[ OK ] Listening on Load/Save RF Kill Switch Status /dev/rfkill Watch. [ OK ] Started Getty on tty6. [ OK ] Started Getty on tty5. [ OK ] Started Getty on tty4. [ OK ] Started Getty on tty3. [ OK ] Started Getty on tty2. [ OK ] Started Getty on tty1. [ OK ] Started Serial Getty on ttyS0. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Update UTMP about System Runlevel Changes. [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.123' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 134.216882][ T2011] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 134.457031][ T2011] usb 1-1: Using ep0 maxpacket: 8 [ 134.577021][ T2011] usb 1-1: config 0 contains an unexpected descriptor of type 0x1, skipping [ 134.585948][ T2011] usb 1-1: config 0 interface 0 altsetting 133 has an invalid endpoint with address 0x80, skipping [ 134.596987][ T2011] usb 1-1: config 0 interface 0 altsetting 133 endpoint 0x6 has invalid wMaxPacketSize 0 [ 134.607151][ T2011] usb 1-1: config 0 interface 0 altsetting 133 bulk endpoint 0x6 has invalid maxpacket 0 [ 134.617306][ T2011] usb 1-1: config 0 interface 0 altsetting 133 has an invalid endpoint descriptor of length 2, skipping [ 134.628751][ T2011] usb 1-1: config 0 interface 0 altsetting 133 has an invalid endpoint with address 0x0, skipping [ 134.639702][ T2011] usb 1-1: config 0 interface 0 altsetting 133 endpoint 0x9 has an invalid bInterval 0, changing to 7 [ 134.650943][ T2011] usb 1-1: config 0 interface 0 altsetting 133 has a duplicate endpoint with address 0x9, skipping [ 134.661934][ T2011] usb 1-1: config 0 interface 0 altsetting 133 has 7 endpoint descriptors, different from the interface descriptor's value: 6 [ 134.675301][ T2011] usb 1-1: config 0 interface 0 has no altsetting 0 [ 134.837254][ T2011] usb 1-1: New USB device found, idVendor=13d3, idProduct=3323, bcdDevice=b4.c4 [ 134.846583][ T2011] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 134.854971][ T2011] usb 1-1: Product: syz [ 134.859421][ T2011] usb 1-1: Manufacturer: syz [ 134.864165][ T2011] usb 1-1: SerialNumber: syz [ 134.909395][ T2011] usb 1-1: config 0 descriptor?? executing program [ 135.194235][ T2011] r8712u: register rtl8712_netdev_ops to netdev_ops [ 135.201174][ T2011] usb 1-1: r8712u: USB_SPEED_HIGH with 3 endpoints [ 135.248951][ T2011] ===================================================== [ 135.248962][ T2011] BUG: KMSAN: uninit-value in string+0x573/0x6d0 [ 135.248968][ T2011] CPU: 0 PID: 2011 Comm: kworker/0:2 Not tainted 5.11.0-rc7-syzkaller #0 [ 135.248975][ T2011] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 135.248982][ T2011] Workqueue: usb_hub_wq hub_event [ 135.248992][ T2011] Call Trace: [ 135.248995][ T2011] dump_stack+0x21c/0x280 [ 135.248999][ T2011] kmsan_report+0xfb/0x1e0 [ 135.249003][ T2011] __msan_warning+0x5f/0xa0 [ 135.249007][ T2011] string+0x573/0x6d0 [ 135.249011][ T2011] vsnprintf+0x1acd/0x3600 [ 135.249015][ T2011] pointer+0x1b8a/0x1ca0 [ 135.249019][ T2011] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 135.249023][ T2011] vsnprintf+0x15f2/0x3600 [ 135.249027][ T2011] vprintk_store+0x2ab/0x1df0 [ 135.249031][ T2011] ? kmsan_internal_set_origin+0x85/0xc0 [ 135.249036][ T2011] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 135.249040][ T2011] vprintk_emit+0x29a/0x7f0 [ 135.249044][ T2011] dev_vprintk_emit+0x5f7/0x6d8 [ 135.249048][ T2011] dev_printk_emit+0x1ce/0x210 [ 135.249053][ T2011] ? r8712_usbctrl_vendorreq+0x4a8/0x4d0 [ 135.249057][ T2011] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 135.249062][ T2011] __dev_printk+0x3dc/0x458 [ 135.249066][ T2011] _dev_info+0x1e5/0x22a [ 135.249069][ T2011] ? usb_read8+0xe7/0x130 [ 135.249073][ T2011] ? r871xu_drv_init+0x1986/0x2fe0 [ 135.249078][ T2011] ? r8712_usb_set_intf_ops+0x240/0x240 [ 135.249082][ T2011] r871xu_drv_init+0x1a59/0x2fe0 [ 135.249086][ T2011] ? r871x_dev_unload+0x310/0x310 [ 135.249090][ T2011] usb_probe_interface+0xfcc/0x1520 [ 135.249095][ T2011] ? usb_register_driver+0x900/0x900 [ 135.249099][ T2011] really_probe+0xe15/0x24d0 [ 135.249103][ T2011] driver_probe_device+0x29d/0x3a0 [ 135.249107][ T2011] __device_attach_driver+0x63f/0x830 [ 135.249112][ T2011] bus_for_each_drv+0x2c8/0x3f0 [ 135.249116][ T2011] ? deferred_probe_work_func+0x400/0x400 [ 135.249121][ T2011] __device_attach+0x56a/0x890 [ 135.249125][ T2011] device_initial_probe+0x4a/0x60 [ 135.249129][ T2011] bus_probe_device+0x17e/0x3d0 [ 135.249133][ T2011] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 135.249138][ T2011] device_add+0x2c15/0x31d0 [ 135.249142][ T2011] usb_set_configuration+0x3872/0x3eb0 [ 135.249146][ T2011] ? usb_set_configuration+0xac1/0x3eb0 [ 135.249151][ T2011] usb_generic_driver_probe+0x138/0x300 [ 135.249155][ T2011] ? usb_choose_configuration+0xee0/0xee0 [ 135.249160][ T2011] usb_probe_device+0x317/0x570 [ 135.249164][ T2011] ? usb_register_device_driver+0x590/0x590 [ 135.249169][ T2011] really_probe+0xe15/0x24d0 [ 135.249173][ T2011] driver_probe_device+0x29d/0x3a0 [ 135.249177][ T2011] __device_attach_driver+0x63f/0x830 [ 135.249181][ T2011] bus_for_each_drv+0x2c8/0x3f0 [ 135.249186][ T2011] ? deferred_probe_work_func+0x400/0x400 [ 135.249190][ T2011] __device_attach+0x56a/0x890 [ 135.249194][ T2011] device_initial_probe+0x4a/0x60 [ 135.249198][ T2011] bus_probe_device+0x17e/0x3d0 [ 135.249203][ T2011] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 135.249207][ T2011] device_add+0x2c15/0x31d0 [ 135.249211][ T2011] usb_new_device+0x1bd4/0x2a30 [ 135.249215][ T2011] hub_event+0x5b99/0x8870 [ 135.249219][ T2011] ? kmsan_get_metadata+0x116/0x180 [ 135.249223][ T2011] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 135.249228][ T2011] ? led_work+0x780/0x780 [ 135.249232][ T2011] process_one_work+0x1219/0x1fe0 [ 135.249236][ T2011] worker_thread+0x10ec/0x2340 [ 135.249240][ T2011] kthread+0x521/0x560 [ 135.249244][ T2011] ? process_one_work+0x1fe0/0x1fe0 [ 135.249248][ T2011] ? kthread_blkcg+0x110/0x110 [ 135.249252][ T2011] ret_from_fork+0x1f/0x30 [ 135.249255][ T2011] [ 135.249259][ T2011] Local variable ----data@usb_read8 created at: [ 135.249264][ T2011] usb_read8+0x5d/0x130 [ 135.249268][ T2011] usb_read8+0x5d/0x130 [ 135.249272][ T2011] ===================================================== [ 135.249278][ T2011] Disabling lock debugging due to kernel taint [ 135.249283][ T2011] Kernel panic - not syncing: panic_on_warn set ... [ 135.249289][ T2011] CPU: 0 PID: 2011 Comm: kworker/0:2 Tainted: G B 5.11.0-rc7-syzkaller #0 [ 135.249297][ T2011] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 135.249303][ T2011] Workqueue: usb_hub_wq hub_event [ 135.249310][ T2011] Call Trace: [ 135.249314][ T2011] dump_stack+0x21c/0x280 [ 135.249317][ T2011] panic+0x4c6/0xea7 [ 135.249321][ T2011] ? add_taint+0x17c/0x210 [ 135.249325][ T2011] ? vsnprintf+0x329/0x3600 [ 135.249329][ T2011] kmsan_report+0x1de/0x1e0 [ 135.249332][ T2011] __msan_warning+0x5f/0xa0 [ 135.249336][ T2011] string+0x573/0x6d0 [ 135.249340][ T2011] vsnprintf+0x1acd/0x3600 [ 135.249344][ T2011] pointer+0x1b8a/0x1ca0 [ 135.249348][ T2011] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 135.249352][ T2011] vsnprintf+0x15f2/0x3600 [ 135.249356][ T2011] vprintk_store+0x2ab/0x1df0 [ 135.249360][ T2011] ? kmsan_internal_set_origin+0x85/0xc0 [ 135.249365][ T2011] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 135.249369][ T2011] vprintk_emit+0x29a/0x7f0 [ 135.249373][ T2011] dev_vprintk_emit+0x5f7/0x6d8 [ 135.249377][ T2011] dev_printk_emit+0x1ce/0x210 [ 135.249381][ T2011] ? r8712_usbctrl_vendorreq+0x4a8/0x4d0 [ 135.249386][ T2011] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 135.249391][ T2011] __dev_printk+0x3dc/0x458 [ 135.249394][ T2011] _dev_info+0x1e5/0x22a [ 135.249398][ T2011] ? usb_read8+0xe7/0x130 [ 135.249402][ T2011] ? r871xu_drv_init+0x1986/0x2fe0 [ 135.249406][ T2011] ? r8712_usb_set_intf_ops+0x240/0x240 [ 135.249411][ T2011] r871xu_drv_init+0x1a59/0x2fe0 [ 135.249415][ T2011] ? r871x_dev_unload+0x310/0x310 [ 135.249419][ T2011] usb_probe_interface+0xfcc/0x1520 [ 135.249423][ T2011] ? usb_register_driver+0x900/0x900 [ 135.249428][ T2011] really_probe+0xe15/0x24d0 [ 135.249432][ T2011] driver_probe_device+0x29d/0x3a0 [ 135.249436][ T2011] __device_attach_driver+0x63f/0x830 [ 135.249440][ T2011] bus_for_each_drv+0x2c8/0x3f0 [ 135.249445][ T2011] ? deferred_probe_work_func+0x400/0x400 [ 135.249449][ T2011] __device_attach+0x56a/0x890 [ 135.249453][ T2011] device_initial_probe+0x4a/0x60 [ 135.249457][ T2011] bus_probe_device+0x17e/0x3d0 [ 135.249462][ T2011] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 135.249466][ T2011] device_add+0x2c15/0x31d0 [ 135.249470][ T2011] usb_set_configuration+0x3872/0x3eb0 [ 135.249475][ T2011] ? usb_set_configuration+0xac1/0x3eb0 [ 135.249479][ T2011] usb_generic_driver_probe+0x138/0x300 [ 135.249484][ T2011] ? usb_choose_configuration+0xee0/0xee0 [ 135.249488][ T2011] usb_probe_device+0x317/0x570 [ 135.249493][ T2011] ? usb_register_device_driver+0x590/0x590 [ 135.249497][ T2011] really_probe+0xe15/0x24d0 [ 135.249501][ T2011] driver_probe_device+0x29d/0x3a0 [ 135.249505][ T2011] __device_attach_driver+0x63f/0x830 [ 135.249510][ T2011] bus_for_each_drv+0x2c8/0x3f0 [ 135.249514][ T2011] ? deferred_probe_work_func+0x400/0x400 [ 135.249518][ T2011] __device_attach+0x56a/0x890 [ 135.249522][ T2011] device_initial_probe+0x4a/0x60 [ 135.249527][ T2011] bus_probe_device+0x17e/0x3d0 [ 135.249531][ T2011] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 135.249535][ T2011] device_add+0x2c15/0x31d0 [ 135.249539][ T2011] usb_new_device+0x1bd4/0x2a30 [ 135.249543][ T2011] hub_event+0x5b99/0x8870 [ 135.249547][ T2011] ? kmsan_get_metadata+0x116/0x180 [ 135.249552][ T2011] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 135.249556][ T2011] ? led_work+0x780/0x780 [ 135.249560][ T2011] process_one_work+0x1219/0x1fe0 [ 135.249564][ T2011] worker_thread+0x10ec/0x2340 [ 135.249568][ T2011] kthread+0x521/0x560 [ 135.249572][ T2011] ? process_one_work+0x1fe0/0x1fe0 [ 135.249576][ T2011] ? kthread_blkcg+0x110/0x110 [ 135.249580][ T2011] ret_from_fork+0x1f/0x30 [ 135.250333][ T2011] Kernel Offset: disabled