[info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[ 14.209495][ C1] random: crng init done [?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.217' (ECDSA) to the list of known hosts. 2019/08/31 05:30:17 parsed 1 programs 2019/08/31 05:30:19 executed programs: 0 syzkaller login: [ 27.555522][ T1735] cgroup1: Unknown subsys name 'perf_event' [ 27.562436][ T1735] cgroup1: Unknown subsys name 'net_cls' [ 28.436692][ T102] usb 1-1: new low-speed USB device number 2 using dummy_hcd [ 28.806719][ T102] usb 1-1: config 0 has an invalid interface number: 236 but max is 2 [ 28.815120][ T102] usb 1-1: config 0 has an invalid descriptor of length 99, skipping remainder of the config [ 28.825336][ T102] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 28.834424][ T102] usb 1-1: config 0 has no interface number 0 [ 28.840544][ T102] usb 1-1: config 0 interface 236 altsetting 0 endpoint 0x81 is Bulk; changing to Interrupt [ 28.850622][ T102] usb 1-1: New USB device found, idVendor=07c0, idProduct=1501, bcdDevice=74.a0 [ 28.859687][ T102] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.868995][ T102] usb 1-1: config 0 descriptor?? [ 28.910377][ T102] iowarrior 1-1:0.236: IOWarrior product=0x1501, serial= interface=236 now attached to iowarrior0 [ 29.367564][ T102] usb 1-1: USB disconnect, device number 2 [ 29.387808][ T102] iowarrior 1-1:0.236: I/O-Warror #0 now disconnected [ 30.156944][ T102] usb 1-1: new low-speed USB device number 3 using dummy_hcd [ 30.516570][ T102] usb 1-1: config 0 has an invalid interface number: 236 but max is 2 [ 30.524741][ T102] usb 1-1: config 0 has an invalid descriptor of length 99, skipping remainder of the config [ 30.536397][ T102] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 30.545255][ T102] usb 1-1: config 0 has no interface number 0 [ 30.551359][ T102] usb 1-1: config 0 interface 236 altsetting 0 endpoint 0x81 is Bulk; changing to Interrupt [ 30.561639][ T102] usb 1-1: New USB device found, idVendor=07c0, idProduct=1501, bcdDevice=74.a0 [ 30.570692][ T102] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.579926][ T102] usb 1-1: config 0 descriptor?? [ 30.628811][ T102] iowarrior 1-1:0.236: IOWarrior product=0x1501, serial= interface=236 now attached to iowarrior0 [ 30.872962][ T83] usb 1-1: USB disconnect, device number 3 [ 30.887481][ T83] ================================================================== [ 30.895632][ T83] BUG: KASAN: use-after-free in __mutex_lock+0xf23/0x1360 [ 30.902719][ T83] Read of size 8 at addr ffff8881cffe7bd8 by task kworker/1:2/83 [ 30.910413][ T83] [ 30.912721][ T83] CPU: 1 PID: 83 Comm: kworker/1:2 Not tainted 5.3.0-rc5+ #28 [ 30.920241][ T83] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 30.930280][ T83] Workqueue: usb_hub_wq hub_event [ 30.935271][ T83] Call Trace: [ 30.938533][ T83] dump_stack+0xca/0x13e [ 30.942747][ T83] ? __mutex_lock+0xf23/0x1360 [ 30.947479][ T83] ? __mutex_lock+0xf23/0x1360 [ 30.952215][ T83] print_address_description+0x6a/0x32c [ 30.957730][ T83] ? __mutex_lock+0xf23/0x1360 [ 30.962463][ T83] ? __mutex_lock+0xf23/0x1360 [ 30.967206][ T83] __kasan_report.cold+0x1a/0x33 [ 30.972118][ T83] ? __mutex_lock+0xf23/0x1360 [ 30.976860][ T83] kasan_report+0xe/0x12 [ 30.981079][ T83] __mutex_lock+0xf23/0x1360 [ 30.985640][ T83] ? lock_downgrade+0x6e0/0x6e0 [ 30.990464][ T83] ? iowarrior_disconnect+0xf0/0x2c0 [ 30.995882][ T83] ? mutex_trylock+0x2c0/0x2c0 [ 31.000625][ T83] ? __mutex_unlock_slowpath+0xea/0x670 [ 31.006142][ T83] ? lockdep_hardirqs_on+0x379/0x580 [ 31.011399][ T83] ? wait_for_completion+0x3c0/0x3c0 [ 31.016661][ T83] ? __kasan_slab_free+0x145/0x180 [ 31.021760][ T83] ? iowarrior_disconnect+0xf0/0x2c0 [ 31.027027][ T83] iowarrior_disconnect+0xf0/0x2c0 [ 31.032117][ T83] usb_unbind_interface+0x1bd/0x8a0 [ 31.037292][ T83] ? usb_autoresume_device+0x60/0x60 [ 31.042558][ T83] device_release_driver_internal+0x42f/0x500 [ 31.048612][ T83] bus_remove_device+0x2dc/0x4a0 [ 31.053531][ T83] device_del+0x420/0xb10 [ 31.057839][ T83] ? __device_links_no_driver+0x240/0x240 [ 31.063532][ T83] ? usb_remove_ep_devs+0x3e/0x80 [ 31.068529][ T83] ? remove_intf_ep_devs+0x13f/0x1d0 [ 31.073797][ T83] usb_disable_device+0x211/0x690 [ 31.078805][ T83] usb_disconnect+0x284/0x8d0 [ 31.083457][ T83] hub_event+0x1454/0x3640 [ 31.087857][ T83] ? find_held_lock+0x2d/0x110 [ 31.092598][ T83] ? mark_held_locks+0xe0/0xe0 [ 31.097409][ T83] ? hub_port_debounce+0x260/0x260 [ 31.102512][ T83] process_one_work+0x92b/0x1530 [ 31.107432][ T83] ? pwq_dec_nr_in_flight+0x310/0x310 [ 31.112781][ T83] ? do_raw_spin_lock+0x11a/0x280 [ 31.117867][ T83] worker_thread+0x96/0xe20 [ 31.122359][ T83] ? process_one_work+0x1530/0x1530 [ 31.127541][ T83] kthread+0x318/0x420 [ 31.131594][ T83] ? kthread_create_on_node+0xf0/0xf0 [ 31.136941][ T83] ret_from_fork+0x24/0x30 [ 31.141331][ T83] [ 31.143640][ T83] Allocated by task 102: [ 31.147860][ T83] save_stack+0x1b/0x80 [ 31.151987][ T83] __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 31.157596][ T83] iowarrior_probe+0x7a/0x10b2 [ 31.162333][ T83] usb_probe_interface+0x305/0x7a0 [ 31.167416][ T83] really_probe+0x281/0x6d0 [ 31.171910][ T83] drive