[info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 15.240711][ C1] random: crng init done [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.45' (ECDSA) to the list of known hosts. 2019/09/16 20:20:37 fuzzer started 2019/09/16 20:20:39 dialing manager at 10.128.0.105:37811 2019/09/16 20:20:39 syscalls: 84 2019/09/16 20:20:39 code coverage: enabled 2019/09/16 20:20:39 comparison tracing: enabled 2019/09/16 20:20:39 extra coverage: enabled 2019/09/16 20:20:39 setuid sandbox: enabled 2019/09/16 20:20:39 namespace sandbox: enabled 2019/09/16 20:20:39 Android sandbox: /sys/fs/selinux/policy does not exist 2019/09/16 20:20:39 fault injection: enabled 2019/09/16 20:20:39 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/09/16 20:20:39 net packet injection: /dev/net/tun can't be opened (open /dev/net/tun: no such device) 2019/09/16 20:20:39 net device setup: enabled 20:20:43 executing program 0: syz_open_dev$hidraw(&(0x7f00000012c0)='/dev/../raw#\x00', 0x0, 0x0) syz_open_dev$hidraw(&(0x7f00000012c0)='/dev/../raw#\x00', 0x0, 0x204) r0 = syz_open_dev$hidraw(0x0, 0x21, 0x4000) r1 = syz_open_dev$hidraw(0x0, 0x9, 0x800) r2 = syz_open_dev$hidraw(0x0, 0x0, 0x0) ioctl$HIDIOCAPPLICATION(0xffffffffffffffff, 0xc0c0583b, 0x20000000) r3 = syz_open_dev$hidraw(&(0x7f0000000140)='/dev/../raw#\x00', 0x0, 0x431422) ioctl$HIDIOCAPPLICATION(r3, 0xc028660f, 0x717002) read$hidraw(r3, 0x0, 0x0) r4 = syz_open_dev$hidraw(0x0, 0x0, 0x201) ioctl$HIDIOCGRAWPHYS(0xffffffffffffffff, 0x80404805, &(0x7f00000011c0)) r5 = syz_open_dev$hiddev(0x0, 0x0, 0x800) ioctl$HIDIOCGNAME(r5, 0x80404806, &(0x7f0000000200)) write$hidraw(r4, &(0x7f0000001200)='\x00', 0xffffff45) read$hidraw(r2, 0x0, 0x0) ioctl$HIDIOCGRDESCSIZE(0xffffffffffffffff, 0x80044801, 0x0) syz_open_dev$evdev(&(0x7f0000001380)='/dev/input/event#\x00', 0x61a, 0x14000) read$hidraw(r2, &(0x7f0000003200)=""/4096, 0xffffffad) syz_open_dev$hidraw(&(0x7f0000001340)='/dev/hidraw#\x00', 0x26c0000, 0x2) syz_open_dev$hidraw(0x0, 0x23, 0x80) ioctl$EVIOCSABS20(0xffffffffffffffff, 0x401845e0, &(0x7f0000000040)={0x0, 0x7, 0x6, 0x0, 0x8, 0x8}) read$hidraw(r0, &(0x7f0000003200)=""/4096, 0xffffffad) syz_open_dev$hidraw(&(0x7f0000000080)='/dev/hidraw#\x00', 0x8, 0x467d357b05e7d304) r6 = syz_open_dev$hidraw(0x0, 0x0, 0x201) write$hidraw(r6, &(0x7f0000001200)='\x00', 0xffffff45) syz_open_dev$hidraw(0x0, 0x0, 0x0) read$hidraw(0xffffffffffffffff, 0x0, 0x0) write$hidraw(0xffffffffffffffff, 0x0, 0x0) read$hidraw(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000180)='/dev/hidraw#\x00', 0x7, 0x551ac3) read$hidraw(0xffffffffffffffff, &(0x7f0000001240)=""/85, 0x55) read$hidraw(r1, 0x0, 0x0) 20:20:43 executing program 2: ioctl$HIDIOCAPPLICATION(0xffffffffffffffff, 0xc0c0583b, 0x20000000) ioctl$HIDIOCGRDESCSIZE(0xffffffffffffffff, 0x80044801, &(0x7f0000000000)) syz_open_dev$hidraw(&(0x7f00000012c0)='/dev/../raw#\x00', 0x0, 0x204) r0 = syz_open_dev$hidraw(0x0, 0x0, 0x4000) r1 = syz_open_dev$hidraw(0x0, 0x0, 0x0) r2 = syz_open_dev$hidraw(0x0, 0x0, 0x201) ioctl$HIDIOCGRAWPHYS(r1, 0x80404805, 0x0) read$hidraw(0xffffffffffffffff, &(0x7f00000000c0)=""/4096, 0x1000) write$hidraw(r2, &(0x7f0000001200)='\x00', 0xffffff45) r3 = syz_open_dev$hiddev(&(0x7f00000011c0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGREPORT(r3, 0x400c4807, &(0x7f0000001380)={0x2, 0x3, 0xffffffffffffff01}) syz_open_dev$evdev(0x0, 0x6, 0x2c2000) r4 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x2, 0x80000) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000180)=""/4096) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000002480)={0x9a, 0x1e, 0xd8, 0x9, "5d6e565b50d83cf14c22bab25dfad60ebf6434d5ef80201abd1c1ab46630a7f2"}) syz_open_dev$hidraw(&(0x7f0000001140)='/dev/hidraw#\x00', 0x5, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, 0x0) r5 = syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) ioctl$HIDIOCGRDESCSIZE(r5, 0x80044801, &(0x7f0000002440)) read$hidraw(r1, &(0x7f0000003200)=""/4096, 0xffffffad) syz_open_dev$hidraw(&(0x7f0000001340)='/dev/hidraw#\x00', 0x0, 0x0) read$hidraw(r0, &(0x7f0000003200)=""/4096, 0xffffffad) r6 = syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) ioctl$HIDIOCAPPLICATION(r6, 0xc0c0583b, 0x20000000) syz_open_dev$hidraw(&(0x7f00000024c0)='/dev/hidraw#\x00', 0xfffffffffffffffd, 0x0) ioctl$HIDIOCGRAWNAME(0xffffffffffffffff, 0x80404804, &(0x7f0000001180)) 20:20:43 executing program 5: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x1b96, 0x6, 0x40, 0x0, 0x4, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x0, {0x9}}}]}}]}}, 0x0) 20:20:43 executing program 3: syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x204) r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x3) ioctl$EVIOCSABS20(r0, 0x401845e0, &(0x7f0000000080)={0x80, 0x0, 0xfffffffffffffffa, 0x8, 0x0, 0x7}) syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000180)='/dev/hidraw#\x00', 0x3f, 0x0) r1 = syz_open_dev$hidraw(0x0, 0x0, 0x0) r2 = syz_open_dev$hidraw(0x0, 0x0, 0x201) ioctl$HIDIOCGNAME(0xffffffffffffffff, 0x80404806, 0x0) write$hidraw(r2, &(0x7f0000001200)='\x00', 0xffffff45) syz_open_dev$evdev(0x0, 0x0, 0x0) read$hidraw(r1, &(0x7f0000003200)=""/4096, 0xffffffad) write$hidraw(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x0) ioctl$HIDIOCSFLAG(0xffffffffffffffff, 0x4004480f, 0xffffffffffffffff) r3 = syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) ioctl$HIDIOCAPPLICATION(r3, 0x40086602, 0x20000000) syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) r4 = syz_open_dev$hidraw(&(0x7f0000000240)='/dev/../raw#\x00', 0x0, 0x12d441) write$hidraw(r4, &(0x7f0000000000)="3a0ac17e0d595345e24ea72cf22da8cf6bd8605cc6dd64", 0x140000) 20:20:43 executing program 4: r0 = syz_usb_connect(0x0, 0x120, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000ac194608f00a57d12d54000000010902120001000000000904090000ffabfe00"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="00001100000022272bb4a43b59a75508"], 0x0, 0x0, 0x0, 0x0}) 20:20:43 executing program 1: syz_open_dev$hidraw(&(0x7f0000000080)='/dev/../raw#\x00', 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000000)='/.\x00\xbaex\xe2\x91\x02C\x00', 0x0, 0x0) r0 = syz_open_dev$hidraw(0x0, 0x0, 0x0) ioctl$HIDIOCAPPLICATION(r0, 0x4020940d, 0x400007) syzkaller login: [ 44.563392][ T1747] cgroup1: Unknown subsys name 'perf_event' [ 44.600461][ T1747] cgroup1: Unknown subsys name 'net_cls' [ 44.717525][ T1752] cgroup1: Unknown subsys name 'perf_event' [ 44.725814][ T1753] cgroup1: Unknown subsys name 'perf_event' [ 44.732385][ T1752] cgroup1: Unknown subsys name 'net_cls' [ 44.749199][ T1753] cgroup1: Unknown subsys name 'net_cls' [ 44.752644][ T1755] cgroup1: Unknown subsys name 'perf_event' [ 44.758022][ T1754] cgroup1: Unknown subsys name 'perf_event' [ 44.768216][ T1757] cgroup1: Unknown subsys name 'perf_event' [ 44.773082][ T1755] cgroup1: Unknown subsys name 'net_cls' [ 44.777146][ T1754] cgroup1: Unknown subsys name 'net_cls' [ 44.790756][ T1757] cgroup1: Unknown subsys name 'net_cls' 20:20:46 executing program 0: syz_open_dev$hidraw(&(0x7f00000012c0)='/dev/../raw#\x00', 0x0, 0x0) syz_open_dev$hidraw(&(0x7f00000012c0)='/dev/../raw#\x00', 0x0, 0x204) r0 = syz_open_dev$hidraw(0x0, 0x21, 0x4000) r1 = syz_open_dev$hidraw(0x0, 0x9, 0x800) r2 = syz_open_dev$hidraw(0x0, 0x0, 0x0) ioctl$HIDIOCAPPLICATION(0xffffffffffffffff, 0xc0c0583b, 0x20000000) r3 = syz_open_dev$hidraw(&(0x7f0000000140)='/dev/../raw#\x00', 0x0, 0x431422) ioctl$HIDIOCAPPLICATION(r3, 0xc028660f, 0x717002) read$hidraw(r3, 0x0, 0x0) r4 = syz_open_dev$hidraw(0x0, 0x0, 0x201) ioctl$HIDIOCGRAWPHYS(0xffffffffffffffff, 0x80404805, &(0x7f00000011c0)) r5 = syz_open_dev$hiddev(0x0, 0x0, 0x800) ioctl$HIDIOCGNAME(r5, 0x80404806, &(0x7f0000000200)) write$hidraw(r4, &(0x7f0000001200)='\x00', 0xffffff45) read$hidraw(r2, 0x0, 0x0) ioctl$HIDIOCGRDESCSIZE(0xffffffffffffffff, 0x80044801, 0x0) syz_open_dev$evdev(&(0x7f0000001380)='/dev/input/event#\x00', 0x61a, 0x14000) read$hidraw(r2, &(0x7f0000003200)=""/4096, 0xffffffad) syz_open_dev$hidraw(&(0x7f0000001340)='/dev/hidraw#\x00', 0x26c0000, 0x2) syz_open_dev$hidraw(0x0, 0x23, 0x80) ioctl$EVIOCSABS20(0xffffffffffffffff, 0x401845e0, &(0x7f0000000040)={0x0, 0x7, 0x6, 0x0, 0x8, 0x8}) read$hidraw(r0, &(0x7f0000003200)=""/4096, 0xffffffad) syz_open_dev$hidraw(&(0x7f0000000080)='/dev/hidraw#\x00', 0x8, 0x467d357b05e7d304) r6 = syz_open_dev$hidraw(0x0, 0x0, 0x201) write$hidraw(r6, &(0x7f0000001200)='\x00', 0xffffff45) syz_open_dev$hidraw(0x0, 0x0, 0x0) read$hidraw(0xffffffffffffffff, 0x0, 0x0) write$hidraw(0xffffffffffffffff, 0x0, 0x0) read$hidraw(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000180)='/dev/hidraw#\x00', 0x7, 0x551ac3) read$hidraw(0xffffffffffffffff, &(0x7f0000001240)=""/85, 0x55) read$hidraw(r1, 0x0, 0x0) 20:20:46 executing program 0: syz_open_dev$hidraw(&(0x7f00000012c0)='/dev/../raw#\x00', 0x0, 0x0) syz_open_dev$hidraw(&(0x7f00000012c0)='/dev/../raw#\x00', 0x0, 0x204) r0 = syz_open_dev$hidraw(0x0, 0x21, 0x4000) r1 = syz_open_dev$hidraw(0x0, 0x9, 0x800) r2 = syz_open_dev$hidraw(0x0, 0x0, 0x0) ioctl$HIDIOCAPPLICATION(0xffffffffffffffff, 0xc0c0583b, 0x20000000) r3 = syz_open_dev$hidraw(&(0x7f0000000140)='/dev/../raw#\x00', 0x0, 0x431422) ioctl$HIDIOCAPPLICATION(r3, 0xc028660f, 0x717002) read$hidraw(r3, 0x0, 0x0) r4 = syz_open_dev$hidraw(0x0, 0x0, 0x201) ioctl$HIDIOCGRAWPHYS(0xffffffffffffffff, 0x80404805, &(0x7f00000011c0)) r5 = syz_open_dev$hiddev(0x0, 0x0, 0x800) ioctl$HIDIOCGNAME(r5, 0x80404806, &(0x7f0000000200)) write$hidraw(r4, &(0x7f0000001200)='\x00', 0xffffff45) read$hidraw(r2, 0x0, 0x0) ioctl$HIDIOCGRDESCSIZE(0xffffffffffffffff, 0x80044801, 0x0) syz_open_dev$evdev(&(0x7f0000001380)='/dev/input/event#\x00', 0x61a, 0x14000) read$hidraw(r2, &(0x7f0000003200)=""/4096, 0xffffffad) syz_open_dev$hidraw(&(0x7f0000001340)='/dev/hidraw#\x00', 0x26c0000, 0x2) syz_open_dev$hidraw(0x0, 0x23, 0x80) ioctl$EVIOCSABS20(0xffffffffffffffff, 0x401845e0, &(0x7f0000000040)={0x0, 0x7, 0x6, 0x0, 0x8, 0x8}) read$hidraw(r0, &(0x7f0000003200)=""/4096, 0xffffffad) syz_open_dev$hidraw(&(0x7f0000000080)='/dev/hidraw#\x00', 0x8, 0x467d357b05e7d304) r6 = syz_open_dev$hidraw(0x0, 0x0, 0x201) write$hidraw(r6, &(0x7f0000001200)='\x00', 0xffffff45) syz_open_dev$hidraw(0x0, 0x0, 0x0) read$hidraw(0xffffffffffffffff, 0x0, 0x0) write$hidraw(0xffffffffffffffff, 0x0, 0x0) read$hidraw(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000180)='/dev/hidraw#\x00', 0x7, 0x551ac3) read$hidraw(0xffffffffffffffff, &(0x7f0000001240)=""/85, 0x55) read$hidraw(r1, 0x0, 0x0) 20:20:46 executing program 0: syz_open_dev$hidraw(&(0x7f00000012c0)='/dev/../raw#\x00', 0x0, 0x0) syz_open_dev$hidraw(&(0x7f00000012c0)='/dev/../raw#\x00', 0x0, 0x204) r0 = syz_open_dev$hidraw(0x0, 0x21, 0x4000) r1 = syz_open_dev$hidraw(0x0, 0x9, 0x800) r2 = syz_open_dev$hidraw(0x0, 0x0, 0x0) ioctl$HIDIOCAPPLICATION(0xffffffffffffffff, 0xc0c0583b, 0x20000000) r3 = syz_open_dev$hidraw(&(0x7f0000000140)='/dev/../raw#\x00', 0x0, 0x431422) ioctl$HIDIOCAPPLICATION(r3, 0xc028660f, 0x717002) read$hidraw(r3, 0x0, 0x0) r4 = syz_open_dev$hidraw(0x0, 0x0, 0x201) ioctl$HIDIOCGRAWPHYS(0xffffffffffffffff, 0x80404805, &(0x7f00000011c0)) r5 = syz_open_dev$hiddev(0x0, 0x0, 0x800) ioctl$HIDIOCGNAME(r5, 0x80404806, &(0x7f0000000200)) write$hidraw(r4, &(0x7f0000001200)='\x00', 0xffffff45) read$hidraw(r2, 0x0, 0x0) ioctl$HIDIOCGRDESCSIZE(0xffffffffffffffff, 0x80044801, 0x0) syz_open_dev$evdev(&(0x7f0000001380)='/dev/input/event#\x00', 0x61a, 0x14000) read$hidraw(r2, &(0x7f0000003200)=""/4096, 0xffffffad) syz_open_dev$hidraw(&(0x7f0000001340)='/dev/hidraw#\x00', 0x26c0000, 0x2) syz_open_dev$hidraw(0x0, 0x23, 0x80) ioctl$EVIOCSABS20(0xffffffffffffffff, 0x401845e0, &(0x7f0000000040)={0x0, 0x7, 0x6, 0x0, 0x8, 0x8}) read$hidraw(r0, &(0x7f0000003200)=""/4096, 0xffffffad) syz_open_dev$hidraw(&(0x7f0000000080)='/dev/hidraw#\x00', 0x8, 0x467d357b05e7d304) r6 = syz_open_dev$hidraw(0x0, 0x0, 0x201) write$hidraw(r6, &(0x7f0000001200)='\x00', 0xffffff45) syz_open_dev$hidraw(0x0, 0x0, 0x0) read$hidraw(0xffffffffffffffff, 0x0, 0x0) write$hidraw(0xffffffffffffffff, 0x0, 0x0) read$hidraw(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000180)='/dev/hidraw#\x00', 0x7, 0x551ac3) read$hidraw(0xffffffffffffffff, &(0x7f0000001240)=""/85, 0x55) read$hidraw(r1, 0x0, 0x0) 20:20:46 executing program 1: syz_open_dev$hidraw(&(0x7f0000000080)='/dev/../raw#\x00', 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000000)='/.\x00\xbaex\xe2\x91\x02C\x00', 0x0, 0x0) r0 = syz_open_dev$hidraw(0x0, 0x0, 0x0) ioctl$HIDIOCAPPLICATION(r0, 0x4020940d, 0x400007) 20:20:46 executing program 2: ioctl$HIDIOCAPPLICATION(0xffffffffffffffff, 0xc0c0583b, 0x20000000) ioctl$HIDIOCGRDESCSIZE(0xffffffffffffffff, 0x80044801, &(0x7f0000000000)) syz_open_dev$hidraw(&(0x7f00000012c0)='/dev/../raw#\x00', 0x0, 0x204) r0 = syz_open_dev$hidraw(0x0, 0x0, 0x4000) r1 = syz_open_dev$hidraw(0x0, 0x0, 0x0) r2 = syz_open_dev$hidraw(0x0, 0x0, 0x201) ioctl$HIDIOCGRAWPHYS(r1, 0x80404805, 0x0) read$hidraw(0xffffffffffffffff, &(0x7f00000000c0)=""/4096, 0x1000) write$hidraw(r2, &(0x7f0000001200)='\x00', 0xffffff45) r3 = syz_open_dev$hiddev(&(0x7f00000011c0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGREPORT(r3, 0x400c4807, &(0x7f0000001380)={0x2, 0x3, 0xffffffffffffff01}) syz_open_dev$evdev(0x0, 0x6, 0x2c2000) r4 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x2, 0x80000) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000180)=""/4096) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000002480)={0x9a, 0x1e, 0xd8, 0x9, "5d6e565b50d83cf14c22bab25dfad60ebf6434d5ef80201abd1c1ab46630a7f2"}) syz_open_dev$hidraw(&(0x7f0000001140)='/dev/hidraw#\x00', 0x5, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, 0x0) r5 = syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) ioctl$HIDIOCGRDESCSIZE(r5, 0x80044801, &(0x7f0000002440)) read$hidraw(r1, &(0x7f0000003200)=""/4096, 0xffffffad) syz_open_dev$hidraw(&(0x7f0000001340)='/dev/hidraw#\x00', 0x0, 0x0) read$hidraw(r0, &(0x7f0000003200)=""/4096, 0xffffffad) r6 = syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) ioctl$HIDIOCAPPLICATION(r6, 0xc0c0583b, 0x20000000) syz_open_dev$hidraw(&(0x7f00000024c0)='/dev/hidraw#\x00', 0xfffffffffffffffd, 0x0) ioctl$HIDIOCGRAWNAME(0xffffffffffffffff, 0x80404804, &(0x7f0000001180)) 20:20:46 executing program 1: syz_open_dev$hidraw(&(0x7f0000000080)='/dev/../raw#\x00', 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000000)='/.\x00\xbaex\xe2\x91\x02C\x00', 0x0, 0x0) r0 = syz_open_dev$hidraw(0x0, 0x0, 0x0) ioctl$HIDIOCAPPLICATION(r0, 0x4020940d, 0x400007) 20:20:46 executing program 0: syz_open_dev$hidraw(&(0x7f0000000080)='/dev/../raw#\x00', 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000000)='/.\x00\xbaex\xe2\x91\x02C\x00', 0x0, 0x0) r0 = syz_open_dev$hidraw(0x0, 0x0, 0x0) ioctl$HIDIOCAPPLICATION(r0, 0x4020940d, 0x400007) 20:20:46 executing program 0: syz_open_dev$hidraw(&(0x7f0000000080)='/dev/../raw#\x00', 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000000)='/.\x00\xbaex\xe2\x91\x02C\x00', 0x0, 0x0) r0 = syz_open_dev$hidraw(0x0, 0x0, 0x0) ioctl$HIDIOCAPPLICATION(r0, 0x4020940d, 0x400007) [ 48.091040][ T83] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 48.149684][ T102] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 48.329639][ T83] usb 5-1: Using ep0 maxpacket: 8 [ 48.389642][ T102] usb 6-1: Using ep0 maxpacket: 32 [ 48.459783][ T83] usb 5-1: config 0 has an invalid interface number: 9 but max is 0 [ 48.467986][ T83] usb 5-1: config 0 has no interface number 0 [ 48.474382][ T83] usb 5-1: New USB device found, idVendor=0af0, idProduct=d157, bcdDevice=54.2d [ 48.483470][ T83] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 48.493776][ T83] usb 5-1: config 0 descriptor?? [ 48.519879][ T102] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 48.649754][ T102] usb 6-1: New USB device found, idVendor=1b96, idProduct=0006, bcdDevice= 0.40 [ 48.658982][ T102] usb 6-1: New USB device strings: Mfr=0, Product=4, SerialNumber=3 [ 48.667119][ T102] usb 6-1: Product: syz [ 48.671308][ T102] usb 6-1: SerialNumber: syz [ 48.711196][ T102] usbhid 6-1:1.0: couldn't find an input interrupt endpoint [ 48.741157][ T83] hso 5-1:0.9: Failed to find BULK IN ep [ 48.912752][ T102] usb 6-1: USB disconnect, device number 2 [ 48.942384][ T83] usb 5-1: USB disconnect, device number 2 [ 49.679701][ T102] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 49.709676][ T12] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 49.919665][ T102] usb 6-1: Using ep0 maxpacket: 32 [ 49.949646][ T12] usb 5-1: Using ep0 maxpacket: 8 [ 50.039871][ T102] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 50.069772][ T12] usb 5-1: config 0 has an invalid interface number: 9 but max is 0 [ 50.077811][ T12] usb 5-1: config 0 has no interface number 0 [ 50.083964][ T12] usb 5-1: New USB device found, idVendor=0af0, idProduct=d157, bcdDevice=54.2d [ 50.093076][ T12] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 50.102184][ T12] usb 5-1: config 0 descriptor?? [ 50.199815][ T102] usb 6-1: New USB device found, idVendor=1b96, idProduct=0006, bcdDevice= 0.40 [ 50.209042][ T102] usb 6-1: New USB device strings: Mfr=0, Product=4, SerialNumber=3 [ 50.217418][ T102] usb 6-1: Product: syz [ 50.221618][ T102] usb 6-1: SerialNumber: syz [ 50.261139][ T102] usbhid 6-1:1.0: couldn't find an input interrupt endpoint [ 50.381885][ T12] usb 5-1: USB disconnect, device number 3 [ 50.460525][ T102] usb 6-1: USB disconnect, device number 3 20:20:49 executing program 5: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x1b96, 0x6, 0x40, 0x0, 0x4, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x0, {0x9}}}]}}]}}, 0x0) 20:20:49 executing program 4: r0 = syz_usb_connect(0x0, 0x120, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000ac194608f00a57d12d54000000010902120001000000000904090000ffabfe00"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="00001100000022272bb4a43b59a75508"], 0x0, 0x0, 0x0, 0x0}) 20:20:49 executing program 3: syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x204) r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x3) ioctl$EVIOCSABS20(r0, 0x401845e0, &(0x7f0000000080)={0x80, 0x0, 0xfffffffffffffffa, 0x8, 0x0, 0x7}) syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000180)='/dev/hidraw#\x00', 0x3f, 0x0) r1 = syz_open_dev$hidraw(0x0, 0x0, 0x0) r2 = syz_open_dev$hidraw(0x0, 0x0, 0x201) ioctl$HIDIOCGNAME(0xffffffffffffffff, 0x80404806, 0x0) write$hidraw(r2, &(0x7f0000001200)='\x00', 0xffffff45) syz_open_dev$evdev(0x0, 0x0, 0x0) read$hidraw(r1, &(0x7f0000003200)=""/4096, 0xffffffad) write$hidraw(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x0) ioctl$HIDIOCSFLAG(0xffffffffffffffff, 0x4004480f, 0xffffffffffffffff) r3 = syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) ioctl$HIDIOCAPPLICATION(r3, 0x40086602, 0x20000000) syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) r4 = syz_open_dev$hidraw(&(0x7f0000000240)='/dev/../raw#\x00', 0x0, 0x12d441) write$hidraw(r4, &(0x7f0000000000)="3a0ac17e0d595345e24ea72cf22da8cf6bd8605cc6dd64", 0x140000) 20:20:49 executing program 1: syz_open_dev$hidraw(&(0x7f0000000080)='/dev/../raw#\x00', 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000000)='/.\x00\xbaex\xe2\x91\x02C\x00', 0x0, 0x0) r0 = syz_open_dev$hidraw(0x0, 0x0, 0x0) ioctl$HIDIOCAPPLICATION(r0, 0x4020940d, 0x400007) 20:20:49 executing program 0: syz_open_dev$hidraw(&(0x7f0000000080)='/dev/../raw#\x00', 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000000)='/.\x00\xbaex\xe2\x91\x02C\x00', 0x0, 0x0) r0 = syz_open_dev$hidraw(0x0, 0x0, 0x0) ioctl$HIDIOCAPPLICATION(r0, 0x4020940d, 0x400007) 20:20:49 executing program 2: ioctl$HIDIOCAPPLICATION(0xffffffffffffffff, 0xc0c0583b, 0x20000000) ioctl$HIDIOCGRDESCSIZE(0xffffffffffffffff, 0x80044801, &(0x7f0000000000)) syz_open_dev$hidraw(&(0x7f00000012c0)='/dev/../raw#\x00', 0x0, 0x204) r0 = syz_open_dev$hidraw(0x0, 0x0, 0x4000) r1 = syz_open_dev$hidraw(0x0, 0x0, 0x0) r2 = syz_open_dev$hidraw(0x0, 0x0, 0x201) ioctl$HIDIOCGRAWPHYS(r1, 0x80404805, 0x0) read$hidraw(0xffffffffffffffff, &(0x7f00000000c0)=""/4096, 0x1000) write$hidraw(r2, &(0x7f0000001200)='\x00', 0xffffff45) r3 = syz_open_dev$hiddev(&(0x7f00000011c0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGREPORT(r3, 0x400c4807, &(0x7f0000001380)={0x2, 0x3, 0xffffffffffffff01}) syz_open_dev$evdev(0x0, 0x6, 0x2c2000) r4 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x2, 0x80000) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000180)=""/4096) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000002480)={0x9a, 0x1e, 0xd8, 0x9, "5d6e565b50d83cf14c22bab25dfad60ebf6434d5ef80201abd1c1ab46630a7f2"}) syz_open_dev$hidraw(&(0x7f0000001140)='/dev/hidraw#\x00', 0x5, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, 0x0) r5 = syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) ioctl$HIDIOCGRDESCSIZE(r5, 0x80044801, &(0x7f0000002440)) read$hidraw(r1, &(0x7f0000003200)=""/4096, 0xffffffad) syz_open_dev$hidraw(&(0x7f0000001340)='/dev/hidraw#\x00', 0x0, 0x0) read$hidraw(r0, &(0x7f0000003200)=""/4096, 0xffffffad) r6 = syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) ioctl$HIDIOCAPPLICATION(r6, 0xc0c0583b, 0x20000000) syz_open_dev$hidraw(&(0x7f00000024c0)='/dev/hidraw#\x00', 0xfffffffffffffffd, 0x0) ioctl$HIDIOCGRAWNAME(0xffffffffffffffff, 0x80404804, &(0x7f0000001180)) 20:20:49 executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x1b96, 0x6, 0x40, 0x0, 0x4, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x0, {0x9}}}]}}]}}, 0x0) 20:20:49 executing program 1: r0 = syz_usb_connect(0x0, 0x120, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000ac194608f00a57d12d54000000010902120001000000000904090000ffabfe00"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="00001100000022272bb4a43b59a75508"], 0x0, 0x0, 0x0, 0x0}) 20:20:49 executing program 3: syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x204) r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x3) ioctl$EVIOCSABS20(r0, 0x401845e0, &(0x7f0000000080)={0x80, 0x0, 0xfffffffffffffffa, 0x8, 0x0, 0x7}) syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000180)='/dev/hidraw#\x00', 0x3f, 0x0) r1 = syz_open_dev$hidraw(0x0, 0x0, 0x0) r2 = syz_open_dev$hidraw(0x0, 0x0, 0x201) ioctl$HIDIOCGNAME(0xffffffffffffffff, 0x80404806, 0x0) write$hidraw(r2, &(0x7f0000001200)='\x00', 0xffffff45) syz_open_dev$evdev(0x0, 0x0, 0x0) read$hidraw(r1, &(0x7f0000003200)=""/4096, 0xffffffad) write$hidraw(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x0) ioctl$HIDIOCSFLAG(0xffffffffffffffff, 0x4004480f, 0xffffffffffffffff) r3 = syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) ioctl$HIDIOCAPPLICATION(r3, 0x40086602, 0x20000000) syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) r4 = syz_open_dev$hidraw(&(0x7f0000000240)='/dev/../raw#\x00', 0x0, 0x12d441) write$hidraw(r4, &(0x7f0000000000)="3a0ac17e0d595345e24ea72cf22da8cf6bd8605cc6dd64", 0x140000) 20:20:49 executing program 3: syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x204) r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x3) ioctl$EVIOCSABS20(r0, 0x401845e0, &(0x7f0000000080)={0x80, 0x0, 0xfffffffffffffffa, 0x8, 0x0, 0x7}) syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000180)='/dev/hidraw#\x00', 0x3f, 0x0) r1 = syz_open_dev$hidraw(0x0, 0x0, 0x0) r2 = syz_open_dev$hidraw(0x0, 0x0, 0x201) ioctl$HIDIOCGNAME(0xffffffffffffffff, 0x80404806, 0x0) write$hidraw(r2, &(0x7f0000001200)='\x00', 0xffffff45) syz_open_dev$evdev(0x0, 0x0, 0x0) read$hidraw(r1, &(0x7f0000003200)=""/4096, 0xffffffad) write$hidraw(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x0) ioctl$HIDIOCSFLAG(0xffffffffffffffff, 0x4004480f, 0xffffffffffffffff) r3 = syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) ioctl$HIDIOCAPPLICATION(r3, 0x40086602, 0x20000000) syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) r4 = syz_open_dev$hidraw(&(0x7f0000000240)='/dev/../raw#\x00', 0x0, 0x12d441) write$hidraw(r4, &(0x7f0000000000)="3a0ac17e0d595345e24ea72cf22da8cf6bd8605cc6dd64", 0x140000) 20:20:49 executing program 2: ioctl$HIDIOCAPPLICATION(0xffffffffffffffff, 0xc0c0583b, 0x20000000) ioctl$HIDIOCGRDESCSIZE(0xffffffffffffffff, 0x80044801, &(0x7f0000000000)) syz_open_dev$hidraw(&(0x7f00000012c0)='/dev/../raw#\x00', 0x0, 0x204) r0 = syz_open_dev$hidraw(0x0, 0x0, 0x4000) r1 = syz_open_dev$hidraw(0x0, 0x0, 0x0) r2 = syz_open_dev$hidraw(0x0, 0x0, 0x201) ioctl$HIDIOCGRAWPHYS(r1, 0x80404805, 0x0) read$hidraw(0xffffffffffffffff, &(0x7f00000000c0)=""/4096, 0x1000) write$hidraw(r2, &(0x7f0000001200)='\x00', 0xffffff45) r3 = syz_open_dev$hiddev(&(0x7f00000011c0)='/dev/usb/hiddev#\x00', 0x0, 0x0) ioctl$HIDIOCGREPORT(r3, 0x400c4807, &(0x7f0000001380)={0x2, 0x3, 0xffffffffffffff01}) syz_open_dev$evdev(0x0, 0x6, 0x2c2000) r4 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x2, 0x80000) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000180)=""/4096) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000002480)={0x9a, 0x1e, 0xd8, 0x9, "5d6e565b50d83cf14c22bab25dfad60ebf6434d5ef80201abd1c1ab46630a7f2"}) syz_open_dev$hidraw(&(0x7f0000001140)='/dev/hidraw#\x00', 0x5, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, 0x0) r5 = syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) ioctl$HIDIOCGRDESCSIZE(r5, 0x80044801, &(0x7f0000002440)) read$hidraw(r1, &(0x7f0000003200)=""/4096, 0xffffffad) syz_open_dev$hidraw(&(0x7f0000001340)='/dev/hidraw#\x00', 0x0, 0x0) read$hidraw(r0, &(0x7f0000003200)=""/4096, 0xffffffad) r6 = syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) ioctl$HIDIOCAPPLICATION(r6, 0xc0c0583b, 0x20000000) syz_open_dev$hidraw(&(0x7f00000024c0)='/dev/hidraw#\x00', 0xfffffffffffffffd, 0x0) ioctl$HIDIOCGRAWNAME(0xffffffffffffffff, 0x80404804, &(0x7f0000001180)) 20:20:49 executing program 3: syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x204) r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x3) ioctl$EVIOCSABS20(r0, 0x401845e0, &(0x7f0000000080)={0x80, 0x0, 0xfffffffffffffffa, 0x8, 0x0, 0x7}) syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000180)='/dev/hidraw#\x00', 0x3f, 0x0) r1 = syz_open_dev$hidraw(0x0, 0x0, 0x0) r2 = syz_open_dev$hidraw(0x0, 0x0, 0x201) ioctl$HIDIOCGNAME(0xffffffffffffffff, 0x80404806, 0x0) write$hidraw(r2, &(0x7f0000001200)='\x00', 0xffffff45) syz_open_dev$evdev(0x0, 0x0, 0x0) read$hidraw(r1, &(0x7f0000003200)=""/4096, 0xffffffad) write$hidraw(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x0) ioctl$HIDIOCSFLAG(0xffffffffffffffff, 0x4004480f, 0xffffffffffffffff) r3 = syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) ioctl$HIDIOCAPPLICATION(r3, 0x40086602, 0x20000000) syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) r4 = syz_open_dev$hidraw(&(0x7f0000000240)='/dev/../raw#\x00', 0x0, 0x12d441) write$hidraw(r4, &(0x7f0000000000)="3a0ac17e0d595345e24ea72cf22da8cf6bd8605cc6dd64", 0x140000) [ 51.179698][ T17] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 51.187400][ T83] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 51.219784][ T2804] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 51.227429][ T22] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 51.429757][ T83] usb 5-1: Using ep0 maxpacket: 8 [ 51.434989][ T17] usb 6-1: Using ep0 maxpacket: 32 [ 51.469767][ T22] usb 2-1: Using ep0 maxpacket: 8 [ 51.474949][ T2804] usb 1-1: Using ep0 maxpacket: 32 [ 51.559845][ T17] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 51.573468][ T83] usb 5-1: config 0 has an invalid interface number: 9 but max is 0 [ 51.581546][ T83] usb 5-1: config 0 has no interface number 0 [ 51.588045][ T83] usb 5-1: New USB device found, idVendor=0af0, idProduct=d157, bcdDevice=54.2d [ 51.597185][ T83] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 51.606697][ T83] usb 5-1: config 0 descriptor?? [ 51.611794][ T2804] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 51.624968][ T22] usb 2-1: config 0 has an invalid interface number: 9 but max is 0 [ 51.633234][ T22] usb 2-1: config 0 has no interface number 0 [ 51.639516][ T22] usb 2-1: New USB device found, idVendor=0af0, idProduct=d157, bcdDevice=54.2d [ 51.648964][ T22] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 51.657937][ T22] usb 2-1: config 0 descriptor?? [ 51.729780][ T17] usb 6-1: New USB device found, idVendor=1b96, idProduct=0006, bcdDevice= 0.40 [ 51.739054][ T17] usb 6-1: New USB device strings: Mfr=0, Product=4, SerialNumber=3 [ 51.747152][ T17] usb 6-1: Product: syz [ 51.751475][ T17] usb 6-1: SerialNumber: syz [ 51.756120][ T2804] usb 1-1: New USB device found, idVendor=1b96, idProduct=0006, bcdDevice= 0.40 [ 51.765229][ T2804] usb 1-1: New USB device strings: Mfr=0, Product=4, SerialNumber=3 [ 51.773574][ T2804] usb 1-1: Product: syz [ 51.777732][ T2804] usb 1-1: SerialNumber: syz [ 51.821214][ T17] usbhid 6-1:1.0: couldn't find an input interrupt endpoint [ 51.831756][ T2804] usbhid 1-1:1.0: couldn't find an input interrupt endpoint [ 51.890540][ T83] hso 5-1:0.9: Failed to find BULK IN ep [ 51.920438][ T22] hso 2-1:0.9: Failed to find BULK IN ep [ 52.036180][ T22] usb 1-1: USB disconnect, device number 2 [ 52.037774][ T102] usb 6-1: USB disconnect, device number 4 [ 52.101684][ T12] usb 5-1: USB disconnect, device number 4 [ 52.131337][ T83] usb 2-1: USB disconnect, device number 2 20:20:51 executing program 5: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x1b96, 0x6, 0x40, 0x0, 0x4, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x0, {0x9}}}]}}]}}, 0x0) 20:20:51 executing program 4: r0 = syz_usb_connect(0x0, 0x120, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000ac194608f00a57d12d54000000010902120001000000000904090000ffabfe00"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="00001100000022272bb4a43b59a75508"], 0x0, 0x0, 0x0, 0x0}) 20:20:51 executing program 3: syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x204) r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x3) ioctl$EVIOCSABS20(r0, 0x401845e0, &(0x7f0000000080)={0x80, 0x0, 0xfffffffffffffffa, 0x8, 0x0, 0x7}) syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000180)='/dev/hidraw#\x00', 0x3f, 0x0) r1 = syz_open_dev$hidraw(0x0, 0x0, 0x0) r2 = syz_open_dev$hidraw(0x0, 0x0, 0x201) ioctl$HIDIOCGNAME(0xffffffffffffffff, 0x80404806, 0x0) write$hidraw(r2, &(0x7f0000001200)='\x00', 0xffffff45) syz_open_dev$evdev(0x0, 0x0, 0x0) read$hidraw(r1, &(0x7f0000003200)=""/4096, 0xffffffad) write$hidraw(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x0) ioctl$HIDIOCSFLAG(0xffffffffffffffff, 0x4004480f, 0xffffffffffffffff) r3 = syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) ioctl$HIDIOCAPPLICATION(r3, 0x40086602, 0x20000000) syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) r4 = syz_open_dev$hidraw(&(0x7f0000000240)='/dev/../raw#\x00', 0x0, 0x12d441) write$hidraw(r4, &(0x7f0000000000)="3a0ac17e0d595345e24ea72cf22da8cf6bd8605cc6dd64", 0x140000) 20:20:51 executing program 2: syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x204) r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x3) ioctl$EVIOCSABS20(r0, 0x401845e0, &(0x7f0000000080)={0x80, 0x0, 0xfffffffffffffffa, 0x8, 0x0, 0x7}) syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000180)='/dev/hidraw#\x00', 0x3f, 0x0) r1 = syz_open_dev$hidraw(0x0, 0x0, 0x0) r2 = syz_open_dev$hidraw(0x0, 0x0, 0x201) ioctl$HIDIOCGNAME(0xffffffffffffffff, 0x80404806, 0x0) write$hidraw(r2, &(0x7f0000001200)='\x00', 0xffffff45) syz_open_dev$evdev(0x0, 0x0, 0x0) read$hidraw(r1, &(0x7f0000003200)=""/4096, 0xffffffad) write$hidraw(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x0) ioctl$HIDIOCSFLAG(0xffffffffffffffff, 0x4004480f, 0xffffffffffffffff) r3 = syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) ioctl$HIDIOCAPPLICATION(r3, 0x40086602, 0x20000000) syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) r4 = syz_open_dev$hidraw(&(0x7f0000000240)='/dev/../raw#\x00', 0x0, 0x12d441) write$hidraw(r4, &(0x7f0000000000)="3a0ac17e0d595345e24ea72cf22da8cf6bd8605cc6dd64", 0x140000) 20:20:51 executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x1b96, 0x6, 0x40, 0x0, 0x4, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x0, {0x9}}}]}}]}}, 0x0) 20:20:51 executing program 1: r0 = syz_usb_connect(0x0, 0x120, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000ac194608f00a57d12d54000000010902120001000000000904090000ffabfe00"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="00001100000022272bb4a43b59a75508"], 0x0, 0x0, 0x0, 0x0}) 20:20:51 executing program 2: syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x204) r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x3) ioctl$EVIOCSABS20(r0, 0x401845e0, &(0x7f0000000080)={0x80, 0x0, 0xfffffffffffffffa, 0x8, 0x0, 0x7}) syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000180)='/dev/hidraw#\x00', 0x3f, 0x0) r1 = syz_open_dev$hidraw(0x0, 0x0, 0x0) r2 = syz_open_dev$hidraw(0x0, 0x0, 0x201) ioctl$HIDIOCGNAME(0xffffffffffffffff, 0x80404806, 0x0) write$hidraw(r2, &(0x7f0000001200)='\x00', 0xffffff45) syz_open_dev$evdev(0x0, 0x0, 0x0) read$hidraw(r1, &(0x7f0000003200)=""/4096, 0xffffffad) write$hidraw(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x0) ioctl$HIDIOCSFLAG(0xffffffffffffffff, 0x4004480f, 0xffffffffffffffff) r3 = syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) ioctl$HIDIOCAPPLICATION(r3, 0x40086602, 0x20000000) syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) r4 = syz_open_dev$hidraw(&(0x7f0000000240)='/dev/../raw#\x00', 0x0, 0x12d441) write$hidraw(r4, &(0x7f0000000000)="3a0ac17e0d595345e24ea72cf22da8cf6bd8605cc6dd64", 0x140000) 20:20:51 executing program 3: syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x204) r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x3) ioctl$EVIOCSABS20(r0, 0x401845e0, &(0x7f0000000080)={0x80, 0x0, 0xfffffffffffffffa, 0x8, 0x0, 0x7}) syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000180)='/dev/hidraw#\x00', 0x3f, 0x0) r1 = syz_open_dev$hidraw(0x0, 0x0, 0x0) r2 = syz_open_dev$hidraw(0x0, 0x0, 0x201) ioctl$HIDIOCGNAME(0xffffffffffffffff, 0x80404806, 0x0) write$hidraw(r2, &(0x7f0000001200)='\x00', 0xffffff45) syz_open_dev$evdev(0x0, 0x0, 0x0) read$hidraw(r1, &(0x7f0000003200)=""/4096, 0xffffffad) write$hidraw(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x0) ioctl$HIDIOCSFLAG(0xffffffffffffffff, 0x4004480f, 0xffffffffffffffff) r3 = syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) ioctl$HIDIOCAPPLICATION(r3, 0x40086602, 0x20000000) syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) r4 = syz_open_dev$hidraw(&(0x7f0000000240)='/dev/../raw#\x00', 0x0, 0x12d441) write$hidraw(r4, &(0x7f0000000000)="3a0ac17e0d595345e24ea72cf22da8cf6bd8605cc6dd64", 0x140000) 20:20:51 executing program 2: syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x204) r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x3) ioctl$EVIOCSABS20(r0, 0x401845e0, &(0x7f0000000080)={0x80, 0x0, 0xfffffffffffffffa, 0x8, 0x0, 0x7}) syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000180)='/dev/hidraw#\x00', 0x3f, 0x0) r1 = syz_open_dev$hidraw(0x0, 0x0, 0x0) r2 = syz_open_dev$hidraw(0x0, 0x0, 0x201) ioctl$HIDIOCGNAME(0xffffffffffffffff, 0x80404806, 0x0) write$hidraw(r2, &(0x7f0000001200)='\x00', 0xffffff45) syz_open_dev$evdev(0x0, 0x0, 0x0) read$hidraw(r1, &(0x7f0000003200)=""/4096, 0xffffffad) write$hidraw(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x0) ioctl$HIDIOCSFLAG(0xffffffffffffffff, 0x4004480f, 0xffffffffffffffff) r3 = syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) ioctl$HIDIOCAPPLICATION(r3, 0x40086602, 0x20000000) syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) r4 = syz_open_dev$hidraw(&(0x7f0000000240)='/dev/../raw#\x00', 0x0, 0x12d441) write$hidraw(r4, &(0x7f0000000000)="3a0ac17e0d595345e24ea72cf22da8cf6bd8605cc6dd64", 0x140000) 20:20:51 executing program 3: syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x204) r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x3) ioctl$EVIOCSABS20(r0, 0x401845e0, &(0x7f0000000080)={0x80, 0x0, 0xfffffffffffffffa, 0x8, 0x0, 0x7}) syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000180)='/dev/hidraw#\x00', 0x3f, 0x0) r1 = syz_open_dev$hidraw(0x0, 0x0, 0x0) r2 = syz_open_dev$hidraw(0x0, 0x0, 0x201) ioctl$HIDIOCGNAME(0xffffffffffffffff, 0x80404806, 0x0) write$hidraw(r2, &(0x7f0000001200)='\x00', 0xffffff45) syz_open_dev$evdev(0x0, 0x0, 0x0) read$hidraw(r1, &(0x7f0000003200)=""/4096, 0xffffffad) write$hidraw(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x0) ioctl$HIDIOCSFLAG(0xffffffffffffffff, 0x4004480f, 0xffffffffffffffff) r3 = syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) ioctl$HIDIOCAPPLICATION(r3, 0x40086602, 0x20000000) syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) r4 = syz_open_dev$hidraw(&(0x7f0000000240)='/dev/../raw#\x00', 0x0, 0x12d441) write$hidraw(r4, &(0x7f0000000000)="3a0ac17e0d595345e24ea72cf22da8cf6bd8605cc6dd64", 0x140000) 20:20:51 executing program 2: r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) r1 = syz_open_dev$hidraw(0x0, 0x0, 0x101) ioctl$HIDIOCGCOLLECTIONINFO(0xffffffffffffffff, 0xc0104811, &(0x7f00000000c0)={0x10000}) write$hidraw(r1, &(0x7f0000000080)='\x00', 0x1e8) ioctl$EVIOCGSW(r0, 0x8040451b, &(0x7f0000000000)=""/58) [ 52.869757][ T12] usb 6-1: new high-speed USB device number 5 using dummy_hcd 20:20:51 executing program 3: syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x204) r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x3) ioctl$EVIOCSABS20(r0, 0x401845e0, &(0x7f0000000080)={0x80, 0x0, 0xfffffffffffffffa, 0x8, 0x0, 0x7}) syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000180)='/dev/hidraw#\x00', 0x3f, 0x0) r1 = syz_open_dev$hidraw(0x0, 0x0, 0x0) r2 = syz_open_dev$hidraw(0x0, 0x0, 0x201) ioctl$HIDIOCGNAME(0xffffffffffffffff, 0x80404806, 0x0) write$hidraw(r2, &(0x7f0000001200)='\x00', 0xffffff45) syz_open_dev$evdev(0x0, 0x0, 0x0) read$hidraw(r1, &(0x7f0000003200)=""/4096, 0xffffffad) write$hidraw(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x0) ioctl$HIDIOCSFLAG(0xffffffffffffffff, 0x4004480f, 0xffffffffffffffff) r3 = syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) ioctl$HIDIOCAPPLICATION(r3, 0x40086602, 0x20000000) syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) r4 = syz_open_dev$hidraw(&(0x7f0000000240)='/dev/../raw#\x00', 0x0, 0x12d441) write$hidraw(r4, &(0x7f0000000000)="3a0ac17e0d595345e24ea72cf22da8cf6bd8605cc6dd64", 0x140000) [ 52.929993][ T102] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 52.949739][ T2786] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 52.959284][ T5] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 53.139678][ T12] usb 6-1: Using ep0 maxpacket: 32 [ 53.180029][ T102] usb 1-1: Using ep0 maxpacket: 32 [ 53.229648][ T5] usb 2-1: Using ep0 maxpacket: 8 [ 53.235047][ T2786] usb 5-1: Using ep0 maxpacket: 8 [ 53.259853][ T12] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 53.309815][ T102] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 53.349706][ T5] usb 2-1: config 0 has an invalid interface number: 9 but max is 0 [ 53.357762][ T5] usb 2-1: config 0 has no interface number 0 [ 53.364051][ T2786] usb 5-1: config 0 has an invalid interface number: 9 but max is 0 [ 53.372076][ T2786] usb 5-1: config 0 has no interface number 0 [ 53.378295][ T5] usb 2-1: New USB device found, idVendor=0af0, idProduct=d157, bcdDevice=54.2d [ 53.387378][ T5] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 53.395510][ T2786] usb 5-1: New USB device found, idVendor=0af0, idProduct=d157, bcdDevice=54.2d [ 53.404601][ T2786] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 53.412790][ T12] usb 6-1: New USB device found, idVendor=1b96, idProduct=0006, bcdDevice= 0.40 [ 53.421872][ T12] usb 6-1: New USB device strings: Mfr=0, Product=4, SerialNumber=3 [ 53.429904][ T12] usb 6-1: Product: syz [ 53.434088][ T12] usb 6-1: SerialNumber: syz [ 53.439511][ T5] usb 2-1: config 0 descriptor?? [ 53.445609][ T2786] usb 5-1: config 0 descriptor?? [ 53.469780][ T102] usb 1-1: New USB device found, idVendor=1b96, idProduct=0006, bcdDevice= 0.40 [ 53.478928][ T102] usb 1-1: New USB device strings: Mfr=0, Product=4, SerialNumber=3 [ 53.487014][ T102] usb 1-1: Product: syz [ 53.491317][ T102] usb 1-1: SerialNumber: syz [ 53.499533][ T12] usbhid 6-1:1.0: couldn't find an input interrupt endpoint [ 53.551293][ T102] usbhid 1-1:1.0: couldn't find an input interrupt endpoint [ 53.690618][ T5] hso 2-1:0.9: Failed to find BULK IN ep [ 53.710263][ T2786] sysfs: cannot create duplicate filename '/class/tty/ttyHS0' [ 53.717773][ T2786] CPU: 0 PID: 2786 Comm: kworker/0:3 Not tainted 5.3.0-rc7+ #0 [ 53.720683][ T83] usb 6-1: USB disconnect, device number 5 [ 53.727743][ T2786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 53.727770][ T2786] Workqueue: usb_hub_wq hub_event [ 53.727778][ T2786] Call Trace: [ 53.727796][ T2786] dump_stack+0xca/0x13e [ 53.727815][ T2786] sysfs_warn_dup.cold+0x1c/0x29 [ 53.761318][ T2786] sysfs_do_create_link_sd.isra.0+0x10f/0x130 [ 53.766766][ T22] usb 1-1: USB disconnect, device number 3 [ 53.767413][ T2786] sysfs_create_link+0x61/0xc0 [ 53.777978][ T2786] device_add+0x788/0x16f0 [ 53.782419][ T2786] ? uevent_store+0x50/0x50 [ 53.786928][ T2786] ? __init_waitqueue_head+0x31/0x90 [ 53.792207][ T2786] tty_register_device_attr+0x341/0x6f0 [ 53.797819][ T2786] ? hung_up_tty_compat_ioctl+0x40/0x40 [ 53.803427][ T2786] ? mark_held_locks+0x9f/0xe0 [ 53.808182][ T2786] ? tty_port_link_device+0x59/0xc0 [ 53.813477][ T2786] hso_serial_common_create+0x113/0x710 [ 53.819018][ T2786] ? lockdep_init_map+0x1b0/0x5e0 [ 53.824034][ T2786] hso_probe+0xc93/0x1a46 [ 53.828348][ T2786] usb_probe_interface+0x305/0x7a0 [ 53.833630][ T2786] ? usb_probe_device+0x100/0x100 [ 53.838650][ T2786] really_probe+0x281/0x6d0 [ 53.843135][ T2786] driver_probe_device+0x101/0x1b0 [ 53.848232][ T2786] __device_attach_driver+0x1c2/0x220 [ 53.853588][ T2786] ? driver_allows_async_probing+0x160/0x160 [ 53.859547][ T2786] bus_for_each_drv+0x162/0x1e0 [ 53.864385][ T2786] ? bus_rescan_devices+0x20/0x20 [ 53.869389][ T2786] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 53.875175][ T2786] ? lockdep_hardirqs_on+0x379/0x580 [ 53.880452][ T2786] __device_attach+0x217/0x360 [ 53.885206][ T2786] ? device_bind_driver+0xd0/0xd0 [ 53.890210][ T2786] ? kobject_uevent_env+0x29e/0x1150 [ 53.895475][ T2786] ? kobject_uevent_env+0x2a8/0x1150 [ 53.900758][ T2786] bus_probe_device+0x1e4/0x290 [ 53.905596][ T2786] ? blocking_notifier_call_chain+0x54/0xa0 [ 53.911510][ T2786] device_add+0xae6/0x16f0 [ 53.916010][ T2786] ? uevent_store+0x50/0x50 [ 53.920512][ T2786] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 53.926376][ T2786] usb_set_configuration+0xdf6/0x1670 [ 53.931733][ T2786] generic_probe+0x9d/0xd5 [ 53.936129][ T2786] usb_probe_device+0x99/0x100 [ 53.940994][ T2786] ? usb_suspend+0x620/0x620 [ 53.945733][ T2786] really_probe+0x281/0x6d0 [ 53.950236][ T2786] driver_probe_device+0x101/0x1b0 [ 53.955348][ T2786] __device_attach_driver+0x1c2/0x220 [ 53.960880][ T2786] ? driver_allows_async_probing+0x160/0x160 [ 53.966951][ T2786] bus_for_each_drv+0x162/0x1e0 [ 53.971783][ T2786] ? bus_rescan_devices+0x20/0x20 [ 53.976948][ T2786] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 53.982735][ T2786] ? lockdep_hardirqs_on+0x379/0x580 [ 53.988058][ T2786] __device_attach+0x217/0x360 [ 53.992812][ T2786] ? device_bind_driver+0xd0/0xd0 [ 53.998006][ T2786] ? kobject_uevent_env+0x29e/0x1150 [ 54.003379][ T2786] ? kobject_uevent_env+0x2a8/0x1150 [ 54.008646][ T2786] bus_probe_device+0x1e4/0x290 [ 54.013477][ T2786] ? blocking_notifier_call_chain+0x54/0xa0 [ 54.019351][ T2786] device_add+0xae6/0x16f0 [ 54.023761][ T2786] ? uevent_store+0x50/0x50 [ 54.028246][ T2786] usb_new_device.cold+0x6a4/0xe79 [ 54.033359][ T2786] hub_event+0x1b5c/0x3640 [ 54.037766][ T2786] ? hub_port_debounce+0x260/0x260 [ 54.042857][ T2786] process_one_work+0x92b/0x1530 [ 54.047777][ T2786] ? pwq_dec_nr_in_flight+0x310/0x310 [ 54.053127][ T2786] ? do_raw_spin_lock+0x11a/0x280 [ 54.058218][ T2786] worker_thread+0x96/0xe20 [ 54.062806][ T2786] ? process_one_work+0x1530/0x1530 [ 54.067990][ T2786] kthread+0x318/0x420 [ 54.072056][ T2786] ? kthread_create_on_node+0xf0/0xf0 [ 54.077428][ T2786] ret_from_fork+0x24/0x30 [ 54.082915][ T2786] hso 5-1:0.9: Failed to find BULK IN ep [ 54.090301][ T2786] ================================================================== [ 54.098511][ T2786] BUG: KASAN: use-after-free in __mutex_lock+0xf23/0x1360 [ 54.105603][ T2786] Read of size 8 at addr ffff8881d5904558 by task kworker/0:3/2786 [ 54.113473][ T2786] [ 54.115785][ T2786] CPU: 0 PID: 2786 Comm: kworker/0:3 Not tainted 5.3.0-rc7+ #0 [ 54.123299][ T2786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 54.133348][ T2786] Workqueue: usb_hub_wq hub_event [ 54.138475][ T2786] Call Trace: [ 54.141745][ T2786] dump_stack+0xca/0x13e [ 54.145982][ T2786] ? __mutex_lock+0xf23/0x1360 [ 54.150727][ T2786] ? __mutex_lock+0xf23/0x1360 [ 54.155472][ T2786] print_address_description+0x6a/0x32c [ 54.161017][ T2786] ? __mutex_lock+0xf23/0x1360 [ 54.165762][ T2786] ? __mutex_lock+0xf23/0x1360 [ 54.170504][ T2786] __kasan_report.cold+0x1a/0x33 [ 54.175617][ T2786] ? __mutex_lock+0xf23/0x1360 [ 54.180373][ T2786] kasan_report+0xe/0x12 [ 54.184624][ T2786] __mutex_lock+0xf23/0x1360 [ 54.189192][ T2786] ? find_held_lock+0x2d/0x110 [ 54.193932][ T2786] ? device_del+0x9e/0xb10 [ 54.198344][ T2786] ? mutex_trylock+0x2c0/0x2c0 [ 54.203089][ T2786] ? lock_downgrade+0x6e0/0x6e0 [ 54.207934][ T2786] ? refcount_sub_and_test_checked+0x130/0x1c0 [ 54.214082][ T2786] ? rwlock_bug.part.0+0x90/0x90 [ 54.219020][ T2786] ? do_raw_spin_unlock+0x50/0x220 [ 54.224123][ T2786] ? class_create_release+0x20/0x20 [ 54.229306][ T2786] ? _raw_spin_unlock+0x1f/0x30 [ 54.234142][ T2786] ? klist_put+0x9c/0x170 [ 54.238463][ T2786] ? device_del+0x9e/0xb10 20:20:52 executing program 5: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x1b96, 0x6, 0x40, 0x0, 0x4, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x0, {0x9}}}]}}]}}, 0x0) [ 54.242876][ T2786] device_del+0x9e/0xb10 [ 54.247118][ T2786] ? refcount_dec_not_one+0x1e0/0x1e0 [ 54.252497][ T2786] ? __device_links_no_driver+0x240/0x240 [ 54.258218][ T2786] device_destroy+0x90/0xd0 [ 54.262723][ T2786] ? root_device_unregister+0x80/0x80 [ 54.268100][ T2786] ? hso_serial_common_create+0x3a3/0x710 [ 54.273825][ T2786] tty_unregister_device+0x7e/0x1a0 [ 54.279018][ T2786] hso_probe.cold+0xc8/0x121 [ 54.283706][ T2786] usb_probe_interface+0x305/0x7a0 [ 54.288826][ T2786] ? usb_probe_device+0x100/0x100 [ 54.293855][ T2786] really_probe+0x281/0x6d0 [ 54.298376][ T2786] driver_probe_device+0x101/0x1b0 [ 54.303505][ T2786] __device_attach_driver+0x1c2/0x220 [ 54.308965][ T2786] ? driver_allows_async_probing+0x160/0x160 [ 54.314988][ T2786] bus_for_each_drv+0x162/0x1e0 [ 54.319933][ T2786] ? bus_rescan_devices+0x20/0x20 [ 54.324938][ T2786] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 54.330731][ T2786] ? lockdep_hardirqs_on+0x379/0x580 [ 54.336206][ T2786] __device_attach+0x217/0x360 [ 54.341300][ T2786] ? device_bind_driver+0xd0/0xd0 [ 54.346309][ T2786] ? kobject_uevent_env+0x29e/0x1150 [ 54.351571][ T2786] ? kobject_uevent_env+0x2a8/0x1150 [ 54.356835][ T2786] bus_probe_device+0x1e4/0x290 [ 54.361727][ T2786] ? blocking_notifier_call_chain+0x54/0xa0 [ 54.367626][ T2786] device_add+0xae6/0x16f0 [ 54.372023][ T2786] ? uevent_store+0x50/0x50 [ 54.376518][ T2786] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 54.382303][ T2786] usb_set_configuration+0xdf6/0x1670 [ 54.387670][ T2786] generic_probe+0x9d/0xd5 [ 54.392065][ T2786] usb_probe_device+0x99/0x100 [ 54.396820][ T2786] ? usb_suspend+0x620/0x620 [ 54.401403][ T2786] really_probe+0x281/0x6d0 [ 54.405888][ T2786] driver_probe_device+0x101/0x1b0 [ 54.411003][ T2786] __device_attach_driver+0x1c2/0x220 [ 54.416360][ T2786] ? driver_allows_async_probing+0x160/0x160 [ 54.422407][ T2786] bus_for_each_drv+0x162/0x1e0 [ 54.427239][ T2786] ? bus_rescan_devices+0x20/0x20 [ 54.432259][ T2786] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 54.438043][ T2786] ? lockdep_hardirqs_on+0x379/0x580 [ 54.443308][ T2786] __device_attach+0x217/0x360 [ 54.448053][ T2786] ? device_bind_driver+0xd0/0xd0 [ 54.453055][ T2786] ? kobject_uevent_env+0x29e/0x1150 [ 54.458323][ T2786] ? kobject_uevent_env+0x2a8/0x1150 [ 54.463631][ T2786] bus_probe_device+0x1e4/0x290 [ 54.468478][ T2786] ? blocking_notifier_call_chain+0x54/0xa0 [ 54.474355][ T2786] device_add+0xae6/0x16f0 [ 54.478755][ T2786] ? uevent_store+0x50/0x50 [ 54.483241][ T2786] usb_new_device.cold+0x6a4/0xe79 [ 54.488341][ T2786] hub_event+0x1b5c/0x3640 [ 54.492865][ T2786] ? hub_port_debounce+0x260/0x260 [ 54.497988][ T2786] process_one_work+0x92b/0x1530 [ 54.502919][ T2786] ? pwq_dec_nr_in_flight+0x310/0x310 [ 54.508285][ T2786] ? do_raw_spin_lock+0x11a/0x280 [ 54.513449][ T2786] worker_thread+0x96/0xe20 [ 54.517951][ T2786] ? process_one_work+0x1530/0x1530 [ 54.523149][ T2786] kthread+0x318/0x420 [ 54.527211][ T2786] ? kthread_create_on_node+0xf0/0xf0 [ 54.532576][ T2786] ret_from_fork+0x24/0x30 [ 54.536968][ T2786] [ 54.539278][ T2786] Allocated by task 5: [ 54.543373][ T2786] save_stack+0x1b/0x80 [ 54.547520][ T2786] __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 54.553131][ T2786] tty_register_device_attr+0x1b6/0x6f0 [ 54.558661][ T2786] hso_serial_common_create+0x113/0x710 [ 54.564189][ T2786] hso_probe+0xc93/0x1a46 [ 54.568576][ T2786] usb_probe_interface+0x305/0x7a0 [ 54.573798][ T2786] really_probe+0x281/0x6d0 [ 54.578461][ T2786] driver_probe_device+0x101/0x1b0 [ 54.583555][ T2786] __device_attach_driver+0x1c2/0x220 [ 54.588973][ T2786] bus_for_each_drv+0x162/0x1e0 20:20:53 executing program 4: r0 = syz_usb_connect(0x0, 0x120, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000ac194608f00a57d12d54000000010902120001000000000904090000ffabfe00"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="00001100000022272bb4a43b59a75508"], 0x0, 0x0, 0x0, 0x0}) 20:20:53 executing program 3: syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x204) r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x3) ioctl$EVIOCSABS20(r0, 0x401845e0, &(0x7f0000000080)={0x80, 0x0, 0xfffffffffffffffa, 0x8, 0x0, 0x7}) syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000180)='/dev/hidraw#\x00', 0x3f, 0x0) r1 = syz_open_dev$hidraw(0x0, 0x0, 0x0) r2 = syz_open_dev$hidraw(0x0, 0x0, 0x201) ioctl$HIDIOCGNAME(0xffffffffffffffff, 0x80404806, 0x0) write$hidraw(r2, &(0x7f0000001200)='\x00', 0xffffff45) syz_open_dev$evdev(0x0, 0x0, 0x0) read$hidraw(r1, &(0x7f0000003200)=""/4096, 0xffffffad) write$hidraw(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x0) ioctl$HIDIOCSFLAG(0xffffffffffffffff, 0x4004480f, 0xffffffffffffffff) r3 = syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) ioctl$HIDIOCAPPLICATION(r3, 0x40086602, 0x20000000) syz_open_dev$hidraw(&(0x7f0000000180)='/dev/../raw#\x00', 0x0, 0x0) r4 = syz_open_dev$hidraw(&(0x7f0000000240)='/dev/../raw#\x00', 0x0, 0x12d441) write$hidraw(r4, &(0x7f0000000000)="3a0ac17e0d595345e24ea72cf22da8cf6bd8605cc6dd64", 0x140000) 20:20:53 executing program 2: r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) r1 = syz_open_dev$hidraw(0x0, 0x0, 0x101) ioctl$HIDIOCGCOLLECTIONINFO(0xffffffffffffffff, 0xc0104811, &(0x7f00000000c0)={0x10000}) write$hidraw(r1, &(0x7f0000000080)='\x00', 0x1e8) ioctl$EVIOCGSW(r0, 0x8040451b, &(0x7f0000000000)=""/58) 20:20:53 executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x1b96, 0x6, 0x40, 0x0, 0x4, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x0, {0x9}}}]}}]}}, 0x0) [ 54.593832][ T2786] __device_attach+0x217/0x360 [ 54.598601][ T2786] bus_probe_device+0x1e4/0x290 [ 54.603453][ T2786] device_add+0xae6/0x16f0 [ 54.607879][ T2786] usb_set_configuration+0xdf6/0x1670 [ 54.613258][ T2786] generic_probe+0x9d/0xd5 [ 54.617682][ T2786] usb_probe_device+0x99/0x100 [ 54.622457][ T2786] really_probe+0x281/0x6d0 [ 54.626976][ T2786] driver_probe_device+0x101/0x1b0 [ 54.632195][ T2786] __device_attach_driver+0x1c2/0x220 [ 54.637578][ T2786] bus_for_each_drv+0x162/0x1e0 [ 54.642432][ T2786] __device_attach+0x217/0x360 [ 54.647385][ T2786] bus_probe_device+0x1e4/0x290 [ 54.652239][ T2786] device_add+0xae6/0x16f0 [ 54.656663][ T2786] usb_new_device.cold+0x6a4/0xe79 [ 54.661780][ T2786] hub_event+0x1b5c/0x3640 [ 54.666293][ T2786] process_one_work+0x92b/0x1530 [ 54.671240][ T2786] worker_thread+0x96/0xe20 [ 54.675840][ T2786] kthread+0x318/0x420 [ 54.679962][ T2786] ret_from_fork+0x24/0x30 [ 54.684638][ T2786] [ 54.686968][ T2786] Freed by task 5: [ 54.690690][ T2786] save_stack+0x1b/0x80 [ 54.695114][ T2786] __kasan_slab_free+0x130/0x180 [ 54.700057][ T2786] kfree+0xe4/0x2f0 [ 54.703869][ T2786] device_release+0x71/0x200 [ 54.708671][ T2786] kobject_put+0x171/0x280 [ 54.708689][ T2786] device_destroy+0x98/0xd0 [ 54.717628][ T2786] tty_unregister_device+0x7e/0x1a0 [ 54.722825][ T2786] hso_probe.cold+0xc8/0x121 [ 54.727537][ T2786] usb_probe_interface+0x305/0x7a0 [ 54.732738][ T2786] really_probe+0x281/0x6d0 [ 54.737221][ T2786] driver_probe_device+0x101/0x1b0 [ 54.742321][ T2786] __device_attach_driver+0x1c2/0x220 [ 54.747694][ T2786] bus_for_each_drv+0x162/0x1e0 [ 54.752536][ T2786] __device_attach+0x217/0x360 [ 54.757277][ T2786] bus_probe_device+0x1e4/0x290 [ 54.763843][ T2786] device_add+0xae6/0x16f0 [ 54.768241][ T2786] usb_set_configuration+0xdf6/0x1670 [ 54.773677][ T2786] generic_probe+0x9d/0xd5 [ 54.778108][ T2786] usb_probe_device+0x99/0x100 [ 54.782855][ T2786] really_probe+0x281/0x6d0 [ 54.787353][ T2786] driver_probe_device+0x101/0x1b0 [ 54.792455][ T2786] __device_attach_driver+0x1c2/0x220 [ 54.797804][ T2786] bus_for_each_drv+0x162/0x1e0 [ 54.802637][ T2786] __device_attach+0x217/0x360 [ 54.807395][ T2786] bus_probe_device+0x1e4/0x290 [ 54.812231][ T2786] device_add+0xae6/0x16f0 [ 54.816631][ T2786] usb_new_device.cold+0x6a4/0xe79 [ 54.821758][ T2786] hub_event+0x1b5c/0x3640 [ 54.826183][ T2786] process_one_work+0x92b/0x1530 [ 54.831104][ T2786] worker_thread+0x96/0xe20 [ 54.835711][ T2786] kthread+0x318/0x420 [ 54.839774][ T2786] ret_from_fork+0x24/0x30 [ 54.844176][ T2786] [ 54.846489][ T2786] The buggy address belongs to the object at ffff8881d5904400 [ 54.846489][ T2786] which belongs to the cache kmalloc-2k of size 2048 [ 54.860774][ T2786] The buggy address is located 344 bytes inside of [ 54.860774][ T2786] 2048-byte region [ffff8881d5904400, ffff8881d5904c00) [ 54.874113][ T2786] The buggy address belongs to the page: [ 54.879842][ T2786] page:ffffea0007564000 refcount:1 mapcount:0 mapping:ffff8881da00c000 index:0x0 compound_mapcount: 0 [ 54.890761][ T2786] flags: 0x200000000010200(slab|head) [ 54.896133][ T2786] raw: 0200000000010200 ffffea0007581800 0000000400000004 ffff8881da00c000 [ 54.904723][ T2786] raw: 0000000000000000 00000000800f000f 00000001ffffffff 0000000000000000 [ 54.913283][ T2786] page dumped because: kasan: bad access detected [ 54.919694][ T2786] [ 54.922087][ T2786] Memory state around the buggy address: [ 54.927711][ T2786] ffff8881d5904400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 54.935754][ T2786] ffff8881d5904480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 54.943792][ T2786] >ffff8881d5904500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 54.951830][ T2786] ^ [ 54.958756][ T2786] ffff8881d5904580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 54.966813][ T2786] ffff8881d5904600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 54.974952][ T2786] ================================================================== [ 54.983003][ T2786] Disabling lock debugging due to kernel taint [ 54.989252][ T2786] Kernel panic - not syncing: panic_on_warn set ... [ 54.995922][ T2786] CPU: 0 PID: 2786 Comm: kworker/0:3 Tainted: G B 5.3.0-rc7+ #0 [ 55.004847][ T2786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 55.014905][ T2786] Workqueue: usb_hub_wq hub_event [ 55.019906][ T2786] Call Trace: [ 55.023263][ T2786] dump_stack+0xca/0x13e [ 55.027489][ T2786] panic+0x2a3/0x6da [ 55.031367][ T2786] ? add_taint.cold+0x16/0x16 [ 55.036034][ T2786] ? retint_kernel+0x10/0x10 [ 55.040706][ T2786] ? trace_hardirqs_on+0x55/0x1e0 [ 55.045709][ T2786] ? __mutex_lock+0xf23/0x1360 [ 55.050447][ T2786] end_report+0x43/0x49 [ 55.054579][ T2786] ? __mutex_lock+0xf23/0x1360 [ 55.059316][ T2786] __kasan_report.cold+0xd/0x33 [ 55.064144][ T2786] ? __mutex_lock+0xf23/0x1360 [ 55.068897][ T2786] kasan_report+0xe/0x12 [ 55.073212][ T2786] __mutex_lock+0xf23/0x1360 [ 55.077781][ T2786] ? find_held_lock+0x2d/0x110 [ 55.082523][ T2786] ? device_del+0x9e/0xb10 [ 55.086977][ T2786] ? mutex_trylock+0x2c0/0x2c0 [ 55.091717][ T2786] ? lock_downgrade+0x6e0/0x6e0 [ 55.096554][ T2786] ? refcount_sub_and_test_checked+0x130/0x1c0 [ 55.102779][ T2786] ? rwlock_bug.part.0+0x90/0x90 [ 55.107724][ T2786] ? do_raw_spin_unlock+0x50/0x220 [ 55.112816][ T2786] ? class_create_release+0x20/0x20 [ 55.118062][ T2786] ? _raw_spin_unlock+0x1f/0x30 [ 55.122898][ T2786] ? klist_put+0x9c/0x170 [ 55.127214][ T2786] ? device_del+0x9e/0xb10 [ 55.131604][ T2786] device_del+0x9e/0xb10 [ 55.135842][ T2786] ? refcount_dec_not_one+0x1e0/0x1e0 [ 55.141189][ T2786] ? __device_links_no_driver+0x240/0x240 [ 55.146991][ T2786] device_destroy+0x90/0xd0 [ 55.151472][ T2786] ? root_device_unregister+0x80/0x80 [ 55.156821][ T2786] ? hso_serial_common_create+0x3a3/0x710 [ 55.162521][ T2786] tty_unregister_device+0x7e/0x1a0 [ 55.167697][ T2786] hso_probe.cold+0xc8/0x121 [ 55.172265][ T2786] usb_probe_interface+0x305/0x7a0 [ 55.177355][ T2786] ? usb_probe_device+0x100/0x100 [ 55.182371][ T2786] really_probe+0x281/0x6d0 [ 55.186849][ T2786] driver_probe_device+0x101/0x1b0 [ 55.191940][ T2786] __device_attach_driver+0x1c2/0x220 [ 55.197289][ T2786] ? driver_allows_async_probing+0x160/0x160 [ 55.203244][ T2786] bus_for_each_drv+0x162/0x1e0 [ 55.208073][ T2786] ? bus_rescan_devices+0x20/0x20 [ 55.213084][ T2786] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 55.218958][ T2786] ? lockdep_hardirqs_on+0x379/0x580 [ 55.224219][ T2786] __device_attach+0x217/0x360 [ 55.228961][ T2786] ? device_bind_driver+0xd0/0xd0 [ 55.233962][ T2786] ? kobject_uevent_env+0x29e/0x1150 [ 55.239224][ T2786] ? kobject_uevent_env+0x2a8/0x1150 [ 55.244485][ T2786] bus_probe_device+0x1e4/0x290 [ 55.249323][ T2786] ? blocking_notifier_call_chain+0x54/0xa0 [ 55.255190][ T2786] device_add+0xae6/0x16f0 [ 55.260017][ T2786] ? uevent_store+0x50/0x50 [ 55.265287][ T2786] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 55.271073][ T2786] usb_set_configuration+0xdf6/0x1670 [ 55.276439][ T2786] generic_probe+0x9d/0xd5 [ 55.280843][ T2786] usb_probe_device+0x99/0x100 [ 55.285592][ T2786] ? usb_suspend+0x620/0x620 [ 55.290168][ T2786] really_probe+0x281/0x6d0 [ 55.294920][ T2786] driver_probe_device+0x101/0x1b0 [ 55.300017][ T2786] __device_attach_driver+0x1c2/0x220 [ 55.305366][ T2786] ? driver_allows_async_probing+0x160/0x160 [ 55.311331][ T2786] bus_for_each_drv+0x162/0x1e0 [ 55.316158][ T2786] ? bus_rescan_devices+0x20/0x20 [ 55.321166][ T2786] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 55.326947][ T2786] ? lockdep_hardirqs_on+0x379/0x580 [ 55.332209][ T2786] __device_attach+0x217/0x360 [ 55.336948][ T2786] ? device_bind_driver+0xd0/0xd0 [ 55.341967][ T2786] ? kobject_uevent_env+0x29e/0x1150 [ 55.347242][ T2786] ? kobject_uevent_env+0x2a8/0x1150 [ 55.352510][ T2786] bus_probe_device+0x1e4/0x290 [ 55.357345][ T2786] ? blocking_notifier_call_chain+0x54/0xa0 [ 55.363222][ T2786] device_add+0xae6/0x16f0 [ 55.367625][ T2786] ? uevent_store+0x50/0x50 [ 55.372105][ T2786] usb_new_device.cold+0x6a4/0xe79 [ 55.377209][ T2786] hub_event+0x1b5c/0x3640 [ 55.381607][ T2786] ? hub_port_debounce+0x260/0x260 [ 55.386701][ T2786] process_one_work+0x92b/0x1530 [ 55.391625][ T2786] ? pwq_dec_nr_in_flight+0x310/0x310 [ 55.397058][ T2786] ? do_raw_spin_lock+0x11a/0x280 [ 55.402110][ T2786] worker_thread+0x96/0xe20 [ 55.406591][ T2786] ? process_one_work+0x1530/0x1530 [ 55.411903][ T2786] kthread+0x318/0x420 [ 55.415956][ T2786] ? kthread_create_on_node+0xf0/0xf0 [ 55.421321][ T2786] ret_from_fork+0x24/0x30 [ 55.426778][ T2786] Kernel Offset: disabled [ 55.431746][ T2786] Rebooting in 86400 seconds..