./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor606332849 <...> Warning: Permanently added '10.128.1.44' (ED25519) to the list of known hosts. execve("./syz-executor606332849", ["./syz-executor606332849"], 0x7ffcd48d2720 /* 10 vars */) = 0 brk(NULL) = 0x5555806e0000 brk(0x5555806e0d00) = 0x5555806e0d00 arch_prctl(ARCH_SET_FS, 0x5555806e0380) = 0 set_tid_address(0x5555806e0650) = 5830 set_robust_list(0x5555806e0660, 24) = 0 rseq(0x5555806e0ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor606332849", 4096) = 27 getrandom("\x99\xb4\xea\x97\xca\xbf\x75\x98", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x5555806e0d00 brk(0x555580701d00) = 0x555580701d00 brk(0x555580702000) = 0x555580702000 mprotect(0x7fb760890000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 executing program write(1, "executing program\n", 18) = 18 openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 3 ioctl(3, USB_RAW_IOCTL_INIT, 0x7ffe4578e7d0) = 0 ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe4578e7d0) = 0 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe4578e7d0) = 0 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe4578e7d0) = 0 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe4578e7d0) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe4578d7c0) = 18 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe4578e7d0) = 0 [ 62.303989][ T975] usb 1-1: new high-speed USB device number 2 using dummy_hcd ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe4578e7d0) = 0 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe4578e7d0) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe4578d7c0) = 18 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe4578e7d0) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe4578d7c0) = 9 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe4578e7d0) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe4578d7c0) = 36 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe4578e7d0) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe4578d7c0) = 4 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe4578e7d0) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe4578d7c0) = 8 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe4578e7d0) = 0 [ 62.489706][ T975] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 62.500758][ T975] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 62.510503][ T975] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 62.521418][ T975] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe4578d7c0) = 8 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe4578e7d0) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe4578d7c0) = 8 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe4578e7d0) = 0 ioctl(3, USB_RAW_IOCTL_VBUS_DRAW, 0) = 0 ioctl(3, USB_RAW_IOCTL_CONFIGURE, 0) = 0 ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7fb7608963cc) = -1 EINVAL (Invalid argument) ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7fb7608963dc) = -1 EINVAL (Invalid argument) [ 62.607137][ T975] usb 1-1: New USB device found, idVendor=1949, idProduct=85a5, bcdDevice=a3.3a [ 62.616381][ T975] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 62.624449][ T975] usb 1-1: Product: syz [ 62.628624][ T975] usb 1-1: Manufacturer: syz [ 62.633237][ T975] usb 1-1: SerialNumber: syz [ 62.641862][ T975] usb 1-1: config 0 descriptor?? ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffe4578d7c0) = 0 [ 62.696806][ T975] ================================================================== [ 62.704887][ T975] BUG: KASAN: null-ptr-deref in input_ff_create+0x1aa/0x2f0 [ 62.712193][ T975] Write of size 8 at addr 0000000000000040 by task kworker/0:2/975 [ 62.720078][ T975] [ 62.722404][ T975] CPU: 0 UID: 0 PID: 975 Comm: kworker/0:2 Not tainted 6.13.0-rc3-next-20241220-syzkaller #0 [ 62.722421][ T975] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024 [ 62.722429][ T975] Workqueue: usb_hub_wq hub_event [ 62.722455][ T975] Call Trace: [ 62.722461][ T975] [ 62.722467][ T975] dump_stack_lvl+0x241/0x360 [ 62.722485][ T975] ? __pfx_dump_stack_lvl+0x10/0x10 [ 62.722499][ T975] ? __pfx__printk+0x10/0x10 [ 62.722514][ T975] ? _printk+0xd5/0x120 [ 62.722530][ T975] print_report+0xe8/0x550 [ 62.722546][ T975] ? __virt_addr_valid+0x58/0x530 [ 62.722561][ T975] ? input_ff_create+0x1aa/0x2f0 [ 62.722571][ T975] kasan_report+0x143/0x180 [ 62.722585][ T975] ? __pfx_lockdep_init_map_type+0x10/0x10 [ 62.722599][ T975] ? input_ff_create+0x1aa/0x2f0 [ 62.722610][ T975] kasan_check_range+0x282/0x290 [ 62.722624][ T975] input_ff_create+0x1aa/0x2f0 [ 62.722635][ T975] input_ff_create_memless+0x133/0x630 [ 62.722646][ T975] xpad_init_input+0xcef/0x1440 [ 62.722658][ T975] xpad_probe+0x1427/0x1b90 [ 62.722671][ T975] usb_probe_interface+0x641/0xbb0 [ 62.722685][ T975] ? __pfx_usb_probe_interface+0x10/0x10 [ 62.722694][ T975] really_probe+0x2b9/0xad0 [ 62.722711][ T975] __driver_probe_device+0x1a2/0x390 [ 62.722726][ T975] driver_probe_device+0x50/0x430 [ 62.722741][ T975] __device_attach_driver+0x2d6/0x530 [ 62.722756][ T975] bus_for_each_drv+0x24e/0x2e0 [ 62.722767][ T975] ? __pfx___device_attach_driver+0x10/0x10 [ 62.722782][ T975] ? __pfx_bus_for_each_drv+0x10/0x10 [ 62.722794][ T975] __device_attach+0x333/0x520 [ 62.722807][ T975] ? __pfx_lock_release+0x10/0x10 [ 62.722821][ T975] ? __pfx___device_attach+0x10/0x10 [ 62.722834][ T975] ? do_raw_spin_unlock+0x13c/0x8b0 [ 62.722847][ T975] bus_probe_device+0x189/0x260 [ 62.722858][ T975] device_add+0x856/0xbf0 [ 62.722873][ T975] usb_set_configuration+0x1976/0x1fb0 [ 62.722892][ T975] usb_generic_driver_probe+0x88/0x140 [ 62.722907][ T975] usb_probe_device+0x1b8/0x380 [ 62.722917][ T975] ? __pfx_usb_probe_device+0x10/0x10 [ 62.722926][ T975] really_probe+0x2b9/0xad0 [ 62.722942][ T975] __driver_probe_device+0x1a2/0x390 [ 62.722956][ T975] driver_probe_device+0x50/0x430 [ 62.722971][ T975] __device_attach_driver+0x2d6/0x530 [ 62.722986][ T975] bus_for_each_drv+0x24e/0x2e0 [ 62.722996][ T975] ? __pfx___device_attach_driver+0x10/0x10 [ 62.723011][ T975] ? __pfx_bus_for_each_drv+0x10/0x10 [ 62.723023][ T975] __device_attach+0x333/0x520 [ 62.723037][ T975] ? __pfx___device_attach+0x10/0x10 [ 62.723052][ T975] bus_probe_device+0x189/0x260 [ 62.723063][ T975] device_add+0x856/0xbf0 [ 62.723076][ T975] usb_new_device+0x104a/0x19a0 [ 62.723092][ T975] ? __pfx_usb_new_device+0x10/0x10 [ 62.723106][ T975] ? _raw_spin_unlock_irq+0x23/0x50 [ 62.723119][ T975] ? lockdep_hardirqs_on+0x99/0x150 [ 62.723133][ T975] hub_event+0x2d6d/0x5150 [ 62.723156][ T975] ? __pfx_hub_event+0x10/0x10 [ 62.723171][ T975] ? __pfx_lock_acquire+0x10/0x10 [ 62.723183][ T975] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 62.723197][ T975] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 62.723211][ T975] ? process_scheduled_works+0x976/0x1840 [ 62.723223][ T975] process_scheduled_works+0xa66/0x1840 [ 62.723246][ T975] ? __pfx_process_scheduled_works+0x10/0x10 [ 62.723258][ T975] ? assign_work+0x364/0x3d0 [ 62.723269][ T975] worker_thread+0x870/0xd30 [ 62.723282][ T975] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 62.723296][ T975] ? __kthread_parkme+0x169/0x1d0 [ 62.723308][ T975] ? __pfx_worker_thread+0x10/0x10 [ 62.723320][ T975] kthread+0x7a9/0x920 [ 62.723332][ T975] ? __pfx_kthread+0x10/0x10 [ 62.723345][ T975] ? __pfx_worker_thread+0x10/0x10 [ 62.723357][ T975] ? __pfx_kthread+0x10/0x10 [ 62.723369][ T975] ? __pfx_kthread+0x10/0x10 [ 62.723382][ T975] ? __pfx_kthread+0x10/0x10 exit_group(0) = ? [ 62.723395][ T975] ? _raw_spin_unlock_irq+0x23/0x50 [ 62.723407][ T975] ? lockdep_hardirqs_on+0x99/0x150 [ 62.723420][ T975] ? __pfx_kthread+0x10/0x10 [ 62.723433][ T975] ret_from_fork+0x4b/0x80 [ 62.723446][ T975] ? __pfx_kthread+0x10/0x10 [ 62.723459][ T975] ret_from_fork_asm+0x1a/0x30 [ 62.723473][ T975] [ 62.723477][ T975] ================================================================== [ 63.137266][ T975] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 63.144575][ T975] CPU: 0 UID: 0 PID: 975 Comm: kworker/0:2 Not tainted 6.13.0-rc3-next-20241220-syzkaller #0 [ 63.154746][ T975] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024 [ 63.164799][ T975] Workqueue: usb_hub_wq hub_event [ 63.169828][ T975] Call Trace: [ 63.173095][ T975] [ 63.176021][ T975] dump_stack_lvl+0x241/0x360 [ 63.180783][ T975] ? __pfx_dump_stack_lvl+0x10/0x10 [ 63.186004][ T975] ? __pfx__printk+0x10/0x10 [ 63.190600][ T975] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 63.196582][ T975] ? vscnprintf+0x5d/0x90 [ 63.200905][ T975] panic+0x349/0x880 [ 63.204797][ T975] ? check_panic_on_warn+0x21/0xb0 [ 63.209900][ T975] ? __pfx_panic+0x10/0x10 [ 63.214317][ T975] ? _raw_spin_unlock_irqrestore+0x130/0x140 [ 63.220290][ T975] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 63.226624][ T975] ? print_report+0xe8/0x550 [ 63.231235][ T975] check_panic_on_warn+0x86/0xb0 [ 63.236178][ T975] ? input_ff_create+0x1aa/0x2f0 [ 63.241115][ T975] end_report+0x77/0x160 [ 63.245354][ T975] kasan_report+0x154/0x180 [ 63.249936][ T975] ? __pfx_lockdep_init_map_type+0x10/0x10 [ 63.255740][ T975] ? input_ff_create+0x1aa/0x2f0 [ 63.261016][ T975] kasan_check_range+0x282/0x290 [ 63.265958][ T975] input_ff_create+0x1aa/0x2f0 [ 63.270713][ T975] input_ff_create_memless+0x133/0x630 [ 63.276160][ T975] xpad_init_input+0xcef/0x1440 [ 63.281004][ T975] xpad_probe+0x1427/0x1b90 [ 63.285499][ T975] usb_probe_interface+0x641/0xbb0 [ 63.290602][ T975] ? __pfx_usb_probe_interface+0x10/0x10 [ 63.296226][ T975] really_probe+0x2b9/0xad0 [ 63.300730][ T975] __driver_probe_device+0x1a2/0x390 [ 63.306008][ T975] driver_probe_device+0x50/0x430 [ 63.311034][ T975] __device_attach_driver+0x2d6/0x530 [ 63.316398][ T975] bus_for_each_drv+0x24e/0x2e0 [ 63.321243][ T975] ? __pfx___device_attach_driver+0x10/0x10 [ 63.327131][ T975] ? __pfx_bus_for_each_drv+0x10/0x10 [ 63.332492][ T975] __device_attach+0x333/0x520 [ 63.337254][ T975] ? __pfx_lock_release+0x10/0x10 [ 63.342269][ T975] ? __pfx___device_attach+0x10/0x10 [ 63.347546][ T975] ? do_raw_spin_unlock+0x13c/0x8b0 [ 63.352736][ T975] bus_probe_device+0x189/0x260 [ 63.357578][ T975] device_add+0x856/0xbf0 [ 63.361902][ T975] usb_set_configuration+0x1976/0x1fb0 [ 63.367362][ T975] usb_generic_driver_probe+0x88/0x140 [ 63.372811][ T975] usb_probe_device+0x1b8/0x380 [ 63.377659][ T975] ? __pfx_usb_probe_device+0x10/0x10 [ 63.383020][ T975] really_probe+0x2b9/0xad0 [ 63.387521][ T975] __driver_probe_device+0x1a2/0x390 [ 63.392801][ T975] driver_probe_device+0x50/0x430 [ 63.397917][ T975] __device_attach_driver+0x2d6/0x530 [ 63.403370][ T975] bus_for_each_drv+0x24e/0x2e0 [ 63.408214][ T975] ? __pfx___device_attach_driver+0x10/0x10 [ 63.414101][ T975] ? __pfx_bus_for_each_drv+0x10/0x10 [ 63.419465][ T975] __device_attach+0x333/0x520 [ 63.424223][ T975] ? __pfx___device_attach+0x10/0x10 [ 63.429503][ T975] bus_probe_device+0x189/0x260 [ 63.434344][ T975] device_add+0x856/0xbf0 [ 63.438668][ T975] usb_new_device+0x104a/0x19a0 [ 63.443518][ T975] ? __pfx_usb_new_device+0x10/0x10 [ 63.448814][ T975] ? _raw_spin_unlock_irq+0x23/0x50 [ 63.454014][ T975] ? lockdep_hardirqs_on+0x99/0x150 [ 63.459224][ T975] hub_event+0x2d6d/0x5150 [ 63.463650][ T975] ? __pfx_hub_event+0x10/0x10 [ 63.468419][ T975] ? __pfx_lock_acquire+0x10/0x10 [ 63.473440][ T975] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 63.479419][ T975] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 63.485743][ T975] ? process_scheduled_works+0x976/0x1840 [ 63.491453][ T975] process_scheduled_works+0xa66/0x1840 [ 63.496998][ T975] ? __pfx_process_scheduled_works+0x10/0x10 [ 63.502971][ T975] ? assign_work+0x364/0x3d0 [ 63.507553][ T975] worker_thread+0x870/0xd30 [ 63.512137][ T975] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 63.518030][ T975] ? __kthread_parkme+0x169/0x1d0 [ 63.523175][ T975] ? __pfx_worker_thread+0x10/0x10 [ 63.528276][ T975] kthread+0x7a9/0x920 [ 63.532347][ T975] ? __pfx_kthread+0x10/0x10 [ 63.536939][ T975] ? __pfx_worker_thread+0x10/0x10 [ 63.542043][ T975] ? __pfx_kthread+0x10/0x10 [ 63.546624][ T975] ? __pfx_kthread+0x10/0x10 [ 63.551215][ T975] ? __pfx_kthread+0x10/0x10 [ 63.555798][ T975] ? _raw_spin_unlock_irq+0x23/0x50 [ 63.560998][ T975] ? lockdep_hardirqs_on+0x99/0x150 [ 63.566191][ T975] ? __pfx_kthread+0x10/0x10 [ 63.570809][ T975] ret_from_fork+0x4b/0x80 [ 63.575324][ T975] ? __pfx_kthread+0x10/0x10 [ 63.579934][ T975] ret_from_fork_asm+0x1a/0x30 [ 63.584735][ T975] [ 63.588022][ T975] Kernel Offset: disabled [ 63.592347][ T975] Rebooting in 86400 seconds..