[info] Using makefile-style concurrent boot in runlevel 2. [ 14.339153][ C1] random: crng init done [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.15.205' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 24.231609][ T12] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 24.471590][ T12] usb 1-1: Using ep0 maxpacket: 32 [ 24.591734][ T12] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 24.602696][ T12] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 24.772225][ T12] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 24.781270][ T12] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 24.789303][ T12] usb 1-1: Product: syz [ 24.793493][ T12] usb 1-1: Manufacturer: syz [ 24.798069][ T12] usb 1-1: SerialNumber: syz executing program [ 25.141811][ T12] ================================================================== [ 25.149992][ T12] BUG: KASAN: use-after-free in build_audio_procunit+0xeab/0x13f0 [ 25.157792][ T12] Read of size 1 at addr ffff8881d4c0140d by task kworker/0:1/12 [ 25.165513][ T12] [ 25.167852][ T12] CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.4.0-rc3+ #0 [ 25.175283][ T12] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 25.185324][ T12] Workqueue: usb_hub_wq hub_event [ 25.190330][ T12] Call Trace: [ 25.193604][ T12] dump_stack+0xca/0x13e [ 25.197845][ T12] ? build_audio_procunit+0xeab/0x13f0 [ 25.203281][ T12] ? build_audio_procunit+0xeab/0x13f0 [ 25.208716][ T12] print_address_description.constprop.0+0x36/0x50 [ 25.215200][ T12] ? build_audio_procunit+0xeab/0x13f0 [ 25.220637][ T12] ? build_audio_procunit+0xeab/0x13f0 [ 25.226076][ T12] __kasan_report.cold+0x1a/0x33 [ 25.231001][ T12] ? build_audio_procunit+0xeab/0x13f0 [ 25.236436][ T12] kasan_report+0xe/0x20 [ 25.240655][ T12] build_audio_procunit+0xeab/0x13f0 [ 25.245923][ T12] parse_audio_unit+0x1812/0x36f0 [ 25.250926][ T12] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 25.256725][ T12] ? lockdep_hardirqs_on+0x382/0x580 [ 25.262040][ T12] ? stack_depot_save+0x252/0x440 [ 25.267047][ T12] ? build_audio_procunit+0x13f0/0x13f0 [ 25.272567][ T12] ? save_stack+0x4c/0x80 [ 25.276869][ T12] ? save_stack+0x1b/0x80 [ 25.281180][ T12] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 25.286961][ T12] ? snd_usb_create_mixer+0x180/0x1890 [ 25.292408][ T12] ? usb_audio_probe+0xc76/0x2010 [ 25.297515][ T12] ? usb_probe_interface+0x305/0x7a0 [ 25.302822][ T12] ? really_probe+0x281/0x6d0 [ 25.307480][ T12] ? driver_probe_device+0x104/0x210 [ 25.312748][ T12] ? __device_attach_driver+0x1c2/0x220 [ 25.318273][ T12] ? bus_for_each_drv+0x162/0x1e0 [ 25.323276][ T12] ? __device_attach+0x217/0x360 [ 25.328200][ T12] ? bus_probe_device+0x1e4/0x290 [ 25.333295][ T12] ? device_add+0xae6/0x16f0 [ 25.337874][ T12] ? usb_set_configuration+0xdf6/0x1670 [ 25.343404][ T12] ? validate_desc.part.0+0x17f/0x240 [ 25.348843][ T12] snd_usb_mixer_controls+0x715/0xb90 [ 25.354190][ T12] ? parse_audio_unit+0x36f0/0x36f0 [ 25.359374][ T12] ? fs_reclaim_acquire.part.0+0x30/0x30 [ 25.364985][ T12] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 25.370244][ T12] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 25.376111][ T12] ? kasan_unpoison_shadow+0x30/0x40 [ 25.381383][ T12] ? usb_ifnum_to_if+0x12b/0x180 [ 25.386301][ T12] snd_usb_create_mixer+0x2b5/0x1890 [ 25.391563][ T12] ? mark_lock+0xbc/0x1160 [ 25.395957][ T12] ? mark_held_locks+0x9f/0xe0 [ 25.400697][ T12] ? snd_usb_mixer_interrupt+0x800/0x800 [ 25.406305][ T12] ? lockdep_hardirqs_on+0x382/0x580 [ 25.411572][ T12] ? usb_driver_claim_interface+0x210/0x420 [ 25.417450][ T12] ? snd_usb_create_stream+0x16a/0x4c0 [ 25.422902][ T12] usb_audio_probe+0xc76/0x2010 [ 25.427785][ T12] ? usb_audio_resume+0x20/0x20 [ 25.432618][ T12] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 25.438405][ T12] usb_probe_interface+0x305/0x7a0 [ 25.443584][ T12] ? usb_probe_device+0x100/0x100 [ 25.448587][ T12] really_probe+0x281/0x6d0 [ 25.453067][ T12] driver_probe_device+0x104/0x210 [ 25.458154][ T12] __device_attach_driver+0x1c2/0x220 [ 25.463502][ T12] ? driver_allows_async_probing+0x160/0x160 [ 25.469458][ T12] bus_for_each_drv+0x162/0x1e0 [ 25.474285][ T12] ? bus_rescan_devices+0x20/0x20 [ 25.479288][ T12] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 25.485072][ T12] ? lockdep_hardirqs_on+0x382/0x580 [ 25.490336][ T12] __device_attach+0x217/0x360 [ 25.495176][ T12] ? device_bind_driver+0xd0/0xd0 [ 25.500186][ T12] ? kobject_uevent_env+0x29e/0x1150 [ 25.505455][ T12] ? kobject_uevent_env+0x2a8/0x1150 [ 25.510724][ T12] bus_probe_device+0x1e4/0x290 [ 25.515556][ T12] ? blocking_notifier_call_chain+0x54/0xa0 [ 25.521431][ T12] device_add+0xae6/0x16f0 [ 25.525838][ T12] ? uevent_store+0x50/0x50 [ 25.530327][ T12] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 25.536121][ T12] usb_set_configuration+0xdf6/0x1670 [ 25.541516][ T12] generic_probe+0x9d/0xd5 [ 25.545926][ T12] usb_probe_device+0x99/0x100 [ 25.550713][ T12] ? usb_suspend+0x620/0x620 [ 25.555279][ T12] really_probe+0x281/0x6d0 [ 25.559761][ T12] driver_probe_device+0x104/0x210 [ 25.564850][ T12] __device_attach_driver+0x1c2/0x220 [ 25.570211][ T12] ? driver_allows_async_probing+0x160/0x160 [ 25.576167][ T12] bus_for_each_drv+0x162/0x1e0 [ 25.580995][ T12] ? bus_rescan_devices+0x20/0x20 [ 25.585993][ T12] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 25.591774][ T12] ? lockdep_hardirqs_on+0x382/0x580 [ 25.597033][ T12] __device_attach+0x217/0x360 [ 25.601771][ T12] ? device_bind_driver+0xd0/0xd0 [ 25.606770][ T12] ? kobject_uevent_env+0x29e/0x1150 [ 25.612025][ T12] ? kobject_uevent_env+0x2a8/0x1150 [ 25.617287][ T12] bus_probe_device+0x1e4/0x290 [ 25.622118][ T12] ? blocking_notifier_call_chain+0x54/0xa0 [ 25.627983][ T12] device_add+0xae6/0x16f0 [ 25.632388][ T12] ? uevent_store+0x50/0x50 [ 25.636883][ T12] usb_new_device.cold+0x6a4/0xe79 [ 25.641986][ T12] hub_event+0x1dd0/0x37e0 [ 25.646516][ T12] ? hub_port_debounce+0x260/0x260 [ 25.651695][ T12] ? find_held_lock+0x2d/0x110 [ 25.656442][ T12] ? mark_held_locks+0xe0/0xe0 [ 25.661185][ T12] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 25.666823][ T12] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 25.672083][ T12] process_one_work+0x92b/0x1530 [ 25.676995][ T12] ? pwq_dec_nr_in_flight+0x310/0x310 [ 25.682341][ T12] ? do_raw_spin_lock+0x11a/0x280 [ 25.687382][ T12] worker_thread+0x96/0xe20 [ 25.691863][ T12] ? process_one_work+0x1530/0x1530 [ 25.697037][ T12] kthread+0x318/0x420 [ 25.701083][ T12] ? kthread_create_on_node+0xf0/0xf0 [ 25.706432][ T12] ret_from_fork+0x24/0x30 [ 25.710859][ T12] [ 25.713173][ T12] Allocated by task 12: [ 25.717433][ T12] save_stack+0x1b/0x80 [ 25.721633][ T12] __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 25.727248][ T12] usb_alloc_urb+0x65/0xb0 [ 25.731671][ T12] usb_control_msg+0x1c9/0x4a0 [ 25.736499][ T12] usb_get_descriptor+0xc1/0x1b0 [ 25.741503][ T12] usb_get_configuration+0x28e/0x3050 [ 25.746863][ T12] usb_new_device+0xd3/0x160 [ 25.751510][ T12] hub_event+0x1dd0/0x37e0 [ 25.755955][ T12] process_one_work+0x92b/0x1530 [ 25.760930][ T12] worker_thread+0x96/0xe20 [ 25.765415][ T12] kthread+0x318/0x420 [ 25.769557][ T12] ret_from_fork+0x24/0x30 [ 25.773942][ T12] [ 25.776252][ T12] Freed by task 12: [ 25.780039][ T12] save_stack+0x1b/0x80 [ 25.784257][ T12] __kasan_slab_free+0x130/0x180 [ 25.789179][ T12] kfree+0xe4/0x320 [ 25.792971][ T12] usb_free_urb.part.0+0x7a/0xc0 [ 25.797883][ T12] usb_free_urb+0x1b/0x30 [ 25.802241][ T12] usb_start_wait_urb+0x1e5/0x2b0 [ 25.807280][ T12] usb_control_msg+0x31c/0x4a0 [ 25.812021][ T12] usb_get_descriptor+0xc1/0x1b0 [ 25.816942][ T12] usb_get_configuration+0x28e/0x3050 [ 25.822301][ T12] usb_new_device+0xd3/0x160 [ 25.826874][ T12] hub_event+0x1dd0/0x37e0 [ 25.831278][ T12] process_one_work+0x92b/0x1530 [ 25.836286][ T12] worker_thread+0x96/0xe20 [ 25.840766][ T12] kthread+0x318/0x420 [ 25.844827][ T12] ret_from_fork+0x24/0x30 [ 25.849211][ T12] [ 25.851524][ T12] The buggy address belongs to the object at ffff8881d4c01400 [ 25.851524][ T12] which belongs to the cache kmalloc-192 of size 192 [ 25.865550][ T12] The buggy address is located 13 bytes inside of [ 25.865550][ T12] 192-byte region [ffff8881d4c01400, ffff8881d4c014c0) [ 25.878881][ T12] The buggy address belongs to the page: [ 25.884502][ T12] page:ffffea0007530040 refcount:1 mapcount:0 mapping:ffff8881da002a00 index:0x0 [ 25.894413][ T12] flags: 0x200000000000200(slab) [ 25.899356][ T12] raw: 0200000000000200 ffffea000754fec0 0000000200000002 ffff8881da002a00 [ 25.907926][ T12] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 25.916499][ T12] page dumped because: kasan: bad access detected [ 25.922884][ T12] [ 25.925187][ T12] Memory state around the buggy address: [ 25.930796][ T12] ffff8881d4c01300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.938835][ T12] ffff8881d4c01380: 00 00 00 07 fc fc fc fc fc fc fc fc fc fc fc fc [ 25.946884][ T12] >ffff8881d4c01400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.954920][ T12] ^ [ 25.959228][ T12] ffff8881d4c01480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 25.967287][ T12] ffff8881d4c01500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.975407][ T12] ================================================================== [ 25.983445][ T12] Disabling lock debugging due to kernel taint [ 25.989642][ T12] Kernel panic - not syncing: panic_on_warn set ... [ 25.996236][ T12] CPU: 0 PID: 12 Comm: kworker/0:1 Tainted: G B 5.4.0-rc3+ #0 [ 26.005204][ T12] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 26.015332][ T12] Workqueue: usb_hub_wq hub_event [ 26.020328][ T12] Call Trace: [ 26.023694][ T12] dump_stack+0xca/0x13e [ 26.028004][ T12] panic+0x2aa/0x6e1 [ 26.031876][ T12] ? add_taint.cold+0x16/0x16 [ 26.036530][ T12] ? build_audio_procunit+0xeab/0x13f0 [ 26.041977][ T12] ? trace_hardirqs_on+0x55/0x1e0 [ 26.046975][ T12] ? build_audio_procunit+0xeab/0x13f0 [ 26.052407][ T12] end_report+0x43/0x49 [ 26.056536][ T12] ? build_audio_procunit+0xeab/0x13f0 [ 26.061977][ T12] __kasan_report.cold+0xd/0x33 [ 26.066980][ T12] ? build_audio_procunit+0xeab/0x13f0 [ 26.072414][ T12] kasan_report+0xe/0x20 [ 26.076636][ T12] build_audio_procunit+0xeab/0x13f0 [ 26.081902][ T12] parse_audio_unit+0x1812/0x36f0 [ 26.087003][ T12] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 26.092785][ T12] ? lockdep_hardirqs_on+0x382/0x580 [ 26.098051][ T12] ? stack_depot_save+0x252/0x440 [ 26.103048][ T12] ? build_audio_procunit+0x13f0/0x13f0 [ 26.108565][ T12] ? save_stack+0x4c/0x80 [ 26.112870][ T12] ? save_stack+0x1b/0x80 [ 26.117178][ T12] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 26.122959][ T12] ? snd_usb_create_mixer+0x180/0x1890 [ 26.128403][ T12] ? usb_audio_probe+0xc76/0x2010 [ 26.134196][ T12] ? usb_probe_interface+0x305/0x7a0 [ 26.140685][ T12] ? really_probe+0x281/0x6d0 [ 26.145338][ T12] ? driver_probe_device+0x104/0x210 [ 26.150597][ T12] ? __device_attach_driver+0x1c2/0x220 [ 26.156214][ T12] ? bus_for_each_drv+0x162/0x1e0 [ 26.161221][ T12] ? __device_attach+0x217/0x360 [ 26.166137][ T12] ? bus_probe_device+0x1e4/0x290 [ 26.173842][ T12] ? device_add+0xae6/0x16f0 [ 26.178410][ T12] ? usb_set_configuration+0xdf6/0x1670 [ 26.183962][ T12] ? validate_desc.part.0+0x17f/0x240 [ 26.189319][ T12] snd_usb_mixer_controls+0x715/0xb90 [ 26.194690][ T12] ? parse_audio_unit+0x36f0/0x36f0 [ 26.199866][ T12] ? fs_reclaim_acquire.part.0+0x30/0x30 [ 26.205486][ T12] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 26.210747][ T12] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 26.216550][ T12] ? kasan_unpoison_shadow+0x30/0x40 [ 26.221816][ T12] ? usb_ifnum_to_if+0x12b/0x180 [ 26.226727][ T12] snd_usb_create_mixer+0x2b5/0x1890 [ 26.231996][ T12] ? mark_lock+0xbc/0x1160 [ 26.236389][ T12] ? mark_held_locks+0x9f/0xe0 [ 26.241215][ T12] ? snd_usb_mixer_interrupt+0x800/0x800 [ 26.246835][ T12] ? lockdep_hardirqs_on+0x382/0x580 [ 26.252103][ T12] ? usb_driver_claim_interface+0x210/0x420 [ 26.257983][ T12] ? snd_usb_create_stream+0x16a/0x4c0 [ 26.263422][ T12] usb_audio_probe+0xc76/0x2010 [ 26.268256][ T12] ? usb_audio_resume+0x20/0x20 [ 26.273081][ T12] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 26.278868][ T12] usb_probe_interface+0x305/0x7a0 [ 26.283959][ T12] ? usb_probe_device+0x100/0x100 [ 26.288958][ T12] really_probe+0x281/0x6d0 [ 26.293450][ T12] driver_probe_device+0x104/0x210 [ 26.298539][ T12] __device_attach_driver+0x1c2/0x220 [ 26.303885][ T12] ? driver_allows_async_probing+0x160/0x160 [ 26.309835][ T12] bus_for_each_drv+0x162/0x1e0 [ 26.314659][ T12] ? bus_rescan_devices+0x20/0x20 [ 26.319657][ T12] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 26.325444][ T12] ? lockdep_hardirqs_on+0x382/0x580 [ 26.330705][ T12] __device_attach+0x217/0x360 [ 26.335446][ T12] ? device_bind_driver+0xd0/0xd0 [ 26.340446][ T12] ? kobject_uevent_env+0x29e/0x1150 [ 26.345704][ T12] ? kobject_uevent_env+0x2a8/0x1150 [ 26.350968][ T12] bus_probe_device+0x1e4/0x290 [ 26.355907][ T12] ? blocking_notifier_call_chain+0x54/0xa0 [ 26.361787][ T12] device_add+0xae6/0x16f0 [ 26.366318][ T12] ? uevent_store+0x50/0x50 [ 26.370808][ T12] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 26.376590][ T12] usb_set_configuration+0xdf6/0x1670 [ 26.382721][ T12] generic_probe+0x9d/0xd5 [ 26.387112][ T12] usb_probe_device+0x99/0x100 [ 26.391852][ T12] ? usb_suspend+0x620/0x620 [ 26.396428][ T12] really_probe+0x281/0x6d0 [ 26.400916][ T12] driver_probe_device+0x104/0x210 [ 26.406031][ T12] __device_attach_driver+0x1c2/0x220 [ 26.411382][ T12] ? driver_allows_async_probing+0x160/0x160 [ 26.417348][ T12] bus_for_each_drv+0x162/0x1e0 [ 26.422174][ T12] ? bus_rescan_devices+0x20/0x20 [ 26.427260][ T12] ? _raw_spin_unlock_irqrestore+0x3e/0x50 [ 26.433043][ T12] ? lockdep_hardirqs_on+0x382/0x580 [ 26.438407][ T12] __device_attach+0x217/0x360 [ 26.443150][ T12] ? device_bind_driver+0xd0/0xd0 [ 26.448151][ T12] ? kobject_uevent_env+0x29e/0x1150 [ 26.453545][ T12] ? kobject_uevent_env+0x2a8/0x1150 [ 26.458820][ T12] bus_probe_device+0x1e4/0x290 [ 26.463739][ T12] ? blocking_notifier_call_chain+0x54/0xa0 [ 26.469627][ T12] device_add+0xae6/0x16f0 [ 26.474022][ T12] ? uevent_store+0x50/0x50 [ 26.478512][ T12] usb_new_device.cold+0x6a4/0xe79 [ 26.483601][ T12] hub_event+0x1dd0/0x37e0 [ 26.487992][ T12] ? hub_port_debounce+0x260/0x260 [ 26.493077][ T12] ? find_held_lock+0x2d/0x110 [ 26.497814][ T12] ? mark_held_locks+0xe0/0xe0 [ 26.502554][ T12] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 26.508073][ T12] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 26.513330][ T12] process_one_work+0x92b/0x1530 [ 26.518245][ T12] ? pwq_dec_nr_in_flight+0x310/0x310 [ 26.523590][ T12] ? do_raw_spin_lock+0x11a/0x280 [ 26.528598][ T12] worker_thread+0x96/0xe20 [ 26.533087][ T12] ? process_one_work+0x1530/0x1530 [ 26.538311][ T12] kthread+0x318/0x420 [ 26.542395][ T12] ? kthread_create_on_node+0xf0/0xf0 [ 26.547749][ T12] ret_from_fork+0x24/0x30 [ 26.553186][ T12] Kernel Offset: disabled [ 26.557498][ T12] Rebooting in 86400 seconds..