[info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 14.238241][ T1662] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. [ 14.462675][ C1] random: crng init done Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.71' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 21.103991][ T21] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 21.344004][ T21] usb 1-1: Using ep0 maxpacket: 32 [ 21.504048][ T21] usb 1-1: unable to get BOS descriptor or descriptor too short [ 21.584157][ T21] usb 1-1: config 129 has an invalid interface number: 129 but max is 0 [ 21.592568][ T21] usb 1-1: config 129 has no interface number 0 [ 21.598898][ T21] usb 1-1: config 129 interface 129 altsetting 1 has an invalid endpoint with address 0x80, skipping [ 21.609776][ T21] usb 1-1: config 129 interface 129 altsetting 1 endpoint 0xB has invalid maxpacket 543, setting to 64 [ 21.620813][ T21] usb 1-1: config 129 interface 129 altsetting 1 endpoint 0x7 has invalid maxpacket 707, setting to 64 [ 21.631837][ T21] usb 1-1: config 129 interface 129 altsetting 1 endpoint 0xD has invalid maxpacket 557, setting to 64 [ 21.642883][ T21] usb 1-1: config 129 interface 129 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 414 [ 21.653039][ T21] usb 1-1: config 129 interface 129 altsetting 1 has an invalid endpoint descriptor of length 2, skipping [ 21.664332][ T21] usb 1-1: config 129 interface 129 altsetting 1 has a duplicate endpoint with address 0x3, skipping [ 21.675302][ T21] usb 1-1: config 129 interface 129 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 977 [ 21.685722][ T21] usb 1-1: config 129 interface 129 altsetting 1 has 8 endpoint descriptors, different from the interface descriptor's value: 7 [ 21.698958][ T21] usb 1-1: config 129 interface 129 has no altsetting 0 [ 21.944054][ T21] usb 1-1: string descriptor 0 read error: -22 [ 21.950281][ T21] usb 1-1: New USB device found, idVendor=1618, idProduct=9113, bcdDevice=25.de [ 21.959345][ T21] usb 1-1: New USB device strings: Mfr=3, Product=0, SerialNumber=9 [ 22.007242][ T21] rsi_91x: rsi_probe: Failed to init usb interface [ 22.014735][ T21] ================================================================== [ 22.022890][ T21] BUG: KASAN: double-free or invalid-free in rsi_91x_deinit+0x270/0x2f0 [ 22.031181][ T21] [ 22.033488][ T21] CPU: 1 PID: 21 Comm: kworker/1:1 Not tainted 5.3.0-rc5+ #28 [ 22.041306][ T21] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 22.051341][ T21] Workqueue: usb_hub_wq hub_event [ 22.056333][ T21] Call Trace: [ 22.059606][ T21] dump_stack+0xca/0x13e [ 22.063825][ T21] print_address_description+0x6a/0x32c [ 22.069345][ T21] ? rsi_91x_deinit+0x270/0x2f0 [ 22.074164][ T21] kasan_report_invalid_free+0x61/0xa0 [ 22.079594][ T21] ? rsi_91x_deinit+0x270/0x2f0 [ 22.084416][ T21] __kasan_slab_free+0x162/0x180 [ 22.089320][ T21] ? rsi_91x_deinit+0x270/0x2f0 [ 22.094142][ T21] kfree+0xe4/0x2f0 [ 22.097921][ T21] rsi_91x_deinit+0x270/0x2f0 [ 22.102607][ T21] rsi_probe+0xcec/0x15a0 [ 22.107001][ T21] ? rsi_disconnect+0x630/0x630 [ 22.111824][ T21] ? lockdep_hardirqs_on+0x379/0x580 [ 22.117079][ T21] ? __pm_runtime_resume+0x111/0x180 [ 22.122334][ T21] usb_probe_interface+0x305/0x7a0 [ 22.127413][ T21] ? usb_probe_device+0x100/0x100 [ 22.132407][ T21] really_probe+0x281/0x6d0 [ 22.136880][ T21] driver_probe_device+0x101/0x1b0 [ 22.141961][ T21] __device_attach_driver+0x1c2/0x220 [ 22.147305][ T21] ? driver_allows_async_probing+0x160/0x160 [ 22.153255][ T21] bus_for_each_drv+0x162/0x1e0 [ 22.158081][ T21] ? bus_rescan_devices+0x20/0x20 [ 22.163078][ T21] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 22.168886][ T21] ? lockdep_hardirqs_on+0x379/0x580 [ 22.174146][ T21] __device_attach+0x217/0x360 [ 22.178881][ T21] ? device_bind_driver+0xd0/0xd0 [ 22.183879][ T21] ? kobject_uevent_env+0x29e/0x1160 [ 22.189135][ T21] ? kobject_uevent_env+0x2a8/0x1160 [ 22.194388][ T21] bus_probe_device+0x1e4/0x290 [ 22.199214][ T21] ? blocking_notifier_call_chain+0x54/0xa0 [ 22.205078][ T21] device_add+0xae6/0x16f0 [ 22.209463][ T21] ? uevent_store+0x50/0x50 [ 22.213959][ T21] usb_set_configuration+0xdf6/0x1670 [ 22.219303][ T21] generic_probe+0x9d/0xd5 [ 22.223688][ T21] usb_probe_device+0x99/0x100 [ 22.228420][ T21] ? usb_suspend+0x620/0x620 [ 22.232979][ T21] really_probe+0x281/0x6d0 [ 22.237454][ T21] driver_probe_device+0x101/0x1b0 [ 22.242535][ T21] __device_attach_driver+0x1c2/0x220 [ 22.247878][ T21] ? driver_allows_async_probing+0x160/0x160 [ 22.253829][ T21] bus_for_each_drv+0x162/0x1e0 [ 22.258653][ T21] ? bus_rescan_devices+0x20/0x20 [ 22.263649][ T21] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 22.269424][ T21] ? lockdep_hardirqs_on+0x379/0x580 [ 22.274680][ T21] __device_attach+0x217/0x360 [ 22.279416][ T21] ? device_bind_driver+0xd0/0xd0 [ 22.284410][ T21] ? kobject_uevent_env+0x29e/0x1160 [ 22.289664][ T21] ? kobject_uevent_env+0x2a8/0x1160 [ 22.294932][ T21] bus_probe_device+0x1e4/0x290 [ 22.299783][ T21] ? blocking_notifier_call_chain+0x54/0xa0 [ 22.305642][ T21] device_add+0xae6/0x16f0 [ 22.310027][ T21] ? uevent_store+0x50/0x50 [ 22.314515][ T21] usb_new_device.cold+0x6a4/0xe79 [ 22.319598][ T21] hub_event+0x1b5c/0x3640 [ 22.323987][ T21] ? hub_port_debounce+0x260/0x260 [ 22.329082][ T21] process_one_work+0x92b/0x1530 [ 22.333994][ T21] ? pwq_dec_nr_in_flight+0x310/0x310 [ 22.339333][ T21] ? do_raw_spin_lock+0x11a/0x280 [ 22.344328][ T21] worker_thread+0x96/0xe20 [ 22.348802][ T21] ? process_one_work+0x1530/0x1530 [ 22.353972][ T21] kthread+0x318/0x420 [ 22.358014][ T21] ? kthread_create_on_node+0xf0/0xf0 [ 22.363356][ T21] ret_from_fork+0x24/0x30 [ 22.367740][ T21] [ 22.370041][ T21] Allocated by task 21: [ 22.374167][ T21] save_stack+0x1b/0x80 [ 22.378294][ T21] __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 22.383898][ T21] rsi_probe+0x11a/0x15a0 [ 22.388198][ T21] usb_probe_interface+0x305/0x7a0 [ 22.393364][ T21] really_probe+0x281/0x6d0 [ 22.397839][ T21] driver_probe_device+0x101/0x1b0 [ 22.402918][ T21] __device_attach_driver+0x1c2/0x220 [ 22.408270][ T21] bus_for_each_drv+0x162/0x1e0 [ 22.413087][ T21] __device_attach+0x217/0x360 [ 22.417836][ T21] bus_probe_device+0x1e4/0x290 [ 22.422655][ T21] device_add+0xae6/0x16f0 [ 22.427042][ T21] usb_set_configuration+0xdf6/0x1670 [ 22.432382][ T21] generic_probe+0x9d/0xd5 [ 22.436768][ T21] usb_probe_device+0x99/0x100 [ 22.441502][ T21] really_probe+0x281/0x6d0 [ 22.445976][ T21] driver_probe_device+0x101/0x1b0 [ 22.451054][ T21] __device_attach_driver+0x1c2/0x220 [ 22.456399][ T21] bus_for_each_drv+0x162/0x1e0 [ 22.461219][ T21] __device_attach+0x217/0x360 [ 22.465952][ T21] bus_probe_device+0x1e4/0x290 [ 22.470802][ T21] device_add+0xae6/0x16f0 [ 22.475187][ T21] usb_new_device.cold+0x6a4/0xe79 [ 22.480269][ T21] hub_event+0x1b5c/0x3640 [ 22.484653][ T21] process_one_work+0x92b/0x1530 [ 22.489560][ T21] worker_thread+0x96/0xe20 [ 22.494032][ T21] kthread+0x318/0x420 [ 22.498095][ T21] ret_from_fork+0x24/0x30 [ 22.502477][ T21] [ 22.504781][ T21] Freed by task 21: [ 22.508558][ T21] save_stack+0x1b/0x80 [ 22.512693][ T21] __kasan_slab_free+0x130/0x180 [ 22.517600][ T21] kfree+0xe4/0x2f0 [ 22.521398][ T21] rsi_probe+0xdfd/0x15a0 [ 22.525697][ T21] usb_probe_interface+0x305/0x7a0 [ 22.530775][ T21] really_probe+0x281/0x6d0 [ 22.535248][ T21] driver_probe_device+0x101/0x1b0 [ 22.540326][ T21] __device_attach_driver+0x1c2/0x220 [ 22.545669][ T21] bus_for_each_drv+0x162/0x1e0 [ 22.550490][ T21] __device_attach+0x217/0x360 [ 22.555221][ T21] bus_probe_device+0x1e4/0x290 [ 22.560040][ T21] device_add+0xae6/0x16f0 [ 22.564440][ T21] usb_set_configuration+0xdf6/0x1670 [ 22.569799][ T21] generic_probe+0x9d/0xd5 [ 22.574186][ T21] usb_probe_device+0x99/0x100 [ 22.578918][ T21] really_probe+0x281/0x6d0 [ 22.583390][ T21] driver_probe_device+0x101/0x1b0 [ 22.588471][ T21] __device_attach_driver+0x1c2/0x220 [ 22.593813][ T21] bus_for_each_drv+0x162/0x1e0 [ 22.598634][ T21] __device_attach+0x217/0x360 [ 22.603364][ T21] bus_probe_device+0x1e4/0x290 [ 22.608185][ T21] device_add+0xae6/0x16f0 [ 22.612572][ T21] usb_new_device.cold+0x6a4/0xe79 [ 22.617655][ T21] hub_event+0x1b5c/0x3640 [ 22.622041][ T21] process_one_work+0x92b/0x1530 [ 22.626947][ T21] worker_thread+0x96/0xe20 [ 22.631421][ T21] kthread+0x318/0x420 [ 22.635465][ T21] ret_from_fork+0x24/0x30 [ 22.639846][ T21] [ 22.642146][ T21] The buggy address belongs to the object at ffff8881d2fc3b80 [ 22.642146][ T21] which belongs to the cache kmalloc-512 of size 512 [ 22.656166][ T21] The buggy address is located 0 bytes inside of [ 22.656166][ T21] 512-byte region [ffff8881d2fc3b80, ffff8881d2fc3d80) [ 22.669316][ T21] The buggy address belongs to the page: [ 22.674920][ T21] page:ffffea00074bf080 refcount:1 mapcount:0 mapping:ffff8881da002500 index:0x0 compound_mapcount: 0 [ 22.685818][ T21] flags: 0x200000000010200(slab|head) [ 22.691165][ T21] raw: 0200000000010200 dead000000000100 dead000000000122 ffff8881da002500 [ 22.699718][ T21] raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 [ 22.708267][ T21] page dumped because: kasan: bad access detected [ 22.714646][ T21] [ 22.716944][ T21] Memory state around the buggy address: [ 22.722543][ T21] ffff8881d2fc3a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.730575][ T21] ffff8881d2fc3b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.738612][ T21] >ffff8881d2fc3b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.746642][ T21] ^ [ 22.750680][ T21] ffff8881d2fc3c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.758723][ T21] f