./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor187372385 <...> Warning: Permanently added '10.128.0.117' (ECDSA) to the list of known hosts. execve("./syz-executor187372385", ["./syz-executor187372385"], 0x7fffb09630f0 /* 10 vars */) = 0 brk(NULL) = 0x555555c2d000 brk(0x555555c2dc40) = 0x555555c2dc40 arch_prctl(ARCH_SET_FS, 0x555555c2d300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor187372385", 4096) = 27 brk(0x555555c4ec40) = 0x555555c4ec40 brk(0x555555c4f000) = 0x555555c4f000 mprotect(0x7fea6bac4000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 3 ioctl(3, USB_RAW_IOCTL_INIT, 0x7ffe892dbad0) = 0 ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe892dbad0) = 0 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe892dbad0) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe892daac0) = 18 syzkaller login: [ 48.326726][ T26] usb 1-1: new high-speed USB device number 2 using dummy_hcd ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe892dbad0) = 0 [ 48.566698][ T26] usb 1-1: Using ep0 maxpacket: 8 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe892daac0) = 18 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe892dbad0) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe892daac0) = 0 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe892dbad0) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe892daac0) = 0 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe892dbad0) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe892daac0) = 0 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe892dbad0) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe892daac0) = 9 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe892dbad0) = 0 [ 48.727190][ T26] usb 1-1: unable to get BOS descriptor or descriptor too short ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe892daac0) = 228 [ 48.807581][ T26] usb 1-1: config 0 has an invalid interface number: 85 but max is 1 [ 48.815822][ T26] usb 1-1: config 0 has an invalid interface number: 155 but max is 1 [ 48.824050][ T26] usb 1-1: config 0 has no interface number 0 [ 48.830176][ T26] usb 1-1: config 0 has no interface number 1 [ 48.836277][ T26] usb 1-1: config 0 interface 85 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 48.846835][ T26] usb 1-1: config 0 interface 85 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 48.857464][ T26] usb 1-1: config 0 interface 85 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 48.868044][ T26] usb 1-1: config 0 interface 85 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 48.878573][ T26] usb 1-1: config 0 interface 85 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 48.888603][ T26] usb 1-1: config 0 interface 85 altsetting 0 endpoint 0xC has invalid wMaxPacketSize 0 [ 48.898359][ T26] usb 1-1: config 0 interface 155 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 48.909003][ T26] usb 1-1: config 0 interface 155 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 48.919865][ T26] usb 1-1: config 0 interface 155 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 48.929766][ T26] usb 1-1: config 0 interface 155 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 48.940400][ T26] usb 1-1: config 0 interface 155 altsetting 0 has an invalid endpoint with address 0x0, skipping ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe892dbad0) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe892daac0) = 0 [ 48.951063][ T26] usb 1-1: config 0 interface 155 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 48.960928][ T26] usb 1-1: config 0 interface 155 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe892dbad0) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe892daac0) = 0 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe892dbad0) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe892daac0) = 0 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe892dbad0) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe892daac0) = 0 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe892dbad0) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe892daac0) = 0 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe892dbad0) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe892daac0) = 0 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe892dbad0) = 0 ioctl(3, USB_RAW_IOCTL_VBUS_DRAW, 0) = 0 ioctl(3, USB_RAW_IOCTL_CONFIGURE, 0) = 0 ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7fea6baca3ac) = -1 EINVAL (Invalid argument) ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffe892daac0) = 0 [ 49.207252][ T26] usb 1-1: string descriptor 0 read error: -22 [ 49.213499][ T26] usb 1-1: New USB device found, idVendor=077d, idProduct=627a, bcdDevice= 0.01 [ 49.222724][ T26] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 49.233511][ T26] usb 1-1: config 0 descriptor?? [ 49.282259][ T26] ------------[ cut here ]------------ [ 49.287870][ T26] usb 1-1: BOGUS urb xfer, pipe 1 != type 3 [ 49.294094][ T26] WARNING: CPU: 1 PID: 26 at drivers/usb/core/urb.c:502 usb_submit_urb+0xed2/0x18a0 [ 49.303543][ T26] Modules linked in: [ 49.307499][ T26] CPU: 1 PID: 26 Comm: kworker/1:1 Not tainted 5.19.0-rc3-syzkaller-00271-g6a0a17e6c6d1 #0 [ 49.317725][ T26] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 49.327860][ T26] Workqueue: usb_hub_wq hub_event [ 49.332921][ T26] RIP: 0010:usb_submit_urb+0xed2/0x18a0 [ 49.338558][ T26] Code: 7c 24 18 e8 80 fd ee fb 48 8b 7c 24 18 e8 36 dd 03 ff 41 89 d8 44 89 e1 4c 89 ea 48 89 c6 48 c7 c7 40 ec 6e 8a e8 4d 95 a6 03 <0f> 0b e9 58 f8 ff ff e8 52 fd ee fb 48 81 c5 c0 05 00 00 e9 84 f7 [ 49.358247][ T26] RSP: 0018:ffffc90000a1edd0 EFLAGS: 00010282 [ 49.364311][ T26] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 [ 49.372326][ T26] RDX: ffff888016729d80 RSI: ffffffff8160cfb8 RDI: fffff52000143dac [ 49.380350][ T26] RBP: ffff88814013ac00 R08: 0000000000000005 R09: 0000000000000000 [ 49.388360][ T26] R10: 0000000080000000 R11: 0000000000000001 R12: 0000000000000001 [ 49.396340][ T26] R13: ffff888020ef4190 R14: 0000000000000002 R15: ffff888016a08f00 [ 49.404391][ T26] FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 [ 49.413701][ T26] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 49.420351][ T26] CR2: 0000563b645bcfc0 CR3: 000000001d2ef000 CR4: 00000000003506e0 [ 49.428394][ T26] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 49.436354][ T26] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 49.444389][ T26] Call Trace: [ 49.447720][ T26] [ 49.450664][ T26] ? lockdep_init_map_type+0x142/0x7f0 [ 49.456153][ T26] usb_start_wait_urb+0x101/0x4c0 [ 49.461264][ T26] ? usb_api_blocking_completion+0xa0/0xa0 [ 49.467154][ T26] ? trace_kmalloc+0x32/0xf0 [ 49.471759][ T26] ? memset+0x20/0x40 [ 49.475736][ T26] usb_bulk_msg+0x226/0x550 exit_group(0) = ? +++ exited with 0 +++ [ 49.480386][ T26] shark_wri