[[36minfo[39;49m] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
[ 14.922129][ C1] random: crng init done
[....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
Debian GNU/Linux 7 syzkaller ttyS0
Warning: Permanently added '10.128.0.131' (ECDSA) to the list of known hosts.
executing program
syzkaller login: [ 49.003369][ T102] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[ 49.243324][ T102] usb 1-1: Using ep0 maxpacket: 32
[ 49.363530][ T102] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0
[ 49.373305][ T102] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 173, changing to 11
[ 49.384685][ T102] usb 1-1: config 0 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4
[ 49.397583][ T102] usb 1-1: New USB device found, idVendor=1509, idProduct=9242, bcdDevice=fb.5c
[ 49.406620][ T102] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 49.415892][ T102] usb 1-1: config 0 descriptor??
[ 49.455534][ T102] Registered IR keymap rc-rc6-mce
[ 49.503303][ T102] rc_core: Loaded IR protocol module ir-rc6-decoder, but protocol rc-6 still not available
[ 49.513680][ T102] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[ 49.543323][ T102] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[ 49.574178][ T102] rc rc0: Media Center Ed. eHome Infrared Remote Transceiver (1509:9242) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0
[ 49.588329][ T102] input: Media Center Ed. eHome Infrared Remote Transceiver (1509:9242) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input5
[ 49.604497][ T102] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[ 49.633340][ T102] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[ 49.663288][ C0] mceusb 1-1:0.0: short-range (0x2) receiver active
[ 49.669976][ C0] mceusb 1-1:0.0: long-range (0xe9) receiver active
[ 49.676658][ C0] ==================================================================
[ 49.684756][ C0] BUG: KASAN: slab-out-of-bounds in mceusb_dev_recv+0x101e/0x12e0
[ 49.692530][ C0] Read of size 1 at addr ffff8881d54a3100 by task swapper/0/0
[ 49.699973][ C0]
[ 49.702284][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.3.0+ #0
[ 49.709012][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 49.719040][ C0] Call Trace:
[ 49.722300][ C0]
[ 49.725141][ C0] dump_stack+0xca/0x13e
[ 49.729359][ C0] ? mceusb_dev_recv+0x101e/0x12e0
[ 49.734444][ C0] ? mceusb_dev_recv+0x101e/0x12e0
[ 49.739529][ C0] print_address_description+0x6a/0x32c
[ 49.745057][ C0] ? mceusb_dev_recv+0x101e/0x12e0
[ 49.750151][ C0] ? mceusb_dev_recv+0x101e/0x12e0
[ 49.755236][ C0] __kasan_report.cold+0x1a/0x33
[ 49.760493][ C0] ? ir_raw_event_store_with_filter+0x1b0/0x580
[ 49.766704][ C0] ? mceusb_dev_recv+0x101e/0x12e0
[ 49.771787][ C0] kasan_report+0xe/0x12
[ 49.776015][ C0] mceusb_dev_recv+0x101e/0x12e0
[ 49.780925][ C0] ? mce_write_callback+0x50/0x50
[ 49.785924][ C0] ? do_raw_read_unlock+0x3b/0x70
[ 49.790924][ C0] ? _raw_read_unlock+0x1f/0x30
[ 49.795747][ C0] __usb_hcd_giveback_urb+0x1f2/0x470
[ 49.801090][ C0] usb_hcd_giveback_urb+0x368/0x420
[ 49.806260][ C0] dummy_timer+0x120f/0x2fa2
[ 49.810834][ C0] ? dummy_udc_probe+0x930/0x930
[ 49.815746][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 49.821263][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 49.826521][ C0] call_timer_fn+0x179/0x650
[ 49.831082][ C0] ? dummy_udc_probe+0x930/0x930
[ 49.836001][ C0] ? msleep_interruptible+0x130/0x130
[ 49.841430][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 49.846947][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 49.852206][ C0] ? _raw_spin_unlock_irq+0x24/0x30
[ 49.857381][ C0] ? dummy_udc_probe+0x930/0x930
[ 49.862289][ C0] run_timer_softirq+0x5e0/0x14d0
[ 49.867286][ C0] ? add_timer+0x7a0/0x7a0
[ 49.871676][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 49.877200][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 49.882459][ C0] __do_softirq+0x221/0x912
[ 49.886959][ C0] irq_exit+0x178/0x1a0
[ 49.891089][ C0] smp_apic_timer_interrupt+0x12f/0x500
[ 49.896617][ C0] apic_timer_interrupt+0xf/0x20
[ 49.901525][ C0]
[ 49.904450][ C0] RIP: 0010:default_idle+0x28/0x2e0
[ 49.909626][ C0] Code: 90 90 41 56 41 55 65 44 8b 2d 94 9d 90 7a 41 54 55 53 0f 1f 44 00 00 e8 36 71 d2 fb e9 07 00 00 00 0f 00 2d ca 43 51 00 fb f4 <65> 44 8b 2d 70 9d 90 7a 0f 1f 44 00 00 5b 5d 41 5c 41 5d 41 5e c3
[ 49.929205][ C0] RSP: 0018:ffffffff86c07da8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
[ 49.937602][ C0] RAX: 0000000000000007 RBX: ffffffff86c2b200 RCX: 0000000000000000
[ 49.945556][ C0] RDX: 0000000000000000 RSI: 0000000000000006 RDI: ffffffff86c2ba4c
[ 49.953501][ C0] RBP: fffffbfff0d85640 R08: ffffffff86c2b200 R09: 0000000000000000
[ 49.961458][ C0] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[ 49.969421][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 49.977406][ C0] ? default_idle+0x1a/0x2e0
[ 49.981979][ C0] do_idle+0x3b6/0x500
[ 49.986639][ C0] ? arch_cpu_idle_exit+0x40/0x40
[ 49.991730][ C0] ? schedule+0xde/0x250
[ 49.995953][ C0] cpu_startup_entry+0x14/0x20
[ 50.000712][ C0] start_kernel+0x838/0x872
[ 50.005191][ C0] ? mem_encrypt_init+0x5/0x5
[ 50.009846][ C0] ? x86_family+0x3d/0x50
[ 50.014149][ C0] ? load_ucode_bsp+0x23d/0x27d
[ 50.018983][ C0] secondary_startup_64+0xa4/0xb0
[ 50.023986][ C0]
[ 50.026308][ C0] Allocated by task 102:
[ 50.030530][ C0] save_stack+0x1b/0x80
[ 50.034671][ C0] __kasan_kmalloc.constprop.0+0xbf/0xd0
[ 50.040274][ C0] hcd_buffer_alloc+0x1ed/0x290
[ 50.045114][ C0] usb_alloc_coherent+0x5d/0x80
[ 50.049950][ C0] mceusb_dev_probe+0x714/0x2f51
[ 50.054860][ C0] usb_probe_interface+0x305/0x7a0
[ 50.059954][ C0] really_probe+0x281/0x6d0
[ 50.064429][ C0] driver_probe_device+0x101/0x1b0
[ 50.069511][ C0] __device_attach_driver+0x1c2/0x220
[ 50.074852][ C0] bus_for_each_drv+0x162/0x1e0
[ 50.079684][ C0] __device_attach+0x217/0x360
[ 50.084418][ C0] bus_probe_device+0x1e4/0x290
[ 50.089242][ C0] device_add+0xae6/0x16f0
[ 50.093642][ C0] usb_set_configuration+0xdf6/0x1670
[ 50.098986][ C0] generic_probe+0x9d/0xd5
[ 50.103375][ C0] usb_probe_device+0x99/0x100
[ 50.108120][ C0] really_probe+0x281/0x6d0
[ 50.112593][ C0] driver_probe_device+0x101/0x1b0
[ 50.117682][ C0] __device_attach_driver+0x1c2/0x220
[ 50.123042][ C0] bus_for_each_drv+0x162/0x1e0
[ 50.127886][ C0] __device_attach+0x217/0x360
[ 50.132645][ C0] bus_probe_device+0x1e4/0x290
[ 50.137482][ C0] device_add+0xae6/0x16f0
[ 50.141877][ C0] usb_new_device.cold+0x6a4/0xe79
[ 50.146963][ C0] hub_event+0x1b5c/0x3640
[ 50.151355][ C0] process_one_work+0x92b/0x1530
[ 50.156292][ C0] worker_thread+0x96/0xe20
[ 50.160766][ C0] kthread+0x318/0x420
[ 50.164812][ C0] ret_from_fork+0x24/0x30
[ 50.169198][ C0]
[ 50.171499][ C0] Freed by task 1:
[ 50.175201][ C0] save_stack+0x1b/0x80
[ 50.179328][ C0] __kasan_slab_free+0x130/0x180
[ 50.184245][ C0] kfree+0xe4/0x2f0
[ 50.188030][ C0] do_mount+0x69f/0x1af0
[ 50.192246][ C0] ksys_mount+0xd7/0x150
[ 50.196463][ C0] __x64_sys_mount+0xba/0x150
[ 50.201114][ C0] do_syscall_64+0xb7/0x580
[ 50.205650][ C0] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 50.211519][ C0]
[ 50.213871][ C0] The buggy address belongs to the object at ffff8881d54a3000
[ 50.213871][ C0] which belongs to the cache kmalloc-256 of size 256
[ 50.227910][ C0] The buggy address is located 0 bytes to the right of
[ 50.227910][ C0] 256-byte region [ffff8881d54a3000, ffff8881d54a3100)
[ 50.241717][ C0] The buggy address belongs to the page:
[ 50.247334][ C0] page:ffffea00075528c0 refcount:1 mapcount:0 mapping:ffff8881da002780 index:0x0
[ 50.256437][ C0] flags: 0x200000000000200(slab)
[ 50.261356][ C0] raw: 0200000000000200 dead000000000100 dead000000000122 ffff8881da002780
[ 50.269929][ C0] raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
[ 50.278485][ C0] page dumped because: kasan: bad access detected
[ 50.284872][ C0]
[ 50.287174][ C0] Memory state around the buggy address:
[ 50.292778][ C0] ffff8881d54a3000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 50.300817][ C0] ffff8881d54a3080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 50.308849][ C0] >ffff8881d54a3100: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
[ 50.316891][ C0] ^
[ 50.320933][ C0] ffff8881d54a3180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 50.328964][ C0] ffff8881d54a3200: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[ 50.337005][ C0] ==================================================================
[ 50.345036][ C0] Disabling lock debugging due to kernel taint
[ 50.351167][ C0] Kernel panic - not syncing: panic_on_warn set ...
[ 50.357727][ C0] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G B 5.3.0+ #0
[ 50.365843][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 50.375875][ C0] Call Trace:
[ 50.379135][ C0]
[ 50.381967][ C0] dump_stack+0xca/0x13e
[ 50.386182][ C0] panic+0x2a3/0x6da
[ 50.390048][ C0] ? add_taint.cold+0x16/0x16
[ 50.394701][ C0] ? print_shadow_for_address+0xb8/0x114
[ 50.400313][ C0] ? trace_hardirqs_off+0x50/0x1d0
[ 50.405410][ C0] ? mceusb_dev_recv+0x101e/0x12e0
[ 50.410667][ C0] end_report+0x43/0x49
[ 50.414802][ C0] ? mceusb_dev_recv+0x101e/0x12e0
[ 50.419885][ C0] __kasan_report.cold+0xd/0x33
[ 50.424707][ C0] ? ir_raw_event_store_with_filter+0x1b0/0x580
[ 50.430967][ C0] ? mceusb_dev_recv+0x101e/0x12e0
[ 50.436049][ C0] kasan_report+0xe/0x12
[ 50.440262][ C0] mceusb_dev_recv+0x101e/0x12e0
[ 50.445191][ C0] ? mce_write_callback+0x50/0x50
[ 50.450187][ C0] ? do_raw_read_unlock+0x3b/0x70
[ 50.455181][ C0] ? _raw_read_unlock+0x1f/0x30
[ 50.460005][ C0] __usb_hcd_giveback_urb+0x1f2/0x470
[ 50.465346][ C0] usb_hcd_giveback_urb+0x368/0x420
[ 50.470519][ C0] dummy_timer+0x120f/0x2fa2
[ 50.475080][ C0] ? dummy_udc_probe+0x930/0x930
[ 50.479990][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 50.485505][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 50.490760][ C0] call_timer_fn+0x179/0x650
[ 50.495323][ C0] ? dummy_udc_probe+0x930/0x930
[ 50.500243][ C0] ? msleep_interruptible+0x130/0x130
[ 50.505594][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 50.511110][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 50.516368][ C0] ? _raw_spin_unlock_irq+0x24/0x30
[ 50.521546][ C0] ? dummy_udc_probe+0x930/0x930
[ 50.526468][ C0] run_timer_softirq+0x5e0/0x14d0
[ 50.531463][ C0] ? add_timer+0x7a0/0x7a0
[ 50.535856][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 50.541369][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 50.546626][ C0] __do_softirq+0x221/0x912
[ 50.551103][ C0] irq_exit+0x178/0x1a0
[ 50.555231][ C0] smp_apic_timer_interrupt+0x12f/0x500
[ 50.560748][ C0] apic_timer_interrupt+0xf/0x20
[ 50.565654][ C0]
[ 50.568566][ C0] RIP: 0010:default_idle+0x28/0x2e0
[ 50.573738][ C0] Code: 90 90 41 56 41 55 65 44 8b 2d 94 9d 90 7a 41 54 55 53 0f 1f 44 00 00 e8 36 71 d2 fb e9 07 00 00 00 0f 00 2d ca 43 51 00 fb f4 <65> 44 8b 2d 70 9d 90 7a 0f 1f 44 00 00 5b 5d 41 5c 41 5d 41 5e c3
[ 50.593313][ C0] RSP: 0018:ffffffff86c07da8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
[ 50.601695][ C0] RAX: 0000000000000007 RBX: ffffffff86c2b200 RCX: 0000000000000000
[ 50.609697][ C0] RDX: 0000000000000000 RSI: 0000000000000006 RDI: ffffffff86c2ba4c
[ 50.617656][ C0] RBP: fffffbfff0d85640 R08: ffffffff86c2b200 R09: 0000000000000000
[ 50.625611][ C0] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[ 50.633560][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 50.641528][ C0] ? default_idle+0x1a/0x2e0
[ 50.646095][ C0] do_idle+0x3b6/0x500
[ 50.650159][ C0] ? arch_cpu_idle_exit+0x40/0x40
[ 50.655180][ C0] ? schedule+0xde/0x250
[ 50.659396][ C0] cpu_startup_entry+0x14/0x20
[ 50.664730][ C0] start_kernel+0x838/0x872
[ 50.669483][ C0] ? mem_encrypt_init+0x5/0x5
[ 50.674173][ C0] ? x86_family+0x3d/0x50
[ 50.678489][ C0] ? load_ucode_bsp+0x23d/0x27d
[ 50.683320][ C0] secondary_startup_64+0xa4/0xb0
[ 50.688968][ C0] Kernel Offset: disabled
[ 50.693293][ C0] Rebooting in 86400 seconds..