at_type_i_discrete={0xc, 0x24, 0x2, 0x1, 0x1, 0x1, 0x6, 0x8, ' (05a9:0601) [ 1484.835024][ T22] uvcvideo: No valid video chain found. [ 1484.876090][ T3606] usb 1-1: string descriptor 0 read error: -71 [ 1484.897543][ T3606] option 1-1:0.197: GSM modem (1-port) converter detected [ 1484.906144][T17961] usb 5-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 1484.909111][ T3606] usb 1-1: USB disconnect, device number 67 [ 1484.923396][T17961] usb 5-1: config 1 interface 0 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 6 [ 1484.929180][ T3606] option 1-1:0.197: device disconnected [ 1485.029540][T31996] udc-core: couldn't find an available UDC or it's busy [ 1485.036609][T31996] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 1485.051321][ T22] usb 3-1: USB disconnect, device number 65 [ 1485.096125][T17961] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1485.105247][T17961] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1485.113526][T17961] usb 5-1: Product: syz [ 1485.117705][T17961] usb 5-1: Manufacturer: syz [ 1485.122272][T17961] usb 5-1: SerialNumber: syz 04:03:54 executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100007d927f400912232348c300000001090212000100001d00090400000072458a00"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_open_dev$hiddev(0x0, 0x0, 0x0) r1 = syz_open_dev$hiddev(0x0, 0x0, 0x0) ioctl$HIDIOCGREPORT(r1, 0xc0c0583b, &(0x7f0000000100)={0x0, 0x0, 0x48000}) r2 = syz_open_dev$hiddev(&(0x7f0000000000)='/dev/usb/hiddev#\x00', 0x3, 0x800) ioctl$HIDIOCGPHYS(r2, 0x80404812, &(0x7f00000000c0)) ioctl$HIDIOCAPPLICATION(r2, 0x660c, 0x1ff) syz_usb_ep_read(r0, 0x1d, 0x10, &(0x7f0000000040)=""/16) [ 1485.166936][T17961] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1485.496009][ T3606] usb 4-1: new high-speed USB device number 62 using dummy_hcd 04:03:54 executing program 0: syz_usb_connect(0x1, 0x24, &(0x7f0000000240)=ANY=[@ANYRESOCT], 0x0) [ 1485.706685][ T3606] usb 4-1: New USB device found, idVendor=1209, idProduct=2323, bcdDevice=c3.48 [ 1485.715848][ T3606] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1485.727222][ T3606] usb 4-1: config 0 descriptor?? [ 1485.776020][T17961] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1485.815970][T11101] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 1485.986189][ C1] ================================================================== [ 1485.994501][ C1] BUG: KASAN: stack-out-of-bounds in ath9k_hif_usb_rx_cb+0xe11/0xf90 [ 1485.996160][ T3092] usb 1-1: new low-speed USB device number 68 using dummy_hcd [ 1486.002563][ C1] Write of size 8 at addr ffff8881da2578c8 by task ksoftirqd/1/16 [ 1486.002575][ C1] [ 1486.002588][ C1] CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 5.7.0-rc1-syzkaller #0 [ 1486.002599][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1486.002603][ C1] Call Trace: [ 1486.002627][ C1] dump_stack+0xef/0x16e [ 1486.026109][T11101] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1486.028303][ C1] print_address_description.constprop.0.cold+0xd3/0x314 [ 1486.028319][ C1] ? ath9k_hif_usb_rx_cb+0xe11/0xf90 [ 1486.028330][ C1] __kasan_report.cold+0x37/0x92 [ 1486.028342][ C1] ? ath9k_hif_usb_rx_cb+0xe11/0xf90 [ 1486.028360][ C1] ? ath9k_hif_usb_rx_cb+0xe11/0xf90 [ 1486.084469][ C1] kasan_report+0x33/0x50 [ 1486.088796][ C1] ath9k_hif_usb_rx_cb+0xe11/0xf90 [ 1486.093885][ C1] ? hif_usb_mgmt_cb+0x310/0x310 [ 1486.098798][ C1] ? do_raw_read_unlock+0x3b/0x70 [ 1486.103806][ C1] ? _raw_read_unlock+0x1a/0x30 [ 1486.108658][ C1] __usb_hcd_giveback_urb+0x1f2/0x470 [ 1486.114027][ C1] usb_hcd_giveback_urb+0x368/0x420 [ 1486.116064][T11101] usb 3-1: New USB device found, idVendor=05a9, idProduct=0601, bcdDevice=ff.b4 [ 1486.119218][ C1] dummy_timer+0x125e/0x32b4 [ 1486.119234][ C1] ? dummy_udc_probe+0x980/0x980 [ 1486.119248][ C1] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 1486.119260][ C1] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 1486.119278][ C1] call_timer_fn+0x1ac/0x700 [ 1486.128398][T11101] usb 3-1: New USB device strings: Mfr=255, Product=0, SerialNumber=0 [ 1486.132856][ C1] ? dummy_udc_probe+0x980/0x980 [ 1486.137872][T11101] usb 3-1: Manufacturer: syz [ 1486.143311][ C1] ? timer_fixup_init+0x60/0x60 [ 1486.158489][T11101] usb 3-1: config 0 descriptor?? [ 1486.161260][ C1] ? lock_downgrade+0x720/0x720 [ 1486.161275][ C1] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 1486.161287][ C1] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 1486.161300][ C1] ? _raw_spin_unlock_irq+0x1f/0x30 [ 1486.161319][ C1] ? dummy_udc_probe+0x980/0x980 [ 1486.189262][T32006] udc-core: couldn't find an available UDC or it's busy [ 1486.190901][ C1] run_timer_softirq+0x5f9/0x1500 [ 1486.190914][ C1] ? add_timer+0x7a0/0x7a0 [ 1486.190928][ C1] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 1486.190938][ C1] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 1486.190956][ C1] __do_softirq+0x21e/0x9aa [ 1486.196277][T32006] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 1486.201402][ C1] ? takeover_tasklets+0x770/0x770 [ 1486.213535][T11101] uvcvideo: Found UVC 114.a2 device (05a9:0601) [ 1486.218236][ C1] run_ksoftirqd+0x1f/0x40 [ 1486.218250][ C1] smpboot_thread_fn+0x3e8/0x870 [ 1486.218264][ C1] ? __smpboot_create_thread.part.0+0x340/0x340 [ 1486.218276][ C1] ? __kthread_parkme+0x118/0x1d0 [ 1486.218287][ C1] ? __smpboot_create_thread.part.0+0x340/0x340 [ 1486.218298][ C1] kthread+0x326/0x430 [ 1486.218310][ C1] ? kthread_create_on_node+0xf0/0xf0 [ 1486.218321][ C1] ret_from_fork+0x24/0x30 [ 1486.218327][ C1] [ 1486.218331][ C1] The buggy address belongs to the page: [ 1486.218343][ C1] page:ffffea00076895c0 refcount:0 mapcount:0 mapping:00000000aabb68ae index:0x0 [ 1486.218351][ C1] flags: 0x200000000000000() [ 1486.218367][ C1] raw: 0200000000000000 ffffea00076895c8 ffffea00076895c8 0000000000000000 [ 1486.222790][T11101] uvcvideo: No valid video chain found. 04:03:55 executing program 5: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000b884c10000000000000009000001f7021b0001000000000904000001da3d25000905850b0081"], 0x0) syz_usb_disconnect(r0) syz_usb_connect(0x0, 0x10f, &(0x7f0000000000)=ANY=[@ANYRES64=r0], 0x0) [ 1486.228317][ C1] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 1486.228323][ C1] page dumped because: kasan: bad access detected [ 1486.228327][ C1] [ 1486.228336][ C1] addr ffff8881da2578c8 is located in stack of task ksoftirqd/1/16 at offset 128 in frame: [ 1486.228350][ C1] ath9k_hif_usb_rx_cb+0x0/0xf90 [ 1486.228356][ C1] [ 1486.228362][ C1] this frame has 1 object: [ 1486.228369][ C1] [48, 128) 'skb_pool' [ 1486.228372][ C1] [ 1486.228376][ C1] Memory state around the buggy address: [ 1486.228392][ C1] ffff8881da257780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1486.233750][ T3606] gs_usb 4-1:0.0: Couldn't get device config: (err=-71) [ 1486.238141][ C1] ffff8881da257800: 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 f1 f1 00 [ 1486.238150][ C1] >ffff8881da257880: 00 00 00 00 00 00 00 00 00 f3 f3 f3 f3 00 00 00 [ 1486.238156][ C1] ^ [ 1486.238164][ C1] ffff8881da257900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1486.238173][ C1] ffff8881da257980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1486.238178][ C1] ================================================================== [ 1486.238182][ C1] Disabling lock debugging due to kernel taint [ 1486.238187][ C1] Kernel panic - not syncing: panic_on_warn set ... [ 1486.238204][ C1] CPU: 1 PID: 16 Comm: ksoftirqd/1 Tainted: G B 5.7.0-rc1-syzkaller #0 [ 1486.256935][ T3606] gs_usb: probe of 4-1:0.0 failed with error -71 [ 1486.257810][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 04:03:55 executing program 1: syz_usb_connect(0x3, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b6c0ff20731c1f86d61f000000010902120001008f00000904ea4000caf8bbff"], 0x0) syz_usb_connect$printer(0x3, 0x2d, &(0x7f0000000040)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x20, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x80, 0x80, 0x80, [{{0x9, 0x4, 0x0, 0x2, 0x2, 0x7, 0x1, 0x1, 0x4, "", {{{0x9, 0x5, 0x1, 0x2, 0x200, 0x8, 0x5, 0x4}}}}}]}}]}}, &(0x7f0000000400)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x250, 0x1, 0xb3, 0x7f, 0x10, 0x4}, 0x57, &(0x7f00000000c0)={0x5, 0xf, 0x57, 0x5, [@ssp_cap={0x24, 0x10, 0xa, 0x72, 0x6, 0x0, 0xf, 0x4, [0x30, 0x30, 0x3f0f, 0xffc0ff, 0xffc007, 0xf]}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "de318ca27543a14ef1363794f5628e9a"}, @ssp_cap={0x14, 0x10, 0xa, 0x7, 0x2, 0xfff, 0xf000, 0x100, [0xc030, 0x7f80cf]}, @ptm_cap={0x3}, @ptm_cap={0x3}]}, 0x7, [{0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x44c}}, {0x1e, &(0x7f0000000180)=@string={0x1e, 0x3, "12bd8638918df052d00e1607918ba93a23d150022b6eb6fd9b7964b7"}}, {0x1a, &(0x7f00000001c0)=@string={0x1a, 0x3, "f6b9d103db35a95c28114877b778d38e7a3af1c70e073df4"}}, {0x58, &(0x7f0000000200)=@string={0x58, 0x3, "aafc959e1868d9476651d8b079ee0e3957e72b3fe689669cd58f35a08bbc225b8fe7771711e5bddec37cb29f49281244c071680ecfdb01c4baf8b148d927ee0207802c20c5021d237bfcb8fcb1bea7792696e8c1a96b"}}, {0xfd, &(0x7f0000000280)=@string={0xfd, 0x3, "cbb1818e108839177e5fc113cfdfed69da6795feaf695e1d40805a665385abc3e7138bf8706944ed67fb612d9e002500a6191be7995c09c06c6800aa8d94ef9e08f24ea5b9ba88192d13e96d99775319cda8e159202a3e9eeb0ef088da3c38234f559851c8b74d54511a1bacc04cec75e625b62d925f64e769ce6ae72a618d3de55e094f42b6fb1ba4f18a322490e986fd9c82647f23400ff93734286fd142c0b11c665566a37e2d82756cef4835e18af821b6a546a5df54809b7a8c7d1fcc16261880827d4e1e31faa3d489953b94f00468b83437bc11aa3807c1353606cb6ad86b2b920bd189a81b7f29a28ce1ccc33c35362fee7e68ffcf5602"}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x44a}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x418}}]}) r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000b884c110110f21108a800000000109021b0001000000000904000001da3d25000905850b0081"], 0x0) syz_usb_disconnect(r0) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000540)={0x14, &(0x7f0000000480)={0x65afd33a001df8b7, 0xd, 0x60, {0x60, 0x22, "adfdcbcbf374a4dd143a22c9435b17b9c795efa91d8cd063b1c7fc6dd677cb43969a9aa1e91a8bbf124760efbbeab78ab2e81aabb5ac631b9051f0fa6b74a8b1e193ff52ed493dfd6870d662a949c2c67c111651ff1e888eca8bf2606747"}}, &(0x7f0000000500)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000680)={0x1c, &(0x7f0000000580)={0x20, 0x8, 0x6d, "6e6c265523b53fc4403da7db58ddc26f4d10483172b04e0397b762fadf6b325410bb865b8b25960261d1200351dc31be7eb64a94ec5a52c8862a24f4a7229ffc63642f15d0a1e01c2179bff74769608300144e0c3f9ead753cf842cbf45aac48ea970ab2b0c2ecf8b984b2f4ae"}, &(0x7f0000000600)={0x0, 0xa, 0x1, 0x76}, &(0x7f0000000640)={0x0, 0x8, 0x1, 0xfc}}) [ 1486.268032][ T3606] usb 4-1: USB disconnect, device number 62 [ 1486.273320][ C1] Call Trace: [ 1486.273336][ C1] dump_stack+0xef/0x16e [ 1486.273346][ C1] panic+0x2aa/0x6e1 [ 1486.273362][ C1] ? add_taint.cold+0x16/0x16 [ 1486.305890][ T3092] usb 1-1: device descriptor read/64, error 18 [ 1486.306281][ C1] ? print_shadow_for_address+0xb8/0x114 [ 1486.415219][ T12] usb 3-1: USB disconnect, device number 66 [ 1486.416170][ C1] ? trace_hardirqs_off+0x50/0x200 [ 1486.416183][ C1] ? ath9k_hif_usb_rx_cb+0xe11/0xf90 [ 1486.416192][ C1] end_report+0x4d/0x53 [ 1486.416207][ C1] __kasan_report.cold+0x72/0x92 [ 1486.544466][ C1] ? ath9k_hif_usb_rx_cb+0xe11/0xf90 [ 1486.549728][ C1] ? ath9k_hif_usb_rx_cb+0xe11/0xf90 [ 1486.554984][ C1] kasan_report+0x33/0x50 [ 1486.559286][ C1] ath9k_hif_usb_rx_cb+0xe11/0xf90 [ 1486.564371][ C1] ? hif_usb_mgmt_cb+0x310/0x310 [ 1486.569282][ C1] ? do_raw_read_unlock+0x3b/0x70 [ 1486.574414][ C1] ? _raw_read_unlock+0x1a/0x30 [ 1486.579243][ C1] __usb_hcd_giveback_urb+0x1f2/0x470 [ 1486.584594][ C1] usb_hcd_giveback_urb+0x368/0x420 [ 1486.589767][ C1] dummy_timer+0x125e/0x32b4 [ 1486.594331][ C1] ? dummy_udc_probe+0x980/0x980 [ 1486.599259][ C1] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 1486.604778][ C1] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 1486.610061][ C1] call_timer_fn+0x1ac/0x700 [ 1486.614715][ C1] ? dummy_udc_probe+0x980/0x980 [ 1486.619726][ C1] ? timer_fixup_init+0x60/0x60 [ 1486.624549][ C1] ? lock_downgrade+0x720/0x720 [ 1486.629375][ C1] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 1486.634908][ C1] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 1486.640165][ C1] ? _raw_spin_unlock_irq+0x1f/0x30 [ 1486.645350][ C1] ? dummy_udc_probe+0x980/0x980 [ 1486.650259][ C1] run_timer_softirq+0x5f9/0x1500 [ 1486.655272][ C1] ? add_timer+0x7a0/0x7a0 [ 1486.659788][ C1] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 1486.665304][ C1] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 1486.670575][ C1] __do_softirq+0x21e/0x9aa [ 1486.675057][ C1] ? takeover_tasklets+0x770/0x770 [ 1486.680140][ C1] run_ksoftirqd+0x1f/0x40 [ 1486.684528][ C1] smpboot_thread_fn+0x3e8/0x870 [ 1486.689439][ C1] ? __smpboot_create_thread.part.0+0x340/0x340 [ 1486.695656][ C1] ? __kthread_parkme+0x118/0x1d0 [ 1486.695872][ T3092] usb 1-1: device descriptor read/64, error 18 [ 1486.700672][ C1] ? __smpboot_create_thread.part.0+0x340/0x340 [ 1486.700683][ C1] kthread+0x326/0x430 [ 1486.700693][ C1] ? kthread_create_on_node+0xf0/0xf0 [ 1486.700711][ C1] ret_from_fork+0x24/0x30 [ 1486.727415][ C1] Kernel Offset: disabled [ 1486.731725][ C1] Rebooting in 86400 seconds..