Warning: Permanently added '10.128.1.9' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 23.711643][ T12] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 23.951632][ T12] usb 1-1: Using ep0 maxpacket: 8 [ 24.071710][ T12] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 24.082660][ T12] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 24.095604][ T12] usb 1-1: New USB device found, idVendor=046d, idProduct=c293, bcdDevice= 0.00 [ 24.104675][ T12] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 24.113934][ T12] usb 1-1: config 0 descriptor?? [ 24.593363][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.600577][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x2 [ 24.607747][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.614899][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.622062][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.629163][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.636312][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.643444][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.650541][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.657685][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.664811][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.671947][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.679051][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.686186][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.693328][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.700420][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.707563][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.714685][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.721820][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.728925][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.736068][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.743216][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.750301][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.757443][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.764576][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.771711][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.778822][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.786027][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 executing program [ 24.793225][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.800363][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.807511][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.814683][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.821816][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.828918][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.836111][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.843462][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.850562][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.857967][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.865101][ T12] logitech 0003:046D:C293.0001: unknown main item tag 0x0 [ 24.873632][ T12] logitech 0003:046D:C293.0001: hidraw0: USB HID v0.00 Device [HID 046d:c293] on usb-dummy_hcd.0-1/input0 [ 24.884958][ T12] logitech 0003:046D:C293.0001: not enough fields in HID_OUTPUT_REPORT 0 [ 24.893496][ T12] logitech: probe of 0003:046D:C293.0001 failed with error -1 [ 24.902529][ T12] usb 1-1: USB disconnect, device number 2 [ 25.271597][ T12] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 25.511616][ T12] usb 1-1: Using ep0 maxpacket: 8 [ 25.631718][ T12] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 25.642605][ T12] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 25.655427][ T12] usb 1-1: New USB device found, idVendor=046d, idProduct=c293, bcdDevice= 0.00 [ 25.664471][ T12] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 25.673342][ T12] usb 1-1: config 0 descriptor?? [ 26.143135][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.150299][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x2 [ 26.157476][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.164617][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.171765][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.178886][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.186052][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.193192][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.200306][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.207439][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.214603][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.221736][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.228842][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.236017][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.243162][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.250290][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.257417][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.264559][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.271703][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.278813][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.285964][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.293097][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.300186][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.307322][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.314461][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.321615][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.328742][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.335886][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.343150][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.343397][ T1726] ================================================================== [ 26.350262][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.358348][ T1726] BUG: KASAN: use-after-free in usbhid_power+0xca/0xe0 [ 26.358358][ T1726] Read of size 8 at addr ffff8881d29e0008 by task syz-executor286/1726 [ 26.358361][ T1726] [ 26.358373][ T1726] CPU: 1 PID: 1726 Comm: syz-executor286 Not tainted 5.3.0-rc4+ #26 [ 26.358379][ T1726] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 26.358384][ T1726] Call Trace: [ 26.358398][ T1726] dump_stack+0xca/0x13e [ 26.358413][ T1726] ? usbhid_power+0xca/0xe0 [ 26.365531][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.372323][ T1726] ? usbhid_power+0xca/0xe0 [ 26.372337][ T1726] print_address_description+0x6a/0x32c [ 26.372348][ T1726] ? usbhid_power+0xca/0xe0 [ 26.372359][ T1726] ? usbhid_power+0xca/0xe0 [ 26.372375][ T1726] __kasan_report.cold+0x1a/0x33 [ 26.380600][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.382918][ T1726] ? usbhid_power+0xca/0xe0 [ 26.382930][ T1726] kasan_report+0xe/0x12 [ 26.382941][ T1726] usbhid_power+0xca/0xe0 [ 26.382952][ T1726] hidraw_open+0x20d/0x740 [ 26.382962][ T1726] ? usbhid_output_report+0x290/0x290 [ 26.382986][ T1726] ? hidraw_ioctl+0xae0/0xae0 [ 26.382998][ T1726] chrdev_open+0x219/0x5c0 [ 26.383015][ T1726] ? cdev_put.part.0+0x50/0x50 [ 26.390972][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.401005][ T1726] do_dentry_open+0x494/0x1120 [ 26.401018][ T1726] ? cdev_put.part.0+0x50/0x50 [ 26.401031][ T1726] ? chmod_common+0x3c0/0x3c0 [ 26.401047][ T1726] ? inode_permission+0xbe/0x3a0 [ 26.404387][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.408555][ T1726] path_openat+0x1430/0x3f50 [ 26.413070][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.420129][ T1726] ? save_stack+0x1b/0x80 [ 26.424660][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.430150][ T1726] ? do_sys_open+0x294/0x580 [ 26.434677][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.439110][ T1726] ? do_syscall_64+0xb7/0x580 [ 26.439127][ T1726] ? path_lookupat.isra.0+0x8d0/0x8d0 [ 26.444078][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.451143][ T1726] ? __lock_acquire+0x145e/0x3b50 [ 26.455655][ T12] logitech 0003:046D:C293.0002: unknown main item tag 0x0 [ 26.459847][ T1726] do_filp_open+0x1a1/0x280 [ 26.589129][ T1726] ? may_open_dev+0xf0/0xf0 [ 26.593606][ T1726] ? __alloc_fd+0x46d/0x600 [ 26.598104][ T1726] ? do_raw_spin_lock+0x11a/0x280 [ 26.603098][ T1726] ? do_raw_spin_unlock+0x50/0x220 [ 26.608178][ T1726] ? _raw_spin_unlock+0x1f/0x30 [ 26.612997][ T1726] ? __alloc_fd+0x46d/0x600 [ 26.617485][ T1726] do_sys_open+0x3c0/0x580 [ 26.621886][ T1726] ? filp_open+0x70/0x70 [ 26.626097][ T1726] ? trace_hardirqs_off_caller+0x55/0x1e0 [ 26.631793][ T1726] do_syscall_64+0xb7/0x580 [ 26.636266][ T1726] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 26.642128][ T1726] RIP: 0033:0x4019f0 [ 26.645993][ T1726] Code: 01 f0 ff ff 0f 83 c0 0b 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 83 3d dd 5c 2d 00 00 75 14 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 94 0b 00 00 c3 48 83 ec 08 e8 fa 00 00 00 [ 26.665565][ T1726] RSP: 002b:00007ffd346f43e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 26.673960][ T1726] RAX: ffffffffffffffda RBX: 00000000000017de RCX: 00000000004019f0 [ 26.681900][ T1726] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007ffd346f43f0 [ 26.689837][ T1726] RBP: 6666666666666667 R08: 000000000000000f R09: 0000000000000000 [ 26.697780][ T1726] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000402a10 [ 26.705721][ T1726] R13: 0000000000402aa0 R14: 0000000000000000 R15: 0000000000000000 [ 26.713660][ T1726] [ 26.715959][ T1726] Allocated by task 12: [ 26.720115][ T1726] save_stack+0x1b/0x80 [ 26.724240][ T1726] __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 26.729841][ T1726] __kmalloc_node_track_caller+0xfc/0x380 [ 26.735535][ T1726] __kmalloc_reserve.isra.0+0x39/0xe0 [ 26.740887][ T1726] __alloc_skb+0xef/0x5a0 [ 26.745184][ T1726] alloc_uevent_skb+0x7b/0x210 [ 26.749916][ T1726] kobject_uevent_env+0x8ee/0x1160 [ 26.755000][ T1726] device_release_driver_internal+0x3ef/0x500 [ 26.761036][ T1726] bus_remove_device+0x2dc/0x4a0 [ 26.765938][ T1726] device_del+0x420/0xb10 [ 26.770239][ T1726] usb_disable_device+0x211/0x690 [ 26.775236][ T1726] usb_disconnect+0x284/0x8d0 [ 26.779880][ T1726] hub_event+0x1454/0x3640 [ 26.784265][ T1726] process_one_work+0x92b/0x1530 [ 26.789172][ T1726] worker_thread+0x7ab/0xe20 [ 26.793736][ T1726] kthread+0x318/0x420 [ 26.797779][ T1726] ret_from_fork+0x24/0x30 [ 26.802163][ T1726] [ 26.804477][ T1726] Freed by task 239: [ 26.808345][ T1726] save_stack+0x1b/0x80 [ 26.812476][ T1726] __kasan_slab_free+0x130/0x180 [ 26.817394][ T1726] kfree+0xe4/0x2f0 [ 26.821172][ T1726] skb_free_head+0x8b/0xa0 [ 26.825557][ T1726] skb_release_data+0x41f/0x7c0 [ 26.830387][ T1726] skb_release_all+0x46/0x60 [ 26.834963][ T1726] consume_skb+0xd9/0x320 [ 26.839262][ T1726] skb_free_datagram+0x16/0xf0 [ 26.843997][ T1726] netlink_recvmsg+0x65e/0xee0 [ 26.848732][ T1726] sock_recvmsg+0xca/0x110 [ 26.853121][ T1726] ___sys_recvmsg+0x271/0x5a0 [ 26.857770][ T1726] __sys_recvmsg+0xe9/0x1b0 [ 26.862242][ T1726] do_syscall_64+0xb7/0x580 [ 26.866715][ T1726] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 26.872575][ T1726] [ 26.874877][ T1726] The buggy address belongs to the object at ffff8881d29e0000 [ 26.874877][ T1726] which belongs to the cache kmalloc-1k of size 1024 [ 26.888898][ T1726] The buggy address is located 8 bytes inside of [ 26.888898][ T1726] 1024-byte region [ffff8881d29e0000, ffff8881d29e0400) [ 26.902050][ T1726] The buggy address belongs to the page: [ 26.907651][ T1726] page:ffffea00074a7800 refcount:1 mapcount:0 mapping:ffff8881da002280 index:0x0 compound_mapcount: 0 [ 26.918549][ T1726] flags: 0x200000000010200(slab|head) [ 26.923895][ T1726] raw: 0200000000010200 dead000000000100 dead000000000122 ffff8881da002280 [ 26.932450][ T1726] raw: 0000000000000000 00000000000e000e 00000001ffffffff 0000000000000000 [ 26.941000][ T1726] page dumped because: kasan: bad access detected [ 26.947378][ T1726] [ 26.949677][ T1726] Memory state around the buggy address: [ 26.955294][ T1726] ffff8881d29dff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.963325][ T1726] ffff8881d29dff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.971361][ T1726] >ffff8881d29e0000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.979392][ T1726] ^ [ 26.983707][ T1726] ffff8881d29e0080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.991739][ T1726] ffff8881d29e0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.999768][ T1726] ================================================================== [ 27.007800][ T1726] Disabling lock debugging due to kernel taint [ 27.014066][ T1726] Kernel panic - not syncing: panic_on_warn set ... [ 27.020662][ T1726] CPU: 1 PID: 1726 Comm: syz-executor286 Tainted: G B 5.3.0-rc4+ #26 [ 27.029999][ T1726] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.040036][ T1726] Call Trace: [ 27.043300][ T1726] dump_stack+0xca/0x13e [ 27.047536][ T1726] panic+0x2a3/0x6da [ 27.051406][ T1726] ? add_taint.cold+0x16/0x16 [ 27.056057][ T1726] ? retint_kernel+0x10/0x10 [ 27.060621][ T1726] ? trace_hardirqs_on+0x55/0x1e0 [ 27.065621][ T1726] ? usbhid_power+0xca/0xe0 [ 27.070098][ T1726] end_report+0x43/0x49 [ 27.074231][ T1726] ? usbhid_power+0xca/0xe0 [ 27.078703][ T1726] __kasan_report.cold+0xd/0x33 [ 27.083521][ T1726] ? usbhid_power+0xca/0xe0 [ 27.087991][ T1726] kasan_report+0xe/0x12 [ 27.092207][ T1726] usbhid_power+0xca/0xe0 [ 27.096512][ T1726] hidraw_open+0x20d/0x740 [ 27.100901][ T1726] ? usbhid_output_report+0x290/0x290 [ 27.106245][ T1726] ? hidraw_ioctl+0xae0/0xae0 [ 27.110894][ T1726] chrdev_open+0x219/0x5c0 [ 27.115299][ T1726] ? cdev_put.part.0+0x50/0x50 [ 27.120034][ T1726] do_dentry_open+0x494/0x1120 [ 27.124768][ T1726] ? cdev_put.part.0+0x50/0x50 [ 27.129502][ T1726] ? chmod_common+0x3c0/0x3c0 [ 27.134152][ T1726] ? inode_permission+0xbe/0x3a0 [ 27.139059][ T1726] path_openat+0x1430/0x3f50 [ 27.143619][ T1726] ? save_stack+0x1b/0x80 [ 27.147940][ T1726] ? do_sys_open+0x294/0x580 [ 27.152511][ T1726] ? do_syscall_64+0xb7/0x580 [ 27.157159][ T1726] ? path_lookupat.isra.0+0x8d0/0x8d0 [ 27.162503][ T1726] ? __lock_acquire+0x145e/0x3b50 [ 27.167499][ T1726] do_filp_open+0x1a1/0x280 [ 27.171977][ T1726] ? may_open_dev+0xf0/0xf0 [ 27.176457][ T1726] ? __alloc_fd+0x46d/0x600 [ 27.180931][ T1726] ? do_raw_spin_lock+0x11a/0x280 [ 27.185926][ T1726] ? do_raw_spin_unlock+0x50/0x220 [ 27.191011][ T1726] ? _raw_spin_unlock+0x1f/0x30 [ 27.195830][ T1726] ? __alloc_fd+0x46d/0x600 [ 27.200311][ T1726] do_sys_open+0x3c0/0x580 [ 27.204723][ T1726] ? filp_open+0x70/0x70 [ 27.208967][ T1726] ? trace_hardirqs_off_caller+0x55/0x1e0 [ 27.214659][ T1726] do_syscall_64+0xb7/0x580 [ 27.219136][ T1726] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 27.225001][ T1726] RIP: 0033:0x4019f0 [ 27.228872][ T1726] Code: 01 f0 ff ff 0f 83 c0 0b 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 83 3d dd 5c 2d 00 00 75 14 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 94 0b 00 00 c3 48 83 ec 08 e8 fa 00 00 00 [ 27.248448][ T1726] RSP: 002b:00007ffd346f43e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 27.256841][ T1726] RAX: ffffffffffffffda RBX: 00000000000017de RCX: 00000000004019f0 [ 27.264788][ T1726] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007ffd346f43f0 [ 27.272728][ T1726] RBP: 6666666666666667 R08: 000000000000000f R09: 0000000000000000 [ 27.280679][ T1726] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000402a10 [ 27.288654][ T1726] R13: 0000000000402aa0 R14: 0000000000000000 R15: 0000000000000000 [ 27.296929][ T1726] Kernel Offset: disabled [ 27.301258][ T1726] Rebooting in 86400 seconds..