INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.35' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 30.194538][ T95] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 30.284710][ T95] usb 1-1: Using ep0 maxpacket: 8 [ 30.414818][ T95] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 30.426406][ T95] usb 1-1: New USB device found, idVendor=0bd3, idProduct=0555, bcdDevice=69.6a [ 30.436697][ T95] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.447459][ T95] usb 1-1: config 0 descriptor?? executing program [ 30.744526][ T95] usb 1-1: string descriptor 0 read error: -71 [ 30.752782][ T95] uvcvideo: Found UVC 0.00 device (0bd3:0555) [ 30.762159][ T95] ================================================================== [ 30.771355][ T95] BUG: KASAN: use-after-free in uvc_probe.cold+0x2193/0x29de [ 30.779526][ T95] Read of size 2 at addr ffff8881d4f4902e by task kworker/0:2/95 [ 30.788068][ T95] [ 30.790411][ T95] CPU: 0 PID: 95 Comm: kworker/0:2 Not tainted 5.5.0-rc6-syzkaller #0 [ 30.799484][ T95] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 30.810650][ T95] Workqueue: usb_hub_wq hub_event [ 30.816131][ T95] Call Trace: [ 30.820004][ T95] dump_stack+0xef/0x16e [ 30.824517][ T95] ? uvc_probe.cold+0x2193/0x29de [ 30.830308][ T95] ? uvc_probe.cold+0x2193/0x29de [ 30.836129][ T95] print_address_description.constprop.0.cold+0xd3/0x314 [ 30.844317][ T95] ? uvc_probe.cold+0x2193/0x29de [ 30.849773][ T95] ? uvc_probe.cold+0x2193/0x29de [ 30.854820][ T95] __kasan_report.cold+0x37/0x85 [ 30.860892][ T95] ? uvc_probe.cold+0x2193/0x29de [ 30.866477][ T95] kasan_report+0xe/0x20 [ 30.871399][ T95] uvc_probe.cold+0x2193/0x29de [ 30.876861][ T95] ? mark_lock+0xbc/0x1160 [ 30.882092][ T95] ? mark_lock+0xbc/0x1160 [ 30.888600][ T95] ? mark_held_locks+0x9f/0xe0 [ 30.894203][ T95] ? usb_probe_interface+0x310/0x800 [ 30.899891][ T95] usb_probe_interface+0x310/0x800 [ 30.905710][ T95] ? usb_probe_device+0x140/0x140 [ 30.911461][ T95] really_probe+0x290/0xad0 [ 30.916434][ T95] driver_probe_device+0x223/0x350 [ 30.922116][ T95] __device_attach_driver+0x1d1/0x290 [ 30.928202][ T95] ? driver_allows_async_probing+0x160/0x160 [ 30.935834][ T95] bus_for_each_drv+0x162/0x1e0 [ 30.941766][ T95] ? bus_rescan_devices+0x20/0x20 [ 30.947848][ T95] ? _raw_spin_unlock_irqrestore+0x39/0x40 [ 30.954611][ T95] ? lockdep_hardirqs_on+0x382/0x580 [ 30.960880][ T95] __device_attach+0x217/0x390 [ 30.966240][ T95] ? device_bind_driver+0xd0/0xd0 [ 30.971711][ T95] bus_probe_device+0x1e4/0x290 [ 30.977860][ T95] device_add+0x1459/0x1bf0 [ 30.982991][ T95] ? wait_for_completion+0x3c0/0x3c0 [ 30.990691][ T95] ? device_link_remove+0x110/0x110 [ 30.997083][ T95] ? _raw_spin_unlock_irqrestore+0x39/0x40 [ 31.003194][ T95] usb_set_configuration+0xe47/0x17d0 [ 31.009164][ T95] generic_probe+0x9d/0xd5 [ 31.013818][ T95] usb_probe_device+0xaf/0x140 [ 31.018889][ T95] ? usb_suspend+0x5f0/0x5f0 [ 31.024151][ T95] really_probe+0x290/0xad0 [ 31.028748][ T95] driver_probe_device+0x223/0x350 [ 31.034472][ T95] __device_attach_driver+0x1d1/0x290 [ 31.040182][ T95] ? driver_allows_async_probing+0x160/0x160 [ 31.046166][ T95] bus_for_each_drv+0x162/0x1e0 [ 31.051498][ T95] ? bus_rescan_devices+0x20/0x20 [ 31.058212][ T95] ? _raw_spin_unlock_irqrestore+0x39/0x40 [ 31.064582][ T95] ? lockdep_hardirqs_on+0x382/0x580 [ 31.070177][ T95] __device_attach+0x217/0x390 [ 31.075506][ T95] ? device_bind_driver+0xd0/0xd0 [ 31.081164][ T95] bus_probe_device+0x1e4/0x290 [ 31.086906][ T95] device_add+0x1459/0x1bf0 [ 31.092212][ T95] ? device_link_remove+0x110/0x110 [ 31.098989][ T95] usb_new_device.cold+0x540/0xcd0 [ 31.104847][ T95] hub_event+0x21cb/0x4300 [ 31.109752][ T95] ? hub_port_debounce+0x350/0x350 [ 31.115323][ T95] ? find_held_lock+0x2d/0x110 [ 31.120613][ T95] ? mark_held_locks+0xe0/0xe0 [ 31.126205][ T95] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 31.132531][ T95] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 31.139793][ T95] process_one_work+0x945/0x15c0 [ 31.145130][ T95] ? pwq_dec_nr_in_flight+0x310/0x310 [ 31.151211][ T95] ? do_raw_spin_lock+0x129/0x290 [ 31.157043][ T95] worker_thread+0x96/0xe20 [ 31.162295][ T95] ? process_one_work+0x15c0/0x15c0 [ 31.167853][ T95] kthread+0x318/0x420 [ 31.172478][ T95] ? kthread_create_on_node+0xf0/0xf0 [ 31.178979][ T95] ret_from_fork+0x24/0x30 [ 31.184610][ T95] [ 31.187340][ T95] Allocated by task 95: [ 31.192311][ T95] save_stack+0x1b/0x80 [ 31.196653][ T95] __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 31.202821][ T95] uvc_alloc_chain+0x48/0xfa [ 31.208173][ T95] uvc_probe.cold+0x15f0/0x29de [ 31.213954][ T95] usb_probe_interface+0x310/0x800 [ 31.220427][ T95] really_probe+0x290/0xad0 [ 31.227539][ T95] driver_probe_device+0x223/0x350 [ 31.233658][ T95] __device_attach_driver+0x1d1/0x290 [ 31.239665][ T95] bus_for_each_drv+0x162/0x1e0 [ 31.245621][ T95] __device_attach+0x217/0x390 [ 31.250733][ T95] bus_probe_device+0x1e4/0x290 [ 31.256379][ T95] device_add+0x1459/0x1bf0 [ 31.261361][ T95] usb_set_configuration+0xe47/0x17d0 [ 31.268150][ T95] generic_probe+0x9d/0xd5 [ 31.273670][ T95] usb_probe_device+0xaf/0x140 [ 31.278773][ T95] really_probe+0x290/0xad0 [ 31.284634][ T95] driver_probe_device+0x223/0x350 [ 31.290486][ T95] __device_attach_driver+0x1d1/0x290 [ 31.296140][ T95] bus_for_each_drv+0x162/0x1e0 [ 31.302434][ T95] __device_attach+0x217/0x390 [ 31.307288][ T95] bus_probe_device+0x1e4/0x290 [ 31.312695][ T95] device_add+0x1459/0x1bf0 [ 31.318462][ T95] usb_new_device.cold+0x540/0xcd0 [ 31.324031][ T95] hub_event+0x21cb/0x4300 [ 31.329025][ T95] process_one_work+0x945/0x15c0 [ 31.334066][ T95] worker_thread+0x96/0xe20 [ 31.338982][ T95] kthread+0x318/0x420 [ 31.343184][ T95] ret_from_fork+0x24/0x30 [ 31.348122][ T95] [ 31.350757][ T95] Freed by task 95: [ 31.354663][ T95] save_stack+0x1b/0x80 [ 31.359049][ T95] __kasan_slab_free+0x117/0x160 [ 31.363983][ T95] kfree+0xd5/0x300 [ 31.368182][ T95] uvc_probe.cold+0x16fd/0x29de [ 31.373772][ T95] usb_probe_interface+0x310/0x800 [ 31.379094][ T95] really_probe+0x290/0xad0 [ 31.384170][ T95] driver_probe_device+0x223/0x350 [ 31.389968][ T95] __device_attach_driver+0x1d1/0x290 [ 31.396186][ T95] bus_for_each_drv+0x162/0x1e0 [ 31.401912][ T95] __device_attach+0x217/0x390 [ 31.407080][ T95] bus_probe_device+0x1e4/0x290 [ 31.412927][ T95] device_add+0x1459/0x1bf0 [ 31.418021][ T95] usb_set_configuration+0xe47/0x17d0 [ 31.424927][ T95] generic_probe+0x9d/0xd5 [ 31.429806][ T95] usb_probe_device+0xaf/0x140 [ 31.435230][ T95] really_probe+0x290/0xad0 [ 31.440418][ T95] driver_probe_device+0x223/0x350 [ 31.446912][ T95] __device_attach_driver+0x1d1/0x290 [ 31.453013][ T95] bus_for_each_drv+0x162/0x1e0 [ 31.458018][ T95] __device_attach+0x217/0x390 [ 31.463275][ T95] bus_probe_device+0x1e4/0x290 [ 31.468304][ T95] device_add+0x1459/0x1bf0 [ 31.472810][ T95] usb_new_device.cold+0x540/0xcd0 [ 31.478825][ T95] hub_event+0x21cb/0x4300 [ 31.484827][ T95] process_one_work+0x945/0x15c0 [ 31.490686][ T95] worker_thread+0x96/0xe20 [ 31.496390][ T95] kthread+0x318/0x420 [ 31.501102][ T95] ret_from_fork+0x24/0x30 [ 31.506089][ T95] [ 31.508421][ T95] The buggy address belongs to the object at ffff8881d4f49000 [ 31.508421][ T95] which belongs to the cache kmalloc-256 of size 256 [ 31.526204][ T95] The buggy address is located 46 bytes inside of [ 31.526204][ T95] 256-byte region [ffff8881d4f49000, ffff8881d4f49100) [ 31.541143][ T95] The buggy address belongs to the page: [ 31.548169][ T95] page:ffffea000753d200 refcount:1 mapcount:0 mapping:ffff8881da002780 index:0x0 compound_mapcount: 0 [ 31.560226][ T95] raw: 0200000000010200 ffffea000753c380 0000000200000002 ffff8881da002780 [ 31.569859][ T95] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 31.580119][ T95] page dumped because: kasan: bad access detected [ 31.588388][ T95] [ 31.591053][ T95] Memory state around the buggy address: [ 31.596998][ T95] ffff8881d4f48f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.605586][ T95] ffff8881d4f48f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.614751][ T95] >ffff8881d4f49000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.623170][ T95] ^ [ 31.628905][ T95] ffff8881d4f49080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.637660][ T95] ffff8881d4f49100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.646645][ T95] ================================================================== [ 31.655427][ T95] Disabling lock debugging due to kernel taint [ 31.663161][ T95] Kernel panic - not syncing: panic_on_warn set ... [ 31.671564][ T95] CPU: 0 PID: 95 Comm: kworker/0:2 Tainted: G B 5.5.0-rc6-syzkaller #0 [ 31.682646][ T95] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 31.695025][ T95] Workqueue: usb_hub_wq hub_event [ 31.700134][ T95] Call Trace: [ 31.703575][ T95] dump_stack+0xef/0x16e [ 31.708394][ T95] panic+0x2aa/0x6e1 [ 31.712512][ T95] ? add_taint.cold+0x16/0x16 [ 31.718190][ T95] ? retint_kernel+0x10/0x10 [ 31.723114][ T95] ? trace_hardirqs_on+0x55/0x200 [ 31.729436][ T95] ? uvc_probe.cold+0x2193/0x29de [ 31.735626][ T95] end_report+0x43/0x49 [ 31.740095][ T95] ? uvc_probe.cold+0x2193/0x29de [ 31.745538][ T95] __kasan_report.cold+0x55/0x85 [ 31.752195][ T95] ? uvc_probe.cold+0x2193/0x29de [ 31.758067][ T95] kasan_report+0xe/0x20 [ 31.763649][ T95] uvc_probe.cold+0x2193/0x29de [ 31.769092][ T95] ? mark_lock+0xbc/0x1160 [ 31.775053][ T95] ? mark_lock+0xbc/0x1160 [ 31.781645][ T95] ? mark_held_locks+0x9f/0xe0 [ 31.786829][ T95] ? usb_probe_interface+0x310/0x800 [ 31.793786][ T95] usb_probe_interface+0x310/0x800 [ 31.799160][ T95] ? usb_probe_device+0x140/0x140 [ 31.805356][ T95] really_probe+0x290/0xad0 [ 31.810146][ T95] driver_probe_device+0x223/0x350 [ 31.815549][ T95] __device_attach_driver+0x1d1/0x290 [ 31.823093][ T95] ? driver_allows_async_probing+0x160/0x160 [ 31.829961][ T95] bus_for_each_drv+0x162/0x1e0 [ 31.835538][ T95] ? bus_rescan_devices+0x20/0x20 [ 31.842215][ T95] ? _raw_spin_unlock_irqrestore+0x39/0x40 [ 31.849081][ T95] ? lockdep_hardirqs_on+0x382/0x580 [ 31.854789][ T95] __device_attach+0x217/0x390 [ 31.859639][ T95] ? device_bind_driver+0xd0/0xd0 [ 31.867117][ T95] bus_probe_device+0x1e4/0x290 [ 31.873820][ T95] device_add+0x1459/0x1bf0 [ 31.880234][ T95] ? wait_for_completion+0x3c0/0x3c0 [ 31.886348][ T95] ? device_link_remove+0x110/0x110 [ 31.894203][ T95] ? _raw_spin_unlock_irqrestore+0x39/0x40 [ 31.902303][ T95] usb_set_configuration+0xe47/0x17d0 [ 31.908064][ T95] generic_probe+0x9d/0xd5 [ 31.913491][ T95] usb_probe_device+0xaf/0x140 [ 31.919031][ T95] ? usb_suspend+0x5f0/0x5f0 [ 31.924355][ T95] really_probe+0x290/0xad0 [ 31.929753][ T95] driver_probe_device+0x223/0x350 [ 31.936300][ T95] __device_attach_driver+0x1d1/0x290 [ 31.944060][ T95] ? driver_allows_async_probing+0x160/0x160 [ 31.950775][ T95] bus_for_each_drv+0x162/0x1e0 [ 31.956876][ T95] ? bus_rescan_devices+0x20/0x20 [ 31.962569][ T95] ? _raw_spin_unlock_irqrestore+0x39/0x40 [ 31.969985][ T95] ? lockdep_hardirqs_on+0x382/0x580 [ 31.976762][ T95] __device_attach+0x217/0x390 [ 31.983365][ T95] ? device_bind_driver+0xd0/0xd0 [ 31.989656][ T95] bus_probe_device+0x1e4/0x290 [ 31.995639][ T95] device_add+0x1459/0x1bf0 [ 32.000719][ T95] ? device_link_remove+0x110/0x110 [ 32.006362][ T95] usb_new_device.cold+0x540/0xcd0 [ 32.011628][ T95] hub_event+0x21cb/0x4300 [ 32.016996][ T95] ? hub_port_debounce+0x350/0x350 [ 32.022459][ T95] ? find_held_lock+0x2d/0x110 [ 32.028250][ T95] ? mark_held_locks+0xe0/0xe0 [ 32.033438][ T95] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 32.040071][ T95] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 32.046294][ T95] process_one_work+0x945/0x15c0 [ 32.051796][ T95] ? pwq_dec_nr_in_flight+0x310/0x310 [ 32.058724][ T95] ? do_raw_spin_lock+0x129/0x290 [ 32.066296][ T95] worker_thread+0x96/0xe20 [ 32.073496][ T95] ? process_one_work+0x15c0/0x15c0 [ 32.079941][ T95] kthread+0x318/0x420 [ 32.084138][ T95] ? kthread_create_on_node+0xf0/0xf0 [ 32.089829][ T95] ret_from_fork+0x24/0x30 [ 32.096229][ T95] Kernel Offset: disabled [ 32.101375][ T95] Rebooting in 86400 seconds..