Warning: Permanently added '10.128.0.166' (ECDSA) to the list of known hosts. executing program [ 49.156922][ T22] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 49.396870][ T22] usb 1-1: Using ep0 maxpacket: 8 [ 49.516969][ T22] usb 1-1: config 0 has an invalid interface number: 80 but max is 0 [ 49.525207][ T22] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 49.535536][ T22] usb 1-1: config 0 has no interface number 0 [ 49.541772][ T22] usb 1-1: config 0 interface 80 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 49.552804][ T22] usb 1-1: New USB device found, idVendor=9022, idProduct=d632, bcdDevice=a1.53 [ 49.561871][ T22] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 49.571862][ T22] usb 1-1: config 0 descriptor?? [ 49.619028][ T22] dw2102: su3000_identify_state [ 49.623995][ T22] dvb-usb: found a 'TeVii S632 USB' in warm state. [ 49.630900][ T22] dw2102: su3000_power_ctrl: 1, initialized 0 [ 49.637315][ T22] dvb-usb: bulk message failed: -22 (2/-634124224) [ 49.645569][ T22] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 49.677171][ T22] dvbdev: DVB: registering new adapter (TeVii S632 USB) [ 49.684547][ T22] usb 1-1: media controller created [ 49.690130][ T22] dvb-usb: bulk message failed: -22 (6/-2035979840) [ 49.696866][ T22] dw2102: i2c transfer failed. [ 49.701745][ T22] dvb-usb: bulk message failed: -22 (6/-2035979840) [ 49.708557][ T22] dw2102: i2c transfer failed. [ 49.713362][ T22] dvb-usb: bulk message failed: -22 (6/-2035979840) [ 49.719984][ T22] dw2102: i2c transfer failed. [ 49.724767][ T22] dvb-usb: bulk message failed: -22 (6/-2035979840) [ 49.731460][ T22] dw2102: i2c transfer failed. [ 49.736401][ T22] dvb-usb: bulk message failed: -22 (6/-2035979840) [ 49.743048][ T22] dw2102: i2c transfer failed. [ 49.747900][ T22] dvb-usb: bulk message failed: -22 (6/-2035979840) [ 49.754482][ T22] dw2102: i2c transfer failed. [ 49.759305][ T22] dvb-usb: MAC address: 02:02:02:02:02:02 [ 49.769390][ T22] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. executing program [ 49.785320][ T22] dvb-usb: bulk message failed: -22 (1/0) [ 49.791212][ T22] dw2102: command 0x51 transfer failed. [ 49.798057][ T22] dvb-usb: bulk message failed: -22 (5/-2035979840) [ 49.804808][ T22] dw2102: i2c transfer failed. [ 49.809796][ T22] dvb-usb: bulk message failed: -22 (5/-2035979840) [ 49.816477][ T22] dw2102: i2c transfer failed. [ 49.829946][ T22] dvb-usb: bulk message failed: -22 (5/-2035979840) [ 49.836703][ T22] dw2102: i2c transfer failed. [ 49.841677][ T22] dvb-usb: bulk message failed: -22 (5/-2035979840) [ 49.848297][ T22] dw2102: i2c transfer failed. [ 49.853197][ T22] dvb-usb: bulk message failed: -22 (5/-2035979840) [ 49.859926][ T22] dw2102: i2c transfer failed. [ 49.864714][ T22] dvb-usb: bulk message failed: -22 (5/-2035979840) [ 49.871362][ T22] dw2102: i2c transfer failed. [ 49.917426][ T22] dvb-usb: bulk message failed: -22 (5/-2035979840) [ 49.924235][ T22] dw2102: i2c transfer failed. [ 49.929087][ T22] dvb-usb: bulk message failed: -22 (5/-2035979840) [ 49.935669][ T22] dw2102: i2c transfer failed. [ 49.940618][ T22] dvb-usb: bulk message failed: -22 (5/-2035979840) [ 49.947242][ T22] dw2102: i2c transfer failed. [ 49.952038][ T22] dvb-usb: bulk message failed: -22 (5/-2035979840) [ 49.958813][ T22] dw2102: i2c transfer failed. [ 49.963611][ T22] dvb-usb: bulk message failed: -22 (5/-2035979840) [ 49.970229][ T22] dw2102: i2c transfer failed. [ 49.975092][ T22] dvb-usb: bulk message failed: -22 (5/-2035979840) [ 49.981732][ T22] dw2102: i2c transfer failed. [ 49.986525][ T22] ts2020 0-0060: Montage Technology TS2020 successfully identified [ 49.995190][ T22] dw2102: Attached RS2000/TS2020! [ 50.000436][ T22] usb 1-1: DVB: registering adapter 0 frontend 0 (M88RS2000 DVB-S)... [ 50.008886][ T22] dvbdev: dvb_create_media_entity: media entity 'M88RS2000 DVB-S' registered. [ 50.077033][ T22] Registered IR keymap rc-su3000 [ 50.082669][ T22] rc rc0: TeVii S632 USB as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 50.092005][ T22] input: TeVii S632 USB as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input5 [ 50.102652][ T22] dvb-usb: schedule remote query interval to 150 msecs. [ 50.109698][ T22] dw2102: su3000_power_ctrl: 0, initialized 1 [ 50.115873][ T22] dvb-usb: TeVii S632 USB successfully initialized and connected. [ 50.125611][ T22] usb 1-1: USB disconnect, device number 2 [ 50.132672][ T22] ================================================================== [ 50.140911][ T22] BUG: KASAN: use-after-free in dvb_usb_device_exit+0x19a/0x1a0 [ 50.148580][ T22] Read of size 8 at addr ffff8881d53bb6e0 by task kworker/1:1/22 [ 50.156309][ T22] [ 50.158639][ T22] CPU: 1 PID: 22 Comm: kworker/1:1 Not tainted 5.3.0-rc2+ #25 [ 50.166099][ T22] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 50.176299][ T22] Workqueue: usb_hub_wq hub_event [ 50.181426][ T22] Call Trace: [ 50.184736][ T22] dump_stack+0xca/0x13e [ 50.188965][ T22] ? dvb_usb_device_exit+0x19a/0x1a0 [ 50.194235][ T22] ? dvb_usb_device_exit+0x19a/0x1a0 [ 50.199530][ T22] print_address_description+0x6a/0x32c [ 50.205117][ T22] ? dvb_usb_device_exit+0x19a/0x1a0 [ 50.210393][ T22] ? dvb_usb_device_exit+0x19a/0x1a0 [ 50.215669][ T22] __kasan_report.cold+0x1a/0x33 [ 50.220702][ T22] ? _raw_spin_unlock_irq+0x20/0x30 [ 50.225896][ T22] ? dvb_usb_device_exit+0x19a/0x1a0 [ 50.231169][ T22] kasan_report+0xe/0x12 [ 50.235411][ T22] dvb_usb_device_exit+0x19a/0x1a0 [ 50.240603][ T22] ? dvb_usb_exit+0x290/0x290 [ 50.245282][ T22] ? usb_disable_endpoint+0x1ba/0x1f0 [ 50.250677][ T22] ? usb_disable_interface+0x140/0x1a0 [ 50.256128][ T22] usb_unbind_interface+0x1bd/0x8a0 [ 50.261316][ T22] ? usb_autoresume_device+0x60/0x60 [ 50.266585][ T22] device_release_driver_internal+0x404/0x4c0 [ 50.272634][ T22] bus_remove_device+0x2dc/0x4a0 [ 50.277595][ T22] device_del+0x420/0xb10 [ 50.281946][ T22] ? __device_links_no_driver+0x240/0x240 [ 50.287691][ T22] ? usb_remove_ep_devs+0x3e/0x80 [ 50.292700][ T22] ? remove_intf_ep_devs+0x13f/0x1d0 [ 50.297969][ T22] usb_disable_device+0x211/0x690 [ 50.302988][ T22] usb_disconnect+0x284/0x8d0 [ 50.307656][ T22] hub_event+0x1454/0x3640 [ 50.312062][ T22] ? find_held_lock+0x2d/0x110 [ 50.316818][ T22] ? mark_held_locks+0xe0/0xe0 [ 50.321571][ T22] ? hub_port_debounce+0x260/0x260 [ 50.326782][ T22] process_one_work+0x92b/0x1530 [ 50.331757][ T22] ? pwq_dec_nr_in_flight+0x310/0x310 [ 50.337134][ T22] ? do_raw_spin_lock+0x11a/0x280 [ 50.342145][ T22] worker_thread+0x7ab/0xe20 [ 50.346739][ T22] ? process_one_work+0x1530/0x1530 [ 50.351973][ T22] kthread+0x318/0x420 [ 50.356039][ T22] ? kthread_create_on_node+0xf0/0xf0 [ 50.361409][ T22] ret_from_fork+0x24/0x30 [ 50.366041][ T22] [ 50.368383][ T22] Allocated by task 22: [ 50.372544][ T22] save_stack+0x1b/0x80 [ 50.376693][ T22] __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 50.382325][ T22] __kmalloc_track_caller+0xc8/0x2a0 [ 50.387648][ T22] kmemdup+0x23/0x50 [ 50.391545][ T22] dw2102_probe+0x627/0xc40 [ 50.396042][ T22] usb_probe_interface+0x305/0x7a0 [ 50.401150][ T22] really_probe+0x281/0x650 [ 50.405639][ T22] driver_probe_device+0x101/0x1b0 [ 50.410734][ T22] __device_attach_driver+0x1c2/0x220 [ 50.416100][ T22] bus_for_each_drv+0x15c/0x1e0 [ 50.421094][ T22] __device_attach+0x217/0x360 [ 50.425987][ T22] bus_probe_device+0x1e4/0x290 [ 50.431014][ T22] device_add+0xae6/0x16f0 [ 50.435576][ T22] usb_set_configuration+0xdf6/0x1670 [ 50.440945][ T22] generic_probe+0x9d/0xd5 [ 50.445357][ T22] usb_probe_device+0x99/0x100 [ 50.450733][ T22] really_probe+0x281/0x650 [ 50.455235][ T22] driver_probe_device+0x101/0x1b0 [ 50.460335][ T22] __device_attach_driver+0x1c2/0x220 [ 50.465694][ T22] bus_for_each_drv+0x15c/0x1e0 [ 50.470530][ T22] __device_attach+0x217/0x360 [ 50.475281][ T22] bus_probe_device+0x1e4/0x290 [ 50.480169][ T22] device_add+0xae6/0x16f0 [ 50.484583][ T22] usb_new_device.cold+0x6a4/0xe79 [ 50.489736][ T22] hub_event+0x1b5c/0x3640 [ 50.494149][ T22] process_one_work+0x92b/0x1530 [ 50.499120][ T22] worker_thread+0x96/0xe20 [ 50.503613][ T22] kthread+0x318/0x420 [ 50.507662][ T22] ret_from_fork+0x24/0x30 [ 50.512097][ T22] [ 50.514410][ T22] Freed by task 22: [ 50.518205][ T22] save_stack+0x1b/0x80 [ 50.522388][ T22] __kasan_slab_free+0x130/0x180 [ 50.527338][ T22] kfree+0xe4/0x2f0 [ 50.531129][ T22] dw2102_probe+0x871/0xc40 [ 50.535613][ T22] usb_probe_interface+0x305/0x7a0 [ 50.540810][ T22] really_probe+0x281/0x650 [ 50.545298][ T22] driver_probe_device+0x101/0x1b0 [ 50.550393][ T22] __device_attach_driver+0x1c2/0x220 [ 50.555741][ T22] bus_for_each_drv+0x15c/0x1e0 [ 50.560567][ T22] __device_attach+0x217/0x360 [ 50.565309][ T22] bus_probe_device+0x1e4/0x290 [ 50.570140][ T22] device_add+0xae6/0x16f0 [ 50.574589][ T22] usb_set_configuration+0xdf6/0x1670 [ 50.579944][ T22] generic_probe+0x9d/0xd5 [ 50.584348][ T22] usb_probe_device+0x99/0x100 [ 50.589091][ T22] really_probe+0x281/0x650 [ 50.593584][ T22] driver_probe_device+0x101/0x1b0 [ 50.598676][ T22] __device_attach_driver+0x1c2/0x220 [ 50.604037][ T22] bus_for_each_drv+0x15c/0x1e0 [ 50.608877][ T22] __device_attach+0x217/0x360 [ 50.613647][ T22] bus_probe_device+0x1e4/0x290 [ 50.618488][ T22] device_add+0xae6/0x16f0 [ 50.622883][ T22] usb_new_device.cold+0x6a4/0xe79 [ 50.628090][ T22] hub_event+0x1b5c/0x3640 [ 50.632495][ T22] process_one_work+0x92b/0x1530 [ 50.637417][ T22] worker_thread+0x96/0xe20 [ 50.641898][ T22] kthread+0x318/0x420 [ 50.645942][ T22] ret_from_fork+0x24/0x30 [ 50.650331][ T22] [ 50.652643][ T22] The buggy address belongs to the object at ffff8881d53bb300 [ 50.652643][ T22] which belongs to the cache kmalloc-4k of size 4096 [ 50.666684][ T22] The buggy address is located 992 bytes inside of [ 50.666684][ T22] 4096-byte region [ffff8881d53bb300, ffff8881d53bc300) [ 50.680023][ T22] The buggy address belongs to the page: [ 50.685692][ T22] page:ffffea000754ee00 refcount:1 mapcount:0 mapping:ffff8881da00c280 index:0x0 compound_mapcount: 0 [ 50.696623][ T22] flags: 0x200000000010200(slab|head) [ 50.702022][ T22] raw: 0200000000010200 dead000000000100 dead000000000122 ffff8881da00c280 [ 50.710633][ T22] raw: 0000000000000000 0000000000070007 00000001ffffffff 0000000000000000 [ 50.719199][ T22] page dumped because: kasan: bad access detected [ 50.725592][ T22] [ 50.727902][ T22] Memory state around the buggy address: [ 50.733518][ T22] ffff8881d53bb580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 50.741611][ T22] ffff8881d53bb600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 50.749818][ T22] >ffff8881d53bb680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 50.757860][ T22] ^ [ 50.765099][ T22] ffff8881d53bb700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 50.773346][ T22] ffff8881d53bb780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 50.781391][ T22] ================================================================== [ 50.789515][ T22] Disabling lock debugging due to kernel taint [ 50.795735][ T22] Kernel panic - not syncing: panic_on_warn set ... [ 50.802353][ T22] CPU: 1 PID: 22 Comm: kworker/1:1 Tainted: G B 5.3.0-rc2+ #25 [ 50.811177][ T22] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 50.821222][ T22] Workqueue: usb_hub_wq hub_event [ 50.826223][ T22] Call Trace: [ 50.829499][ T22] dump_stack+0xca/0x13e [ 50.833728][ T22] panic+0x2a3/0x6da [ 50.837599][ T22] ? add_taint.cold+0x16/0x16 [ 50.842249][ T22] ? retint_kernel+0x10/0x10 [ 50.846822][ T22] ? trace_hardirqs_on+0x55/0x1e0 [ 50.851828][ T22] ? dvb_usb_device_exit+0x19a/0x1a0 [ 50.857142][ T22] end_report+0x43/0x49 [ 50.861284][ T22] ? dvb_usb_device_exit+0x19a/0x1a0 [ 50.866608][ T22] __kasan_report.cold+0xd/0x33 [ 50.871450][ T22] ? _raw_spin_unlock_irq+0x20/0x30 [ 50.876627][ T22] ? dvb_usb_device_exit+0x19a/0x1a0 [ 50.881890][ T22] kasan_report+0xe/0x12 [ 50.886123][ T22] dvb_usb_device_exit+0x19a/0x1a0 [ 50.891217][ T22] ? dvb_usb_exit+0x290/0x290 [ 50.895876][ T22] ? usb_disable_endpoint+0x1ba/0x1f0 [ 50.901302][ T22] ? usb_disable_interface+0x140/0x1a0 [ 50.906744][ T22] usb_unbind_interface+0x1bd/0x8a0 [ 50.911917][ T22] ? usb_autoresume_device+0x60/0x60 [ 50.917278][ T22] device_release_driver_internal+0x404/0x4c0 [ 50.923335][ T22] bus_remove_device+0x2dc/0x4a0 [ 50.928249][ T22] device_del+0x420/0xb10 [ 50.932555][ T22] ? __device_links_no_driver+0x240/0x240 [ 50.938248][ T22] ? usb_remove_ep_devs+0x3e/0x80 [ 50.943244][ T22] ? remove_intf_ep_devs+0x13f/0x1d0 [ 50.948535][ T22] usb_disable_device+0x211/0x690 [ 50.953640][ T22] usb_disconnect+0x284/0x8d0 [ 50.958290][ T22] hub_event+0x1454/0x3640 [ 50.962681][ T22] ? find_held_lock+0x2d/0x110 [ 50.967418][ T22] ? mark_held_locks+0xe0/0xe0 [ 50.972162][ T22] ? hub_port_debounce+0x260/0x260 [ 50.977249][ T22] process_one_work+0x92b/0x1530 [ 50.982164][ T22] ? pwq_dec_nr_in_flight+0x310/0x310 [ 50.987518][ T22] ? do_raw_spin_lock+0x11a/0x280 [ 50.992562][ T22] worker_thread+0x7ab/0xe20 [ 50.997141][ T22] ? process_one_work+0x1530/0x1530 [ 51.002318][ T22] kthread+0x318/0x420 [ 51.006362][ T22] ? kthread_create_on_node+0xf0/0xf0 [ 51.011712][ T22] ret_from_fork+0x24/0x30 [ 51.016365][ T22] Kernel Offset: disabled [ 51.020678][ T22] Rebooting in 86400 seconds..