Extracting prog: 1m50.501118834s
Minimizing prog: 27m36.473210125s
Simplifying prog options: 0s
Extracting C: 28.164705677s
Simplifying C: 9m45.230092174s


extracting reproducer from 51 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-quotactl_fd$Q_GETNEXTQUOTA-syz_usb_connect$uac1-socket$inet6_udplite-setsockopt$inet_opts-getsockopt$inet_opts-socketpair$unix-syz_emit_ethernet-syz_open_pts-ioctl$KVM_RUN-io_uring_register$IORING_REGISTER_BUFFERS-migrate_pages-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010203296fb608229084d488ff0102030109021200010495008109041e800056a7f602"], &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x16})
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003)
quotactl_fd$Q_GETNEXTQUOTA(r0, 0xffffffff80000900, 0xee01, &(0x7f00000004c0))
syz_usb_connect$uac1(0x1, 0xb4, &(0x7f0000000540)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa2, 0x3, 0x1, 0x9, 0x50, 0xb7, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xf3, 0x2}, [@output_terminal={0x9, 0x24, 0x3, 0x5, 0x305, 0x4, 0x3, 0xb}, @extension_unit={0xd, 0x24, 0x8, 0x6, 0x1, 0x8, "aba5722cfce9"}, @output_terminal={0x9, 0x24, 0x3, 0x2, 0x1ff, 0x4, 0x4, 0x7f}, @processing_unit={0x8, 0x24, 0x7, 0x5, 0x3, 0x8, '3'}, @selector_unit={0x5, 0x24, 0x5, 0x3, 0x6}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0xfff0, 0x5, 0x40, "a27ffa59"}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x7, 0x4, 0x3, 0x80, "", "845e"}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x3, 0x9, 0x3, {0x7, 0x25, 0x1, 0x0, 0x56, 0xfff}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x6, 0x8, 0xb0, {0x7, 0x25, 0x1, 0x8a50e7098371a17f, 0x5, 0x6}}}}}}}]}}, &(0x7f0000000440)={0x0, 0x0, 0x18, &(0x7f00000001c0)={0x5, 0xf, 0x18, 0x2, [@ext_cap={0x7, 0x10, 0x2, 0x1a, 0x6, 0x5, 0x401}, @ssp_cap={0xc, 0x10, 0xa, 0x2, 0x0, 0x9}]}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})
socket$inet6_udplite(0xa, 0x2, 0x88)
setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x8000000000000c, &(0x7f0000000080)='@', 0x1)
getsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x9, 0xffffffffffffffff, &(0x7f0000000000)=0x32)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080))
syz_emit_ethernet(0x46, &(0x7f00000004c0)={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x33}, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "b81923", 0x10, 0x0, 0x0, @local, @local, {[@dstopts={0x2e, 0x0, '\x00', [@padn]}]}}}}}, 0x0)
syz_open_pts(0xffffffffffffffff, 0x80)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a)
migrate_pages(0x0, 0x3, &(0x7f0000000040)=0x7f, 0x0)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000a40)={&(0x7f0000000380)=[{0x1900, 0x6000, 0x0, 0x0}, {0x1, 0x2a00, 0x0, 0x0}], 0x2})

program crashed: general protection fault in su3000_i2c_transfer
single: successfully extracted reproducer
found reproducer with 14 syscalls
minimizing guilty program
testing program (duration=45.690181126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-quotactl_fd$Q_GETNEXTQUOTA-syz_usb_connect$uac1-socket$inet6_udplite-setsockopt$inet_opts-getsockopt$inet_opts-socketpair$unix-syz_emit_ethernet-syz_open_pts-ioctl$KVM_RUN-io_uring_register$IORING_REGISTER_BUFFERS-migrate_pages
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010203296fb608229084d488ff0102030109021200010495008109041e800056a7f602"], &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x16})
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003)
quotactl_fd$Q_GETNEXTQUOTA(r0, 0xffffffff80000900, 0xee01, &(0x7f00000004c0))
syz_usb_connect$uac1(0x1, 0xb4, &(0x7f0000000540)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa2, 0x3, 0x1, 0x9, 0x50, 0xb7, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xf3, 0x2}, [@output_terminal={0x9, 0x24, 0x3, 0x5, 0x305, 0x4, 0x3, 0xb}, @extension_unit={0xd, 0x24, 0x8, 0x6, 0x1, 0x8, "aba5722cfce9"}, @output_terminal={0x9, 0x24, 0x3, 0x2, 0x1ff, 0x4, 0x4, 0x7f}, @processing_unit={0x8, 0x24, 0x7, 0x5, 0x3, 0x8, '3'}, @selector_unit={0x5, 0x24, 0x5, 0x3, 0x6}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0xfff0, 0x5, 0x40, "a27ffa59"}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x7, 0x4, 0x3, 0x80, "", "845e"}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x3, 0x9, 0x3, {0x7, 0x25, 0x1, 0x0, 0x56, 0xfff}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x6, 0x8, 0xb0, {0x7, 0x25, 0x1, 0x8a50e7098371a17f, 0x5, 0x6}}}}}}}]}}, &(0x7f0000000440)={0x0, 0x0, 0x18, &(0x7f00000001c0)={0x5, 0xf, 0x18, 0x2, [@ext_cap={0x7, 0x10, 0x2, 0x1a, 0x6, 0x5, 0x401}, @ssp_cap={0xc, 0x10, 0xa, 0x2, 0x0, 0x9}]}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})
socket$inet6_udplite(0xa, 0x2, 0x88)
setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x8000000000000c, &(0x7f0000000080)='@', 0x1)
getsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x9, 0xffffffffffffffff, &(0x7f0000000000)=0x32)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080))
syz_emit_ethernet(0x46, &(0x7f00000004c0)={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x33}, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "b81923", 0x10, 0x0, 0x0, @local, @local, {[@dstopts={0x2e, 0x0, '\x00', [@padn]}]}}}}}, 0x0)
syz_open_pts(0xffffffffffffffff, 0x80)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a)
migrate_pages(0x0, 0x3, &(0x7f0000000040)=0x7f, 0x0)

program did not crash
testing program (duration=45.690181126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-quotactl_fd$Q_GETNEXTQUOTA-syz_usb_connect$uac1-socket$inet6_udplite-setsockopt$inet_opts-getsockopt$inet_opts-socketpair$unix-syz_emit_ethernet-syz_open_pts-ioctl$KVM_RUN-io_uring_register$IORING_REGISTER_BUFFERS-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010203296fb608229084d488ff0102030109021200010495008109041e800056a7f602"], &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x16})
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003)
quotactl_fd$Q_GETNEXTQUOTA(r0, 0xffffffff80000900, 0xee01, &(0x7f00000004c0))
syz_usb_connect$uac1(0x1, 0xb4, &(0x7f0000000540)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa2, 0x3, 0x1, 0x9, 0x50, 0xb7, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xf3, 0x2}, [@output_terminal={0x9, 0x24, 0x3, 0x5, 0x305, 0x4, 0x3, 0xb}, @extension_unit={0xd, 0x24, 0x8, 0x6, 0x1, 0x8, "aba5722cfce9"}, @output_terminal={0x9, 0x24, 0x3, 0x2, 0x1ff, 0x4, 0x4, 0x7f}, @processing_unit={0x8, 0x24, 0x7, 0x5, 0x3, 0x8, '3'}, @selector_unit={0x5, 0x24, 0x5, 0x3, 0x6}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0xfff0, 0x5, 0x40, "a27ffa59"}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x7, 0x4, 0x3, 0x80, "", "845e"}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x3, 0x9, 0x3, {0x7, 0x25, 0x1, 0x0, 0x56, 0xfff}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x6, 0x8, 0xb0, {0x7, 0x25, 0x1, 0x8a50e7098371a17f, 0x5, 0x6}}}}}}}]}}, &(0x7f0000000440)={0x0, 0x0, 0x18, &(0x7f00000001c0)={0x5, 0xf, 0x18, 0x2, [@ext_cap={0x7, 0x10, 0x2, 0x1a, 0x6, 0x5, 0x401}, @ssp_cap={0xc, 0x10, 0xa, 0x2, 0x0, 0x9}]}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})
socket$inet6_udplite(0xa, 0x2, 0x88)
setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x8000000000000c, &(0x7f0000000080)='@', 0x1)
getsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x9, 0xffffffffffffffff, &(0x7f0000000000)=0x32)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080))
syz_emit_ethernet(0x46, &(0x7f00000004c0)={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x33}, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "b81923", 0x10, 0x0, 0x0, @local, @local, {[@dstopts={0x2e, 0x0, '\x00', [@padn]}]}}}}}, 0x0)
syz_open_pts(0xffffffffffffffff, 0x80)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000a40)={&(0x7f0000000380)=[{0x1900, 0x6000, 0x0, 0x0}, {0x1, 0x2a00, 0x0, 0x0}], 0x2})

program crashed: general protection fault in su3000_i2c_transfer
testing program (duration=45.690181126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-quotactl_fd$Q_GETNEXTQUOTA-syz_usb_connect$uac1-socket$inet6_udplite-setsockopt$inet_opts-getsockopt$inet_opts-socketpair$unix-syz_emit_ethernet-syz_open_pts-ioctl$KVM_RUN-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010203296fb608229084d488ff0102030109021200010495008109041e800056a7f602"], &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x16})
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003)
quotactl_fd$Q_GETNEXTQUOTA(r0, 0xffffffff80000900, 0xee01, &(0x7f00000004c0))
syz_usb_connect$uac1(0x1, 0xb4, &(0x7f0000000540)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa2, 0x3, 0x1, 0x9, 0x50, 0xb7, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xf3, 0x2}, [@output_terminal={0x9, 0x24, 0x3, 0x5, 0x305, 0x4, 0x3, 0xb}, @extension_unit={0xd, 0x24, 0x8, 0x6, 0x1, 0x8, "aba5722cfce9"}, @output_terminal={0x9, 0x24, 0x3, 0x2, 0x1ff, 0x4, 0x4, 0x7f}, @processing_unit={0x8, 0x24, 0x7, 0x5, 0x3, 0x8, '3'}, @selector_unit={0x5, 0x24, 0x5, 0x3, 0x6}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0xfff0, 0x5, 0x40, "a27ffa59"}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x7, 0x4, 0x3, 0x80, "", "845e"}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x3, 0x9, 0x3, {0x7, 0x25, 0x1, 0x0, 0x56, 0xfff}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x6, 0x8, 0xb0, {0x7, 0x25, 0x1, 0x8a50e7098371a17f, 0x5, 0x6}}}}}}}]}}, &(0x7f0000000440)={0x0, 0x0, 0x18, &(0x7f00000001c0)={0x5, 0xf, 0x18, 0x2, [@ext_cap={0x7, 0x10, 0x2, 0x1a, 0x6, 0x5, 0x401}, @ssp_cap={0xc, 0x10, 0xa, 0x2, 0x0, 0x9}]}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})
socket$inet6_udplite(0xa, 0x2, 0x88)
setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x8000000000000c, &(0x7f0000000080)='@', 0x1)
getsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x9, 0xffffffffffffffff, &(0x7f0000000000)=0x32)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080))
syz_emit_ethernet(0x46, &(0x7f00000004c0)={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x33}, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "b81923", 0x10, 0x0, 0x0, @local, @local, {[@dstopts={0x2e, 0x0, '\x00', [@padn]}]}}}}}, 0x0)
syz_open_pts(0xffffffffffffffff, 0x80)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000a40)={&(0x7f0000000380)=[{0x1900, 0x6000, 0x0, 0x0}, {0x1, 0x2a00, 0x0, 0x0}], 0x2})

program crashed: general protection fault in su3000_i2c_transfer
testing program (duration=45.690181126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-quotactl_fd$Q_GETNEXTQUOTA-syz_usb_connect$uac1-socket$inet6_udplite-setsockopt$inet_opts-getsockopt$inet_opts-socketpair$unix-syz_emit_ethernet-syz_open_pts-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010203296fb608229084d488ff0102030109021200010495008109041e800056a7f602"], &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x16})
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003)
quotactl_fd$Q_GETNEXTQUOTA(r0, 0xffffffff80000900, 0xee01, &(0x7f00000004c0))
syz_usb_connect$uac1(0x1, 0xb4, &(0x7f0000000540)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa2, 0x3, 0x1, 0x9, 0x50, 0xb7, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xf3, 0x2}, [@output_terminal={0x9, 0x24, 0x3, 0x5, 0x305, 0x4, 0x3, 0xb}, @extension_unit={0xd, 0x24, 0x8, 0x6, 0x1, 0x8, "aba5722cfce9"}, @output_terminal={0x9, 0x24, 0x3, 0x2, 0x1ff, 0x4, 0x4, 0x7f}, @processing_unit={0x8, 0x24, 0x7, 0x5, 0x3, 0x8, '3'}, @selector_unit={0x5, 0x24, 0x5, 0x3, 0x6}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0xfff0, 0x5, 0x40, "a27ffa59"}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x7, 0x4, 0x3, 0x80, "", "845e"}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x3, 0x9, 0x3, {0x7, 0x25, 0x1, 0x0, 0x56, 0xfff}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x6, 0x8, 0xb0, {0x7, 0x25, 0x1, 0x8a50e7098371a17f, 0x5, 0x6}}}}}}}]}}, &(0x7f0000000440)={0x0, 0x0, 0x18, &(0x7f00000001c0)={0x5, 0xf, 0x18, 0x2, [@ext_cap={0x7, 0x10, 0x2, 0x1a, 0x6, 0x5, 0x401}, @ssp_cap={0xc, 0x10, 0xa, 0x2, 0x0, 0x9}]}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})
socket$inet6_udplite(0xa, 0x2, 0x88)
setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x8000000000000c, &(0x7f0000000080)='@', 0x1)
getsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x9, 0xffffffffffffffff, &(0x7f0000000000)=0x32)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080))
syz_emit_ethernet(0x46, &(0x7f00000004c0)={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x33}, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "b81923", 0x10, 0x0, 0x0, @local, @local, {[@dstopts={0x2e, 0x0, '\x00', [@padn]}]}}}}}, 0x0)
syz_open_pts(0xffffffffffffffff, 0x80)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000a40)={&(0x7f0000000380)=[{0x1900, 0x6000, 0x0, 0x0}, {0x1, 0x2a00, 0x0, 0x0}], 0x2})

program crashed: general protection fault in su3000_i2c_transfer
testing program (duration=45.690181126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-quotactl_fd$Q_GETNEXTQUOTA-syz_usb_connect$uac1-socket$inet6_udplite-setsockopt$inet_opts-getsockopt$inet_opts-socketpair$unix-syz_emit_ethernet-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010203296fb608229084d488ff0102030109021200010495008109041e800056a7f602"], &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x16})
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003)
quotactl_fd$Q_GETNEXTQUOTA(r0, 0xffffffff80000900, 0xee01, &(0x7f00000004c0))
syz_usb_connect$uac1(0x1, 0xb4, &(0x7f0000000540)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa2, 0x3, 0x1, 0x9, 0x50, 0xb7, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xf3, 0x2}, [@output_terminal={0x9, 0x24, 0x3, 0x5, 0x305, 0x4, 0x3, 0xb}, @extension_unit={0xd, 0x24, 0x8, 0x6, 0x1, 0x8, "aba5722cfce9"}, @output_terminal={0x9, 0x24, 0x3, 0x2, 0x1ff, 0x4, 0x4, 0x7f}, @processing_unit={0x8, 0x24, 0x7, 0x5, 0x3, 0x8, '3'}, @selector_unit={0x5, 0x24, 0x5, 0x3, 0x6}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0xfff0, 0x5, 0x40, "a27ffa59"}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x7, 0x4, 0x3, 0x80, "", "845e"}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x3, 0x9, 0x3, {0x7, 0x25, 0x1, 0x0, 0x56, 0xfff}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x6, 0x8, 0xb0, {0x7, 0x25, 0x1, 0x8a50e7098371a17f, 0x5, 0x6}}}}}}}]}}, &(0x7f0000000440)={0x0, 0x0, 0x18, &(0x7f00000001c0)={0x5, 0xf, 0x18, 0x2, [@ext_cap={0x7, 0x10, 0x2, 0x1a, 0x6, 0x5, 0x401}, @ssp_cap={0xc, 0x10, 0xa, 0x2, 0x0, 0x9}]}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})
socket$inet6_udplite(0xa, 0x2, 0x88)
setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x8000000000000c, &(0x7f0000000080)='@', 0x1)
getsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x9, 0xffffffffffffffff, &(0x7f0000000000)=0x32)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080))
syz_emit_ethernet(0x46, &(0x7f00000004c0)={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x33}, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "b81923", 0x10, 0x0, 0x0, @local, @local, {[@dstopts={0x2e, 0x0, '\x00', [@padn]}]}}}}}, 0x0)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000a40)={&(0x7f0000000380)=[{0x1900, 0x6000, 0x0, 0x0}, {0x1, 0x2a00, 0x0, 0x0}], 0x2})

program crashed: general protection fault in su3000_i2c_transfer
testing program (duration=45.690181126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-quotactl_fd$Q_GETNEXTQUOTA-syz_usb_connect$uac1-socket$inet6_udplite-setsockopt$inet_opts-getsockopt$inet_opts-socketpair$unix-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010203296fb608229084d488ff0102030109021200010495008109041e800056a7f602"], &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x16})
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003)
quotactl_fd$Q_GETNEXTQUOTA(r0, 0xffffffff80000900, 0xee01, &(0x7f00000004c0))
syz_usb_connect$uac1(0x1, 0xb4, &(0x7f0000000540)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa2, 0x3, 0x1, 0x9, 0x50, 0xb7, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xf3, 0x2}, [@output_terminal={0x9, 0x24, 0x3, 0x5, 0x305, 0x4, 0x3, 0xb}, @extension_unit={0xd, 0x24, 0x8, 0x6, 0x1, 0x8, "aba5722cfce9"}, @output_terminal={0x9, 0x24, 0x3, 0x2, 0x1ff, 0x4, 0x4, 0x7f}, @processing_unit={0x8, 0x24, 0x7, 0x5, 0x3, 0x8, '3'}, @selector_unit={0x5, 0x24, 0x5, 0x3, 0x6}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0xfff0, 0x5, 0x40, "a27ffa59"}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x7, 0x4, 0x3, 0x80, "", "845e"}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x3, 0x9, 0x3, {0x7, 0x25, 0x1, 0x0, 0x56, 0xfff}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x6, 0x8, 0xb0, {0x7, 0x25, 0x1, 0x8a50e7098371a17f, 0x5, 0x6}}}}}}}]}}, &(0x7f0000000440)={0x0, 0x0, 0x18, &(0x7f00000001c0)={0x5, 0xf, 0x18, 0x2, [@ext_cap={0x7, 0x10, 0x2, 0x1a, 0x6, 0x5, 0x401}, @ssp_cap={0xc, 0x10, 0xa, 0x2, 0x0, 0x9}]}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})
socket$inet6_udplite(0xa, 0x2, 0x88)
setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x8000000000000c, &(0x7f0000000080)='@', 0x1)
getsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x9, 0xffffffffffffffff, &(0x7f0000000000)=0x32)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080))
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000a40)={&(0x7f0000000380)=[{0x1900, 0x6000, 0x0, 0x0}, {0x1, 0x2a00, 0x0, 0x0}], 0x2})

program crashed: general protection fault in su3000_i2c_transfer
testing program (duration=45.690181126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-quotactl_fd$Q_GETNEXTQUOTA-syz_usb_connect$uac1-socket$inet6_udplite-setsockopt$inet_opts-getsockopt$inet_opts-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010203296fb608229084d488ff0102030109021200010495008109041e800056a7f602"], &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x16})
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003)
quotactl_fd$Q_GETNEXTQUOTA(r0, 0xffffffff80000900, 0xee01, &(0x7f00000004c0))
syz_usb_connect$uac1(0x1, 0xb4, &(0x7f0000000540)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa2, 0x3, 0x1, 0x9, 0x50, 0xb7, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xf3, 0x2}, [@output_terminal={0x9, 0x24, 0x3, 0x5, 0x305, 0x4, 0x3, 0xb}, @extension_unit={0xd, 0x24, 0x8, 0x6, 0x1, 0x8, "aba5722cfce9"}, @output_terminal={0x9, 0x24, 0x3, 0x2, 0x1ff, 0x4, 0x4, 0x7f}, @processing_unit={0x8, 0x24, 0x7, 0x5, 0x3, 0x8, '3'}, @selector_unit={0x5, 0x24, 0x5, 0x3, 0x6}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0xfff0, 0x5, 0x40, "a27ffa59"}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x7, 0x4, 0x3, 0x80, "", "845e"}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x3, 0x9, 0x3, {0x7, 0x25, 0x1, 0x0, 0x56, 0xfff}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x6, 0x8, 0xb0, {0x7, 0x25, 0x1, 0x8a50e7098371a17f, 0x5, 0x6}}}}}}}]}}, &(0x7f0000000440)={0x0, 0x0, 0x18, &(0x7f00000001c0)={0x5, 0xf, 0x18, 0x2, [@ext_cap={0x7, 0x10, 0x2, 0x1a, 0x6, 0x5, 0x401}, @ssp_cap={0xc, 0x10, 0xa, 0x2, 0x0, 0x9}]}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})
socket$inet6_udplite(0xa, 0x2, 0x88)
setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x8000000000000c, &(0x7f0000000080)='@', 0x1)
getsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x9, 0xffffffffffffffff, &(0x7f0000000000)=0x32)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000a40)={&(0x7f0000000380)=[{0x1900, 0x6000, 0x0, 0x0}, {0x1, 0x2a00, 0x0, 0x0}], 0x2})

program crashed: general protection fault in su3000_i2c_transfer
testing program (duration=45.690181126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-quotactl_fd$Q_GETNEXTQUOTA-syz_usb_connect$uac1-socket$inet6_udplite-setsockopt$inet_opts-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010203296fb608229084d488ff0102030109021200010495008109041e800056a7f602"], &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x16})
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003)
quotactl_fd$Q_GETNEXTQUOTA(r0, 0xffffffff80000900, 0xee01, &(0x7f00000004c0))
syz_usb_connect$uac1(0x1, 0xb4, &(0x7f0000000540)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa2, 0x3, 0x1, 0x9, 0x50, 0xb7, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xf3, 0x2}, [@output_terminal={0x9, 0x24, 0x3, 0x5, 0x305, 0x4, 0x3, 0xb}, @extension_unit={0xd, 0x24, 0x8, 0x6, 0x1, 0x8, "aba5722cfce9"}, @output_terminal={0x9, 0x24, 0x3, 0x2, 0x1ff, 0x4, 0x4, 0x7f}, @processing_unit={0x8, 0x24, 0x7, 0x5, 0x3, 0x8, '3'}, @selector_unit={0x5, 0x24, 0x5, 0x3, 0x6}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0xfff0, 0x5, 0x40, "a27ffa59"}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x7, 0x4, 0x3, 0x80, "", "845e"}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x3, 0x9, 0x3, {0x7, 0x25, 0x1, 0x0, 0x56, 0xfff}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x6, 0x8, 0xb0, {0x7, 0x25, 0x1, 0x8a50e7098371a17f, 0x5, 0x6}}}}}}}]}}, &(0x7f0000000440)={0x0, 0x0, 0x18, &(0x7f00000001c0)={0x5, 0xf, 0x18, 0x2, [@ext_cap={0x7, 0x10, 0x2, 0x1a, 0x6, 0x5, 0x401}, @ssp_cap={0xc, 0x10, 0xa, 0x2, 0x0, 0x9}]}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})
socket$inet6_udplite(0xa, 0x2, 0x88)
setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x8000000000000c, &(0x7f0000000080)='@', 0x1)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000a40)={&(0x7f0000000380)=[{0x1900, 0x6000, 0x0, 0x0}, {0x1, 0x2a00, 0x0, 0x0}], 0x2})

program crashed: general protection fault in su3000_i2c_transfer
testing program (duration=45.690181126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-quotactl_fd$Q_GETNEXTQUOTA-syz_usb_connect$uac1-socket$inet6_udplite-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010203296fb608229084d488ff0102030109021200010495008109041e800056a7f602"], &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x16})
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003)
quotactl_fd$Q_GETNEXTQUOTA(r0, 0xffffffff80000900, 0xee01, &(0x7f00000004c0))
syz_usb_connect$uac1(0x1, 0xb4, &(0x7f0000000540)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa2, 0x3, 0x1, 0x9, 0x50, 0xb7, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xf3, 0x2}, [@output_terminal={0x9, 0x24, 0x3, 0x5, 0x305, 0x4, 0x3, 0xb}, @extension_unit={0xd, 0x24, 0x8, 0x6, 0x1, 0x8, "aba5722cfce9"}, @output_terminal={0x9, 0x24, 0x3, 0x2, 0x1ff, 0x4, 0x4, 0x7f}, @processing_unit={0x8, 0x24, 0x7, 0x5, 0x3, 0x8, '3'}, @selector_unit={0x5, 0x24, 0x5, 0x3, 0x6}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0xfff0, 0x5, 0x40, "a27ffa59"}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x7, 0x4, 0x3, 0x80, "", "845e"}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x3, 0x9, 0x3, {0x7, 0x25, 0x1, 0x0, 0x56, 0xfff}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x6, 0x8, 0xb0, {0x7, 0x25, 0x1, 0x8a50e7098371a17f, 0x5, 0x6}}}}}}}]}}, &(0x7f0000000440)={0x0, 0x0, 0x18, &(0x7f00000001c0)={0x5, 0xf, 0x18, 0x2, [@ext_cap={0x7, 0x10, 0x2, 0x1a, 0x6, 0x5, 0x401}, @ssp_cap={0xc, 0x10, 0xa, 0x2, 0x0, 0x9}]}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})
socket$inet6_udplite(0xa, 0x2, 0x88)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000a40)={&(0x7f0000000380)=[{0x1900, 0x6000, 0x0, 0x0}, {0x1, 0x2a00, 0x0, 0x0}], 0x2})

program crashed: general protection fault in su3000_i2c_transfer
testing program (duration=45.690181126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-quotactl_fd$Q_GETNEXTQUOTA-syz_usb_connect$uac1-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010203296fb608229084d488ff0102030109021200010495008109041e800056a7f602"], &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x16})
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003)
quotactl_fd$Q_GETNEXTQUOTA(r0, 0xffffffff80000900, 0xee01, &(0x7f00000004c0))
syz_usb_connect$uac1(0x1, 0xb4, &(0x7f0000000540)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa2, 0x3, 0x1, 0x9, 0x50, 0xb7, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xf3, 0x2}, [@output_terminal={0x9, 0x24, 0x3, 0x5, 0x305, 0x4, 0x3, 0xb}, @extension_unit={0xd, 0x24, 0x8, 0x6, 0x1, 0x8, "aba5722cfce9"}, @output_terminal={0x9, 0x24, 0x3, 0x2, 0x1ff, 0x4, 0x4, 0x7f}, @processing_unit={0x8, 0x24, 0x7, 0x5, 0x3, 0x8, '3'}, @selector_unit={0x5, 0x24, 0x5, 0x3, 0x6}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0xfff0, 0x5, 0x40, "a27ffa59"}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x7, 0x4, 0x3, 0x80, "", "845e"}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x3, 0x9, 0x3, {0x7, 0x25, 0x1, 0x0, 0x56, 0xfff}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x6, 0x8, 0xb0, {0x7, 0x25, 0x1, 0x8a50e7098371a17f, 0x5, 0x6}}}}}}}]}}, &(0x7f0000000440)={0x0, 0x0, 0x18, &(0x7f00000001c0)={0x5, 0xf, 0x18, 0x2, [@ext_cap={0x7, 0x10, 0x2, 0x1a, 0x6, 0x5, 0x401}, @ssp_cap={0xc, 0x10, 0xa, 0x2, 0x0, 0x9}]}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000a40)={&(0x7f0000000380)=[{0x1900, 0x6000, 0x0, 0x0}, {0x1, 0x2a00, 0x0, 0x0}], 0x2})

program crashed: general protection fault in su3000_i2c_transfer
testing program (duration=45.690181126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-quotactl_fd$Q_GETNEXTQUOTA-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010203296fb608229084d488ff0102030109021200010495008109041e800056a7f602"], &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x16})
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003)
quotactl_fd$Q_GETNEXTQUOTA(r0, 0xffffffff80000900, 0xee01, &(0x7f00000004c0))
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000a40)={&(0x7f0000000380)=[{0x1900, 0x6000, 0x0, 0x0}, {0x1, 0x2a00, 0x0, 0x0}], 0x2})

program crashed: general protection fault in su3000_i2c_transfer
testing program (duration=45.690181126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010203296fb608229084d488ff0102030109021200010495008109041e800056a7f602"], &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x16})
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000a40)={&(0x7f0000000380)=[{0x1900, 0x6000, 0x0, 0x0}, {0x1, 0x2a00, 0x0, 0x0}], 0x2})

program crashed: general protection fault in su3000_i2c_transfer
testing program (duration=45.690181126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010203296fb608229084d488ff0102030109021200010495008109041e800056a7f602"], &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x16})
ioctl$I2C_RDWR(0xffffffffffffffff, 0x707, &(0x7f0000000a40)={&(0x7f0000000380)=[{0x1900, 0x6000, 0x0, 0x0}, {0x1, 0x2a00, 0x0, 0x0}], 0x2})

program did not crash
testing program (duration=45.690181126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$I2C-ioctl$I2C_RDWR
detailed listing:
executing program 0:
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000a40)={&(0x7f0000000380)=[{0x1900, 0x6000, 0x0, 0x0}, {0x1, 0x2a00, 0x0, 0x0}], 0x2})

program did not crash
testing program (duration=45.690181126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, 0x0, &(0x7f0000001700)={0x0, 0x0, 0x0, 0x0})
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000a40)={&(0x7f0000000380)=[{0x1900, 0x6000, 0x0, 0x0}, {0x1, 0x2a00, 0x0, 0x0}], 0x2})

program did not crash
testing program (duration=45.690181126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB], &(0x7f0000001700)={0x0, 0x0, 0x0, 0x0})
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000a40)={&(0x7f0000000380)=[{0x1900, 0x6000, 0x0, 0x0}, {0x1, 0x2a00, 0x0, 0x0}], 0x2})

program did not crash
testing program (duration=45.690181126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010203296fb608229084d488ff0102030109021200010495008109041e800056a7f602"], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000a40)={&(0x7f0000000380)=[{0x1900, 0x6000, 0x0, 0x0}, {0x1, 0x2a00, 0x0, 0x0}], 0x2})

program did not crash
testing program (duration=45.690181126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010203296fb608229084d488ff0102030109021200010495008109041e800056a7f602"], &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x16})
r0 = syz_open_dev$I2C(0x0, 0x1, 0x2003)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000a40)={&(0x7f0000000380)=[{0x1900, 0x6000, 0x0, 0x0}, {0x1, 0x2a00, 0x0, 0x0}], 0x2})

program did not crash
testing program (duration=45.690181126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010203296fb608229084d488ff0102030109021200010495008109041e800056a7f602"], &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x16})
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003)
ioctl$I2C_RDWR(r0, 0x707, 0x0)

program did not crash
testing program (duration=45.690181126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010203296fb608229084d488ff0102030109021200010495008109041e800056a7f602"], &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x16})
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000a40)={0x0})

program did not crash
extracting C reproducer
testing compiled C program (duration=45.690181126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
program crashed: general protection fault in su3000_i2c_transfer
simplifying C reproducer
testing compiled C program (duration=45.690181126s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
program crashed: general protection fault in su3000_i2c_transfer
testing compiled C program (duration=45.690181126s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
program crashed: general protection fault in su3000_i2c_transfer
testing compiled C program (duration=45.690181126s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
program crashed: general protection fault in su3000_i2c_transfer
testing compiled C program (duration=45.690181126s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
program crashed: general protection fault in su3000_i2c_transfer
testing compiled C program (duration=45.690181126s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
program crashed: general protection fault in su3000_i2c_transfer
testing compiled C program (duration=45.690181126s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
program crashed: general protection fault in su3000_i2c_transfer
testing compiled C program (duration=45.690181126s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
program crashed: general protection fault in su3000_i2c_transfer
testing compiled C program (duration=45.690181126s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
program crashed: general protection fault in su3000_i2c_transfer
testing program (duration=45.690181126s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010203296fb608229084d488ff0102030109021200010495008109041e800056a7f602"], &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x16})
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000a40)={&(0x7f0000000380)=[{0x1900, 0x6000, 0x0, 0x0}, {0x1, 0x2a00, 0x0, 0x0}], 0x2})

program crashed: general protection fault in su3000_i2c_transfer
validation run: crashed=true
testing program (duration=45.690181126s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010203296fb608229084d488ff0102030109021200010495008109041e800056a7f602"], &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x16})
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000a40)={&(0x7f0000000380)=[{0x1900, 0x6000, 0x0, 0x0}, {0x1, 0x2a00, 0x0, 0x0}], 0x2})

program crashed: general protection fault in su3000_i2c_transfer
validation run: crashed=true
testing program (duration=45.690181126s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010203296fb608229084d488ff0102030109021200010495008109041e800056a7f602"], &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x16})
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000a40)={&(0x7f0000000380)=[{0x1900, 0x6000, 0x0, 0x0}, {0x1, 0x2a00, 0x0, 0x0}], 0x2})

program crashed: general protection fault in su3000_i2c_transfer
validation run: crashed=true
reproducing took 44m30.985220607s
repro crashed as (corrupted=false):
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 1 UID: 0 PID: 6027 Comm: syz.0.17 Not tainted 6.17.0-rc1-syzkaller-00224-g8d561baae505 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:su3000_i2c_transfer+0x1ad/0x1040 drivers/media/usb/dvb-usb/dw2102.c:740
Code: 4c 89 f8 48 c1 e8 03 49 bc 00 00 00 00 00 fc ff df 42 80 3c 20 00 74 08 4c 89 ff e8 8d b6 3c fa 49 8b 1f 48 89 d8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 5f 09 00 00 0f b6 1b 48 8b 44 24 38 42
RSP: 0018:ffffc90003f8faa8 EFLAGS: 00010202
RAX: 0000000000000002 RBX: 0000000000000010 RCX: 0000000000000003
RDX: ffffffff87e65d05 RSI: ffffffff8f0d3a50 RDI: 0000000000001900
RBP: 0000000000000000 R08: ffff88802eea1e00 R09: 0000000000000002
R10: 0000000000001a00 R11: 0000000000000000 R12: dffffc0000000000
R13: 1ffff1100ec2c488 R14: 0000000000000002 R15: ffff888076162448
FS:  000055555dd4b500(0000) GS:ffff888125d1b000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f91a5e850f5 CR3: 000000007009e000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 __i2c_transfer+0x871/0x2170 drivers/i2c/i2c-core-base.c:-1
 i2c_transfer+0x25b/0x3a0 drivers/i2c/i2c-core-base.c:2320
 i2cdev_ioctl_rdwr+0x460/0x740 drivers/i2c/i2c-dev.c:306
 i2cdev_ioctl+0x64b/0x7f0 drivers/i2c/i2c-dev.c:467
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:598 [inline]
 __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:584
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fdabeb8ebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd4b566978 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fdabedb5fa0 RCX: 00007fdabeb8ebe9
RDX: 0000200000000a40 RSI: 0000000000000707 RDI: 0000000000000004
RBP: 00007fdabec11e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fdabedb5fa0 R14: 00007fdabedb5fa0 R15: 0000000000000003
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:su3000_i2c_transfer+0x1ad/0x1040 drivers/media/usb/dvb-usb/dw2102.c:740
Code: 4c 89 f8 48 c1 e8 03 49 bc 00 00 00 00 00 fc ff df 42 80 3c 20 00 74 08 4c 89 ff e8 8d b6 3c fa 49 8b 1f 48 89 d8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 5f 09 00 00 0f b6 1b 48 8b 44 24 38 42
RSP: 0018:ffffc90003f8faa8 EFLAGS: 00010202
RAX: 0000000000000002 RBX: 0000000000000010 RCX: 0000000000000003
RDX: ffffffff87e65d05 RSI: ffffffff8f0d3a50 RDI: 0000000000001900
RBP: 0000000000000000 R08: ffff88802eea1e00 R09: 0000000000000002
R10: 0000000000001a00 R11: 0000000000000000 R12: dffffc0000000000
R13: 1ffff1100ec2c488 R14: 0000000000000002 R15: ffff888076162448
FS:  000055555dd4b500(0000) GS:ffff888125d1b000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f91a5e850f5 CR3: 000000007009e000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
   0:	4c 89 f8             	mov    %r15,%rax
   3:	48 c1 e8 03          	shr    $0x3,%rax
   7:	49 bc 00 00 00 00 00 	movabs $0xdffffc0000000000,%r12
   e:	fc ff df
  11:	42 80 3c 20 00       	cmpb   $0x0,(%rax,%r12,1)
  16:	74 08                	je     0x20
  18:	4c 89 ff             	mov    %r15,%rdi
  1b:	e8 8d b6 3c fa       	call   0xfa3cb6ad
  20:	49 8b 1f             	mov    (%r15),%rbx
  23:	48 89 d8             	mov    %rbx,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 0f b6 04 20       	movzbl (%rax,%r12,1),%eax <-- trapping instruction
  2f:	84 c0                	test   %al,%al
  31:	0f 85 5f 09 00 00    	jne    0x996
  37:	0f b6 1b             	movzbl (%rbx),%ebx
  3a:	48 8b 44 24 38       	mov    0x38(%rsp),%rax
  3f:	42                   	rex.X

final repro crashed as (corrupted=false):
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 1 UID: 0 PID: 6027 Comm: syz.0.17 Not tainted 6.17.0-rc1-syzkaller-00224-g8d561baae505 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:su3000_i2c_transfer+0x1ad/0x1040 drivers/media/usb/dvb-usb/dw2102.c:740
Code: 4c 89 f8 48 c1 e8 03 49 bc 00 00 00 00 00 fc ff df 42 80 3c 20 00 74 08 4c 89 ff e8 8d b6 3c fa 49 8b 1f 48 89 d8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 5f 09 00 00 0f b6 1b 48 8b 44 24 38 42
RSP: 0018:ffffc90003f8faa8 EFLAGS: 00010202
RAX: 0000000000000002 RBX: 0000000000000010 RCX: 0000000000000003
RDX: ffffffff87e65d05 RSI: ffffffff8f0d3a50 RDI: 0000000000001900
RBP: 0000000000000000 R08: ffff88802eea1e00 R09: 0000000000000002
R10: 0000000000001a00 R11: 0000000000000000 R12: dffffc0000000000
R13: 1ffff1100ec2c488 R14: 0000000000000002 R15: ffff888076162448
FS:  000055555dd4b500(0000) GS:ffff888125d1b000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f91a5e850f5 CR3: 000000007009e000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 __i2c_transfer+0x871/0x2170 drivers/i2c/i2c-core-base.c:-1
 i2c_transfer+0x25b/0x3a0 drivers/i2c/i2c-core-base.c:2320
 i2cdev_ioctl_rdwr+0x460/0x740 drivers/i2c/i2c-dev.c:306
 i2cdev_ioctl+0x64b/0x7f0 drivers/i2c/i2c-dev.c:467
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:598 [inline]
 __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:584
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fdabeb8ebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd4b566978 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fdabedb5fa0 RCX: 00007fdabeb8ebe9
RDX: 0000200000000a40 RSI: 0000000000000707 RDI: 0000000000000004
RBP: 00007fdabec11e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fdabedb5fa0 R14: 00007fdabedb5fa0 R15: 0000000000000003
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:su3000_i2c_transfer+0x1ad/0x1040 drivers/media/usb/dvb-usb/dw2102.c:740
Code: 4c 89 f8 48 c1 e8 03 49 bc 00 00 00 00 00 fc ff df 42 80 3c 20 00 74 08 4c 89 ff e8 8d b6 3c fa 49 8b 1f 48 89 d8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 5f 09 00 00 0f b6 1b 48 8b 44 24 38 42
RSP: 0018:ffffc90003f8faa8 EFLAGS: 00010202
RAX: 0000000000000002 RBX: 0000000000000010 RCX: 0000000000000003
RDX: ffffffff87e65d05 RSI: ffffffff8f0d3a50 RDI: 0000000000001900
RBP: 0000000000000000 R08: ffff88802eea1e00 R09: 0000000000000002
R10: 0000000000001a00 R11: 0000000000000000 R12: dffffc0000000000
R13: 1ffff1100ec2c488 R14: 0000000000000002 R15: ffff888076162448
FS:  000055555dd4b500(0000) GS:ffff888125d1b000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f91a5e850f5 CR3: 000000007009e000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
   0:	4c 89 f8             	mov    %r15,%rax
   3:	48 c1 e8 03          	shr    $0x3,%rax
   7:	49 bc 00 00 00 00 00 	movabs $0xdffffc0000000000,%r12
   e:	fc ff df
  11:	42 80 3c 20 00       	cmpb   $0x0,(%rax,%r12,1)
  16:	74 08                	je     0x20
  18:	4c 89 ff             	mov    %r15,%rdi
  1b:	e8 8d b6 3c fa       	call   0xfa3cb6ad
  20:	49 8b 1f             	mov    (%r15),%rbx
  23:	48 89 d8             	mov    %rbx,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 0f b6 04 20       	movzbl (%rax,%r12,1),%eax <-- trapping instruction
  2f:	84 c0                	test   %al,%al
  31:	0f 85 5f 09 00 00    	jne    0x996
  37:	0f b6 1b             	movzbl (%rbx),%ebx
  3a:	48 8b 44 24 38       	mov    0x38(%rsp),%rax
  3f:	42                   	rex.X