Extracting prog: 34.280644796s
Minimizing prog: 29m41.647605463s
Simplifying prog options: 0s
Extracting C: 44.752059455s
Simplifying C: 3m19.456961703s


extracting reproducer from 99 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-openat$binderfs-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_emit_ethernet-syz_open_dev$hiddev-ioctl$HIDIOCGUSAGE-syz_clone-mkdirat$cgroup_root-syz_open_dev$hiddev-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dir-getdents64-fchdir-socket-setsockopt$packet_tx_ring-socket-ioctl$F2FS_IOC_GET_FEATURES-bpf$BPF_BTF_LOAD-setsockopt$packet_tx_ring-recvmmsg$unix-recvmmsg-close-unlinkat-syz_mount_image$fuse-mkdirat-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1c, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="bb6167d7b3838265979b8ccd5d9db898e4cbda30f7f32e2954bbde9320ab54386ff6b8a5ddc182c5b840ebe3cfc43754162ea3f2dbb783d3090dbd4f8c57a1ab971c60c9698e137e6d748a1a7fa65d738b493afd8c70bcdac672fc815b12b5fd1805aa00e2dea1ece39047467380c87193911838088c1512ee14f7d63400f916065b5b46342744750c9d1be8dd7c900acbb380199ed21def916aa484779e4c344005a8bc613d4e0e39484bb4e0a95f1e719aa82789ea77484f8e023b47ff9e452d58ffc8570077d05a5c68bcb88df41a37dbce", @ANYBLOB="0000000000000000b7080000000000007b8a6a78e8f4329aa5bef8ff00000000bfa200000000000007020000f8ffffffb70372000008004000b7040000ea5400007b"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10)
syz_emit_ethernet(0x6a, &(0x7f0000000200)={@local, @random="302bd0ac46a2", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x33, 0x0, @private, @broadcast}, {0x0, 0x0, 0x48, 0x0, @wg=@cookie={0x3, 0x4, "1fa3883e21cd9fe5caae18544a9131d14c91cf0d35507989", "6e447a58f2e6a0893330bdb477ae5aa6740446707740eb6dcb6c5545363eff42"}}}}}}, 0x0)
r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0xc018480b, &(0x7f00000000c0)={0x3, 0x200, 0x81, 0x7f, 0x21185045, 0x7})
syz_clone(0xc1003000, 0x0, 0x0, 0x0, 0x0, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
syz_open_dev$hiddev(&(0x7f00000002c0), 0x6f0d, 0x40)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x60000, 0x3)
getdents64(r3, &(0x7f0000001f80)=""/4096, 0x1000)
fchdir(0xffffffffffffffff)
r4 = socket(0x1e, 0x4, 0x0)
setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000100)=@req={0x3fc, 0x0, 0x0, 0x6}, 0x10)
r5 = socket(0x1e, 0x4, 0x0)
ioctl$F2FS_IOC_GET_FEATURES(0xffffffffffffffff, 0x8004f50c, &(0x7f0000000280))
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001a80)={&(0x7f0000001480)=ANY=[@ANYBLOB="9feb010018000000000fffff00000000000000000200000000005190a5f450807932d1c1441a9d5e7797e7ccf9bdb4bfa708b959089180b9afb240a3d7414cc7fc9d08d345ecaa2752d6abc8e43a42a9fb94d54b0c7bee0341e266294369a1ad201ca10d5cf13cd4110f9df246656f06ea319dfc3291e9e0fd8b99f06c5a152ecb877b1bad9442ae288a539e8c3f50484ee0bc3505f64bffde0b4c57d2111ae52512ac5065a85f38b7202db327df866b0f8765aabd0a8be866a3553acff3364a149977f6a345977f08222609eabe588ba45c07fb4e2226808ff458fb7bd15b39861572ef0401d9fb79b7d4a161"], &(0x7f00000019c0)=""/173, 0x1a, 0xad, 0x1}, 0x28)
setsockopt$packet_tx_ring(r5, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10)
recvmmsg$unix(r4, &(0x7f0000003100)=[{{0x0, 0xffffffffffffffbc, &(0x7f0000000300)=[{&(0x7f0000000140)=""/83}], 0x1}}], 0x1, 0x0, 0x0)
recvmmsg(r4, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)=""/43, 0x30}], 0x1}, 0x20003ff1}], 0x1, 0x183, 0x0)
close(r5)
unlinkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x200)
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x21, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c0)
ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program crashed: UBSAN: shift-out-of-bounds in s32ton
single: successfully extracted reproducer
found reproducer with 30 syscalls
minimizing guilty program
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-openat$binderfs-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_emit_ethernet-syz_open_dev$hiddev-ioctl$HIDIOCGUSAGE-syz_clone-mkdirat$cgroup_root-syz_open_dev$hiddev-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dir-getdents64-fchdir-socket-setsockopt$packet_tx_ring-socket-ioctl$F2FS_IOC_GET_FEATURES-bpf$BPF_BTF_LOAD-setsockopt$packet_tx_ring-recvmmsg$unix-recvmmsg-close-unlinkat-syz_mount_image$fuse-mkdirat
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1c, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="bb6167d7b3838265979b8ccd5d9db898e4cbda30f7f32e2954bbde9320ab54386ff6b8a5ddc182c5b840ebe3cfc43754162ea3f2dbb783d3090dbd4f8c57a1ab971c60c9698e137e6d748a1a7fa65d738b493afd8c70bcdac672fc815b12b5fd1805aa00e2dea1ece39047467380c87193911838088c1512ee14f7d63400f916065b5b46342744750c9d1be8dd7c900acbb380199ed21def916aa484779e4c344005a8bc613d4e0e39484bb4e0a95f1e719aa82789ea77484f8e023b47ff9e452d58ffc8570077d05a5c68bcb88df41a37dbce", @ANYBLOB="0000000000000000b7080000000000007b8a6a78e8f4329aa5bef8ff00000000bfa200000000000007020000f8ffffffb70372000008004000b7040000ea5400007b"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10)
syz_emit_ethernet(0x6a, &(0x7f0000000200)={@local, @random="302bd0ac46a2", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x33, 0x0, @private, @broadcast}, {0x0, 0x0, 0x48, 0x0, @wg=@cookie={0x3, 0x4, "1fa3883e21cd9fe5caae18544a9131d14c91cf0d35507989", "6e447a58f2e6a0893330bdb477ae5aa6740446707740eb6dcb6c5545363eff42"}}}}}}, 0x0)
r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0xc018480b, &(0x7f00000000c0)={0x3, 0x200, 0x81, 0x7f, 0x21185045, 0x7})
syz_clone(0xc1003000, 0x0, 0x0, 0x0, 0x0, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
syz_open_dev$hiddev(&(0x7f00000002c0), 0x6f0d, 0x40)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x60000, 0x3)
getdents64(r3, &(0x7f0000001f80)=""/4096, 0x1000)
fchdir(0xffffffffffffffff)
r4 = socket(0x1e, 0x4, 0x0)
setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000100)=@req={0x3fc, 0x0, 0x0, 0x6}, 0x10)
r5 = socket(0x1e, 0x4, 0x0)
ioctl$F2FS_IOC_GET_FEATURES(0xffffffffffffffff, 0x8004f50c, &(0x7f0000000280))
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001a80)={&(0x7f0000001480)=ANY=[@ANYBLOB="9feb010018000000000fffff00000000000000000200000000005190a5f450807932d1c1441a9d5e7797e7ccf9bdb4bfa708b959089180b9afb240a3d7414cc7fc9d08d345ecaa2752d6abc8e43a42a9fb94d54b0c7bee0341e266294369a1ad201ca10d5cf13cd4110f9df246656f06ea319dfc3291e9e0fd8b99f06c5a152ecb877b1bad9442ae288a539e8c3f50484ee0bc3505f64bffde0b4c57d2111ae52512ac5065a85f38b7202db327df866b0f8765aabd0a8be866a3553acff3364a149977f6a345977f08222609eabe588ba45c07fb4e2226808ff458fb7bd15b39861572ef0401d9fb79b7d4a161"], &(0x7f00000019c0)=""/173, 0x1a, 0xad, 0x1}, 0x28)
setsockopt$packet_tx_ring(r5, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10)
recvmmsg$unix(r4, &(0x7f0000003100)=[{{0x0, 0xffffffffffffffbc, &(0x7f0000000300)=[{&(0x7f0000000140)=""/83}], 0x1}}], 0x1, 0x0, 0x0)
recvmmsg(r4, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)=""/43, 0x30}], 0x1}, 0x20003ff1}], 0x1, 0x183, 0x0)
close(r5)
unlinkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x200)
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x21, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c0)

program did not crash
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-openat$binderfs-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_emit_ethernet-syz_open_dev$hiddev-ioctl$HIDIOCGUSAGE-syz_clone-mkdirat$cgroup_root-syz_open_dev$hiddev-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dir-getdents64-fchdir-socket-setsockopt$packet_tx_ring-socket-ioctl$F2FS_IOC_GET_FEATURES-bpf$BPF_BTF_LOAD-setsockopt$packet_tx_ring-recvmmsg$unix-recvmmsg-close-unlinkat-syz_mount_image$fuse-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1c, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="bb6167d7b3838265979b8ccd5d9db898e4cbda30f7f32e2954bbde9320ab54386ff6b8a5ddc182c5b840ebe3cfc43754162ea3f2dbb783d3090dbd4f8c57a1ab971c60c9698e137e6d748a1a7fa65d738b493afd8c70bcdac672fc815b12b5fd1805aa00e2dea1ece39047467380c87193911838088c1512ee14f7d63400f916065b5b46342744750c9d1be8dd7c900acbb380199ed21def916aa484779e4c344005a8bc613d4e0e39484bb4e0a95f1e719aa82789ea77484f8e023b47ff9e452d58ffc8570077d05a5c68bcb88df41a37dbce", @ANYBLOB="0000000000000000b7080000000000007b8a6a78e8f4329aa5bef8ff00000000bfa200000000000007020000f8ffffffb70372000008004000b7040000ea5400007b"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10)
syz_emit_ethernet(0x6a, &(0x7f0000000200)={@local, @random="302bd0ac46a2", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x33, 0x0, @private, @broadcast}, {0x0, 0x0, 0x48, 0x0, @wg=@cookie={0x3, 0x4, "1fa3883e21cd9fe5caae18544a9131d14c91cf0d35507989", "6e447a58f2e6a0893330bdb477ae5aa6740446707740eb6dcb6c5545363eff42"}}}}}}, 0x0)
r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0xc018480b, &(0x7f00000000c0)={0x3, 0x200, 0x81, 0x7f, 0x21185045, 0x7})
syz_clone(0xc1003000, 0x0, 0x0, 0x0, 0x0, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
syz_open_dev$hiddev(&(0x7f00000002c0), 0x6f0d, 0x40)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x60000, 0x3)
getdents64(r3, &(0x7f0000001f80)=""/4096, 0x1000)
fchdir(0xffffffffffffffff)
r4 = socket(0x1e, 0x4, 0x0)
setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000100)=@req={0x3fc, 0x0, 0x0, 0x6}, 0x10)
r5 = socket(0x1e, 0x4, 0x0)
ioctl$F2FS_IOC_GET_FEATURES(0xffffffffffffffff, 0x8004f50c, &(0x7f0000000280))
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001a80)={&(0x7f0000001480)=ANY=[@ANYBLOB="9feb010018000000000fffff00000000000000000200000000005190a5f450807932d1c1441a9d5e7797e7ccf9bdb4bfa708b959089180b9afb240a3d7414cc7fc9d08d345ecaa2752d6abc8e43a42a9fb94d54b0c7bee0341e266294369a1ad201ca10d5cf13cd4110f9df246656f06ea319dfc3291e9e0fd8b99f06c5a152ecb877b1bad9442ae288a539e8c3f50484ee0bc3505f64bffde0b4c57d2111ae52512ac5065a85f38b7202db327df866b0f8765aabd0a8be866a3553acff3364a149977f6a345977f08222609eabe588ba45c07fb4e2226808ff458fb7bd15b39861572ef0401d9fb79b7d4a161"], &(0x7f00000019c0)=""/173, 0x1a, 0xad, 0x1}, 0x28)
setsockopt$packet_tx_ring(r5, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10)
recvmmsg$unix(r4, &(0x7f0000003100)=[{{0x0, 0xffffffffffffffbc, &(0x7f0000000300)=[{&(0x7f0000000140)=""/83}], 0x1}}], 0x1, 0x0, 0x0)
recvmmsg(r4, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)=""/43, 0x30}], 0x1}, 0x20003ff1}], 0x1, 0x183, 0x0)
close(r5)
unlinkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x200)
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x21, 0x0, 0x0)
ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program crashed: UBSAN: shift-out-of-bounds in s32ton
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-openat$binderfs-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_emit_ethernet-syz_open_dev$hiddev-ioctl$HIDIOCGUSAGE-syz_clone-mkdirat$cgroup_root-syz_open_dev$hiddev-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dir-getdents64-fchdir-socket-setsockopt$packet_tx_ring-socket-ioctl$F2FS_IOC_GET_FEATURES-bpf$BPF_BTF_LOAD-setsockopt$packet_tx_ring-recvmmsg$unix-recvmmsg-close-unlinkat-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1c, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="bb6167d7b3838265979b8ccd5d9db898e4cbda30f7f32e2954bbde9320ab54386ff6b8a5ddc182c5b840ebe3cfc43754162ea3f2dbb783d3090dbd4f8c57a1ab971c60c9698e137e6d748a1a7fa65d738b493afd8c70bcdac672fc815b12b5fd1805aa00e2dea1ece39047467380c87193911838088c1512ee14f7d63400f916065b5b46342744750c9d1be8dd7c900acbb380199ed21def916aa484779e4c344005a8bc613d4e0e39484bb4e0a95f1e719aa82789ea77484f8e023b47ff9e452d58ffc8570077d05a5c68bcb88df41a37dbce", @ANYBLOB="0000000000000000b7080000000000007b8a6a78e8f4329aa5bef8ff00000000bfa200000000000007020000f8ffffffb70372000008004000b7040000ea5400007b"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10)
syz_emit_ethernet(0x6a, &(0x7f0000000200)={@local, @random="302bd0ac46a2", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x33, 0x0, @private, @broadcast}, {0x0, 0x0, 0x48, 0x0, @wg=@cookie={0x3, 0x4, "1fa3883e21cd9fe5caae18544a9131d14c91cf0d35507989", "6e447a58f2e6a0893330bdb477ae5aa6740446707740eb6dcb6c5545363eff42"}}}}}}, 0x0)
r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0xc018480b, &(0x7f00000000c0)={0x3, 0x200, 0x81, 0x7f, 0x21185045, 0x7})
syz_clone(0xc1003000, 0x0, 0x0, 0x0, 0x0, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
syz_open_dev$hiddev(&(0x7f00000002c0), 0x6f0d, 0x40)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x60000, 0x3)
getdents64(r3, &(0x7f0000001f80)=""/4096, 0x1000)
fchdir(0xffffffffffffffff)
r4 = socket(0x1e, 0x4, 0x0)
setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000100)=@req={0x3fc, 0x0, 0x0, 0x6}, 0x10)
r5 = socket(0x1e, 0x4, 0x0)
ioctl$F2FS_IOC_GET_FEATURES(0xffffffffffffffff, 0x8004f50c, &(0x7f0000000280))
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001a80)={&(0x7f0000001480)=ANY=[@ANYBLOB="9feb010018000000000fffff00000000000000000200000000005190a5f450807932d1c1441a9d5e7797e7ccf9bdb4bfa708b959089180b9afb240a3d7414cc7fc9d08d345ecaa2752d6abc8e43a42a9fb94d54b0c7bee0341e266294369a1ad201ca10d5cf13cd4110f9df246656f06ea319dfc3291e9e0fd8b99f06c5a152ecb877b1bad9442ae288a539e8c3f50484ee0bc3505f64bffde0b4c57d2111ae52512ac5065a85f38b7202db327df866b0f8765aabd0a8be866a3553acff3364a149977f6a345977f08222609eabe588ba45c07fb4e2226808ff458fb7bd15b39861572ef0401d9fb79b7d4a161"], &(0x7f00000019c0)=""/173, 0x1a, 0xad, 0x1}, 0x28)
setsockopt$packet_tx_ring(r5, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10)
recvmmsg$unix(r4, &(0x7f0000003100)=[{{0x0, 0xffffffffffffffbc, &(0x7f0000000300)=[{&(0x7f0000000140)=""/83}], 0x1}}], 0x1, 0x0, 0x0)
recvmmsg(r4, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)=""/43, 0x30}], 0x1}, 0x20003ff1}], 0x1, 0x183, 0x0)
close(r5)
unlinkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x200)
ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program crashed: UBSAN: shift-out-of-bounds in s32ton
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-openat$binderfs-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_emit_ethernet-syz_open_dev$hiddev-ioctl$HIDIOCGUSAGE-syz_clone-mkdirat$cgroup_root-syz_open_dev$hiddev-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dir-getdents64-fchdir-socket-setsockopt$packet_tx_ring-socket-ioctl$F2FS_IOC_GET_FEATURES-bpf$BPF_BTF_LOAD-setsockopt$packet_tx_ring-recvmmsg$unix-recvmmsg-close-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1c, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="bb6167d7b3838265979b8ccd5d9db898e4cbda30f7f32e2954bbde9320ab54386ff6b8a5ddc182c5b840ebe3cfc43754162ea3f2dbb783d3090dbd4f8c57a1ab971c60c9698e137e6d748a1a7fa65d738b493afd8c70bcdac672fc815b12b5fd1805aa00e2dea1ece39047467380c87193911838088c1512ee14f7d63400f916065b5b46342744750c9d1be8dd7c900acbb380199ed21def916aa484779e4c344005a8bc613d4e0e39484bb4e0a95f1e719aa82789ea77484f8e023b47ff9e452d58ffc8570077d05a5c68bcb88df41a37dbce", @ANYBLOB="0000000000000000b7080000000000007b8a6a78e8f4329aa5bef8ff00000000bfa200000000000007020000f8ffffffb70372000008004000b7040000ea5400007b"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10)
syz_emit_ethernet(0x6a, &(0x7f0000000200)={@local, @random="302bd0ac46a2", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x33, 0x0, @private, @broadcast}, {0x0, 0x0, 0x48, 0x0, @wg=@cookie={0x3, 0x4, "1fa3883e21cd9fe5caae18544a9131d14c91cf0d35507989", "6e447a58f2e6a0893330bdb477ae5aa6740446707740eb6dcb6c5545363eff42"}}}}}}, 0x0)
r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0xc018480b, &(0x7f00000000c0)={0x3, 0x200, 0x81, 0x7f, 0x21185045, 0x7})
syz_clone(0xc1003000, 0x0, 0x0, 0x0, 0x0, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
syz_open_dev$hiddev(&(0x7f00000002c0), 0x6f0d, 0x40)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x60000, 0x3)
getdents64(r3, &(0x7f0000001f80)=""/4096, 0x1000)
fchdir(0xffffffffffffffff)
r4 = socket(0x1e, 0x4, 0x0)
setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000100)=@req={0x3fc, 0x0, 0x0, 0x6}, 0x10)
r5 = socket(0x1e, 0x4, 0x0)
ioctl$F2FS_IOC_GET_FEATURES(0xffffffffffffffff, 0x8004f50c, &(0x7f0000000280))
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001a80)={&(0x7f0000001480)=ANY=[@ANYBLOB="9feb010018000000000fffff00000000000000000200000000005190a5f450807932d1c1441a9d5e7797e7ccf9bdb4bfa708b959089180b9afb240a3d7414cc7fc9d08d345ecaa2752d6abc8e43a42a9fb94d54b0c7bee0341e266294369a1ad201ca10d5cf13cd4110f9df246656f06ea319dfc3291e9e0fd8b99f06c5a152ecb877b1bad9442ae288a539e8c3f50484ee0bc3505f64bffde0b4c57d2111ae52512ac5065a85f38b7202db327df866b0f8765aabd0a8be866a3553acff3364a149977f6a345977f08222609eabe588ba45c07fb4e2226808ff458fb7bd15b39861572ef0401d9fb79b7d4a161"], &(0x7f00000019c0)=""/173, 0x1a, 0xad, 0x1}, 0x28)
setsockopt$packet_tx_ring(r5, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10)
recvmmsg$unix(r4, &(0x7f0000003100)=[{{0x0, 0xffffffffffffffbc, &(0x7f0000000300)=[{&(0x7f0000000140)=""/83}], 0x1}}], 0x1, 0x0, 0x0)
recvmmsg(r4, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)=""/43, 0x30}], 0x1}, 0x20003ff1}], 0x1, 0x183, 0x0)
close(r5)
ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program crashed: UBSAN: shift-out-of-bounds in s32ton
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-openat$binderfs-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_emit_ethernet-syz_open_dev$hiddev-ioctl$HIDIOCGUSAGE-syz_clone-mkdirat$cgroup_root-syz_open_dev$hiddev-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dir-getdents64-fchdir-socket-setsockopt$packet_tx_ring-socket-ioctl$F2FS_IOC_GET_FEATURES-bpf$BPF_BTF_LOAD-setsockopt$packet_tx_ring-recvmmsg$unix-recvmmsg-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1c, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="bb6167d7b3838265979b8ccd5d9db898e4cbda30f7f32e2954bbde9320ab54386ff6b8a5ddc182c5b840ebe3cfc43754162ea3f2dbb783d3090dbd4f8c57a1ab971c60c9698e137e6d748a1a7fa65d738b493afd8c70bcdac672fc815b12b5fd1805aa00e2dea1ece39047467380c87193911838088c1512ee14f7d63400f916065b5b46342744750c9d1be8dd7c900acbb380199ed21def916aa484779e4c344005a8bc613d4e0e39484bb4e0a95f1e719aa82789ea77484f8e023b47ff9e452d58ffc8570077d05a5c68bcb88df41a37dbce", @ANYBLOB="0000000000000000b7080000000000007b8a6a78e8f4329aa5bef8ff00000000bfa200000000000007020000f8ffffffb70372000008004000b7040000ea5400007b"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10)
syz_emit_ethernet(0x6a, &(0x7f0000000200)={@local, @random="302bd0ac46a2", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x33, 0x0, @private, @broadcast}, {0x0, 0x0, 0x48, 0x0, @wg=@cookie={0x3, 0x4, "1fa3883e21cd9fe5caae18544a9131d14c91cf0d35507989", "6e447a58f2e6a0893330bdb477ae5aa6740446707740eb6dcb6c5545363eff42"}}}}}}, 0x0)
r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0xc018480b, &(0x7f00000000c0)={0x3, 0x200, 0x81, 0x7f, 0x21185045, 0x7})
syz_clone(0xc1003000, 0x0, 0x0, 0x0, 0x0, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
syz_open_dev$hiddev(&(0x7f00000002c0), 0x6f0d, 0x40)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x60000, 0x3)
getdents64(r3, &(0x7f0000001f80)=""/4096, 0x1000)
fchdir(0xffffffffffffffff)
r4 = socket(0x1e, 0x4, 0x0)
setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000100)=@req={0x3fc, 0x0, 0x0, 0x6}, 0x10)
r5 = socket(0x1e, 0x4, 0x0)
ioctl$F2FS_IOC_GET_FEATURES(0xffffffffffffffff, 0x8004f50c, &(0x7f0000000280))
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001a80)={&(0x7f0000001480)=ANY=[@ANYBLOB="9feb010018000000000fffff00000000000000000200000000005190a5f450807932d1c1441a9d5e7797e7ccf9bdb4bfa708b959089180b9afb240a3d7414cc7fc9d08d345ecaa2752d6abc8e43a42a9fb94d54b0c7bee0341e266294369a1ad201ca10d5cf13cd4110f9df246656f06ea319dfc3291e9e0fd8b99f06c5a152ecb877b1bad9442ae288a539e8c3f50484ee0bc3505f64bffde0b4c57d2111ae52512ac5065a85f38b7202db327df866b0f8765aabd0a8be866a3553acff3364a149977f6a345977f08222609eabe588ba45c07fb4e2226808ff458fb7bd15b39861572ef0401d9fb79b7d4a161"], &(0x7f00000019c0)=""/173, 0x1a, 0xad, 0x1}, 0x28)
setsockopt$packet_tx_ring(r5, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10)
recvmmsg$unix(r4, &(0x7f0000003100)=[{{0x0, 0xffffffffffffffbc, &(0x7f0000000300)=[{&(0x7f0000000140)=""/83}], 0x1}}], 0x1, 0x0, 0x0)
recvmmsg(r4, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)=""/43, 0x30}], 0x1}, 0x20003ff1}], 0x1, 0x183, 0x0)
ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program crashed: UBSAN: shift-out-of-bounds in s32ton
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-openat$binderfs-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_emit_ethernet-syz_open_dev$hiddev-ioctl$HIDIOCGUSAGE-syz_clone-mkdirat$cgroup_root-syz_open_dev$hiddev-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dir-getdents64-fchdir-socket-setsockopt$packet_tx_ring-socket-ioctl$F2FS_IOC_GET_FEATURES-bpf$BPF_BTF_LOAD-setsockopt$packet_tx_ring-recvmmsg$unix-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1c, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="bb6167d7b3838265979b8ccd5d9db898e4cbda30f7f32e2954bbde9320ab54386ff6b8a5ddc182c5b840ebe3cfc43754162ea3f2dbb783d3090dbd4f8c57a1ab971c60c9698e137e6d748a1a7fa65d738b493afd8c70bcdac672fc815b12b5fd1805aa00e2dea1ece39047467380c87193911838088c1512ee14f7d63400f916065b5b46342744750c9d1be8dd7c900acbb380199ed21def916aa484779e4c344005a8bc613d4e0e39484bb4e0a95f1e719aa82789ea77484f8e023b47ff9e452d58ffc8570077d05a5c68bcb88df41a37dbce", @ANYBLOB="0000000000000000b7080000000000007b8a6a78e8f4329aa5bef8ff00000000bfa200000000000007020000f8ffffffb70372000008004000b7040000ea5400007b"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10)
syz_emit_ethernet(0x6a, &(0x7f0000000200)={@local, @random="302bd0ac46a2", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x33, 0x0, @private, @broadcast}, {0x0, 0x0, 0x48, 0x0, @wg=@cookie={0x3, 0x4, "1fa3883e21cd9fe5caae18544a9131d14c91cf0d35507989", "6e447a58f2e6a0893330bdb477ae5aa6740446707740eb6dcb6c5545363eff42"}}}}}}, 0x0)
r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0xc018480b, &(0x7f00000000c0)={0x3, 0x200, 0x81, 0x7f, 0x21185045, 0x7})
syz_clone(0xc1003000, 0x0, 0x0, 0x0, 0x0, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
syz_open_dev$hiddev(&(0x7f00000002c0), 0x6f0d, 0x40)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x60000, 0x3)
getdents64(r3, &(0x7f0000001f80)=""/4096, 0x1000)
fchdir(0xffffffffffffffff)
r4 = socket(0x1e, 0x4, 0x0)
setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000100)=@req={0x3fc, 0x0, 0x0, 0x6}, 0x10)
r5 = socket(0x1e, 0x4, 0x0)
ioctl$F2FS_IOC_GET_FEATURES(0xffffffffffffffff, 0x8004f50c, &(0x7f0000000280))
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001a80)={&(0x7f0000001480)=ANY=[@ANYBLOB="9feb010018000000000fffff00000000000000000200000000005190a5f450807932d1c1441a9d5e7797e7ccf9bdb4bfa708b959089180b9afb240a3d7414cc7fc9d08d345ecaa2752d6abc8e43a42a9fb94d54b0c7bee0341e266294369a1ad201ca10d5cf13cd4110f9df246656f06ea319dfc3291e9e0fd8b99f06c5a152ecb877b1bad9442ae288a539e8c3f50484ee0bc3505f64bffde0b4c57d2111ae52512ac5065a85f38b7202db327df866b0f8765aabd0a8be866a3553acff3364a149977f6a345977f08222609eabe588ba45c07fb4e2226808ff458fb7bd15b39861572ef0401d9fb79b7d4a161"], &(0x7f00000019c0)=""/173, 0x1a, 0xad, 0x1}, 0x28)
setsockopt$packet_tx_ring(r5, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10)
recvmmsg$unix(r4, &(0x7f0000003100)=[{{0x0, 0xffffffffffffffbc, &(0x7f0000000300)=[{&(0x7f0000000140)=""/83}], 0x1}}], 0x1, 0x0, 0x0)
ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program crashed: UBSAN: shift-out-of-bounds in s32ton
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-openat$binderfs-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_emit_ethernet-syz_open_dev$hiddev-ioctl$HIDIOCGUSAGE-syz_clone-mkdirat$cgroup_root-syz_open_dev$hiddev-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dir-getdents64-fchdir-socket-setsockopt$packet_tx_ring-socket-ioctl$F2FS_IOC_GET_FEATURES-bpf$BPF_BTF_LOAD-setsockopt$packet_tx_ring-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1c, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="bb6167d7b3838265979b8ccd5d9db898e4cbda30f7f32e2954bbde9320ab54386ff6b8a5ddc182c5b840ebe3cfc43754162ea3f2dbb783d3090dbd4f8c57a1ab971c60c9698e137e6d748a1a7fa65d738b493afd8c70bcdac672fc815b12b5fd1805aa00e2dea1ece39047467380c87193911838088c1512ee14f7d63400f916065b5b46342744750c9d1be8dd7c900acbb380199ed21def916aa484779e4c344005a8bc613d4e0e39484bb4e0a95f1e719aa82789ea77484f8e023b47ff9e452d58ffc8570077d05a5c68bcb88df41a37dbce", @ANYBLOB="0000000000000000b7080000000000007b8a6a78e8f4329aa5bef8ff00000000bfa200000000000007020000f8ffffffb70372000008004000b7040000ea5400007b"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10)
syz_emit_ethernet(0x6a, &(0x7f0000000200)={@local, @random="302bd0ac46a2", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x33, 0x0, @private, @broadcast}, {0x0, 0x0, 0x48, 0x0, @wg=@cookie={0x3, 0x4, "1fa3883e21cd9fe5caae18544a9131d14c91cf0d35507989", "6e447a58f2e6a0893330bdb477ae5aa6740446707740eb6dcb6c5545363eff42"}}}}}}, 0x0)
r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0xc018480b, &(0x7f00000000c0)={0x3, 0x200, 0x81, 0x7f, 0x21185045, 0x7})
syz_clone(0xc1003000, 0x0, 0x0, 0x0, 0x0, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
syz_open_dev$hiddev(&(0x7f00000002c0), 0x6f0d, 0x40)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x60000, 0x3)
getdents64(r3, &(0x7f0000001f80)=""/4096, 0x1000)
fchdir(0xffffffffffffffff)
r4 = socket(0x1e, 0x4, 0x0)
setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000100)=@req={0x3fc, 0x0, 0x0, 0x6}, 0x10)
r5 = socket(0x1e, 0x4, 0x0)
ioctl$F2FS_IOC_GET_FEATURES(0xffffffffffffffff, 0x8004f50c, &(0x7f0000000280))
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001a80)={&(0x7f0000001480)=ANY=[@ANYBLOB="9feb010018000000000fffff00000000000000000200000000005190a5f450807932d1c1441a9d5e7797e7ccf9bdb4bfa708b959089180b9afb240a3d7414cc7fc9d08d345ecaa2752d6abc8e43a42a9fb94d54b0c7bee0341e266294369a1ad201ca10d5cf13cd4110f9df246656f06ea319dfc3291e9e0fd8b99f06c5a152ecb877b1bad9442ae288a539e8c3f50484ee0bc3505f64bffde0b4c57d2111ae52512ac5065a85f38b7202db327df866b0f8765aabd0a8be866a3553acff3364a149977f6a345977f08222609eabe588ba45c07fb4e2226808ff458fb7bd15b39861572ef0401d9fb79b7d4a161"], &(0x7f00000019c0)=""/173, 0x1a, 0xad, 0x1}, 0x28)
setsockopt$packet_tx_ring(r5, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10)
ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program crashed: UBSAN: shift-out-of-bounds in s32ton
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-openat$binderfs-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_emit_ethernet-syz_open_dev$hiddev-ioctl$HIDIOCGUSAGE-syz_clone-mkdirat$cgroup_root-syz_open_dev$hiddev-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dir-getdents64-fchdir-socket-setsockopt$packet_tx_ring-socket-ioctl$F2FS_IOC_GET_FEATURES-bpf$BPF_BTF_LOAD-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1c, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="bb6167d7b3838265979b8ccd5d9db898e4cbda30f7f32e2954bbde9320ab54386ff6b8a5ddc182c5b840ebe3cfc43754162ea3f2dbb783d3090dbd4f8c57a1ab971c60c9698e137e6d748a1a7fa65d738b493afd8c70bcdac672fc815b12b5fd1805aa00e2dea1ece39047467380c87193911838088c1512ee14f7d63400f916065b5b46342744750c9d1be8dd7c900acbb380199ed21def916aa484779e4c344005a8bc613d4e0e39484bb4e0a95f1e719aa82789ea77484f8e023b47ff9e452d58ffc8570077d05a5c68bcb88df41a37dbce", @ANYBLOB="0000000000000000b7080000000000007b8a6a78e8f4329aa5bef8ff00000000bfa200000000000007020000f8ffffffb70372000008004000b7040000ea5400007b"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10)
syz_emit_ethernet(0x6a, &(0x7f0000000200)={@local, @random="302bd0ac46a2", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x33, 0x0, @private, @broadcast}, {0x0, 0x0, 0x48, 0x0, @wg=@cookie={0x3, 0x4, "1fa3883e21cd9fe5caae18544a9131d14c91cf0d35507989", "6e447a58f2e6a0893330bdb477ae5aa6740446707740eb6dcb6c5545363eff42"}}}}}}, 0x0)
r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0xc018480b, &(0x7f00000000c0)={0x3, 0x200, 0x81, 0x7f, 0x21185045, 0x7})
syz_clone(0xc1003000, 0x0, 0x0, 0x0, 0x0, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
syz_open_dev$hiddev(&(0x7f00000002c0), 0x6f0d, 0x40)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x60000, 0x3)
getdents64(r3, &(0x7f0000001f80)=""/4096, 0x1000)
fchdir(0xffffffffffffffff)
r4 = socket(0x1e, 0x4, 0x0)
setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000100)=@req={0x3fc, 0x0, 0x0, 0x6}, 0x10)
socket(0x1e, 0x4, 0x0)
ioctl$F2FS_IOC_GET_FEATURES(0xffffffffffffffff, 0x8004f50c, &(0x7f0000000280))
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001a80)={&(0x7f0000001480)=ANY=[@ANYBLOB="9feb010018000000000fffff00000000000000000200000000005190a5f450807932d1c1441a9d5e7797e7ccf9bdb4bfa708b959089180b9afb240a3d7414cc7fc9d08d345ecaa2752d6abc8e43a42a9fb94d54b0c7bee0341e266294369a1ad201ca10d5cf13cd4110f9df246656f06ea319dfc3291e9e0fd8b99f06c5a152ecb877b1bad9442ae288a539e8c3f50484ee0bc3505f64bffde0b4c57d2111ae52512ac5065a85f38b7202db327df866b0f8765aabd0a8be866a3553acff3364a149977f6a345977f08222609eabe588ba45c07fb4e2226808ff458fb7bd15b39861572ef0401d9fb79b7d4a161"], &(0x7f00000019c0)=""/173, 0x1a, 0xad, 0x1}, 0x28)
ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program crashed: UBSAN: shift-out-of-bounds in s32ton
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-openat$binderfs-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_emit_ethernet-syz_open_dev$hiddev-ioctl$HIDIOCGUSAGE-syz_clone-mkdirat$cgroup_root-syz_open_dev$hiddev-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dir-getdents64-fchdir-socket-setsockopt$packet_tx_ring-socket-ioctl$F2FS_IOC_GET_FEATURES-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1c, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="bb6167d7b3838265979b8ccd5d9db898e4cbda30f7f32e2954bbde9320ab54386ff6b8a5ddc182c5b840ebe3cfc43754162ea3f2dbb783d3090dbd4f8c57a1ab971c60c9698e137e6d748a1a7fa65d738b493afd8c70bcdac672fc815b12b5fd1805aa00e2dea1ece39047467380c87193911838088c1512ee14f7d63400f916065b5b46342744750c9d1be8dd7c900acbb380199ed21def916aa484779e4c344005a8bc613d4e0e39484bb4e0a95f1e719aa82789ea77484f8e023b47ff9e452d58ffc8570077d05a5c68bcb88df41a37dbce", @ANYBLOB="0000000000000000b7080000000000007b8a6a78e8f4329aa5bef8ff00000000bfa200000000000007020000f8ffffffb70372000008004000b7040000ea5400007b"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10)
syz_emit_ethernet(0x6a, &(0x7f0000000200)={@local, @random="302bd0ac46a2", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x33, 0x0, @private, @broadcast}, {0x0, 0x0, 0x48, 0x0, @wg=@cookie={0x3, 0x4, "1fa3883e21cd9fe5caae18544a9131d14c91cf0d35507989", "6e447a58f2e6a0893330bdb477ae5aa6740446707740eb6dcb6c5545363eff42"}}}}}}, 0x0)
r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0xc018480b, &(0x7f00000000c0)={0x3, 0x200, 0x81, 0x7f, 0x21185045, 0x7})
syz_clone(0xc1003000, 0x0, 0x0, 0x0, 0x0, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
syz_open_dev$hiddev(&(0x7f00000002c0), 0x6f0d, 0x40)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x60000, 0x3)
getdents64(r3, &(0x7f0000001f80)=""/4096, 0x1000)
fchdir(0xffffffffffffffff)
r4 = socket(0x1e, 0x4, 0x0)
setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000100)=@req={0x3fc, 0x0, 0x0, 0x6}, 0x10)
socket(0x1e, 0x4, 0x0)
ioctl$F2FS_IOC_GET_FEATURES(0xffffffffffffffff, 0x8004f50c, &(0x7f0000000280))
ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program crashed: UBSAN: shift-out-of-bounds in s32ton
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-openat$binderfs-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_emit_ethernet-syz_open_dev$hiddev-ioctl$HIDIOCGUSAGE-syz_clone-mkdirat$cgroup_root-syz_open_dev$hiddev-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dir-getdents64-fchdir-socket-setsockopt$packet_tx_ring-socket-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1c, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="bb6167d7b3838265979b8ccd5d9db898e4cbda30f7f32e2954bbde9320ab54386ff6b8a5ddc182c5b840ebe3cfc43754162ea3f2dbb783d3090dbd4f8c57a1ab971c60c9698e137e6d748a1a7fa65d738b493afd8c70bcdac672fc815b12b5fd1805aa00e2dea1ece39047467380c87193911838088c1512ee14f7d63400f916065b5b46342744750c9d1be8dd7c900acbb380199ed21def916aa484779e4c344005a8bc613d4e0e39484bb4e0a95f1e719aa82789ea77484f8e023b47ff9e452d58ffc8570077d05a5c68bcb88df41a37dbce", @ANYBLOB="0000000000000000b7080000000000007b8a6a78e8f4329aa5bef8ff00000000bfa200000000000007020000f8ffffffb70372000008004000b7040000ea5400007b"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10)
syz_emit_ethernet(0x6a, &(0x7f0000000200)={@local, @random="302bd0ac46a2", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x33, 0x0, @private, @broadcast}, {0x0, 0x0, 0x48, 0x0, @wg=@cookie={0x3, 0x4, "1fa3883e21cd9fe5caae18544a9131d14c91cf0d35507989", "6e447a58f2e6a0893330bdb477ae5aa6740446707740eb6dcb6c5545363eff42"}}}}}}, 0x0)
r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0xc018480b, &(0x7f00000000c0)={0x3, 0x200, 0x81, 0x7f, 0x21185045, 0x7})
syz_clone(0xc1003000, 0x0, 0x0, 0x0, 0x0, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
syz_open_dev$hiddev(&(0x7f00000002c0), 0x6f0d, 0x40)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x60000, 0x3)
getdents64(r3, &(0x7f0000001f80)=""/4096, 0x1000)
fchdir(0xffffffffffffffff)
r4 = socket(0x1e, 0x4, 0x0)
setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000100)=@req={0x3fc, 0x0, 0x0, 0x6}, 0x10)
socket(0x1e, 0x4, 0x0)
ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program crashed: UBSAN: shift-out-of-bounds in s32ton
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-openat$binderfs-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_emit_ethernet-syz_open_dev$hiddev-ioctl$HIDIOCGUSAGE-syz_clone-mkdirat$cgroup_root-syz_open_dev$hiddev-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dir-getdents64-fchdir-socket-setsockopt$packet_tx_ring-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1c, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="bb6167d7b3838265979b8ccd5d9db898e4cbda30f7f32e2954bbde9320ab54386ff6b8a5ddc182c5b840ebe3cfc43754162ea3f2dbb783d3090dbd4f8c57a1ab971c60c9698e137e6d748a1a7fa65d738b493afd8c70bcdac672fc815b12b5fd1805aa00e2dea1ece39047467380c87193911838088c1512ee14f7d63400f916065b5b46342744750c9d1be8dd7c900acbb380199ed21def916aa484779e4c344005a8bc613d4e0e39484bb4e0a95f1e719aa82789ea77484f8e023b47ff9e452d58ffc8570077d05a5c68bcb88df41a37dbce", @ANYBLOB="0000000000000000b7080000000000007b8a6a78e8f4329aa5bef8ff00000000bfa200000000000007020000f8ffffffb70372000008004000b7040000ea5400007b"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10)
syz_emit_ethernet(0x6a, &(0x7f0000000200)={@local, @random="302bd0ac46a2", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x33, 0x0, @private, @broadcast}, {0x0, 0x0, 0x48, 0x0, @wg=@cookie={0x3, 0x4, "1fa3883e21cd9fe5caae18544a9131d14c91cf0d35507989", "6e447a58f2e6a0893330bdb477ae5aa6740446707740eb6dcb6c5545363eff42"}}}}}}, 0x0)
r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0xc018480b, &(0x7f00000000c0)={0x3, 0x200, 0x81, 0x7f, 0x21185045, 0x7})
syz_clone(0xc1003000, 0x0, 0x0, 0x0, 0x0, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
syz_open_dev$hiddev(&(0x7f00000002c0), 0x6f0d, 0x40)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x60000, 0x3)
getdents64(r3, &(0x7f0000001f80)=""/4096, 0x1000)
fchdir(0xffffffffffffffff)
r4 = socket(0x1e, 0x4, 0x0)
setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000100)=@req={0x3fc, 0x0, 0x0, 0x6}, 0x10)
ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program crashed: UBSAN: shift-out-of-bounds in s32ton
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-openat$binderfs-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_emit_ethernet-syz_open_dev$hiddev-ioctl$HIDIOCGUSAGE-syz_clone-mkdirat$cgroup_root-syz_open_dev$hiddev-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dir-getdents64-fchdir-socket-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1c, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="bb6167d7b3838265979b8ccd5d9db898e4cbda30f7f32e2954bbde9320ab54386ff6b8a5ddc182c5b840ebe3cfc43754162ea3f2dbb783d3090dbd4f8c57a1ab971c60c9698e137e6d748a1a7fa65d738b493afd8c70bcdac672fc815b12b5fd1805aa00e2dea1ece39047467380c87193911838088c1512ee14f7d63400f916065b5b46342744750c9d1be8dd7c900acbb380199ed21def916aa484779e4c344005a8bc613d4e0e39484bb4e0a95f1e719aa82789ea77484f8e023b47ff9e452d58ffc8570077d05a5c68bcb88df41a37dbce", @ANYBLOB="0000000000000000b7080000000000007b8a6a78e8f4329aa5bef8ff00000000bfa200000000000007020000f8ffffffb70372000008004000b7040000ea5400007b"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10)
syz_emit_ethernet(0x6a, &(0x7f0000000200)={@local, @random="302bd0ac46a2", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x33, 0x0, @private, @broadcast}, {0x0, 0x0, 0x48, 0x0, @wg=@cookie={0x3, 0x4, "1fa3883e21cd9fe5caae18544a9131d14c91cf0d35507989", "6e447a58f2e6a0893330bdb477ae5aa6740446707740eb6dcb6c5545363eff42"}}}}}}, 0x0)
r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0xc018480b, &(0x7f00000000c0)={0x3, 0x200, 0x81, 0x7f, 0x21185045, 0x7})
syz_clone(0xc1003000, 0x0, 0x0, 0x0, 0x0, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
syz_open_dev$hiddev(&(0x7f00000002c0), 0x6f0d, 0x40)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x60000, 0x3)
getdents64(r3, &(0x7f0000001f80)=""/4096, 0x1000)
fchdir(0xffffffffffffffff)
socket(0x1e, 0x4, 0x0)
ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program crashed: UBSAN: shift-out-of-bounds in s32ton
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-openat$binderfs-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_emit_ethernet-syz_open_dev$hiddev-ioctl$HIDIOCGUSAGE-syz_clone-mkdirat$cgroup_root-syz_open_dev$hiddev-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dir-getdents64-fchdir-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1c, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="bb6167d7b3838265979b8ccd5d9db898e4cbda30f7f32e2954bbde9320ab54386ff6b8a5ddc182c5b840ebe3cfc43754162ea3f2dbb783d3090dbd4f8c57a1ab971c60c9698e137e6d748a1a7fa65d738b493afd8c70bcdac672fc815b12b5fd1805aa00e2dea1ece39047467380c87193911838088c1512ee14f7d63400f916065b5b46342744750c9d1be8dd7c900acbb380199ed21def916aa484779e4c344005a8bc613d4e0e39484bb4e0a95f1e719aa82789ea77484f8e023b47ff9e452d58ffc8570077d05a5c68bcb88df41a37dbce", @ANYBLOB="0000000000000000b7080000000000007b8a6a78e8f4329aa5bef8ff00000000bfa200000000000007020000f8ffffffb70372000008004000b7040000ea5400007b"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10)
syz_emit_ethernet(0x6a, &(0x7f0000000200)={@local, @random="302bd0ac46a2", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x33, 0x0, @private, @broadcast}, {0x0, 0x0, 0x48, 0x0, @wg=@cookie={0x3, 0x4, "1fa3883e21cd9fe5caae18544a9131d14c91cf0d35507989", "6e447a58f2e6a0893330bdb477ae5aa6740446707740eb6dcb6c5545363eff42"}}}}}}, 0x0)
r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0xc018480b, &(0x7f00000000c0)={0x3, 0x200, 0x81, 0x7f, 0x21185045, 0x7})
syz_clone(0xc1003000, 0x0, 0x0, 0x0, 0x0, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
syz_open_dev$hiddev(&(0x7f00000002c0), 0x6f0d, 0x40)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x60000, 0x3)
getdents64(r3, &(0x7f0000001f80)=""/4096, 0x1000)
fchdir(0xffffffffffffffff)
ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program crashed: UBSAN: shift-out-of-bounds in s32ton
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-openat$binderfs-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_emit_ethernet-syz_open_dev$hiddev-ioctl$HIDIOCGUSAGE-syz_clone-mkdirat$cgroup_root-syz_open_dev$hiddev-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dir-getdents64-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1c, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="bb6167d7b3838265979b8ccd5d9db898e4cbda30f7f32e2954bbde9320ab54386ff6b8a5ddc182c5b840ebe3cfc43754162ea3f2dbb783d3090dbd4f8c57a1ab971c60c9698e137e6d748a1a7fa65d738b493afd8c70bcdac672fc815b12b5fd1805aa00e2dea1ece39047467380c87193911838088c1512ee14f7d63400f916065b5b46342744750c9d1be8dd7c900acbb380199ed21def916aa484779e4c344005a8bc613d4e0e39484bb4e0a95f1e719aa82789ea77484f8e023b47ff9e452d58ffc8570077d05a5c68bcb88df41a37dbce", @ANYBLOB="0000000000000000b7080000000000007b8a6a78e8f4329aa5bef8ff00000000bfa200000000000007020000f8ffffffb70372000008004000b7040000ea5400007b"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10)
syz_emit_ethernet(0x6a, &(0x7f0000000200)={@local, @random="302bd0ac46a2", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x33, 0x0, @private, @broadcast}, {0x0, 0x0, 0x48, 0x0, @wg=@cookie={0x3, 0x4, "1fa3883e21cd9fe5caae18544a9131d14c91cf0d35507989", "6e447a58f2e6a0893330bdb477ae5aa6740446707740eb6dcb6c5545363eff42"}}}}}}, 0x0)
r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0xc018480b, &(0x7f00000000c0)={0x3, 0x200, 0x81, 0x7f, 0x21185045, 0x7})
syz_clone(0xc1003000, 0x0, 0x0, 0x0, 0x0, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
syz_open_dev$hiddev(&(0x7f00000002c0), 0x6f0d, 0x40)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x60000, 0x3)
getdents64(r3, &(0x7f0000001f80)=""/4096, 0x1000)
ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program crashed: UBSAN: shift-out-of-bounds in s32ton
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-openat$binderfs-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_emit_ethernet-syz_open_dev$hiddev-ioctl$HIDIOCGUSAGE-syz_clone-mkdirat$cgroup_root-syz_open_dev$hiddev-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dir-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1c, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="bb6167d7b3838265979b8ccd5d9db898e4cbda30f7f32e2954bbde9320ab54386ff6b8a5ddc182c5b840ebe3cfc43754162ea3f2dbb783d3090dbd4f8c57a1ab971c60c9698e137e6d748a1a7fa65d738b493afd8c70bcdac672fc815b12b5fd1805aa00e2dea1ece39047467380c87193911838088c1512ee14f7d63400f916065b5b46342744750c9d1be8dd7c900acbb380199ed21def916aa484779e4c344005a8bc613d4e0e39484bb4e0a95f1e719aa82789ea77484f8e023b47ff9e452d58ffc8570077d05a5c68bcb88df41a37dbce", @ANYBLOB="0000000000000000b7080000000000007b8a6a78e8f4329aa5bef8ff00000000bfa200000000000007020000f8ffffffb70372000008004000b7040000ea5400007b"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10)
syz_emit_ethernet(0x6a, &(0x7f0000000200)={@local, @random="302bd0ac46a2", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x33, 0x0, @private, @broadcast}, {0x0, 0x0, 0x48, 0x0, @wg=@cookie={0x3, 0x4, "1fa3883e21cd9fe5caae18544a9131d14c91cf0d35507989", "6e447a58f2e6a0893330bdb477ae5aa6740446707740eb6dcb6c5545363eff42"}}}}}}, 0x0)
r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0xc018480b, &(0x7f00000000c0)={0x3, 0x200, 0x81, 0x7f, 0x21185045, 0x7})
syz_clone(0xc1003000, 0x0, 0x0, 0x0, 0x0, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
syz_open_dev$hiddev(&(0x7f00000002c0), 0x6f0d, 0x40)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x60000, 0x3)
ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program crashed: UBSAN: shift-out-of-bounds in s32ton
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-openat$binderfs-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_emit_ethernet-syz_open_dev$hiddev-ioctl$HIDIOCGUSAGE-syz_clone-mkdirat$cgroup_root-syz_open_dev$hiddev-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1c, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="bb6167d7b3838265979b8ccd5d9db898e4cbda30f7f32e2954bbde9320ab54386ff6b8a5ddc182c5b840ebe3cfc43754162ea3f2dbb783d3090dbd4f8c57a1ab971c60c9698e137e6d748a1a7fa65d738b493afd8c70bcdac672fc815b12b5fd1805aa00e2dea1ece39047467380c87193911838088c1512ee14f7d63400f916065b5b46342744750c9d1be8dd7c900acbb380199ed21def916aa484779e4c344005a8bc613d4e0e39484bb4e0a95f1e719aa82789ea77484f8e023b47ff9e452d58ffc8570077d05a5c68bcb88df41a37dbce", @ANYBLOB="0000000000000000b7080000000000007b8a6a78e8f4329aa5bef8ff00000000bfa200000000000007020000f8ffffffb70372000008004000b7040000ea5400007b"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10)
syz_emit_ethernet(0x6a, &(0x7f0000000200)={@local, @random="302bd0ac46a2", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x33, 0x0, @private, @broadcast}, {0x0, 0x0, 0x48, 0x0, @wg=@cookie={0x3, 0x4, "1fa3883e21cd9fe5caae18544a9131d14c91cf0d35507989", "6e447a58f2e6a0893330bdb477ae5aa6740446707740eb6dcb6c5545363eff42"}}}}}}, 0x0)
r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0xc018480b, &(0x7f00000000c0)={0x3, 0x200, 0x81, 0x7f, 0x21185045, 0x7})
syz_clone(0xc1003000, 0x0, 0x0, 0x0, 0x0, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
syz_open_dev$hiddev(&(0x7f00000002c0), 0x6f0d, 0x40)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program crashed: UBSAN: shift-out-of-bounds in s32ton
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-openat$binderfs-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_emit_ethernet-syz_open_dev$hiddev-ioctl$HIDIOCGUSAGE-syz_clone-mkdirat$cgroup_root-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1c, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="bb6167d7b3838265979b8ccd5d9db898e4cbda30f7f32e2954bbde9320ab54386ff6b8a5ddc182c5b840ebe3cfc43754162ea3f2dbb783d3090dbd4f8c57a1ab971c60c9698e137e6d748a1a7fa65d738b493afd8c70bcdac672fc815b12b5fd1805aa00e2dea1ece39047467380c87193911838088c1512ee14f7d63400f916065b5b46342744750c9d1be8dd7c900acbb380199ed21def916aa484779e4c344005a8bc613d4e0e39484bb4e0a95f1e719aa82789ea77484f8e023b47ff9e452d58ffc8570077d05a5c68bcb88df41a37dbce", @ANYBLOB="0000000000000000b7080000000000007b8a6a78e8f4329aa5bef8ff00000000bfa200000000000007020000f8ffffffb70372000008004000b7040000ea5400007b"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10)
syz_emit_ethernet(0x6a, &(0x7f0000000200)={@local, @random="302bd0ac46a2", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x33, 0x0, @private, @broadcast}, {0x0, 0x0, 0x48, 0x0, @wg=@cookie={0x3, 0x4, "1fa3883e21cd9fe5caae18544a9131d14c91cf0d35507989", "6e447a58f2e6a0893330bdb477ae5aa6740446707740eb6dcb6c5545363eff42"}}}}}}, 0x0)
r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0xc018480b, &(0x7f00000000c0)={0x3, 0x200, 0x81, 0x7f, 0x21185045, 0x7})
syz_clone(0xc1003000, 0x0, 0x0, 0x0, 0x0, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
syz_open_dev$hiddev(&(0x7f00000002c0), 0x6f0d, 0x40)
ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program crashed: UBSAN: shift-out-of-bounds in s32ton
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-openat$binderfs-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_emit_ethernet-syz_open_dev$hiddev-ioctl$HIDIOCGUSAGE-syz_clone-mkdirat$cgroup_root-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1c, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="bb6167d7b3838265979b8ccd5d9db898e4cbda30f7f32e2954bbde9320ab54386ff6b8a5ddc182c5b840ebe3cfc43754162ea3f2dbb783d3090dbd4f8c57a1ab971c60c9698e137e6d748a1a7fa65d738b493afd8c70bcdac672fc815b12b5fd1805aa00e2dea1ece39047467380c87193911838088c1512ee14f7d63400f916065b5b46342744750c9d1be8dd7c900acbb380199ed21def916aa484779e4c344005a8bc613d4e0e39484bb4e0a95f1e719aa82789ea77484f8e023b47ff9e452d58ffc8570077d05a5c68bcb88df41a37dbce", @ANYBLOB="0000000000000000b7080000000000007b8a6a78e8f4329aa5bef8ff00000000bfa200000000000007020000f8ffffffb70372000008004000b7040000ea5400007b"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10)
syz_emit_ethernet(0x6a, &(0x7f0000000200)={@local, @random="302bd0ac46a2", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x33, 0x0, @private, @broadcast}, {0x0, 0x0, 0x48, 0x0, @wg=@cookie={0x3, 0x4, "1fa3883e21cd9fe5caae18544a9131d14c91cf0d35507989", "6e447a58f2e6a0893330bdb477ae5aa6740446707740eb6dcb6c5545363eff42"}}}}}}, 0x0)
r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0xc018480b, &(0x7f00000000c0)={0x3, 0x200, 0x81, 0x7f, 0x21185045, 0x7})
syz_clone(0xc1003000, 0x0, 0x0, 0x0, 0x0, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program crashed: UBSAN: shift-out-of-bounds in s32ton
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-openat$binderfs-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_emit_ethernet-syz_open_dev$hiddev-ioctl$HIDIOCGUSAGE-syz_clone-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1c, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="bb6167d7b3838265979b8ccd5d9db898e4cbda30f7f32e2954bbde9320ab54386ff6b8a5ddc182c5b840ebe3cfc43754162ea3f2dbb783d3090dbd4f8c57a1ab971c60c9698e137e6d748a1a7fa65d738b493afd8c70bcdac672fc815b12b5fd1805aa00e2dea1ece39047467380c87193911838088c1512ee14f7d63400f916065b5b46342744750c9d1be8dd7c900acbb380199ed21def916aa484779e4c344005a8bc613d4e0e39484bb4e0a95f1e719aa82789ea77484f8e023b47ff9e452d58ffc8570077d05a5c68bcb88df41a37dbce", @ANYBLOB="0000000000000000b7080000000000007b8a6a78e8f4329aa5bef8ff00000000bfa200000000000007020000f8ffffffb70372000008004000b7040000ea5400007b"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10)
syz_emit_ethernet(0x6a, &(0x7f0000000200)={@local, @random="302bd0ac46a2", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x33, 0x0, @private, @broadcast}, {0x0, 0x0, 0x48, 0x0, @wg=@cookie={0x3, 0x4, "1fa3883e21cd9fe5caae18544a9131d14c91cf0d35507989", "6e447a58f2e6a0893330bdb477ae5aa6740446707740eb6dcb6c5545363eff42"}}}}}}, 0x0)
r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0xc018480b, &(0x7f00000000c0)={0x3, 0x200, 0x81, 0x7f, 0x21185045, 0x7})
syz_clone(0xc1003000, 0x0, 0x0, 0x0, 0x0, 0x0)
ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program crashed: UBSAN: shift-out-of-bounds in s32ton
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-openat$binderfs-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_emit_ethernet-syz_open_dev$hiddev-ioctl$HIDIOCGUSAGE-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1c, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="bb6167d7b3838265979b8ccd5d9db898e4cbda30f7f32e2954bbde9320ab54386ff6b8a5ddc182c5b840ebe3cfc43754162ea3f2dbb783d3090dbd4f8c57a1ab971c60c9698e137e6d748a1a7fa65d738b493afd8c70bcdac672fc815b12b5fd1805aa00e2dea1ece39047467380c87193911838088c1512ee14f7d63400f916065b5b46342744750c9d1be8dd7c900acbb380199ed21def916aa484779e4c344005a8bc613d4e0e39484bb4e0a95f1e719aa82789ea77484f8e023b47ff9e452d58ffc8570077d05a5c68bcb88df41a37dbce", @ANYBLOB="0000000000000000b7080000000000007b8a6a78e8f4329aa5bef8ff00000000bfa200000000000007020000f8ffffffb70372000008004000b7040000ea5400007b"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10)
syz_emit_ethernet(0x6a, &(0x7f0000000200)={@local, @random="302bd0ac46a2", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x33, 0x0, @private, @broadcast}, {0x0, 0x0, 0x48, 0x0, @wg=@cookie={0x3, 0x4, "1fa3883e21cd9fe5caae18544a9131d14c91cf0d35507989", "6e447a58f2e6a0893330bdb477ae5aa6740446707740eb6dcb6c5545363eff42"}}}}}}, 0x0)
r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0xc018480b, &(0x7f00000000c0)={0x3, 0x200, 0x81, 0x7f, 0x21185045, 0x7})
ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program crashed: UBSAN: shift-out-of-bounds in s32ton
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-openat$binderfs-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_emit_ethernet-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1c, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="bb6167d7b3838265979b8ccd5d9db898e4cbda30f7f32e2954bbde9320ab54386ff6b8a5ddc182c5b840ebe3cfc43754162ea3f2dbb783d3090dbd4f8c57a1ab971c60c9698e137e6d748a1a7fa65d738b493afd8c70bcdac672fc815b12b5fd1805aa00e2dea1ece39047467380c87193911838088c1512ee14f7d63400f916065b5b46342744750c9d1be8dd7c900acbb380199ed21def916aa484779e4c344005a8bc613d4e0e39484bb4e0a95f1e719aa82789ea77484f8e023b47ff9e452d58ffc8570077d05a5c68bcb88df41a37dbce", @ANYBLOB="0000000000000000b7080000000000007b8a6a78e8f4329aa5bef8ff00000000bfa200000000000007020000f8ffffffb70372000008004000b7040000ea5400007b"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10)
syz_emit_ethernet(0x6a, &(0x7f0000000200)={@local, @random="302bd0ac46a2", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x33, 0x0, @private, @broadcast}, {0x0, 0x0, 0x48, 0x0, @wg=@cookie={0x3, 0x4, "1fa3883e21cd9fe5caae18544a9131d14c91cf0d35507989", "6e447a58f2e6a0893330bdb477ae5aa6740446707740eb6dcb6c5545363eff42"}}}}}}, 0x0)
r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program crashed: UBSAN: shift-out-of-bounds in s32ton
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-openat$binderfs-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_emit_ethernet-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1c, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="bb6167d7b3838265979b8ccd5d9db898e4cbda30f7f32e2954bbde9320ab54386ff6b8a5ddc182c5b840ebe3cfc43754162ea3f2dbb783d3090dbd4f8c57a1ab971c60c9698e137e6d748a1a7fa65d738b493afd8c70bcdac672fc815b12b5fd1805aa00e2dea1ece39047467380c87193911838088c1512ee14f7d63400f916065b5b46342744750c9d1be8dd7c900acbb380199ed21def916aa484779e4c344005a8bc613d4e0e39484bb4e0a95f1e719aa82789ea77484f8e023b47ff9e452d58ffc8570077d05a5c68bcb88df41a37dbce", @ANYBLOB="0000000000000000b7080000000000007b8a6a78e8f4329aa5bef8ff00000000bfa200000000000007020000f8ffffffb70372000008004000b7040000ea5400007b"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10)
syz_emit_ethernet(0x6a, &(0x7f0000000200)={@local, @random="302bd0ac46a2", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x33, 0x0, @private, @broadcast}, {0x0, 0x0, 0x48, 0x0, @wg=@cookie={0x3, 0x4, "1fa3883e21cd9fe5caae18544a9131d14c91cf0d35507989", "6e447a58f2e6a0893330bdb477ae5aa6740446707740eb6dcb6c5545363eff42"}}}}}}, 0x0)
ioctl$HIDIOCSREPORT(0xffffffffffffffff, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program did not crash
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-openat$binderfs-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1c, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="bb6167d7b3838265979b8ccd5d9db898e4cbda30f7f32e2954bbde9320ab54386ff6b8a5ddc182c5b840ebe3cfc43754162ea3f2dbb783d3090dbd4f8c57a1ab971c60c9698e137e6d748a1a7fa65d738b493afd8c70bcdac672fc815b12b5fd1805aa00e2dea1ece39047467380c87193911838088c1512ee14f7d63400f916065b5b46342744750c9d1be8dd7c900acbb380199ed21def916aa484779e4c344005a8bc613d4e0e39484bb4e0a95f1e719aa82789ea77484f8e023b47ff9e452d58ffc8570077d05a5c68bcb88df41a37dbce", @ANYBLOB="0000000000000000b7080000000000007b8a6a78e8f4329aa5bef8ff00000000bfa200000000000007020000f8ffffffb70372000008004000b7040000ea5400007b"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10)
r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program crashed: UBSAN: shift-out-of-bounds in s32ton
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-openat$binderfs-bpf$MAP_CREATE-bpf$PROG_LOAD-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1c, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="bb6167d7b3838265979b8ccd5d9db898e4cbda30f7f32e2954bbde9320ab54386ff6b8a5ddc182c5b840ebe3cfc43754162ea3f2dbb783d3090dbd4f8c57a1ab971c60c9698e137e6d748a1a7fa65d738b493afd8c70bcdac672fc815b12b5fd1805aa00e2dea1ece39047467380c87193911838088c1512ee14f7d63400f916065b5b46342744750c9d1be8dd7c900acbb380199ed21def916aa484779e4c344005a8bc613d4e0e39484bb4e0a95f1e719aa82789ea77484f8e023b47ff9e452d58ffc8570077d05a5c68bcb88df41a37dbce", @ANYBLOB="0000000000000000b7080000000000007b8a6a78e8f4329aa5bef8ff00000000bfa200000000000007020000f8ffffffb70372000008004000b7040000ea5400007b"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program crashed: UBSAN: shift-out-of-bounds in s32ton
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-openat$binderfs-bpf$MAP_CREATE-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program crashed: UBSAN: shift-out-of-bounds in s32ton
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-openat$binderfs-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program crashed: UBSAN: shift-out-of-bounds in s32ton
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program crashed: UBSAN: shift-out-of-bounds in s32ton
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program did not crash
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program did not crash
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
r0 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r0, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program did not crash
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program did not crash
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program crashed: lost connection to test machine
suppressed program crash: lost connection to test machine
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program did not crash
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0)
r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program did not crash
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x0}, 0x0)
r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program did not crash
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
r1 = syz_open_dev$hiddev(0x0, 0x0, 0x0)
ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program did not crash
testing program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r1, 0x400c4808, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=35.167875571s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
program crashed: UBSAN: shift-out-of-bounds in s32ton
simplifying C reproducer
testing compiled C program (duration=35.167875571s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
program crashed: UBSAN: shift-out-of-bounds in s32ton
testing compiled C program (duration=35.167875571s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
program crashed: UBSAN: shift-out-of-bounds in s32ton
testing compiled C program (duration=35.167875571s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
program crashed: UBSAN: shift-out-of-bounds in s32ton
testing compiled C program (duration=35.167875571s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
program crashed: UBSAN: shift-out-of-bounds in s32ton
testing compiled C program (duration=35.167875571s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
program crashed: UBSAN: shift-out-of-bounds in s32ton
testing compiled C program (duration=35.167875571s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
program crashed: UBSAN: shift-out-of-bounds in s32ton
testing program (duration=35.167875571s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program crashed: UBSAN: shift-out-of-bounds in s32ton
validation run: crashed=true
testing program (duration=35.167875571s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program crashed: UBSAN: shift-out-of-bounds in s32ton
validation run: crashed=true
testing program (duration=35.167875571s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCSREPORT
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0)
r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f0000000240)={0x3, 0x100})

program crashed: UBSAN: shift-out-of-bounds in s32ton
validation run: crashed=true
reproducing took 36m13.939760765s
repro crashed as (corrupted=false):
================================================================================
UBSAN: shift-out-of-bounds in drivers/hid/hid-core.c:1346:16
shift exponent 4294967295 is too large for 32-bit type '__s32' (aka 'int')
CPU: 1 PID: 373 Comm: syz.2.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:88
 dump_stack_lvl+0xee/0x150 lib/dump_stack.c:106
 dump_stack+0x15/0x20 lib/dump_stack.c:113
 ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
 __ubsan_handle_shift_out_of_bounds+0x37c/0x400 lib/ubsan.c:321
 s32ton+0xe8/0x150 drivers/hid/hid-core.c:1346
 hid_output_field drivers/hid/hid-core.c:1615 [inline]
 hid_output_report+0x423/0x780 drivers/hid/hid-core.c:1647
 __usbhid_submit_report drivers/hid/usbhid/hid-core.c:591 [inline]
 usbhid_submit_report+0x45b/0xa80 drivers/hid/usbhid/hid-core.c:636
 usbhid_request+0x50/0x60 drivers/hid/usbhid/hid-core.c:-1
 hid_hw_request include/linux/hid.h:1100 [inline]
 hiddev_ioctl+0xfd5/0x1630 drivers/hid/usbhid/hiddev.c:726
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:874 [inline]
 __se_sys_ioctl+0x121/0x1a0 fs/ioctl.c:860
 __x64_sys_ioctl+0x7b/0x90 fs/ioctl.c:860
 x64_sys_call+0x2f/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fcd7fea3749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd83066138 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fcd800f9fa0 RCX: 00007fcd7fea3749
RDX: 0000200000000240 RSI: 00000000400c4808 RDI: 0000000000000004
RBP: 00007fcd7ff27f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fcd800f9fa0 R14: 00007fcd800f9fa0 R15: 0000000000000003
 </TASK>
================================================================================

final repro crashed as (corrupted=false):
================================================================================
UBSAN: shift-out-of-bounds in drivers/hid/hid-core.c:1346:16
shift exponent 4294967295 is too large for 32-bit type '__s32' (aka 'int')
CPU: 1 PID: 373 Comm: syz.2.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:88
 dump_stack_lvl+0xee/0x150 lib/dump_stack.c:106
 dump_stack+0x15/0x20 lib/dump_stack.c:113
 ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
 __ubsan_handle_shift_out_of_bounds+0x37c/0x400 lib/ubsan.c:321
 s32ton+0xe8/0x150 drivers/hid/hid-core.c:1346
 hid_output_field drivers/hid/hid-core.c:1615 [inline]
 hid_output_report+0x423/0x780 drivers/hid/hid-core.c:1647
 __usbhid_submit_report drivers/hid/usbhid/hid-core.c:591 [inline]
 usbhid_submit_report+0x45b/0xa80 drivers/hid/usbhid/hid-core.c:636
 usbhid_request+0x50/0x60 drivers/hid/usbhid/hid-core.c:-1
 hid_hw_request include/linux/hid.h:1100 [inline]
 hiddev_ioctl+0xfd5/0x1630 drivers/hid/usbhid/hiddev.c:726
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:874 [inline]
 __se_sys_ioctl+0x121/0x1a0 fs/ioctl.c:860
 __x64_sys_ioctl+0x7b/0x90 fs/ioctl.c:860
 x64_sys_call+0x2f/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fcd7fea3749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd83066138 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fcd800f9fa0 RCX: 00007fcd7fea3749
RDX: 0000200000000240 RSI: 00000000400c4808 RDI: 0000000000000004
RBP: 00007fcd7ff27f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fcd800f9fa0 R14: 00007fcd800f9fa0 R15: 0000000000000003
 </TASK>
================================================================================