Warning: Permanently added '10.128.0.82' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 58.718016] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 58.967927] usb 1-1: Using ep0 maxpacket: 8 [ 59.088039] usb 1-1: config 0 has an invalid interface number: 103 but max is 0 [ 59.095785] usb 1-1: config 0 has no interface number 0 [ 59.101313] usb 1-1: New USB device found, idVendor=2201, idProduct=012c, bcdDevice=c1.e7 [ 59.109714] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 59.119133] usb 1-1: config 0 descriptor?? [ 59.164416] ================================================================== [ 59.164419] BUG: KASAN: stack-out-of-bounds in string+0x1f6/0x220 [ 59.164423] Read of size 1 at addr ffff8880a859f260 by task kworker/1:1/21 [ 59.164424] [ 59.164427] CPU: 1 PID: 21 Comm: kworker/1:1 Not tainted 5.1.0-rc4-319354-g9a33b36 #3 [ 59.164431] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 59.164433] Workqueue: usb_hub_wq hub_event [ 59.164436] Call Trace: [ 59.164438] dump_stack+0xe8/0x16e [ 59.164439] ? string+0x1f6/0x220 [ 59.164441] ? string+0x1f6/0x220 [ 59.164443] print_address_description+0x6c/0x236 [ 59.164445] ? string+0x1f6/0x220 [ 59.164446] ? string+0x1f6/0x220 [ 59.164448] kasan_report.cold+0x1a/0x3c [ 59.164450] ? __sanitizer_cov_trace_const_cmp4+0x20/0x20 [ 59.164452] ? string+0x1f6/0x220 [ 59.164454] string+0x1f6/0x220 [ 59.164455] ? widen_string+0x2a0/0x2a0 [ 59.164457] vsnprintf+0xa14/0x16b0 [ 59.164459] ? pointer+0x910/0x910 [ 59.164460] ? put_dec_trunc8+0x263/0x2f0 [ 59.164462] ? set_precision+0x170/0x170 [ 59.164464] pointer+0x60b/0x910 [ 59.164465] ? address_val+0x80/0x80 [ 59.164467] vsnprintf+0x5a0/0x16b0 [ 59.164469] ? pointer+0x910/0x910 [ 59.164470] ? noop_count+0x40/0x40 [ 59.164472] vscnprintf+0x29/0x80 [ 59.164474] vprintk_store+0x45/0x4a0 [ 59.164475] vprintk_emit+0x210/0x5a0 [ 59.164477] dev_vprintk_emit+0x50e/0x553 [ 59.164480] ? dev_attr_show.cold+0x3a/0x3a [ 59.164483] ? lockdep_hardirqs_on+0x37e/0x580 [ 59.164485] ? depot_save_stack+0x1d6/0x450 [ 59.164487] ? __bfs+0x27/0x560 [ 59.164489] ? lockdep_on+0x50/0x50 [ 59.164490] dev_printk_emit+0xbf/0xf6 [ 59.164492] ? dev_vprintk_emit+0x553/0x553 [ 59.164494] ? check_usage+0x520/0x520 [ 59.164496] __dev_printk+0x1ed/0x215 [ 59.164497] _dev_info+0xdc/0x10e [ 59.164499] ? _dev_notice+0x10e/0x10e [ 59.164501] ? refcount_inc_checked+0x1d/0x60 [ 59.164503] ? usb_string+0x3ad/0x510 [ 59.164504] vub300_probe+0x25e/0xd80 [ 59.164506] ? __pm_runtime_set_status+0x703/0xa10 [ 59.164508] ? mark_held_locks+0xe0/0xe0 [ 59.164510] ? mmc_signal_sdio_irq+0xf0/0xf0 [ 59.164512] ? mark_held_locks+0x9f/0xe0 [ 59.164514] ? find_held_lock+0x2d/0x110 [ 59.164516] ? usb_probe_interface+0x5fe/0x820 [ 59.164517] ? mark_held_locks+0x9f/0xe0 [ 59.164519] ? _raw_spin_unlock_irqrestore+0x4b/0x60 [ 59.164521] usb_probe_interface+0x31d/0x820 [ 59.164523] ? usb_probe_device+0x150/0x150 [ 59.164525] really_probe+0x2da/0xb10 [ 59.164527] driver_probe_device+0x21d/0x350 [ 59.164529] __device_attach_driver+0x1d8/0x290 [ 59.164532] ? driver_allows_async_probing+0x160/0x160 [ 59.164533] bus_for_each_drv+0x163/0x1e0 [ 59.164535] ? bus_rescan_devices+0x30/0x30 [ 59.164538] ? _raw_spin_unlock_irqrestore+0x4b/0x60 [ 59.164540] ? lockdep_hardirqs_on+0x37e/0x580 [ 59.164542] __device_attach+0x223/0x3a0 [ 59.164543] ? device_bind_driver+0xe0/0xe0 [ 59.164546] ? kobject_uevent_env+0x295/0x13d0 [ 59.164547] bus_probe_device+0x1f1/0x2a0 [ 59.164550] ? blocking_notifier_call_chain+0x59/0xb0 [ 59.164551] device_add+0xad2/0x16e0 [ 59.164554] ? get_device_parent.isra.0+0x560/0x560 [ 59.164556] ? _raw_spin_unlock_irqrestore+0x4b/0x60 [ 59.164558] usb_set_configuration+0xdf7/0x1740 [ 59.164560] generic_probe+0xa2/0xda [ 59.164561] usb_probe_device+0xc0/0x150 [ 59.164563] ? usb_suspend+0x5f0/0x5f0 [ 59.164565] really_probe+0x2da/0xb10 [ 59.164567] driver_probe_device+0x21d/0x350 [ 59.164569] __device_attach_driver+0x1d8/0x290 [ 59.164571] ? driver_allows_async_probing+0x160/0x160 [ 59.164573] bus_for_each_drv+0x163/0x1e0 [ 59.164575] ? bus_rescan_devices+0x30/0x30 [ 59.164577] ? _raw_spin_unlock_irqrestore+0x4b/0x60 [ 59.164579] ? lockdep_hardirqs_on+0x37e/0x580 [ 59.164580] __device_attach+0x223/0x3a0 [ 59.164582] ? device_bind_driver+0xe0/0xe0 [ 59.164584] ? kobject_uevent_env+0x295/0x13d0 [ 59.164586] bus_probe_device+0x1f1/0x2a0 [ 59.164588] ? blocking_notifier_call_chain+0x59/0xb0 [ 59.164590] device_add+0xad2/0x16e0 [ 59.164592] ? get_device_parent.isra.0+0x560/0x560 [ 59.164594] usb_new_device.cold+0x537/0xccf [ 59.164596] hub_event+0x138e/0x3b00 [ 59.164597] ? hub_port_debounce+0x350/0x350 [ 59.164599] ? _raw_spin_unlock_irq+0x29/0x40 [ 59.164601] process_one_work+0x90f/0x1580 [ 59.164603] ? wq_pool_ids_show+0x300/0x300 [ 59.164605] ? do_raw_spin_lock+0x11f/0x290 [ 59.164607] worker_thread+0x9b/0xe20 [ 59.164609] ? process_one_work+0x1580/0x1580 [ 59.164610] kthread+0x313/0x420 [ 59.164612] ? kthread_park+0x1a0/0x1a0 [ 59.164614] ret_from_fork+0x3a/0x50 [ 59.164615] [ 59.164617] The buggy address belongs to the page: [ 59.164620] page:ffffea0002a167c0 count:0 mapcount:0 mapping:0000000000000000 index:0x0 [ 59.164623] flags: 0xfff00000000000() [ 59.164627] raw: 00fff00000000000 ffffea0002a167c8 ffffea0002a167c8 0000000000000000 [ 59.164630] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 59.164632] page dumped because: kasan: bad access detected [ 59.164633] [ 59.164635] Memory state around the buggy address: [ 59.164639] ffff8880a859f100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 59.164642] ffff8880a859f180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 59.164644] >ffff8880a859f200: 00 00 f1 f1 f1 f1 f1 f1 00 00 00 00 f2 f2 f2 f2 [ 59.164647] ^ [ 59.164650] ffff8880a859f280: 00 00 00 00 f2 f2 f2 f2 00 00 00 00 00 00 f3 f3 [ 59.164653] ffff8880a859f300: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 59.164656] ================================================================== [ 59.164658] Disabling lock debugging due to kernel taint [ 59.164661] Kernel panic - not syncing: panic_on_warn set ... [ 59.164664] CPU: 1 PID: 21 Comm: kworker/1:1 Tainted: G B 5.1.0-rc4-319354-g9a33b36 #3 [ 59.164668] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 59.164670] Workqueue: usb_hub_wq hub_event [ 59.164672] Call Trace: [ 59.164674] dump_stack+0xe8/0x16e [ 59.164675] panic+0x29d/0x5f2 [ 59.164677] ? __warn_printk+0xf8/0xf8 [ 59.164679] ? lock_downgrade+0x640/0x640 [ 59.164681] ? print_shadow_for_address+0xbd/0x119 [ 59.164683] ? trace_hardirqs_off+0x50/0x1c0 [ 59.164684] ? string+0x1f6/0x220 [ 59.164686] end_report+0x48/0x4e [ 59.164687] ? string+0x1f6/0x220 [ 59.164689] kasan_report.cold+0xd/0x3c [ 59.164691] ? __sanitizer_cov_trace_const_cmp4+0x20/0x20 [ 59.164693] ? string+0x1f6/0x220 [ 59.164695] string+0x1f6/0x220 [ 59.164696] ? widen_string+0x2a0/0x2a0 [ 59.164698] vsnprintf+0xa14/0x16b0 [ 59.164700] ? pointer+0x910/0x910 [ 59.164702] ? put_dec_trunc8+0x263/0x2f0 [ 59.164703] ? set_precision+0x170/0x170 [ 59.164705] pointer+0x60b/0x910 [ 59.164707] ? address_val+0x80/0x80 [ 59.164708] vsnprintf+0x5a0/0x16b0 [ 59.164710] ? pointer+0x910/0x910 [ 59.164712] ? noop_count+0x40/0x40 [ 59.164714] vscnprintf+0x29/0x80 [ 59.164717] vprintk_store+0x45/0x4a0 [ 59.164719] vprintk_emit+0x210/0x5a0 [ 59.164721] dev_vprintk_emit+0x50e/0x553 [ 59.164723] ? dev_attr_show.cold+0x3a/0x3a [ 59.164725] ? lockdep_hardirqs_on+0x37e/0x580 [ 59.164727] ? depot_save_stack+0x1d6/0x450 [ 59.164728] ? __bfs+0x27/0x560 [ 59.164730] ? lockdep_on+0x50/0x50 [ 59.164732] dev_printk_emit+0xbf/0xf6 [ 59.164734] ? dev_vprintk_emit+0x553/0x553 [ 59.164736] ? check_usage+0x520/0x520 [ 59.164738] __dev_printk+0x1ed/0x215 [ 59.164739] _dev_info+0xdc/0x10e [ 59.164741] ? _dev_notice+0x10e/0x10e [ 59.164743] ? refcount_inc_checked+0x1d/0x60 [ 59.164745] ? usb_string+0x3ad/0x510 [ 59.164747] vub300_probe+0x25e/0xd80 [ 59.164749] ? __pm_runtime_set_status+0x703/0xa10 [ 59.164750] ? mark_held_locks+0xe0/0xe0 [ 59.164752] ? mmc_signal_sdio_irq+0xf0/0xf0 [ 59.164754] ? mark_held_locks+0x9f/0xe0 [ 59.164756] ? find_held_lock+0x2d/0x110 [ 59.164758] ? usb_probe_interface+0x5fe/0x820 [ 59.164760] ? mark_held_locks+0x9f/0xe0 [ 59.164762] ? _raw_spin_unlock_irqrestore+0x4b/0x60 [ 59.164764] usb_probe_interface+0x31d/0x820 [ 59.164765] ? usb_probe_device+0x150/0x150 [ 59.164767] really_probe+0x2da/0xb10 [ 59.164769] driver_probe_device+0x21d/0x350 [ 59.164771] __device_attach_driver+0x1d8/0x290 [ 59.164773] ? driver_allows_async_probing+0x160/0x160 [ 59.164775] bus_for_each_drv+0x163/0x1e0 [ 59.164777] ? bus_rescan_devices+0x30/0x30 [ 59.164779] ? _raw_spin_unlock_irqrestore+0x4b/0x60 [ 59.164781] ? lockdep_hardirqs_on+0x37e/0x580 [ 59.164783] __device_attach+0x223/0x3a0 [ 59.164785] ? device_bind_driver+0xe0/0xe0 [ 59.164787] ? kobject_uevent_env+0x295/0x13d0 [ 59.164788] bus_probe_device+0x1f1/0x2a0 [ 59.164791] ? blocking_notifier_call_chain+0x59/0xb0 [ 59.164792] device_add+0xad2/0x16e0 [ 59.164794] ? get_device_parent.isra.0+0x560/0x560 [ 59.164797] ? _raw_spin_unlock_irqrestore+0x4b/0x60 [ 59.164799] usb_set_configuration+0xdf7/0x1740 [ 59.164800] generic_probe+0xa2/0xda [ 59.164802] usb_probe_device+0xc0/0x150 [ 59.164804] ? usb_suspend+0x5f0/0x5f0 [ 59.164805] really_probe+0x2da/0xb10 [ 59.164807] driver_probe_device+0x21d/0x350 [ 59.164809] __device_attach_driver+0x1d8/0x290 [ 59.164811] ? driver_allows_async_probing+0x160/0x160 [ 59.164813] bus_for_each_drv+0x163/0x1e0 [ 59.164815] ? bus_rescan_devices+0x30/0x30 [ 59.164817] ? _raw_spin_unlock_irqrestore+0x4b/0x60 [ 59.164819] ? lockdep_hardirqs_on+0x37e/0x580 [ 59.164821] __device_attach+0x223/0x3a0 [ 59.164823] ? device_bind_driver+0xe0/0xe0 [ 59.164825] ? kobject_uevent_env+0x295/0x13d0 [ 59.164827] bus_probe_device+0x1f1/0x2a0 [ 59.164829] ? blocking_notifier_call_chain+0x59/0xb0 [ 59.164830] device_add+0xad2/0x16e0 [ 59.164833] ? get_device_parent.isra.0+0x560/0x560 [ 59.164834] usb_new_device.cold+0x537/0xccf [ 59.164836] hub_event+0x138e/0x3b00 [ 59.164838] ? hub_port_debounce+0x350/0x350 [ 59.164840] ? _raw_spin_unlock_irq+0x29/0x40 [ 59.164842] process_one_work+0x90f/0x1580 [ 59.164844] ? wq_pool_ids_show+0x300/0x300 [ 59.164845] ? do_raw_spin_lock+0x11f/0x290 [ 59.164847] worker_thread+0x9b/0xe20 [ 59.164849] ? process_one_work+0x1580/0x1580 [ 59.164851] kthread+0x313/0x420 [ 59.164852] ? kthread_park+0x1a0/0x1a0 [ 59.164854] ret_from_fork+0x3a/0x50 [ 59.164856] Kernel Offset: disabled