INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.58' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 24.537017][ T21] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 24.776956][ T21] usb 1-1: Using ep0 maxpacket: 8 [ 24.897078][ T21] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 24.912682][ T21] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 24.925704][ T21] usb 1-1: New USB device found, idVendor=046d, idProduct=ca04, bcdDevice= 0.00 [ 24.934757][ T21] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 24.944982][ T21] usb 1-1: config 0 descriptor?? [ 25.428750][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.435998][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.443307][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.450725][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.458008][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.465139][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.472425][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.479617][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.486740][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.493916][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.501075][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.508247][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.515531][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.522702][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.529941][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.537197][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.544419][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.551624][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.558816][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.565934][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.573124][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.580368][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.587545][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.594672][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.601840][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.609359][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.616477][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 executing program [ 25.623760][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.630946][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.638136][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.645503][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.653271][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.660573][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.667764][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.674889][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.682148][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.689312][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.696426][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.703597][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.711020][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.718191][ T21] logitech 0003:046D:CA04.0001: unknown main item tag 0x0 [ 25.727480][ T21] logitech 0003:046D:CA04.0001: hidraw0: USB HID v0.00 Device [HID 046d:ca04] on usb-dummy_hcd.0-1/input0 [ 25.738822][ T21] logitech 0003:046D:CA04.0001: not enough fields in HID_OUTPUT_REPORT 0 [ 25.749168][ T21] usb 1-1: USB disconnect, device number 2 [ 26.106960][ T21] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 26.346959][ T21] usb 1-1: Using ep0 maxpacket: 8 [ 26.467063][ T21] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 26.478086][ T21] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 26.490965][ T21] usb 1-1: New USB device found, idVendor=046d, idProduct=ca04, bcdDevice= 0.00 [ 26.500234][ T21] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.509758][ T21] usb 1-1: config 0 descriptor?? [ 26.978166][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 26.985483][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 26.992880][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.000850][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.008534][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.016270][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.023672][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.030865][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.038079][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.045432][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.052619][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.060049][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.067530][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.074844][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.082300][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.089462][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.097045][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.104184][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.111452][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.118610][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.125788][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.133056][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.140246][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.147647][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.155042][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.162661][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.170002][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.177176][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.177343][ T1730] ================================================================== [ 27.184298][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.192470][ T1730] BUG: KASAN: use-after-free in usbhid_power+0xca/0xe0 [ 27.192480][ T1730] Read of size 8 at addr ffff8881c7828008 by task syz-executor827/1730 [ 27.192483][ T1730] [ 27.192497][ T1730] CPU: 0 PID: 1730 Comm: syz-executor827 Not tainted 5.3.0-rc4+ #26 [ 27.192503][ T1730] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.192511][ T1730] Call Trace: [ 27.199651][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.206450][ T1730] dump_stack+0xca/0x13e [ 27.214725][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.216992][ T1730] ? usbhid_power+0xca/0xe0 [ 27.217004][ T1730] ? usbhid_power+0xca/0xe0 [ 27.217021][ T1730] print_address_description+0x6a/0x32c [ 27.225172][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.235286][ T1730] ? usbhid_power+0xca/0xe0 [ 27.235296][ T1730] ? usbhid_power+0xca/0xe0 [ 27.235307][ T1730] __kasan_report.cold+0x1a/0x33 [ 27.235317][ T1730] ? usbhid_power+0xca/0xe0 [ 27.235330][ T1730] kasan_report+0xe/0x12 [ 27.238666][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.245885][ T1730] usbhid_power+0xca/0xe0 [ 27.250164][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.257389][ T1730] hidraw_open+0x20d/0x740 [ 27.257399][ T1730] ? usbhid_output_report+0x290/0x290 [ 27.257407][ T1730] ? hidraw_ioctl+0xae0/0xae0 [ 27.257419][ T1730] chrdev_open+0x219/0x5c0 [ 27.257429][ T1730] ? cdev_put.part.0+0x50/0x50 [ 27.257440][ T1730] do_dentry_open+0x494/0x1120 [ 27.257451][ T1730] ? cdev_put.part.0+0x50/0x50 [ 27.257462][ T1730] ? chmod_common+0x3c0/0x3c0 [ 27.257473][ T1730] ? inode_permission+0xbe/0x3a0 [ 27.257482][ T1730] path_openat+0x1430/0x3f50 [ 27.257505][ T1730] ? save_stack+0x1b/0x80 [ 27.262266][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.266860][ T1730] ? do_sys_open+0x294/0x580 [ 27.266874][ T1730] ? do_syscall_64+0xb7/0x580 [ 27.272447][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.279563][ T1730] ? path_lookupat.isra.0+0x8d0/0x8d0 [ 27.279575][ T1730] ? __lock_acquire+0x145e/0x3b50 [ 27.279586][ T1730] do_filp_open+0x1a1/0x280 [ 27.279599][ T1730] ? may_open_dev+0xf0/0xf0 [ 27.284092][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.288557][ T1730] ? __alloc_fd+0x46d/0x600 [ 27.288568][ T1730] ? do_raw_spin_lock+0x11a/0x280 [ 27.288578][ T1730] ? do_raw_spin_unlock+0x50/0x220 [ 27.288595][ T1730] ? _raw_spin_unlock+0x1f/0x30 [ 27.293516][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.297984][ T1730] ? __alloc_fd+0x46d/0x600 [ 27.297996][ T1730] do_sys_open+0x3c0/0x580 [ 27.298007][ T1730] ? filp_open+0x70/0x70 [ 27.298018][ T1730] ? trace_hardirqs_off_caller+0x55/0x1e0 [ 27.298033][ T1730] do_syscall_64+0xb7/0x580 [ 27.302370][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.309442][ T1730] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 27.309453][ T1730] RIP: 0033:0x4019b0 [ 27.309464][ T1730] Code: 01 f0 ff ff 0f 83 c0 0b 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 83 3d 1d 5d 2d 00 00 75 14 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 94 0b 00 00 c3 48 83 ec 08 e8 fa 00 00 00 [ 27.309475][ T1730] RSP: 002b:00007ffe5431f758 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 27.313812][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.321236][ T1730] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004019b0 [ 27.321243][ T1730] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007ffe5431f760 [ 27.321250][ T1730] RBP: 6666666666666667 R08: 000000000000000f R09: 0000000000000000 [ 27.321257][ T1730] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004029d0 [ 27.321263][ T1730] R13: 0000000000402a60 R14: 0000000000000000 R15: 0000000000000000 [ 27.321271][ T1730] [ 27.325696][ T21] logitech 0003:046D:CA04.0002: unknown main item tag 0x0 [ 27.331024][ T1730] Allocated by task 1710: [ 27.331039][ T1730] save_stack+0x1b/0x80 [ 27.331049][ T1730] __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 27.331059][ T1730] __kmalloc_node_track_caller+0xfc/0x380 [ 27.331074][ T1730] __kmalloc_reserve.isra.0+0x39/0xe0 [ 27.601020][ T1730] __alloc_skb+0xef/0x5a0 [ 27.605342][ T1730] netlink_sendmsg+0x8cd/0xcc0 [ 27.610463][ T1730] sock_sendmsg+0xcf/0x120 [ 27.614871][ T1730] ___sys_sendmsg+0x803/0x920 [ 27.619526][ T1730] __sys_sendmsg+0xec/0x1b0 [ 27.624008][ T1730] do_syscall_64+0xb7/0x580 [ 27.628492][ T1730] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 27.634459][ T1730] [ 27.636766][ T1730] Freed by task 1710: [ 27.640745][ T1730] save_stack+0x1b/0x80 [ 27.645000][ T1730] __kasan_slab_free+0x130/0x180 [ 27.650320][ T1730] kfree+0xe4/0x2f0 [ 27.672758][ T1730] skb_free_head+0x8b/0xa0 [ 27.677187][ T1730] skb_release_data+0x41f/0x7c0 [ 27.682406][ T1730] skb_release_all+0x46/0x60 [ 27.687014][ T1730] consume_skb+0xd9/0x320 [ 27.701585][ T1730] netlink_unicast+0x4d7/0x690 [ 27.706794][ T1730] netlink_sendmsg+0x802/0xcc0 [ 27.711970][ T1730] sock_sendmsg+0xcf/0x120 [ 27.716546][ T1730] ___sys_sendmsg+0x803/0x920 [ 27.721199][ T1730] __sys_sendmsg+0xec/0x1b0 [ 27.725700][ T1730] do_syscall_64+0xb7/0x580 [ 27.730370][ T1730] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 27.736329][ T1730] [ 27.738640][ T1730] The buggy address belongs to the object at ffff8881c7828000 [ 27.738640][ T1730] which belongs to the cache kmalloc-1k of size 1024 [ 27.752703][ T1730] The buggy address is located 8 bytes inside of [ 27.752703][ T1730] 1024-byte region [ffff8881c7828000, ffff8881c7828400) [ 27.765872][ T1730] The buggy address belongs to the page: [ 27.771529][ T1730] page:ffffea00071e0a00 refcount:1 mapcount:0 mapping:ffff8881da002280 index:0x0 compound_mapcount: 0 [ 27.782442][ T1730] flags: 0x200000000010200(slab|head) [ 27.787797][ T1730] raw: 0200000000010200 dead000000000100 dead000000000122 ffff8881da002280 [ 27.796385][ T1730] raw: 0000000000000000 00000000000e000e 00000001ffffffff 0000000000000000 [ 27.805225][ T1730] page dumped because: kasan: bad access detected [ 27.812702][ T1730] [ 27.815085][ T1730] Memory state around the buggy address: [ 27.820781][ T1730] ffff8881c7827f00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 27.828832][ T1730] ffff8881c7827f80: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 27.836879][ T1730] >ffff8881c7828000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.844925][ T1730] ^ [ 27.849237][ T1730] ffff8881c7828080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.858694][ T1730] ffff8881c7828100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.866838][ T1730] ================================================================== [ 27.874882][ T1730] Disabling lock debugging due to kernel taint [ 27.881340][ T1730] Kernel panic - not syncing: panic_on_warn set ... [ 27.887935][ T1730] CPU: 0 PID: 1730 Comm: syz-executor827 Tainted: G B 5.3.0-rc4+ #26 [ 27.897278][ T1730] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.914502][ T1730] Call Trace: [ 27.917868][ T1730] dump_stack+0xca/0x13e [ 27.922086][ T1730] panic+0x2a3/0x6da [ 27.925959][ T1730] ? add_taint.cold+0x16/0x16 [ 27.930620][ T1730] ? retint_kernel+0x10/0x10 [ 27.935197][ T1730] ? trace_hardirqs_on+0x55/0x1e0 [ 27.940206][ T1730] ? usbhid_power+0xca/0xe0 [ 27.944705][ T1730] end_report+0x43/0x49 [ 27.948871][ T1730] ? usbhid_power+0xca/0xe0 [ 27.953351][ T1730] __kasan_report.cold+0xd/0x33 [ 27.958181][ T1730] ? usbhid_power+0xca/0xe0 [ 27.962665][ T1730] kasan_report+0xe/0x12 [ 27.966888][ T1730] usbhid_power+0xca/0xe0 [ 27.971198][ T1730] hidraw_open+0x20d/0x740 [ 27.975593][ T1730] ? usbhid_output_report+0x290/0x290 [ 27.980943][ T1730] ? hidraw_ioctl+0xae0/0xae0 [ 27.985734][ T1730] chrdev_open+0x219/0x5c0 [ 27.990141][ T1730] ? cdev_put.part.0+0x50/0x50 [ 27.994910][ T1730] do_dentry_open+0x494/0x1120 [ 27.999689][ T1730] ? cdev_put.part.0+0x50/0x50 [ 28.004446][ T1730] ? chmod_common+0x3c0/0x3c0 [ 28.009219][ T1730] ? inode_permission+0xbe/0x3a0 [ 28.014465][ T1730] path_openat+0x1430/0x3f50 [ 28.019230][ T1730] ? save_stack+0x1b/0x80 [ 28.023714][ T1730] ? do_sys_open+0x294/0x580 [ 28.028381][ T1730] ? do_syscall_64+0xb7/0x580 [ 28.033153][ T1730] ? path_lookupat.isra.0+0x8d0/0x8d0 [ 28.038532][ T1730] ? __lock_acquire+0x145e/0x3b50 [ 28.043549][ T1730] do_filp_open+0x1a1/0x280 [ 28.048133][ T1730] ? may_open_dev+0xf0/0xf0 [ 28.052625][ T1730] ? __alloc_fd+0x46d/0x600 [ 28.057130][ T1730] ? do_raw_spin_lock+0x11a/0x280 [ 28.062169][ T1730] ? do_raw_spin_unlock+0x50/0x220 [ 28.067274][ T1730] ? _raw_spin_unlock+0x1f/0x30 [ 28.072278][ T1730] ? __alloc_fd+0x46d/0x600 [ 28.076864][ T1730] do_sys_open+0x3c0/0x580 [ 28.081272][ T1730] ? filp_open+0x70/0x70 [ 28.085501][ T1730] ? trace_hardirqs_off_caller+0x55/0x1e0 [ 28.091285][ T1730] do_syscall_64+0xb7/0x580 [ 28.095929][ T1730] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 28.101806][ T1730] RIP: 0033:0x4019b0 [ 28.105718][ T1730] Code: 01 f0 ff ff 0f 83 c0 0b 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 83 3d 1d 5d 2d 00 00 75 14 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 94 0b 00 00 c3 48 83 ec 08 e8 fa 00 00 00 [ 28.125311][ T1730] RSP: 002b:00007ffe5431f758 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 28.134145][ T1730] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004019b0 [ 28.142129][ T1730] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007ffe5431f760 [ 28.150627][ T1730] RBP: 6666666666666667 R08: 000000000000000f R09: 0000000000000000 [ 28.158584][ T1730] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004029d0 [ 28.166652][ T1730] R13: 0000000000402a60 R14: 0000000000000000 R15: 0000000000000000 [ 28.175466][ T1730] Kernel Offset: disabled [ 28.179822][ T1730] Rebooting in 86400 seconds..