Extracting prog: 7m36.734881811s
Minimizing prog: 1h1m9.566653375s
Simplifying prog options: 0s
Extracting C: 3m14.426167712s
Simplifying C: 5m47.777335893s
extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-ioctl$USBDEVFS_IOCTL-ioctl$USBDEVFS_IOCTL
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040f71d00250001000000010902220001010080000904"], 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000880), 0x19, 0x2)
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f00000008c0))
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000900)=@usbdevfs_connect) (fail_nth: 12)
program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-ioctl$USBDEVFS_IOCTL-ioctl$USBDEVFS_IOCTL
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040f71d00250001000000010902220001010080000904"], 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000880), 0x19, 0x2)
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f00000008c0))
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000900)=@usbdevfs_connect) (fail_nth: 12)
program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-ioctl$USBDEVFS_IOCTL-ioctl$USBDEVFS_IOCTL
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040f71d00250001000000010902220001010080000904"], 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000880), 0x19, 0x2)
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f00000008c0))
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000900)=@usbdevfs_connect) (fail_nth: 12)
program crashed: WARNING in spi_register_controller
single: successfully extracted reproducer
found reproducer with 4 syscalls
minimizing guilty program
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-ioctl$USBDEVFS_IOCTL
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040f71d00250001000000010902220001010080000904"], 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000880), 0x19, 0x2)
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f00000008c0))
program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-ioctl$USBDEVFS_IOCTL
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040f71d00250001000000010902220001010080000904"], 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000880), 0x19, 0x2)
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000900)=@usbdevfs_connect) (fail_nth: 12)
program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$USBDEVFS_IOCTL-ioctl$USBDEVFS_IOCTL
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040f71d00250001000000010902220001010080000904"], 0x0)
ioctl$USBDEVFS_IOCTL(0xffffffffffffffff, 0xc0105512, &(0x7f00000008c0))
ioctl$USBDEVFS_IOCTL(0xffffffffffffffff, 0xc0105512, &(0x7f0000000900)=@usbdevfs_connect) (fail_nth: 12)
program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-ioctl$USBDEVFS_IOCTL-ioctl$USBDEVFS_IOCTL
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f0000000880), 0x19, 0x2)
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f00000008c0))
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000900)=@usbdevfs_connect) (fail_nth: 12)
program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-ioctl$USBDEVFS_IOCTL-ioctl$USBDEVFS_IOCTL
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040f71d00250001000000010902220001010080000904"], 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000880), 0x19, 0x2)
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f00000008c0))
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000900)=@usbdevfs_connect)
program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-ioctl$USBDEVFS_IOCTL-ioctl$USBDEVFS_IOCTL
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x34, 0x0, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000880), 0x19, 0x2)
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f00000008c0))
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000900)=@usbdevfs_connect) (fail_nth: 12)
program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-ioctl$USBDEVFS_IOCTL-ioctl$USBDEVFS_IOCTL
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000880), 0x19, 0x2)
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f00000008c0))
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000900)=@usbdevfs_connect) (fail_nth: 12)
program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-ioctl$USBDEVFS_IOCTL-ioctl$USBDEVFS_IOCTL
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040f71d00250001000000010902220001010080000904"], 0x0)
r0 = syz_open_dev$usbfs(0x0, 0x19, 0x2)
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f00000008c0))
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000900)=@usbdevfs_connect) (fail_nth: 12)
program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-ioctl$USBDEVFS_IOCTL-ioctl$USBDEVFS_IOCTL
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040f71d00250001000000010902220001010080000904"], 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000880), 0x19, 0x2)
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0)
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000900)=@usbdevfs_connect) (fail_nth: 12)
program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-ioctl$USBDEVFS_IOCTL-ioctl$USBDEVFS_IOCTL
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040f71d00250001000000010902220001010080000904"], 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000880), 0x19, 0x2)
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f00000008c0))
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) (fail_nth: 12)
program did not crash
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-ioctl$USBDEVFS_IOCTL-ioctl$USBDEVFS_IOCTL
program crashed: WARNING in spi_register_controller
simplifying C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-ioctl$USBDEVFS_IOCTL-ioctl$USBDEVFS_IOCTL
program crashed: WARNING in spi_register_controller
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-ioctl$USBDEVFS_IOCTL-ioctl$USBDEVFS_IOCTL
program crashed: WARNING in spi_register_controller
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-ioctl$USBDEVFS_IOCTL-ioctl$USBDEVFS_IOCTL
program crashed: WARNING in spi_register_controller
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-ioctl$USBDEVFS_IOCTL-ioctl$USBDEVFS_IOCTL
program crashed: WARNING in spi_register_controller
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-ioctl$USBDEVFS_IOCTL-ioctl$USBDEVFS_IOCTL
program crashed: WARNING in spi_register_controller
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-ioctl$USBDEVFS_IOCTL-ioctl$USBDEVFS_IOCTL
program crashed: WARNING in spi_register_controller
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-ioctl$USBDEVFS_IOCTL-ioctl$USBDEVFS_IOCTL
program crashed: WARNING in spi_register_controller
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-ioctl$USBDEVFS_IOCTL-ioctl$USBDEVFS_IOCTL
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040f71d00250001000000010902220001010080000904"], 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000880), 0x19, 0x2)
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f00000008c0))
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000900)=@usbdevfs_connect) (fail_nth: 12)
program crashed: WARNING in spi_register_controller
validation run: crashed=true
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-ioctl$USBDEVFS_IOCTL-ioctl$USBDEVFS_IOCTL
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040f71d00250001000000010902220001010080000904"], 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000880), 0x19, 0x2)
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f00000008c0))
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000900)=@usbdevfs_connect) (fail_nth: 12)
program crashed: WARNING in spi_register_controller
validation run: crashed=true
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-ioctl$USBDEVFS_IOCTL-ioctl$USBDEVFS_IOCTL
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040f71d00250001000000010902220001010080000904"], 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000880), 0x19, 0x2)
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f00000008c0))
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000900)=@usbdevfs_connect) (fail_nth: 12)
program crashed: WARNING in spi_register_controller
validation run: crashed=true
reproducing took 1h23m36.920834352s
repro crashed as (corrupted=false):
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 00007fe4d0225fac R14: 00007fe4d0225fa0 R15: 00007fe4d0225fa0
------------[ cut here ]------------
couldn't get idr
WARNING: drivers/spi/spi.c:3634 at spi_controller_id_alloc drivers/spi/spi.c:3634 [inline], CPU#0: syz.0.17/5588
WARNING: drivers/spi/spi.c:3634 at spi_register_controller+0x1261/0x1670 drivers/spi/spi.c:3697, CPU#0: syz.0.17/5588
Modules linked in:
CPU: 0 UID: 0 PID: 5588 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:spi_controller_id_alloc drivers/spi/spi.c:3634 [inline]
RIP: 0010:spi_register_controller+0x1261/0x1670 drivers/spi/spi.c:3697
Code: 8c e8 33 d5 79 fa e9 1e ff ff ff e8 a9 a6 16 fb 48 8d 3d 72 3f 18 0b 67 48 0f b9 3a eb 11 e8 96 a6 16 fb 48 8d 3d 6f 3f 18 0b <67> 48 0f b9 3a bf e4 ff ff ff 44 89 f6 e8 8d ab 16 fb 41 83 fe e4
RSP: 0018:ffffc90004de7878 EFLAGS: 00010293
RAX: ffffffff86b27e5a RBX: ffff888050e4a000 RCX: ffff888034fc4b00
RDX: 0000000000000000 RSI: 00000000fffffff4 RDI: ffffffff91cabdd0
RBP: 0000000000000000 R08: ffffc90004de7807 R09: 1ffff920009bcf00
R10: dffffc0000000000 R11: fffff520009bcf01 R12: 1ffff1100a1c9408
R13: dffffc0000000000 R14: 00000000fffffff4 R15: ffff888050e4a4d8
FS: 000055558743d500(0000) GS:ffff88808aa10000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fbfc3e0ca90 CR3: 0000000040ab8000 CR4: 0000000000352ef0
Call Trace:
msi2500_probe+0x4c6/0x9e0 drivers/media/usb/msi2500/msi2500.c:1249
usb_probe_interface+0x751/0xe00 drivers/usb/core/driver.c:399
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x254/0xae0 drivers/base/dd.c:707
__driver_probe_device+0x1e8/0x360 drivers/base/dd.c:869
driver_probe_device+0x4f/0x240 drivers/base/dd.c:899
__device_attach_driver+0x270/0x410 drivers/base/dd.c:1027
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:503
__device_attach+0x2bd/0x430 drivers/base/dd.c:1131
proc_ioctl+0x409/0x660 drivers/usb/core/devio.c:2370
proc_ioctl_default+0xc4/0x110 drivers/usb/core/devio.c:2405
usbdev_do_ioctl drivers/usb/core/devio.c:2769 [inline]
usbdev_ioctl+0x139d/0x21a0 drivers/usb/core/devio.c:2829
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe4cff9f559
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc6b706298 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fe4d0225fa0 RCX: 00007fe4cff9f559
RDX: 0000200000000900 RSI: 00000000c0105512 RDI: 0000000000000004
RBP: 00007ffc6b706300 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 00007fe4d0225fac R14: 00007fe4d0225fa0 R15: 00007fe4d0225fa0
----------------
Code disassembly (best guess):
0: 8c e8 mov %gs,%eax
2: 33 d5 xor %ebp,%edx
4: 79 fa jns 0x0
6: e9 1e ff ff ff jmp 0xffffff29
b: e8 a9 a6 16 fb call 0xfb16a6b9
10: 48 8d 3d 72 3f 18 0b lea 0xb183f72(%rip),%rdi # 0xb183f89
17: 67 48 0f b9 3a ud1 (%edx),%rdi
1c: eb 11 jmp 0x2f
1e: e8 96 a6 16 fb call 0xfb16a6b9
23: 48 8d 3d 6f 3f 18 0b lea 0xb183f6f(%rip),%rdi # 0xb183f99
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: bf e4 ff ff ff mov $0xffffffe4,%edi
34: 44 89 f6 mov %r14d,%esi
37: e8 8d ab 16 fb call 0xfb16abc9
3c: 41 83 fe e4 cmp $0xffffffe4,%r14d
final repro crashed as (corrupted=false):
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 00007fe4d0225fac R14: 00007fe4d0225fa0 R15: 00007fe4d0225fa0
------------[ cut here ]------------
couldn't get idr
WARNING: drivers/spi/spi.c:3634 at spi_controller_id_alloc drivers/spi/spi.c:3634 [inline], CPU#0: syz.0.17/5588
WARNING: drivers/spi/spi.c:3634 at spi_register_controller+0x1261/0x1670 drivers/spi/spi.c:3697, CPU#0: syz.0.17/5588
Modules linked in:
CPU: 0 UID: 0 PID: 5588 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:spi_controller_id_alloc drivers/spi/spi.c:3634 [inline]
RIP: 0010:spi_register_controller+0x1261/0x1670 drivers/spi/spi.c:3697
Code: 8c e8 33 d5 79 fa e9 1e ff ff ff e8 a9 a6 16 fb 48 8d 3d 72 3f 18 0b 67 48 0f b9 3a eb 11 e8 96 a6 16 fb 48 8d 3d 6f 3f 18 0b <67> 48 0f b9 3a bf e4 ff ff ff 44 89 f6 e8 8d ab 16 fb 41 83 fe e4
RSP: 0018:ffffc90004de7878 EFLAGS: 00010293
RAX: ffffffff86b27e5a RBX: ffff888050e4a000 RCX: ffff888034fc4b00
RDX: 0000000000000000 RSI: 00000000fffffff4 RDI: ffffffff91cabdd0
RBP: 0000000000000000 R08: ffffc90004de7807 R09: 1ffff920009bcf00
R10: dffffc0000000000 R11: fffff520009bcf01 R12: 1ffff1100a1c9408
R13: dffffc0000000000 R14: 00000000fffffff4 R15: ffff888050e4a4d8
FS: 000055558743d500(0000) GS:ffff88808aa10000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fbfc3e0ca90 CR3: 0000000040ab8000 CR4: 0000000000352ef0
Call Trace:
msi2500_probe+0x4c6/0x9e0 drivers/media/usb/msi2500/msi2500.c:1249
usb_probe_interface+0x751/0xe00 drivers/usb/core/driver.c:399
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x254/0xae0 drivers/base/dd.c:707
__driver_probe_device+0x1e8/0x360 drivers/base/dd.c:869
driver_probe_device+0x4f/0x240 drivers/base/dd.c:899
__device_attach_driver+0x270/0x410 drivers/base/dd.c:1027
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:503
__device_attach+0x2bd/0x430 drivers/base/dd.c:1131
proc_ioctl+0x409/0x660 drivers/usb/core/devio.c:2370
proc_ioctl_default+0xc4/0x110 drivers/usb/core/devio.c:2405
usbdev_do_ioctl drivers/usb/core/devio.c:2769 [inline]
usbdev_ioctl+0x139d/0x21a0 drivers/usb/core/devio.c:2829
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe4cff9f559
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc6b706298 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fe4d0225fa0 RCX: 00007fe4cff9f559
RDX: 0000200000000900 RSI: 00000000c0105512 RDI: 0000000000000004
RBP: 00007ffc6b706300 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 00007fe4d0225fac R14: 00007fe4d0225fa0 R15: 00007fe4d0225fa0
----------------
Code disassembly (best guess):
0: 8c e8 mov %gs,%eax
2: 33 d5 xor %ebp,%edx
4: 79 fa jns 0x0
6: e9 1e ff ff ff jmp 0xffffff29
b: e8 a9 a6 16 fb call 0xfb16a6b9
10: 48 8d 3d 72 3f 18 0b lea 0xb183f72(%rip),%rdi # 0xb183f89
17: 67 48 0f b9 3a ud1 (%edx),%rdi
1c: eb 11 jmp 0x2f
1e: e8 96 a6 16 fb call 0xfb16a6b9
23: 48 8d 3d 6f 3f 18 0b lea 0xb183f6f(%rip),%rdi # 0xb183f99
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: bf e4 ff ff ff mov $0xffffffe4,%edi
34: 44 89 f6 mov %r14d,%esi
37: e8 8d ab 16 fb call 0xfb16abc9
3c: 41 83 fe e4 cmp $0xffffffe4,%r14d