Warning: Permanently added '10.128.0.132' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 32.829390][ T12] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 33.069353][ T12] usb 1-1: Using ep0 maxpacket: 8 [ 33.229411][ T12] usb 1-1: unable to get BOS descriptor or descriptor too short [ 33.309439][ T12] usb 1-1: config 1 has an invalid interface number: 191 but max is 0 [ 33.317719][ T12] usb 1-1: config 1 has an invalid interface association descriptor of length 2, skipping [ 33.328320][ T12] usb 1-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 33.338605][ T12] usb 1-1: config 1 has no interface number 0 [ 33.344821][ T12] usb 1-1: config 1 interface 191 altsetting 9 bulk endpoint 0xF has invalid maxpacket 56 [ 33.354782][ T12] usb 1-1: config 1 interface 191 altsetting 9 has a duplicate endpoint with address 0xF, skipping [ 33.365550][ T12] usb 1-1: config 1 interface 191 altsetting 9 endpoint 0x9 has invalid maxpacket 120, setting to 64 [ 33.376464][ T12] usb 1-1: config 1 interface 191 altsetting 9 has an invalid endpoint with address 0x0, skipping [ 33.387157][ T12] usb 1-1: config 1 interface 191 altsetting 9 bulk endpoint 0x6 has invalid maxpacket 8 [ 33.397377][ T12] usb 1-1: config 1 interface 191 has no altsetting 0 [ 33.639425][ T12] usb 1-1: string descriptor 0 read error: -22 [ 33.645708][ T12] usb 1-1: New USB device found, idVendor=1618, idProduct=9116, bcdDevice=7b.8c [ 33.654880][ T12] usb 1-1: New USB device strings: Mfr=4, Product=7, SerialNumber=1 [ 33.702897][ T12] rsi_91x: rsi_probe: Failed to init usb interface [ 33.710536][ T12] ================================================================== [ 33.718734][ T12] BUG: KASAN: double-free or invalid-free in rsi_91x_deinit+0x270/0x2f0 [ 33.727062][ T12] [ 33.729395][ T12] CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.3.0-rc2+ #25 [ 33.736848][ T12] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 33.747046][ T12] Workqueue: usb_hub_wq hub_event [ 33.752067][ T12] Call Trace: [ 33.755449][ T12] dump_stack+0xca/0x13e [ 33.759723][ T12] print_address_description+0x6a/0x32c [ 33.765277][ T12] ? rsi_91x_deinit+0x270/0x2f0 [ 33.770127][ T12] kasan_report_invalid_free+0x61/0xa0 [ 33.775591][ T12] ? rsi_91x_deinit+0x270/0x2f0 [ 33.780450][ T12] __kasan_slab_free+0x162/0x180 [ 33.785393][ T12] ? rsi_91x_deinit+0x270/0x2f0 [ 33.790246][ T12] kfree+0xe4/0x2f0 [ 33.794059][ T12] rsi_91x_deinit+0x270/0x2f0 [ 33.798740][ T12] rsi_probe+0xcec/0x15a0 [ 33.803074][ T12] ? rsi_disconnect+0x630/0x630 [ 33.807928][ T12] ? lockdep_hardirqs_on+0x379/0x580 [ 33.813237][ T12] ? __pm_runtime_resume+0x111/0x180 [ 33.818522][ T12] usb_probe_interface+0x305/0x7a0 [ 33.823728][ T12] ? usb_probe_device+0x100/0x100 [ 33.828782][ T12] really_probe+0x281/0x650 [ 33.833288][ T12] driver_probe_device+0x101/0x1b0 [ 33.838412][ T12] __device_attach_driver+0x1c2/0x220 [ 33.843816][ T12] ? driver_allows_async_probing+0x160/0x160 [ 33.849903][ T12] bus_for_each_drv+0x15c/0x1e0 [ 33.854760][ T12] ? bus_rescan_devices+0x20/0x20 [ 33.859791][ T12] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 33.865614][ T12] ? lockdep_hardirqs_on+0x379/0x580 [ 33.870922][ T12] __device_attach+0x217/0x360 [ 33.875692][ T12] ? device_bind_driver+0xd0/0xd0 [ 33.881183][ T12] ? kobject_uevent_env+0x29e/0x1160 [ 33.886476][ T12] ? kobject_uevent_env+0x2a8/0x1160 [ 33.891773][ T12] bus_probe_device+0x1e4/0x290 [ 33.896642][ T12] ? blocking_notifier_call_chain+0x54/0xa0 [ 33.902631][ T12] device_add+0xae6/0x16f0 [ 33.907054][ T12] ? uevent_store+0x50/0x50 [ 33.911560][ T12] usb_set_configuration+0xdf6/0x1670 [ 33.916951][ T12] generic_probe+0x9d/0xd5 [ 33.921371][ T12] usb_probe_device+0x99/0x100 [ 33.926227][ T12] ? usb_suspend+0x620/0x620 [ 33.930820][ T12] really_probe+0x281/0x650 [ 33.935323][ T12] driver_probe_device+0x101/0x1b0 [ 33.940438][ T12] __device_attach_driver+0x1c2/0x220 [ 33.945812][ T12] ? driver_allows_async_probing+0x160/0x160 [ 33.951794][ T12] bus_for_each_drv+0x15c/0x1e0 [ 33.956657][ T12] ? bus_rescan_devices+0x20/0x20 [ 33.961700][ T12] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 33.967514][ T12] ? lockdep_hardirqs_on+0x379/0x580 [ 33.972807][ T12] __device_attach+0x217/0x360 [ 33.977573][ T12] ? device_bind_driver+0xd0/0xd0 [ 33.982621][ T12] ? kobject_uevent_env+0x29e/0x1160 [ 33.987911][ T12] ? kobject_uevent_env+0x2a8/0x1160 [ 33.993201][ T12] bus_probe_device+0x1e4/0x290 [ 33.998256][ T12] ? blocking_notifier_call_chain+0x54/0xa0 [ 34.004247][ T12] device_add+0xae6/0x16f0 [ 34.008668][ T12] ? uevent_store+0x50/0x50 [ 34.013176][ T12] usb_new_device.cold+0x6a4/0xe79 [ 34.018294][ T12] hub_event+0x1b5c/0x3640 [ 34.022712][ T12] ? hub_port_debounce+0x260/0x260 [ 34.027828][ T12] process_one_work+0x92b/0x1530 [ 34.032777][ T12] ? pwq_dec_nr_in_flight+0x310/0x310 [ 34.038152][ T12] ? do_raw_spin_lock+0x11a/0x280 [ 34.043186][ T12] worker_thread+0x96/0xe20 [ 34.047703][ T12] ? process_one_work+0x1530/0x1530 [ 34.052921][ T12] kthread+0x318/0x420 [ 34.057009][ T12] ? kthread_create_on_node+0xf0/0xf0 [ 34.062386][ T12] ret_from_fork+0x24/0x30 [ 34.066809][ T12] [ 34.069132][ T12] Allocated by task 12: [ 34.073291][ T12] save_stack+0x1b/0x80 [ 34.077455][ T12] __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 34.083093][ T12] rsi_probe+0x11a/0x15a0 [ 34.087419][ T12] usb_probe_interface+0x305/0x7a0 [ 34.092530][ T12] really_probe+0x281/0x650 [ 34.097044][ T12] driver_probe_device+0x101/0x1b0 [ 34.102313][ T12] __device_attach_driver+0x1c2/0x220 [ 34.107693][ T12] bus_for_each_drv+0x15c/0x1e0 [ 34.112548][ T12] __device_attach+0x217/0x360 [ 34.117314][ T12] bus_probe_device+0x1e4/0x290 [ 34.122163][ T12] device_add+0xae6/0x16f0 [ 34.126591][ T12] usb_set_configuration+0xdf6/0x1670 [ 34.131973][ T12] generic_probe+0x9d/0xd5 [ 34.136501][ T12] usb_probe_device+0x99/0x100 [ 34.141277][ T12] really_probe+0x281/0x650 [ 34.145785][ T12] driver_probe_device+0x101/0x1b0 [ 34.150905][ T12] __device_attach_driver+0x1c2/0x220 [ 34.156291][ T12] bus_for_each_drv+0x15c/0x1e0 [ 34.161141][ T12] __device_attach+0x217/0x360 [ 34.165995][ T12] bus_probe_device+0x1e4/0x290 [ 34.170847][ T12] device_add+0xae6/0x16f0 [ 34.175283][ T12] usb_new_device.cold+0x6a4/0xe79 [ 34.180396][ T12] hub_event+0x1b5c/0x3640 [ 34.184809][ T12] process_one_work+0x92b/0x1530 [ 34.189743][ T12] worker_thread+0x96/0xe20 [ 34.194254][ T12] kthread+0x318/0x420 [ 34.198331][ T12] ret_from_fork+0x24/0x30 [ 34.202735][ T12] [ 34.205060][ T12] Freed by task 12: [ 34.208869][ T12] save_stack+0x1b/0x80 [ 34.213026][ T12] __kasan_slab_free+0x130/0x180 [ 34.217968][ T12] kfree+0xe4/0x2f0 [ 34.221784][ T12] rsi_probe+0xdfd/0x15a0 [ 34.226117][ T12] usb_probe_interface+0x305/0x7a0 [ 34.231231][ T12] really_probe+0x281/0x650 [ 34.235736][ T12] driver_probe_device+0x101/0x1b0 [ 34.240859][ T12] __device_attach_driver+0x1c2/0x220 [ 34.246239][ T12] bus_for_each_drv+0x15c/0x1e0 [ 34.251094][ T12] __device_attach+0x217/0x360 [ 34.255858][ T12] bus_probe_device+0x1e4/0x290 [ 34.260709][ T12] device_add+0xae6/0x16f0 [ 34.265139][ T12] usb_set_configuration+0xdf6/0x1670 [ 34.270508][ T12] generic_probe+0x9d/0xd5 [ 34.274927][ T12] usb_probe_device+0x99/0x100 [ 34.279713][ T12] really_probe+0x281/0x650 [ 34.284211][ T12] driver_probe_device+0x101/0x1b0 [ 34.289323][ T12] __device_attach_driver+0x1c2/0x220 [ 34.294700][ T12] bus_for_each_drv+0x15c/0x1e0 [ 34.299572][ T12] __device_attach+0x217/0x360 [ 34.304341][ T12] bus_probe_device+0x1e4/0x290 [ 34.309189][ T12] device_add+0xae6/0x16f0 [ 34.313608][ T12] usb_new_device.cold+0x6a4/0xe79 [ 34.318733][ T12] hub_event+0x1b5c/0x3640 [ 34.323166][ T12] process_one_work+0x92b/0x1530 [ 34.328108][ T12] worker_thread+0x96/0xe20 [ 34.332616][ T12] kthread+0x318/0x420 [ 34.336682][ T12] ret_from_fork+0x24/0x30 [ 34.341086][ T12] [ 34.343416][ T12] The buggy address belongs to the object at ffff8881d2eedb80 [ 34.343416][ T12] which belongs to the cache kmalloc-512 of size 512 [ 34.357475][ T12] The buggy address is located 0 bytes inside of [ 34.357475][ T12] 512-byte region [ffff8881d2eedb80, ffff8881d2eedd80) [ 34.370572][ T12] The buggy address belongs to the page: [ 34.376210][ T12] page:ffffea00074bbb00 refcount:1 mapcount:0 mapping:ffff8881da002500 index:0x0 compound_mapcount: 0 [ 34.387150][ T12] flags: 0x200000000010200(slab|head) [ 34.392527][ T12] raw: 0200000000010200 ffffea00074bba00 0000000600000006 ffff8881da002500 [ 34.401119][ T12] raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 [ 34.409699][ T12] page dumped because: kasan: bad access detected [ 34.416104][ T12] [ 34.418420][ T12] Memory state around the buggy address: [ 34.424056][ T12] ffff8881d2eeda80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.432121][ T12] ffff8881d2eedb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.440211][ T12] >ffff8881d2eedb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.448273][ T12] ^ [ 34.452350][ T12] ffff8881d2eedc00: fb