./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2307419966 <...> Warning: Permanently added '10.128.1.69' (ED25519) to the list of known hosts. execve("./syz-executor2307419966", ["./syz-executor2307419966"], 0x7ffe4584ad20 /* 10 vars */) = 0 brk(NULL) = 0x555555807000 brk(0x555555807d00) = 0x555555807d00 arch_prctl(ARCH_SET_FS, 0x555555807380) = 0 set_tid_address(0x555555807650) = 5092 set_robust_list(0x555555807660, 24) = 0 rseq(0x555555807ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2307419966", 4096) = 28 getrandom("\xc8\xf4\x8a\xde\x48\x0a\x02\x13", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555555807d00 brk(0x555555828d00) = 0x555555828d00 brk(0x555555829000) = 0x555555829000 mprotect(0x7fec27d03000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555807650) = 5093 ./strace-static-x86_64: Process 5093 attached [pid 5093] set_robust_list(0x555555807660, 24) = 0 [pid 5093] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5093] setpgid(0, 0) = 0 [pid 5093] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5093] write(3, "1000", 4) = 4 [pid 5093] close(3) = 0 [pid 5093] write(1, "executing program\n", 18executing program ) = 18 [pid 5093] openat(AT_FDCWD, "/dev/video37", O_RDWR) = 3 [pid 5093] preadv(3, [{iov_base="\x3b\xe3\x53\xbb\x10\x00\x00\x00\x00\x00\x0c\x8f\xf7\x01\x01\x01\x77\x01\x01\x01\x00\x01", iov_len=223}], 1, 0) = 22 [pid 5093] openat(AT_FDCWD, "/dev/uinput", O_RDONLY) = 4 [pid 5093] writev(-1, [{iov_base="", iov_len=0}, {iov_base=NULL, iov_len=0}, {iov_base=NULL, iov_len=0}], 3) = -1 EBADF (Bad file descriptor) [pid 5093] pipe2([5, 6], 0) = 0 [pid 5093] openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 7 [pid 5093] ioctl(7, USB_RAW_IOCTL_INIT, 0x7ffe8badfb30) = 0 [pid 5093] ioctl(7, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0 [pid 5093] ioctl(7, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe8badfb30) = 0 [pid 5093] ioctl(7, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe8badfb30) = 0 [pid 5093] ioctl(7, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe8badfb30) = 0 [pid 5093] ioctl(7, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe8badfb30) = 0 [pid 5093] ioctl(7, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe8badeb20) = 18 [pid 5093] ioctl(7, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe8badfb30) = 0 [ 72.217576][ T45] usb 1-1: new high-speed USB device number 2 using dummy_hcd [pid 5093] ioctl(7, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe8badfb30) = 0 [pid 5093] ioctl(7, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe8badfb30) = 0 [pid 5093] ioctl(7, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe8badeb20) = 18 [pid 5093] ioctl(7, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe8badfb30) = 0 [pid 5093] ioctl(7, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe8badeb20) = 9 [pid 5093] ioctl(7, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe8badfb30) = 0 [pid 5093] ioctl(7, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe8badeb20) = 146 [pid 5093] ioctl(7, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe8badfb30) = 0 [pid 5093] ioctl(7, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe8badeb20) = 4 [pid 5093] ioctl(7, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe8badfb30) = 0 [ 72.436558][ T45] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 72.448425][ T45] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [pid 5093] ioctl(7, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe8badeb20) = 8 [pid 5093] ioctl(7, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe8badfb30) = 0 [pid 5093] ioctl(7, USB_RAW_IOCTL_VBUS_DRAW, 0) = 0 [pid 5093] ioctl(7, USB_RAW_IOCTL_CONFIGURE, 0) = 0 [pid 5093] ioctl(7, USB_RAW_IOCTL_EP0_READ, 0x7ffe8badeb20) = 0 [ 72.494629][ T45] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 72.503782][ T45] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 72.511896][ T45] usb 1-1: SerialNumber: syz [pid 5093] exit_group(0) = ? [pid 5093] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5093, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555807650) = 5099 ./strace-static-x86_64: Process 5099 attached [pid 5099] set_robust_list(0x555555807660, 24) = 0 [ 72.741397][ T45] usb 1-1: 0:2 : does not exist [ 72.746621][ T45] ------------[ cut here ]------------ [ 72.753917][ T45] UBSAN: shift-out-of-bounds in sound/usb/mixer.c:2057:20 [ 72.762787][ T45] shift exponent 42 is too large for 32-bit type 'int' [ 72.771949][ T45] CPU: 1 PID: 45 Comm: kworker/1:1 Not tainted 6.10.0-rc7-syzkaller-00025-ga19ea421490d #0 [pid 5099] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5099] setpgid(0, 0) = 0 [pid 5099] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5099] write(3, "1000", 4) = 4 [ 72.781960][ T45] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 72.792198][ T45] Workqueue: usb_hub_wq hub_event [ 72.797266][ T45] Call Trace: [ 72.800592][ T45] [ 72.803645][ T45] dump_stack_lvl+0x241/0x360 [ 72.808375][ T45] ? __pfx_dump_stack_lvl+0x10/0x10 [ 72.813766][ T45] ? __pfx__printk+0x10/0x10 [ 72.818370][ T45] ? validate_processing_unit+0x402/0x600 [ 72.824125][ T45] __ubsan_handle_shift_out_of_bounds+0x3c8/0x420 [ 72.830595][ T45] parse_audio_unit+0x277d/0x3f10 [ 72.835634][ T45] ? really_probe+0x2b8/0xad0 [pid 5099] close(3) = 0 executing program [pid 5099] write(1, "executing program\n", 18) = 18 [pid 5099] openat(AT_FDCWD, "/dev/video37", O_RDWR) = 3 [ 72.840313][ T45] ? __driver_probe_device+0x1a2/0x390 [ 72.845813][ T45] ? __driver_probe_device+0x1a2/0x390 [ 72.851315][ T45] ? bus_probe_device+0x189/0x260 [ 72.856359][ T45] ? usb_new_device+0x104a/0x19a0 [ 72.861417][ T45] ? hub_event+0x2d6a/0x5150 [ 72.866012][ T45] ? kthread+0x2f0/0x390 [ 72.870274][ T45] ? ret_from_fork+0x4b/0x80 [ 72.874996][ T45] ? ret_from_fork_asm+0x1a/0x30 [ 72.879978][ T45] ? __pfx_parse_audio_unit+0x10/0x10 [ 72.885391][ T45] ? __kasan_kmalloc+0x98/0xb0 [ 72.890168][ T45] ? snd_usb_create_mixer+0x1da/0x2fa0 [ 72.895644][ T45] ? snd_usb_find_csint_desc+0x217/0x220 [ 72.901312][ T45] ? snd_usb_validate_audio_desc+0x43f/0x4f0 [ 72.907337][ T45] snd_usb_create_mixer+0x1365/0x2fa0 [ 72.912756][ T45] ? __pfx_snd_usb_create_mixer+0x10/0x10 [ 72.918576][ T45] ? _dev_err+0x122/0x170 [ 72.922939][ T45] ? usb_ifnum_to_if+0x125/0x2d0 [ 72.927886][ T45] ? usb_audio_probe+0xe91/0x2100 [ 72.932927][ T45] ? __pfx__dev_err+0x10/0x10 [ 72.937623][ T45] ? __pfx_snd_usb_audio_create+0x10/0x10 [ 72.943356][ T45] ? snd_usb_create_stream+0x38b/0x630 [ 72.948839][ T45] ? snd_usb_find_csint_desc+0x217/0x220 [ 72.954489][ T45] usb_audio_probe+0x1688/0x2100 [ 72.959478][ T45] ? __pfx_usb_audio_probe+0x10/0x10 [ 72.964772][ T45] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 72.970677][ T45] ? pm_runtime_enable+0x1c2/0x2d0 [ 72.975808][ T45] usb_probe_interface+0x645/0xbb0 [ 72.980945][ T45] ? __pfx_usb_probe_interface+0x10/0x10 [ 72.986586][ T45] really_probe+0x2b8/0xad0 [ 72.991105][ T45] __driver_probe_device+0x1a2/0x390 [ 72.996428][ T45] driver_probe_device+0x50/0x430 [ 73.001465][ T45] __device_attach_driver+0x2d6/0x530 [ 73.006856][ T45] bus_for_each_drv+0x24e/0x2e0 [ 73.011736][ T45] ? __pfx___device_attach_driver+0x10/0x10 [ 73.017635][ T45] ? __pfx_bus_for_each_drv+0x10/0x10 [ 73.023042][ T45] __device_attach+0x333/0x520 [ 73.027823][ T45] ? __pfx_lock_release+0x10/0x10 [ 73.032860][ T45] ? __pfx___device_attach+0x10/0x10 [ 73.038174][ T45] ? do_raw_spin_unlock+0x13c/0x8b0 [ 73.043395][ T45] bus_probe_device+0x189/0x260 [ 73.048259][ T45] device_add+0x856/0xbf0 [ 73.052611][ T45] usb_set_configuration+0x1976/0x1fb0 [ 73.058101][ T45] usb_generic_driver_probe+0x88/0x140 [ 73.063573][ T45] usb_probe_device+0x1b8/0x380 [ 73.068427][ T45] ? __pfx_usb_probe_device+0x10/0x10 [ 73.073804][ T45] really_probe+0x2b8/0xad0 [ 73.078331][ T45] __driver_probe_device+0x1a2/0x390 [ 73.083635][ T45] driver_probe_device+0x50/0x430 [ 73.088675][ T45] __device_attach_driver+0x2d6/0x530 [ 73.094055][ T45] bus_for_each_drv+0x24e/0x2e0 [ 73.098916][ T45] ? __pfx___device_attach_driver+0x10/0x10 [ 73.104874][ T45] ? __pfx_bus_for_each_drv+0x10/0x10 [ 73.110261][ T45] __device_attach+0x333/0x520 [ 73.115039][ T45] ? __pfx___device_attach+0x10/0x10 [ 73.120347][ T45] bus_probe_device+0x189/0x260 [ 73.125223][ T45] device_add+0x856/0xbf0 [ 73.129602][ T45] usb_new_device+0x104a/0x19a0 [ 73.134504][ T45] ? __pfx_usb_new_device+0x10/0x10 [ 73.139729][ T45] ? _raw_spin_unlock_irq+0x23/0x50 [ 73.144962][ T45] ? lockdep_hardirqs_on+0x99/0x150 [ 73.150270][ T45] hub_event+0x2d6a/0x5150 [ 73.154749][ T45] ? __pfx_hub_event+0x10/0x10 [ 73.159532][ T45] ? __pfx_lock_acquire+0x10/0x10 [ 73.164570][ T45] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 73.170565][ T45] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 73.176936][ T45] ? process_scheduled_works+0x945/0x1830 [ 73.182686][ T45] process_scheduled_works+0xa2c/0x1830 [ 73.188279][ T45] ? __pfx_process_scheduled_works+0x10/0x10 [ 73.194387][ T45] ? assign_work+0x364/0x3d0 [ 73.199030][ T45] worker_thread+0x86d/0xd50 [ 73.203647][ T45] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 73.209558][ T45] ? __kthread_parkme+0x169/0x1d0 [ 73.214600][ T45] ? __pfx_worker_thread+0x10/0x10 [ 73.219724][ T45] kthread+0x2f0/0x390 [ 73.223818][ T45] ? __pfx_worker_thread+0x10/0x10 [ 73.228945][ T45] ? __pfx_kthread+0x10/0x10 [ 73.233552][ T45] ret_from_fork+0x4b/0x80 [ 73.237982][ T45] ? __pfx_kthread+0x10/0x10 [ 73.242586][ T45] ret_from_fork_asm+0x1a/0x30 [ 73.247381][ T45] [ 73.251387][ T45] ---[ end trace ]--- [ 73.255404][ T45] Kernel panic - not syncing: UBSAN: panic_on_warn set ... [ 73.262610][ T45] CPU: 1 PID: 45 Comm: kworker/1:1 Not tainted 6.10.0-rc7-syzkaller-00025-ga19ea421490d #0 [ 73.272644][ T45] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 73.282715][ T45] Workqueue: usb_hub_wq hub_event [ 73.287778][ T45] Call Trace: [ 73.291084][ T45] [pid 5099] preadv(3, [{iov_base="\x81\x25\x52\xf5\x10\x00\x00\x00\x00\x00\x0c\x8f\xae\x01\x01\x01\x2e\x01\x01\x01\x00\x01", iov_len=223}], 1, 0) = 22 [pid 5099] openat(AT_FDCWD, "/dev/uinput", O_RDONLY) = 4 [pid 5099] writev(-1, [{iov_base="", iov_len=0}, {iov_base=NULL, iov_len=0}, {iov_base=NULL, iov_len=0}], 3) = -1 EBADF (Bad file descriptor) [pid 5099] pipe2([5, 6], 0) = 0 [pid 5099] openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 7 [pid 5099] ioctl(7, USB_RAW_IOCTL_INIT, 0x7ffe8badfb30) = 0 [pid 5099] ioctl(7, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0 [pid 5099] ioctl(7, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe8badfb30) = 0 [ 73.294037][ T45] dump_stack_lvl+0x241/0x360 [ 73.298764][ T45] ? __pfx_dump_stack_lvl+0x10/0x10 [ 73.304005][ T45] ? __pfx__printk+0x10/0x10 [ 73.308642][ T45] ? vprintk_emit+0x631/0x770 [ 73.313369][ T45] ? vscnprintf+0x5d/0x90 [ 73.317744][ T45] panic+0x349/0x860 [ 73.321678][ T45] ? check_panic_on_warn+0x21/0xb0 [ 73.326825][ T45] ? __pfx_panic+0x10/0x10 [ 73.331278][ T45] ? _printk+0xd5/0x120 [ 73.335478][ T45] ? __pfx__printk+0x10/0x10 [ 73.340111][ T45] check_panic_on_warn+0x86/0xb0 [ 73.345082][ T45] __ubsan_handle_shift_out_of_bounds+0x3e7/0x420 [ 73.351570][ T45] parse_audio_unit+0x277d/0x3f10 [ 73.356628][ T45] ? really_probe+0x2b8/0xad0 [ 73.361439][ T45] ? __driver_probe_device+0x1a2/0x390 [ 73.366948][ T45] ? __driver_probe_device+0x1a2/0x390 [ 73.372455][ T45] ? bus_probe_device+0x189/0x260 [ 73.377515][ T45] ? usb_new_device+0x104a/0x19a0 [ 73.382571][ T45] ? hub_event+0x2d6a/0x5150 [ 73.387183][ T45] ? kthread+0x2f0/0x390 [ 73.391456][ T45] ? ret_from_fork+0x4b/0x80 [ 73.396076][ T45] ? ret_from_fork_asm+0x1a/0x30 [ 73.401051][ T45] ? __pfx_parse_audio_unit+0x10/0x10 [ 73.406487][ T45] ? __kasan_kmalloc+0x98/0xb0 [ 73.411278][ T45] ? snd_usb_create_mixer+0x1da/0x2fa0 [ 73.416766][ T45] ? snd_usb_find_csint_desc+0x217/0x220 [ 73.422442][ T45] ? snd_usb_validate_audio_desc+0x43f/0x4f0 [ 73.428478][ T45] snd_usb_create_mixer+0x1365/0x2fa0 [ 73.433900][ T45] ? __pfx_snd_usb_create_mixer+0x10/0x10 [ 73.439668][ T45] ? _dev_err+0x122/0x170 [ 73.444029][ T45] ? usb_ifnum_to_if+0x125/0x2d0 [ 73.448989][ T45] ? usb_audio_probe+0xe91/0x2100 [ 73.454035][ T45] ? __pfx__dev_err+0x10/0x10 [ 73.458736][ T45] ? __pfx_snd_usb_audio_create+0x10/0x10 [ 73.464470][ T45] ? snd_usb_create_stream+0x38b/0x630 [ 73.469935][ T45] ? snd_usb_find_csint_desc+0x217/0x220 [ 73.475585][ T45] usb_audio_probe+0x1688/0x2100 [ 73.480552][ T45] ? __pfx_usb_audio_probe+0x10/0x10 [ 73.485839][ T45] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 73.491743][ T45] ? pm_runtime_enable+0x1c2/0x2d0 [ 73.496877][ T45] usb_probe_interface+0x645/0xbb0 [ 73.502011][ T45] ? __pfx_usb_probe_interface+0x10/0x10 [ 73.507651][ T45] really_probe+0x2b8/0xad0 [ 73.512171][ T45] __driver_probe_device+0x1a2/0x390 [ 73.517477][ T45] driver_probe_device+0x50/0x430 [ 73.522505][ T45] __device_attach_driver+0x2d6/0x530 [ 73.527878][ T45] bus_for_each_drv+0x24e/0x2e0 [ 73.532734][ T45] ? __pfx___device_attach_driver+0x10/0x10 [ 73.538628][ T45] ? __pfx_bus_for_each_drv+0x10/0x10 [ 73.544016][ T45] __device_attach+0x333/0x520 [ 73.548797][ T45] ? __pfx_lock_release+0x10/0x10 [ 73.553836][ T45] ? __pfx___device_attach+0x10/0x10 [ 73.559136][ T45] ? do_raw_spin_unlock+0x13c/0x8b0 [ 73.564353][ T45] bus_probe_device+0x189/0x260 [ 73.569214][ T45] device_add+0x856/0xbf0 [ 73.573561][ T45] usb_set_configuration+0x1976/0x1fb0 [ 73.579050][ T45] usb_generic_driver_probe+0x88/0x140 [ 73.584537][ T45] usb_probe_device+0x1b8/0x380 [ 73.589396][ T45] ? __pfx_usb_probe_device+0x10/0x10 [ 73.594771][ T45] really_probe+0x2b8/0xad0 [ 73.599284][ T45] __driver_probe_device+0x1a2/0x390 [ 73.604586][ T45] driver_probe_device+0x50/0x430 [ 73.609619][ T45] __device_attach_driver+0x2d6/0x530 [ 73.615023][ T45] bus_for_each_drv+0x24e/0x2e0 [ 73.619900][ T45] ? __pfx___device_attach_driver+0x10/0x10 [ 73.625792][ T45] ? __pfx_bus_for_each_drv+0x10/0x10 [ 73.631184][ T45] __device_attach+0x333/0x520 [ 73.635967][ T45] ? __pfx___device_attach+0x10/0x10 [ 73.641290][ T45] bus_probe_device+0x189/0x260 [ 73.646154][ T45] device_add+0x856/0xbf0 [ 73.650519][ T45] usb_new_device+0x104a/0x19a0 [ 73.655421][ T45] ? __pfx_usb_new_device+0x10/0x10 [ 73.660639][ T45] ? _raw_spin_unlock_irq+0x23/0x50 [ 73.665839][ T45] ? lockdep_hardirqs_on+0x99/0x150 [ 73.671051][ T45] hub_event+0x2d6a/0x5150 [ 73.675521][ T45] ? __pfx_hub_event+0x10/0x10 [ 73.680308][ T45] ? __pfx_lock_acquire+0x10/0x10 [ 73.685337][ T45] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 73.691326][ T45] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 73.697670][ T45] ? process_scheduled_works+0x945/0x1830 [ 73.703501][ T45] process_scheduled_works+0xa2c/0x1830 [ 73.709100][ T45] ? __pfx_process_scheduled_works+0x10/0x10 [ 73.715096][ T45] ? assign_work+0x364/0x3d0 [ 73.719694][ T45] worker_thread+0x86d/0xd50 [ 73.724298][ T45] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 73.730200][ T45] ? __kthread_parkme+0x169/0x1d0 [ 73.735237][ T45] ? __pfx_worker_thread+0x10/0x10 [ 73.740363][ T45] kthread+0x2f0/0x390 [ 73.744447][ T45] ? __pfx_worker_thread+0x10/0x10 [ 73.749572][ T45] ? __pfx_kthread+0x10/0x10 [ 73.754176][ T45] ret_from_fork+0x4b/0x80 [ 73.758630][ T45] ? __pfx_kthread+0x10/0x10 [ 73.763232][ T45] ret_from_fork_asm+0x1a/0x30 [ 73.768030][ T45] [ 73.771422][ T45] Kernel Offset: disabled [ 73.775801][ T45] Rebooting in 86400 seconds..