./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2683497700 <...> DUID 00:04:fb:87:82:62:74:5a:87:37:86:23:e7:72:30:e3:bc:00 forked to background, child pid 3186 [ 20.090047][ T3187] 8021q: adding VLAN 0 to HW filter on device bond0 [ 20.106048][ T3187] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.10.40' (ECDSA) to the list of known hosts. execve("./syz-executor2683497700", ["./syz-executor2683497700"], 0x7fff680211c0 /* 10 vars */) = 0 brk(NULL) = 0x555557302000 brk(0x555557302c40) = 0x555557302c40 arch_prctl(ARCH_SET_FS, 0x555557302300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor2683497700", 4096) = 28 brk(0x555557323c40) = 0x555557323c40 brk(0x555557324000) = 0x555557324000 mprotect(0x7f611c54c000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 3 ioctl(3, USB_RAW_IOCTL_INIT, 0x7ffc537d3130) = 0 ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffc537d3130) = 0 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffc537d3130) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffc537d2120) = 18 syzkaller login: [ 35.174788][ T3343] usb 1-1: new high-speed USB device number 2 using dummy_hcd ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffc537d3130) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffc537d2120) = 18 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffc537d3130) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffc537d2120) = 9 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffc537d3130) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffc537d2120) = 36 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffc537d3130) = 0 ioctl(3, USB_RAW_IOCTL_VBUS_DRAW, 0) = 0 ioctl(3, USB_RAW_IOCTL_CONFIGURE, 0) = 0 [ 35.535375][ T3343] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 50183, setting to 1024 [ 35.546561][ T3343] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 1024 [ 35.556800][ T3343] usb 1-1: New USB device found, idVendor=05ac, idProduct=0253, bcdDevice= 0.40 [ 35.565963][ T3343] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 35.575414][ T3343] usb 1-1: config 0 descriptor?? ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f611c5523ac) = -1 EINVAL (Invalid argument) ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffc537d2120) = 0 [ 35.596061][ T3607] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 35.616454][ T3343] input: bcm5974 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input5 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffc537d3160) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffc537d2150) = 8 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffc537d3160) = 0 ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffc537d2150) = 8 [ 36.054823][ T2959] ------------[ cut here ]------------ [ 36.060295][ T2959] usb 1-1: BOGUS urb xfer, pipe 1 != type 3 [ 36.067051][ T2959] WARNING: CPU: 1 PID: 2959 at drivers/usb/core/urb.c:503 usb_submit_urb+0xce2/0x1920 [ 36.076664][ T2959] Modules linked in: [ 36.080554][ T2959] CPU: 1 PID: 2959 Comm: acpid Not tainted 6.0.0-syzkaller-09589-g55be6084c8e0 #0 [ 36.089848][ T2959] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 [ 36.099940][ T2959] RIP: 0010:usb_submit_urb+0xce2/0x1920 [ 36.105519][ T2959] Code: 48 c1 e8 03 8a 04 18 84 c0 0f 85 d4 08 00 00 45 8b 06 48 c7 c7 e0 e3 54 8b 48 8b 74 24 20 4c 89 fa 89 e9 31 c0 e8 fe d7 39 fb <0f> 0b 4c 8b 74 24 30 44 89 e5 48 89 ef 48 c7 c6 b0 e6 77 8d e8 65 [ 36.125356][ T2959] RSP: 0018:ffffc9000314f590 EFLAGS: 00010246 [ 36.131427][ T2959] RAX: 0df343a797085100 RBX: dffffc0000000000 RCX: ffff88807d9e8000 [ 36.139419][ T2959] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 36.147485][ T2959] RBP: 0000000000000001 R08: ffffffff816c0f4d R09: ffffed10173667f1 [ 36.155473][ T2959] R10: ffffed10173667f1 R11: 1ffff110173667f0 R12: 0000000000000002 [ 36.163444][ T2959] R13: ffff888012f7c000 R14: ffffffff8b54e1c8 R15: ffff88801cba6b68 [ 36.171443][ T2959] FS: 00007ff1035ac740(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 [ 36.180393][ T2959] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.187007][ T2959] CR2: 00007ffd88f27f28 CR3: 0000000027c7f000 CR4: 00000000003506e0 [ 36.194994][ T2959] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 36.202946][ T2959] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 36.210937][ T2959] Call Trace: [ 36.214320][ T2959] [ 36.217274][ T2959] bcm5974_start_traffic+0xd5/0x140 [ 36.222480][ T2959] bcm5974_open+0x8e/0x120 [ 36.226927][ T2959] input_open_device+0x184/0x2d0 [ 36.231868][ T2959] mousedev_open_device+0xc1/0x160 [ 36.237016][ T2959] mousedev_open+0x2c6/0x460 [ 36.241620][ T2959] chrdev_open+0x5fb/0x680 [ 36.246074][ T2959] ? __fsnotify_update_child_dentry_flags+0x2d0/0x2d0 exit_group(0) = ? +++ exited with 0 +++ [ 36.252843][ T2959] ? cd_forget