./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3859737120 <...> [ 53.539047][ C0] net_ratelimit: 82 callbacks suppressed [ 53.539062][ C0] eth0: bad gso: type: 1, size: 1408 [ 53.765486][ C0] eth0: bad gso: type: 1, size: 1408 [ 53.775855][ C0] eth0: bad gso: type: 1, size: 1408 [ 53.782217][ C0] eth0: bad gso: type: 1, size: 1408 [ 53.789474][ C0] eth0: bad gso: type: 1, size: 1408 [ 53.795762][ C0] eth0: bad gso: type: 1, size: 1408 [ 53.801845][ C0] eth0: bad gso: type: 1, size: 1408 [ 53.807849][ C0] eth0: bad gso: type: 1, size: 1408 [ 53.814018][ C0] eth0: bad gso: type: 1, size: 1408 Warning: Permanently added '10.128.1.75' (ED25519) to the list of known hosts. execve("./syz-executor3859737120", ["./syz-executor3859737120"], 0x7ffd7a2fc660 /* 10 vars */) = 0 brk(NULL) = 0x555587f9f000 brk(0x555587f9fd00) = 0x555587f9fd00 arch_prctl(ARCH_SET_FS, 0x555587f9f380) = 0 set_tid_address(0x555587f9f650) = 5225 set_robust_list(0x555587f9f660, 24) = 0 rseq(0x555587f9fca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3859737120", 4096) = 28 getrandom("\xcb\x05\xc7\x7b\xe5\x9a\xc6\x1c", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555587f9fd00 brk(0x555587fc0d00) = 0x555587fc0d00 brk(0x555587fc1000) = 0x555587fc1000 mprotect(0x7fd27242d000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5226 attached [pid 5226] set_robust_list(0x555587f9f660, 24 [pid 5225] <... clone resumed>, child_tidptr=0x555587f9f650) = 5226 [pid 5226] <... set_robust_list resumed>) = 0 [pid 5226] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5226] setpgid(0, 0) = 0 [pid 5226] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5226] write(3, "1000", 4) = 4 [pid 5226] close(3) = 0 executing program [pid 5226] write(1, "executing program\n", 18) = 18 [pid 5226] openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 3 [pid 5226] ioctl(3, USB_RAW_IOCTL_INIT, 0x7ffe1f10ec50) = 0 [pid 5226] ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0 [pid 5226] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe1f10ec50) = 0 [pid 5226] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe1f10ec50) = 0 [pid 5226] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe1f10ec50) = 0 [pid 5226] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe1f10ec50) = 0 [pid 5226] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe1f10dc40) = 18 [pid 5226] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe1f10ec50) = 0 [ 60.947210][ T941] usb 1-1: new high-speed USB device number 2 using dummy_hcd [pid 5226] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe1f10ec50) = 0 [pid 5226] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe1f10ec50) = 0 [pid 5226] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe1f10dc40) = 18 [pid 5226] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe1f10ec50) = 0 [pid 5226] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe1f10dc40) = 9 [pid 5226] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe1f10ec50) = 0 [pid 5226] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe1f10dc40) = 18 [pid 5226] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe1f10ec50) = 0 [pid 5226] ioctl(3, USB_RAW_IOCTL_VBUS_DRAW, 0) = 0 [pid 5226] ioctl(3, USB_RAW_IOCTL_CONFIGURE, 0) = 0 [pid 5226] ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffe1f10dc40) = 0 [ 61.153011][ T941] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=1a.9e [ 61.162380][ T941] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 61.173561][ T941] usb 1-1: config 0 descriptor?? [pid 5226] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe1f10ec70) = 0 [pid 5226] ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffe1f10dc60) = 4 [pid 5226] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe1f10ec70) = 0 [pid 5226] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe1f10dc60) = 8 [pid 5226] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe1f10ec70) = 0 [pid 5226] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe1f10dc60) = 0 [ 61.809885][ T941] ------------[ cut here ]------------ [ 61.815607][ T941] WARNING: CPU: 1 PID: 941 at drivers/net/wireless/ath/ath6kl/bmi.c:90 ath6kl_bmi_get_target_info+0x44a/0x590 [ 61.815675][ T941] Modules linked in: [ 61.815700][ T941] CPU: 1 UID: 0 PID: 941 Comm: kworker/1:2 Not tainted 6.10.0-next-20240726-syzkaller #0 [ 61.815721][ T941] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 61.815733][ T941] Workqueue: usb_hub_wq hub_event [ 61.815763][ T941] RIP: 0010:ath6kl_bmi_get_target_info+0x44a/0x590 [ 61.815789][ T941] Code: 04 30 84 c0 0f 85 3a 01 00 00 48 8b 44 24 08 8b 30 48 c7 c7 e0 50 a4 8c 89 da e8 a1 1b fe ff e9 04 fe ff ff e8 e7 62 c9 fa 90 <0f> 0b 90 bb ea ff ff ff e9 f1 fd ff ff e8 d4 62 c9 fa 31 db e9 e5 [ 61.815809][ T941] RSP: 0018:ffffc9000400eb60 EFLAGS: 00010293 [ 61.815825][ T941] RAX: ffffffff86ca6839 RBX: 0000000000000000 RCX: ffff8880214bbc00 [ 61.815838][ T941] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000c [ 61.815850][ T941] RBP: ffffc9000400ec30 R08: ffffffff86ca6790 R09: 1ffffffff26e6f0e [ 61.815863][ T941] R10: dffffc0000000000 R11: fffffbfff26e6f0f R12: ffffc9000400ece4 [ 61.815876][ T941] R13: ffff8880240c0e40 R14: dffffc0000000000 R15: 1ffff92000801d74 [ 61.815890][ T941] FS: 0000000000000000(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000 [ 61.815905][ T941] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 61.815918][ T941] CR2: 0000000020000700 CR3: 0000000076428000 CR4: 00000000003506f0 [ 61.815935][ T941] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 61.815946][ T941] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 61.815958][ T941] Call Trace: [ 61.815966][ T941] [ 61.815974][ T941] ? __warn+0x168/0x4e0 [ 61.815994][ T941] ? ath6kl_bmi_get_target_info+0x44a/0x590 [ 61.816020][ T941] ? report_bug+0x2b3/0x500 [ 61.816040][ T941] ? ath6kl_bmi_get_target_info+0x44a/0x590 [ 61.816059][ T941] ? handle_bug+0x3e/0x70 [ 61.816069][ T941] ? exc_invalid_op+0x1a/0x50 [ 61.816080][ T941] ? asm_exc_invalid_op+0x1a/0x20 [ 61.816095][ T941] ? ath6kl_bmi_get_target_info+0x3a0/0x590 [ 61.816109][ T941] ? ath6kl_bmi_get_target_info+0x449/0x590 [ 61.816126][ T941] ? ath6kl_bmi_get_target_info+0x44a/0x590 [ 61.816147][ T941] ? __pfx_ath6kl_bmi_get_target_info+0x10/0x10 [ 61.816162][ T941] ? ath6kl_bmi_init+0x6d/0xf0 [ 61.816171][ T941] ? __kmalloc_noprof+0x21a/0x400 [ 61.816190][ T941] ath6kl_core_init+0x1eb/0x1140 [ 61.816207][ T941] ? __pfx_lockdep_init_map_type+0x10/0x10 [ 61.816227][ T941] ? __kasan_kmalloc+0x98/0xb0 [ 61.816238][ T941] ? __pfx_ath6kl_core_init+0x10/0x10 [ 61.816252][ T941] ? ath6kl_core_create+0x7d8/0x950 [ 61.816273][ T941] ath6kl_usb_probe+0x129b/0x1390 [ 61.816289][ T941] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 61.816307][ T941] ? usb_disable_lpm+0x77/0x380 [ 61.816323][ T941] usb_probe_interface+0x645/0xbb0 [ 61.816346][ T941] ? __pfx_usb_probe_interface+0x10/0x10 [ 61.816360][ T941] really_probe+0x2b8/0xad0 [ 61.816380][ T941] __driver_probe_device+0x1a2/0x390 [ 61.816395][ T941] driver_probe_device+0x50/0x430 [ 61.816409][ T941] __device_attach_driver+0x2d6/0x530 [ 61.816423][ T941] bus_for_each_drv+0x24e/0x2e0 [ 61.816439][ T941] ? __pfx___device_attach_driver+0x10/0x10 [ 61.816451][ T941] ? __pfx_bus_for_each_drv+0x10/0x10 [ 61.816471][ T941] __device_attach+0x333/0x520 [ 61.816483][ T941] ? __pfx_lock_release+0x10/0x10 [ 61.816499][ T941] ? __pfx___device_attach+0x10/0x10 [ 61.816512][ T941] ? do_raw_spin_unlock+0x13c/0x8b0 [ 61.816530][ T941] bus_probe_device+0x189/0x260 [ 61.816547][ T941] device_add+0x856/0xbf0 [ 61.816561][ T941] usb_set_configuration+0x1976/0x1fb0 [ 61.816590][ T941] usb_generic_driver_probe+0x88/0x140 [ 61.816624][ T941] usb_probe_device+0x1b8/0x380 [ 61.816641][ T941] ? __pfx_usb_probe_device+0x10/0x10 [ 61.816654][ T941] really_probe+0x2b8/0xad0 [ 61.816671][ T941] __driver_probe_device+0x1a2/0x390 [ 61.816685][ T941] driver_probe_device+0x50/0x430 [ 61.816699][ T941] __device_attach_driver+0x2d6/0x530 [ 61.816713][ T941] bus_for_each_drv+0x24e/0x2e0 [ 61.816728][ T941] ? __pfx___device_attach_driver+0x10/0x10 [ 61.816740][ T941] ? __pfx_bus_for_each_drv+0x10/0x10 [ 61.816761][ T941] __device_attach+0x333/0x520 [ 61.816776][ T941] ? __pfx___device_attach+0x10/0x10 [ 61.816793][ T941] bus_probe_device+0x189/0x260 [ 61.816810][ T941] device_add+0x856/0xbf0 [ 61.816824][ T941] usb_new_device+0x104a/0x19a0 [ 61.816847][ T941] ? __pfx_usb_new_device+0x10/0x10 [ 61.816953][ T941] ? _raw_spin_unlock_irq+0x23/0x50 [ 61.816977][ T941] ? lockdep_hardirqs_on+0x99/0x150 [ 61.817004][ T941] hub_event+0x2d6d/0x5150 [ 61.817080][ T941] ? __pfx_hub_event+0x10/0x10 [ 61.817102][ T941] ? __pfx_lock_acquire+0x10/0x10 [ 61.817124][ T941] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 61.817148][ T941] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 61.817180][ T941] ? process_scheduled_works+0x945/0x1830 [ 61.817203][ T941] process_scheduled_works+0xa2c/0x1830 [ 61.817251][ T941] ? __pfx_process_scheduled_works+0x10/0x10 [ 61.817283][ T941] ? assign_work+0x364/0x3d0 [ 61.817313][ T941] worker_thread+0x86d/0xd40 [ 61.817343][ T941] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 61.817368][ T941] ? __kthread_parkme+0x169/0x1d0 [ 61.817397][ T941] ? __pfx_worker_thread+0x10/0x10 [ 61.817419][ T941] kthread+0x2f0/0x390 [ 61.817437][ T941] ? __pfx_worker_thread+0x10/0x10 [ 61.817458][ T941] ? __pfx_kthread+0x10/0x10 [ 61.817477][ T941] ret_from_fork+0x4b/0x80 [ 61.817499][ T941] ? __pfx_kthread+0x10/0x10 [ 61.817517][ T941] ret_from_fork_asm+0x1a/0x30 [ 61.817557][ T941] [ 61.817566][ T941] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 62.368036][ T941] CPU: 1 UID: 0 PID: 941 Comm: kworker/1:2 Not tainted 6.10.0-next-20240726-syzkaller #0 [ 62.377834][ T941] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 62.387891][ T941] Workqueue: usb_hub_wq hub_event [ 62.393126][ T941] Call Trace: [ 62.396411][ T941] [ 62.399336][ T941] dump_stack_lvl+0x241/0x360 [ 62.404015][ T941] ? __pfx_dump_stack_lvl+0x10/0x10 [ 62.409322][ T941] ? __pfx__printk+0x10/0x10 [ 62.414101][ T941] ? vscnprintf+0x5d/0x90 [ 62.418426][ T941] panic+0x349/0x870 [ 62.422321][ T941] ? __warn+0x177/0x4e0 [ 62.426468][ T941] ? __pfx_panic+0x10/0x10 [ 62.430891][ T941] ? ret_from_fork_asm+0x1a/0x30 [ 62.435827][ T941] __warn+0x34b/0x4e0 [ 62.439800][ T941] ? ath6kl_bmi_get_target_info+0x44a/0x590 [ 62.445690][ T941] report_bug+0x2b3/0x500 [ 62.450022][ T941] ? ath6kl_bmi_get_target_info+0x44a/0x590 [ 62.456087][ T941] handle_bug+0x3e/0x70 [ 62.460323][ T941] exc_invalid_op+0x1a/0x50 [ 62.464824][ T941] asm_exc_invalid_op+0x1a/0x20 [ 62.469666][ T941] RIP: 0010:ath6kl_bmi_get_target_info+0x44a/0x590 [ 62.476190][ T941] Code: 04 30 84 c0 0f 85 3a 01 00 00 48 8b 44 24 08 8b 30 48 c7 c7 e0 50 a4 8c 89 da e8 a1 1b fe ff e9 04 fe ff ff e8 e7 62 c9 fa 90 <0f> 0b 90 bb ea ff ff ff e9 f1 fd ff ff e8 d4 62 c9 fa 31 db e9 e5 [ 62.496086][ T941] RSP: 0018:ffffc9000400eb60 EFLAGS: 00010293 [ 62.502169][ T941] RAX: ffffffff86ca6839 RBX: 0000000000000000 RCX: ffff8880214bbc00 [ 62.510312][ T941] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000c [ 62.518538][ T941] RBP: ffffc9000400ec30 R08: ffffffff86ca6790 R09: 1ffffffff26e6f0e [ 62.526704][ T941] R10: dffffc0000000000 R11: fffffbfff26e6f0f R12: ffffc9000400ece4 [ 62.534751][ T941] R13: ffff8880240c0e40 R14: dffffc0000000000 R15: 1ffff92000801d74 [ 62.542847][ T941] ? ath6kl_bmi_get_target_info+0x3a0/0x590 [ 62.548861][ T941] ? ath6kl_bmi_get_target_info+0x449/0x590 [ 62.554987][ T941] ? __pfx_ath6kl_bmi_get_target_info+0x10/0x10 [ 62.561457][ T941] ? ath6kl_bmi_init+0x6d/0xf0 [ 62.566397][ T941] ? __kmalloc_noprof+0x21a/0x400 [ 62.572227][ T941] ath6kl_core_init+0x1eb/0x1140 [ 62.577630][ T941] ? __pfx_lockdep_init_map_type+0x10/0x10 [ 62.583440][ T941] ? __kasan_kmalloc+0x98/0xb0 [ 62.588293][ T941] ? __pfx_ath6kl_core_init+0x10/0x10 [ 62.593844][ T941] ? ath6kl_core_create+0x7d8/0x950 [ 62.599219][ T941] ath6kl_usb_probe+0x129b/0x1390 [ 62.604504][ T941] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 62.610402][ T941] ? usb_disable_lpm+0x77/0x380 [ 62.615574][ T941] usb_probe_interface+0x645/0xbb0 [ 62.620707][ T941] ? __pfx_usb_probe_interface+0x10/0x10 [ 62.626338][ T941] really_probe+0x2b8/0xad0 [ 62.631024][ T941] __driver_probe_device+0x1a2/0x390 [ 62.636341][ T941] driver_probe_device+0x50/0x430 [ 62.641583][ T941] __device_attach_driver+0x2d6/0x530 [ 62.646993][ T941] bus_for_each_drv+0x24e/0x2e0 [ 62.651866][ T941] ? __pfx___device_attach_driver+0x10/0x10 [ 62.657767][ T941] ? __pfx_bus_for_each_drv+0x10/0x10 [ 62.663232][ T941] __device_attach+0x333/0x520 [ 62.668077][ T941] ? __pfx_lock_release+0x10/0x10 [ 62.673099][ T941] ? __pfx___device_attach+0x10/0x10 [ 62.678379][ T941] ? do_raw_spin_unlock+0x13c/0x8b0 [ 62.683581][ T941] bus_probe_device+0x189/0x260 [ 62.688602][ T941] device_add+0x856/0xbf0 [ 62.692935][ T941] usb_set_configuration+0x1976/0x1fb0 [ 62.698525][ T941] usb_generic_driver_probe+0x88/0x140 [ 62.703991][ T941] usb_probe_device+0x1b8/0x380 [ 62.708937][ T941] ? __pfx_usb_probe_device+0x10/0x10 [ 62.714500][ T941] really_probe+0x2b8/0xad0 [ 62.719053][ T941] __driver_probe_device+0x1a2/0x390 [ 62.724376][ T941] driver_probe_device+0x50/0x430 [ 62.729430][ T941] __device_attach_driver+0x2d6/0x530 [ 62.734851][ T941] bus_for_each_drv+0x24e/0x2e0 [ 62.739813][ T941] ? __pfx___device_attach_driver+0x10/0x10 [ 62.745741][ T941] ? __pfx_bus_for_each_drv+0x10/0x10 [ 62.751145][ T941] __device_attach+0x333/0x520 [ 62.755915][ T941] ? __pfx___device_attach+0x10/0x10 [ 62.761199][ T941] bus_probe_device+0x189/0x260 [ 62.766049][ T941] device_add+0x856/0xbf0 [ 62.770408][ T941] usb_new_device+0x104a/0x19a0 [ 62.775620][ T941] ? __pfx_usb_new_device+0x10/0x10 [ 62.780834][ T941] ? _raw_spin_unlock_irq+0x23/0x50 [ 62.786027][ T941] ? lockdep_hardirqs_on+0x99/0x150 [ 62.791484][ T941] hub_event+0x2d6d/0x5150 [ 62.795958][ T941] ? __pfx_hub_event+0x10/0x10 [ 62.800745][ T941] ? __pfx_lock_acquire+0x10/0x10 [ 62.805779][ T941] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 62.811795][ T941] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 62.818150][ T941] ? process_scheduled_works+0x945/0x1830 [ 62.823874][ T941] process_scheduled_works+0xa2c/0x1830 [ 62.829471][ T941] ? __pfx_process_scheduled_works+0x10/0x10 [ 62.835569][ T941] ? assign_work+0x364/0x3d0 [ 62.840277][ T941] worker_thread+0x86d/0xd40 [ 62.844881][ T941] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 62.850808][ T941] ? __kthread_parkme+0x169/0x1d0 [ 62.855856][ T941] ? __pfx_worker_thread+0x10/0x10 [ 62.860967][ T941] kthread+0x2f0/0x390 [ 62.865026][ T941] ? __pfx_worker_thread+0x10/0x10 [ 62.870219][ T941] ? __pfx_kthread+0x10/0x10 [ 62.874906][ T941] ret_from_fork+0x4b/0x80 [ 62.879326][ T941] ? __pfx_kthread+0x10/0x10 [ 62.883999][ T941] ret_from_fork_asm+0x1a/0x30 [ 62.888792][ T941] [ 62.891939][ T941] Kernel Offset: disabled [ 62.896295][ T941] Rebooting in 86400 seconds..