Extracting prog: 1m28.609692331s
Minimizing prog: 7m17.595437223s
Simplifying prog options: 0s
Extracting C: 32.178676274s
Simplifying C: 4m28.65068373s
extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'generic-gcm-aesni\x00'}, 0x58)
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r1, 0x4b2f, 0x7)
program crashed: WARNING in cm109_urb_irq_callback/usb_submit_urb
single: successfully extracted reproducer
found reproducer with 5 syscalls
minimizing guilty program
testing program (duration=39.963018363s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io-syz_open_dev$tty1
detailed listing:
executing program 0:
bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'generic-gcm-aesni\x00'}, 0x58)
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x1)
program did not crash
testing program (duration=39.963018363s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io-ioctl$KIOCSOUND
detailed listing:
executing program 0:
bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'generic-gcm-aesni\x00'}, 0x58)
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
ioctl$KIOCSOUND(0xffffffffffffffff, 0x4b2f, 0x7)
program did not crash
testing program (duration=39.963018363s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'generic-gcm-aesni\x00'}, 0x58)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r0, 0x4b2f, 0x7)
program did not crash
testing program (duration=39.963018363s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_control_io-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'generic-gcm-aesni\x00'}, 0x58)
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r0, 0x4b2f, 0x7)
program did not crash
testing program (duration=39.963018363s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r1, 0x4b2f, 0x7)
program did not crash
testing program (duration=39.963018363s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
bind$alg(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r1, 0x4b2f, 0x7)
program did not crash
testing program (duration=39.963018363s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'generic-gcm-aesni\x00'}, 0x58)
r0 = syz_usb_connect(0x0, 0x2d, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r1, 0x4b2f, 0x7)
program did not crash
testing program (duration=39.963018363s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'generic-gcm-aesni\x00'}, 0x58)
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r1, 0x4b2f, 0x7)
program did not crash
testing program (duration=39.963018363s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'generic-gcm-aesni\x00'}, 0x58)
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB, @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r1, 0x4b2f, 0x7)
program did not crash
extracting C reproducer
testing compiled C program (duration=39.963018363s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io-syz_open_dev$tty1-ioctl$KIOCSOUND
program crashed: WARNING in cm109_urb_irq_callback/usb_submit_urb
simplifying C reproducer
testing compiled C program (duration=39.963018363s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io-syz_open_dev$tty1-ioctl$KIOCSOUND
program crashed: WARNING in cm109_urb_irq_callback/usb_submit_urb
testing compiled C program (duration=39.963018363s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io-syz_open_dev$tty1-ioctl$KIOCSOUND
program crashed: WARNING in cm109_urb_irq_callback/usb_submit_urb
testing compiled C program (duration=39.963018363s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io-syz_open_dev$tty1-ioctl$KIOCSOUND
program crashed: WARNING in cm109_urb_irq_callback/usb_submit_urb
testing compiled C program (duration=39.963018363s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io-syz_open_dev$tty1-ioctl$KIOCSOUND
program crashed: WARNING in cm109_urb_irq_callback/usb_submit_urb
testing compiled C program (duration=39.963018363s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io-syz_open_dev$tty1-ioctl$KIOCSOUND
program crashed: WARNING in cm109_urb_irq_callback/usb_submit_urb
testing compiled C program (duration=39.963018363s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io-syz_open_dev$tty1-ioctl$KIOCSOUND
program crashed: WARNING in cm109_urb_irq_callback/usb_submit_urb
testing compiled C program (duration=39.963018363s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io-syz_open_dev$tty1-ioctl$KIOCSOUND
program crashed: WARNING in cm109_urb_irq_callback/usb_submit_urb
testing program (duration=39.963018363s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'generic-gcm-aesni\x00'}, 0x58)
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r1, 0x4b2f, 0x7)
program crashed: WARNING in cm109_urb_irq_callback/usb_submit_urb
validation run: crashed=true
testing program (duration=39.963018363s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'generic-gcm-aesni\x00'}, 0x58)
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r1, 0x4b2f, 0x7)
program crashed: WARNING in cm109_urb_irq_callback/usb_submit_urb
validation run: crashed=true
testing program (duration=39.963018363s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$alg-syz_usb_connect-syz_usb_control_io-syz_open_dev$tty1-ioctl$KIOCSOUND
detailed listing:
executing program 0:
bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'generic-gcm-aesni\x00'}, 0x58)
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KIOCSOUND(r1, 0x4b2f, 0x7)
program crashed: WARNING in cm109_urb_irq_callback/usb_submit_urb
validation run: crashed=true
reproducing took 15m49.947309437s
repro crashed as (corrupted=false):
cm109 5-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff888026145400 submitted while active
WARNING: drivers/usb/core/urb.c:380 at usb_submit_urb+0x15a0/0x1970 drivers/usb/core/urb.c:380, CPU#2: syz.0.17/6093
Modules linked in:
CPU: 2 UID: 0 PID: 6093 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:usb_submit_urb+0x15a3/0x1970 drivers/usb/core/urb.c:380
Code: 4b 03 00 00 48 8b 04 24 48 8b 90 b0 00 00 00 eb 91 bb ed ff ff ff e9 07 f3 ff ff e8 e7 42 a8 fa 48 8d 3d 30 cd 7d 09 48 89 de <67> 48 0f b9 3a bb f0 ff ff ff e9 e9 f2 ff ff e8 c9 42 a8 fa 0f 1f
RSP: 0018:ffffc90000648a90 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff888026145400 RCX: ffffffff87a182d4
RDX: ffff8880273a0000 RSI: ffff888026145400 RDI: ffffffff909489e0
RBP: ffff8880392ff058 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: ffff8880273a0b30 R12: 0000000000000001
R13: ffff8880392ff057 R14: ffff88802c2f0fe0 R15: 000000000000000f
FS: 0000555584e26500(0000) GS:ffff8880d6af1000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000556e1ec401a0 CR3: 0000000053b58000 CR4: 0000000000352ef0
Call Trace:
cm109_submit_ctl drivers/input/misc/cm109.c:380 [inline]
cm109_urb_irq_callback+0x2ed/0xbb0 drivers/input/misc/cm109.c:431
__usb_hcd_giveback_urb+0x38b/0x610 drivers/usb/core/hcd.c:1661
usb_hcd_giveback_urb+0x39b/0x450 drivers/usb/core/hcd.c:1745
dummy_timer+0x1809/0x3ad0 drivers/usb/gadget/udc/dummy_hcd.c:1995
__run_hrtimer kernel/time/hrtimer.c:1777 [inline]
__hrtimer_run_queues+0x202/0xc40 kernel/time/hrtimer.c:1841
hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1858
handle_softirqs+0x219/0x950 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1056
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 kernel/locking/spinlock.c:194
Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 a6 64 1e f6 48 89 df e8 5e b7 1e f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 d5 b6 0e f6 65 8b 05 9e 4b 37 08 85 c0 74 16 5b
RSP: 0018:ffffc90003ecfaf8 EFLAGS: 00000246
RAX: 0000000000000002 RBX: ffffffff8f704e60 RCX: 0000000000000006
RDX: 0000000000000000 RSI: ffffffff8dacf3d9 RDI: ffffffff8bf2b280
RBP: 0000000000000293 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff9088cbd7 R11: 0000000000000002 R12: 1ffff920007d9f67
R13: ffff88810698623c R14: ffff888106854f00 R15: ffff888106854f18
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
usb_hcd_poll_rh_status+0x570/0x7e0 drivers/usb/core/hcd.c:762
dummy_pullup+0x20c/0x270 drivers/usb/gadget/udc/dummy_hcd.c:928
usb_gadget_disconnect_locked+0x142/0x4b0 drivers/usb/gadget/udc/core.c:780
gadget_unbind_driver+0xdd/0x510 drivers/usb/gadget/udc/core.c:1685
device_remove+0xcb/0x170 drivers/base/dd.c:569
__device_release_driver drivers/base/dd.c:1282 [inline]
device_release_driver_internal+0x44b/0x620 drivers/base/dd.c:1305
driver_detach+0xd8/0x1b0 drivers/base/dd.c:1368
bus_remove_driver+0x13b/0x2e0 drivers/base/bus.c:784
driver_unregister+0x76/0xb0 drivers/base/driver.c:277
usb_gadget_unregister_driver+0x49/0x70 drivers/usb/gadget/udc/core.c:1751
raw_release+0x1ae/0x2b0 drivers/usb/gadget/legacy/raw_gadget.c:463
__fput+0x402/0xb70 fs/file_table.c:468
task_work_run+0x150/0x240 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:44 [inline]
exit_to_user_mode_loop+0xfb/0x540 kernel/entry/common.c:75
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
do_syscall_64+0x4ee/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7efea178f7c9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd88ccc5d8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 0000000000012409 RCX: 00007efea178f7c9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000588ccc8cf
R10: 0000001b2e020000 R11: 0000000000000246 R12: 00007efea19e5fac
R13: 00007efea19e5fa0 R14: ffffffffffffffff R15: 0000000000000003
----------------
Code disassembly (best guess):
0: 4b 03 00 rex.WXB add (%r8),%rax
3: 00 48 8b add %cl,-0x75(%rax)
6: 04 24 add $0x24,%al
8: 48 8b 90 b0 00 00 00 mov 0xb0(%rax),%rdx
f: eb 91 jmp 0xffffffa2
11: bb ed ff ff ff mov $0xffffffed,%ebx
16: e9 07 f3 ff ff jmp 0xfffff322
1b: e8 e7 42 a8 fa call 0xfaa84307
20: 48 8d 3d 30 cd 7d 09 lea 0x97dcd30(%rip),%rdi # 0x97dcd57
27: 48 89 de mov %rbx,%rsi
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: bb f0 ff ff ff mov $0xfffffff0,%ebx
34: e9 e9 f2 ff ff jmp 0xfffff322
39: e8 c9 42 a8 fa call 0xfaa84307
3e: 0f .byte 0xf
3f: 1f (bad)
final repro crashed as (corrupted=false):
cm109 5-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff888026145400 submitted while active
WARNING: drivers/usb/core/urb.c:380 at usb_submit_urb+0x15a0/0x1970 drivers/usb/core/urb.c:380, CPU#2: syz.0.17/6093
Modules linked in:
CPU: 2 UID: 0 PID: 6093 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:usb_submit_urb+0x15a3/0x1970 drivers/usb/core/urb.c:380
Code: 4b 03 00 00 48 8b 04 24 48 8b 90 b0 00 00 00 eb 91 bb ed ff ff ff e9 07 f3 ff ff e8 e7 42 a8 fa 48 8d 3d 30 cd 7d 09 48 89 de <67> 48 0f b9 3a bb f0 ff ff ff e9 e9 f2 ff ff e8 c9 42 a8 fa 0f 1f
RSP: 0018:ffffc90000648a90 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff888026145400 RCX: ffffffff87a182d4
RDX: ffff8880273a0000 RSI: ffff888026145400 RDI: ffffffff909489e0
RBP: ffff8880392ff058 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: ffff8880273a0b30 R12: 0000000000000001
R13: ffff8880392ff057 R14: ffff88802c2f0fe0 R15: 000000000000000f
FS: 0000555584e26500(0000) GS:ffff8880d6af1000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000556e1ec401a0 CR3: 0000000053b58000 CR4: 0000000000352ef0
Call Trace:
cm109_submit_ctl drivers/input/misc/cm109.c:380 [inline]
cm109_urb_irq_callback+0x2ed/0xbb0 drivers/input/misc/cm109.c:431
__usb_hcd_giveback_urb+0x38b/0x610 drivers/usb/core/hcd.c:1661
usb_hcd_giveback_urb+0x39b/0x450 drivers/usb/core/hcd.c:1745
dummy_timer+0x1809/0x3ad0 drivers/usb/gadget/udc/dummy_hcd.c:1995
__run_hrtimer kernel/time/hrtimer.c:1777 [inline]
__hrtimer_run_queues+0x202/0xc40 kernel/time/hrtimer.c:1841
hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1858
handle_softirqs+0x219/0x950 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1056
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 kernel/locking/spinlock.c:194
Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 a6 64 1e f6 48 89 df e8 5e b7 1e f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 d5 b6 0e f6 65 8b 05 9e 4b 37 08 85 c0 74 16 5b
RSP: 0018:ffffc90003ecfaf8 EFLAGS: 00000246
RAX: 0000000000000002 RBX: ffffffff8f704e60 RCX: 0000000000000006
RDX: 0000000000000000 RSI: ffffffff8dacf3d9 RDI: ffffffff8bf2b280
RBP: 0000000000000293 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff9088cbd7 R11: 0000000000000002 R12: 1ffff920007d9f67
R13: ffff88810698623c R14: ffff888106854f00 R15: ffff888106854f18
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
usb_hcd_poll_rh_status+0x570/0x7e0 drivers/usb/core/hcd.c:762
dummy_pullup+0x20c/0x270 drivers/usb/gadget/udc/dummy_hcd.c:928
usb_gadget_disconnect_locked+0x142/0x4b0 drivers/usb/gadget/udc/core.c:780
gadget_unbind_driver+0xdd/0x510 drivers/usb/gadget/udc/core.c:1685
device_remove+0xcb/0x170 drivers/base/dd.c:569
__device_release_driver drivers/base/dd.c:1282 [inline]
device_release_driver_internal+0x44b/0x620 drivers/base/dd.c:1305
driver_detach+0xd8/0x1b0 drivers/base/dd.c:1368
bus_remove_driver+0x13b/0x2e0 drivers/base/bus.c:784
driver_unregister+0x76/0xb0 drivers/base/driver.c:277
usb_gadget_unregister_driver+0x49/0x70 drivers/usb/gadget/udc/core.c:1751
raw_release+0x1ae/0x2b0 drivers/usb/gadget/legacy/raw_gadget.c:463
__fput+0x402/0xb70 fs/file_table.c:468
task_work_run+0x150/0x240 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:44 [inline]
exit_to_user_mode_loop+0xfb/0x540 kernel/entry/common.c:75
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
do_syscall_64+0x4ee/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7efea178f7c9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd88ccc5d8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 0000000000012409 RCX: 00007efea178f7c9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000588ccc8cf
R10: 0000001b2e020000 R11: 0000000000000246 R12: 00007efea19e5fac
R13: 00007efea19e5fa0 R14: ffffffffffffffff R15: 0000000000000003
----------------
Code disassembly (best guess):
0: 4b 03 00 rex.WXB add (%r8),%rax
3: 00 48 8b add %cl,-0x75(%rax)
6: 04 24 add $0x24,%al
8: 48 8b 90 b0 00 00 00 mov 0xb0(%rax),%rdx
f: eb 91 jmp 0xffffffa2
11: bb ed ff ff ff mov $0xffffffed,%ebx
16: e9 07 f3 ff ff jmp 0xfffff322
1b: e8 e7 42 a8 fa call 0xfaa84307
20: 48 8d 3d 30 cd 7d 09 lea 0x97dcd30(%rip),%rdi # 0x97dcd57
27: 48 89 de mov %rbx,%rsi
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: bb f0 ff ff ff mov $0xfffffff0,%ebx
34: e9 e9 f2 ff ff jmp 0xfffff322
39: e8 c9 42 a8 fa call 0xfaa84307
3e: 0f .byte 0xf
3f: 1f (bad)