Warning: Permanently added '10.128.1.4' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 30.509072][ T95] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 30.719134][ T95] usb 1-1: config 1 has an invalid interface number: 33 but max is 0 [ 30.727433][ T95] usb 1-1: config 1 has no interface number 0 [ 30.733613][ T95] usb 1-1: config 1 interface 33 altsetting 253 endpoint 0x9 has an invalid bInterval 224, changing to 11 [ 30.744928][ T95] usb 1-1: config 1 interface 33 altsetting 253 has an invalid endpoint with address 0x0, skipping [ 30.755661][ T95] usb 1-1: config 1 interface 33 altsetting 253 bulk endpoint 0xE has invalid maxpacket 16 [ 30.765682][ T95] usb 1-1: config 1 interface 33 altsetting 253 endpoint 0x8 has invalid maxpacket 1024, setting to 64 [ 30.777672][ T95] usb 1-1: config 1 interface 33 has no altsetting 0 [ 30.784462][ T95] usb 1-1: New USB device found, idVendor=9022, idProduct=d632, bcdDevice=17.fc [ 30.793554][ T95] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 executing program [ 31.079234][ T95] usb 1-1: string descriptor 0 read error: -71 [ 31.087389][ T95] dw2102: su3000_identify_state [ 31.092390][ T95] dvb-usb: found a 'TeVii S632 USB' in warm state. [ 31.098959][ T95] dw2102: su3000_power_ctrl: 1, initialized 0 [ 31.109903][ T95] dvb-usb: bulk message failed: -22 (2/256) [ 31.118501][ T95] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 31.139437][ T95] dvbdev: DVB: registering new adapter (TeVii S632 USB) [ 31.146761][ T95] usb 1-1: media controller created [ 31.152352][ T95] dvb-usb: bulk message failed: -22 (6/-2032430384) [ 31.159127][ T95] dw2102: i2c transfer failed. [ 31.164016][ T95] dvb-usb: bulk message failed: -22 (6/-2032430384) [ 31.170792][ T95] dw2102: i2c transfer failed. [ 31.176415][ T95] dvb-usb: bulk message failed: -22 (6/-2032430384) [ 31.183041][ T95] dw2102: i2c transfer failed. [ 31.187984][ T95] dvb-usb: bulk message failed: -22 (6/-2032430384) [ 31.194613][ T95] dw2102: i2c transfer failed. [ 31.199443][ T95] dvb-usb: bulk message failed: -22 (6/-2032430384) [ 31.206070][ T95] dw2102: i2c transfer failed. [ 31.210883][ T95] dvb-usb: bulk message failed: -22 (6/-2032430384) [ 31.217475][ T95] dw2102: i2c transfer failed. [ 31.222287][ T95] dvb-usb: MAC address: 02:02:02:02:02:02 [ 31.232355][ T95] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 31.247890][ T95] dvb-usb: bulk message failed: -22 (1/0) [ 31.253717][ T95] dw2102: command 0x51 transfer failed. [ 31.260912][ T95] dvb-usb: bulk message failed: -22 (5/-2032430384) [ 31.267605][ T95] dw2102: i2c transfer failed. [ 31.273142][ T95] dvb-usb: bulk message failed: -22 (5/-2032430384) [ 31.279928][ T95] dw2102: i2c transfer failed. [ 31.284720][ T95] dvb-usb: bulk message failed: -22 (5/-2032430384) [ 31.291399][ T95] dw2102: i2c transfer failed. [ 31.296192][ T95] dvb-usb: bulk message failed: -22 (5/-2032430384) [ 31.302826][ T95] dw2102: i2c transfer failed. [ 31.307615][ T95] dvb-usb: bulk message failed: -22 (5/-2032430384) [ 31.314273][ T95] dw2102: i2c transfer failed. [ 31.319072][ T95] dvb-usb: bulk message failed: -22 (5/-2032430384) [ 31.325695][ T95] dw2102: i2c transfer failed. [ 31.380625][ T95] dvb-usb: bulk message failed: -22 (5/-2032430384) [ 31.387226][ T95] dw2102: i2c transfer failed. [ 31.392193][ T95] dvb-usb: bulk message failed: -22 (5/-2032430384) [ 31.398795][ T95] dw2102: i2c transfer failed. [ 31.403627][ T95] dvb-usb: bulk message failed: -22 (5/-2032430384) [ 31.410244][ T95] dw2102: i2c transfer failed. [ 31.415068][ T95] dvb-usb: bulk message failed: -22 (5/-2032430384) [ 31.421922][ T95] dw2102: i2c transfer failed. [ 31.426717][ T95] dvb-usb: bulk message failed: -22 (5/-2032430384) [ 31.433704][ T95] dw2102: i2c transfer failed. [ 31.438494][ T95] dvb-usb: bulk message failed: -22 (5/-2032430384) [ 31.445131][ T95] dw2102: i2c transfer failed. [ 31.449997][ T95] ts2020 0-0060: Montage Technology TS2020 successfully identified [ 31.458375][ T95] dw2102: Attached RS2000/TS2020! [ 31.463668][ T95] usb 1-1: DVB: registering adapter 0 frontend 0 (M88RS2000 DVB-S)... [ 31.472088][ T95] dvbdev: dvb_create_media_entity: media entity 'M88RS2000 DVB-S' registered. [ 31.539311][ T95] Registered IR keymap rc-su3000 [ 31.544815][ T95] rc rc0: TeVii S632 USB as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 31.554178][ T95] input: TeVii S632 USB as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input5 [ 31.565061][ T95] dvb-usb: schedule remote query interval to 150 msecs. [ 31.572282][ T95] dw2102: su3000_power_ctrl: 0, initialized 1 [ 31.578471][ T95] dvb-usb: TeVii S632 USB successfully initialized and connected. [ 31.588917][ T95] usb 1-1: USB disconnect, device number 2 [ 31.596595][ T95] ================================================================== [ 31.604964][ T95] BUG: KASAN: use-after-free in dvb_usb_device_exit+0x19a/0x1a0 [ 31.612640][ T95] Read of size 8 at addr ffff8881cd4c03e0 by task kworker/0:2/95 [ 31.620337][ T95] [ 31.623875][ T95] CPU: 0 PID: 95 Comm: kworker/0:2 Not tainted 5.5.0-rc6-syzkaller #0 [ 31.632018][ T95] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 31.642650][ T95] Workqueue: usb_hub_wq hub_event [ 31.647681][ T95] Call Trace: [ 31.650966][ T95] dump_stack+0xef/0x16e [ 31.655209][ T95] ? dvb_usb_device_exit+0x19a/0x1a0 [ 31.660486][ T95] ? dvb_usb_device_exit+0x19a/0x1a0 [ 31.665760][ T95] print_address_description.constprop.0.cold+0xd3/0x314 [ 31.672771][ T95] ? dvb_usb_device_exit+0x19a/0x1a0 [ 31.678041][ T95] ? dvb_usb_device_exit+0x19a/0x1a0 [ 31.683439][ T95] __kasan_report.cold+0x37/0x85 [ 31.688377][ T95] ? dvb_usb_device_exit+0x19a/0x1a0 [ 31.693659][ T95] kasan_report+0xe/0x20 [ 31.697893][ T95] dvb_usb_device_exit+0x19a/0x1a0 [ 31.702993][ T95] ? dvb_usb_exit+0x290/0x290 [ 31.707943][ T95] ? usb_disable_endpoint+0x1ba/0x1f0 [ 31.713309][ T95] ? usb_disable_interface+0x140/0x1a0 [ 31.718800][ T95] usb_unbind_interface+0x1bd/0x8a0 [ 31.723986][ T95] ? usb_autoresume_device+0x60/0x60 [ 31.729272][ T95] device_release_driver_internal+0x42f/0x500 [ 31.735359][ T95] bus_remove_device+0x2eb/0x5a0 [ 31.740292][ T95] device_del+0x481/0xd30 [ 31.744661][ T95] ? device_create_with_groups+0x120/0x120 [ 31.750511][ T95] ? usb_remove_ep_devs+0x3e/0x80 [ 31.755631][ T95] ? remove_intf_ep_devs+0x13f/0x1d0 [ 31.760906][ T95] usb_disable_device+0x23d/0x790 [ 31.766195][ T95] usb_disconnect+0x293/0x900 [ 31.770864][ T95] hub_event+0x1a1d/0x4300 [ 31.775773][ T95] ? hub_port_debounce+0x350/0x350 [ 31.780909][ T95] ? find_held_lock+0x2d/0x110 [ 31.785755][ T95] ? mark_held_locks+0xe0/0xe0 [ 31.790514][ T95] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 31.796061][ T95] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 31.801369][ T95] process_one_work+0x945/0x15c0 [ 31.806303][ T95] ? pwq_dec_nr_in_flight+0x310/0x310 [ 31.811707][ T95] ? do_raw_spin_lock+0x129/0x290 [ 31.816830][ T95] worker_thread+0x7ab/0xe20 [ 31.821418][ T95] ? process_one_work+0x15c0/0x15c0 [ 31.826598][ T95] kthread+0x318/0x420 [ 31.830697][ T95] ? kthread_create_on_node+0xf0/0xf0 [ 31.836059][ T95] ret_from_fork+0x24/0x30 [ 31.840609][ T95] [ 31.842971][ T95] Allocated by task 95: [ 31.847208][ T95] save_stack+0x1b/0x80 [ 31.851354][ T95] __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 31.857067][ T95] __kmalloc_track_caller+0xf0/0x330 [ 31.862389][ T95] kmemdup+0x23/0x50 [ 31.866283][ T95] dw2102_probe+0x627/0xc40 [ 31.870780][ T95] usb_probe_interface+0x310/0x800 [ 31.875879][ T95] really_probe+0x290/0xad0 [ 31.880381][ T95] driver_probe_device+0x223/0x350 [ 31.885521][ T95] __device_attach_driver+0x1d1/0x290 [ 31.890895][ T95] bus_for_each_drv+0x162/0x1e0 [ 31.895737][ T95] __device_attach+0x217/0x390 [ 31.900608][ T95] bus_probe_device+0x1e4/0x290 [ 31.905439][ T95] device_add+0x1459/0x1bf0 [ 31.909959][ T95] usb_set_configuration+0xe47/0x17d0 [ 31.915320][ T95] generic_probe+0x9d/0xd5 [ 31.919950][ T95] usb_probe_device+0xaf/0x140 [ 31.924719][ T95] really_probe+0x290/0xad0 [ 31.929213][ T95] driver_probe_device+0x223/0x350 [ 31.934751][ T95] __device_attach_driver+0x1d1/0x290 [ 31.940103][ T95] bus_for_each_drv+0x162/0x1e0 [ 31.944938][ T95] __device_attach+0x217/0x390 [ 31.949692][ T95] bus_probe_device+0x1e4/0x290 [ 31.954541][ T95] device_add+0x1459/0x1bf0 [ 31.959149][ T95] usb_new_device.cold+0x540/0xcd0 [ 31.964709][ T95] hub_event+0x21cb/0x4300 [ 31.969121][ T95] process_one_work+0x945/0x15c0 [ 31.974813][ T95] worker_thread+0x96/0xe20 [ 31.979331][ T95] kthread+0x318/0x420 [ 31.983404][ T95] ret_from_fork+0x24/0x30 [ 31.987920][ T95] [ 31.990241][ T95] Freed by task 95: [ 31.994047][ T95] save_stack+0x1b/0x80 [ 31.998316][ T95] __kasan_slab_free+0x117/0x160 [ 32.004375][ T95] kfree+0xd5/0x300 [ 32.008173][ T95] dw2102_probe+0x871/0xc40 [ 32.012679][ T95] usb_probe_interface+0x310/0x800 [ 32.017785][ T95] really_probe+0x290/0xad0 [ 32.022387][ T95] driver_probe_device+0x223/0x350 [ 32.027613][ T95] __device_attach_driver+0x1d1/0x290 [ 32.033542][ T95] bus_for_each_drv+0x162/0x1e0 [ 32.038405][ T95] __device_attach+0x217/0x390 [ 32.043159][ T95] bus_probe_device+0x1e4/0x290 [ 32.047997][ T95] device_add+0x1459/0x1bf0 [ 32.052495][ T95] usb_set_configuration+0xe47/0x17d0 [ 32.058003][ T95] generic_probe+0x9d/0xd5 [ 32.062557][ T95] usb_probe_device+0xaf/0x140 [ 32.067373][ T95] really_probe+0x290/0xad0 [ 32.071864][ T95] driver_probe_device+0x223/0x350 [ 32.077339][ T95] __device_attach_driver+0x1d1/0x290 [ 32.082715][ T95] bus_for_each_drv+0x162/0x1e0 [ 32.087547][ T95] __device_attach+0x217/0x390 [ 32.092299][ T95] bus_probe_device+0x1e4/0x290 [ 32.097133][ T95] device_add+0x1459/0x1bf0 [ 32.101624][ T95] usb_new_device.cold+0x540/0xcd0 [ 32.107165][ T95] hub_event+0x21cb/0x4300 [ 32.111567][ T95] process_one_work+0x945/0x15c0 [ 32.117332][ T95] worker_thread+0x96/0xe20 [ 32.121848][ T95] kthread+0x318/0x420 [ 32.125917][ T95] ret_from_fork+0x24/0x30 [ 32.130316][ T95] [ 32.132631][ T95] The buggy address belongs to the object at ffff8881cd4c0000 [ 32.132631][ T95] which belongs to the cache kmalloc-4k of size 4096 [ 32.146667][ T95] The buggy address is located 992 bytes inside of [ 32.146667][ T95] 4096-byte region [ffff8881cd4c0000, ffff8881cd4c1000) [ 32.161359][ T95] The buggy address belongs to the page: [ 32.166980][ T95] page:ffffea0007353000 refcount:1 mapcount:0 mapping:ffff8881da00c280 index:0x0 compound_mapcount: 0 [ 32.178036][ T95] raw: 0200000000010200 dead000000000100 dead000000000122 ffff8881da00c280 [ 32.186730][ T95] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [ 32.195298][ T95] page dumped because: kasan: bad access detected [ 32.201855][ T95] [ 32.204174][ T95] Memory state around the buggy address: [ 32.209800][ T95] ffff8881cd4c0280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.217849][ T95] ffff8881cd4c0300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.225925][ T95] >ffff8881cd4c0380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.233972][ T95] ^ [ 32.241413][ T95] ffff8881cd4c0400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.249468][ T95] ffff8881cd4c0480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.257695][ T95] ================================================================== [ 32.265754][ T95] Disabling lock debugging due to kernel taint [ 32.271954][ T95] Kernel panic - not syncing: panic_on_warn set ... [ 32.279321][ T95] CPU: 0 PID: 95 Comm: kworker/0:2 Tainted: G B 5.5.0-rc6-syzkaller #0 [ 32.289382][ T95] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 32.299432][ T95] Workqueue: usb_hub_wq hub_event [ 32.304441][ T95] Call Trace: [ 32.307718][ T95] dump_stack+0xef/0x16e [ 32.311974][ T95] panic+0x2aa/0x6e1 [ 32.315862][ T95] ? add_taint.cold+0x16/0x16 [ 32.320529][ T95] ? retint_kernel+0x10/0x10 [ 32.325096][ T95] ? trace_hardirqs_on+0x55/0x200 [ 32.330128][ T95] ? dvb_usb_device_exit+0x19a/0x1a0 [ 32.335545][ T95] end_report+0x43/0x49 [ 32.339682][ T95] ? dvb_usb_device_exit+0x19a/0x1a0 [ 32.344955][ T95] __kasan_report.cold+0x55/0x85 [ 32.349971][ T95] ? dvb_usb_device_exit+0x19a/0x1a0 [ 32.355284][ T95] kasan_report+0xe/0x20 [ 32.359540][ T95] dvb_usb_device_exit+0x19a/0x1a0 [ 32.364658][ T95] ? dvb_usb_exit+0x290/0x290 [ 32.369322][ T95] ? usb_disable_endpoint+0x1ba/0x1f0 [ 32.374694][ T95] ? usb_disable_interface+0x140/0x1a0 [ 32.380145][ T95] usb_unbind_interface+0x1bd/0x8a0 [ 32.385393][ T95] ? usb_autoresume_device+0x60/0x60 [ 32.390667][ T95] device_release_driver_internal+0x42f/0x500 [ 32.396720][ T95] bus_remove_device+0x2eb/0x5a0 [ 32.401693][ T95] device_del+0x481/0xd30 [ 32.406173][ T95] ? device_create_with_groups+0x120/0x120 [ 32.411967][ T95] ? usb_remove_ep_devs+0x3e/0x80 [ 32.416975][ T95] ? remove_intf_ep_devs+0x13f/0x1d0 [ 32.422289][ T95] usb_disable_device+0x23d/0x790 [ 32.427361][ T95] usb_disconnect+0x293/0x900 [ 32.432026][ T95] hub_event+0x1a1d/0x4300 [ 32.436460][ T95] ? hub_port_debounce+0x350/0x350 [ 32.441566][ T95] ? find_held_lock+0x2d/0x110 [ 32.446328][ T95] ? mark_held_locks+0xe0/0xe0 [ 32.451081][ T95] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 32.456641][ T95] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 32.461996][ T95] process_one_work+0x945/0x15c0 [ 32.466928][ T95] ? pwq_dec_nr_in_flight+0x310/0x310 [ 32.472370][ T95] ? do_raw_spin_lock+0x129/0x290 [ 32.477400][ T95] worker_thread+0x7ab/0xe20 [ 32.481981][ T95] ? process_one_work+0x15c0/0x15c0 [ 32.487182][ T95] kthread+0x318/0x420 [ 32.491248][ T95] ? kthread_create_on_node+0xf0/0xf0 [ 32.496601][ T95] ret_from_fork+0x24/0x30 [ 32.501050][ T95] Kernel Offset: disabled [ 32.505459][ T95] Rebooting in 86400 seconds..