[ OK ] Listening on Load/Save RF Kill Switch Status /dev/rfkill Watch. [ OK ] Started Getty on tty6. [ OK ] Started Getty on tty5. [ OK ] Started Getty on tty4. [ OK ] Started Getty on tty3. [ OK ] Started Getty on tty2. [ OK ] Started Getty on tty1. [ OK ] Started Serial Getty on ttyS0. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Update UTMP about System Runlevel Changes. [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.10.8' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 66.626595][ T29] audit: type=1400 audit(1592607961.776:8): avc: denied { execmem } for pid=6807 comm="syz-executor104" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 66.897401][ T2682] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 67.137305][ T2682] usb 1-1: Using ep0 maxpacket: 8 [ 67.257465][ T2682] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 67.268942][ T2682] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 67.279674][ T2682] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 67.290586][ T2682] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 67.301275][ T2682] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 67.467390][ T2682] usb 1-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 67.478159][ T2682] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 67.488529][ T2682] usb 1-1: Product: syz [ 67.492727][ T2682] usb 1-1: Manufacturer: syz [ 67.497744][ T2682] usb 1-1: SerialNumber: syz [ 67.597372][ T2682] cdc_ether: probe of 1-1:1.0 failed with error -22 [ 67.757296][ C0] ================================================================== [ 67.765816][ C0] BUG: KASAN: slab-out-of-bounds in snd_usb_mixer_notify_id+0x219/0x2a0 [ 67.775785][ C0] Write of size 4 at addr ffff8880a7749660 by task swapper/0/0 [ 67.783325][ C0] [ 67.785733][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.7.0-syzkaller #0 [ 67.793360][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 67.804443][ C0] Call Trace: [ 67.807911][ C0] [ 67.810762][ C0] dump_stack+0x188/0x20d [ 67.815179][ C0] ? snd_usb_mixer_notify_id+0x219/0x2a0 [ 67.820883][ C0] ? snd_usb_mixer_notify_id+0x219/0x2a0 [ 67.826512][ C0] print_address_description.constprop.0.cold+0xd3/0x413 [ 67.833524][ C0] ? vprintk_func+0x97/0x1a6 [ 67.840180][ C0] ? snd_usb_mixer_notify_id+0x219/0x2a0 [ 67.846679][ C0] kasan_report.cold+0x1f/0x37 [ 67.851890][ C0] ? snd_usb_mixer_notify_id+0x219/0x2a0 [ 67.858132][ C0] snd_usb_mixer_notify_id+0x219/0x2a0 [ 67.863717][ C0] snd_usb_mixer_interrupt+0x416/0x980 [ 67.869330][ C0] ? trace_hardirqs_off+0x50/0x220 [ 67.875666][ C0] __usb_hcd_giveback_urb+0x2af/0x4b0 [ 67.883462][ C0] usb_hcd_giveback_urb+0x368/0x420 [ 67.890994][ C0] dummy_timer+0x1243/0x2fe1 [ 67.896100][ C0] ? __lock_acquire+0x2224/0x48a0 [ 67.901633][ C0] ? debug_smp_processor_id+0x2f/0x185 [ 67.907107][ C0] ? dummy_dequeue+0x4c0/0x4c0 [ 67.911860][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 67.917403][ C0] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 67.923387][ C0] call_timer_fn+0x1ac/0x780 [ 67.928018][ C0] ? dummy_dequeue+0x4c0/0x4c0 [ 67.933321][ C0] ? timer_fixup_init+0x60/0x60 [ 67.938166][ C0] ? lock_downgrade+0x840/0x840 [ 67.943354][ C0] ? _raw_spin_unlock_irq+0x1f/0x80 [ 67.948781][ C0] ? lockdep_hardirqs_on_prepare+0x1bc/0x590 [ 67.954847][ C0] ? dummy_dequeue+0x4c0/0x4c0 [ 67.960342][ C0] run_timer_softirq+0x623/0x1600 [ 67.960965][ T3253] usb 1-1: USB disconnect, device number 2 [ 67.965385][ C0] ? add_timer+0x830/0x830 [ 67.975594][ C0] ? debug_smp_processor_id+0x2f/0x185 [ 67.981277][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 67.986959][ C0] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 67.992952][ C0] ? lockdep_hardirqs_on_prepare+0x1bc/0x590 [ 67.999223][ C0] __do_softirq+0x26c/0x9f7 [ 68.003936][ C0] irq_exit+0x192/0x1d0 [ 68.008121][ C0] smp_apic_timer_interrupt+0x19e/0x600 [ 68.013692][ C0] apic_timer_interrupt+0xf/0x20 [ 68.018721][ C0] [ 68.021666][ C0] RIP: 0010:native_safe_halt+0xe/0x10 [ 68.027656][ C0] Code: cc cc cc cc cc cc cc cc cc cc cc cc e9 07 00 00 00 0f 00 2d 84 9c 4a 00 f4 c3 66 90 e9 07 00 00 00 0f 00 2d 74 9c 4a 00 fb f4 cc 41 56 41 55 41 54 55 53 e8 33 9c 83 f9 e8 be c8 bf fb 0f 1f [ 68.049517][ C0] RSP: 0018:ffffffff89807c50 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13 [ 68.058016][ C0] RAX: ffffffff89886580 RBX: 0000000000000000 RCX: 1ffffffff15173ba [ 68.066439][ C0] RDX: 0000000000000000 RSI: ffffffff87de1248 RDI: ffffffff89886e00 [ 68.074509][ C0] RBP: ffff88821af54864 R08: 0000000000000000 R09: 0000000000000001 [ 68.085436][ C0] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88821af54864 [ 68.096447][ C0] R13: 1ffffffff1300f95 R14: ffff88821af54865 R15: 0000000000000001 [ 68.107829][ C0] ? acpi_safe_halt+0x88/0x110 [ 68.113930][ C0] acpi_safe_halt+0x8d/0x110 [ 68.119808][ C0] acpi_idle_do_entry+0xa9/0xe0 [ 68.126020][ C0] acpi_idle_enter+0x437/0xb20 [ 68.130991][ C0] ? acpi_idle_enter_bm+0x2d0/0x2d0 [ 68.136608][ C0] ? kvm_clock_read+0x14/0x30 [ 68.141372][ C0] ? kvm_sched_clock_read+0x5/0x10 [ 68.148804][ C0] ? sched_clock+0x2a/0x40 [ 68.155475][ C0] ? sched_clock_cpu+0x18/0x1b0 [ 68.162884][ C0] cpuidle_enter_state+0xdd/0xd60 [ 68.170334][ C0] ? assoc_array_gc+0x1200/0x1250 [ 68.177697][ C0] cpuidle_enter+0x4a/0xa0 [ 68.183927][ C0] do_idle+0x42f/0x690 [ 68.190272][ C0] ? arch_cpu_idle_exit+0x70/0x70 [ 68.198711][ C0] ? schedule+0xe7/0x2a0 [ 68.203783][ C0] ? trace_init_perf_perm_irq_work_exit+0xe/0xe [ 68.212462][ C0] cpu_startup_entry+0x14/0x20 [ 68.219094][ C0] start_kernel+0x9be/0x9fb [ 68.224299][ C0] ? mem_encrypt_init+0x5/0x5 [ 68.230394][ C0] ? x86_family+0x3d/0x50 [ 68.235006][ C0] ? load_ucode_bsp+0x23d/0x27d [ 68.240346][ C0] secondary_startup_64+0xa4/0xb0 [ 68.246059][ C0] [ 68.248474][ C0] Allocated by task 2682: [ 68.253257][ C0] save_stack+0x1b/0x40 [ 68.260649][ C0] __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 68.266925][ C0] kmem_cache_alloc_trace+0x153/0x7d0 [ 68.272699][ C0] add_single_ctl_with_resume+0x53/0x1d0 [ 68.279283][ C0] snd_usb_mixer_apply_create_quirk+0x17ac/0x2000 [ 68.286681][ C0] snd_usb_create_mixer+0x7de/0x18c0 [ 68.292521][ C0] create_standard_mixer_quirk+0x57/0x70 [ 68.299546][ C0] snd_usb_create_quirk+0x9f/0xd0 [ 68.304834][ C0] create_composite_quirk+0x1d5/0x420 [