Extracting prog: 6m45.199745677s
Minimizing prog: 18m46.081041427s
Simplifying prog options: 0s
Extracting C: 1m54.447800816s
Simplifying C: 17m37.672613656s


extracting reproducer from 51 programs
testing a last program of every proc
single: executing 11 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x14, 0x16, 0xa, 0x1, 0x0, 0x0, {0x1, 0x0, 0xfffc}}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}}, 0x5c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfs-openat$cgroup_ro-io_uring_setup-openat$sndseq-prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-recvmmsg-sched_setscheduler-syz_emit_vhci-openat$kvm-bpf$PROG_LOAD
detailed listing:
executing program 0:
syz_mount_image$hfs(&(0x7f0000000140), &(0x7f0000000000)='./file0\x00', 0x1000000, &(0x7f0000000180)=ANY=[@ANYBLOB="71756965742c696f636861727365743d69736f383835392d372c63726561746f723d8761b3312c636f6465706167653d6370313235302c7569643d", @ANYRESHEX=0x0, @ANYBLOB='F\x00', @ANYRES64=0x0], 0x1, 0x2fb, &(0x7f0000000240)="$eJzs3b9u00AcB/DvnZ02pVUxbRESC6hQCZaKAgNiCUJZ2ZkQkKRShFVEWyRgIVSMiAdg5xV4CBYQLwAsTDxANqM7nx07OV9SSOImfD9SIud8f36H/91Zogci+m/drX//eOOX+gjAgwfgNiABVAEfwFmcqz7fO2wfhq2mqyJPl1AfgbikGMjT2GvZiqpyuoQRqF8+VrJpNBlRFN35UXYQVDp99VtIYNFch3p/dcpxjUt/5zrAhZJCKU3230B00cULrJYYDhERnQDm+S/NY2JFJwlICWyZx/5MP//7dcsOYLxuhgNJkbNA5vmvR3eRUMf3tN7Vm+/pKZzaL5NZ4ijBVPp+LyA+s3JjMGGfVf6MYiYWubTb9rHdeIOmxBFqRqbAhv5uxqduYki0m5a5qUNxbRXcOxX3Ro0ol/p3JyHttsPWotqwxL9+vBb/nfgsvooHIsAHNNPxnx8JdZj0kQr6jpSsqPivFde4rEupXDDT/lqtJnNZzuhGzpsWjCG9rNpnJNk6kxcEnTQCS5xHyYZuew351wpx73ZsDYhe5eu2UkH6a7CsbmsjV8ozZ8J242nofJXytzrOvUkXxXtxX2ziNz6hnhn/SxXfFjJXputWL3ROc2bE/Vmw5/R1zmDgydEL9mIagbHo7AcVON7bsnd4jFtYPXj56okXhq19tfHIsvFsZV+YlMpbwJpn8hseHHnQSVMiTz08XkfRqDVHkwz+6lgrVPePNEVdPrbM6ipLU+S0D9P8bfiw7ap/geuEnOhGMnQZS4VqoFWwayL3KDphDkRy0E3CwCCW5pwad4l4/qdH8mZUp+8z6itwjNPdk0zkatxJZ3D5oeCabewyZG6wXDyDy7R4vWDOqOdcl64AlzOJAs4WAx3n3BB1fMNDvv8nIiIiIiIiIiIiIiIiIiIiIiIiIpo10/gfC2X3kYiIiIiIiIiIiIiIiIiIiIiIiIiIiIho1o2+/u9Sb6Um29+I1+v/BkPX/80tAGwWiuL6v0Tl+BMAAP//CpR9aw==")
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cgroup.controllers\x00', 0x275a, 0x0)
io_uring_setup(0x175c, &(0x7f000009df80)={0x0, 0x678, 0x0, 0x0, 0x2e8})
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000b40), 0x101000)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
syz_emit_vhci(0x0, 0x10)
openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000140)=ANY=[@ANYBLOB="61154c00000000006113306000e60e00bfa00000000000001503000008004e002d35010000000000950000bc000000006916000000000000bf67000000000000350605000fff07206706000005000000160302000ee60060bf500000000000000f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffad4501000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a81426104000000000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546ccd3f1d5ab2af27546e7c0700000000000000b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc2300000008ac86d8a297dff0445a15f21dce4de9f29eff65aadc841848c9b562a31e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4d08000000ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43000000207b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000000000000000000000000000c1eb2d91fb79ea00000000000000bb0d0000000000000000b712c1e47be511fe32fbc90e2364a55e9bb609c64423d2d00fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386bab561cda886fa642994cacd4722a11dc3c693962895496d4f6e9cc54db6c7205a6b068fff496d2da7d632bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c835d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db88aa3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fb9fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff139604faf0a4da65396174b4563d54b52f06c870edf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c299848649e1a6bff5af657a67463d7dbf85ae9321fad16ee751cd7dde94ec97549c2b517dc4a29b9cba8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2a3bc87b0da23c00d9ef418cf19e7a8c4c328be0ce95798adc2dca871073f6bd61dc18402cde8bf377b2eaa45c940aabc86b94f8cbde4d470667bee722a6a2af483ad0d3415ed0f9db059a6cffb92e2a0cfd81434e00000000000000000000d154ba10a8e51489a614e69722bac30000000000000000000000000000c5c4d188ff555285b9743d3aac000583f42d168613151d681a2f71373f20d92c9048407c91fabecfe8b3f2d5454d127edab14ba61ba1cfc4336324c86f3dcb43e9a58208077e90f6ec1c7ac756f61dcc372cdd30b82507489f0bbfbd3c3f21752e81319c0161e154ceb16e00bc7f5a6962dff317f4d014786e432817064874d69a39cb0da31bcc5f81894d8a5cbb8be3f7741b18007dff12eb95066cc6bc256f0a12282224bb031bbee6d23cef7074f6d718b06ca80b57aa183dd0c3eee45891441f2b89b4c67aa9882281393954972046974f18df232cd7fca610e33f51c2d062020f403d85ff36c26e2f6bd1d82f4d3ceb3472d9a77e0057a3bfe697d9ab7585f4a1b381343d2cf855689232f4fc5135790662dc1419a374be9d7b3e5be2886d23add90d862f1a682ff11c798e338af3e5bb0f9d3952b15bf3e0c618c89d20ca1e18a031397693bf3cfbd8417e5b55e641c898c280356f2da222d5d68919d98158578dcf18efa404e508bcbbb8cfcf70086821ebdf34c9a1dff45af873d0ecdf904c2bdbef81f246d26f4b40df949e12bdac18532f4e11c608cc31d60cb591c40a7b386fa1c753336d7220a35118d4919b45eff32aab684e62c6691de14e97aa7e9dc8ecf0cd50540246d2b746e41e5b4e2c095039dfe0f71db6265f7580d098be40ef36faee5d1695830d4242a23e541e6ce9fa1998d8961cf4fe3c8e8fbb566fffffffffc229614a4b7f80d237b8abc6fd0407de31d6e5532f360d379f20f054e5deb27f7922fe6c14eba96c9af409da03290e4009f872d5aaca63dbe239efb1e02dd4fc07f8c5b070e2ddeb4b5afa6df2e7e162962e334d8553cc56008ddc8277fa9e8f6684513bfa827686b6fb71259743f55f46fa7e6379312e93213faf275f0441d46bc5690181244c44bea45854ed4ccd99f3fd328110ae22ef1504ec0566652d742ed8a7e202539c6531824f7399b486fbb906a91b77f2a6ba27bf97ebc7482cea32278a7acd9f2210e6ed2defcbd112f29a92401c5a37c58835f870b056186ef3971d3d9effa5661cabc2a059689dcfb030dd4ac0fe54db67510d3e9a5d36b900000000000000000000000000000000c9e484cf5f8c0955c11b285de46871d62f9d986e73658d228225b21f694dd2dc80e96ce476496973ee14e3d4fd03507c6f7c0c8ae809ddc9a36b4f30d15d08cc8e72d750f5e529cf4cec823b923d382f3f2c42dcb4b316eba77e7f767ae17d4d3427c9379eadbd040fbbe0c6dd8100f1558354bdd35626052c2e66cc34f4e266cc04218764824533cac2736e236b50ae4d800565910200af9cb11002791a91d834ffcc65a6226ecafe0372e3ace29c2441eca24371857aa9eb9b3910a2eb"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffffd2, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-socket$inet6-socket$nl_route-sendmsg$nl_route-listen-setsockopt$inet6_int-ioctl$KVM_CREATE_VM-mmap-ioctl$KVM_CREATE_VCPU-accept4$ax25-ioctl$sock_inet_SIOCGIFDSTADDR-openat$cgroup-openat$cgroup-ioctl$KVM_SET_SREGS-openat$ptmx-ioctl$TCSETA-syz_kvm_setup_cpu$x86-ioctl$KVM_RUN-ioctl$KVM_GET_DIRTY_LOG-socket-setsockopt$sock_int-bind$inet-recvmmsg-sendto$inet-setsockopt$MRT6_ASSERT-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-capset-bpf$PROG_LOAD-syz_mount_image$erofs
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r1 = socket$inet6(0xa, 0x6, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000700)=ANY=[@ANYBLOB="4800000010004b0400000000000000007a000000", @ANYRES32=0x0, @ANYBLOB="0000000000006d058bd0128008000100677265001c00028006000e000c0000bf0600030080000000080007dacba0cb3fbf1f49ec90f49c5aa0754830553106cb1c6e3b8a5bd9f2b0f9a863da2682c46bccc02c005c27c784146ed5c7820fb5c81e4847a257f15e6b859e8ac7778dbb169bfb507ccffcbffa885c81f096420266efb91f60b15663842fc240d9420b64c02eb060d917b6c8cbc45c58e5bf54e125c56e03ed18ef1a038980c75bb909dc8673da25ffba8af395f3aae0f5df7a567547d635e7ccf2538e305406b3dd433fd0f4aa9619b1bb95dcb8d9e59055a14540b8efe3f50aa8dfda9c1db1c87f578264364389e24e05708cb8b0abf604179154e69397f7f85382a6fbe91d3adcf7021307f7a2cf3765910556c5c39fbfcf97b0638df2"], 0x48}}, 0x0)
listen(r1, 0x101)
setsockopt$inet6_int(r1, 0x10d, 0xa, &(0x7f0000000040)=0x5, 0x4)
r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0)
r5 = accept4$ax25(0xffffffffffffffff, &(0x7f0000000480)={{}, [@bcast, @bcast, @netrom, @bcast, @rose, @bcast, @default, @netrom]}, &(0x7f0000000500)=0x48, 0x66af955d8e3a1475)
ioctl$sock_inet_SIOCGIFDSTADDR(r5, 0x8917, &(0x7f0000000540)={'veth1_to_bond\x00', {0x2, 0x0, @multicast2}})
r6 = openat$cgroup(0xffffffffffffffff, &(0x7f00000003c0)='syz1\x00', 0x200002, 0x0)
openat$cgroup(r6, &(0x7f0000000400)='syz0\x00', 0x200002, 0x0)
ioctl$KVM_SET_SREGS(r4, 0x4138ae84, &(0x7f00000005c0)={{0xeeee8000, 0x2, 0xe, 0x1, 0xb, 0x3, 0x97, 0xf, 0x6, 0x6, 0xc, 0x7}, {0x1, 0xf000, 0x8, 0x2, 0x81, 0x4a, 0x4, 0x42, 0xd, 0x6, 0x0, 0x7}, {0xeeee0000, 0x5000, 0xa, 0x1, 0x3, 0x0, 0x3, 0x3, 0x4, 0x1, 0x6, 0x3}, {0x4000, 0x100000, 0xe, 0x3, 0x2, 0x81, 0x7, 0x94, 0x40, 0x29, 0xff, 0xe}, {0x100000, 0x10000, 0xf, 0x3, 0x5, 0x5, 0xb, 0x80, 0x7, 0xad, 0x8}, {0xeeee8000, 0xf7ffd000, 0x3, 0x8, 0x4, 0x1, 0x2, 0x1, 0x7, 0x5, 0xef, 0x7}, {0xeeee8000, 0xf000, 0xb, 0x80, 0x2, 0xf8, 0xf6, 0x7, 0x0, 0x2, 0x3, 0x7}, {0xe6e70000, 0x0, 0x4, 0x5, 0x7d, 0xd, 0x0, 0x88, 0x1, 0x0, 0x8, 0xff}, {0xeeee7000, 0xd85e}, {0xeeee0000, 0xb41f}, 0x20000000, 0x0, 0x0, 0x200082, 0x7, 0x4100, 0x8080000, [0x40, 0x0, 0x7, 0x4]})
r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
ioctl$TCSETA(r7, 0x5433, 0xffffffffffffffff)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000793000/0x18000)=nil, &(0x7f0000000300)=[@text64={0x40, 0x0}], 0x1, 0x10, 0x0, 0x0)
ioctl$KVM_RUN(r4, 0xae80, 0x0)
ioctl$KVM_GET_DIRTY_LOG(r3, 0x4010ae42, &(0x7f0000000080)={0x0, 0x0, &(0x7f00007a4000/0x4000)=nil})
r8 = socket(0x40000000015, 0x5, 0x0)
setsockopt$sock_int(r8, 0x1, 0x3c, &(0x7f0000000000)=0x1, 0x4)
bind$inet(r8, &(0x7f00008a5ff0)={0x2, 0x0, @loopback}, 0x10)
recvmmsg(r8, &(0x7f0000000d00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000003380)=""/4096, 0x1000}}], 0x1, 0x60010020, 0x0)
sendto$inet(r8, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2, 0x0, @loopback}, 0x10)
setsockopt$MRT6_ASSERT(r8, 0x29, 0xcf, &(0x7f0000000580)=0x1, 0x4)
r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb703000008000000b703000000000020850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f00000002c0)='mm_page_alloc\x00', r9}, 0x10)
capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x20, 0x81, 0xffffffff})
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x15, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b40000000000000079102800000000007b0a00ff000000009500740000000000"], &(0x7f0000003ff6)='GPL\x00', 0x800002, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, r6, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94)
syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000c40)='./file1\x00', 0x810410, &(0x7f00000059c0)=ANY=[], 0x5, 0x1e5, &(0x7f00000001c0)="$eJxiGAWjYBSMWPDo4dcHvU4WIToMDAw8DCoM7FDxF8wINUxI6u/MLNWeaus6Z9PtpUfy+Gp3IWR2ffQJI91+kNkHHJkZSqD8/////0eWV4HSIQxMIDYLTFwTSoczMDKoQtkJf/jh+lIZGBkioewsJHY+J5SRk6qXnJ+TkpaZk2oAIgxBhBGIMEa2H2Th20ZGhhQGBgYOqPsYkeSLK6uyE3NyUovQGaz/YfZgSJHKwBd+YPc5MjHYIoUfKEwjOpobQXw9qLgBJPzAwJCBicEQyjZmYGQIhrItGNgZ9PT0EEGC5H8pFoT5zMT4fzAwBHUHhTNwM5gYaGEyIwNDA7IIA8nm/IcWAzTxO/tAJxtGdBFQhoaLiL3ddRpT11PKbWccqCwDLrgYGBgwpC5xUWYyG9RHWNUgyidGFgYGdaTyiQVRjDPol+QW6BdXVulm5iamp6an5hkZGZsZmBgYmBrpgwsiCImn/OMAl09cSOazIskj111sjGwMFYklJUWGFQwMJUWGcL4RhEQqcYO35b+B63/byMSgoQwxAxSJYG+zY3cPIwQjyWow43T8KBgFo2AUjIJRMApGwSgYBaNgFIyCUTAKRsEoGAWjYBSQBOQZGMGjoNCJqv84gFEAWDUgAAD//6kpX/Y=")

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$char_usb-syz_open_dev$char_usb-syz_usb_disconnect-syz_open_procfs-bpf$MAP_CREATE-socket$kcm-ioctl$sock_kcm_SIOCKCMCLONE-close_range
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_disconnect(r0)
r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip6_mr_vif\x00')
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1900000004000000040000000200000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000001d182930b415"], 0x48)
r2 = socket$kcm(0xa, 0x5, 0x0)
ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x890c, &(0x7f0000000000))
close_range(r1, 0xffffffffffffffff, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ipvs-socket$nl_netfilter-syz_init_net_socket$nfc_llcp-bind$nfc_llcp-syz_init_net_socket$nfc_llcp-bind$nfc_llcp-sendmsg$NFT_BATCH-pidfd_getfd-syz_usb_connect
detailed listing:
executing program 0:
r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
r2 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1)
bind$nfc_llcp(r2, &(0x7f0000000380)={0x27, 0x0, 0x0, 0x0, 0x0, 0x7, "d9298498abdba7f061bd1ca44c226af5160e961711a07760760beeab11e88509de7f1939e8abff0055e5c0d48bd63ffdb93bd43a847a1597c8ef039a5be422", 0x38}, 0x60)
r3 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1)
bind$nfc_llcp(r3, &(0x7f0000000000)={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "d9298498abdba7f061bd1ca44c226af5160e0000000000000006eeab91e8ff0055e564a08bcd3ffdb93bd43a847a1597c8ef03da5be62200", 0x10}, 0x60)
sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x601, 0x0, 0x0, {0x1}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_POLICY={0x8, 0x8, 0x1, 0x0, 0x1}]}], {0x14, 0x10}}, 0x8c}}, 0x0)
pidfd_getfd(r0, r1, 0x0)
syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100006325a640402000207265970000010902240001000000000904000002214c6a0009050702000000da00090589"], 0x0)

program crashed: WARNING in smsusb_start_streaming/usb_submit_urb
single: successfully extracted reproducer
found reproducer with 9 syscalls
minimizing guilty program
testing program (duration=51.039141976s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ipvs-socket$nl_netfilter-syz_init_net_socket$nfc_llcp-bind$nfc_llcp-syz_init_net_socket$nfc_llcp-bind$nfc_llcp-sendmsg$NFT_BATCH-pidfd_getfd
detailed listing:
executing program 0:
r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
r2 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1)
bind$nfc_llcp(r2, &(0x7f0000000380)={0x27, 0x0, 0x0, 0x0, 0x0, 0x7, "d9298498abdba7f061bd1ca44c226af5160e961711a07760760beeab11e88509de7f1939e8abff0055e5c0d48bd63ffdb93bd43a847a1597c8ef039a5be422", 0x38}, 0x60)
r3 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1)
bind$nfc_llcp(r3, &(0x7f0000000000)={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "d9298498abdba7f061bd1ca44c226af5160e0000000000000006eeab91e8ff0055e564a08bcd3ffdb93bd43a847a1597c8ef03da5be62200", 0x10}, 0x60)
sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x601, 0x0, 0x0, {0x1}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_POLICY={0x8, 0x8, 0x1, 0x0, 0x1}]}], {0x14, 0x10}}, 0x8c}}, 0x0)
pidfd_getfd(r0, r1, 0x0)

program did not crash
testing program (duration=51.039141976s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ipvs-socket$nl_netfilter-syz_init_net_socket$nfc_llcp-bind$nfc_llcp-syz_init_net_socket$nfc_llcp-bind$nfc_llcp-sendmsg$NFT_BATCH-syz_usb_connect
detailed listing:
executing program 0:
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1)
bind$nfc_llcp(r1, &(0x7f0000000380)={0x27, 0x0, 0x0, 0x0, 0x0, 0x7, "d9298498abdba7f061bd1ca44c226af5160e961711a07760760beeab11e88509de7f1939e8abff0055e5c0d48bd63ffdb93bd43a847a1597c8ef039a5be422", 0x38}, 0x60)
r2 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1)
bind$nfc_llcp(r2, &(0x7f0000000000)={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "d9298498abdba7f061bd1ca44c226af5160e0000000000000006eeab91e8ff0055e564a08bcd3ffdb93bd43a847a1597c8ef03da5be62200", 0x10}, 0x60)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x601, 0x0, 0x0, {0x1}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_POLICY={0x8, 0x8, 0x1, 0x0, 0x1}]}], {0x14, 0x10}}, 0x8c}}, 0x0)
syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100006325a640402000207265970000010902240001000000000904000002214c6a0009050702000000da00090589"], 0x0)

program crashed: WARNING in smsusb_start_streaming/usb_submit_urb
testing program (duration=51.039141976s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ipvs-socket$nl_netfilter-syz_init_net_socket$nfc_llcp-bind$nfc_llcp-syz_init_net_socket$nfc_llcp-bind$nfc_llcp-syz_usb_connect
detailed listing:
executing program 0:
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
r0 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1)
bind$nfc_llcp(r0, &(0x7f0000000380)={0x27, 0x0, 0x0, 0x0, 0x0, 0x7, "d9298498abdba7f061bd1ca44c226af5160e961711a07760760beeab11e88509de7f1939e8abff0055e5c0d48bd63ffdb93bd43a847a1597c8ef039a5be422", 0x38}, 0x60)
r1 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1)
bind$nfc_llcp(r1, &(0x7f0000000000)={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "d9298498abdba7f061bd1ca44c226af5160e0000000000000006eeab91e8ff0055e564a08bcd3ffdb93bd43a847a1597c8ef03da5be62200", 0x10}, 0x60)
syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100006325a640402000207265970000010902240001000000000904000002214c6a0009050702000000da00090589"], 0x0)

program crashed: WARNING in smsusb_start_streaming/usb_submit_urb
testing program (duration=51.039141976s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ipvs-socket$nl_netfilter-syz_init_net_socket$nfc_llcp-bind$nfc_llcp-syz_init_net_socket$nfc_llcp-syz_usb_connect
detailed listing:
executing program 0:
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
r0 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1)
bind$nfc_llcp(r0, &(0x7f0000000380)={0x27, 0x0, 0x0, 0x0, 0x0, 0x7, "d9298498abdba7f061bd1ca44c226af5160e961711a07760760beeab11e88509de7f1939e8abff0055e5c0d48bd63ffdb93bd43a847a1597c8ef039a5be422", 0x38}, 0x60)
syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1)
syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100006325a640402000207265970000010902240001000000000904000002214c6a0009050702000000da00090589"], 0x0)

program did not crash
testing program (duration=51.039141976s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ipvs-socket$nl_netfilter-syz_init_net_socket$nfc_llcp-bind$nfc_llcp-bind$nfc_llcp-syz_usb_connect
detailed listing:
executing program 0:
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
r0 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1)
bind$nfc_llcp(r0, &(0x7f0000000380)={0x27, 0x0, 0x0, 0x0, 0x0, 0x7, "d9298498abdba7f061bd1ca44c226af5160e961711a07760760beeab11e88509de7f1939e8abff0055e5c0d48bd63ffdb93bd43a847a1597c8ef039a5be422", 0x38}, 0x60)
bind$nfc_llcp(0xffffffffffffffff, &(0x7f0000000000)={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "d9298498abdba7f061bd1ca44c226af5160e0000000000000006eeab91e8ff0055e564a08bcd3ffdb93bd43a847a1597c8ef03da5be62200", 0x10}, 0x60)
syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100006325a640402000207265970000010902240001000000000904000002214c6a0009050702000000da00090589"], 0x0)

program crashed: WARNING in smsusb_start_streaming/usb_submit_urb
testing program (duration=51.039141976s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ipvs-socket$nl_netfilter-syz_init_net_socket$nfc_llcp-bind$nfc_llcp-syz_usb_connect
detailed listing:
executing program 0:
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1)
bind$nfc_llcp(0xffffffffffffffff, &(0x7f0000000000)={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "d9298498abdba7f061bd1ca44c226af5160e0000000000000006eeab91e8ff0055e564a08bcd3ffdb93bd43a847a1597c8ef03da5be62200", 0x10}, 0x60)
syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100006325a640402000207265970000010902240001000000000904000002214c6a0009050702000000da00090589"], 0x0)

program crashed: WARNING in smsusb_start_streaming/usb_submit_urb
testing program (duration=51.039141976s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ipvs-socket$nl_netfilter-bind$nfc_llcp-syz_usb_connect
detailed listing:
executing program 0:
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
bind$nfc_llcp(0xffffffffffffffff, &(0x7f0000000000)={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "d9298498abdba7f061bd1ca44c226af5160e0000000000000006eeab91e8ff0055e564a08bcd3ffdb93bd43a847a1597c8ef03da5be62200", 0x10}, 0x60)
syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100006325a640402000207265970000010902240001000000000904000002214c6a0009050702000000da00090589"], 0x0)

program crashed: WARNING in smsusb_start_streaming/usb_submit_urb
testing program (duration=51.039141976s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ipvs-bind$nfc_llcp-syz_usb_connect
detailed listing:
executing program 0:
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0)
bind$nfc_llcp(0xffffffffffffffff, &(0x7f0000000000)={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "d9298498abdba7f061bd1ca44c226af5160e0000000000000006eeab91e8ff0055e564a08bcd3ffdb93bd43a847a1597c8ef03da5be62200", 0x10}, 0x60)
syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100006325a640402000207265970000010902240001000000000904000002214c6a0009050702000000da00090589"], 0x0)

program crashed: WARNING in smsusb_start_streaming/usb_submit_urb
testing program (duration=51.039141976s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$nfc_llcp-syz_usb_connect
detailed listing:
executing program 0:
bind$nfc_llcp(0xffffffffffffffff, &(0x7f0000000000)={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "d9298498abdba7f061bd1ca44c226af5160e0000000000000006eeab91e8ff0055e564a08bcd3ffdb93bd43a847a1597c8ef03da5be62200", 0x10}, 0x60)
syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100006325a640402000207265970000010902240001000000000904000002214c6a0009050702000000da00090589"], 0x0)

program crashed: WARNING in smsusb_start_streaming/usb_submit_urb
testing program (duration=51.039141976s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$nfc_llcp-syz_usb_connect
detailed listing:
executing program 0:
bind$nfc_llcp(0xffffffffffffffff, 0x0, 0x0)
syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100006325a640402000207265970000010902240001000000000904000002214c6a0009050702000000da00090589"], 0x0)

program did not crash
testing program (duration=51.039141976s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$nfc_llcp-syz_usb_connect
detailed listing:
executing program 0:
bind$nfc_llcp(0xffffffffffffffff, &(0x7f0000000000)={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "d9298498abdba7f061bd1ca44c226af5160e0000000000000006eeab91e8ff0055e564a08bcd3ffdb93bd43a847a1597c8ef03da5be62200", 0x10}, 0x60)
syz_usb_connect(0x0, 0x36, 0x0, 0x0)

program did not crash
testing program (duration=51.039141976s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$nfc_llcp-syz_usb_connect
detailed listing:
executing program 0:
bind$nfc_llcp(0xffffffffffffffff, &(0x7f0000000000)={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "d9298498abdba7f061bd1ca44c226af5160e0000000000000006eeab91e8ff0055e564a08bcd3ffdb93bd43a847a1597c8ef03da5be62200", 0x10}, 0x60)
syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=51.039141976s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$nfc_llcp-syz_usb_connect
program crashed: WARNING in smsusb_start_streaming/usb_submit_urb
simplifying C reproducer
testing compiled C program (duration=51.039141976s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$nfc_llcp-syz_usb_connect
program crashed: WARNING in smsusb_start_streaming/usb_submit_urb
testing compiled C program (duration=51.039141976s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$nfc_llcp-syz_usb_connect
program crashed: WARNING in smsusb_start_streaming/usb_submit_urb
testing compiled C program (duration=51.039141976s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$nfc_llcp-syz_usb_connect
program crashed: WARNING in corrupted/usb_submit_urb
a never seen crash title: WARNING in corrupted/usb_submit_urb, ignore
testing compiled C program (duration=51.039141976s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$nfc_llcp-syz_usb_connect
program crashed: WARNING in smsusb_start_streaming/usb_submit_urb
testing compiled C program (duration=51.039141976s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$nfc_llcp-syz_usb_connect
program crashed: WARNING in smsusb_start_streaming/usb_submit_urb
testing compiled C program (duration=51.039141976s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$nfc_llcp-syz_usb_connect
program crashed: WARNING in smsusb_start_streaming/usb_submit_urb
testing compiled C program (duration=51.039141976s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$nfc_llcp-syz_usb_connect
program crashed: WARNING in smsusb_start_streaming/usb_submit_urb
testing compiled C program (duration=51.039141976s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$nfc_llcp-syz_usb_connect
program crashed: WARNING in smsusb_start_streaming/usb_submit_urb
testing compiled C program (duration=51.039141976s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$nfc_llcp-syz_usb_connect
program crashed: WARNING in corrupted/usb_submit_urb
a never seen crash title: WARNING in corrupted/usb_submit_urb, ignore
testing compiled C program (duration=51.039141976s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$nfc_llcp-syz_usb_connect
program crashed: WARNING in smsusb_start_streaming/usb_submit_urb
testing compiled C program (duration=51.039141976s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$nfc_llcp-syz_usb_connect
program crashed: WARNING in corrupted/usb_submit_urb
a never seen crash title: WARNING in corrupted/usb_submit_urb, ignore
testing compiled C program (duration=51.039141976s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$nfc_llcp-syz_usb_connect
program crashed: WARNING in smsusb_start_streaming/usb_submit_urb
testing compiled C program (duration=51.039141976s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$nfc_llcp-syz_usb_connect
program crashed: WARNING in smsusb_start_streaming/usb_submit_urb
testing compiled C program (duration=51.039141976s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:true Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$nfc_llcp-syz_usb_connect
program crashed: WARNING in smsusb_start_streaming/usb_submit_urb
testing compiled C program (duration=51.039141976s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:true Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$nfc_llcp-syz_usb_connect
program crashed: WARNING in smsusb_start_streaming/usb_submit_urb
reproducing took 45m3.401226877s
repro crashed as (corrupted=false):
usb 1-1: Manufacturer: syz
usb 1-1: config 0 descriptor??
smsusb:smsusb_probe: board id=9, interface number 0
smsusb:siano_media_device_register: media controller created
------------[ cut here ]------------
usb 1-1: BOGUS urb xfer, pipe 3 != type 1
WARNING: CPU: 1 PID: 21 at drivers/usb/core/urb.c:503 usb_submit_urb+0xc81/0x1980 drivers/usb/core/urb.c:502
Modules linked in:
CPU: 1 PID: 21 Comm: kworker/1:0 Not tainted 5.15.182-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_submit_urb+0xc81/0x1980 drivers/usb/core/urb.c:502
Code: 8a 4c 89 f0 48 c1 e8 03 42 0f b6 04 28 84 c0 0f 85 09 09 00 00 45 8b 06 48 c7 c7 40 60 a4 8a 48 89 ee 4c 89 e2 e8 2f 91 c7 03 <0f> 0b 44 8b 64 24 3c 8b 6c 24 30 44 0f b6 74 24 08 4c 89 f7 48 c7
RSP: 0018:ffffc90000db6bc0 EFLAGS: 00010246
RAX: 1754bbf64112cd00 RBX: ffff8880792ec030 RCX: ffff88813fe69dc0
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: ffffffff8aa4c9c0 R08: dffffc0000000000 R09: fffff520001b6cdd
R10: fffff520001b6cdd R11: 1ffff920001b6cdc R12: ffff888024eaa438
R13: dffffc0000000000 R14: ffffffff8aa45e2c R15: ffff88807e6a10f8
FS:  0000000000000000(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc87d8fc48 CR3: 000000002a910000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 smsusb_submit_urb drivers/media/usb/siano/smsusb.c:173 [inline]
 smsusb_start_streaming+0x2d4/0x540 drivers/media/usb/siano/smsusb.c:197
 smsusb_init_device drivers/media/usb/siano/smsusb.c:472 [inline]
 smsusb_probe+0x1607/0x1d10 drivers/media/usb/siano/smsusb.c:569

final repro crashed as (corrupted=false):
usb 1-1: Manufacturer: syz
usb 1-1: config 0 descriptor??
smsusb:smsusb_probe: board id=9, interface number 0
smsusb:siano_media_device_register: media controller created
------------[ cut here ]------------
usb 1-1: BOGUS urb xfer, pipe 3 != type 1
WARNING: CPU: 1 PID: 21 at drivers/usb/core/urb.c:503 usb_submit_urb+0xc81/0x1980 drivers/usb/core/urb.c:502
Modules linked in:
CPU: 1 PID: 21 Comm: kworker/1:0 Not tainted 5.15.182-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_submit_urb+0xc81/0x1980 drivers/usb/core/urb.c:502
Code: 8a 4c 89 f0 48 c1 e8 03 42 0f b6 04 28 84 c0 0f 85 09 09 00 00 45 8b 06 48 c7 c7 40 60 a4 8a 48 89 ee 4c 89 e2 e8 2f 91 c7 03 <0f> 0b 44 8b 64 24 3c 8b 6c 24 30 44 0f b6 74 24 08 4c 89 f7 48 c7
RSP: 0018:ffffc90000db6bc0 EFLAGS: 00010246
RAX: 1754bbf64112cd00 RBX: ffff8880792ec030 RCX: ffff88813fe69dc0
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: ffffffff8aa4c9c0 R08: dffffc0000000000 R09: fffff520001b6cdd
R10: fffff520001b6cdd R11: 1ffff920001b6cdc R12: ffff888024eaa438
R13: dffffc0000000000 R14: ffffffff8aa45e2c R15: ffff88807e6a10f8
FS:  0000000000000000(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc87d8fc48 CR3: 000000002a910000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 smsusb_submit_urb drivers/media/usb/siano/smsusb.c:173 [inline]
 smsusb_start_streaming+0x2d4/0x540 drivers/media/usb/siano/smsusb.c:197
 smsusb_init_device drivers/media/usb/siano/smsusb.c:472 [inline]
 smsusb_probe+0x1607/0x1d10 drivers/media/usb/siano/smsusb.c:569