Extracting prog: 2m43.01703595s Minimizing prog: 33m19.956129863s Simplifying prog options: 0s Extracting C: 36.239447595s Simplifying C: 4m21.959658675s extracting reproducer from 74 programs testing a last program of every proc single: executing 24 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_GET_IO_FLUSHER-geteuid-syz_mount_image$ext4-openat$dir-fcntl$setstatus-socket$inet6-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-openat$urandom-mmap$IORING_OFF_SQ_RING-syz_genetlink_get_family_id$SEG6-syz_mount_image$ext4-bpf$MAP_CREATE-bpf$MAP_DELETE_ELEM-socket$inet-syz_emit_ethernet-pread64 detailed listing: executing program 0: prctl$PR_GET_IO_FLUSHER(0x3a) r0 = geteuid() syz_mount_image$ext4(&(0x7f0000000400)='ext4\x00', &(0x7f0000000440)='./file0\x00', 0x24, &(0x7f0000000480)={[{@data_err_abort}, {@noblock_validity}, {@data_err_ignore}, {@errors_remount}, {@lazytime, 0x0}, {@sb={'sb', 0x3d, 0x80000000}}, {@noload}, {@journal_checksum}, {@stripe={'stripe', 0x3d, 0x1b}}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x6}}, {@init_itable}, {@data_ordered}, {@journal_dev={'journal_dev', 0x3d, 0x769}}, {@norecovery}, {@grpid}, {@dax_never}, {@dax_inode}], [{@fowner_lt={'fowner<', r0}}, {@hash}, {@smackfshat={'smackfshat', 0x3d, '\xc6\x92\f\f\xc2\x8d\xafa\bj\xecR]O\xe7\x80\xad\fs*n|\xcf\x97|\'\x06r\x81\xdd\x80*\xd9K\xad\x9b\xe6\x95\xa6\a\xb8Di\xc9\xdc\xd6\xcf\x9f\'L\xc8\x84E$\xce\x84\bp\a\x00N\xacN7\v\x03p\x96\xb2\xcd\x18\x87.\xd2\x81$\x85\xac\xd3\x8fj\xc8\x16\xcf\x16\xaf\xb2\xa5\x8c]\xd9N\x92\x06\xe9\xbd\xd1\x04\xee\xe5U\x91Y\xfa&$z\xb4\xb2J\xcbP\x88\xa5,\xfb\xafS\xef,\xa5\xd7\x12\xbc\x00'/151}}, {@context={'context', 0x3d, 'root'}}, {@measure}], 0x2c}, 0xa, 0x526, &(0x7f0000000680)="$eJzs3M9vFNcdAPDvrNcY13bt0p+UtrilVa1WBWwocOgBUCtxaVWpVUUvlVzbIIqhFXYlQJYwVQVSDolQ/gCS3CJxyjGn5BIlUQ6JuAblmCgSinzB4RBNNLszy3rX65+7tow/H8neNzNvZt535j3vvPd2HcCuNZz9SiL6I+Lj/ojB6uLSDMPVl8WFuYkvF+YmkkjTv3yRVPI9WZibKLIW+/XlCyOliNL/kzjQfNqemRs3L49PT09dy1ccmS3lqSvjF6cuTl0dO3Xq+LHekyfGftuWOPuKwu0/9/d7f5w4f++f7z3IVqX56vo4qoYqv/es+Qxdz5JvlCsvwzEcpRa5f7GOsu8EA3XppBy921gU1iGrtVlt7c7afwxGV5Rr2wbjD//b1sIBHZWmadrTtLb2Xjaf1kuS6g5pejsFngNJrJaj4a8A8Jwo3uifLGS94bmJ5n7w8+3xmaj0gLK4F/Of6pZype8+PFTtG3V36PzfiYjz80/vF89gu+36AwBb760zEXfPVp87ip/qllJ8ry7fN6M6NzQUEd+KiH0R8e38+eW7EZW834+IH9TtM1A5ykq6q/NPdZqffz4q5hLqH1fbJnv++10+t7X0+a9W8qGufGmgEn93cuHS9NTR/JqMRHdPtjzafOjasNrbv3/4UqvzD+fPf8VPdv7s9VmO0uflhgG6yfHZ8c3GXXh8u3JhbzXHn0Q5KVIR+yPihxs4fnbNLv3q9R+12r4k/izOpvhfbH3w8gYK1CB9NeKX1fs/Hw3xRz7/l1TmJ6/858jMjZu/uVQ/Pzl68sTYg5cjpqeOHilqRbP3P7zz5zzZ1I1Y4f4XTWPlJrRJ2f3/xrL1vzYLPJSlavO1M+s/x51Hd1v2aTZa//ckf62ki/nZ6+Ozs9dGI/Yk883rx57te328d0n+LP6RQ8u3/30RX72S73cgIrJK/OOI+ElEHMzL/tOI+FlEHFoh/nfP/vxfrbqQq8ffWVn8k+u6/60Spz+IWH5T1+V33mw68QvDTfF3x9P7i0ljxuz+H6+kRvI1k+Oze1eLa6WS1ic2cekAAABgxzgYEf2RlA7nA039USodPhzRVxtBmZn99YV///fqZPU7AkPRXSpGugbrxkNH87HhbDnba6xuOdt+rDJunKZp2pstZ/336YHtDR12vb4W7T/zWdd2lw7ouHXNozUN0AM7WWP7f7TmPdv/gQxga7XhczTADqX9w+615vbfqW/BAdtmufZ/K2JxG4oCbLHl2v/fmtac3pKyAFtL/x92r423fx8GgJ3O+z/sSmv6kvwGEvvOrZAnKXfmpK0TpagmPv1HNezG/wIwFFGsKZ5pVj7gJ6WI9pSwa/MBZiXO1/QuuaelZffaG+24qlFaNU95Hf+IoWWit03XeUmitPbMvXH5Tw87WkV7mitkY+2tVbZbReJmp5tMpRG8to1/mgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANri6wAAAP//qXDF/w==") r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000bc0)='.\x00', 0x0, 0x0) fcntl$setstatus(r1, 0x4, 0x400) socket$inet6(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000c00)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000c40)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000c80)=0x2) sched_setscheduler(r2, 0x1, &(0x7f0000000cc0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x9a5eb000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000d00)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000d40)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000dc0), 0x651, 0x0) recvmmsg(r3, &(0x7f0000000e00), 0x4000087, 0x2, 0x0) openat$urandom(0xffffffffffffff9c, 0x0, 0x101402, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000e40), 0xffffffffffffffff) syz_mount_image$ext4(&(0x7f0000000e80)='ext4\x00', &(0x7f0000000ec0)='./file1\x00', 0x800, &(0x7f0000000f00)={[{@nouid32}, {@errors_remount}, {@grpjquota}, {@sysvgroups}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x800000}}, {@bsdgroups}, {@i_version}, {@nobarrier}]}, 0x1, 0x500, &(0x7f0000000f80)="$eJzs3c9vI1cdAPDvOHHjbtMmhUoFBHQphQWt1k68bVT1VC4ghCohKk4c0pB4oyh2HMVOacJKTf4HJCpxQHBAnLlxqLQnjghucNvLckBaYAXaIHEwGv/Iejd2kt11bK39+UijmTdvMt/31pn34q+1fgFMrMsRcRARz0XEBxEx1z6ftLd4t7Wl192/d3P16N7N1SQajff/mTTr03PR9TOpF9r3zEXED74T8ePkZNza3v7mSrlc2mmXC/XKdqG2t39to7KyXlovbRWLS4tLC29ff6s4sL6+Vvnd3W9vfO+Hn/7+S3f+fPDNn6bNmm3XdfdjkFpdzx7HSWUuItCITEXEdPv3h2dP+rv4mYh4vfn8z8VU89U8nx6PNQDwDGg05qIx110GAMZdppkDSzL5di5gNjKZfL6Vw3slLmXK1Vr96o3q7tZaK1c2H9nMjY1yaaGdK5yPbJKWFz9Ojx+Ui/Fw+XpEvBwRP5t5vlnOr54/zwAADNYLj8z//5lpzf8AwJjLnXXB8nDaAQAMz5nzPwAwdsz/ADB5zP8AMHnS+f83o24EADBU3v8DwKS53Zn/p0bdEgBgKL7/3nvp1jhqf//12od7u5vVD6+tlWqb+cruan61urOdX69W18ul/Gq1ctb9ytXq9uKbsftRoV6q1Qu1vf3lSnV3q77c/F7v5VJ2KL0CAE7z8mu3/ppExME7zze36FrLwVwN422c1qIBHo+cP0wu38INk8t7fKDnWp65nocP++QJgjU+foIfAgbtyufl/2FSyf/D5JL/h8kl/w+Tq9FI+q35nzm+BAAYK3L8QM/P/7sM9PN/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGBOzzW2+q5zJ5PMRL0bEfGSTGxvl0kJEvBQRf5nJzqTlxZG2GAB4epm/J+31v67MvTH7aO1zyX9nmvuI+Mkv3v/5Ryv1+s5iev5fx+frn7TPF0fRfgDgLJ15ujOPd9y/d3O1sw2zPXe/1VpcNI171N5aNdMxne7+lItsRFz6d9Iqt6V/r0wNIP7BYUR8rlf/k2ZuZL698umj8dPYLw41fuah+JlmXWuf/lt89sSdZ/rGPGutV5gUt9Lx591ez18mLjf3uZ6LH+eaI9TT64x/RyfGv87znmuONb3Gv8vnjfHmH77bt+4w4gvTveInx/GTPvHfOGf821/88uv96hq/irgSveN3xyrUK9uF2t7+tY3KynppvbRVLC4tLi28ff2tYqGZoy50MtUn/eOdqy/17f9vIy71iZ87o/9fO7XXjeMB+Nf/++BHX+kX/zDiG1/t/fq/ckr8dE78+qnxH1jpu3h3K/5aq/+Hj/v6Xz1n/Dt/218756UAwBDU9vY3V8rl0s5AD7Ix4Bt2HSQX1GYHY36Q/j1+fGYmnug+r7ZTZj2v+eMvP301rRx5TwdyMOKBCbhwDx76UbcEAAAAAAAAAAAAAADo58L/O1Fm1D0EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgnP0/AAD//xUWygo=") r5 = bpf$MAP_CREATE(0x0, &(0x7f0000001480)=@base={0x9, 0x16, 0x8, 0x40, 0x42}, 0x50) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000001500)={r5, &(0x7f0000001540)}, 0x20) socket$inet(0x2, 0x2, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaabbbbbbbbbbbb86dd600010a6001404000033843fc30000000000000000000000ff020000000000000000000000000001"], 0x0) pread64(0xffffffffffffffff, &(0x7f0000000080)=""/237, 0xed, 0x4eb) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsconfig$FSCONFIG_CMD_CREATE-socket$inet_udp-open-open-fcntl$setlease-exit-openat$dir-bpf$MAP_CREATE_RINGBUF-bpf$BPF_BTF_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_WITH_BTFID_LOAD-socket$netlink-fcntl$setlease-ioctl$sock_SIOCGIFCONF-fsmount-socket$key-sendmsg$key-sendmsg$netlink-socket$netlink-socket$inet_udp-openat$ttyS3-ioctl$TIOCSETD-ioctl$TIOCSETD-ioctl$TIOCVHANGUP-bind$inet-connect$inet-setsockopt$inet_IP_XFRM_POLICY-capset detailed listing: executing program 0: fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) open(&(0x7f0000000400)='./file0\x00', 0x80ff, 0x88) r1 = open(0x0, 0x0, 0x0) fcntl$setlease(r1, 0x400, 0x1) exit(0xfffffffffffffffb) openat$dir(0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x0, 0x0) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000840)=ANY=[@ANYRESDEC=r1], 0x48) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x28) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x11, 0x3, &(0x7f0000000600)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000640)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r3, 0x8, &(0x7f0000000680)={0x0, 0x1}, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000006c0)=@bpf_tracing={0x1a, 0xf, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000040000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000093000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000010000008500000084000000b70000000000000095"], &(0x7f0000000800)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x19, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r4, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$netlink(0x10, 0x3, 0x0) fcntl$setlease(r1, 0x400, 0x0) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000002c00)=@buf) fsmount(0xffffffffffffffff, 0x0, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x8000000004) r6 = socket$inet_udp(0x2, 0x2, 0x0) r7 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x28000, 0x0) ioctl$TIOCSETD(r7, 0x5423, &(0x7f00000001c0)=0x2) ioctl$TIOCSETD(r7, 0x5423, &(0x7f0000000200)=0x1b) ioctl$TIOCVHANGUP(r7, 0x5437, 0x0) bind$inet(r6, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x12}}, 0x10) connect$inet(r6, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r6, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x1}, @in6=@mcast2, 0x0, 0x0, 0xffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x28c, 0x1, 0x0, 0x0, 0x3}, {0x7}, 0x0, 0x0, 0x1, 0x0, 0x873f24456926a1a5}, {{@in=@rand_addr=0x64010102, 0x2000000, 0x33}, 0x0, @in6=@loopback, 0x0, 0x3, 0x0, 0xb7, 0x0, 0x8000000, 0x3}}, 0xe8) capset(0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-bpf$BPF_PROG_WITH_BTFID_LOAD-bpf$ITER_CREATE-close-bpf$BPF_PROG_TEST_RUN-bpf$BPF_GET_MAP_INFO-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-setsockopt$inet6_tcp_int-bpf$MAP_UPDATE_CONST_STR-connect$inet6-fcntl$dupfd-sendmsg$IPVS_CMD_GET_CONFIG-write$UHID_INPUT detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000002700)=@bpf_lsm={0x6, 0x3, &(0x7f00000027c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000002800)='GPL\x00'}, 0x80) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000002840)={r1}, 0x8) close(r2) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000002880)={r1, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000002900)={r2, 0x58, &(0x7f0000002940)}, 0x10) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)={0x40, 0x1e, 0x1, 0xe}, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0x40, 0x1a, 0x2, 0x378}, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f00000002c0)={0x2c, &(0x7f00000000c0)={0x20, 0x22, 0x3c, {0x3c, 0xd, "4b91bd7553546350b5a572e40017c8b2452740595399db4749630e63ec208ae1ceeef6464e980ee055e63064b0749512fbdda0ae994fe6283cbd"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x403}}, &(0x7f0000000180)={0x0, 0xf, 0x7e, {0x5, 0xf, 0x7e, 0x4, [@generic={0x5a, 0x10, 0xb, "f14c5f470dc2fadb60be012fed4038429a98aa7fbe690701c95945161d1c9ff99644a301d383c4e3b174d71c34613181d8446196871478b3e6e6a63f548865a1a8104bf7b165934f191b62afc9f8e1140dd31ce859d979"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x7f, 0x0, 0x4}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xfe, 0x5, 0x2}, @wireless={0xb, 0x10, 0x1, 0xc, 0x21, 0x40, 0x8, 0x1000, 0xe}]}}, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x3, 0x5, 0x8, '[?\tu', "124af7e4"}}, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2, 0x1, 0x85, 0xf, 0x2, 0x7, 0x2}}}, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3, 0xb0, "d96dcabed347903696081fd06fdb4fd30c71e910908b82a6d92e1674efd77c970a0c4ce9296c846217406dd4ffa5e754f274a733fce8acc6b4c1ba2038156bd6ea92a3767378c017e74f5efb8d4336ad37140481fe6fdb825902c617b82200018dd4944367a602fd93883756ddffbdd3b9d13f58e14aae3d94fc0c7e7b2b4c55de8ad731c15f0a87db87fa1f83faac0d267a97061ae61ef02db01e1ce84cccb44d45ffcb0af620d9dc5ecef1026137fc"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2d}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f00000008c0)=0x100000001, 0x76dc) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000b40)={{r2}, &(0x7f0000000a00), &(0x7f0000000a40)='%ps \x00'}, 0x20) connect$inet6(0xffffffffffffffff, &(0x7f0000000900), 0x1c) r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_CONFIG(r3, &(0x7f0000000940)={0x0, 0xfffffffffffffede, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x40800}, 0x4000) write$UHID_INPUT(r3, &(0x7f0000000cc0)={0x8, {"e7652111f65d380b5592b9292602d63feb1c92be7fdd0f4f066c79fd2f9da87f6c8bb2419b329305604976e49a5da38d209e833a88ed8e64927a24506b90af9ff01fdbd79eef4ddc837a7b57cb924977c99c5b8efd4a8ea14aabc5b84352a6fc71d1c358c27d94c11f5bb6294fc962934f59b47949799169eef4236c725bfe7acb0d96d3652bff72462ce3243b351d65f56e345819d4c2a159216f009b80b5d90364ec0dc1987061f3c6d99a1f58baac16d6e2b69b8f18703b5354223b0132ff59cd8901f64e7daa30b272bd3664a0f9f8209e936ea9566be2edb4ad8651e6ff2e8ba6b3df912d96755594b38482e31c8675c363f534004e441d222954dc9c3432b3d9899e9e5996735d7fd423084eea4b811f5742f15b0cad9081e3afaa28d11966f57d97d4b5e019b5ffdc760df539c366308b2689645c11e7137cd6cd710e3e521940d6a81f41e641b5449ad226c9345215f357562251ae7669a9bff29f7ccd6cf4fe8623eb8ed2b1bc9cea800a75c0863b4ada75d30d15a123945689ea6f3c59ef0e0f7be6f01e4accba226a28f169598949da084228d174ac7d7a7c16fac8fdcecd7a7e4d54e81786fe7990ac50f9d39b32163f98e40937d79ae2c9f4116cc75d6e03389aa76e0fca44c58d93e32cdad8d44719cbb59efeee1da41234dd76599deb724947bde2a4f6b82fc3669ebfde5eacc0312c0473f6342830d37f13ea066bc13777eab41ed37358350bf3295e575ff17c27b07a4f7c6953f1172d8025125da352652388bbbf165343a403faa171acb23732626b78595216a8e6aa5a4579fa24e8eadf378aecd269f35e327b228458efb25d143a30a29c7e31884e0d2e55640c51906178e3689f90ac95318a99602b74db9572f1fa4caeec399200770072c7d67c6d7b34568b85bef1f9170b0ec09378fb9ee0796a439b384ad20918104430273828e4c6a34ccc770fc4f3e097248ccc18092098ffadcfca51208d1e22bc2b5eb0aa01b840c0602763455c436a2141a7e894a2899c917b3c9fc4085ef0c3ad3e00468b12e281232a53c2772a4baab1b6c034eba1df52a49138e59d6a02aceb1f45319220ca4d915381ea7f96e9cdbd065150e7260773f6af5a670b4df6e758563ff9d2e12cc239a0b7921125a0c3a5cc4da8d00676706c9da529a4318548258c4465c8d8c10c0cd7998b0331cf09ddef59e8382354ac1527458f92652efc0ef78e0cf38898b076c0877f72998e4eada6fdac9d0f08654c4e3ad4664bf18eddc24891768ba6f92925f92fccc3de31fdee60e1ca8c1b6a085b8b6307555e280069211bdfc7ba1f87350b719b3d6b2638877e5b79933c0cf68c69af40c04c8c2312ef0397f349bc4aba4b5c954da45d0705d483b716596455b6b14eb5999c5a2f5122ce85c0d4694c9ea6c7b571b7790c8846436f5d878eff9ea669bc40281a782c350e88d4b866501d22e536963e9ede015ede169c58a2e7731c75fbec5e473bc03fecf85636d1b7bc3dee4a3827cfbca0700baf71e01be0deb3ec6f877f3dae17159466b3aa6c289c610bc8640fe4f5e5bd71693ccff5353caa189eed373aca1566439d57f7c8054b3338b9f1bc8eed8a1e3f864304010367d8b4ff98acebf1ff0c213558ce1fb990f33dce08bd9e4114f4abfdefe4f90fd10ba389113cd856e6d83f195478eed3fbb9bddf2adab718b3c736560f69579eb9be597ec993cf328918e0d35dfcdb9ca2219b3ada217700ffa862f49140f8a8834d4bd395c06b3384734fb70ea1df2247afc85ac45930d22bef0248ef046fa19770b0e0c5b6e8a145b02b0912a954060e6299495465b4e6903556a688818831a23daf0358536afc8eab6096565cb8ca4bb978b8650e9fee2455e27694e8b10d5780454c3bfbd50dbce6fb1e92f2034533a02b16ba3230f46e4c013546064efd6182fe76cb10fb033a164f9134896048b7272aae88baf4411c654e69a4caed7760b23e86b0d815e52d84f120b3053ea1bbf9e9d9a05b51b73ea8dd27acc83bbd5eba976e5451e22a8679bd83befcf1d0a85d0fd5581a1ac8afce11626e018e15188b4c230d26e9aea6bfbabeeebfdf17253831f30c1740753035b5efdcc3492ad77788e62b69fe3949901fed9b8a691ea2b2190eb2c6bd5993653ddbd378aa3badaab71eb8ec5a9af346cec9020f8ca4ad080bee4bebee701fa12abe451fa0e070bea35a96e089c7d594cd49f044cc427cfed3fca7b55a70d0126376f0bab16f7b996e1255c03df011f2daa34afe3450b41f35b704b4085e53005559a621f1a2eb9d5d6c3ed5aa5d297dd4d5edac566c2046b895b46aeefc62182debe9d671d4652c22160cd0f6b580095ea59f7581a9b44efd76ae7f95b65539346201cee61d55a7687158dd0a69cdd30f90d118f1d71e6a82fb7e3947c8e7f7e3f953b3312e7bc1fcfc0c93e52f2ff26b685a3606d94851443de09c1473cce546fdc3efc347efd938c99ff7094081516b0ebdfb7cd91d154691a4caab132ef48d0ed2959a3a2a463c2a4b8a1ca432d37e9254c24ba6f56b89e2f86f040d612a9cde3359ad45620686d5821b1d7888ff7488bb21bb42020bf87e7c0de1887037895e89e9ed4f8fc8d268bc13e9dee320ca7218cfdcf91f43f3326b859269e0133bcaa7b9a0cbc065fffb6dec564d0f7f096802fa27000485e7b1d2f3bb3b927f235d5776ddf9aacf4910e81e667da8c2af8348a2a0bc8ddee58825acbf1a0a627ff38d5183d929fa9b3872848c519c5157c65505141abe80be23a389d279b5ce095596201652591ce04d0b793c81df36891783b3fce855a57085b701d402957e5c103247ae668c86d7f516f68241f8be06fa0302917e41d9b3d825f1af48e95f7817d7f8b9db93b4849be386f4318deb784c0bc4654398391b94456553cc734336ec94e3d76431428e9708e21dabcd1be88b9e1271d27e93fa92edc3904eae3dee514b044b93b98af224e77b472a188f2524e9f2079002a9d7842f7a6d7d4421fb9eeac20b8aa3d761ab1ec62086afaedd3dd9335e4dd3cc534be65c5d75ee393d4f87a3db98bea8e07d925bbb91cf60c914a223b85af77dccf1c6438e37900c389f3ef9111c56fbf03b48629dd00de505c9f1c1a138f85fb19fed7ae2e052f2aafde747a700b71becfdf94ee7fcf68aa4f701ed8c369812b195b8fa769e9a0c2273edf588621577bc7c55aeb7550bf323fc85b4f163b589fd8574abacd77a2c2107c8e91fe626aa4a0cb62f5a7c1bf8f04a2fc8d0d74516b002d42a4fdb2970e5cbff3cf2e104943628282a9483bfdeab90239abc20b5767f6e341c55ea901419ab7a615a61acb65c998af603129f194bac4dc7dd69a8001c96ee938e751fa69ef8b9832d31d63ed4220f4c1e9f50c3b45060366801f52db95a1b23d481b04c8d10978778c05459a1d56604d4e57463c2f97042e5dda3b7265c8b74e32bc959be52fe8f734822cae58905af2172575a7e516f1bf3315f492d5cc1dacc7de448afad83918c629df85a1f8c43c8f15f5b5aadf80f47ac859fcdbef1b48a7a7c1ae7fb6ddfe73706e2229ab41e771f6149906a158eb11540fb00e12914c9c1b88ae6b04e098d1a5d50c1700901fd4829d2f2760cdd03dd67e4cdee9588a9104b254d876a461a2af42664bb7c10ab2e12b388687ffc254886741aed2afc2d29011befded8d10148a78d6b9664b65e4da8970e1dae0ce09b3a5f8f828a393fec71183022a506a2711e2d9bff1de2c51c6198f3a9bc1fc7c66af1d31988631891e387af4833389b9a4384c4c23c38cfa19d99d72c23095af6544eeb8e98f752822363b40dfdbcd69f6896dc0ed7d29ffcbbef7da745051f75f1f94e1503722c669453f968137aa59608c1f54c22e1617b2cc28689e0e1df5f2ef043417be9b8b72b9dabe150d3a70654661c601aac465ada452f8a1f2539deb4d2d4e8dd4356082b9ae9ce6327aa071131364844c6e5d7a6bd53d871f041867a0eefafeaece24f3bd4d0dabdb4ddbbf954e2c73d7d859f9bef1c4f74f77db33ca6bb1cb6f2af463a3426755e075e3bc043f16f9ce152381d24187592c934b6d2a413e042118ed87ac99ed706cdf30645856b46b2e5b65ae5626260eb75dde887ce306f296cbeee8d4664f2e6af00cb5ba01afb441ce6d7708e17d3e3ef585011c2f3f8de92225fb5b645528e7e6a06adb1e876859c0af29b6e0f01d4db257f9f842ccaa16648bea35ae7372b7337f6b4c51c5e6122127d2948a3599f7c7b9bc3c11c1170f66212c8b9d21d1058a234b9cfc6aa4650cf2d1aee961c2436b14bbe7bc2a7d4fdd810b398972d19926e5ca99a5bd997ffb5ae62a9eb58e957580a513e8df7231043c91f566ad76afe52de7ed52d7cf2b2de41ab9581c8e90560625ac713d47bc7f701ba83ea892e5c2e83965f406f3a2e121190ca9e3c040f1d9f36c0251a8465a20ac204d5667e1fe4920693151de23f5ab8ab6d40abb40aab5aeb137301ce5bf5028032e9cda705a0d20eeb8aac80d59bd0a115afe3ef0cf88740758e44f87146e7f3606cefa4e438ffde7d5957af3de0cbf7c4d3f35f6e19a5653c3372b0c4897c0acc91b408774c43ac3a834aad6683a9569604a457f339a1e887dfa4c17ab4f604d890d7913a17be1f888359493f98ffaba0e6f6276a4ff682a55e5fa198d2f291cffb94d8fad519e19a8a9a7a73fa94ff3140dd3239076055f7af5f4cc46549025b12ffd38fed61cc478bb0d8848c6f8ba6df4bb84a5e80cfc116a966ab690adf5777d29c910cb5c977272d81c222d146e90d09af683be2556a471eb391363dab79990264af172ed06c086ae0693d49c716dc4757bfa65ea0f642ff09c48f958c7b47fd6091c6a4afcddab17e54fb91f19c825ec424b9dc78ca07409f301cd504c88b0deb4d47b8cb32e42b254aa9640c0cd5ffb8d99b0aa4f15e9b693d165b95969bdac052745f2ad182e558661f6ede6d2c7c2ae560d311dcaaadb76b5510efba89eb5458bf9442028323c1a75125851bac74c7ea8b2881128062ec6c9f4db6f0f374749171fca86b1be3fbac8b6e61a0d1d070fd7a759d0e642c00c2329defe7696c506a30bc26725611825f418e92a6b5b17c4e2ab122e958fca63b9655295ec4f0a45b7e1750956c5cf935d884f876739b084ddcca318b1ffb2a59d2d56ade17279c1dc4e47db044df1d684098e697d28359bdb9696d5d642c7a24335c9f32ed4745a99e2433ce7335b2e8063b2b0d443103c1f4216cc2a156787555b514dc25b1baf3a74f3bb93a426eb141aca0a304901c08ec7e79f04d6991c7546b68e173531f9d6ca29eb90e40dbc3f6c1c8d5414fe56bad5f739ed251414e699fa1c73ad382cab86ebe9c892b82523cf7269e9e78f74cdfff09d1467b95078e4585f20b5159ffe969a5da6a309fcd3796118ae352e28e36d739dbdecba88428953bf355d947bc4126b021581292846b8834f38cc15f8a0b18430516178b36564567237d47ec930d4a39a642a23c3e3b42f50f54eb5bf35101bcaff40ef5cb286a53f30b4b96de66bd64bb26996f25eed207aabb4a60a47e1adc2c1091a382b242f4f896a512471e86b1f80d3cb00793be037f7ea691a32a6de64977dae01bf2e692a3e0e0c20f76bd9893ef22189a469b9f21e6d41af5d6fdba83d7edd3a4eeed2639a5683f3436bcea815a2ed3ce111c824528ca13c5fb0c99e1b918056a59823d0fd2a1e1ac105d2d4d4f51a53cdf5a3b2325fff83ca73039c6dc295b9e2840bfb2ab89c63f05ab32eefc6bc5", 0x1000}}, 0x1006) program crashed: KASAN: use-after-free Read in bcmp single: successfully extracted reproducer found reproducer with 17 syscalls minimizing guilty program testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-bpf$BPF_PROG_WITH_BTFID_LOAD-bpf$ITER_CREATE-close-bpf$BPF_PROG_TEST_RUN-bpf$BPF_GET_MAP_INFO-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-setsockopt$inet6_tcp_int-bpf$MAP_UPDATE_CONST_STR-connect$inet6-fcntl$dupfd-sendmsg$IPVS_CMD_GET_CONFIG detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000002700)=@bpf_lsm={0x6, 0x3, &(0x7f00000027c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000002800)='GPL\x00'}, 0x80) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000002840)={r1}, 0x8) close(r2) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000002880)={r1, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000002900)={r2, 0x58, &(0x7f0000002940)}, 0x10) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)={0x40, 0x1e, 0x1, 0xe}, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0x40, 0x1a, 0x2, 0x378}, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f00000002c0)={0x2c, &(0x7f00000000c0)={0x20, 0x22, 0x3c, {0x3c, 0xd, "4b91bd7553546350b5a572e40017c8b2452740595399db4749630e63ec208ae1ceeef6464e980ee055e63064b0749512fbdda0ae994fe6283cbd"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x403}}, &(0x7f0000000180)={0x0, 0xf, 0x7e, {0x5, 0xf, 0x7e, 0x4, [@generic={0x5a, 0x10, 0xb, "f14c5f470dc2fadb60be012fed4038429a98aa7fbe690701c95945161d1c9ff99644a301d383c4e3b174d71c34613181d8446196871478b3e6e6a63f548865a1a8104bf7b165934f191b62afc9f8e1140dd31ce859d979"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x7f, 0x0, 0x4}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xfe, 0x5, 0x2}, @wireless={0xb, 0x10, 0x1, 0xc, 0x21, 0x40, 0x8, 0x1000, 0xe}]}}, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x3, 0x5, 0x8, '[?\tu', "124af7e4"}}, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2, 0x1, 0x85, 0xf, 0x2, 0x7, 0x2}}}, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3, 0xb0, "d96dcabed347903696081fd06fdb4fd30c71e910908b82a6d92e1674efd77c970a0c4ce9296c846217406dd4ffa5e754f274a733fce8acc6b4c1ba2038156bd6ea92a3767378c017e74f5efb8d4336ad37140481fe6fdb825902c617b82200018dd4944367a602fd93883756ddffbdd3b9d13f58e14aae3d94fc0c7e7b2b4c55de8ad731c15f0a87db87fa1f83faac0d267a97061ae61ef02db01e1ce84cccb44d45ffcb0af620d9dc5ecef1026137fc"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2d}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f00000008c0)=0x100000001, 0x76dc) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000b40)={{r2}, &(0x7f0000000a00), &(0x7f0000000a40)='%ps \x00'}, 0x20) connect$inet6(0xffffffffffffffff, &(0x7f0000000900), 0x1c) r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_CONFIG(r3, &(0x7f0000000940)={0x0, 0xfffffffffffffede, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x40800}, 0x4000) program crashed: KASAN: use-after-free Read in bcmp testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-bpf$BPF_PROG_WITH_BTFID_LOAD-bpf$ITER_CREATE-close-bpf$BPF_PROG_TEST_RUN-bpf$BPF_GET_MAP_INFO-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-setsockopt$inet6_tcp_int-bpf$MAP_UPDATE_CONST_STR-connect$inet6-fcntl$dupfd detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000002700)=@bpf_lsm={0x6, 0x3, &(0x7f00000027c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000002800)='GPL\x00'}, 0x80) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000002840)={r1}, 0x8) close(r2) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000002880)={r1, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000002900)={r2, 0x58, &(0x7f0000002940)}, 0x10) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)={0x40, 0x1e, 0x1, 0xe}, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0x40, 0x1a, 0x2, 0x378}, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f00000002c0)={0x2c, &(0x7f00000000c0)={0x20, 0x22, 0x3c, {0x3c, 0xd, "4b91bd7553546350b5a572e40017c8b2452740595399db4749630e63ec208ae1ceeef6464e980ee055e63064b0749512fbdda0ae994fe6283cbd"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x403}}, &(0x7f0000000180)={0x0, 0xf, 0x7e, {0x5, 0xf, 0x7e, 0x4, [@generic={0x5a, 0x10, 0xb, "f14c5f470dc2fadb60be012fed4038429a98aa7fbe690701c95945161d1c9ff99644a301d383c4e3b174d71c34613181d8446196871478b3e6e6a63f548865a1a8104bf7b165934f191b62afc9f8e1140dd31ce859d979"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x7f, 0x0, 0x4}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xfe, 0x5, 0x2}, @wireless={0xb, 0x10, 0x1, 0xc, 0x21, 0x40, 0x8, 0x1000, 0xe}]}}, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x3, 0x5, 0x8, '[?\tu', "124af7e4"}}, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2, 0x1, 0x85, 0xf, 0x2, 0x7, 0x2}}}, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3, 0xb0, "d96dcabed347903696081fd06fdb4fd30c71e910908b82a6d92e1674efd77c970a0c4ce9296c846217406dd4ffa5e754f274a733fce8acc6b4c1ba2038156bd6ea92a3767378c017e74f5efb8d4336ad37140481fe6fdb825902c617b82200018dd4944367a602fd93883756ddffbdd3b9d13f58e14aae3d94fc0c7e7b2b4c55de8ad731c15f0a87db87fa1f83faac0d267a97061ae61ef02db01e1ce84cccb44d45ffcb0af620d9dc5ecef1026137fc"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2d}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f00000008c0)=0x100000001, 0x76dc) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000b40)={{r2}, &(0x7f0000000a00), &(0x7f0000000a40)='%ps \x00'}, 0x20) connect$inet6(0xffffffffffffffff, &(0x7f0000000900), 0x1c) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) program crashed: KASAN: use-after-free Read in bcmp testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-bpf$BPF_PROG_WITH_BTFID_LOAD-bpf$ITER_CREATE-close-bpf$BPF_PROG_TEST_RUN-bpf$BPF_GET_MAP_INFO-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-setsockopt$inet6_tcp_int-bpf$MAP_UPDATE_CONST_STR-connect$inet6 detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000002700)=@bpf_lsm={0x6, 0x3, &(0x7f00000027c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000002800)='GPL\x00'}, 0x80) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000002840)={r1}, 0x8) close(r2) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000002880)={r1, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000002900)={r2, 0x58, &(0x7f0000002940)}, 0x10) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)={0x40, 0x1e, 0x1, 0xe}, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0x40, 0x1a, 0x2, 0x378}, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f00000002c0)={0x2c, &(0x7f00000000c0)={0x20, 0x22, 0x3c, {0x3c, 0xd, "4b91bd7553546350b5a572e40017c8b2452740595399db4749630e63ec208ae1ceeef6464e980ee055e63064b0749512fbdda0ae994fe6283cbd"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x403}}, &(0x7f0000000180)={0x0, 0xf, 0x7e, {0x5, 0xf, 0x7e, 0x4, [@generic={0x5a, 0x10, 0xb, "f14c5f470dc2fadb60be012fed4038429a98aa7fbe690701c95945161d1c9ff99644a301d383c4e3b174d71c34613181d8446196871478b3e6e6a63f548865a1a8104bf7b165934f191b62afc9f8e1140dd31ce859d979"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x7f, 0x0, 0x4}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xfe, 0x5, 0x2}, @wireless={0xb, 0x10, 0x1, 0xc, 0x21, 0x40, 0x8, 0x1000, 0xe}]}}, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x3, 0x5, 0x8, '[?\tu', "124af7e4"}}, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2, 0x1, 0x85, 0xf, 0x2, 0x7, 0x2}}}, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3, 0xb0, "d96dcabed347903696081fd06fdb4fd30c71e910908b82a6d92e1674efd77c970a0c4ce9296c846217406dd4ffa5e754f274a733fce8acc6b4c1ba2038156bd6ea92a3767378c017e74f5efb8d4336ad37140481fe6fdb825902c617b82200018dd4944367a602fd93883756ddffbdd3b9d13f58e14aae3d94fc0c7e7b2b4c55de8ad731c15f0a87db87fa1f83faac0d267a97061ae61ef02db01e1ce84cccb44d45ffcb0af620d9dc5ecef1026137fc"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2d}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f00000008c0)=0x100000001, 0x76dc) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000b40)={{r2}, &(0x7f0000000a00), &(0x7f0000000a40)='%ps \x00'}, 0x20) connect$inet6(0xffffffffffffffff, &(0x7f0000000900), 0x1c) program crashed: KASAN: use-after-free Read in bcmp testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-bpf$BPF_PROG_WITH_BTFID_LOAD-bpf$ITER_CREATE-close-bpf$BPF_PROG_TEST_RUN-bpf$BPF_GET_MAP_INFO-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-setsockopt$inet6_tcp_int-bpf$MAP_UPDATE_CONST_STR detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000002700)=@bpf_lsm={0x6, 0x3, &(0x7f00000027c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000002800)='GPL\x00'}, 0x80) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000002840)={r1}, 0x8) close(r2) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000002880)={r1, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000002900)={r2, 0x58, &(0x7f0000002940)}, 0x10) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)={0x40, 0x1e, 0x1, 0xe}, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0x40, 0x1a, 0x2, 0x378}, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f00000002c0)={0x2c, &(0x7f00000000c0)={0x20, 0x22, 0x3c, {0x3c, 0xd, "4b91bd7553546350b5a572e40017c8b2452740595399db4749630e63ec208ae1ceeef6464e980ee055e63064b0749512fbdda0ae994fe6283cbd"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x403}}, &(0x7f0000000180)={0x0, 0xf, 0x7e, {0x5, 0xf, 0x7e, 0x4, [@generic={0x5a, 0x10, 0xb, "f14c5f470dc2fadb60be012fed4038429a98aa7fbe690701c95945161d1c9ff99644a301d383c4e3b174d71c34613181d8446196871478b3e6e6a63f548865a1a8104bf7b165934f191b62afc9f8e1140dd31ce859d979"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x7f, 0x0, 0x4}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xfe, 0x5, 0x2}, @wireless={0xb, 0x10, 0x1, 0xc, 0x21, 0x40, 0x8, 0x1000, 0xe}]}}, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x3, 0x5, 0x8, '[?\tu', "124af7e4"}}, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2, 0x1, 0x85, 0xf, 0x2, 0x7, 0x2}}}, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3, 0xb0, "d96dcabed347903696081fd06fdb4fd30c71e910908b82a6d92e1674efd77c970a0c4ce9296c846217406dd4ffa5e754f274a733fce8acc6b4c1ba2038156bd6ea92a3767378c017e74f5efb8d4336ad37140481fe6fdb825902c617b82200018dd4944367a602fd93883756ddffbdd3b9d13f58e14aae3d94fc0c7e7b2b4c55de8ad731c15f0a87db87fa1f83faac0d267a97061ae61ef02db01e1ce84cccb44d45ffcb0af620d9dc5ecef1026137fc"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2d}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f00000008c0)=0x100000001, 0x76dc) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000b40)={{r2}, &(0x7f0000000a00), &(0x7f0000000a40)='%ps \x00'}, 0x20) program crashed: KASAN: use-after-free Read in bcmp testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-bpf$BPF_PROG_WITH_BTFID_LOAD-bpf$ITER_CREATE-close-bpf$BPF_PROG_TEST_RUN-bpf$BPF_GET_MAP_INFO-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-setsockopt$inet6_tcp_int detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000002700)=@bpf_lsm={0x6, 0x3, &(0x7f00000027c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000002800)='GPL\x00'}, 0x80) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000002840)={r1}, 0x8) close(r2) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000002880)={r1, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000002900)={r2, 0x58, &(0x7f0000002940)}, 0x10) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)={0x40, 0x1e, 0x1, 0xe}, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0x40, 0x1a, 0x2, 0x378}, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f00000002c0)={0x2c, &(0x7f00000000c0)={0x20, 0x22, 0x3c, {0x3c, 0xd, "4b91bd7553546350b5a572e40017c8b2452740595399db4749630e63ec208ae1ceeef6464e980ee055e63064b0749512fbdda0ae994fe6283cbd"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x403}}, &(0x7f0000000180)={0x0, 0xf, 0x7e, {0x5, 0xf, 0x7e, 0x4, [@generic={0x5a, 0x10, 0xb, "f14c5f470dc2fadb60be012fed4038429a98aa7fbe690701c95945161d1c9ff99644a301d383c4e3b174d71c34613181d8446196871478b3e6e6a63f548865a1a8104bf7b165934f191b62afc9f8e1140dd31ce859d979"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x7f, 0x0, 0x4}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xfe, 0x5, 0x2}, @wireless={0xb, 0x10, 0x1, 0xc, 0x21, 0x40, 0x8, 0x1000, 0xe}]}}, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x3, 0x5, 0x8, '[?\tu', "124af7e4"}}, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2, 0x1, 0x85, 0xf, 0x2, 0x7, 0x2}}}, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3, 0xb0, "d96dcabed347903696081fd06fdb4fd30c71e910908b82a6d92e1674efd77c970a0c4ce9296c846217406dd4ffa5e754f274a733fce8acc6b4c1ba2038156bd6ea92a3767378c017e74f5efb8d4336ad37140481fe6fdb825902c617b82200018dd4944367a602fd93883756ddffbdd3b9d13f58e14aae3d94fc0c7e7b2b4c55de8ad731c15f0a87db87fa1f83faac0d267a97061ae61ef02db01e1ce84cccb44d45ffcb0af620d9dc5ecef1026137fc"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2d}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f00000008c0)=0x100000001, 0x76dc) program crashed: KASAN: use-after-free Read in bcmp testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-bpf$BPF_PROG_WITH_BTFID_LOAD-bpf$ITER_CREATE-close-bpf$BPF_PROG_TEST_RUN-bpf$BPF_GET_MAP_INFO-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000002700)=@bpf_lsm={0x6, 0x3, &(0x7f00000027c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000002800)='GPL\x00'}, 0x80) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000002840)={r1}, 0x8) close(r2) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000002880)={r1, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000002900)={r2, 0x58, &(0x7f0000002940)}, 0x10) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)={0x40, 0x1e, 0x1, 0xe}, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0x40, 0x1a, 0x2, 0x378}, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f00000002c0)={0x2c, &(0x7f00000000c0)={0x20, 0x22, 0x3c, {0x3c, 0xd, "4b91bd7553546350b5a572e40017c8b2452740595399db4749630e63ec208ae1ceeef6464e980ee055e63064b0749512fbdda0ae994fe6283cbd"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x403}}, &(0x7f0000000180)={0x0, 0xf, 0x7e, {0x5, 0xf, 0x7e, 0x4, [@generic={0x5a, 0x10, 0xb, "f14c5f470dc2fadb60be012fed4038429a98aa7fbe690701c95945161d1c9ff99644a301d383c4e3b174d71c34613181d8446196871478b3e6e6a63f548865a1a8104bf7b165934f191b62afc9f8e1140dd31ce859d979"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x7f, 0x0, 0x4}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xfe, 0x5, 0x2}, @wireless={0xb, 0x10, 0x1, 0xc, 0x21, 0x40, 0x8, 0x1000, 0xe}]}}, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x3, 0x5, 0x8, '[?\tu', "124af7e4"}}, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2, 0x1, 0x85, 0xf, 0x2, 0x7, 0x2}}}, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3, 0xb0, "d96dcabed347903696081fd06fdb4fd30c71e910908b82a6d92e1674efd77c970a0c4ce9296c846217406dd4ffa5e754f274a733fce8acc6b4c1ba2038156bd6ea92a3767378c017e74f5efb8d4336ad37140481fe6fdb825902c617b82200018dd4944367a602fd93883756ddffbdd3b9d13f58e14aae3d94fc0c7e7b2b4c55de8ad731c15f0a87db87fa1f83faac0d267a97061ae61ef02db01e1ce84cccb44d45ffcb0af620d9dc5ecef1026137fc"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2d}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program crashed: KASAN: use-after-free Read in bcmp testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-bpf$BPF_PROG_WITH_BTFID_LOAD-bpf$ITER_CREATE-close-bpf$BPF_PROG_TEST_RUN-bpf$BPF_GET_MAP_INFO-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000002700)=@bpf_lsm={0x6, 0x3, &(0x7f00000027c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000002800)='GPL\x00'}, 0x80) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000002840)={r1}, 0x8) close(r2) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000002880)={r1, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000002900)={r2, 0x58, &(0x7f0000002940)}, 0x10) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)={0x40, 0x1e, 0x1, 0xe}, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0x40, 0x1a, 0x2, 0x378}, 0x0, 0x0, 0x0}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-bpf$BPF_PROG_WITH_BTFID_LOAD-bpf$ITER_CREATE-close-bpf$BPF_PROG_TEST_RUN-bpf$BPF_GET_MAP_INFO-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000002700)=@bpf_lsm={0x6, 0x3, &(0x7f00000027c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000002800)='GPL\x00'}, 0x80) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000002840)={r1}, 0x8) close(r2) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000002880)={r1, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000002900)={r2, 0x58, &(0x7f0000002940)}, 0x10) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)={0x40, 0x1e, 0x1, 0xe}, 0x0}) syz_usb_control_io(r0, &(0x7f00000002c0)={0x2c, &(0x7f00000000c0)={0x20, 0x22, 0x3c, {0x3c, 0xd, "4b91bd7553546350b5a572e40017c8b2452740595399db4749630e63ec208ae1ceeef6464e980ee055e63064b0749512fbdda0ae994fe6283cbd"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x403}}, &(0x7f0000000180)={0x0, 0xf, 0x7e, {0x5, 0xf, 0x7e, 0x4, [@generic={0x5a, 0x10, 0xb, "f14c5f470dc2fadb60be012fed4038429a98aa7fbe690701c95945161d1c9ff99644a301d383c4e3b174d71c34613181d8446196871478b3e6e6a63f548865a1a8104bf7b165934f191b62afc9f8e1140dd31ce859d979"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x7f, 0x0, 0x4}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xfe, 0x5, 0x2}, @wireless={0xb, 0x10, 0x1, 0xc, 0x21, 0x40, 0x8, 0x1000, 0xe}]}}, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x3, 0x5, 0x8, '[?\tu', "124af7e4"}}, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2, 0x1, 0x85, 0xf, 0x2, 0x7, 0x2}}}, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3, 0xb0, "d96dcabed347903696081fd06fdb4fd30c71e910908b82a6d92e1674efd77c970a0c4ce9296c846217406dd4ffa5e754f274a733fce8acc6b4c1ba2038156bd6ea92a3767378c017e74f5efb8d4336ad37140481fe6fdb825902c617b82200018dd4944367a602fd93883756ddffbdd3b9d13f58e14aae3d94fc0c7e7b2b4c55de8ad731c15f0a87db87fa1f83faac0d267a97061ae61ef02db01e1ce84cccb44d45ffcb0af620d9dc5ecef1026137fc"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2d}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-bpf$BPF_PROG_WITH_BTFID_LOAD-bpf$ITER_CREATE-close-bpf$BPF_PROG_TEST_RUN-bpf$BPF_GET_MAP_INFO-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000002700)=@bpf_lsm={0x6, 0x3, &(0x7f00000027c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000002800)='GPL\x00'}, 0x80) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000002840)={r1}, 0x8) close(r2) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000002880)={r1, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000002900)={r2, 0x58, &(0x7f0000002940)}, 0x10) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0x40, 0x1a, 0x2, 0x378}, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f00000002c0)={0x2c, &(0x7f00000000c0)={0x20, 0x22, 0x3c, {0x3c, 0xd, "4b91bd7553546350b5a572e40017c8b2452740595399db4749630e63ec208ae1ceeef6464e980ee055e63064b0749512fbdda0ae994fe6283cbd"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x403}}, &(0x7f0000000180)={0x0, 0xf, 0x7e, {0x5, 0xf, 0x7e, 0x4, [@generic={0x5a, 0x10, 0xb, "f14c5f470dc2fadb60be012fed4038429a98aa7fbe690701c95945161d1c9ff99644a301d383c4e3b174d71c34613181d8446196871478b3e6e6a63f548865a1a8104bf7b165934f191b62afc9f8e1140dd31ce859d979"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x7f, 0x0, 0x4}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xfe, 0x5, 0x2}, @wireless={0xb, 0x10, 0x1, 0xc, 0x21, 0x40, 0x8, 0x1000, 0xe}]}}, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x3, 0x5, 0x8, '[?\tu', "124af7e4"}}, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2, 0x1, 0x85, 0xf, 0x2, 0x7, 0x2}}}, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3, 0xb0, "d96dcabed347903696081fd06fdb4fd30c71e910908b82a6d92e1674efd77c970a0c4ce9296c846217406dd4ffa5e754f274a733fce8acc6b4c1ba2038156bd6ea92a3767378c017e74f5efb8d4336ad37140481fe6fdb825902c617b82200018dd4944367a602fd93883756ddffbdd3b9d13f58e14aae3d94fc0c7e7b2b4c55de8ad731c15f0a87db87fa1f83faac0d267a97061ae61ef02db01e1ce84cccb44d45ffcb0af620d9dc5ecef1026137fc"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2d}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-bpf$BPF_PROG_WITH_BTFID_LOAD-bpf$ITER_CREATE-close-bpf$BPF_PROG_TEST_RUN-bpf$BPF_GET_MAP_INFO-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000002700)=@bpf_lsm={0x6, 0x3, &(0x7f00000027c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000002800)='GPL\x00'}, 0x80) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000002840)={r1}, 0x8) close(r2) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000002880)={r1, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000002900)={r2, 0x58, &(0x7f0000002940)}, 0x10) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)={0x40, 0x1e, 0x1, 0xe}, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0x40, 0x1a, 0x2, 0x378}, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f00000002c0)={0x2c, &(0x7f00000000c0)={0x20, 0x22, 0x3c, {0x3c, 0xd, "4b91bd7553546350b5a572e40017c8b2452740595399db4749630e63ec208ae1ceeef6464e980ee055e63064b0749512fbdda0ae994fe6283cbd"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x403}}, &(0x7f0000000180)={0x0, 0xf, 0x7e, {0x5, 0xf, 0x7e, 0x4, [@generic={0x5a, 0x10, 0xb, "f14c5f470dc2fadb60be012fed4038429a98aa7fbe690701c95945161d1c9ff99644a301d383c4e3b174d71c34613181d8446196871478b3e6e6a63f548865a1a8104bf7b165934f191b62afc9f8e1140dd31ce859d979"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x7f, 0x0, 0x4}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xfe, 0x5, 0x2}, @wireless={0xb, 0x10, 0x1, 0xc, 0x21, 0x40, 0x8, 0x1000, 0xe}]}}, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x3, 0x5, 0x8, '[?\tu', "124af7e4"}}, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2, 0x1, 0x85, 0xf, 0x2, 0x7, 0x2}}}, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3, 0xb0, "d96dcabed347903696081fd06fdb4fd30c71e910908b82a6d92e1674efd77c970a0c4ce9296c846217406dd4ffa5e754f274a733fce8acc6b4c1ba2038156bd6ea92a3767378c017e74f5efb8d4336ad37140481fe6fdb825902c617b82200018dd4944367a602fd93883756ddffbdd3b9d13f58e14aae3d94fc0c7e7b2b4c55de8ad731c15f0a87db87fa1f83faac0d267a97061ae61ef02db01e1ce84cccb44d45ffcb0af620d9dc5ecef1026137fc"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2d}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-bpf$BPF_PROG_WITH_BTFID_LOAD-bpf$ITER_CREATE-close-bpf$BPF_PROG_TEST_RUN-bpf$BPF_GET_MAP_INFO-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000002700)=@bpf_lsm={0x6, 0x3, &(0x7f00000027c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000002800)='GPL\x00'}, 0x80) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000002840)={r1}, 0x8) close(r2) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000002880)={r1, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000002900)={r2, 0x58, &(0x7f0000002940)}, 0x10) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)={0x40, 0x1e, 0x1, 0xe}, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0x40, 0x1a, 0x2, 0x378}, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f00000002c0)={0x2c, &(0x7f00000000c0)={0x20, 0x22, 0x3c, {0x3c, 0xd, "4b91bd7553546350b5a572e40017c8b2452740595399db4749630e63ec208ae1ceeef6464e980ee055e63064b0749512fbdda0ae994fe6283cbd"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x403}}, &(0x7f0000000180)={0x0, 0xf, 0x7e, {0x5, 0xf, 0x7e, 0x4, [@generic={0x5a, 0x10, 0xb, "f14c5f470dc2fadb60be012fed4038429a98aa7fbe690701c95945161d1c9ff99644a301d383c4e3b174d71c34613181d8446196871478b3e6e6a63f548865a1a8104bf7b165934f191b62afc9f8e1140dd31ce859d979"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x7f, 0x0, 0x4}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xfe, 0x5, 0x2}, @wireless={0xb, 0x10, 0x1, 0xc, 0x21, 0x40, 0x8, 0x1000, 0xe}]}}, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x3, 0x5, 0x8, '[?\tu', "124af7e4"}}, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2, 0x1, 0x85, 0xf, 0x2, 0x7, 0x2}}}, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3, 0xb0, "d96dcabed347903696081fd06fdb4fd30c71e910908b82a6d92e1674efd77c970a0c4ce9296c846217406dd4ffa5e754f274a733fce8acc6b4c1ba2038156bd6ea92a3767378c017e74f5efb8d4336ad37140481fe6fdb825902c617b82200018dd4944367a602fd93883756ddffbdd3b9d13f58e14aae3d94fc0c7e7b2b4c55de8ad731c15f0a87db87fa1f83faac0d267a97061ae61ef02db01e1ce84cccb44d45ffcb0af620d9dc5ecef1026137fc"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2d}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-bpf$BPF_PROG_WITH_BTFID_LOAD-bpf$ITER_CREATE-close-bpf$BPF_PROG_TEST_RUN-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000002700)=@bpf_lsm={0x6, 0x3, &(0x7f00000027c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000002800)='GPL\x00'}, 0x80) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000002840)={r1}, 0x8) close(r2) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000002880)={r1, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)={0x40, 0x1e, 0x1, 0xe}, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0x40, 0x1a, 0x2, 0x378}, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f00000002c0)={0x2c, &(0x7f00000000c0)={0x20, 0x22, 0x3c, {0x3c, 0xd, "4b91bd7553546350b5a572e40017c8b2452740595399db4749630e63ec208ae1ceeef6464e980ee055e63064b0749512fbdda0ae994fe6283cbd"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x403}}, &(0x7f0000000180)={0x0, 0xf, 0x7e, {0x5, 0xf, 0x7e, 0x4, [@generic={0x5a, 0x10, 0xb, "f14c5f470dc2fadb60be012fed4038429a98aa7fbe690701c95945161d1c9ff99644a301d383c4e3b174d71c34613181d8446196871478b3e6e6a63f548865a1a8104bf7b165934f191b62afc9f8e1140dd31ce859d979"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x7f, 0x0, 0x4}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xfe, 0x5, 0x2}, @wireless={0xb, 0x10, 0x1, 0xc, 0x21, 0x40, 0x8, 0x1000, 0xe}]}}, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x3, 0x5, 0x8, '[?\tu', "124af7e4"}}, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2, 0x1, 0x85, 0xf, 0x2, 0x7, 0x2}}}, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3, 0xb0, "d96dcabed347903696081fd06fdb4fd30c71e910908b82a6d92e1674efd77c970a0c4ce9296c846217406dd4ffa5e754f274a733fce8acc6b4c1ba2038156bd6ea92a3767378c017e74f5efb8d4336ad37140481fe6fdb825902c617b82200018dd4944367a602fd93883756ddffbdd3b9d13f58e14aae3d94fc0c7e7b2b4c55de8ad731c15f0a87db87fa1f83faac0d267a97061ae61ef02db01e1ce84cccb44d45ffcb0af620d9dc5ecef1026137fc"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2d}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program crashed: KASAN: use-after-free Read in bcmp testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-bpf$BPF_PROG_WITH_BTFID_LOAD-bpf$ITER_CREATE-close-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000002700)=@bpf_lsm={0x6, 0x3, &(0x7f00000027c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000002800)='GPL\x00'}, 0x80) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000002840)={r1}, 0x8) close(r2) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)={0x40, 0x1e, 0x1, 0xe}, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0x40, 0x1a, 0x2, 0x378}, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f00000002c0)={0x2c, &(0x7f00000000c0)={0x20, 0x22, 0x3c, {0x3c, 0xd, "4b91bd7553546350b5a572e40017c8b2452740595399db4749630e63ec208ae1ceeef6464e980ee055e63064b0749512fbdda0ae994fe6283cbd"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x403}}, &(0x7f0000000180)={0x0, 0xf, 0x7e, {0x5, 0xf, 0x7e, 0x4, [@generic={0x5a, 0x10, 0xb, "f14c5f470dc2fadb60be012fed4038429a98aa7fbe690701c95945161d1c9ff99644a301d383c4e3b174d71c34613181d8446196871478b3e6e6a63f548865a1a8104bf7b165934f191b62afc9f8e1140dd31ce859d979"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x7f, 0x0, 0x4}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xfe, 0x5, 0x2}, @wireless={0xb, 0x10, 0x1, 0xc, 0x21, 0x40, 0x8, 0x1000, 0xe}]}}, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x3, 0x5, 0x8, '[?\tu', "124af7e4"}}, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2, 0x1, 0x85, 0xf, 0x2, 0x7, 0x2}}}, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3, 0xb0, "d96dcabed347903696081fd06fdb4fd30c71e910908b82a6d92e1674efd77c970a0c4ce9296c846217406dd4ffa5e754f274a733fce8acc6b4c1ba2038156bd6ea92a3767378c017e74f5efb8d4336ad37140481fe6fdb825902c617b82200018dd4944367a602fd93883756ddffbdd3b9d13f58e14aae3d94fc0c7e7b2b4c55de8ad731c15f0a87db87fa1f83faac0d267a97061ae61ef02db01e1ce84cccb44d45ffcb0af620d9dc5ecef1026137fc"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2d}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program crashed: KASAN: use-after-free Read in bcmp testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-bpf$BPF_PROG_WITH_BTFID_LOAD-bpf$ITER_CREATE-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000002700)=@bpf_lsm={0x6, 0x3, &(0x7f00000027c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000002800)='GPL\x00'}, 0x80) bpf$ITER_CREATE(0xb, &(0x7f0000002840)={r1}, 0x8) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)={0x40, 0x1e, 0x1, 0xe}, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0x40, 0x1a, 0x2, 0x378}, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f00000002c0)={0x2c, &(0x7f00000000c0)={0x20, 0x22, 0x3c, {0x3c, 0xd, "4b91bd7553546350b5a572e40017c8b2452740595399db4749630e63ec208ae1ceeef6464e980ee055e63064b0749512fbdda0ae994fe6283cbd"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x403}}, &(0x7f0000000180)={0x0, 0xf, 0x7e, {0x5, 0xf, 0x7e, 0x4, [@generic={0x5a, 0x10, 0xb, "f14c5f470dc2fadb60be012fed4038429a98aa7fbe690701c95945161d1c9ff99644a301d383c4e3b174d71c34613181d8446196871478b3e6e6a63f548865a1a8104bf7b165934f191b62afc9f8e1140dd31ce859d979"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x7f, 0x0, 0x4}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xfe, 0x5, 0x2}, @wireless={0xb, 0x10, 0x1, 0xc, 0x21, 0x40, 0x8, 0x1000, 0xe}]}}, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x3, 0x5, 0x8, '[?\tu', "124af7e4"}}, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2, 0x1, 0x85, 0xf, 0x2, 0x7, 0x2}}}, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3, 0xb0, "d96dcabed347903696081fd06fdb4fd30c71e910908b82a6d92e1674efd77c970a0c4ce9296c846217406dd4ffa5e754f274a733fce8acc6b4c1ba2038156bd6ea92a3767378c017e74f5efb8d4336ad37140481fe6fdb825902c617b82200018dd4944367a602fd93883756ddffbdd3b9d13f58e14aae3d94fc0c7e7b2b4c55de8ad731c15f0a87db87fa1f83faac0d267a97061ae61ef02db01e1ce84cccb44d45ffcb0af620d9dc5ecef1026137fc"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2d}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program crashed: KASAN: use-after-free Read in bcmp testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-bpf$BPF_PROG_WITH_BTFID_LOAD-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000002700)=@bpf_lsm={0x6, 0x3, &(0x7f00000027c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000002800)='GPL\x00'}, 0x80) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)={0x40, 0x1e, 0x1, 0xe}, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0x40, 0x1a, 0x2, 0x378}, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f00000002c0)={0x2c, &(0x7f00000000c0)={0x20, 0x22, 0x3c, {0x3c, 0xd, "4b91bd7553546350b5a572e40017c8b2452740595399db4749630e63ec208ae1ceeef6464e980ee055e63064b0749512fbdda0ae994fe6283cbd"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x403}}, &(0x7f0000000180)={0x0, 0xf, 0x7e, {0x5, 0xf, 0x7e, 0x4, [@generic={0x5a, 0x10, 0xb, "f14c5f470dc2fadb60be012fed4038429a98aa7fbe690701c95945161d1c9ff99644a301d383c4e3b174d71c34613181d8446196871478b3e6e6a63f548865a1a8104bf7b165934f191b62afc9f8e1140dd31ce859d979"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x7f, 0x0, 0x4}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xfe, 0x5, 0x2}, @wireless={0xb, 0x10, 0x1, 0xc, 0x21, 0x40, 0x8, 0x1000, 0xe}]}}, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x3, 0x5, 0x8, '[?\tu', "124af7e4"}}, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2, 0x1, 0x85, 0xf, 0x2, 0x7, 0x2}}}, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3, 0xb0, "d96dcabed347903696081fd06fdb4fd30c71e910908b82a6d92e1674efd77c970a0c4ce9296c846217406dd4ffa5e754f274a733fce8acc6b4c1ba2038156bd6ea92a3767378c017e74f5efb8d4336ad37140481fe6fdb825902c617b82200018dd4944367a602fd93883756ddffbdd3b9d13f58e14aae3d94fc0c7e7b2b4c55de8ad731c15f0a87db87fa1f83faac0d267a97061ae61ef02db01e1ce84cccb44d45ffcb0af620d9dc5ecef1026137fc"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2d}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program crashed: KASAN: use-after-free Read in bcmp testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)={0x40, 0x1e, 0x1, 0xe}, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0x40, 0x1a, 0x2, 0x378}, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f00000002c0)={0x2c, &(0x7f00000000c0)={0x20, 0x22, 0x3c, {0x3c, 0xd, "4b91bd7553546350b5a572e40017c8b2452740595399db4749630e63ec208ae1ceeef6464e980ee055e63064b0749512fbdda0ae994fe6283cbd"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x403}}, &(0x7f0000000180)={0x0, 0xf, 0x7e, {0x5, 0xf, 0x7e, 0x4, [@generic={0x5a, 0x10, 0xb, "f14c5f470dc2fadb60be012fed4038429a98aa7fbe690701c95945161d1c9ff99644a301d383c4e3b174d71c34613181d8446196871478b3e6e6a63f548865a1a8104bf7b165934f191b62afc9f8e1140dd31ce859d979"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x7f, 0x0, 0x4}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xfe, 0x5, 0x2}, @wireless={0xb, 0x10, 0x1, 0xc, 0x21, 0x40, 0x8, 0x1000, 0xe}]}}, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x3, 0x5, 0x8, '[?\tu', "124af7e4"}}, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2, 0x1, 0x85, 0xf, 0x2, 0x7, 0x2}}}, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3, 0xb0, "d96dcabed347903696081fd06fdb4fd30c71e910908b82a6d92e1674efd77c970a0c4ce9296c846217406dd4ffa5e754f274a733fce8acc6b4c1ba2038156bd6ea92a3767378c017e74f5efb8d4336ad37140481fe6fdb825902c617b82200018dd4944367a602fd93883756ddffbdd3b9d13f58e14aae3d94fc0c7e7b2b4c55de8ad731c15f0a87db87fa1f83faac0d267a97061ae61ef02db01e1ce84cccb44d45ffcb0af620d9dc5ecef1026137fc"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2d}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program crashed: KASAN: use-after-free Read in bcmp testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)={0x40, 0x1e, 0x1, 0xe}, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0x40, 0x1a, 0x2, 0x378}, 0x0, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, &(0x7f00000002c0)={0x2c, &(0x7f00000000c0)={0x20, 0x22, 0x3c, {0x3c, 0xd, "4b91bd7553546350b5a572e40017c8b2452740595399db4749630e63ec208ae1ceeef6464e980ee055e63064b0749512fbdda0ae994fe6283cbd"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x403}}, &(0x7f0000000180)={0x0, 0xf, 0x7e, {0x5, 0xf, 0x7e, 0x4, [@generic={0x5a, 0x10, 0xb, "f14c5f470dc2fadb60be012fed4038429a98aa7fbe690701c95945161d1c9ff99644a301d383c4e3b174d71c34613181d8446196871478b3e6e6a63f548865a1a8104bf7b165934f191b62afc9f8e1140dd31ce859d979"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x7f, 0x0, 0x4}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xfe, 0x5, 0x2}, @wireless={0xb, 0x10, 0x1, 0xc, 0x21, 0x40, 0x8, 0x1000, 0xe}]}}, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x3, 0x5, 0x8, '[?\tu', "124af7e4"}}, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2, 0x1, 0x85, 0xf, 0x2, 0x7, 0x2}}}, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3, 0xb0, "d96dcabed347903696081fd06fdb4fd30c71e910908b82a6d92e1674efd77c970a0c4ce9296c846217406dd4ffa5e754f274a733fce8acc6b4c1ba2038156bd6ea92a3767378c017e74f5efb8d4336ad37140481fe6fdb825902c617b82200018dd4944367a602fd93883756ddffbdd3b9d13f58e14aae3d94fc0c7e7b2b4c55de8ad731c15f0a87db87fa1f83faac0d267a97061ae61ef02db01e1ce84cccb44d45ffcb0af620d9dc5ecef1026137fc"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2d}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)={0x40, 0x1e, 0x1, 0xe}, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0x40, 0x1a, 0x2, 0x378}, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f00000002c0)={0x2c, &(0x7f00000000c0)={0x20, 0x22, 0x3c, {0x3c, 0xd, "4b91bd7553546350b5a572e40017c8b2452740595399db4749630e63ec208ae1ceeef6464e980ee055e63064b0749512fbdda0ae994fe6283cbd"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x403}}, &(0x7f0000000180)={0x0, 0xf, 0x7e, {0x5, 0xf, 0x7e, 0x4, [@generic={0x5a, 0x10, 0xb, "f14c5f470dc2fadb60be012fed4038429a98aa7fbe690701c95945161d1c9ff99644a301d383c4e3b174d71c34613181d8446196871478b3e6e6a63f548865a1a8104bf7b165934f191b62afc9f8e1140dd31ce859d979"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x7f, 0x0, 0x4}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xfe, 0x5, 0x2}, @wireless={0xb, 0x10, 0x1, 0xc, 0x21, 0x40, 0x8, 0x1000, 0xe}]}}, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x3, 0x5, 0x8, '[?\tu', "124af7e4"}}, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2, 0x1, 0x85, 0xf, 0x2, 0x7, 0x2}}}, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3, 0xb0, "d96dcabed347903696081fd06fdb4fd30c71e910908b82a6d92e1674efd77c970a0c4ce9296c846217406dd4ffa5e754f274a733fce8acc6b4c1ba2038156bd6ea92a3767378c017e74f5efb8d4336ad37140481fe6fdb825902c617b82200018dd4944367a602fd93883756ddffbdd3b9d13f58e14aae3d94fc0c7e7b2b4c55de8ad731c15f0a87db87fa1f83faac0d267a97061ae61ef02db01e1ce84cccb44d45ffcb0af620d9dc5ecef1026137fc"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2d}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)={0x40, 0x1e, 0x1, 0xe}, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0x40, 0x1a, 0x2, 0x378}, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f00000002c0)={0x2c, &(0x7f00000000c0)={0x20, 0x22, 0x3c, {0x3c, 0xd, "4b91bd7553546350b5a572e40017c8b2452740595399db4749630e63ec208ae1ceeef6464e980ee055e63064b0749512fbdda0ae994fe6283cbd"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x403}}, &(0x7f0000000180)={0x0, 0xf, 0x7e, {0x5, 0xf, 0x7e, 0x4, [@generic={0x5a, 0x10, 0xb, "f14c5f470dc2fadb60be012fed4038429a98aa7fbe690701c95945161d1c9ff99644a301d383c4e3b174d71c34613181d8446196871478b3e6e6a63f548865a1a8104bf7b165934f191b62afc9f8e1140dd31ce859d979"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x7f, 0x0, 0x4}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xfe, 0x5, 0x2}, @wireless={0xb, 0x10, 0x1, 0xc, 0x21, 0x40, 0x8, 0x1000, 0xe}]}}, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x3, 0x5, 0x8, '[?\tu', "124af7e4"}}, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2, 0x1, 0x85, 0xf, 0x2, 0x7, 0x2}}}, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3, 0xb0, "d96dcabed347903696081fd06fdb4fd30c71e910908b82a6d92e1674efd77c970a0c4ce9296c846217406dd4ffa5e754f274a733fce8acc6b4c1ba2038156bd6ea92a3767378c017e74f5efb8d4336ad37140481fe6fdb825902c617b82200018dd4944367a602fd93883756ddffbdd3b9d13f58e14aae3d94fc0c7e7b2b4c55de8ad731c15f0a87db87fa1f83faac0d267a97061ae61ef02db01e1ce84cccb44d45ffcb0af620d9dc5ecef1026137fc"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2d}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)={0x40, 0x1e, 0x1, 0xe}, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0x40, 0x1a, 0x2, 0x378}, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f00000002c0)={0x2c, &(0x7f00000000c0)={0x20, 0x22, 0x3c, {0x3c, 0xd, "4b91bd7553546350b5a572e40017c8b2452740595399db4749630e63ec208ae1ceeef6464e980ee055e63064b0749512fbdda0ae994fe6283cbd"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x403}}, &(0x7f0000000180)={0x0, 0xf, 0x7e, {0x5, 0xf, 0x7e, 0x4, [@generic={0x5a, 0x10, 0xb, "f14c5f470dc2fadb60be012fed4038429a98aa7fbe690701c95945161d1c9ff99644a301d383c4e3b174d71c34613181d8446196871478b3e6e6a63f548865a1a8104bf7b165934f191b62afc9f8e1140dd31ce859d979"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x7f, 0x0, 0x4}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xfe, 0x5, 0x2}, @wireless={0xb, 0x10, 0x1, 0xc, 0x21, 0x40, 0x8, 0x1000, 0xe}]}}, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x3, 0x5, 0x8, '[?\tu', "124af7e4"}}, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2, 0x1, 0x85, 0xf, 0x2, 0x7, 0x2}}}, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3, 0xb0, "d96dcabed347903696081fd06fdb4fd30c71e910908b82a6d92e1674efd77c970a0c4ce9296c846217406dd4ffa5e754f274a733fce8acc6b4c1ba2038156bd6ea92a3767378c017e74f5efb8d4336ad37140481fe6fdb825902c617b82200018dd4944367a602fd93883756ddffbdd3b9d13f58e14aae3d94fc0c7e7b2b4c55de8ad731c15f0a87db87fa1f83faac0d267a97061ae61ef02db01e1ce84cccb44d45ffcb0af620d9dc5ecef1026137fc"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2d}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)={0x40, 0x1e, 0x1, 0xe}, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0x40, 0x1a, 0x2, 0x378}, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f00000002c0)={0x2c, &(0x7f00000000c0)={0x20, 0x22, 0x3c, {0x3c, 0xd, "4b91bd7553546350b5a572e40017c8b2452740595399db4749630e63ec208ae1ceeef6464e980ee055e63064b0749512fbdda0ae994fe6283cbd"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x403}}, &(0x7f0000000180)={0x0, 0xf, 0x7e, {0x5, 0xf, 0x7e, 0x4, [@generic={0x5a, 0x10, 0xb, "f14c5f470dc2fadb60be012fed4038429a98aa7fbe690701c95945161d1c9ff99644a301d383c4e3b174d71c34613181d8446196871478b3e6e6a63f548865a1a8104bf7b165934f191b62afc9f8e1140dd31ce859d979"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x7f, 0x0, 0x4}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xfe, 0x5, 0x2}, @wireless={0xb, 0x10, 0x1, 0xc, 0x21, 0x40, 0x8, 0x1000, 0xe}]}}, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x3, 0x5, 0x8, '[?\tu', "124af7e4"}}, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2, 0x1, 0x85, 0xf, 0x2, 0x7, 0x2}}}, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3, 0xb0, "d96dcabed347903696081fd06fdb4fd30c71e910908b82a6d92e1674efd77c970a0c4ce9296c846217406dd4ffa5e754f274a733fce8acc6b4c1ba2038156bd6ea92a3767378c017e74f5efb8d4336ad37140481fe6fdb825902c617b82200018dd4944367a602fd93883756ddffbdd3b9d13f58e14aae3d94fc0c7e7b2b4c55de8ad731c15f0a87db87fa1f83faac0d267a97061ae61ef02db01e1ce84cccb44d45ffcb0af620d9dc5ecef1026137fc"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2d}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)={0x40, 0x1e, 0x1, 0xe}, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0x40, 0x1a, 0x2, 0x378}, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f00000002c0)={0x2c, &(0x7f00000000c0)={0x20, 0x22, 0x3c, {0x3c, 0xd, "4b91bd7553546350b5a572e40017c8b2452740595399db4749630e63ec208ae1ceeef6464e980ee055e63064b0749512fbdda0ae994fe6283cbd"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x403}}, &(0x7f0000000180)={0x0, 0xf, 0x7e, {0x5, 0xf, 0x7e, 0x4, [@generic={0x5a, 0x10, 0xb, "f14c5f470dc2fadb60be012fed4038429a98aa7fbe690701c95945161d1c9ff99644a301d383c4e3b174d71c34613181d8446196871478b3e6e6a63f548865a1a8104bf7b165934f191b62afc9f8e1140dd31ce859d979"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x7f, 0x0, 0x4}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xfe, 0x5, 0x2}, @wireless={0xb, 0x10, 0x1, 0xc, 0x21, 0x40, 0x8, 0x1000, 0xe}]}}, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x3, 0x5, 0x8, '[?\tu', "124af7e4"}}, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2, 0x1, 0x85, 0xf, 0x2, 0x7, 0x2}}}, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3, 0xb0, "d96dcabed347903696081fd06fdb4fd30c71e910908b82a6d92e1674efd77c970a0c4ce9296c846217406dd4ffa5e754f274a733fce8acc6b4c1ba2038156bd6ea92a3767378c017e74f5efb8d4336ad37140481fe6fdb825902c617b82200018dd4944367a602fd93883756ddffbdd3b9d13f58e14aae3d94fc0c7e7b2b4c55de8ad731c15f0a87db87fa1f83faac0d267a97061ae61ef02db01e1ce84cccb44d45ffcb0af620d9dc5ecef1026137fc"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2d}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0x40, 0x1a, 0x2, 0x378}, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f00000002c0)={0x2c, &(0x7f00000000c0)={0x20, 0x22, 0x3c, {0x3c, 0xd, "4b91bd7553546350b5a572e40017c8b2452740595399db4749630e63ec208ae1ceeef6464e980ee055e63064b0749512fbdda0ae994fe6283cbd"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x403}}, &(0x7f0000000180)={0x0, 0xf, 0x7e, {0x5, 0xf, 0x7e, 0x4, [@generic={0x5a, 0x10, 0xb, "f14c5f470dc2fadb60be012fed4038429a98aa7fbe690701c95945161d1c9ff99644a301d383c4e3b174d71c34613181d8446196871478b3e6e6a63f548865a1a8104bf7b165934f191b62afc9f8e1140dd31ce859d979"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x7f, 0x0, 0x4}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xfe, 0x5, 0x2}, @wireless={0xb, 0x10, 0x1, 0xc, 0x21, 0x40, 0x8, 0x1000, 0xe}]}}, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x3, 0x5, 0x8, '[?\tu', "124af7e4"}}, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2, 0x1, 0x85, 0xf, 0x2, 0x7, 0x2}}}, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3, 0xb0, "d96dcabed347903696081fd06fdb4fd30c71e910908b82a6d92e1674efd77c970a0c4ce9296c846217406dd4ffa5e754f274a733fce8acc6b4c1ba2038156bd6ea92a3767378c017e74f5efb8d4336ad37140481fe6fdb825902c617b82200018dd4944367a602fd93883756ddffbdd3b9d13f58e14aae3d94fc0c7e7b2b4c55de8ad731c15f0a87db87fa1f83faac0d267a97061ae61ef02db01e1ce84cccb44d45ffcb0af620d9dc5ecef1026137fc"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2d}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)={0x40, 0x1e, 0x1, 0xe}, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0x40, 0x1a, 0x2, 0x378}, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f00000002c0)={0x2c, &(0x7f00000000c0)={0x20, 0x22, 0x3c, {0x3c, 0xd, "4b91bd7553546350b5a572e40017c8b2452740595399db4749630e63ec208ae1ceeef6464e980ee055e63064b0749512fbdda0ae994fe6283cbd"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x403}}, &(0x7f0000000180)={0x0, 0xf, 0x7e, {0x5, 0xf, 0x7e, 0x4, [@generic={0x5a, 0x10, 0xb, "f14c5f470dc2fadb60be012fed4038429a98aa7fbe690701c95945161d1c9ff99644a301d383c4e3b174d71c34613181d8446196871478b3e6e6a63f548865a1a8104bf7b165934f191b62afc9f8e1140dd31ce859d979"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x7f, 0x0, 0x4}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xfe, 0x5, 0x2}, @wireless={0xb, 0x10, 0x1, 0xc, 0x21, 0x40, 0x8, 0x1000, 0xe}]}}, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x3, 0x5, 0x8, '[?\tu', "124af7e4"}}, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2, 0x1, 0x85, 0xf, 0x2, 0x7, 0x2}}}, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3, 0xb0, "d96dcabed347903696081fd06fdb4fd30c71e910908b82a6d92e1674efd77c970a0c4ce9296c846217406dd4ffa5e754f274a733fce8acc6b4c1ba2038156bd6ea92a3767378c017e74f5efb8d4336ad37140481fe6fdb825902c617b82200018dd4944367a602fd93883756ddffbdd3b9d13f58e14aae3d94fc0c7e7b2b4c55de8ad731c15f0a87db87fa1f83faac0d267a97061ae61ef02db01e1ce84cccb44d45ffcb0af620d9dc5ecef1026137fc"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2d}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)={0x40, 0x1e, 0x1, 0xe}, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0x40, 0x1a, 0x2, 0x378}, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f00000002c0)={0x2c, &(0x7f00000000c0)={0x20, 0x22, 0x3c, {0x3c, 0xd, "4b91bd7553546350b5a572e40017c8b2452740595399db4749630e63ec208ae1ceeef6464e980ee055e63064b0749512fbdda0ae994fe6283cbd"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x403}}, &(0x7f0000000180)={0x0, 0xf, 0x7e, {0x5, 0xf, 0x7e, 0x4, [@generic={0x5a, 0x10, 0xb, "f14c5f470dc2fadb60be012fed4038429a98aa7fbe690701c95945161d1c9ff99644a301d383c4e3b174d71c34613181d8446196871478b3e6e6a63f548865a1a8104bf7b165934f191b62afc9f8e1140dd31ce859d979"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x7f, 0x0, 0x4}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xfe, 0x5, 0x2}, @wireless={0xb, 0x10, 0x1, 0xc, 0x21, 0x40, 0x8, 0x1000, 0xe}]}}, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x3, 0x5, 0x8, '[?\tu', "124af7e4"}}, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2, 0x1, 0x85, 0xf, 0x2, 0x7, 0x2}}}, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3, 0xb0, "d96dcabed347903696081fd06fdb4fd30c71e910908b82a6d92e1674efd77c970a0c4ce9296c846217406dd4ffa5e754f274a733fce8acc6b4c1ba2038156bd6ea92a3767378c017e74f5efb8d4336ad37140481fe6fdb825902c617b82200018dd4944367a602fd93883756ddffbdd3b9d13f58e14aae3d94fc0c7e7b2b4c55de8ad731c15f0a87db87fa1f83faac0d267a97061ae61ef02db01e1ce84cccb44d45ffcb0af620d9dc5ecef1026137fc"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2d}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0x40, 0x1a, 0x2, 0x378}, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f00000002c0)={0x2c, &(0x7f00000000c0)={0x20, 0x22, 0x3c, {0x3c, 0xd, "4b91bd7553546350b5a572e40017c8b2452740595399db4749630e63ec208ae1ceeef6464e980ee055e63064b0749512fbdda0ae994fe6283cbd"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x403}}, &(0x7f0000000180)={0x0, 0xf, 0x7e, {0x5, 0xf, 0x7e, 0x4, [@generic={0x5a, 0x10, 0xb, "f14c5f470dc2fadb60be012fed4038429a98aa7fbe690701c95945161d1c9ff99644a301d383c4e3b174d71c34613181d8446196871478b3e6e6a63f548865a1a8104bf7b165934f191b62afc9f8e1140dd31ce859d979"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x7f, 0x0, 0x4}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xfe, 0x5, 0x2}, @wireless={0xb, 0x10, 0x1, 0xc, 0x21, 0x40, 0x8, 0x1000, 0xe}]}}, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x3, 0x5, 0x8, '[?\tu', "124af7e4"}}, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2, 0x1, 0x85, 0xf, 0x2, 0x7, 0x2}}}, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3, 0xb0, "d96dcabed347903696081fd06fdb4fd30c71e910908b82a6d92e1674efd77c970a0c4ce9296c846217406dd4ffa5e754f274a733fce8acc6b4c1ba2038156bd6ea92a3767378c017e74f5efb8d4336ad37140481fe6fdb825902c617b82200018dd4944367a602fd93883756ddffbdd3b9d13f58e14aae3d94fc0c7e7b2b4c55de8ad731c15f0a87db87fa1f83faac0d267a97061ae61ef02db01e1ce84cccb44d45ffcb0af620d9dc5ecef1026137fc"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2d}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program crashed: KASAN: use-after-free Read in bcmp testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000002c0)={0x2c, &(0x7f00000000c0)={0x20, 0x22, 0x3c, {0x3c, 0xd, "4b91bd7553546350b5a572e40017c8b2452740595399db4749630e63ec208ae1ceeef6464e980ee055e63064b0749512fbdda0ae994fe6283cbd"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x403}}, &(0x7f0000000180)={0x0, 0xf, 0x7e, {0x5, 0xf, 0x7e, 0x4, [@generic={0x5a, 0x10, 0xb, "f14c5f470dc2fadb60be012fed4038429a98aa7fbe690701c95945161d1c9ff99644a301d383c4e3b174d71c34613181d8446196871478b3e6e6a63f548865a1a8104bf7b165934f191b62afc9f8e1140dd31ce859d979"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x7f, 0x0, 0x4}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xfe, 0x5, 0x2}, @wireless={0xb, 0x10, 0x1, 0xc, 0x21, 0x40, 0x8, 0x1000, 0xe}]}}, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x3, 0x5, 0x8, '[?\tu', "124af7e4"}}, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2, 0x1, 0x85, 0xf, 0x2, 0x7, 0x2}}}, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3, 0xb0, "d96dcabed347903696081fd06fdb4fd30c71e910908b82a6d92e1674efd77c970a0c4ce9296c846217406dd4ffa5e754f274a733fce8acc6b4c1ba2038156bd6ea92a3767378c017e74f5efb8d4336ad37140481fe6fdb825902c617b82200018dd4944367a602fd93883756ddffbdd3b9d13f58e14aae3d94fc0c7e7b2b4c55de8ad731c15f0a87db87fa1f83faac0d267a97061ae61ef02db01e1ce84cccb44d45ffcb0af620d9dc5ecef1026137fc"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2d}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0x40, 0x1a, 0x2, 0x378}, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f00000002c0)={0x2c, &(0x7f00000000c0)={0x20, 0x22, 0x3c, {0x3c, 0xd, "4b91bd7553546350b5a572e40017c8b2452740595399db4749630e63ec208ae1ceeef6464e980ee055e63064b0749512fbdda0ae994fe6283cbd"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x403}}, &(0x7f0000000180)={0x0, 0xf, 0x7e, {0x5, 0xf, 0x7e, 0x4, [@generic={0x5a, 0x10, 0xb, "f14c5f470dc2fadb60be012fed4038429a98aa7fbe690701c95945161d1c9ff99644a301d383c4e3b174d71c34613181d8446196871478b3e6e6a63f548865a1a8104bf7b165934f191b62afc9f8e1140dd31ce859d979"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x7f, 0x0, 0x4}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xfe, 0x5, 0x2}, @wireless={0xb, 0x10, 0x1, 0xc, 0x21, 0x40, 0x8, 0x1000, 0xe}]}}, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x3, 0x5, 0x8, '[?\tu', "124af7e4"}}, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2, 0x1, 0x85, 0xf, 0x2, 0x7, 0x2}}}, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3, 0xb0, "d96dcabed347903696081fd06fdb4fd30c71e910908b82a6d92e1674efd77c970a0c4ce9296c846217406dd4ffa5e754f274a733fce8acc6b4c1ba2038156bd6ea92a3767378c017e74f5efb8d4336ad37140481fe6fdb825902c617b82200018dd4944367a602fd93883756ddffbdd3b9d13f58e14aae3d94fc0c7e7b2b4c55de8ad731c15f0a87db87fa1f83faac0d267a97061ae61ef02db01e1ce84cccb44d45ffcb0af620d9dc5ecef1026137fc"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2d}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f00000002c0)={0x2c, &(0x7f00000000c0)={0x20, 0x22, 0x3c, {0x3c, 0xd, "4b91bd7553546350b5a572e40017c8b2452740595399db4749630e63ec208ae1ceeef6464e980ee055e63064b0749512fbdda0ae994fe6283cbd"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x403}}, &(0x7f0000000180)={0x0, 0xf, 0x7e, {0x5, 0xf, 0x7e, 0x4, [@generic={0x5a, 0x10, 0xb, "f14c5f470dc2fadb60be012fed4038429a98aa7fbe690701c95945161d1c9ff99644a301d383c4e3b174d71c34613181d8446196871478b3e6e6a63f548865a1a8104bf7b165934f191b62afc9f8e1140dd31ce859d979"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x7f, 0x0, 0x4}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xfe, 0x5, 0x2}, @wireless={0xb, 0x10, 0x1, 0xc, 0x21, 0x40, 0x8, 0x1000, 0xe}]}}, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x3, 0x5, 0x8, '[?\tu', "124af7e4"}}, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2, 0x1, 0x85, 0xf, 0x2, 0x7, 0x2}}}, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3, 0xb0, "d96dcabed347903696081fd06fdb4fd30c71e910908b82a6d92e1674efd77c970a0c4ce9296c846217406dd4ffa5e754f274a733fce8acc6b4c1ba2038156bd6ea92a3767378c017e74f5efb8d4336ad37140481fe6fdb825902c617b82200018dd4944367a602fd93883756ddffbdd3b9d13f58e14aae3d94fc0c7e7b2b4c55de8ad731c15f0a87db87fa1f83faac0d267a97061ae61ef02db01e1ce84cccb44d45ffcb0af620d9dc5ecef1026137fc"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2d}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program crashed: KASAN: use-after-free Read in bcmp testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3, 0xb0, "d96dcabed347903696081fd06fdb4fd30c71e910908b82a6d92e1674efd77c970a0c4ce9296c846217406dd4ffa5e754f274a733fce8acc6b4c1ba2038156bd6ea92a3767378c017e74f5efb8d4336ad37140481fe6fdb825902c617b82200018dd4944367a602fd93883756ddffbdd3b9d13f58e14aae3d94fc0c7e7b2b4c55de8ad731c15f0a87db87fa1f83faac0d267a97061ae61ef02db01e1ce84cccb44d45ffcb0af620d9dc5ecef1026137fc"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2d}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program crashed: KASAN: use-after-free Read in bcmp testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, 0x0, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2d}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2d}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program crashed: KASAN: use-after-free Read in bcmp testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3}, 0x0, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program crashed: KASAN: use-after-free Read in bcmp testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3}, 0x0, 0x0, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program crashed: KASAN: use-after-free Read in bcmp testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3}, 0x0, 0x0, 0x0, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program crashed: KASAN: use-after-free Read in bcmp testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)={0x40, 0x7, 0x2}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program crashed: KASAN: use-after-free Read in bcmp testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program crashed: KASAN: use-after-free Read in bcmp testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)={0x40, 0xb, 0x2, "0e76"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program crashed: KASAN: use-after-free Read in bcmp testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program crashed: KASAN: use-after-free Read in bcmp testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={0x40, 0x13, 0x6, @local}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program crashed: KASAN: use-after-free Read in bcmp testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program crashed: KASAN: use-after-free Read in bcmp testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)={0x40, 0x19, 0x2, "df1f"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program crashed: KASAN: use-after-free Read in bcmp testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program crashed: KASAN: use-after-free Read in bcmp testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program crashed: KASAN: use-after-free Read in bcmp testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x4}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program crashed: KASAN: use-after-free Read in bcmp testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x3}}) program crashed: KASAN: use-after-free Read in bcmp testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: KASAN: use-after-free Read in bcmp extracting C reproducer testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io program crashed: KASAN: use-after-free Read in bcmp simplifying C reproducer testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io program crashed: KASAN: use-after-free Read in bcmp testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io program did not crash testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io program crashed: KASAN: use-after-free Read in bcmp testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io program crashed: KASAN: use-after-free Read in bcmp testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io program crashed: KASAN: use-after-free Read in bcmp testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io program crashed: KASAN: use-after-free Read in bcmp testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io program crashed: KASAN: use-after-free Read in bcmp testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: KASAN: use-after-free Read in bcmp validation run: crashed=true testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: KASAN: use-after-free Read in bcmp validation run: crashed=true testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000021404c052f040000000000010902240001000000010904000c020300030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000500)={0x0, 0x12, 0x4a, "99a3dfaa312282f9b62cd9ad54721569803d2ae82fff339730c6493fbe652cd657bd570be9cf8f4f4ea52b1a21df71fddde0c8fddd6b49b447ddf79b7bf7271b721c8e0ca34aac72ad2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: KASAN: use-after-free Read in bcmp validation run: crashed=true reproducing took 43m2.098889764s repro crashed as (corrupted=false): usb 3-1: config 0 interface 0 has no altsetting 0 usb 3-1: New USB device found, idVendor=054c, idProduct=042f, bcdDevice= 0.00 usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 usb 3-1: config 0 descriptor?? ================================================================== BUG: KASAN: use-after-free in memcmp lib/string.c:970 [inline] BUG: KASAN: use-after-free in bcmp+0x210/0x230 lib/string.c:991 Read of size 1 at addr ffff888110baf17a by task kworker/0:2/60 CPU: 0 PID: 60 Comm: kworker/0:2 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:88 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:427 [inline] kasan_report+0x10f/0x150 mm/kasan/report.c:444 __asan_report_load1_noabort+0x14/0x20 mm/kasan/report_generic.c:306 memcmp lib/string.c:970 [inline] bcmp+0x210/0x230 lib/string.c:991 sony_check_add_dev_list drivers/hid/hid-sony.c:2542 [inline] sony_check_add drivers/hid/hid-sony.c:2673 [inline] sony_input_configured+0x6a0/0x3900 drivers/hid/hid-sony.c:2752 hidinput_connect+0x1f4f/0x2cc0 drivers/hid/hid-input.c:2047 hid_connect+0x479/0xe30 drivers/hid/hid-core.c:2021 hid_hw_start+0xaa/0x130 drivers/hid/hid-core.c:2128 sony_probe+0x23c/0xcf0 drivers/hid/hid-sony.c:3024 hid_device_probe+0x28d/0x390 drivers/hid/hid-core.c:2363 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x27d/0x970 drivers/base/dd.c:595 __driver_probe_device+0x193/0x270 drivers/base/dd.c:755 driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785 __device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429 __device_attach+0x2b0/0x420 drivers/base/dd.c:979 device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489 device_add+0xaef/0xe90 drivers/base/core.c:3422 hid_add_device+0x349/0x4b0 drivers/hid/hid-core.c:2513 usbhid_probe+0xb93/0xf30 drivers/hid/usbhid/hid-core.c:1442 usb_probe_interface+0x60f/0xb20 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x27d/0x970 drivers/base/dd.c:595 __driver_probe_device+0x193/0x270 drivers/base/dd.c:755 driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785 __device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429 __device_attach+0x2b0/0x420 drivers/base/dd.c:979 device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489 device_add+0xaef/0xe90 drivers/base/core.c:3422 usb_set_configuration+0x1a01/0x1f70 drivers/usb/core/message.c:2223 usb_generic_driver_probe+0x91/0x150 drivers/usb/core/generic.c:238 usb_probe_device+0x143/0x250 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x27d/0x970 drivers/base/dd.c:595 __driver_probe_device+0x193/0x270 drivers/base/dd.c:755 driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785 __device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429 __device_attach+0x2b0/0x420 drivers/base/dd.c:979 device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489 device_add+0xaef/0xe90 drivers/base/core.c:3422 usb_new_device+0xa1f/0x1720 drivers/usb/core/hub.c:2643 hub_port_connect drivers/usb/core/hub.c:5560 [inline] hub_port_connect_change drivers/usb/core/hub.c:5700 [inline] port_event drivers/usb/core/hub.c:5866 [inline] hub_event+0x291b/0x43f0 drivers/usb/core/hub.c:5948 process_one_work+0x6c8/0xbb0 kernel/workqueue.c:2328 worker_thread+0xaa0/0x1250 kernel/workqueue.c:2475 kthread+0x3f5/0x4f0 kernel/kthread.c:337 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 Allocated by task 329: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:433 [inline] ____kasan_kmalloc mm/kasan/common.c:512 [inline] __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:521 kasan_kmalloc include/linux/kasan.h:227 [inline] __kmalloc_track_caller+0x13c/0x2c0 mm/slub.c:4959 alloc_dr drivers/base/devres.c:116 [inline] devm_kmalloc+0x50/0x150 drivers/base/devres.c:831 devm_kzalloc include/linux/device.h:210 [inline] sony_probe+0xfb/0xcf0 drivers/hid/hid-sony.c:2992 hid_device_probe+0x28d/0x390 drivers/hid/hid-core.c:2363 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x27d/0x970 drivers/base/dd.c:595 __driver_probe_device+0x193/0x270 drivers/base/dd.c:755 driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785 __device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429 __device_attach+0x2b0/0x420 drivers/base/dd.c:979 device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489 device_add+0xaef/0xe90 drivers/base/core.c:3422 hid_add_device+0x349/0x4b0 drivers/hid/hid-core.c:2513 usbhid_probe+0xb93/0xf30 drivers/hid/usbhid/hid-core.c:1442 usb_probe_interface+0x60f/0xb20 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x27d/0x970 drivers/base/dd.c:595 __driver_probe_device+0x193/0x270 drivers/base/dd.c:755 driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785 __device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429 __device_attach+0x2b0/0x420 drivers/base/dd.c:979 device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489 device_add+0xaef/0xe90 drivers/base/core.c:3422 usb_set_configuration+0x1a01/0x1f70 drivers/usb/core/message.c:2223 usb_generic_driver_probe+0x91/0x150 drivers/usb/core/generic.c:238 usb_probe_device+0x143/0x250 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x27d/0x970 drivers/base/dd.c:595 __driver_probe_device+0x193/0x270 drivers/base/dd.c:755 driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785 __device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429 __device_attach+0x2b0/0x420 drivers/base/dd.c:979 device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489 device_add+0xaef/0xe90 drivers/base/core.c:3422 usb_new_device+0xa1f/0x1720 drivers/usb/core/hub.c:2643 hub_port_connect drivers/usb/core/hub.c:5560 [inline] hub_port_connect_change drivers/usb/core/hub.c:5700 [inline] port_event drivers/usb/core/hub.c:5866 [inline] hub_event+0x291b/0x43f0 drivers/usb/core/hub.c:5948 process_one_work+0x6c8/0xbb0 kernel/workqueue.c:2328 worker_thread+0xaa0/0x1250 kernel/workqueue.c:2475 kthread+0x3f5/0x4f0 kernel/kthread.c:337 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 Freed by task 329: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4a/0x70 mm/kasan/common.c:45 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:365 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:373 kasan_slab_free include/linux/kasan.h:193 [inline] slab_free_hook mm/slub.c:1728 [inline] slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1754 slab_free mm/slub.c:3526 [inline] kfree+0xc4/0x270 mm/slub.c:4588 release_nodes+0xe8/0x220 drivers/base/devres.c:501 devres_release_all+0x148/0x1b0 drivers/base/devres.c:530 really_probe+0x346/0x970 drivers/base/dd.c:667 __driver_probe_device+0x193/0x270 drivers/base/dd.c:755 driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785 __device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429 __device_attach+0x2b0/0x420 drivers/base/dd.c:979 device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489 device_add+0xaef/0xe90 drivers/base/core.c:3422 hid_add_device+0x349/0x4b0 drivers/hid/hid-core.c:2513 usbhid_probe+0xb93/0xf30 drivers/hid/usbhid/hid-core.c:1442 usb_probe_interface+0x60f/0xb20 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x27d/0x970 drivers/base/dd.c:595 __driver_probe_device+0x193/0x270 drivers/base/dd.c:755 driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785 __device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429 __device_attach+0x2b0/0x420 drivers/base/dd.c:979 device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489 device_add+0xaef/0xe90 drivers/base/core.c:3422 usb_set_configuration+0x1a01/0x1f70 drivers/usb/core/message.c:2223 usb_generic_driver_probe+0x91/0x150 drivers/usb/core/generic.c:238 usb_probe_device+0x143/0x250 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x27d/0x970 drivers/base/dd.c:595 __driver_probe_device+0x193/0x270 drivers/base/dd.c:755 driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785 __device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429 __device_attach+0x2b0/0x420 drivers/base/dd.c:979 device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489 device_add+0xaef/0xe90 drivers/base/core.c:3422 usb_new_device+0xa1f/0x1720 drivers/usb/core/hub.c:2643 hub_port_connect drivers/usb/core/hub.c:5560 [inline] hub_port_connect_change drivers/usb/core/hub.c:5700 [inline] port_event drivers/usb/core/hub.c:5866 [inline] hub_event+0x291b/0x43f0 drivers/usb/core/hub.c:5948 process_one_work+0x6c8/0xbb0 kernel/workqueue.c:2328 worker_thread+0xaa0/0x1250 kernel/workqueue.c:2475 kthread+0x3f5/0x4f0 kernel/kthread.c:337 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 The buggy address belongs to the object at ffff888110baf000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 378 bytes inside of 1024-byte region [ffff888110baf000, ffff888110baf400) The buggy address belongs to the page: page:ffffea000442ea00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888110ba8800 pfn:0x110ba8 head:ffffea000442ea00 order:3 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head|zone=1) raw: 4000000000010200 0000000000000000 0000000100000001 ffff888100043080 raw: ffff888110ba8800 000000008010000f 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 103, ts 4289251507, free_ts 0 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x192/0x1b0 mm/page_alloc.c:2607 prep_new_page+0x1c/0x110 mm/page_alloc.c:2613 get_page_from_freelist+0x2c3a/0x2cd0 mm/page_alloc.c:4487 __alloc_pages+0x1a2/0x460 mm/page_alloc.c:5824 alloc_slab_page mm/slub.c:-1 [inline] allocate_slab mm/slub.c:1937 [inline] new_slab+0xa0/0x4d0 mm/slub.c:2000 ___slab_alloc+0x3ac/0x840 mm/slub.c:3033 __slab_alloc+0x49/0x90 mm/slub.c:3120 slab_alloc_node mm/slub.c:3211 [inline] slab_alloc mm/slub.c:3255 [inline] __kmalloc_track_caller+0x169/0x2c0 mm/slub.c:4954 kmalloc_reserve net/core/skbuff.c:357 [inline] __alloc_skb+0x210/0x730 net/core/skbuff.c:428 alloc_skb include/linux/skbuff.h:1183 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1182 [inline] netlink_sendmsg+0x611/0xb80 net/netlink/af_netlink.c:1898 sock_sendmsg_nosec net/socket.c:704 [inline] __sock_sendmsg net/socket.c:716 [inline] ____sys_sendmsg+0x5be/0x8f0 net/socket.c:2436 ___sys_sendmsg+0x236/0x2e0 net/socket.c:2490 __sys_sendmsg net/socket.c:2519 [inline] __do_sys_sendmsg net/socket.c:2528 [inline] __se_sys_sendmsg net/socket.c:2526 [inline] __x64_sys_sendmsg+0x201/0x2d0 net/socket.c:2526 x64_sys_call+0x4b/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 page_owner free stack trace missing Memory state around the buggy address: ffff888110baf000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888110baf080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888110baf100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888110baf180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888110baf200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== sony 0003:054C:042F.0002: can't set operational mode: step 3, ignoring sony 0003:054C:042F.0002: No inputs registered, leaving sony 0003:054C:042F.0002: hidraw0: USB HID v0.00 Joystick [HID 054c:042f] on usb-dummy_hcd.2-1/input0 sony 0003:054C:042F.0002: failed to claim input usb 3-1: USB disconnect, device number 4 usb 3-1: new high-speed USB device number 5 using dummy_hcd usb 3-1: config 0 interface 0 altsetting 12 endpoint 0x81 has an invalid bInterval 0, changing to 7 usb 3-1: config 0 interface 0 altsetting 12 endpoint 0x81 has invalid wMaxPacketSize 0 usb 3-1: config 0 interface 0 altsetting 12 has 1 endpoint descriptor, different from the interface descriptor's value: 2 usb 3-1: config 0 interface 0 has no altsetting 0 usb 3-1: New USB device found, idVendor=054c, idProduct=042f, bcdDevice= 0.00 usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 usb 3-1: config 0 descriptor?? sony 0003:054C:042F.0004: can't set operational mode: step 3, ignoring sony 0003:054C:042F.0004: No inputs registered, leaving sony 0003:054C:042F.0004: hidraw0: USB HID v0.00 Joystick [HID 054c:042f] on usb-dummy_hcd.2-1/input0 sony 0003:054C:042F.0004: failed to claim input final repro crashed as (corrupted=false): usb 3-1: config 0 interface 0 has no altsetting 0 usb 3-1: New USB device found, idVendor=054c, idProduct=042f, bcdDevice= 0.00 usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 usb 3-1: config 0 descriptor?? ================================================================== BUG: KASAN: use-after-free in memcmp lib/string.c:970 [inline] BUG: KASAN: use-after-free in bcmp+0x210/0x230 lib/string.c:991 Read of size 1 at addr ffff888110baf17a by task kworker/0:2/60 CPU: 0 PID: 60 Comm: kworker/0:2 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:88 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:427 [inline] kasan_report+0x10f/0x150 mm/kasan/report.c:444 __asan_report_load1_noabort+0x14/0x20 mm/kasan/report_generic.c:306 memcmp lib/string.c:970 [inline] bcmp+0x210/0x230 lib/string.c:991 sony_check_add_dev_list drivers/hid/hid-sony.c:2542 [inline] sony_check_add drivers/hid/hid-sony.c:2673 [inline] sony_input_configured+0x6a0/0x3900 drivers/hid/hid-sony.c:2752 hidinput_connect+0x1f4f/0x2cc0 drivers/hid/hid-input.c:2047 hid_connect+0x479/0xe30 drivers/hid/hid-core.c:2021 hid_hw_start+0xaa/0x130 drivers/hid/hid-core.c:2128 sony_probe+0x23c/0xcf0 drivers/hid/hid-sony.c:3024 hid_device_probe+0x28d/0x390 drivers/hid/hid-core.c:2363 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x27d/0x970 drivers/base/dd.c:595 __driver_probe_device+0x193/0x270 drivers/base/dd.c:755 driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785 __device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429 __device_attach+0x2b0/0x420 drivers/base/dd.c:979 device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489 device_add+0xaef/0xe90 drivers/base/core.c:3422 hid_add_device+0x349/0x4b0 drivers/hid/hid-core.c:2513 usbhid_probe+0xb93/0xf30 drivers/hid/usbhid/hid-core.c:1442 usb_probe_interface+0x60f/0xb20 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x27d/0x970 drivers/base/dd.c:595 __driver_probe_device+0x193/0x270 drivers/base/dd.c:755 driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785 __device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429 __device_attach+0x2b0/0x420 drivers/base/dd.c:979 device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489 device_add+0xaef/0xe90 drivers/base/core.c:3422 usb_set_configuration+0x1a01/0x1f70 drivers/usb/core/message.c:2223 usb_generic_driver_probe+0x91/0x150 drivers/usb/core/generic.c:238 usb_probe_device+0x143/0x250 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x27d/0x970 drivers/base/dd.c:595 __driver_probe_device+0x193/0x270 drivers/base/dd.c:755 driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785 __device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429 __device_attach+0x2b0/0x420 drivers/base/dd.c:979 device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489 device_add+0xaef/0xe90 drivers/base/core.c:3422 usb_new_device+0xa1f/0x1720 drivers/usb/core/hub.c:2643 hub_port_connect drivers/usb/core/hub.c:5560 [inline] hub_port_connect_change drivers/usb/core/hub.c:5700 [inline] port_event drivers/usb/core/hub.c:5866 [inline] hub_event+0x291b/0x43f0 drivers/usb/core/hub.c:5948 process_one_work+0x6c8/0xbb0 kernel/workqueue.c:2328 worker_thread+0xaa0/0x1250 kernel/workqueue.c:2475 kthread+0x3f5/0x4f0 kernel/kthread.c:337 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 Allocated by task 329: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:433 [inline] ____kasan_kmalloc mm/kasan/common.c:512 [inline] __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:521 kasan_kmalloc include/linux/kasan.h:227 [inline] __kmalloc_track_caller+0x13c/0x2c0 mm/slub.c:4959 alloc_dr drivers/base/devres.c:116 [inline] devm_kmalloc+0x50/0x150 drivers/base/devres.c:831 devm_kzalloc include/linux/device.h:210 [inline] sony_probe+0xfb/0xcf0 drivers/hid/hid-sony.c:2992 hid_device_probe+0x28d/0x390 drivers/hid/hid-core.c:2363 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x27d/0x970 drivers/base/dd.c:595 __driver_probe_device+0x193/0x270 drivers/base/dd.c:755 driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785 __device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429 __device_attach+0x2b0/0x420 drivers/base/dd.c:979 device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489 device_add+0xaef/0xe90 drivers/base/core.c:3422 hid_add_device+0x349/0x4b0 drivers/hid/hid-core.c:2513 usbhid_probe+0xb93/0xf30 drivers/hid/usbhid/hid-core.c:1442 usb_probe_interface+0x60f/0xb20 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x27d/0x970 drivers/base/dd.c:595 __driver_probe_device+0x193/0x270 drivers/base/dd.c:755 driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785 __device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429 __device_attach+0x2b0/0x420 drivers/base/dd.c:979 device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489 device_add+0xaef/0xe90 drivers/base/core.c:3422 usb_set_configuration+0x1a01/0x1f70 drivers/usb/core/message.c:2223 usb_generic_driver_probe+0x91/0x150 drivers/usb/core/generic.c:238 usb_probe_device+0x143/0x250 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x27d/0x970 drivers/base/dd.c:595 __driver_probe_device+0x193/0x270 drivers/base/dd.c:755 driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785 __device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429 __device_attach+0x2b0/0x420 drivers/base/dd.c:979 device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489 device_add+0xaef/0xe90 drivers/base/core.c:3422 usb_new_device+0xa1f/0x1720 drivers/usb/core/hub.c:2643 hub_port_connect drivers/usb/core/hub.c:5560 [inline] hub_port_connect_change drivers/usb/core/hub.c:5700 [inline] port_event drivers/usb/core/hub.c:5866 [inline] hub_event+0x291b/0x43f0 drivers/usb/core/hub.c:5948 process_one_work+0x6c8/0xbb0 kernel/workqueue.c:2328 worker_thread+0xaa0/0x1250 kernel/workqueue.c:2475 kthread+0x3f5/0x4f0 kernel/kthread.c:337 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 Freed by task 329: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4a/0x70 mm/kasan/common.c:45 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:365 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:373 kasan_slab_free include/linux/kasan.h:193 [inline] slab_free_hook mm/slub.c:1728 [inline] slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1754 slab_free mm/slub.c:3526 [inline] kfree+0xc4/0x270 mm/slub.c:4588 release_nodes+0xe8/0x220 drivers/base/devres.c:501 devres_release_all+0x148/0x1b0 drivers/base/devres.c:530 really_probe+0x346/0x970 drivers/base/dd.c:667 __driver_probe_device+0x193/0x270 drivers/base/dd.c:755 driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785 __device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429 __device_attach+0x2b0/0x420 drivers/base/dd.c:979 device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489 device_add+0xaef/0xe90 drivers/base/core.c:3422 hid_add_device+0x349/0x4b0 drivers/hid/hid-core.c:2513 usbhid_probe+0xb93/0xf30 drivers/hid/usbhid/hid-core.c:1442 usb_probe_interface+0x60f/0xb20 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x27d/0x970 drivers/base/dd.c:595 __driver_probe_device+0x193/0x270 drivers/base/dd.c:755 driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785 __device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429 __device_attach+0x2b0/0x420 drivers/base/dd.c:979 device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489 device_add+0xaef/0xe90 drivers/base/core.c:3422 usb_set_configuration+0x1a01/0x1f70 drivers/usb/core/message.c:2223 usb_generic_driver_probe+0x91/0x150 drivers/usb/core/generic.c:238 usb_probe_device+0x143/0x250 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x27d/0x970 drivers/base/dd.c:595 __driver_probe_device+0x193/0x270 drivers/base/dd.c:755 driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785 __device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429 __device_attach+0x2b0/0x420 drivers/base/dd.c:979 device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489 device_add+0xaef/0xe90 drivers/base/core.c:3422 usb_new_device+0xa1f/0x1720 drivers/usb/core/hub.c:2643 hub_port_connect drivers/usb/core/hub.c:5560 [inline] hub_port_connect_change drivers/usb/core/hub.c:5700 [inline] port_event drivers/usb/core/hub.c:5866 [inline] hub_event+0x291b/0x43f0 drivers/usb/core/hub.c:5948 process_one_work+0x6c8/0xbb0 kernel/workqueue.c:2328 worker_thread+0xaa0/0x1250 kernel/workqueue.c:2475 kthread+0x3f5/0x4f0 kernel/kthread.c:337 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 The buggy address belongs to the object at ffff888110baf000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 378 bytes inside of 1024-byte region [ffff888110baf000, ffff888110baf400) The buggy address belongs to the page: page:ffffea000442ea00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888110ba8800 pfn:0x110ba8 head:ffffea000442ea00 order:3 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head|zone=1) raw: 4000000000010200 0000000000000000 0000000100000001 ffff888100043080 raw: ffff888110ba8800 000000008010000f 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 103, ts 4289251507, free_ts 0 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x192/0x1b0 mm/page_alloc.c:2607 prep_new_page+0x1c/0x110 mm/page_alloc.c:2613 get_page_from_freelist+0x2c3a/0x2cd0 mm/page_alloc.c:4487 __alloc_pages+0x1a2/0x460 mm/page_alloc.c:5824 alloc_slab_page mm/slub.c:-1 [inline] allocate_slab mm/slub.c:1937 [inline] new_slab+0xa0/0x4d0 mm/slub.c:2000 ___slab_alloc+0x3ac/0x840 mm/slub.c:3033 __slab_alloc+0x49/0x90 mm/slub.c:3120 slab_alloc_node mm/slub.c:3211 [inline] slab_alloc mm/slub.c:3255 [inline] __kmalloc_track_caller+0x169/0x2c0 mm/slub.c:4954 kmalloc_reserve net/core/skbuff.c:357 [inline] __alloc_skb+0x210/0x730 net/core/skbuff.c:428 alloc_skb include/linux/skbuff.h:1183 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1182 [inline] netlink_sendmsg+0x611/0xb80 net/netlink/af_netlink.c:1898 sock_sendmsg_nosec net/socket.c:704 [inline] __sock_sendmsg net/socket.c:716 [inline] ____sys_sendmsg+0x5be/0x8f0 net/socket.c:2436 ___sys_sendmsg+0x236/0x2e0 net/socket.c:2490 __sys_sendmsg net/socket.c:2519 [inline] __do_sys_sendmsg net/socket.c:2528 [inline] __se_sys_sendmsg net/socket.c:2526 [inline] __x64_sys_sendmsg+0x201/0x2d0 net/socket.c:2526 x64_sys_call+0x4b/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 page_owner free stack trace missing Memory state around the buggy address: ffff888110baf000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888110baf080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888110baf100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888110baf180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888110baf200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== sony 0003:054C:042F.0002: can't set operational mode: step 3, ignoring sony 0003:054C:042F.0002: No inputs registered, leaving sony 0003:054C:042F.0002: hidraw0: USB HID v0.00 Joystick [HID 054c:042f] on usb-dummy_hcd.2-1/input0 sony 0003:054C:042F.0002: failed to claim input usb 3-1: USB disconnect, device number 4 usb 3-1: new high-speed USB device number 5 using dummy_hcd usb 3-1: config 0 interface 0 altsetting 12 endpoint 0x81 has an invalid bInterval 0, changing to 7 usb 3-1: config 0 interface 0 altsetting 12 endpoint 0x81 has invalid wMaxPacketSize 0 usb 3-1: config 0 interface 0 altsetting 12 has 1 endpoint descriptor, different from the interface descriptor's value: 2 usb 3-1: config 0 interface 0 has no altsetting 0 usb 3-1: New USB device found, idVendor=054c, idProduct=042f, bcdDevice= 0.00 usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 usb 3-1: config 0 descriptor?? sony 0003:054C:042F.0004: can't set operational mode: step 3, ignoring sony 0003:054C:042F.0004: No inputs registered, leaving sony 0003:054C:042F.0004: hidraw0: USB HID v0.00 Joystick [HID 054c:042f] on usb-dummy_hcd.2-1/input0 sony 0003:054C:042F.0004: failed to claim input