Warning: Permanently added '10.128.0.191' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 40.251295][ T101] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 40.611331][ T101] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 40.622529][ T101] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 762, setting to 64 [ 40.633657][ T101] usb 1-1: New USB device found, idVendor=1a34, idProduct=f705, bcdDevice= 0.00 [ 40.642741][ T101] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 40.651968][ T101] usb 1-1: config 0 descriptor?? [ 41.136704][ T101] acrux 0003:1A34:F705.0001: hidraw0: USB HID v0.00 Device [HID 1a34:f705] on usb-dummy_hcd.0-1/input0 [ 41.147982][ T101] ================================================================== [ 41.156205][ T101] BUG: KASAN: slab-out-of-bounds in ax_probe+0x369/0x540 [ 41.163211][ T101] Write of size 8 at addr ffff8881d5c2c5c0 by task kworker/0:2/101 [ 41.171076][ T101] [ 41.173401][ T101] CPU: 0 PID: 101 Comm: kworker/0:2 Not tainted 5.3.0+ #0 [ 41.180498][ T101] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 41.190541][ T101] Workqueue: usb_hub_wq hub_event [ 41.195540][ T101] Call Trace: [ 41.198808][ T101] dump_stack+0xca/0x13e [ 41.203027][ T101] ? ax_probe+0x369/0x540 [ 41.207329][ T101] ? ax_probe+0x369/0x540 [ 41.211640][ T101] print_address_description.constprop.0+0x36/0x50 [ 41.218126][ T101] ? ax_probe+0x369/0x540 [ 41.222440][ T101] ? ax_probe+0x369/0x540 [ 41.226758][ T101] __kasan_report.cold+0x1a/0x33 [ 41.231757][ T101] ? ax_probe+0x369/0x540 [ 41.236061][ T101] kasan_report+0xe/0x12 [ 41.240296][ T101] check_memory_region+0x128/0x190 [ 41.246354][ T101] ax_probe+0x369/0x540 [ 41.250497][ T101] ? ax_remove+0x20/0x20 [ 41.254724][ T101] hid_device_probe+0x2be/0x3f0 [ 41.259689][ T101] ? hid_match_device+0x1f0/0x1f0 [ 41.264693][ T101] really_probe+0x281/0x6d0 [ 41.269178][ T101] driver_probe_device+0x104/0x210 [ 41.274266][ T101] __device_attach_driver+0x1c2/0x220 [ 41.279814][ T101] ? driver_allows_async_probing+0x160/0x160 [ 41.285771][ T101] bus_for_each_drv+0x162/0x1e0 [ 41.290599][ T101] ? bus_rescan_devices+0x20/0x20 [ 41.295631][ T101] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 41.301413][ T101] ? lockdep_hardirqs_on+0x382/0x580 [ 41.306685][ T101] __device_attach+0x217/0x360 [ 41.311432][ T101] ? device_bind_driver+0xd0/0xd0 [ 41.316438][ T101] ? kobject_uevent_env+0x29e/0x1150 [ 41.321697][ T101] ? kobject_uevent_env+0x2a8/0x1150 [ 41.326956][ T101] bus_probe_device+0x1e4/0x290 [ 41.331783][ T101] ? blocking_notifier_call_chain+0x54/0xa0 [ 41.337652][ T101] device_add+0xae6/0x16f0 [ 41.342058][ T101] ? uevent_store+0x50/0x50 [ 41.346799][ T101] ? __debugfs_create_file+0x2da/0x3c0 [ 41.352246][ T101] hid_add_device+0x33c/0x990 [ 41.356899][ T101] ? debug_object_fixup+0x30/0x30 [ 41.361902][ T101] ? __hid_bus_reprobe_drivers+0x130/0x130 [ 41.367681][ T101] ? lockdep_init_map+0x1b0/0x5e0 [ 41.372694][ T101] usbhid_probe+0xa81/0xfa0 [ 41.377193][ T101] usb_probe_interface+0x305/0x7a0 [ 41.382279][ T101] ? usb_probe_device+0x100/0x100 [ 41.387279][ T101] really_probe+0x281/0x6d0 [ 41.391773][ T101] driver_probe_device+0x104/0x210 [ 41.396885][ T101] __device_attach_driver+0x1c2/0x220 [ 41.402255][ T101] ? driver_allows_async_probing+0x160/0x160 [ 41.408215][ T101] bus_for_each_drv+0x162/0x1e0 [ 41.413045][ T101] ? bus_rescan_devices+0x20/0x20 [ 41.418061][ T101] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 41.423859][ T101] ? lockdep_hardirqs_on+0x382/0x580 [ 41.429133][ T101] __device_attach+0x217/0x360 [ 41.433911][ T101] ? device_bind_driver+0xd0/0xd0 [ 41.438914][ T101] ? kobject_uevent_env+0x29e/0x1150 [ 41.444173][ T101] ? kobject_uevent_env+0x2a8/0x1150 [ 41.449431][ T101] bus_probe_device+0x1e4/0x290 [ 41.454271][ T101] ? blocking_notifier_call_chain+0x54/0xa0 [ 41.460137][ T101] device_add+0xae6/0x16f0 [ 41.464529][ T101] ? uevent_store+0x50/0x50 [ 41.469014][ T101] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 41.474796][ T101] usb_set_configuration+0xdf6/0x1670 [ 41.480143][ T101] generic_probe+0x9d/0xd5 [ 41.484534][ T101] usb_probe_device+0x99/0x100 [ 41.489283][ T101] ? usb_suspend+0x620/0x620 [ 41.493850][ T101] really_probe+0x281/0x6d0 [ 41.498326][ T101] driver_probe_device+0x104/0x210 [ 41.503428][ T101] __device_attach_driver+0x1c2/0x220 [ 41.508794][ T101] ? driver_allows_async_probing+0x160/0x160 [ 41.514759][ T101] bus_for_each_drv+0x162/0x1e0 [ 41.519581][ T101] ? bus_rescan_devices+0x20/0x20 [ 41.524581][ T101] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 41.530390][ T101] ? lockdep_hardirqs_on+0x382/0x580 [ 41.535651][ T101] __device_attach+0x217/0x360 [ 41.540394][ T101] ? device_bind_driver+0xd0/0xd0 [ 41.545395][ T101] ? kobject_uevent_env+0x29e/0x1150 [ 41.550655][ T101] ? kobject_uevent_env+0x2a8/0x1150 [ 41.555913][ T101] bus_probe_device+0x1e4/0x290 [ 41.560748][ T101] ? blocking_notifier_call_chain+0x54/0xa0 [ 41.566615][ T101] device_add+0xae6/0x16f0 [ 41.571007][ T101] ? uevent_store+0x50/0x50 [ 41.575488][ T101] usb_new_device.cold+0x6a4/0xe79 [ 41.580602][ T101] hub_event+0x1b5c/0x3640 [ 41.585005][ T101] ? hub_port_debounce+0x260/0x260 [ 41.590097][ T101] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 41.595621][ T101] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 41.600884][ T101] process_one_work+0x92b/0x1530 [ 41.605843][ T101] ? pwq_dec_nr_in_flight+0x310/0x310 [ 41.615099][ T101] ? do_raw_spin_lock+0x11a/0x280 [ 41.620110][ T101] worker_thread+0x96/0xe20 [ 41.624590][ T101] ? process_one_work+0x1530/0x1530 [ 41.629774][ T101] kthread+0x318/0x420 [ 41.633819][ T101] ? kthread_create_on_node+0xf0/0xf0 [ 41.639166][ T101] ret_from_fork+0x24/0x30 [ 41.643553][ T101] [ 41.645858][ T101] Allocated by task 101: [ 41.650090][ T101] save_stack+0x1b/0x80 [ 41.654220][ T101] __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 41.660087][ T101] hidraw_connect+0x4b/0x3e0 [ 41.664650][ T101] hid_connect+0x5c7/0xbb0 [ 41.669038][ T101] hid_hw_start+0xa2/0x130 [ 41.673430][ T101] ax_probe+0x52/0x540 [ 41.677476][ T101] hid_device_probe+0x2be/0x3f0 [ 41.682301][ T101] really_probe+0x281/0x6d0 [ 41.686788][ T101] driver_probe_device+0x104/0x210 [ 41.691873][ T101] __device_attach_driver+0x1c2/0x220 [ 41.697221][ T101] bus_for_each_drv+0x162/0x1e0 [ 41.702048][ T101] __device_attach+0x217/0x360 [ 41.706786][ T101] bus_probe_device+0x1e4/0x290 [ 41.711695][ T101] device_add+0xae6/0x16f0 [ 41.716084][ T101] hid_add_device+0x33c/0x990 [ 41.720735][ T101] usbhid_probe+0xa81/0xfa0 [ 41.725211][ T101] usb_probe_interface+0x305/0x7a0 [ 41.730297][ T101] really_probe+0x281/0x6d0 [ 41.734775][ T101] driver_probe_device+0x104/0x210 [ 41.739860][ T101] __device_attach_driver+0x1c2/0x220 [ 41.745205][ T101] bus_for_each_drv+0x162/0x1e0 [ 41.750029][ T101] __device_attach+0x217/0x360 [ 41.754775][ T101] bus_probe_device+0x1e4/0x290 [ 41.759613][ T101] device_add+0xae6/0x16f0 [ 41.764015][ T101] usb_set_configuration+0xdf6/0x1670 [ 41.769376][ T101] generic_probe+0x9d/0xd5 [ 41.773765][ T101] usb_probe_device+0x99/0x100 [ 41.778503][ T101] really_probe+0x281/0x6d0 [ 41.782997][ T101] driver_probe_device+0x104/0x210 [ 41.788083][ T101] __device_attach_driver+0x1c2/0x220 [ 41.793429][ T101] bus_for_each_drv+0x162/0x1e0 [ 41.798267][ T101] __device_attach+0x217/0x360 [ 41.803005][ T101] bus_probe_device+0x1e4/0x290 [ 41.807830][ T101] device_add+0xae6/0x16f0 [ 41.812237][ T101] usb_new_device.cold+0x6a4/0xe79 [ 41.817321][ T101] hub_event+0x1b5c/0x3640 [ 41.821712][ T101] process_one_work+0x92b/0x1530 [ 41.826624][ T101] worker_thread+0x96/0xe20 [ 41.831538][ T101] kthread+0x318/0x420 [ 41.835584][ T101] ret_from_fork+0x24/0x30 [ 41.839971][ T101] [ 41.842282][ T101] Freed by task 1: [ 41.845991][ T101] save_stack+0x1b/0x80 [ 41.850125][ T101] __kasan_slab_free+0x130/0x180 [ 41.855045][ T101] kfree+0xe4/0x2f0 [ 41.858828][ T101] usb_free_urb.part.0+0x7a/0xc0 [ 41.863739][ T101] usb_free_urb+0x1b/0x30 [ 41.868042][ T101] usb_start_wait_urb+0x1e5/0x2b0 [ 41.873053][ T101] usb_control_msg+0x31c/0x4a0 [ 41.877815][ T101] set_port_feature+0x69/0x90 [ 41.882487][ T101] hub_power_on+0xca/0x280 [ 41.886876][ T101] hub_activate+0xfb7/0x1570 [ 41.891455][ T101] hub_probe.cold+0x21f8/0x2201 [ 41.896305][ T101] usb_probe_interface+0x305/0x7a0 [ 41.901394][ T101] really_probe+0x281/0x6d0 [ 41.905870][ T101] driver_probe_device+0x104/0x210 [ 41.910999][ T101] __device_attach_driver+0x1c2/0x220 [ 41.916343][ T101] bus_for_each_drv+0x162/0x1e0 [ 41.921167][ T101] __device_attach+0x217/0x360 [ 41.925907][ T101] bus_probe_device+0x1e4/0x290 [ 41.931699][ T101] device_add+0xae6/0x16f0 [ 41.936107][ T101] usb_set_configuration+0xdf6/0x1670 [ 41.941452][ T101] generic_probe+0x9d/0xd5 [ 41.945843][ T101] usb_probe_device+0x99/0x100 [ 41.950579][ T101] really_probe+0x281/0x6d0 [ 41.955069][ T101] driver_probe_device+0x104/0x210 [ 41.960166][ T101] __device_attach_driver+0x1c2/0x220 [ 41.965510][ T101] bus_for_each_drv+0x162/0x1e0 [ 41.970334][ T101] __device_attach+0x217/0x360 [ 41.975071][ T101] bus_probe_device+0x1e4/0x290 [ 41.979900][ T101] device_add+0xae6/0x16f0 [ 41.984292][ T101] usb_new_device.cold+0x6a4/0xe79 [ 41.989399][ T101] usb_add_hcd.cold+0x1103/0x14aa [ 41.994402][ T101] dummy_hcd_probe+0x19f/0x312 [ 41.999141][ T101] platform_drv_probe+0xce/0x1a0 [ 42.004053][ T101] really_probe+0x281/0x6d0 [ 42.008534][ T101] driver_probe_device+0x104/0x210 [ 42.013636][ T101] __device_attach_driver+0x1c2/0x220 [ 42.018982][ T101] bus_for_each_drv+0x162/0x1e0 [ 42.023827][ T101] __device_attach+0x217/0x360 [ 42.028564][ T101] bus_probe_device+0x1e4/0x290 [ 42.033406][ T101] device_add+0xae6/0x16f0 [ 42.037801][ T101] platform_device_add+0x34d/0x6c0 [ 42.042894][ T101] init+0x4b5/0x997 [ 42.046677][ T101] do_one_initcall+0xf0/0x614 [ 42.051352][ T101] kernel_init_freeable+0x4a9/0x596 [ 42.056529][ T101] kernel_init+0xd/0x1bf [ 42.060746][ T101] ret_from_fork+0x24/0x30 [ 42.065147][ T101] [ 42.067466][ T101] The buggy address belongs to the object at ffff8881d5c2c500 [ 42.067466][ T101] which belongs to the cache kmalloc-192 of size 192 [ 42.081492][ T101] The buggy address is located 0 bytes to the right of [ 42.081492][ T101] 192-byte region [ffff8881d5c2c500, ffff8881d5c2c5c0) [ 42.095081][ T101] The buggy address belongs to the page: [ 42.100687][ T101] page:ffffea0007570b00 refcount:1 mapcount:0 mapping:ffff8881da002a00 index:0x0 [ 42.109786][ T101] flags: 0x200000000000200(slab) [ 42.114803][ T101] raw: 0200000000000200 ffffea0007570700 0000000b0000000b ffff8881da002a00 [ 42.123378][ T101] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 42.131944][ T101] page dumped because: kasan: bad access detected [ 42.138346][ T101] [ 42.140660][ T101] Memory state around the buggy address: [ 42.146277][ T101] ffff8881d5c2c480: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc [ 42.154311][ T101] ffff8881d5c2c500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 42.162346][ T101] >ffff8881d5c2c580: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 42.170378][ T101] ^ [ 42.176505][ T101] ffff8881d5c2c600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 42.184542][ T101] ffff8881d5c2c680: 00 00 00 00 fc fc fc fc fc fc fc fc