./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3928166862
<...>
no interfaces have a carrier
[ 25.007227][ T3188] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: [ 25.344645][ T3280] sshd (3280) used greatest stack depth: 20352 bytes left
OK
syzkaller
Warning: Permanently added '10.128.0.223' (ECDSA) to the list of known hosts.
execve("./syz-executor3928166862", ["./syz-executor3928166862"], 0x7ffc27c89f80 /* 10 vars */) = 0
brk(NULL) = 0x555555788000
brk(0x555555788c40) = 0x555555788c40
arch_prctl(ARCH_SET_FS, 0x555555788300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor3928166862", 4096) = 28
brk(0x5555557a9c40) = 0x5555557a9c40
brk(0x5555557aa000) = 0x5555557aa000
mprotect(0x7f500881e000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 3
ioctl(3, USB_RAW_IOCTL_INIT, 0x7ffd9ca82010) = 0
ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd9ca82010) = 0
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd9ca82010) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd9ca81000) = 18
syzkaller login: [ 48.111015][ T3273] usb 1-1: new high-speed USB device number 2 using dummy_hcd
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd9ca82010) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd9ca81000) = 18
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd9ca82010) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd9ca81000) = 9
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd9ca82010) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd9ca81000) = 72
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd9ca82010) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd9ca81000) = 4
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd9ca82010) = 0
[ 48.471891][ T3273] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd9ca81000) = 8
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd9ca82010) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd9ca81000) = 8
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd9ca82010) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd9ca81000) = 8
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd9ca82010) = 0
ioctl(3, USB_RAW_IOCTL_VBUS_DRAW, 0xfa) = 0
ioctl(3, USB_RAW_IOCTL_CONFIGURE, 0) = 0
ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f50088243ac) = 9
ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f50088243bc) = 10
ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f50088243cc) = 12
ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f50088243dc) = 11
ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f50088243ec) = 13
ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f50088243fc) = 14
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffd9ca81000) = 0
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd9ca82010) = 0
[ 48.631530][ T3273] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 48.631554][ T3273] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 48.631569][ T3273] usb 1-1: Product: syz
[ 48.631578][ T3273] usb 1-1: Manufacturer: syz
[ 48.631587][ T3273] usb 1-1: SerialNumber: syz
[ 48.673423][ T3273] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffd9ca81000) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd9ca82010) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffd9ca81000) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd9ca82010) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffd9ca81000) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd9ca82010) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffd9ca81000) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd9ca82010) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffd9ca81000) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd9ca82010) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffd9ca81000) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd9ca82010) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffd9ca81000) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd9ca82010) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffd9ca81000) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd9ca82010) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffd9ca81000) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd9ca82010) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffd9ca81000) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd9ca82010) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffd9ca81000) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd9ca82010) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffd9ca81000) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd9ca82010) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffd9ca81000) = 1856
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd9ca82010) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffd9ca81000) = 0
[ 49.251310][ T3273] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[ 49.251647][ T3273] ------------[ cut here ]------------
[ 49.251653][ T3273] usb 1-1: BOGUS urb xfer, pipe 3 != type 1
[ 49.251848][ T3273] WARNING: CPU: 1 PID: 3273 at drivers/usb/core/urb.c:503 usb_submit_urb+0xce2/0x1920
[ 49.281982][ T3273] Modules linked in:
[ 49.285879][ T3273] CPU: 1 PID: 3273 Comm: kworker/1:2 Not tainted 5.19.0-rc1-syzkaller-00303-g7a68065eb9cd #0
[ 49.296126][ T3273] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 49.306304][ T3273] Workqueue: events request_firmware_work_func
[ 49.312584][ T3273] RIP: 0010:usb_submit_urb+0xce2/0x1920
[ 49.318179][ T3273] Code: 48 c1 e8 03 8a 04 18 84 c0 0f 85 d4 08 00 00 45 8b 06 48 c7 c7 60 a6 32 8b 48 8b 74 24 20 4c 89 fa 89 e9 31 c0 e8 ee e7 42 fb <0f> 0b 4c 8b 74 24 30 44 89 e5 48 89 ef 48 c7 c6 f0 dd 55 8d e8 25
[ 49.337942][ T3273] RSP: 0018:ffffc90002fff9d8 EFLAGS: 00010246
[ 49.344207][ T3273] RAX: 03b025edf3fdbd00 RBX: dffffc0000000000 RCX: ffff8880207b9d80
[ 49.352254][ T3273] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
[ 49.360237][ T3273] RBP: 0000000000000003 R08: ffffffff816bd62d R09: ffffed1017364f14
[ 49.368304][ T3273] R10: ffffed1017364f14 R11: 1ffff11017364f13 R12: 0000000000000003
[ 49.376417][ T3273] R13: ffff888016cabf00 R14: ffffffff8b32a44c R15: ffff8880177bd348
[ 49.384464][ T3273] FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
[ 49.393512][ T3273] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 49.400111][ T3273] CR2: 000055b69dc70fd8 CR3: 0000000072eb9000 CR4: 00000000003506e0
[ 49.408141][ T3273] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 49.408141][ T3273] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 49.408168][ T3273] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 49.408184][ T3273] Call Trace:
[ 49.408192][ T3273]
[ 49.408211][ T3273] ? usb_anchor_urb+0x1ca/0x240
[ 49.408242][ T3273] ath9k_hif_usb_alloc_urbs+0x88a/0xe90
[ 49.408282][ T3273] ath9k_hif_usb_firmware_cb+0x12b/0x4d0
[ 49.408312][ T3273] request_firmware_work_func+0x198/0x270
[ 49.408335][ T3273] ? ath9k_hif_request_firmware+0x4e0/0x4e0
[ 49.408359][ T3273] ? request_firmware_nowait+0x450/0x450
[ 49.408383][ T3273] ? _raw_spin_unlock_irq+0x1f/0x40
[ 49.408425][ T3273] process_one_work+0x81c/0xd10
[ 49.408466][ T3273] ? worker_detach_from_pool+0x260/0x260
[ 49.408493][ T3273] ? _raw_spin_lock_irqsave+0x120/0x120
[ 49.408514][ T3273] ? kthread_data+0x4d/0xc0
[ 49.408541][ T3273] ? wq_worker_running+0x95/0x190
[ 49.408566][ T3273] worker_thread+0xb14/0x1330
[ 49.408601][ T3273] ? _raw_spin_unlock_irqrestore+0xd9/0x130
[ 49.408640][ T3273] kthread+0x266/0x300
[ 49.408659][ T3273] ? rcu_lock_release+0x20/0x20
[ 49.408678][ T3273] ? kthread_blkcg+0xd0/0xd0
[ 49.408701][ T3273] ret_from_fork+0x1f/0x30
[ 49.408740][ T3273]
[ 49.408751][ T3273] Kernel panic - not syncing: panic_on_warn set ...
[ 49.408762][ T3273] CPU: 1 PID: 3273 Comm: kworker/1:2 Not tainted 5.19.0-rc1-syzkaller-00303-g7a68065eb9cd #0
[ 49.408782][ T3273] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 49.408794][ T3273] Workqueue: events request_firmware_work_func
[ 49.408816][ T3273] Call Trace:
[ 49.408824][ T3273]
[ 49.408832][ T3273] dump_stack_lvl+0x1e3/0x2cb
[ 49.408856][ T3273] ? bfq_pos_tree_add_move+0x436/0x436
[ 49.408877][ T3273] ? panic+0x76e/0x76e
[ 49.408903][ T3273] ? vscnprintf+0x59/0x80
[ 49.408921][ T3273] ? usb_submit_urb+0xc40/0x1920
[ 49.408941][ T3273] panic+0x312/0x76e
[ 49.408961][ T3273] ? __warn+0x136/0x230
[ 49.408981][ T3273] ? fb_is_primary_device+0xcc/0xcc
[ 49.409008][ T3273] ? ret_from_fork+0x1f/0x30
[ 49.409029][ T3273] ? usb_submit_urb+0xce2/0x1920
[ 49.409048][ T3273] __warn+0x203/0x230
[ 49.409067][ T3273] ? usb_submit_urb+0xce2/0x1920
[ 49.409087][ T3273] report_bug+0x1b3/0x2d0
[ 49.409113][ T3273] handle_bug+0x3d/0x70
[ 49.409132][ T3273] exc_invalid_op+0x16/0x40
[ 49.409151][ T3273] asm_exc_invalid_op+0x1b/0x20
[ 49.409168][ T3273] RIP: 0010:usb_submit_urb+0xce2/0x1920
[ 49.409188][ T3273] Code: 48 c1 e8 03 8a 04 18 84 c0 0f 85 d4 08 00 00 45 8b 06 48 c7 c7 60 a6 32 8b 48 8b 74 24 20 4c 89 fa 89 e9 31 c0 e8 ee e7 42 fb <0f> 0b 4c 8b 74 24 30 44 89 e5 48 89 ef 48 c7 c6 f0 dd 55 8d e8 25
[ 49.409202][ T3273] RSP: 0018:ffffc90002fff9d8 EFLAGS: 00010246
[ 49.409220][ T3273] RAX: 03b025edf3fdbd00 RBX: dffffc0000000000 RCX: ffff8880207b9d80
[ 49.409234][ T3273] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
[ 49.409247][ T3273] RBP: 0000000000000003 R08: ffffffff816bd62d R09: ffffed1017364f14
[ 49.409266][ T3273] R10: ffffed1017364f14 R11: 1ffff11017364f13 R12: 0000000000000003
[ 49.409279][ T3273] R13: ffff888016cabf00 R14: ffffffff8b32a44c R15: ffff8880177bd348
[ 49.409301][ T3273] ? __wake_up_klogd+0xcd/0x100
[ 49.409329][ T3273] ? usb_submit_urb+0xce2/0x1920
[ 49.409355][ T3273] ? usb_anchor_urb+0x1ca/0x240
[ 49.409378][ T3273] ath9k_hif_usb_alloc_urbs+0x88a/0xe90
[ 49.409407][ T3273] ath9k_hif_usb_firmware_cb+0x12b/0x4d0
[ 49.409434][ T3273] request_firmware_work_func+0x198/0x270
[ 49.409454][ T3273] ? ath9k_hif_request_firmware+0x4e0/0x4e0
[ 49.409476][ T3273] ? request_firmware_nowait+0x450/0x450
[ 49.409500][ T3273] ? _raw_spin_unlock_irq+0x1f/0x40
[ 49.409525][ T3273] process_one_work+0x81c/0xd10
[ 49.409560][ T3273] ? worker_detach_from_pool+0x260/0x260
[ 49.409584][ T3273] ? _raw_spin_lock_irqsave+0x120/0x120
[ 49.409603][ T3273] ? kthread_data+0x4d/0xc0
[ 49.409626][ T3273] ? wq_worker_running+0x95/0x190
[ 49.409648][ T3273] worker_thread+0xb14/0x1330
[ 49.409679][ T3273] ? _raw_spin_unlock_irqrestore+0xd9/0x130
[ 49.409715][ T3273] kthread+0x266/0x300
[ 49.409732][ T3273] ? rcu_lock_release+0x20/0x20
[ 49.409749][ T3273] ? kthread_blkcg+0xd0/0xd0
[ 49.409769][ T3273] ret_from_fork+0x1f/0x30
[ 49.409802][ T3273]
[ 49.416282][ T3273] Kernel Offset: disabled