INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.164' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 26.271121][ T12] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 26.511090][ T12] usb 1-1: Using ep0 maxpacket: 8 [ 26.631222][ T12] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 26.642339][ T12] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 26.655602][ T12] usb 1-1: New USB device found, idVendor=046d, idProduct=ca04, bcdDevice= 0.00 [ 26.664667][ T12] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.674008][ T12] usb 1-1: config 0 descriptor?? [ 27.152868][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.160110][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.167389][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.174579][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.181822][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.188964][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.196153][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.203342][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.210514][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.217708][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.224925][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.232116][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.239301][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.246538][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.253730][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.260863][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.268056][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.275233][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.282450][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.289689][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.297040][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.304209][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.311504][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.318638][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.325827][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.333144][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.340268][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 executing program [ 27.347570][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.354780][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.361988][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.369281][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.376542][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.383929][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.391143][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.398378][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.405604][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.412830][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.419961][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.427259][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.434447][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.441635][ T12] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 27.450405][ T12] logitech 0003:046D:CA04.0001: hidraw0: USB HID v0.00 Device [HID 046d:ca04] on usb-dummy_hcd.0-1/input0 [ 27.461922][ T12] logitech 0003:046D:CA04.0001: not enough fields in HID_OUTPUT_REPORT 0 [ 27.472282][ T12] usb 1-1: USB disconnect, device number 2 [ 27.831164][ T12] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 28.071077][ T12] usb 1-1: Using ep0 maxpacket: 8 [ 28.191182][ T12] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 28.202242][ T12] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 28.215339][ T12] usb 1-1: New USB device found, idVendor=046d, idProduct=ca04, bcdDevice= 0.00 [ 28.224413][ T12] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.233572][ T12] usb 1-1: config 0 descriptor?? [ 28.702207][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.709376][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.716560][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.723929][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.731122][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.738338][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.745581][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.752738][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.759884][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.767266][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.774478][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.781700][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.788938][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.796191][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.803388][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.810594][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.817955][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.825216][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.832469][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.839670][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.846992][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.854239][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.861463][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.868740][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.876003][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.883282][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.890421][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.897755][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.901361][ T1727] ================================================================== [ 28.904976][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.921970][ T1727] BUG: KASAN: use-after-free in usbhid_power+0xca/0xe0 [ 28.921979][ T1727] Read of size 8 at addr ffff8881d5d24008 by task syz-executor509/1727 [ 28.921981][ T1727] [ 28.921990][ T1727] CPU: 1 PID: 1727 Comm: syz-executor509 Not tainted 5.3.0-rc4+ #26 [ 28.921995][ T1727] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 28.921997][ T1727] Call Trace: [ 28.922010][ T1727] dump_stack+0xca/0x13e [ 28.922017][ T1727] ? usbhid_power+0xca/0xe0 [ 28.922023][ T1727] ? usbhid_power+0xca/0xe0 [ 28.922033][ T1727] print_address_description+0x6a/0x32c [ 28.922040][ T1727] ? usbhid_power+0xca/0xe0 [ 28.922046][ T1727] ? usbhid_power+0xca/0xe0 [ 28.922052][ T1727] __kasan_report.cold+0x1a/0x33 [ 28.922059][ T1727] ? usbhid_power+0xca/0xe0 [ 28.922077][ T1727] kasan_report+0xe/0x12 [ 28.929235][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.936171][ T1727] usbhid_power+0xca/0xe0 [ 28.936181][ T1727] hidraw_open+0x20d/0x740 [ 28.936188][ T1727] ? usbhid_output_report+0x290/0x290 [ 28.936193][ T1727] ? hidraw_ioctl+0xae0/0xae0 [ 28.936202][ T1727] chrdev_open+0x219/0x5c0 [ 28.936209][ T1727] ? cdev_put.part.0+0x50/0x50 [ 28.936218][ T1727] do_dentry_open+0x494/0x1120 [ 28.936225][ T1727] ? cdev_put.part.0+0x50/0x50 [ 28.936249][ T1727] ? chmod_common+0x3c0/0x3c0 [ 28.936268][ T1727] ? inode_permission+0xbe/0x3a0 [ 28.944679][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.946903][ T1727] path_openat+0x1430/0x3f50 [ 28.955066][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.964996][ T1727] ? save_stack+0x1b/0x80 [ 28.965006][ T1727] ? do_sys_open+0x294/0x580 [ 28.965014][ T1727] ? do_syscall_64+0xb7/0x580 [ 28.965024][ T1727] ? path_lookupat.isra.0+0x8d0/0x8d0 [ 28.965032][ T1727] ? __lock_acquire+0x145e/0x3b50 [ 28.965039][ T1727] do_filp_open+0x1a1/0x280 [ 28.965046][ T1727] ? may_open_dev+0xf0/0xf0 [ 28.965052][ T1727] ? __alloc_fd+0x46d/0x600 [ 28.965059][ T1727] ? do_raw_spin_lock+0x11a/0x280 [ 28.965066][ T1727] ? do_raw_spin_unlock+0x50/0x220 [ 28.965086][ T1727] ? _raw_spin_unlock+0x1f/0x30 [ 28.968395][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.972578][ T1727] ? __alloc_fd+0x46d/0x600 [ 28.972587][ T1727] do_sys_open+0x3c0/0x580 [ 28.972595][ T1727] ? filp_open+0x70/0x70 [ 28.972603][ T1727] ? trace_hardirqs_off_caller+0x55/0x1e0 [ 28.972610][ T1727] do_syscall_64+0xb7/0x580 [ 28.972619][ T1727] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 28.972626][ T1727] RIP: 0033:0x4019b0 [ 28.972643][ T1727] Code: 01 f0 ff ff 0f 83 c0 0b 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 83 3d 1d 5d 2d 00 00 75 14 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 94 0b 00 00 c3 48 83 ec 08 e8 fa 00 00 00 [ 28.977165][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.981606][ T1727] RSP: 002b:00007ffea212ca58 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 28.981615][ T1727] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004019b0 [ 28.981619][ T1727] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 00007ffea212ca60 [ 28.981623][ T1727] RBP: 6666666666666667 R08: 000000000000000f R09: 0000000000000000 [ 28.981627][ T1727] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004029d0 [ 28.981631][ T1727] R13: 0000000000402a60 R14: 0000000000000000 R15: 0000000000000000 [ 28.981634][ T1727] [ 28.981639][ T1727] Allocated by task 1704: [ 28.981650][ T1727] save_stack+0x1b/0x80 [ 28.981657][ T1727] __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 28.981663][ T1727] __kmalloc_node_track_caller+0xfc/0x380 [ 28.981679][ T1727] __kmalloc_reserve.isra.0+0x39/0xe0 [ 28.987244][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 28.991692][ T1727] __alloc_skb+0xef/0x5a0 [ 28.991702][ T1727] netlink_sendmsg+0x8cd/0xcc0 [ 28.991709][ T1727] sock_sendmsg+0xcf/0x120 [ 28.991722][ T1727] ___sys_sendmsg+0x803/0x920 [ 28.991728][ T1727] __sys_sendmsg+0xec/0x1b0 [ 28.991736][ T1727] do_syscall_64+0xb7/0x580 [ 28.991745][ T1727] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 28.991747][ T1727] [ 28.991750][ T1727] Freed by task 1704: [ 28.991765][ T1727] save_stack+0x1b/0x80 [ 28.996300][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 29.001189][ T1727] __kasan_slab_free+0x130/0x180 [ 29.001196][ T1727] kfree+0xe4/0x2f0 [ 29.001203][ T1727] skb_free_head+0x8b/0xa0 [ 29.001210][ T1727] skb_release_data+0x41f/0x7c0 [ 29.001216][ T1727] skb_release_all+0x46/0x60 [ 29.001222][ T1727] consume_skb+0xd9/0x320 [ 29.001229][ T1727] netlink_unicast+0x4d7/0x690 [ 29.001235][ T1727] netlink_sendmsg+0x802/0xcc0 [ 29.001241][ T1727] sock_sendmsg+0xcf/0x120 [ 29.001247][ T1727] ___sys_sendmsg+0x803/0x920 [ 29.001262][ T1727] __sys_sendmsg+0xec/0x1b0 [ 29.005909][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 29.010096][ T1727] do_syscall_64+0xb7/0x580 [ 29.010115][ T1727] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 29.017326][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 29.021572][ T1727] [ 29.021581][ T1727] The buggy address belongs to the object at ffff8881d5d24000 [ 29.021581][ T1727] which belongs to the cache kmalloc-1k of size 1024 [ 29.021596][ T1727] The buggy address is located 8 bytes inside of [ 29.021596][ T1727] 1024-byte region [ffff8881d5d24000, ffff8881d5d24400) [ 29.026103][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 29.031519][ T1727] The buggy address belongs to the page: [ 29.031531][ T1727] page:ffffea0007574900 refcount:1 mapcount:0 mapping:ffff8881da002280 index:0x0 compound_mapcount: 0 [ 29.031540][ T1727] flags: 0x200000000010200(slab|head) [ 29.031551][ T1727] raw: 0200000000010200 dead000000000100 dead000000000122 ffff8881da002280 [ 29.031558][ T1727] raw: 0000000000000000 00000000000e000e 00000001ffffffff 0000000000000000 [ 29.031561][ T1727] page dumped because: kasan: bad access detected [ 29.031563][ T1727] [ 29.031565][ T1727] Memory state around the buggy address: [ 29.031571][ T1727] ffff8881d5d23f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.031576][ T1727] ffff8881d5d23f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.031581][ T1727] >ffff8881d5d24000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.031584][ T1727] ^ [ 29.031589][ T1727] ffff8881d5d24080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.031594][ T1727] ffff8881d5d24100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.031607][ T1727] ================================================================== [ 29.036335][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 29.040814][ T1727] Disabling lock debugging due to kernel taint [ 29.040918][ T1727] Kernel panic - not syncing: panic_on_warn set ... [ 29.045699][ T12] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 29.050355][ T1727] CPU: 1 PID: 1727 Comm: syz-executor509 Tainted: G B 5.3.0-rc4+ #26 [ 29.050370][ T1727] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 29.601308][ T1727] Call Trace: [ 29.604604][ T1727] dump_stack+0xca/0x13e [ 29.608853][ T1727] panic+0x2a3/0x6da [ 29.612742][ T1727] ? add_taint.cold+0x16/0x16 [ 29.617412][ T1727] ? retint_kernel+0x10/0x10 [ 29.622014][ T1727] ? trace_hardirqs_on+0x55/0x1e0 [ 29.627039][ T1727] ? usbhid_power+0xca/0xe0 [ 29.631529][ T1727] end_report+0x43/0x49 [ 29.635676][ T1727] ? usbhid_power+0xca/0xe0 [ 29.640170][ T1727] __kasan_report.cold+0xd/0x33 [ 29.645009][ T1727] ? usbhid_power+0xca/0xe0 [ 29.649499][ T1727] kasan_report+0xe/0x12 [ 29.653841][ T1727] usbhid_power+0xca/0xe0 [ 29.658168][ T1727] hidraw_open+0x20d/0x740 [ 29.662580][ T1727] ? usbhid_output_report+0x290/0x290 [ 29.667932][ T1727] ? hidraw_ioctl+0xae0/0xae0 [ 29.672706][ T1727] chrdev_open+0x219/0x5c0 [ 29.677108][ T1727] ? cdev_put.part.0+0x50/0x50 [ 29.681859][ T1727] do_dentry_open+0x494/0x1120 [ 29.686618][ T1727] ? cdev_put.part.0+0x50/0x50 [ 29.691368][ T1727] ? chmod_common+0x3c0/0x3c0 [ 29.696069][ T1727] ? inode_permission+0xbe/0x3a0 [ 29.701005][ T1727] path_openat+0x1430/0x3f50 [ 29.705688][ T1727] ? save_stack+0x1b/0x80 [ 29.710002][ T1727] ? do_sys_open+0x294/0x580 [ 29.714702][ T1727] ? do_syscall_64+0xb7/0x580 [ 29.719363][ T1727] ? path_lookupat.isra.0+0x8d0/0x8d0 [ 29.724882][ T1727] ? __lock_acquire+0x145e/0x3b50 [ 29.730045][ T1727] do_filp_open+0x1a1/0x280 [ 29.734539][ T1727] ? may_open_dev+0xf0/0xf0 [ 29.739106][ T1727] ? __alloc_fd+0x46d/0x600 [ 29.743648][ T1727] ? do_raw_spin_lock+0x11a/0x280 [ 29.748663][ T1727] ? do_raw_spin_unlock+0x50/0x220 [ 29.753768][ T1727] ? _raw_spin_unlock+0x1f/0x30 [ 29.758602][ T1727] ? __alloc_fd+0x46d/0x600 [ 29.763101][ T1727] do_sys_open+0x3c0/0x580 [ 29.767509][ T1727] ? filp_open+0x70/0x70 [ 29.771744][ T1727] ? trace_hardirqs_off_caller+0x55/0x1e0 [ 29.777448][ T1727] do_syscall_64+0xb7/0x580 [ 29.781939][ T1727] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 29.787938][ T1727] RIP: 0033:0x4019b0 [ 29.791815][ T1727] Code: 01 f0 ff ff 0f 83 c0 0b 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 83 3d 1d 5d 2d 00 00 75 14 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 94 0b 00 00 c3 48 83 ec 08 e8 fa 00 00 00 [ 29.811501][ T1727] RSP: 002b:00007ffea212ca58 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 29.819917][ T1727] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004019b0 [ 29.827890][ T1727] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 00007ffea212ca60 [ 29.835974][ T1727] RBP: 6666666666666667 R08: 000000000000000f R09: 0000000000000000 [ 29.843945][ T1727] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004029d0 [ 29.851909][ T1727] R13: 0000000000402a60 R14: 0000000000000000 R15: 0000000000000000 [ 29.860246][ T1727] Kernel Offset: disabled [ 29.864674][ T1727] Rebooting in 86400 seconds..