[info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 14.630163][ C1] random: crng init done [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.113' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 37.314417][ T12] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 37.554376][ T12] usb 1-1: Using ep0 maxpacket: 8 [ 37.674531][ T12] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 37.685785][ T12] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 37.699074][ T12] usb 1-1: New USB device found, idVendor=1a34, idProduct=f705, bcdDevice= 0.40 [ 37.708160][ T12] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 37.717799][ T12] usb 1-1: config 0 descriptor?? [ 38.199751][ T12] acrux 0003:1A34:F705.0001: hidraw0: USB HID v0.00 Device [HID 1a34:f705] on usb-dummy_hcd.0-1/input0 [ 38.211016][ T12] ================================================================== [ 38.219119][ T12] BUG: KASAN: slab-out-of-bounds in ax_probe+0x369/0x540 [ 38.226129][ T12] Write of size 8 at addr ffff8881d87b4bc0 by task kworker/0:1/12 [ 38.233920][ T12] [ 38.236262][ T12] CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.3.0+ #0 [ 38.243264][ T12] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 38.253309][ T12] Workqueue: usb_hub_wq hub_event [ 38.258402][ T12] Call Trace: [ 38.261674][ T12] dump_stack+0xca/0x13e [ 38.265906][ T12] ? ax_probe+0x369/0x540 [ 38.270264][ T12] ? ax_probe+0x369/0x540 [ 38.274701][ T12] print_address_description+0x6a/0x32c [ 38.280232][ T12] ? ax_probe+0x369/0x540 [ 38.284567][ T12] ? ax_probe+0x369/0x540 [ 38.288875][ T12] __kasan_report.cold+0x1a/0x33 [ 38.293788][ T12] ? ax_probe+0x369/0x540 [ 38.298106][ T12] kasan_report+0xe/0x12 [ 38.302336][ T12] check_memory_region+0x128/0x190 [ 38.307536][ T12] ax_probe+0x369/0x540 [ 38.311666][ T12] ? ax_remove+0x20/0x20 [ 38.315885][ T12] hid_device_probe+0x2be/0x3f0 [ 38.320711][ T12] ? hid_match_device+0x1f0/0x1f0 [ 38.325717][ T12] really_probe+0x281/0x6d0 [ 38.330225][ T12] driver_probe_device+0x101/0x1b0 [ 38.335327][ T12] __device_attach_driver+0x1c2/0x220 [ 38.340674][ T12] ? driver_allows_async_probing+0x160/0x160 [ 38.346627][ T12] bus_for_each_drv+0x162/0x1e0 [ 38.351464][ T12] ? bus_rescan_devices+0x20/0x20 [ 38.356475][ T12] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 38.362319][ T12] ? lockdep_hardirqs_on+0x379/0x580 [ 38.367584][ T12] __device_attach+0x217/0x360 [ 38.372324][ T12] ? device_bind_driver+0xd0/0xd0 [ 38.377332][ T12] ? kobject_uevent_env+0x29e/0x1150 [ 38.382592][ T12] ? kobject_uevent_env+0x2a8/0x1150 [ 38.387861][ T12] bus_probe_device+0x1e4/0x290 [ 38.392700][ T12] ? blocking_notifier_call_chain+0x54/0xa0 [ 38.398659][ T12] device_add+0xae6/0x16f0 [ 38.403049][ T12] ? uevent_store+0x50/0x50 [ 38.407531][ T12] ? __debugfs_create_file+0x2da/0x3c0 [ 38.412963][ T12] hid_add_device+0x33c/0x990 [ 38.417635][ T12] ? debug_object_fixup+0x30/0x30 [ 38.422654][ T12] ? __hid_bus_reprobe_drivers+0x130/0x130 [ 38.428585][ T12] ? lockdep_init_map+0x1b0/0x5e0 [ 38.433686][ T12] usbhid_probe+0xa81/0xfa0 [ 38.438187][ T12] usb_probe_interface+0x305/0x7a0 [ 38.443523][ T12] ? usb_probe_device+0x100/0x100 [ 38.448617][ T12] really_probe+0x281/0x6d0 [ 38.453205][ T12] driver_probe_device+0x101/0x1b0 [ 38.458311][ T12] __device_attach_driver+0x1c2/0x220 [ 38.463670][ T12] ? driver_allows_async_probing+0x160/0x160 [ 38.469625][ T12] bus_for_each_drv+0x162/0x1e0 [ 38.474453][ T12] ? bus_rescan_devices+0x20/0x20 [ 38.479474][ T12] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 38.485264][ T12] ? lockdep_hardirqs_on+0x379/0x580 [ 38.490524][ T12] __device_attach+0x217/0x360 [ 38.495317][ T12] ? device_bind_driver+0xd0/0xd0 [ 38.500338][ T12] ? kobject_uevent_env+0x29e/0x1150 [ 38.506319][ T12] ? kobject_uevent_env+0x2a8/0x1150 [ 38.511914][ T12] bus_probe_device+0x1e4/0x290 [ 38.516758][ T12] ? blocking_notifier_call_chain+0x54/0xa0 [ 38.522647][ T12] device_add+0xae6/0x16f0 [ 38.527055][ T12] ? uevent_store+0x50/0x50 [ 38.531991][ T12] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 38.538081][ T12] usb_set_configuration+0xdf6/0x1670 [ 38.543438][ T12] generic_probe+0x9d/0xd5 [ 38.547836][ T12] usb_probe_device+0x99/0x100 [ 38.552593][ T12] ? usb_suspend+0x620/0x620 [ 38.557177][ T12] really_probe+0x281/0x6d0 [ 38.561841][ T12] driver_probe_device+0x101/0x1b0 [ 38.566952][ T12] __device_attach_driver+0x1c2/0x220 [ 38.572328][ T12] ? driver_allows_async_probing+0x160/0x160 [ 38.578307][ T12] bus_for_each_drv+0x162/0x1e0 [ 38.583159][ T12] ? bus_rescan_devices+0x20/0x20 [ 38.588200][ T12] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 38.593991][ T12] ? lockdep_hardirqs_on+0x379/0x580 [ 38.599255][ T12] __device_attach+0x217/0x360 [ 38.604003][ T12] ? device_bind_driver+0xd0/0xd0 [ 38.609003][ T12] ? kobject_uevent_env+0x29e/0x1150 [ 38.614267][ T12] ? kobject_uevent_env+0x2a8/0x1150 [ 38.619555][ T12] bus_probe_device+0x1e4/0x290 [ 38.624557][ T12] ? blocking_notifier_call_chain+0x54/0xa0 [ 38.630435][ T12] device_add+0xae6/0x16f0 [ 38.634835][ T12] ? uevent_store+0x50/0x50 [ 38.639400][ T12] usb_new_device.cold+0x6a4/0xe79 [ 38.644520][ T12] hub_event+0x1b5c/0x3640 [ 38.648923][ T12] ? hub_port_debounce+0x260/0x260 [ 38.654012][ T12] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 38.659565][ T12] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 38.664856][ T12] process_one_work+0x92b/0x1530 [ 38.669782][ T12] ? pwq_dec_nr_in_flight+0x310/0x310 [ 38.675129][ T12] ? do_raw_spin_lock+0x11a/0x280 [ 38.680142][ T12] worker_thread+0x96/0xe20 [ 38.684635][ T12] ? process_one_work+0x1530/0x1530 [ 38.690606][ T12] kthread+0x318/0x420 [ 38.694674][ T12] ? kthread_create_on_node+0xf0/0xf0 [ 38.700027][ T12] ret_from_fork+0x24/0x30 [ 38.704433][ T12] [ 38.706745][ T12] Allocated by task 12: [ 38.710995][ T12] save_stack+0x1b/0x80 [ 38.715164][ T12] __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 38.720780][ T12] hidraw_connect+0x4b/0x3e0 [ 38.725350][ T12] hid_connect+0x5c7/0xbb0 [ 38.729743][ T12] hid_hw_start+0xa2/0x130 [ 38.734134][ T12] ax_probe+0x52/0x540 [ 38.738268][ T12] hid_device_probe+0x2be/0x3f0 [ 38.743208][ T12] really_probe+0x281/0x6d0 [ 38.747710][ T12] driver_probe_device+0x101/0x1b0 [ 38.752810][ T12] __device_attach_driver+0x1c2/0x220 [ 38.758270][ T12] bus_for_each_drv+0x162/0x1e0 [ 38.763101][ T12] __device_attach+0x217/0x360 [ 38.767904][ T12] bus_probe_device+0x1e4/0x290 [ 38.772884][ T12] device_add+0xae6/0x16f0 [ 38.777291][ T12] hid_add_device+0x33c/0x990 [ 38.781953][ T12] usbhid_probe+0xa81/0xfa0 [ 38.786442][ T12] usb_probe_interface+0x305/0x7a0 [ 38.791534][ T12] really_probe+0x281/0x6d0 [ 38.796015][ T12] driver_probe_device+0x101/0x1b0 [ 38.801103][ T12] __device_attach_driver+0x1c2/0x220 [ 38.806452][ T12] bus_for_each_drv+0x162/0x1e0 [ 38.811289][ T12] __device_attach+0x217/0x360 [ 38.816029][ T12] bus_probe_device+0x1e4/0x290 [ 38.820945][ T12] device_add+0xae6/0x16f0 [ 38.825339][ T12] usb_set_configuration+0xdf6/0x1670 [ 38.830689][ T12] generic_probe+0x9d/0xd5 [ 38.835097][ T12] usb_probe_device+0x99/0x100 [ 38.839998][ T12] really_probe+0x281/0x6d0 [ 38.844484][ T12] driver_probe_device+0x101/0x1b0 [ 38.849666][ T12] __device_attach_driver+0x1c2/0x220 [ 38.855016][ T12] bus_for_each_drv+0x162/0x1e0 [ 38.859865][ T12] __device_attach+0x217/0x360 [ 38.864614][ T12] bus_probe_device+0x1e4/0x290 [ 38.869448][ T12] device_add+0xae6/0x16f0 [ 38.873844][ T12] usb_new_device.cold+0x6a4/0xe79 [ 38.878930][ T12] hub_event+0x1b5c/0x3640 [ 38.883412][ T12] process_one_work+0x92b/0x1530 [ 38.888325][ T12] worker_thread+0x96/0xe20 [ 38.892801][ T12] kthread+0x318/0x420 [ 38.896849][ T12] ret_from_fork+0x24/0x30 [ 38.901235][ T12] [ 38.903556][ T12] Freed by task 1: [ 38.907256][ T12] save_stack+0x1b/0x80 [ 38.911388][ T12] __kasan_slab_free+0x130/0x180 [ 38.916300][ T12] kfree+0xe4/0x2f0 [ 38.920088][ T12] usb_free_urb.part.0+0x7a/0xc0 [ 38.925959][ T12] usb_free_urb+0x1b/0x30 [ 38.930264][ T12] usb_start_wait_urb+0x1e5/0x2b0 [ 38.935277][ T12] usb_control_msg+0x31c/0x4a0 [ 38.940033][ T12] hub_probe.cold+0xbb8/0x2201 [ 38.944790][ T12] usb_probe_interface+0x305/0x7a0 [ 38.949887][ T12] really_probe+0x281/0x6d0 [ 38.954406][ T12] driver_probe_device+0x101/0x1b0 [ 38.959602][ T12] __device_attach_driver+0x1c2/0x220 [ 38.965065][ T12] bus_for_each_drv+0x162/0x1e0 [ 38.969963][ T12] __device_attach+0x217/0x360 [ 38.974797][ T12] bus_probe_device+0x1e4/0x290 [ 38.979626][ T12] device_add+0xae6/0x16f0 [ 38.984159][ T12] usb_set_configuration+0xdf6/0x1670 [ 38.989529][ T12] generic_probe+0x9d/0xd5 [ 38.993928][ T12] usb_probe_device+0x99/0x100 [ 38.998788][ T12] really_probe+0x281/0x6d0 [ 39.003303][ T12] driver_probe_device+0x101/0x1b0 [ 39.008402][ T12] __device_attach_driver+0x1c2/0x220 [ 39.013752][ T12] bus_for_each_drv+0x162/0x1e0 [ 39.018578][ T12] __device_attach+0x217/0x360 [ 39.023493][ T12] bus_probe_device+0x1e4/0x290 [ 39.028322][ T12] device_add+0xae6/0x16f0 [ 39.032727][ T12] usb_new_device.cold+0x6a4/0xe79 [ 39.037828][ T12] usb_add_hcd.cold+0x1103/0x14aa [ 39.042829][ T12] dummy_hcd_probe+0x19f/0x312 [ 39.047569][ T12] platform_drv_probe+0xce/0x1a0 [ 39.052498][ T12] really_probe+0x281/0x6d0 [ 39.057080][ T12] driver_probe_device+0x101/0x1b0 [ 39.062166][ T12] __device_attach_driver+0x1c2/0x220 [ 39.067510][ T12] bus_for_each_drv+0x162/0x1e0 [ 39.072334][ T12] __device_attach+0x217/0x360 [ 39.077074][ T12] bus_probe_device+0x1e4/0x290 [ 39.081903][ T12] device_add+0xae6/0x16f0 [ 39.086295][ T12] platform_device_add+0x34d/0x6c0 [ 39.091389][ T12] init+0x4b5/0x997 [ 39.098824][ T12] do_one_initcall+0xf0/0x614 [ 39.103481][ T12] kernel_init_freeable+0x4a9/0x596 [ 39.109711][ T12] kernel_init+0xd/0x1bf [ 39.113929][ T12] ret_from_fork+0x24/0x30 [ 39.118330][ T12] [ 39.120650][ T12] The buggy address belongs to the object at ffff8881d87b4b00 [ 39.120650][ T12] which belongs to the cache kmalloc-192 of size 192 [ 39.134993][ T12] The buggy address is located 0 bytes to the right of [ 39.134993][ T12] 192-byte region [ffff8881d87b4b00, ffff8881d87b4bc0) [ 39.148716][ T12] The buggy address belongs to the page: [ 39.154344][ T12] page:ffffea000761ed00 refcount:1 mapcount:0 mapping:ffff8881da002a00 index:0x0 [ 39.164195][ T12] flags: 0x200000000000200(slab) [ 39.169120][ T12] raw: 0200000000000200 ffffea000761f540 0000000300000003 ffff8881da002a00 [ 39.177690][ T12] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 39.186415][ T12] page dumped because: kasan: bad access detected [ 39.193140][ T12] [ 39.195451][ T12] Memory state around the buggy address: [ 39.201075][ T12] ffff8881d87b4a80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 39.209116][ T12] ffff8881d87b4b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 39.217154][ T12] >ffff8881d87b4b80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 39.225189][ T12] ^ [ 39.231328][ T12] ffff8881d87b4c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 39.239436][ T12] ffff8881d87b4c80: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc [ 39.247663][ T12] ======================================================