivers/base/dd.c:595 __driver_probe_device+0x198/0x280 drivers/base/dd.c:755 driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785 __device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907 bus_for_each_drv+0x175/0x200 drivers/base/bus.c:429 __device_attach+0x2a2/0x400 drivers/base/dd.c:979 device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489 device_add+0xb31/0xed0 drivers/base/core.c:3422 usb_set_configuration+0x19c2/0x1f10 drivers/usb/core/message.c:2165 usb_generic_driver_probe+0x91/0x150 drivers/usb/core/generic.c:238 usb_probe_device+0x148/0x260 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x285/0x970 drivers/base/dd.c:595 __driver_probe_device+0x198/0x280 drivers/base/dd.c:755 driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785 __device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907 bus_for_each_drv+0x175/0x200 drivers/base/bus.c:429 __device_attach+0x2a2/0x400 drivers/base/dd.c:979 device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489 device_add+0xb31/0xed0 drivers/base/core.c:3422 usb_new_device+0xd06/0x1620 drivers/usb/core/hub.c:2610 hub_port_connect drivers/usb/core/hub.c:5525 [inline] hub_port_connect_change drivers/usb/core/hub.c:5665 [inline] port_event drivers/usb/core/hub.c:5815 [inline] hub_event+0x27d8/0x42c0 drivers/usb/core/hub.c:5897 process_one_work+0x6be/0xba0 kernel/workqueue.c:2325 worker_thread+0xa59/0x1200 kernel/workqueue.c:2472 kthread+0x411/0x500 kernel/kthread.c:337 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 Allocated by task 60: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:433 [inline] ____kasan_kmalloc mm/kasan/common.c:512 [inline] __kasan_kmalloc+0xda/0x110 mm/kasan/common.c:521 kasan_kmalloc include/linux/kasan.h:227 [inline] __kmalloc+0x13d/0x2c0 mm/slub.c:4431 kmalloc include/linux/slab.h:621 [inline] kzalloc include/linux/slab.h:747 [inline] hid_alloc_report_buf drivers/hid/hid-core.c:1663 [inline] __hid_request+0x9a/0x390 drivers/hid/hid-core.c:1728 hidinput_change_resolution_multipliers drivers/hid/hid-input.c:1711 [inline] hidinput_connect+0x1e20/0x2ce0 drivers/hid/hid-input.c:2027 hid_connect+0x458/0xdf0 drivers/hid/hid-core.c:1968 hid_hw_start+0xaa/0x130 drivers/hid/hid-core.c:2075 ms_probe+0x190/0x460 drivers/hid/hid-microsoft.c:391 hid_device_probe+0x287/0x380 drivers/hid/hid-core.c:2303 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x285/0x970 drivers/base/dd.c:595 __driver_probe_device+0x198/0x280 drivers/base/dd.c:755 driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785 __device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907 bus_for_each_drv+0x175/0x200 drivers/base/bus.c:429 __device_attach+0x2a2/0x400 drivers/base/dd.c:979 device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489 device_add+0xb31/0xed0 drivers/base/core.c:3422 hid_add_device+0x356/0x4b0 drivers/hid/hid-core.c:2453 usbhid_probe+0xb2e/0xee0 drivers/hid/usbhid/hid-core.c:1427 usb_probe_interface+0x5ff/0xae0 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x285/0x970 drivers/base/dd.c:595 __driver_probe_device+0x198/0x280 drivers/base/dd.c:755 driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785 __device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907 bus_for_each_drv+0x175/0x200 drivers/base/bus.c:429 __device_attach+0x2a2/0x400 drivers/base/dd.c:979 device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489 device_add+0xb31/0xed0 drivers/base/core.c:3422 usb_set_configuration+0x19c2/0x1f10 drivers/usb/core/message.c:2165 usb_generic_driver_probe+0x91/0x150 drivers/usb/core/generic.c:238 usb_probe_device+0x148/0x260 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x285/0x970 drivers/base/dd.c:595 __driver_probe_device+0x198/0x280 drivers/base/dd.c:755 driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785 __device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907 bus_for_each_drv+0x175/0x200 drivers/base/bus.c:429 __device_attach+0x2a2/0x400 drivers/base/dd.c:979 device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489 device_add+0xb31/0xed0 drivers/base/core.c:3422 usb_new_device+0xd06/0x1620 drivers/usb/core/hub.c:2610 hub_port_connect drivers/usb/core/hub.c:5525 [inline] hub_port_connect_change drivers/usb/core/hub.c:5665 [inline] port_event drivers/usb/core/hub.c:5815 [inline] hub_event+0x27d8/0x42c0 drivers/usb/core/hub.c:5897 process_one_work+0x6be/0xba0 kernel/workqueue.c:2325 worker_thread+0xa59/0x1200 kernel/workqueue.c:2472 kthread+0x411/0x500 kernel/kthread.c:337 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 The buggy address belongs to the object at ffff888105fa3640 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 1 bytes inside of 8-byte region [ffff888105fa3640, ffff888105fa3648) The buggy address belongs to the page: page:ffffea000417e8c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105fa3 flags: 0x4000000000000200(slab|zone=1) raw: 4000000000000200 dead000000000100 dead000000000122 ffff888100042300 raw: 0000000000000000 0000000080660066 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 1340279454, free_ts 0 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x192/0x1b0 mm/page_alloc.c:2605 prep_new_page+0x1c/0x110 mm/page_alloc.c:2611 get_page_from_freelist+0x2cc5/0x2d50 mm/page_alloc.c:4485 __alloc_pages+0x18f/0x440 mm/page_alloc.c:5795 alloc_slab_page mm/slub.c:-1 [inline] allocate_slab mm/slub.c:1932 [inline] new_slab+0xa1/0x4d0 mm/slub.c:1995 ___slab_alloc+0x381/0x810 mm/slub.c:3028 __slab_alloc+0x49/0x90 mm/slub.c:3115 slab_alloc_node mm/slub.c:3206 [inline] slab_alloc mm/slub.c:3250 [inline] __kmalloc+0x16a/0x2c0 mm/slub.c:4427 kmalloc include/linux/slab.h:621 [inline] kzalloc include/linux/slab.h:747 [inline] acpi_os_allocate_zeroed include/acpi/platform/aclinuxex.h:57 [inline] acpi_ns_internalize_name+0x2bc/0x3a0 drivers/acpi/acpica/nsutils.c:331 acpi_ns_get_node_unlocked drivers/acpi/acpica/nsutils.c:666 [inline] acpi_ns_get_node+0x1a0/0x340 drivers/acpi/acpica/nsutils.c:726 acpi_get_handle+0x17e/0x290 drivers/acpi/acpica/nsxfname.c:98 acpi_has_method+0x83/0xd0 drivers/acpi/utils.c:553 acpi_bay_match+0x78/0x1d0 drivers/acpi/scan.c:1150 acpi_set_pnp_ids drivers/acpi/scan.c:1359 [inline] acpi_init_device_object+0x1bd2/0x2580 drivers/acpi/scan.c:1751 acpi_add_single_object+0xee/0x16f0 drivers/acpi/scan.c:1797 acpi_bus_check_add+0x314/0x790 drivers/acpi/scan.c:2056 page_owner free stack trace missing Memory state around the buggy address: ffff888105fa3500: fb fc fc fc fc fb fc fc fc fc fb fc fc fc fc fb ffff888105fa3580: fc fc fc fc fb fc fc fc fc fb fc fc fc fc fb fc >ffff888105fa3600: fc fc fc fb fc fc fc fc 07 fc fc fc fc fb fc fc ^ ffff888105fa3680: fc fc fb fc fc fc fc fb fc fc fc fc fb fc fc fc ffff888105fa3700: fc fb fc fc fc fc fb fc fc fc fc fb fc fc fc fc ================================================================== microsoft 0003:045E:07DA.0002: No inputs registered, leaving microsoft 0003:045E:07DA.0002: hidraw2: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.1-1/input0 microsoft 0003:045E:07DA.0002: no inputs found microsoft 0003:045E:07DA.0002: could not initialize ff, continuing anyway usb 2-1: USB disconnect, device number 2 usb 2-1: new high-speed USB device number 3 using dummy_hcd usb 2-1: Using ep0 maxpacket: 16 usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 usb 2-1: config 0 descriptor?? microsoft 0003:045E:07DA.0008: ignoring exceeding usage max microsoft 0003:045E:07DA.0008: unknown main item tag 0x0 microsoft 0003:045E:07DA.0008: unknown main item tag 0x0 microsoft 0003:045E:07DA.0008: unknown main item tag 0x0 microsoft 0003:045E:07DA.0008: unknown main item tag 0x0 microsoft 0003:045E:07DA.0008: unknown main item tag 0x0 microsoft 0003:045E:07DA.0008: unsupported Resolution Multiplier 0 microsoft 0003:045E:07DA.0008: No inputs registered, leaving microsoft 0003:045E:07DA.0008: hidraw1: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.1-1/input0 microsoft 0003:045E:07DA.0008: no inputs found microsoft 0003:045E:07DA.0008: could not initialize ff, continuing anyway usb 2-1: USB disconnect, device number 3 usb 7-1: new high-speed USB device number 4 using dummy_hcd usb 7-1: Using ep0 maxpacket: 16 usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 usb 7-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 usb 7-1: config 0 descriptor?? microsoft 0003:045E:07DA.000E: ignoring exceeding usage max microsoft 0003:045E:07DA.000E: unknown main item tag 0x0 microsoft 0003:045E:07DA.000E: unknown main item tag 0x0 microsoft 0003:045E:07DA.000E: unknown main item tag 0x0 microsoft 0003:045E:07DA.000E: unknown main item tag 0x0 microsoft 0003:045E:07DA.000E: unknown main item tag 0x0 microsoft 0003:045E:07DA.000E: unsupported Resolution Multiplier 0 microsoft 0003:045E:07DA.000E: No inputs registered, leaving microsoft 0003:045E:07DA.000E: hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.6-1/input0 microsoft 0003:045E:07DA.000E: no inputs found microsoft 0003:045E:07DA.000E: could not initialize ff, continuing anyway usb 7-1: USB disconnect, device number 4