Warning: Permanently added '10.128.0.51' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 29.674104][ T12] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 29.914053][ T12] usb 1-1: Using ep0 maxpacket: 8 [ 30.034159][ T12] usb 1-1: config 0 has an invalid interface number: 61 but max is 0 [ 30.042527][ T12] usb 1-1: config 0 has an invalid descriptor of length 194, skipping remainder of the config [ 30.053007][ T12] usb 1-1: config 0 has no interface number 0 [ 30.059138][ T12] usb 1-1: config 0 interface 61 has no altsetting 0 [ 30.065890][ T12] usb 1-1: New USB device found, idVendor=9022, idProduct=d632, bcdDevice=60.8e [ 30.075152][ T12] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.084686][ T12] usb 1-1: config 0 descriptor?? executing program [ 30.364252][ T12] usb 1-1: string descriptor 0 read error: -71 [ 30.372393][ T12] dw2102: su3000_identify_state [ 30.377477][ T12] dvb-usb: found a 'TeVii S632 USB' in warm state. [ 30.384067][ T12] dw2102: su3000_power_ctrl: 1, initialized 0 [ 30.390393][ T12] dvb-usb: bulk message failed: -22 (2/256) [ 30.398025][ T12] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 30.424438][ T12] dvbdev: DVB: registering new adapter (TeVii S632 USB) [ 30.431570][ T12] usb 1-1: media controller created [ 30.437140][ T12] dvb-usb: bulk message failed: -22 (6/-2035936744) [ 30.443818][ T12] dw2102: i2c transfer failed. [ 30.448809][ T12] dvb-usb: bulk message failed: -22 (6/-2035936744) [ 30.455473][ T12] dw2102: i2c transfer failed. [ 30.460260][ T12] dvb-usb: bulk message failed: -22 (6/-2035936744) [ 30.466916][ T12] dw2102: i2c transfer failed. [ 30.471853][ T12] dvb-usb: bulk message failed: -22 (6/-2035936744) [ 30.478553][ T12] dw2102: i2c transfer failed. [ 30.483341][ T12] dvb-usb: bulk message failed: -22 (6/-2035936744) [ 30.490097][ T12] dw2102: i2c transfer failed. [ 30.495043][ T12] dvb-usb: bulk message failed: -22 (6/-2035936744) [ 30.501634][ T12] dw2102: i2c transfer failed. [ 30.506460][ T12] dvb-usb: MAC address: 02:02:02:02:02:02 [ 30.517151][ T12] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 30.532290][ T12] dvb-usb: bulk message failed: -22 (1/0) [ 30.538199][ T12] dw2102: command 0x51 transfer failed. [ 30.545389][ T12] dvb-usb: bulk message failed: -22 (5/-2035936744) [ 30.552107][ T12] dw2102: i2c transfer failed. [ 30.557088][ T12] dvb-usb: bulk message failed: -22 (5/-2035936744) [ 30.563833][ T12] dw2102: i2c transfer failed. [ 30.568695][ T12] dvb-usb: bulk message failed: -22 (5/-2035936744) [ 30.575408][ T12] dw2102: i2c transfer failed. [ 30.580313][ T12] dvb-usb: bulk message failed: -22 (5/-2035936744) [ 30.586965][ T12] dw2102: i2c transfer failed. [ 30.591766][ T12] dvb-usb: bulk message failed: -22 (5/-2035936744) [ 30.598990][ T12] dw2102: i2c transfer failed. [ 30.604977][ T12] dvb-usb: bulk message failed: -22 (5/-2035936744) [ 30.612925][ T12] dw2102: i2c transfer failed. [ 30.669641][ T12] dvb-usb: bulk message failed: -22 (5/-2035936744) [ 30.676570][ T12] dw2102: i2c transfer failed. [ 30.681517][ T12] dvb-usb: bulk message failed: -22 (5/-2035936744) [ 30.688396][ T12] dw2102: i2c transfer failed. [ 30.693354][ T12] dvb-usb: bulk message failed: -22 (5/-2035936744) [ 30.699981][ T12] dw2102: i2c transfer failed. [ 30.704794][ T12] dvb-usb: bulk message failed: -22 (5/-2035936744) [ 30.711436][ T12] dw2102: i2c transfer failed. [ 30.716529][ T12] dvb-usb: bulk message failed: -22 (5/-2035936744) [ 30.723219][ T12] dw2102: i2c transfer failed. [ 30.728060][ T12] dvb-usb: bulk message failed: -22 (5/-2035936744) [ 30.734683][ T12] dw2102: i2c transfer failed. [ 30.739463][ T12] ts2020 0-0060: Montage Technology TS2020 successfully identified [ 30.748658][ T12] dw2102: Attached RS2000/TS2020! [ 30.753904][ T12] usb 1-1: DVB: registering adapter 0 frontend 0 (M88RS2000 DVB-S)... [ 30.762542][ T12] dvbdev: dvb_create_media_entity: media entity 'M88RS2000 DVB-S' registered. [ 30.824367][ T12] Registered IR keymap rc-su3000 [ 30.830080][ T12] rc rc0: TeVii S632 USB as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 30.839462][ T12] input: TeVii S632 USB as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input5 [ 30.850106][ T12] dvb-usb: schedule remote query interval to 150 msecs. [ 30.857168][ T12] dw2102: su3000_power_ctrl: 0, initialized 1 [ 30.863244][ T12] dvb-usb: TeVii S632 USB successfully initialized and connected. [ 30.873506][ T12] usb 1-1: USB disconnect, device number 2 [ 30.880335][ T12] ================================================================== [ 30.888646][ T12] BUG: KASAN: use-after-free in dvb_usb_device_exit+0x19a/0x1a0 [ 30.896269][ T12] Read of size 8 at addr ffff8881cf4343e0 by task kworker/0:1/12 [ 30.904086][ T12] [ 30.906405][ T12] CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.5.0-rc1-syzkaller #0 [ 30.914987][ T12] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 30.925317][ T12] Workqueue: usb_hub_wq hub_event [ 30.930351][ T12] Call Trace: [ 30.933649][ T12] dump_stack+0xef/0x16e [ 30.937881][ T12] ? dvb_usb_device_exit+0x19a/0x1a0 [ 30.943159][ T12] ? dvb_usb_device_exit+0x19a/0x1a0 [ 30.949389][ T12] print_address_description.constprop.0+0x16/0x200 [ 30.955988][ T12] ? dvb_usb_device_exit+0x19a/0x1a0 [ 30.961263][ T12] ? dvb_usb_device_exit+0x19a/0x1a0 [ 30.966549][ T12] __kasan_report.cold+0x37/0x7f [ 30.971480][ T12] ? dvb_usb_device_exit+0x19a/0x1a0 [ 30.977451][ T12] kasan_report+0xe/0x20 [ 30.981696][ T12] dvb_usb_device_exit+0x19a/0x1a0 [ 30.986794][ T12] ? dvb_usb_exit+0x290/0x290 [ 30.991460][ T12] ? mark_held_locks+0x9f/0xe0 [ 30.996215][ T12] ? _raw_spin_unlock_irqrestore+0x39/0x40 [ 31.002010][ T12] ? lockdep_hardirqs_on+0x382/0x580 [ 31.007288][ T12] ? usb_disable_interface+0x7b/0x1a0 [ 31.012989][ T12] ? __pm_runtime_resume+0x111/0x180 [ 31.018298][ T12] usb_unbind_interface+0x1bd/0x8a0 [ 31.023631][ T12] ? usb_autoresume_device+0x60/0x60 [ 31.028913][ T12] device_release_driver_internal+0x42f/0x500 [ 31.035418][ T12] bus_remove_device+0x2dc/0x4a0 [ 31.042033][ T12] device_del+0x481/0xd30 [ 31.046387][ T12] ? device_create_with_groups+0x120/0x120 [ 31.052187][ T12] ? lockdep_hardirqs_on+0x382/0x580 [ 31.057554][ T12] ? remove_intf_ep_devs+0x13f/0x1d0 [ 31.062942][ T12] usb_disable_device+0x211/0x690 [ 31.067984][ T12] usb_disconnect+0x284/0x8d0 [ 31.073283][ T12] hub_event+0x1753/0x3860 [ 31.077774][ T12] ? hub_port_debounce+0x260/0x260 [ 31.083018][ T12] ? find_held_lock+0x2d/0x110 [ 31.088662][ T12] ? mark_held_locks+0xe0/0xe0 [ 31.093419][ T12] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 31.098969][ T12] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 31.104367][ T12] process_one_work+0x92b/0x1530 [ 31.109422][ T12] ? pwq_dec_nr_in_flight+0x310/0x310 [ 31.114805][ T12] ? do_raw_spin_lock+0x11a/0x280 [ 31.119857][ T12] worker_thread+0x7ab/0xe20 [ 31.124454][ T12] ? process_one_work+0x1530/0x1530 [ 31.136677][ T12] kthread+0x318/0x420 [ 31.140766][ T12] ? kthread_create_on_node+0xf0/0xf0 [ 31.147067][ T12] ret_from_fork+0x24/0x30 [ 31.151475][ T12] [ 31.153804][ T12] Allocated by task 12: [ 31.157960][ T12] save_stack+0x1b/0x80 [ 31.162175][ T12] __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 31.168881][ T12] __kmalloc_track_caller+0xf0/0x310 [ 31.174326][ T12] kmemdup+0x23/0x50 [ 31.178220][ T12] dw2102_probe+0x627/0xc40 [ 31.182714][ T12] usb_probe_interface+0x305/0x7a0 [ 31.187938][ T12] really_probe+0x281/0x6d0 [ 31.192467][ T12] driver_probe_device+0x104/0x210 [ 31.197573][ T12] __device_attach_driver+0x1c2/0x220 [ 31.202956][ T12] bus_for_each_drv+0x162/0x1e0 [ 31.207813][ T12] __device_attach+0x217/0x360 [ 31.212585][ T12] bus_probe_device+0x1e4/0x290 [ 31.217427][ T12] device_add+0x1480/0x1c20 [ 31.221914][ T12] usb_set_configuration+0xe67/0x1740 [ 31.228760][ T12] generic_probe+0x9d/0xd5 [ 31.233187][ T12] usb_probe_device+0x99/0x100 [ 31.238041][ T12] really_probe+0x281/0x6d0 [ 31.243249][ T12] driver_probe_device+0x104/0x210 [ 31.248345][ T12] __device_attach_driver+0x1c2/0x220 [ 31.253726][ T12] bus_for_each_drv+0x162/0x1e0 [ 31.258563][ T12] __device_attach+0x217/0x360 [ 31.263326][ T12] bus_probe_device+0x1e4/0x290 [ 31.268161][ T12] device_add+0x1480/0x1c20 [ 31.272650][ T12] usb_new_device.cold+0x6a4/0xe79 [ 31.277884][ T12] hub_event+0x1e59/0x3860 [ 31.282386][ T12] process_one_work+0x92b/0x1530 [ 31.287631][ T12] worker_thread+0x96/0xe20 [ 31.292242][ T12] kthread+0x318/0x420 [ 31.296301][ T12] ret_from_fork+0x24/0x30 [ 31.300720][ T12] [ 31.303030][ T12] Freed by task 12: [ 31.306822][ T12] save_stack+0x1b/0x80 [ 31.310959][ T12] __kasan_slab_free+0x129/0x170 [ 31.316351][ T12] kfree+0xda/0x310 [ 31.320145][ T12] dw2102_probe+0x871/0xc40 [ 31.324652][ T12] usb_probe_interface+0x305/0x7a0 [ 31.329881][ T12] really_probe+0x281/0x6d0 [ 31.334378][ T12] driver_probe_device+0x104/0x210 [ 31.339493][ T12] __device_attach_driver+0x1c2/0x220 [ 31.344882][ T12] bus_for_each_drv+0x162/0x1e0 [ 31.349720][ T12] __device_attach+0x217/0x360 [ 31.354468][ T12] bus_probe_device+0x1e4/0x290 [ 31.359369][ T12] device_add+0x1480/0x1c20 [ 31.364037][ T12] usb_set_configuration+0xe67/0x1740 [ 31.370370][ T12] generic_probe+0x9d/0xd5 [ 31.374820][ T12] usb_probe_device+0x99/0x100 [ 31.379762][ T12] really_probe+0x281/0x6d0 [ 31.384263][ T12] driver_probe_device+0x104/0x210 [ 31.389366][ T12] __device_attach_driver+0x1c2/0x220 [ 31.395093][ T12] bus_for_each_drv+0x162/0x1e0 [ 31.399935][ T12] __device_attach+0x217/0x360 [ 31.404710][ T12] bus_probe_device+0x1e4/0x290 [ 31.409544][ T12] device_add+0x1480/0x1c20 [ 31.414037][ T12] usb_new_device.cold+0x6a4/0xe79 [ 31.419140][ T12] hub_event+0x1e59/0x3860 [ 31.423547][ T12] process_one_work+0x92b/0x1530 [ 31.428476][ T12] worker_thread+0x96/0xe20 [ 31.432966][ T12] kthread+0x318/0x420 [ 31.437025][ T12] ret_from_fork+0x24/0x30 [ 31.441421][ T12] [ 31.443749][ T12] The buggy address belongs to the object at ffff8881cf434000 [ 31.443749][ T12] which belongs to the cache kmalloc-4k of size 4096 [ 31.457803][ T12] The buggy address is located 992 bytes inside of [ 31.457803][ T12] 4096-byte region [ffff8881cf434000, ffff8881cf435000) [ 31.471282][ T12] The buggy address belongs to the page: [ 31.477029][ T12] page:ffffea00073d0c00 refcount:1 mapcount:0 mapping:ffff8881da00c280 index:0x0 compound_mapcount: 0 [ 31.488274][ T12] raw: 0200000000010200 dead000000000100 dead000000000122 ffff8881da00c280 [ 31.497109][ T12] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [ 31.505783][ T12] page dumped because: kasan: bad access detected [ 31.512202][ T12] [ 31.514755][ T12] Memory state around the buggy address: [ 31.522072][ T12] ffff8881cf434280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.530137][ T12] ffff8881cf434300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.538197][ T12] >ffff8881cf434380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.546246][ T12] ^ [ 31.553541][ T12] ffff8881cf434400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.561614][ T12] ffff8881cf434480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.569815][ T12] ================================================================== [ 31.577872][ T12] Disabling lock debugging due to kernel taint [ 31.584360][ T12] Kernel panic - not syncing: panic_on_warn set ... [ 31.590970][ T12] CPU: 0 PID: 12 Comm: kworker/0:1 Tainted: G B 5.5.0-rc1-syzkaller #0 [ 31.600508][ T12] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 31.610718][ T12] Workqueue: usb_hub_wq hub_event [ 31.615723][ T12] Call Trace: [ 31.619009][ T12] dump_stack+0xef/0x16e [ 31.623950][ T12] panic+0x2aa/0x6e1 [ 31.627852][ T12] ? add_taint.cold+0x16/0x16 [ 31.632698][ T12] ? retint_kernel+0x10/0x10 [ 31.637272][ T12] ? trace_hardirqs_on+0x55/0x1e0 [ 31.642318][ T12] ? dvb_usb_device_exit+0x19a/0x1a0 [ 31.647619][ T12] end_report+0x43/0x49 [ 31.651778][ T12] ? dvb_usb_device_exit+0x19a/0x1a0 [ 31.657148][ T12] __kasan_report.cold+0x55/0x7f [ 31.662069][ T12] ? dvb_usb_device_exit+0x19a/0x1a0 [ 31.667353][ T12] kasan_report+0xe/0x20 [ 31.671602][ T12] dvb_usb_device_exit+0x19a/0x1a0 [ 31.676818][ T12] ? dvb_usb_exit+0x290/0x290 [ 31.681580][ T12] ? mark_held_locks+0x9f/0xe0 [ 31.687224][ T12] ? _raw_spin_unlock_irqrestore+0x39/0x40 [ 31.693019][ T12] ? lockdep_hardirqs_on+0x382/0x580 [ 31.698287][ T12] ? usb_disable_interface+0x7b/0x1a0 [ 31.703844][ T12] ? __pm_runtime_resume+0x111/0x180 [ 31.709128][ T12] usb_unbind_interface+0x1bd/0x8a0 [ 31.714439][ T12] ? usb_autoresume_device+0x60/0x60 [ 31.719850][ T12] device_release_driver_internal+0x42f/0x500 [ 31.725925][ T12] bus_remove_device+0x2dc/0x4a0 [ 31.730866][ T12] device_del+0x481/0xd30 [ 31.735196][ T12] ? device_create_with_groups+0x120/0x120 [ 31.740994][ T12] ? lockdep_hardirqs_on+0x382/0x580 [ 31.746283][ T12] ? remove_intf_ep_devs+0x13f/0x1d0 [ 31.751548][ T12] usb_disable_device+0x211/0x690 [ 31.756561][ T12] usb_disconnect+0x284/0x8d0 [ 31.761223][ T12] hub_event+0x1753/0x3860 [ 31.765720][ T12] ? hub_port_debounce+0x260/0x260 [ 31.771171][ T12] ? find_held_lock+0x2d/0x110 [ 31.775936][ T12] ? mark_held_locks+0xe0/0xe0 [ 31.781242][ T12] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 31.786887][ T12] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 31.792681][ T12] process_one_work+0x92b/0x1530 [ 31.797605][ T12] ? pwq_dec_nr_in_flight+0x310/0x310 [ 31.803829][ T12] ? do_raw_spin_lock+0x11a/0x280 [ 31.808843][ T12] worker_thread+0x7ab/0xe20 [ 31.813415][ T12] ? process_one_work+0x1530/0x1530 [ 31.818614][ T12] kthread+0x318/0x420 [ 31.822682][ T12] ? kthread_create_on_node+0xf0/0xf0 [ 31.828037][ T12] ret_from_fork+0x24/0x30 [ 31.833054][ T12] Kernel Offset: disabled [ 31.837380][ T12] Rebooting in 86400 seconds..