Extracting prog: 1m36.222919231s
Minimizing prog: 18m46.186758173s
Simplifying prog options: 0s
Extracting C: 54.159287495s
Simplifying C: 8m30.770857867s
extracting reproducer from 24 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCGUCODE
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x6a3, 0xcd0, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xa0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0xcc28163f40625b84, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000000c0)={0x24, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308103c0c0"], 0x0}, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000140)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000180)={0x20, 0x1, 0x1, "8d"}, 0x0})
r1 = syz_open_dev$hiddev(&(0x7f00000001c0), 0xa, 0x62080)
ioctl$HIDIOCGUCODE(r1, 0xc018480d, 0x0)
program crashed: general protection fault in saitek_event
single: successfully extracted reproducer
found reproducer with 6 syscalls
minimizing guilty program
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x6a3, 0xcd0, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xa0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0xcc28163f40625b84, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000000c0)={0x24, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308103c0c0"], 0x0}, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000140)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000180)={0x20, 0x1, 0x1, "8d"}, 0x0})
syz_open_dev$hiddev(&(0x7f00000001c0), 0xa, 0x62080)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-ioctl$HIDIOCGUCODE
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x6a3, 0xcd0, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xa0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0xcc28163f40625b84, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000000c0)={0x24, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308103c0c0"], 0x0}, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000140)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000180)={0x20, 0x1, 0x1, "8d"}, 0x0})
ioctl$HIDIOCGUCODE(0xffffffffffffffff, 0xc018480d, 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCGUCODE
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x6a3, 0xcd0, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xa0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0xcc28163f40625b84, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000000c0)={0x24, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308103c0c0"], 0x0}, 0x0)
r1 = syz_open_dev$hiddev(&(0x7f00000001c0), 0xa, 0x62080)
ioctl$HIDIOCGUCODE(r1, 0xc018480d, 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCGUCODE
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x6a3, 0xcd0, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xa0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0xcc28163f40625b84, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000140)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000180)={0x20, 0x1, 0x1, "8d"}, 0x0})
r1 = syz_open_dev$hiddev(&(0x7f00000001c0), 0xa, 0x62080)
ioctl$HIDIOCGUCODE(r1, 0xc018480d, 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCGUCODE
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x6a3, 0xcd0, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xa0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0xcc28163f40625b84, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000000c0)={0x24, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308103c0c0"], 0x0}, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000140)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000180)={0x20, 0x1, 0x1, "8d"}, 0x0})
r1 = syz_open_dev$hiddev(&(0x7f00000001c0), 0xa, 0x62080)
ioctl$HIDIOCGUCODE(r1, 0xc018480d, 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCGUCODE
detailed listing:
executing program 0:
syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000000c0)={0x24, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308103c0c0"], 0x0}, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f0000000140)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000180)={0x20, 0x1, 0x1, "8d"}, 0x0})
r0 = syz_open_dev$hiddev(&(0x7f00000001c0), 0xa, 0x62080)
ioctl$HIDIOCGUCODE(r0, 0xc018480d, 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCGUCODE
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x3, 0x0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000000c0)={0x24, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308103c0c0"], 0x0}, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000140)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000180)={0x20, 0x1, 0x1, "8d"}, 0x0})
r1 = syz_open_dev$hiddev(&(0x7f00000001c0), 0xa, 0x62080)
ioctl$HIDIOCGUCODE(r1, 0xc018480d, 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCGUCODE
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x6a3, 0xcd0, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xa0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0xcc28163f40625b84, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000140)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000180)={0x20, 0x1, 0x1, "8d"}, 0x0})
r1 = syz_open_dev$hiddev(&(0x7f00000001c0), 0xa, 0x62080)
ioctl$HIDIOCGUCODE(r1, 0xc018480d, 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCGUCODE
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x6a3, 0xcd0, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xa0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0xcc28163f40625b84, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000000c0)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000140)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000180)={0x20, 0x1, 0x1, "8d"}, 0x0})
r1 = syz_open_dev$hiddev(&(0x7f00000001c0), 0xa, 0x62080)
ioctl$HIDIOCGUCODE(r1, 0xc018480d, 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCGUCODE
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x6a3, 0xcd0, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xa0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0xcc28163f40625b84, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000000c0)={0x24, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB], 0x0}, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000140)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000180)={0x20, 0x1, 0x1, "8d"}, 0x0})
r1 = syz_open_dev$hiddev(&(0x7f00000001c0), 0xa, 0x62080)
ioctl$HIDIOCGUCODE(r1, 0xc018480d, 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCGUCODE
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x6a3, 0xcd0, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xa0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0xcc28163f40625b84, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000000c0)={0x24, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308103c0c0"], 0x0}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
r1 = syz_open_dev$hiddev(&(0x7f00000001c0), 0xa, 0x62080)
ioctl$HIDIOCGUCODE(r1, 0xc018480d, 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCGUCODE
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x6a3, 0xcd0, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xa0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0xcc28163f40625b84, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000000c0)={0x24, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308103c0c0"], 0x0}, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000140)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0})
r1 = syz_open_dev$hiddev(&(0x7f00000001c0), 0xa, 0x62080)
ioctl$HIDIOCGUCODE(r1, 0xc018480d, 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCGUCODE
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x6a3, 0xcd0, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xa0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0xcc28163f40625b84, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000000c0)={0x24, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308103c0c0"], 0x0}, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000140)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000180), 0x0})
r1 = syz_open_dev$hiddev(&(0x7f00000001c0), 0xa, 0x62080)
ioctl$HIDIOCGUCODE(r1, 0xc018480d, 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCGUCODE
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x6a3, 0xcd0, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xa0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0xcc28163f40625b84, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000000c0)={0x24, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308103c0c0"], 0x0}, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000140)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000180)={0x20, 0x1, 0x1, "8d"}, 0x0})
r1 = syz_open_dev$hiddev(0x0, 0xa, 0x62080)
ioctl$HIDIOCGUCODE(r1, 0xc018480d, 0x0)
program did not crash
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCGUCODE
program crashed: general protection fault in saitek_event
simplifying C reproducer
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCGUCODE
program did not crash
testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCGUCODE
program crashed: general protection fault in saitek_event
testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCGUCODE
program crashed: general protection fault in saitek_event
testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCGUCODE
program crashed: general protection fault in saitek_event
testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCGUCODE
program crashed: general protection fault in saitek_event
testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCGUCODE
program crashed: general protection fault in saitek_event
testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCGUCODE
program crashed: general protection fault in saitek_event
testing program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCGUCODE
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x6a3, 0xcd0, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xa0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0xcc28163f40625b84, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000000c0)={0x24, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308103c0c0"], 0x0}, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000140)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000180)={0x20, 0x1, 0x1, "8d"}, 0x0})
r1 = syz_open_dev$hiddev(&(0x7f00000001c0), 0xa, 0x62080)
ioctl$HIDIOCGUCODE(r1, 0xc018480d, 0x0)
program crashed: general protection fault in saitek_event
validation run: crashed=true
testing program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCGUCODE
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x6a3, 0xcd0, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xa0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0xcc28163f40625b84, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000000c0)={0x24, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308103c0c0"], 0x0}, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000140)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000180)={0x20, 0x1, 0x1, "8d"}, 0x0})
r1 = syz_open_dev$hiddev(&(0x7f00000001c0), 0xa, 0x62080)
ioctl$HIDIOCGUCODE(r1, 0xc018480d, 0x0)
program crashed: general protection fault in saitek_event
validation run: crashed=true
testing program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCGUCODE
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x6a3, 0xcd0, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xa0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0xcc28163f40625b84, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000000c0)={0x24, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308103c0c0"], 0x0}, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000140)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000180)={0x20, 0x1, 0x1, "8d"}, 0x0})
r1 = syz_open_dev$hiddev(&(0x7f00000001c0), 0xa, 0x62080)
ioctl$HIDIOCGUCODE(r1, 0xc018480d, 0x0)
program crashed: general protection fault in saitek_event
validation run: crashed=true
reproducing took 34m24.485806113s
repro crashed as (corrupted=false):
general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
CPU: 0 PID: 3532 Comm: kworker/u4:11 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Workqueue: writeback wb_workfn (flush-8:0)
RIP: 0010:saitek_event+0x51/0x2a0 drivers/hid/hid-saitek.c:154
Code: 84 f9 49 83 c6 78 4c 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 3d 8d dd f9 4d 8b 36 49 83 c6 18 4c 89 f0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 f7 e8 20 8d dd f9 49 8b 06 48 89 04 24
RSP: 0018:ffffc900000076b0 EFLAGS: 00010006
RAX: 0000000000000003 RBX: ffff888144fa3088 RCX: ffff88802ebdda00
RDX: 0000000000000100 RSI: ffff888144fa3000 RDI: ffff888025ff8000
RBP: 000000000000008d R08: 0000000000000000 R09: 0000000000000004
R10: ffff888144fa30a4 R11: ffffed10289f4615 R12: ffffffff8f0632a8
R13: dffffc0000000000 R14: 0000000000000018 R15: ffff888025ff8000
FS: 0000000000000000(0000) GS:ffff8880b8c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6a8751dff8 CR3: 000000007cf95000 CR4: 00000000003506f0
Call Trace:
hid_process_event+0x42f/0x610 drivers/hid/hid-core.c:1546
hid_process_report drivers/hid/hid-core.c:1704 [inline]
hid_report_raw_event+0x1028/0x1950 drivers/hid/hid-core.c:2062
hid_input_report+0x420/0x500 drivers/hid/hid-core.c:2137
hid_ctrl+0x1e2/0x530 drivers/hid/usbhid/hid-core.c:483
__usb_hcd_giveback_urb+0x35d/0x520 drivers/usb/core/hcd.c:1650
dummy_timer+0xa58/0x34e0 drivers/usb/gadget/udc/dummy_hcd.c:2017
__run_hrtimer kernel/time/hrtimer.c:1754 [inline]
__hrtimer_run_queues+0x525/0xc10 kernel/time/hrtimer.c:1818
hrtimer_run_softirq+0x177/0x290 kernel/time/hrtimer.c:1835
handle_softirqs+0x27d/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:PagePoisoned include/linux/page-flags.h:297 [inline]
RIP: 0010:page_to_nid include/linux/mm.h:1647 [inline]
RIP: 0010:page_zone include/linux/mm.h:1861 [inline]
RIP: 0010:folio_zone include/linux/mm.h:1871 [inline]
RIP: 0010:zone_stat_mod_folio include/linux/vmstat.h:439 [inline]
RIP: 0010:folio_clear_dirty_for_io+0x570/0xca0 mm/page-writeback.c:2932
Code: 82 02 00 00 e8 c1 4e ce ff 4d 85 f6 49 be 00 00 00 00 00 fc ff df 75 07 e8 ad 4e ce ff eb 06 e8 a6 4e ce ff fb 48 8b 44 24 18 <42> 80 3c 30 00 74 08 48 89 df e8 c1 2f 27 00 4c 8b 3b 48 c7 c7 ff
RSP: 0018:ffffc9000ce36ca0 EFLAGS: 00000293
RAX: 1ffffd400039e7e8 RBX: ffffea0001cf3f40 RCX: ffff88802ebdda00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc9000ce36db0 R08: ffffffff91ff15a7 R09: 1ffffffff23fe2b4
R10: dffffc0000000000 R11: fffffbfff23fe2b5 R12: 0000000000000001
R13: ffffffffffffffff R14: dffffc0000000000 R15: 0000000000000000
mpage_submit_folio+0x77/0x3c0 fs/ext4/inode.c:1892
mpage_map_and_submit_buffers fs/ext4/inode.c:2157 [inline]
mpage_map_and_submit_extent fs/ext4/inode.c:2296 [inline]
ext4_do_writepages+0x1d61/0x3990 fs/ext4/inode.c:2733
ext4_writepages+0x1dd/0x350 fs/ext4/inode.c:2822
do_writepages+0x351/0x590 mm/page-writeback.c:2575
__writeback_single_inode+0x14e/0xee0 fs/fs-writeback.c:1701
writeback_sb_inodes+0x813/0x1020 fs/fs-writeback.c:1992
__writeback_inodes_wb+0x114/0x240 fs/fs-writeback.c:2063
wb_writeback+0x472/0xbe0 fs/fs-writeback.c:2173
wb_check_old_data_flush fs/fs-writeback.c:2277 [inline]
wb_do_writeback fs/fs-writeback.c:2330 [inline]
wb_workfn+0xad7/0xe60 fs/fs-writeback.c:2358
process_one_work kernel/workqueue.c:2657 [inline]
process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:saitek_event+0x51/0x2a0 drivers/hid/hid-saitek.c:154
Code: 84 f9 49 83 c6 78 4c 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 3d 8d dd f9 4d 8b 36 49 83 c6 18 4c 89 f0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 f7 e8 20 8d dd f9 49 8b 06 48 89 04 24
RSP: 0018:ffffc900000076b0 EFLAGS: 00010006
RAX: 0000000000000003 RBX: ffff888144fa3088 RCX: ffff88802ebdda00
RDX: 0000000000000100 RSI: ffff888144fa3000 RDI: ffff888025ff8000
RBP: 000000000000008d R08: 0000000000000000 R09: 0000000000000004
R10: ffff888144fa30a4 R11: ffffed10289f4615 R12: ffffffff8f0632a8
R13: dffffc0000000000 R14: 0000000000000018 R15: ffff888025ff8000
FS: 0000000000000000(0000) GS:ffff8880b8c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6a8751dff8 CR3: 000000007cf95000 CR4: 00000000003506f0
----------------
Code disassembly (best guess):
0: 84 f9 test %bh,%cl
2: 49 83 c6 78 add $0x78,%r14
6: 4c 89 f0 mov %r14,%rax
9: 48 c1 e8 03 shr $0x3,%rax
d: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1)
12: 74 08 je 0x1c
14: 4c 89 f7 mov %r14,%rdi
17: e8 3d 8d dd f9 call 0xf9dd8d59
1c: 4d 8b 36 mov (%r14),%r14
1f: 49 83 c6 18 add $0x18,%r14
23: 4c 89 f0 mov %r14,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 4c 89 f7 mov %r14,%rdi
34: e8 20 8d dd f9 call 0xf9dd8d59
39: 49 8b 06 mov (%r14),%rax
3c: 48 89 04 24 mov %rax,(%rsp)
final repro crashed as (corrupted=false):
general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
CPU: 0 PID: 3532 Comm: kworker/u4:11 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Workqueue: writeback wb_workfn (flush-8:0)
RIP: 0010:saitek_event+0x51/0x2a0 drivers/hid/hid-saitek.c:154
Code: 84 f9 49 83 c6 78 4c 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 3d 8d dd f9 4d 8b 36 49 83 c6 18 4c 89 f0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 f7 e8 20 8d dd f9 49 8b 06 48 89 04 24
RSP: 0018:ffffc900000076b0 EFLAGS: 00010006
RAX: 0000000000000003 RBX: ffff888144fa3088 RCX: ffff88802ebdda00
RDX: 0000000000000100 RSI: ffff888144fa3000 RDI: ffff888025ff8000
RBP: 000000000000008d R08: 0000000000000000 R09: 0000000000000004
R10: ffff888144fa30a4 R11: ffffed10289f4615 R12: ffffffff8f0632a8
R13: dffffc0000000000 R14: 0000000000000018 R15: ffff888025ff8000
FS: 0000000000000000(0000) GS:ffff8880b8c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6a8751dff8 CR3: 000000007cf95000 CR4: 00000000003506f0
Call Trace:
hid_process_event+0x42f/0x610 drivers/hid/hid-core.c:1546
hid_process_report drivers/hid/hid-core.c:1704 [inline]
hid_report_raw_event+0x1028/0x1950 drivers/hid/hid-core.c:2062
hid_input_report+0x420/0x500 drivers/hid/hid-core.c:2137
hid_ctrl+0x1e2/0x530 drivers/hid/usbhid/hid-core.c:483
__usb_hcd_giveback_urb+0x35d/0x520 drivers/usb/core/hcd.c:1650
dummy_timer+0xa58/0x34e0 drivers/usb/gadget/udc/dummy_hcd.c:2017
__run_hrtimer kernel/time/hrtimer.c:1754 [inline]
__hrtimer_run_queues+0x525/0xc10 kernel/time/hrtimer.c:1818
hrtimer_run_softirq+0x177/0x290 kernel/time/hrtimer.c:1835
handle_softirqs+0x27d/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:PagePoisoned include/linux/page-flags.h:297 [inline]
RIP: 0010:page_to_nid include/linux/mm.h:1647 [inline]
RIP: 0010:page_zone include/linux/mm.h:1861 [inline]
RIP: 0010:folio_zone include/linux/mm.h:1871 [inline]
RIP: 0010:zone_stat_mod_folio include/linux/vmstat.h:439 [inline]
RIP: 0010:folio_clear_dirty_for_io+0x570/0xca0 mm/page-writeback.c:2932
Code: 82 02 00 00 e8 c1 4e ce ff 4d 85 f6 49 be 00 00 00 00 00 fc ff df 75 07 e8 ad 4e ce ff eb 06 e8 a6 4e ce ff fb 48 8b 44 24 18 <42> 80 3c 30 00 74 08 48 89 df e8 c1 2f 27 00 4c 8b 3b 48 c7 c7 ff
RSP: 0018:ffffc9000ce36ca0 EFLAGS: 00000293
RAX: 1ffffd400039e7e8 RBX: ffffea0001cf3f40 RCX: ffff88802ebdda00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc9000ce36db0 R08: ffffffff91ff15a7 R09: 1ffffffff23fe2b4
R10: dffffc0000000000 R11: fffffbfff23fe2b5 R12: 0000000000000001
R13: ffffffffffffffff R14: dffffc0000000000 R15: 0000000000000000
mpage_submit_folio+0x77/0x3c0 fs/ext4/inode.c:1892
mpage_map_and_submit_buffers fs/ext4/inode.c:2157 [inline]
mpage_map_and_submit_extent fs/ext4/inode.c:2296 [inline]
ext4_do_writepages+0x1d61/0x3990 fs/ext4/inode.c:2733
ext4_writepages+0x1dd/0x350 fs/ext4/inode.c:2822
do_writepages+0x351/0x590 mm/page-writeback.c:2575
__writeback_single_inode+0x14e/0xee0 fs/fs-writeback.c:1701
writeback_sb_inodes+0x813/0x1020 fs/fs-writeback.c:1992
__writeback_inodes_wb+0x114/0x240 fs/fs-writeback.c:2063
wb_writeback+0x472/0xbe0 fs/fs-writeback.c:2173
wb_check_old_data_flush fs/fs-writeback.c:2277 [inline]
wb_do_writeback fs/fs-writeback.c:2330 [inline]
wb_workfn+0xad7/0xe60 fs/fs-writeback.c:2358
process_one_work kernel/workqueue.c:2657 [inline]
process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:saitek_event+0x51/0x2a0 drivers/hid/hid-saitek.c:154
Code: 84 f9 49 83 c6 78 4c 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 3d 8d dd f9 4d 8b 36 49 83 c6 18 4c 89 f0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 f7 e8 20 8d dd f9 49 8b 06 48 89 04 24
RSP: 0018:ffffc900000076b0 EFLAGS: 00010006
RAX: 0000000000000003 RBX: ffff888144fa3088 RCX: ffff88802ebdda00
RDX: 0000000000000100 RSI: ffff888144fa3000 RDI: ffff888025ff8000
RBP: 000000000000008d R08: 0000000000000000 R09: 0000000000000004
R10: ffff888144fa30a4 R11: ffffed10289f4615 R12: ffffffff8f0632a8
R13: dffffc0000000000 R14: 0000000000000018 R15: ffff888025ff8000
FS: 0000000000000000(0000) GS:ffff8880b8c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6a8751dff8 CR3: 000000007cf95000 CR4: 00000000003506f0
----------------
Code disassembly (best guess):
0: 84 f9 test %bh,%cl
2: 49 83 c6 78 add $0x78,%r14
6: 4c 89 f0 mov %r14,%rax
9: 48 c1 e8 03 shr $0x3,%rax
d: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1)
12: 74 08 je 0x1c
14: 4c 89 f7 mov %r14,%rdi
17: e8 3d 8d dd f9 call 0xf9dd8d59
1c: 4d 8b 36 mov (%r14),%r14
1f: 49 83 c6 18 add $0x18,%r14
23: 4c 89 f0 mov %r14,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 4c 89 f7 mov %r14,%rdi
34: e8 20 8d dd f9 call 0xf9dd8d59
39: 49 8b 06 mov (%r14),%rax
3c: 48 89 04 24 mov %rax,(%rsp)