Warning: Permanently added '10.128.0.68' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 24.865307][ T83] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 25.225412][ T83] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 25.236322][ T83] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 25.405418][ T83] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 25.414482][ T83] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.422516][ T83] usb 1-1: Product: syz [ 25.426702][ T83] usb 1-1: Manufacturer: syz [ 25.431317][ T83] usb 1-1: SerialNumber: syz executing program [ 25.775492][ T83] ================================================================== [ 25.783675][ T83] BUG: KASAN: slab-out-of-bounds in parse_term_proc_unit+0x57a/0x5e0 [ 25.791721][ T83] Read of size 1 at addr ffff8881d52c9abc by task kworker/1:2/83 [ 25.799408][ T83] [ 25.801720][ T83] CPU: 1 PID: 83 Comm: kworker/1:2 Not tainted 5.4.0-rc3+ #0 [ 25.813348][ T83] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 25.823488][ T83] Workqueue: usb_hub_wq hub_event [ 25.828495][ T83] Call Trace: [ 25.831766][ T83] dump_stack+0xca/0x13e [ 25.836006][ T83] ? parse_term_proc_unit+0x57a/0x5e0 [ 25.841354][ T83] ? parse_term_proc_unit+0x57a/0x5e0 [ 25.846714][ T83] print_address_description.constprop.0+0x36/0x50 [ 25.853199][ T83] ? parse_term_proc_unit+0x57a/0x5e0 [ 25.858546][ T83] ? parse_term_proc_unit+0x57a/0x5e0 [ 25.863894][ T83] __kasan_report.cold+0x1a/0x33 [ 25.868811][ T83] ? parse_term_proc_unit+0x57a/0x5e0 [ 25.874157][ T83] kasan_report+0xe/0x20 [ 25.878377][ T83] parse_term_proc_unit+0x57a/0x5e0 [ 25.883550][ T83] __check_input_term+0xc32/0x13f0 [ 25.888641][ T83] parse_audio_unit+0x101d/0x36f0 [ 25.893642][ T83] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 25.899429][ T83] ? lockdep_hardirqs_on+0x382/0x580 [ 25.904692][ T83] ? stack_depot_save+0x252/0x440 [ 25.909695][ T83] ? build_audio_procunit+0x13f0/0x13f0 [ 25.915225][ T83] ? save_stack+0x1b/0x80 [ 25.919543][ T83] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 25.925323][ T83] ? snd_usb_create_mixer+0x180/0x1890 [ 25.930755][ T83] ? usb_audio_probe+0xc76/0x2010 [ 25.935757][ T83] ? usb_probe_interface+0x305/0x7a0 [ 25.941017][ T83] ? really_probe+0x281/0x6d0 [ 25.946019][ T83] ? driver_probe_device+0x104/0x210 [ 25.951298][ T83] ? __device_attach_driver+0x1c2/0x220 [ 25.956853][ T83] ? bus_for_each_drv+0x162/0x1e0 [ 25.961856][ T83] ? __device_attach+0x217/0x360 [ 25.966770][ T83] ? bus_probe_device+0x1e4/0x290 [ 25.971771][ T83] ? device_add+0xae6/0x16f0 [ 25.976337][ T83] ? usb_set_configuration+0xdf6/0x1670 [ 25.981858][ T83] ? validate_desc.part.0+0x17f/0x240 [ 25.987209][ T83] snd_usb_mixer_controls+0x715/0xb90 [ 25.992561][ T83] ? parse_audio_unit+0x36f0/0x36f0 [ 25.997738][ T83] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 26.003001][ T83] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 26.008786][ T83] ? kasan_unpoison_shadow+0x30/0x40 [ 26.014051][ T83] ? usb_ifnum_to_if+0x12b/0x180 [ 26.018965][ T83] snd_usb_create_mixer+0x2b5/0x1890 [ 26.024239][ T83] ? mark_lock+0xbc/0x1160 [ 26.028635][ T83] ? mark_held_locks+0x9f/0xe0 [ 26.033375][ T83] ? snd_usb_mixer_interrupt+0x800/0x800 [ 26.038982][ T83] ? lockdep_hardirqs_on+0x382/0x580 [ 26.044243][ T83] ? usb_driver_claim_interface+0x210/0x420 [ 26.050135][ T83] ? snd_usb_create_stream+0x16a/0x4c0 [ 26.055573][ T83] usb_audio_probe+0xc76/0x2010 [ 26.060419][ T83] ? usb_audio_resume+0x20/0x20 [ 26.065251][ T83] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 26.071040][ T83] usb_probe_interface+0x305/0x7a0 [ 26.076131][ T83] ? usb_probe_device+0x100/0x100 [ 26.081134][ T83] really_probe+0x281/0x6d0 [ 26.085617][ T83] driver_probe_device+0x104/0x210 [ 26.090707][ T83] __device_attach_driver+0x1c2/0x220 [ 26.096058][ T83] ? driver_allows_async_probing+0x160/0x160 [ 26.102015][ T83] bus_for_each_drv+0x162/0x1e0 [ 26.106847][ T83] ? bus_rescan_devices+0x20/0x20 [ 26.111855][ T83] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 26.117637][ T83] ? lockdep_hardirqs_on+0x382/0x580 [ 26.122915][ T83] __device_attach+0x217/0x360 [ 26.127656][ T83] ? device_bind_driver+0xd0/0xd0 [ 26.132662][ T83] ? kobject_uevent_env+0x29e/0x1150 [ 26.137923][ T83] ? kobject_uevent_env+0x2a8/0x1150 [ 26.143182][ T83] bus_probe_device+0x1e4/0x290 [ 26.148012][ T83] ? blocking_notifier_call_chain+0x54/0xa0 [ 26.153900][ T83] device_add+0xae6/0x16f0 [ 26.158389][ T83] ? uevent_store+0x50/0x50 [ 26.162879][ T83] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 26.168683][ T83] usb_set_configuration+0xdf6/0x1670 [ 26.174045][ T83] generic_probe+0x9d/0xd5 [ 26.178459][ T83] usb_probe_device+0x99/0x100 [ 26.183199][ T83] ? usb_suspend+0x620/0x620 [ 26.187766][ T83] really_probe+0x281/0x6d0 [ 26.192275][ T83] driver_probe_device+0x104/0x210 [ 26.197374][ T83] __device_attach_driver+0x1c2/0x220 [ 26.202741][ T83] ? driver_allows_async_probing+0x160/0x160 [ 26.208703][ T83] bus_for_each_drv+0x162/0x1e0 [ 26.213534][ T83] ? bus_rescan_devices+0x20/0x20 [ 26.218545][ T83] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 26.224331][ T83] ? lockdep_hardirqs_on+0x382/0x580 [ 26.229593][ T83] __device_attach+0x217/0x360 [ 26.234349][ T83] ? device_bind_driver+0xd0/0xd0 [ 26.239347][ T83] ? kobject_uevent_env+0x29e/0x1150 [ 26.244605][ T83] ? kobject_uevent_env+0x2a8/0x1150 [ 26.249866][ T83] bus_probe_device+0x1e4/0x290 [ 26.254693][ T83] ? blocking_notifier_call_chain+0x54/0xa0 [ 26.260611][ T83] device_add+0xae6/0x16f0 [ 26.265049][ T83] ? uevent_store+0x50/0x50 [ 26.269573][ T83] usb_new_device.cold+0x6a4/0xe79 [ 26.274658][ T83] hub_event+0x1dd0/0x37e0 [ 26.279069][ T83] ? hub_port_debounce+0x260/0x260 [ 26.284160][ T83] ? find_held_lock+0x2d/0x110 [ 26.288899][ T83] ? mark_held_locks+0xe0/0xe0 [ 26.293639][ T83] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 26.299157][ T83] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 26.304435][ T83] process_one_work+0x92b/0x1530 [ 26.309351][ T83] ? pwq_dec_nr_in_flight+0x310/0x310 [ 26.314700][ T83] ? do_raw_spin_lock+0x11a/0x280 [ 26.319709][ T83] worker_thread+0x96/0xe20 [ 26.324202][ T83] ? process_one_work+0x1530/0x1530 [ 26.329375][ T83] kthread+0x318/0x420 [ 26.333418][ T83] ? kthread_create_on_node+0xf0/0xf0 [ 26.338833][ T83] ret_from_fork+0x24/0x30 [ 26.343244][ T83] [ 26.345564][ T83] Allocated by task 83: [ 26.349759][ T83] save_stack+0x1b/0x80 [ 26.354075][ T83] __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 26.359699][ T83] usb_get_configuration+0x314/0x3050 [ 26.365051][ T83] usb_new_device+0xd3/0x160 [ 26.369621][ T83] hub_event+0x1dd0/0x37e0 [ 26.374037][ T83] process_one_work+0x92b/0x1530 [ 26.378993][ T83] worker_thread+0x96/0xe20 [ 26.383471][ T83] kthread+0x318/0x420 [ 26.387519][ T83] ret_from_fork+0x24/0x30 [ 26.391907][ T83] [ 26.394212][ T83] Freed by task 102: [ 26.398087][ T83] save_stack+0x1b/0x80 [ 26.402219][ T83] __kasan_slab_free+0x130/0x180 [ 26.407651][ T83] kfree+0xe4/0x320 [ 26.411448][ T83] usb_free_urb.part.0+0x7a/0xc0 [ 26.416373][ T83] usb_free_urb+0x1b/0x30 [ 26.420677][ T83] usb_start_wait_urb+0x1e5/0x2b0 [ 26.425675][ T83] usb_control_msg+0x31c/0x4a0 [ 26.430413][ T83] set_port_feature+0x69/0x90 [ 26.435065][ T83] hub_suspend+0x769/0x910 [ 26.439472][ T83] usb_suspend_both+0x260/0x7b0 [ 26.444312][ T83] usb_runtime_suspend+0x46/0x120 [ 26.449312][ T83] __rpm_callback+0x27e/0x3c0 [ 26.453969][ T83] rpm_callback+0x18f/0x230 [ 26.458447][ T83] rpm_suspend+0x37a/0x1300 [ 26.462924][ T83] __pm_runtime_suspend+0xbb/0x150 [ 26.468125][ T83] usb_runtime_idle+0x44/0x60 [ 26.472800][ T83] __rpm_callback+0x27e/0x3c0 [ 26.477451][ T83] rpm_idle+0x200/0x8f0 [ 26.481596][ T83] pm_runtime_work+0x13e/0x180 [ 26.486336][ T83] process_one_work+0x92b/0x1530 [ 26.491252][ T83] worker_thread+0x96/0xe20 [ 26.495728][ T83] kthread+0x318/0x420 [ 26.499771][ T83] ret_from_fork+0x24/0x30 [ 26.504178][ T83] [ 26.506494][ T83] The buggy address belongs to the object at ffff8881d52c9a00 [ 26.506494][ T83] which belongs to the cache kmalloc-192 of size 192 [ 26.520555][ T83] The buggy address is located 188 bytes inside of [ 26.520555][ T83] 192-byte region [ffff8881d52c9a00, ffff8881d52c9ac0) [ 26.533814][ T83] The buggy address belongs to the page: [ 26.539433][ T83] page:ffffea000754b240 refcount:1 mapcount:0 mapping:ffff8881da002a00 index:0x0 [ 26.548530][ T83] flags: 0x200000000000200(slab) [ 26.553452][ T83] raw: 0200000000000200 0000000000000000 0000000100000001 ffff8881da002a00 [ 26.565591][ T83] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 26.574262][ T83] page dumped because: kasan: bad access detected [ 26.580660][ T83] [ 26.582966][ T83] Memory state around the buggy address: [ 26.588578][ T83] ffff8881d52c9980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 26.596622][ T83] ffff8881d52c9a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.604677][ T83] >ffff8881d52c9a80: 00 00 00 00 03 fc fc fc fc fc fc fc fc fc fc fc [ 26.612767][ T83] ^ [ 26.618691][ T83] ffff8881d52c9b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.626729][ T83] ffff8881d52c9b80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 26.634762][ T83] ================================================================== [ 26.642840][ T83] Disabling lock debugging due to kernel taint [ 26.649039][ T83] Kernel panic - not syncing: panic_on_warn set ... [ 26.655640][ T83] CPU: 1 PID: 83 Comm: kworker/1:2 Tainted: G B 5.4.0-rc3+ #0 [ 26.664370][ T83] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 26.674504][ T83] Workqueue: usb_hub_wq hub_event [ 26.679502][ T83] Call Trace: [ 26.682770][ T83] dump_stack+0xca/0x13e [ 26.686989][ T83] panic+0x2aa/0x6e1 [ 26.690858][ T83] ? add_taint.cold+0x16/0x16 [ 26.695510][ T83] ? retint_kernel+0x10/0x10 [ 26.700092][ T83] ? trace_hardirqs_on+0x55/0x1e0 [ 26.705094][ T83] ? parse_term_proc_unit+0x57a/0x5e0 [ 26.710455][ T83] end_report+0x43/0x49 [ 26.714601][ T83] ? parse_term_proc_unit+0x57a/0x5e0 [ 26.719945][ T83] __kasan_report.cold+0xd/0x33 [ 26.724768][ T83] ? parse_term_proc_unit+0x57a/0x5e0 [ 26.730113][ T83] kasan_report+0xe/0x20 [ 26.734335][ T83] parse_term_proc_unit+0x57a/0x5e0 [ 26.739552][ T83] __check_input_term+0xc32/0x13f0 [ 26.744641][ T83] parse_audio_unit+0x101d/0x36f0 [ 26.749991][ T83] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 26.755795][ T83] ? lockdep_hardirqs_on+0x382/0x580 [ 26.761079][ T83] ? stack_depot_save+0x252/0x440 [ 26.766084][ T83] ? build_audio_procunit+0x13f0/0x13f0 [ 26.772065][ T83] ? save_stack+0x1b/0x80 [ 26.776390][ T83] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 26.782174][ T83] ? snd_usb_create_mixer+0x180/0x1890 [ 26.787623][ T83] ? usb_audio_probe+0xc76/0x2010 [ 26.792621][ T83] ? usb_probe_interface+0x305/0x7a0 [ 26.797881][ T83] ? really_probe+0x281/0x6d0 [ 26.802531][ T83] ? driver_probe_device+0x104/0x210 [ 26.807800][ T83] ? __device_attach_driver+0x1c2/0x220 [ 26.813335][ T83] ? bus_for_each_drv+0x162/0x1e0 [ 26.818341][ T83] ? __device_attach+0x217/0x360 [ 26.823261][ T83] ? bus_probe_device+0x1e4/0x290 [ 26.828336][ T83] ? device_add+0xae6/0x16f0 [ 26.832918][ T83] ? usb_set_configuration+0xdf6/0x1670 [ 26.838445][ T83] ? validate_desc.part.0+0x17f/0x240 [ 26.843806][ T83] snd_usb_mixer_controls+0x715/0xb90 [ 26.849247][ T83] ? parse_audio_unit+0x36f0/0x36f0 [ 26.854422][ T83] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 26.859707][ T83] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 26.866010][ T83] ? kasan_unpoison_shadow+0x30/0x40 [ 26.871285][ T83] ? usb_ifnum_to_if+0x12b/0x180 [ 26.876200][ T83] snd_usb_create_mixer+0x2b5/0x1890 [ 26.881466][ T83] ? mark_lock+0xbc/0x1160 [ 26.885875][ T83] ? mark_held_locks+0x9f/0xe0 [ 26.890613][ T83] ? snd_usb_mixer_interrupt+0x800/0x800 [ 26.896231][ T83] ? lockdep_hardirqs_on+0x382/0x580 [ 26.901493][ T83] ? usb_driver_claim_interface+0x210/0x420 [ 26.907361][ T83] ? snd_usb_create_stream+0x16a/0x4c0 [ 26.912808][ T83] usb_audio_probe+0xc76/0x2010 [ 26.917634][ T83] ? usb_audio_resume+0x20/0x20 [ 26.922473][ T83] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 26.928269][ T83] usb_probe_interface+0x305/0x7a0 [ 26.933369][ T83] ? usb_probe_device+0x100/0x100 [ 26.938375][ T83] really_probe+0x281/0x6d0 [ 26.942870][ T83] driver_probe_device+0x104/0x210 [ 26.948054][ T83] __device_attach_driver+0x1c2/0x220 [ 26.953403][ T83] ? driver_allows_async_probing+0x160/0x160 [ 26.959373][ T83] bus_for_each_drv+0x162/0x1e0 [ 26.964216][ T83] ? bus_rescan_devices+0x20/0x20 [ 26.969223][ T83] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 26.975003][ T83] ? lockdep_hardirqs_on+0x382/0x580 [ 26.980259][ T83] __device_attach+0x217/0x360 [ 26.984996][ T83] ? device_bind_driver+0xd0/0xd0 [ 26.990008][ T83] ? kobject_uevent_env+0x29e/0x1150 [ 26.995280][ T83] ? kobject_uevent_env+0x2a8/0x1150 [ 27.000537][ T83] bus_probe_device+0x1e4/0x290 [ 27.005364][ T83] ? blocking_notifier_call_chain+0x54/0xa0 [ 27.011250][ T83] device_add+0xae6/0x16f0 [ 27.015642][ T83] ? uevent_store+0x50/0x50 [ 27.020129][ T83] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 27.025914][ T83] usb_set_configuration+0xdf6/0x1670 [ 27.031262][ T83] generic_probe+0x9d/0xd5 [ 27.035655][ T83] usb_probe_device+0x99/0x100 [ 27.040396][ T83] ? usb_suspend+0x620/0x620 [ 27.044982][ T83] really_probe+0x281/0x6d0 [ 27.049468][ T83] driver_probe_device+0x104/0x210 [ 27.054554][ T83] __device_attach_driver+0x1c2/0x220 [ 27.059900][ T83] ? driver_allows_async_probing+0x160/0x160 [ 27.065865][ T83] bus_for_each_drv+0x162/0x1e0 [ 27.070717][ T83] ? bus_rescan_devices+0x20/0x20 [ 27.075769][ T83] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 27.081622][ T83] ? lockdep_hardirqs_on+0x382/0x580 [ 27.086886][ T83] __device_attach+0x217/0x360 [ 27.091626][ T83] ? device_bind_driver+0xd0/0xd0 [ 27.096626][ T83] ? kobject_uevent_env+0x29e/0x1150 [ 27.101882][ T83] ? kobject_uevent_env+0x2a8/0x1150 [ 27.107139][ T83] bus_probe_device+0x1e4/0x290 [ 27.111964][ T83] ? blocking_notifier_call_chain+0x54/0xa0 [ 27.117830][ T83] device_add+0xae6/0x16f0 [ 27.122224][ T83] ? uevent_store+0x50/0x50 [ 27.126714][ T83] usb_new_device.cold+0x6a4/0xe79 [ 27.131802][ T83] hub_event+0x1dd0/0x37e0 [ 27.136206][ T83] ? hub_port_debounce+0x260/0x260 [ 27.141292][ T83] ? find_held_lock+0x2d/0x110 [ 27.146030][ T83] ? mark_held_locks+0xe0/0xe0 [ 27.150769][ T83] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 27.156302][ T83] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 27.161574][ T83] process_one_work+0x92b/0x1530 [ 27.166490][ T83] ? pwq_dec_nr_in_flight+0x310/0x310 [ 27.171833][ T83] ? do_raw_spin_lock+0x11a/0x280 [ 27.176831][ T83] worker_thread+0x96/0xe20 [ 27.181307][ T83] ? process_one_work+0x1530/0x1530 [ 27.186480][ T83] kthread+0x318/0x420 [ 27.190537][ T83] ? kthread_create_on_node+0xf0/0xf0 [ 27.195883][ T83] ret_from_fork+0x24/0x30 [ 27.201037][ T83] Kernel Offset: disabled [ 27.205349][ T83] Rebooting in 86400 seconds..