[ OK ] Listening on Load/Save RF Kill Switch Status /dev/rfkill Watch. [ OK ] Started Getty on tty6. [ OK ] Started Getty on tty5. [ OK ] Started Getty on tty4. [ OK ] Started Getty on tty3. [ OK ] Started Getty on tty2. [ OK ] Started Getty on tty1. [ OK ] Started Serial Getty on ttyS0. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Update UTMP about System Runlevel Changes. [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.25' (ECDSA) to the list of known hosts. syzkaller login: [ 66.594142][ T37] audit: type=1400 audit(1625930729.862:8): avc: denied { execmem } for pid=8423 comm="syz-executor236" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 66.863704][ T3071] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 67.193635][ T3071] usb 1-1: not running at top speed; connect to a high speed hub [ 67.273792][ T3071] usb 1-1: config 102 has an invalid interface number: 87 but max is 1 [ 67.282430][ T3071] usb 1-1: config 102 contains an unexpected descriptor of type 0x1, skipping [ 67.291800][ T3071] usb 1-1: config 102 has an invalid interface number: 113 but max is 1 [ 67.300464][ T3071] usb 1-1: config 102 has an invalid interface association descriptor of length 2, skipping [ 67.310886][ T3071] usb 1-1: config 102 has an invalid interface association descriptor of length 2, skipping [ 67.321268][ T3071] usb 1-1: config 102 has no interface number 0 [ 67.327974][ T3071] usb 1-1: config 102 has no interface number 1 [ 67.334720][ T3071] usb 1-1: config 102 interface 87 altsetting 11 endpoint 0xC has invalid maxpacket 1024, setting to 64 [ 67.346687][ T3071] usb 1-1: config 102 interface 87 altsetting 11 has a duplicate endpoint with address 0xC, skipping [ 67.358831][ T3071] usb 1-1: config 102 interface 87 altsetting 11 has a duplicate endpoint with address 0x5, skipping [ 67.370271][ T3071] usb 1-1: config 102 interface 113 altsetting 5 has a duplicate endpoint with address 0xC, skipping [ 67.381479][ T3071] usb 1-1: config 102 interface 113 altsetting 5 has an invalid endpoint with address 0x80, skipping [ 67.393002][ T3071] usb 1-1: config 102 interface 113 altsetting 5 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 67.404469][ T3071] usb 1-1: config 102 interface 113 altsetting 5 endpoint 0xA has invalid maxpacket 1024, setting to 64 [ 67.415814][ T3071] usb 1-1: config 102 interface 113 altsetting 5 has an invalid endpoint with address 0x0, skipping [ 67.426833][ T3071] usb 1-1: config 102 interface 113 altsetting 5 has a duplicate endpoint with address 0x4, skipping [ 67.438295][ T3071] usb 1-1: config 102 interface 113 altsetting 5 has a duplicate endpoint with address 0xD, skipping [ 67.449426][ T3071] usb 1-1: config 102 interface 113 altsetting 5 has a duplicate endpoint with address 0x3, skipping [ 67.460577][ T3071] usb 1-1: config 102 interface 113 altsetting 5 endpoint 0xB has an invalid bInterval 0, changing to 4 [ 67.472162][ T3071] usb 1-1: config 102 interface 113 altsetting 5 has an invalid endpoint with address 0x80, skipping [ 67.483488][ T3071] usb 1-1: config 102 interface 113 altsetting 5 has a duplicate endpoint with address 0xF, skipping [ 67.494778][ T3071] usb 1-1: config 102 interface 113 altsetting 5 endpoint 0xE has an invalid bInterval 255, changing to 4 [ 67.506316][ T3071] usb 1-1: config 102 interface 113 altsetting 5 has a duplicate endpoint with address 0x1, skipping [ 67.517433][ T3071] usb 1-1: config 102 interface 87 has no altsetting 0 [ 67.524613][ T3071] usb 1-1: config 102 interface 113 has no altsetting 0 [ 67.763652][ T3071] usb 1-1: string descriptor 0 read error: -22 [ 67.763720][ T3071] usb 1-1: New USB device found, idVendor=077d, idProduct=627a, bcdDevice= 0.10 [ 67.779391][ T3071] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 67.829340][ T3071] ------------[ cut here ]------------ [ 67.836058][ T3071] usb 1-1: BOGUS urb xfer, pipe 1 != type 3 [ 67.842476][ T3071] WARNING: CPU: 1 PID: 3071 at drivers/usb/core/urb.c:493 usb_submit_urb+0xd27/0x1540 [ 67.852750][ T3071] Modules linked in: [ 67.857088][ T3071] CPU: 1 PID: 3071 Comm: kworker/1:2 Tainted: G W 5.13.0-syzkaller #0 [ 67.867171][ T3071] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 67.878084][ T3071] Workqueue: usb_hub_wq hub_event [ 67.883174][ T3071] RIP: 0010:usb_submit_urb+0xd27/0x1540 [ 67.890419][ T3071] Code: 84 d4 02 00 00 e8 a9 78 23 fc 4c 89 ef e8 a1 85 0c ff 41 89 d8 44 89 e1 4c 89 f2 48 89 c6 48 c7 c7 20 f2 26 8a e8 c0 65 8e 03 <0f> 0b e9 81 f8 ff ff e8 7d 78 23 fc 48 81 c5 40 06 00 00 e9 ad f7 [ 67.910739][ T3071] RSP: 0018:ffffc9000314ee70 EFLAGS: 00010286 [ 67.917085][ T3071] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 [ 67.925403][ T3071] RDX: ffff88802138e300 RSI: ffffffff815ca6f5 RDI: fffff52000629dc0 [ 67.933370][ T3071] RBP: ffff888016af6050 R08: 0000000000000000 R09: 0000000000000000 [ 67.941824][ T3071] R10: ffffffff815c452e R11: 0000000000000000 R12: 0000000000000001 [ 67.950331][ T3071] R13: ffff8880283270a8 R14: ffff88802ed48a40 R15: ffff888019f96100 [ 67.958541][ T3071] FS: 0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 [ 67.967762][ T3071] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 67.974771][ T3071] CR2: 000055f66b076dc8 CR3: 000000002e368000 CR4: 00000000001506e0 [ 67.982758][ T3071] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 67.991035][ T3071] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 67.999356][ T3071] Call Trace: [ 68.002628][ T3071] usb_start_wait_urb+0x101/0x4c0 [ 68.007971][ T3071] ? usb_api_blocking_completion+0xa0/0xa0 [ 68.014060][ T3071] ? memset+0x20/0x40 [ 68.018067][ T3071] usb_bulk_msg+0x226/0x550 [ 68.022559][ T3071] shark_write_reg+0x1ff/0x2e0 [ 68.