[ OK ] Started Getty on tty4. [ OK ] Started Getty on tty3. [ OK ] Started Getty on tty2. [ OK ] Started Serial Getty on ttyS0. [ OK ] Started Getty on tty1. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Update UTMP about System Runlevel Changes. [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.1.105' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 148.822094][ T55] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 149.062274][ T55] usb 1-1: Using ep0 maxpacket: 8 [ 149.192224][ T55] usb 1-1: config 0 has an invalid interface number: 138 but max is 0 [ 149.200607][ T55] usb 1-1: config 0 has no interface number 0 [ 149.207154][ T55] usb 1-1: config 0 interface 138 altsetting 0 has an invalid endpoint with address 0x80, skipping [ 149.382151][ T55] usb 1-1: New USB device found, idVendor=7392, idProduct=7612, bcdDevice=4e.42 [ 149.391266][ T55] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 149.399651][ T55] usb 1-1: Product: syz [ 149.404149][ T55] usb 1-1: Manufacturer: syz [ 149.408844][ T55] usb 1-1: SerialNumber: syz [ 149.417695][ T55] usb 1-1: config 0 descriptor?? executing program [ 149.722335][ T55] r8712u: register rtl8712_netdev_ops to netdev_ops [ 149.729070][ T55] usb 1-1: r8712u: USB_SPEED_HIGH with 0 endpoints [ 149.784868][ T55] ===================================================== [ 149.784885][ T55] BUG: KMSAN: uninit-value in string+0x573/0x6d0 [ 149.784896][ T55] CPU: 1 PID: 55 Comm: kworker/1:1 Not tainted 5.11.0-rc7-syzkaller #0 [ 149.784909][ T55] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 149.784921][ T55] Workqueue: usb_hub_wq hub_event [ 149.784939][ T55] Call Trace: [ 149.784946][ T55] dump_stack+0x21c/0x280 [ 149.784954][ T55] kmsan_report+0xfb/0x1e0 [ 149.784961][ T55] __msan_warning+0x5f/0xa0 [ 149.784969][ T55] string+0x573/0x6d0 [ 149.784976][ T55] vsnprintf+0x1acd/0x3600 [ 149.784984][ T55] pointer+0x1b8a/0x1ca0 [ 149.784991][ T55] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 149.785000][ T55] vsnprintf+0x15f2/0x3600 [ 149.785008][ T55] vprintk_store+0x2ab/0x1df0 [ 149.785016][ T55] ? kmsan_internal_set_origin+0x85/0xc0 [ 149.785025][ T55] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 149.785033][ T55] vprintk_emit+0x29a/0x7f0 [ 149.785041][ T55] dev_vprintk_emit+0x5f7/0x6d8 [ 149.785049][ T55] dev_printk_emit+0x1ce/0x210 [ 149.785057][ T55] ? r8712_usbctrl_vendorreq+0x4a8/0x4d0 [ 149.785066][ T55] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 149.785074][ T55] __dev_printk+0x3dc/0x458 [ 149.785081][ T55] _dev_info+0x1e5/0x22a [ 149.785089][ T55] ? usb_read8+0xe7/0x130 [ 149.785096][ T55] ? r871xu_drv_init+0x1986/0x2fe0 [ 149.785110][ T55] ? r8712_usb_set_intf_ops+0x240/0x240 [ 149.785119][ T55] r871xu_drv_init+0x1a59/0x2fe0 [ 149.785127][ T55] ? r871x_dev_unload+0x310/0x310 [ 149.785135][ T55] usb_probe_interface+0xfcc/0x1520 [ 149.785144][ T55] ? usb_register_driver+0x900/0x900 [ 149.785152][ T55] really_probe+0xe15/0x24d0 [ 149.785160][ T55] driver_probe_device+0x29d/0x3a0 [ 149.785168][ T55] __device_attach_driver+0x63f/0x830 [ 149.785176][ T55] bus_for_each_drv+0x2c8/0x3f0 [ 149.785185][ T55] ? deferred_probe_work_func+0x400/0x400 [ 149.785193][ T55] __device_attach+0x56a/0x890 [ 149.785201][ T55] device_initial_probe+0x4a/0x60 [ 149.785209][ T55] bus_probe_device+0x17e/0x3d0 [ 149.785218][ T55] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 149.785226][ T55] device_add+0x2c15/0x31d0 [ 149.785234][ T55] usb_set_configuration+0x3872/0x3eb0 [ 149.785243][ T55] ? usb_set_configuration+0xb01/0x3eb0 [ 149.785256][ T55] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 149.785265][ T55] usb_generic_driver_probe+0x138/0x300 [ 149.785275][ T55] ? usb_choose_configuration+0xee0/0xee0 [ 149.785283][ T55] usb_probe_device+0x317/0x570 [ 149.785292][ T55] ? usb_register_device_driver+0x590/0x590 [ 149.785300][ T55] really_probe+0xe15/0x24d0 [ 149.785308][ T55] driver_probe_device+0x29d/0x3a0 [ 149.785317][ T55] __device_attach_driver+0x63f/0x830 [ 149.785325][ T55] bus_for_each_drv+0x2c8/0x3f0 [ 149.785333][ T55] ? deferred_probe_work_func+0x400/0x400 [ 149.785342][ T55] __device_attach+0x56a/0x890 [ 149.785350][ T55] device_initial_probe+0x4a/0x60 [ 149.785358][ T55] bus_probe_device+0x17e/0x3d0 [ 149.785367][ T55] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 149.785376][ T55] device_add+0x2c15/0x31d0 [ 149.785383][ T55] usb_new_device+0x1bd4/0x2a30 [ 149.785391][ T55] hub_event+0x5b99/0x8870 [ 149.785399][ T55] ? kmsan_get_metadata+0x116/0x180 [ 149.785407][ T55] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 149.785416][ T55] ? led_work+0x780/0x780 [ 149.785423][ T55] process_one_work+0x1219/0x1fe0 [ 149.785431][ T55] worker_thread+0x10ec/0x2340 [ 149.785438][ T55] kthread+0x521/0x560 [ 149.785446][ T55] ? process_one_work+0x1fe0/0x1fe0 [ 149.785454][ T55] ? kthread_blkcg+0x110/0x110 [ 149.785462][ T55] ret_from_fork+0x1f/0x30 [ 149.785468][ T55] [ 149.785475][ T55] Local variable ----data@usb_read8 created at: [ 149.785484][ T55] usb_read8+0x5d/0x130 [ 149.785492][ T55] usb_read8+0x5d/0x130 [ 149.785500][ T55] ===================================================== [ 149.785511][ T55] Disabling lock debugging due to kernel taint [ 149.785521][ T55] Kernel panic - not syncing: panic_on_warn set ... [ 149.785532][ T55] CPU: 1 PID: 55 Comm: kworker/1:1 Tainted: G B 5.11.0-rc7-syzkaller #0 [ 149.785546][ T55] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 149.785558][ T55] Workqueue: usb_hub_wq hub_event [ 149.785576][ T55] Call Trace: [ 149.785583][ T55] dump_stack+0x21c/0x280 [ 149.785590][ T55] panic+0x4c6/0xea7 [ 149.785597][ T55] ? add_taint+0x17c/0x210 [ 149.785604][ T55] ? vsnprintf+0x329/0x3600 [ 149.785612][ T55] kmsan_report+0x1de/0x1e0 [ 149.785619][ T55] __msan_warning+0x5f/0xa0 [ 149.785627][ T55] string+0x573/0x6d0 [ 149.785634][ T55] vsnprintf+0x1acd/0x3600 [ 149.785641][ T55] pointer+0x1b8a/0x1ca0 [ 149.785649][ T55] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 149.785662][ T55] vsnprintf+0x15f2/0x3600 [ 149.785669][ T55] vprintk_store+0x2ab/0x1df0 [ 149.785678][ T55] ? kmsan_internal_set_origin+0x85/0xc0 [ 149.785685][ T55] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 149.785692][ T55] vprintk_emit+0x29a/0x7f0 [ 149.785699][ T55] dev_vprintk_emit+0x5f7/0x6d8 [ 149.785706][ T55] dev_printk_emit+0x1ce/0x210 [ 149.785713][ T55] ? r8712_usbctrl_vendorreq+0x4a8/0x4d0 [ 149.785721][ T55] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 149.785729][ T55] __dev_printk+0x3dc/0x458 [ 149.785736][ T55] _dev_info+0x1e5/0x22a [ 149.785743][ T55] ? usb_read8+0xe7/0x130 [ 149.785750][ T55] ? r871xu_drv_init+0x1986/0x2fe0 [ 149.785757][ T55] ? r8712_usb_set_intf_ops+0x240/0x240 [ 149.785765][ T55] r871xu_drv_init+0x1a59/0x2fe0 [ 149.785773][ T55] ? r871x_dev_unload+0x310/0x310 [ 149.785782][ T55] usb_probe_interface+0xfcc/0x1520 [ 149.785789][ T55] ? usb_register_driver+0x900/0x900 [ 149.785796][ T55] really_probe+0xe15/0x24d0 [ 149.785803][ T55] driver_probe_device+0x29d/0x3a0 [ 149.785810][ T55] __device_attach_driver+0x63f/0x830 [ 149.785817][ T55] bus_for_each_drv+0x2c8/0x3f0 [ 149.785823][ T55] ? deferred_probe_work_func+0x400/0x400 [ 149.785831][ T55] __device_attach+0x56a/0x890 [ 149.785839][ T55] device_initial_probe+0x4a/0x60 [ 149.785850][ T55] bus_probe_device+0x17e/0x3d0 [ 149.785857][ T55] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 149.785866][ T55] device_add+0x2c15/0x31d0 [ 149.785873][ T55] usb_set_configuration+0x3872/0x3eb0 [ 149.785882][ T55] ? usb_set_configuration+0xb01/0x3eb0 [ 149.785891][ T55] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 149.785900][ T55] usb_generic_driver_probe+0x138/0x300 [ 149.785909][ T55] ? usb_choose_configuration+0xee0/0xee0 [ 149.785918][ T55] usb_probe_device+0x317/0x570 [ 149.785926][ T55] ? usb_register_device_driver+0x590/0x590 [ 149.785939][ T55] really_probe+0xe15/0x24d0 [ 149.785947][ T55] driver_probe_device+0x29d/0x3a0 [ 149.785955][ T55] __device_attach_driver+0x63f/0x830 [ 149.785963][ T55] bus_for_each_drv+0x2c8/0x3f0 [ 149.785971][ T55] ? deferred_probe_work_func+0x400/0x400 [ 149.785980][ T55] __device_attach+0x56a/0x890 [ 149.785988][ T55] device_initial_probe+0x4a/0x60 [ 149.785996][ T55] bus_probe_device+0x17e/0x3d0 [ 149.786004][ T55] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 149.786013][ T55] device_add+0x2c15/0x31d0 [ 149.786021][ T55] usb_new_device+0x1bd4/0x2a30 [ 149.786032][ T55] hub_event+0x5b99/0x8870 [ 149.786038][ T55] ? kmsan_get_metadata+0x116/0x180 [ 149.786046][ T55] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 149.786053][ T55] ? led_work+0x780/0x780 [ 149.786060][ T55] process_one_work+0x1219/0x1fe0 [ 149.786067][ T55] worker_thread+0x10ec/0x2340 [ 149.786074][ T55] kthread+0x521/0x560 [ 149.786081][ T55] ? process_one_work+0x1fe0/0x1fe0 [ 149.786088][ T55] ? kthread_blkcg+0x110/0x110 [ 149.786095][ T55] ret_from_fork+0x1f/0x30 [ 149.786693][ T55] Kernel Offset: disabled