usb 1-1: USB disconnect, device number 2 ================================================================== BUG: KASAN: slab-use-after-free in hdm_disconnect+0x5c/0xa0 drivers/most/most_usb.c:1123 Read at addr faf0000005799b60 by task kworker/1:0/25 Pointer tag: [fa], memory tag: [fe] CPU: 1 UID: 0 PID: 25 Comm: kworker/1:0 Not tainted 6.12.0-rc7-syzkaller-00125-gcfaaa7d010d1 #0 Hardware name: linux,dummy-virt (DT) Workqueue: usb_hub_wq hub_event Call trace: dump_backtrace+0x94/0xec arch/arm64/kernel/stacktrace.c:319 show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:326 __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x78/0x90 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x108/0x618 mm/kasan/report.c:488 kasan_report+0x88/0xac mm/kasan/report.c:601 report_tag_fault arch/arm64/mm/fault.c:332 [inline] do_tag_recovery arch/arm64/mm/fault.c:344 [inline] __do_kernel_fault+0x170/0x1c8 arch/arm64/mm/fault.c:386 do_bad_area arch/arm64/mm/fault.c:486 [inline] do_tag_check_fault+0x78/0x8c arch/arm64/mm/fault.c:803 do_mem_abort+0x44/0x94 arch/arm64/mm/fault.c:879 el1_abort+0x40/0x60 arch/arm64/kernel/entry-common.c:432 el1h_64_sync_handler+0xd8/0xe4 arch/arm64/kernel/entry-common.c:492 el1h_64_sync+0x64/0x68 arch/arm64/kernel/entry.S:593 hdm_disconnect+0x5c/0xa0 drivers/most/most_usb.c:1123 usb_unbind_interface+0x78/0x290 drivers/usb/core/driver.c:461 device_remove drivers/base/dd.c:569 [inline] device_remove+0x70/0x80 drivers/base/dd.c:561 __device_release_driver drivers/base/dd.c:1273 [inline] device_release_driver_internal+0x1d4/0x230 drivers/base/dd.c:1296 device_release_driver+0x18/0x24 drivers/base/dd.c:1319 bus_remove_device+0xcc/0x10c drivers/base/bus.c:576 device_del+0x14c/0x380 drivers/base/core.c:3861 usb_disable_device+0xd8/0x1b0 drivers/usb/core/message.c:1418 usb_disconnect+0xd8/0x2bc drivers/usb/core/hub.c:2304 hub_port_connect drivers/usb/core/hub.c:5361 [inline] hub_port_connect_change drivers/usb/core/hub.c:5661 [inline] port_event drivers/usb/core/hub.c:5821 [inline] hub_event+0x98c/0x1558 drivers/usb/core/hub.c:5903 process_one_work+0x15c/0x29c kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x24c/0x354 kernel/workqueue.c:3391 kthread+0x114/0x118 kernel/kthread.c:389 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 Allocated by task 25: kasan_save_stack+0x3c/0x64 mm/kasan/common.c:47 save_stack_info+0x40/0x158 mm/kasan/tags.c:106 kasan_save_alloc_info+0x14/0x20 mm/kasan/tags.c:142 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] poison_kmalloc_redzone mm/kasan/common.c:350 [inline] __kasan_kmalloc+0xb4/0xb8 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:257 [inline] __kmalloc_cache_noprof+0x14c/0x2e4 mm/slub.c:4295 kmalloc_noprof include/linux/slab.h:878 [inline] kzalloc_noprof include/linux/slab.h:1014 [inline] hdm_probe+0x3c/0x498 drivers/most/most_usb.c:959 usb_probe_interface+0xd4/0x2a8 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:579 [inline] really_probe+0xbc/0x298 drivers/base/dd.c:658 __driver_probe_device+0x78/0x12c drivers/base/dd.c:800 driver_probe_device+0x3c/0x10c drivers/base/dd.c:830 __device_attach_driver+0xb8/0xf8 drivers/base/dd.c:958 bus_for_each_drv+0x84/0xe0 drivers/base/bus.c:459 __device_attach+0x9c/0x188 drivers/base/dd.c:1030 device_initial_probe+0x14/0x20 drivers/base/dd.c:1079 bus_probe_device+0xac/0xb0 drivers/base/bus.c:534 device_add+0x5cc/0x78c drivers/base/core.c:3672 usb_set_configuration+0x4f0/0x8d8 drivers/usb/core/message.c:2210 usb_generic_driver_probe+0x60/0x88 drivers/usb/core/generic.c:254 usb_probe_device+0x3c/0x118 drivers/usb/core/driver.c:294 call_driver_probe drivers/base/dd.c:579 [inline] really_probe+0xbc/0x298 drivers/base/dd.c:658 __driver_probe_device+0x78/0x12c drivers/base/dd.c:800 driver_probe_device+0x3c/0x10c drivers/base/dd.c:830 __device_attach_driver+0xb8/0xf8 drivers/base/dd.c:958 bus_for_each_drv+0x84/0xe0 drivers/base/bus.c:459 __device_attach+0x9c/0x188 drivers/base/dd.c:1030 device_initial_probe+0x14/0x20 drivers/base/dd.c:1079 bus_probe_device+0xac/0xb0 drivers/base/bus.c:534 device_add+0x5cc/0x78c drivers/base/core.c:3672 usb_new_device+0x27c/0x64c drivers/usb/core/hub.c:2651 hub_port_connect drivers/usb/core/hub.c:5521 [inline] hub_port_connect_change drivers/usb/core/hub.c:5661 [inline] port_event drivers/usb/core/hub.c:5821 [inline] hub_event+0xe20/0x1558 drivers/usb/core/hub.c:5903 process_one_work+0x15c/0x29c kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x24c/0x354 kernel/workqueue.c:3391 kthread+0x114/0x118 kernel/kthread.c:389 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 Freed by task 25: kasan_save_stack+0x3c/0x64 mm/kasan/common.c:47 save_stack_info+0x40/0x158 mm/kasan/tags.c:106 kasan_save_free_info+0x18/0x24 mm/kasan/tags.c:147 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x74/0x8c mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:2342 [inline] slab_free mm/slub.c:4579 [inline] kfree+0xfc/0x2f0 mm/slub.c:4727 release_mdev+0x10/0x1c drivers/most/most_usb.c:932 device_release+0x34/0x90 drivers/base/core.c:2574 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0xa4/0x114 lib/kobject.c:737 put_device drivers/base/core.c:3780 [inline] device_unregister+0x24/0x34 drivers/base/core.c:3903 most_deregister_interface+0xf8/0x108 drivers/most/core.c:1402 hdm_disconnect+0x5c/0xa0 drivers/most/most_usb.c:1123 usb_unbind_interface+0x78/0x290 drivers/usb/core/driver.c:461 device_remove drivers/base/dd.c:569 [inline] device_remove+0x70/0x80 drivers/base/dd.c:561 __device_release_driver drivers/base/dd.c:1273 [inline] device_release_driver_internal+0x1d4/0x230 drivers/base/dd.c:1296 device_release_driver+0x18/0x24 drivers/base/dd.c:1319 bus_remove_device+0xcc/0x10c drivers/base/bus.c:576 device_del+0x14c/0x380 drivers/base/core.c:3861 usb_disable_device+0xd8/0x1b0 drivers/usb/core/message.c:1418 usb_disconnect+0xd8/0x2bc drivers/usb/core/hub.c:2304 hub_port_connect drivers/usb/core/hub.c:5361 [inline] hub_port_connect_change drivers/usb/core/hub.c:5661 [inline] port_event drivers/usb/core/hub.c:5821 [inline] hub_event+0x98c/0x1558 drivers/usb/core/hub.c:5903 process_one_work+0x15c/0x29c kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x24c/0x354 kernel/workqueue.c:3391 kthread+0x114/0x118 kernel/kthread.c:389 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 The buggy address belongs to the object at fff0000005799000 which belongs to the cache kmalloc-4k of size 4096 The buggy address is located 2912 bytes inside of 4096-byte region [fff0000005799000, fff000000579a000) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x45798 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x1ffc00000000040(head|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0) page_type: f5(slab) raw: 01ffc00000000040 f8f0000003001c00 ffffc1ffc0116400 dead000000000002 raw: 0000000000000000 0000000080080008 00000001f5000000 0000000000000000 head: 01ffc00000000040 f8f0000003001c00 ffffc1ffc0116400 dead000000000002 head: 0000000000000000 0000000080080008 00000001f5000000 0000000000000000 head: 01ffc00000000003 ffffc1ffc015e601 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: fff0000005799900: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fff0000005799a00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe >fff0000005799b00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe ^ fff0000005799c00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fff0000005799d00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe ================================================================== ------------[ cut here ]------------ kobject: '(null)' (0000000014ac6788): is not initialized, yet kobject_put() is being called. WARNING: CPU: 1 PID: 25 at lib/kobject.c:734 kobject_put+0xe0/0x114 lib/kobject.c:734 Modules linked in: CPU: 1 UID: 0 PID: 25 Comm: kworker/1:0 Tainted: G B 6.12.0-rc7-syzkaller-00125-gcfaaa7d010d1 #0 Tainted: [B]=BAD_PAGE Hardware name: linux,dummy-virt (DT) Workqueue: usb_hub_wq hub_event pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : kobject_put+0xe0/0x114 lib/kobject.c:734 lr : kobject_put+0xe0/0x114 lib/kobject.c:734 sp : ffff800082b939a0 x29: ffff800082b939a0 x28: 0000000000000000 x27: faf00000058f2800 x26: fbf0000006b1d800 x25: fbf0000006b1d8a8 x24: ffff80008291d8c0 x23: 0000000000000000 x22: faf00000058f28d0 x21: faf0000005799b68 x20: faf00000058f2850 x19: faf0000005799000 x18: ffffffffffffffff x17: 6f6b20746579202c x16: 64657a696c616974 x15: 696e6920746f6e20 x14: 7369203a29383837 x13: ffff80008274e5d0 x12: 0000000000000a4a x11: 000000000000036e x10: ffff8000827fe5d0 x9 : ffff80008274e5d0 x8 : 00000000ffffdfff x7 : ffff8000827fe5d0 x6 : 80000000ffffe000 x5 : 0000000000017ff4 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : faf0000003254900 Call trace: kobject_put+0xe0/0x114 lib/kobject.c:734 put_device+0x14/0x24 drivers/base/core.c:3780 hdm_disconnect+0x8c/0xa0 drivers/most/most_usb.c:1130 usb_unbind_interface+0x78/0x290 drivers/usb/core/driver.c:461 device_remove drivers/base/dd.c:569 [inline] device_remove+0x70/0x80 drivers/base/dd.c:561 __device_release_driver drivers/base/dd.c:1273 [inline] device_release_driver_internal+0x1d4/0x230 drivers/base/dd.c:1296 device_release_driver+0x18/0x24 drivers/base/dd.c:1319 bus_remove_device+0xcc/0x10c drivers/base/bus.c:576 device_del+0x14c/0x380 drivers/base/core.c:3861 usb_disable_device+0xd8/0x1b0 drivers/usb/core/message.c:1418 usb_disconnect+0xd8/0x2bc drivers/usb/core/hub.c:2304 hub_port_connect drivers/usb/core/hub.c:5361 [inline] hub_port_connect_change drivers/usb/core/hub.c:5661 [inline] port_event drivers/usb/core/hub.c:5821 [inline] hub_event+0x98c/0x1558 drivers/usb/core/hub.c:5903 process_one_work+0x15c/0x29c kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x24c/0x354 kernel/workqueue.c:3391 kthread+0x114/0x118 kernel/kthread.c:389 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 1 PID: 25 at lib/refcount.c:28 refcount_warn_saturate+0xf4/0x144 lib/refcount.c:28 Modules linked in: CPU: 1 UID: 0 PID: 25 Comm: kworker/1:0 Tainted: G B W 6.12.0-rc7-syzkaller-00125-gcfaaa7d010d1 #0 Tainted: [B]=BAD_PAGE, [W]=WARN Hardware name: linux,dummy-virt (DT) Workqueue: usb_hub_wq hub_event pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : refcount_warn_saturate+0xf4/0x144 lib/refcount.c:28 lr : refcount_warn_saturate+0xf4/0x144 lib/refcount.c:28 sp : ffff800082b93990 x29: ffff800082b93990 x28: 0000000000000000 x27: faf00000058f2800 x26: fbf0000006b1d800 x25: fbf0000006b1d8a8 x24: ffff80008291d8c0 x23: 0000000000000000 x22: faf00000058f28d0 x21: faf0000005799b68 x20: faf00000058f2850 x19: faf0000005799000 x18: ffffffffffffffff x17: 6f6b20746579202c x16: 64657a696c616974 x15: ffff800082b933d0 x14: 0000000000000000 x13: ffff80008274e5d0 x12: 0000000000000ac2 x11: 0000000000000396 x10: ffff8000827fe5d0 x9 : ffff80008274e5d0 x8 : 00000000ffffdfff x7 : ffff8000827fe5d0 x6 : 80000000ffffe000 x5 : 0000000000017ff4 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : faf0000003254900 Call trace: refcount_warn_saturate+0xf4/0x144 lib/refcount.c:28 __refcount_sub_and_test include/linux/refcount.h:275 [inline] __refcount_dec_and_test include/linux/refcount.h:307 [inline] refcount_dec_and_test include/linux/refcount.h:325 [inline] kref_put include/linux/kref.h:64 [inline] kobject_put+0x110/0x114 lib/kobject.c:737 put_device+0x14/0x24 drivers/base/core.c:3780 hdm_disconnect+0x8c/0xa0 drivers/most/most_usb.c:1130 usb_unbind_interface+0x78/0x290 drivers/usb/core/driver.c:461 device_remove drivers/base/dd.c:569 [inline] device_remove+0x70/0x80 drivers/base/dd.c:561 __device_release_driver drivers/base/dd.c:1273 [inline] device_release_driver_internal+0x1d4/0x230 drivers/base/dd.c:1296 device_release_driver+0x18/0x24 drivers/base/dd.c:1319 bus_remove_device+0xcc/0x10c drivers/base/bus.c:576 device_del+0x14c/0x380 drivers/base/core.c:3861 usb_disable_device+0xd8/0x1b0 drivers/usb/core/message.c:1418 usb_disconnect+0xd8/0x2bc drivers/usb/core/hub.c:2304 hub_port_connect drivers/usb/core/hub.c:5361 [inline] hub_port_connect_change drivers/usb/core/hub.c:5661 [inline] port_event drivers/usb/core/hub.c:5821 [inline] hub_event+0x98c/0x1558 drivers/usb/core/hub.c:5903 process_one_work+0x15c/0x29c kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x24c/0x354 kernel/workqueue.c:3391 kthread+0x114/0x118 kernel/kthread.c:389 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 ---[ end trace 0000000000000000 ]--- usb 1-1: new high-speed USB device number 3 using dummy_hcd usb 1-1: Using ep0 maxpacket: 32 usb 1-1: config 2 has an invalid interface number: 240 but max is 0 usb 1-1: config 2 contains an unexpected descriptor of type 0x2, skipping usb 1-1: config 2 has an invalid descriptor of length 138, skipping remainder of the config usb 1-1: config 2 has no interface number 0 usb 1-1: config 2 interface 240 altsetting 57 has 0 endpoint descriptors, different from the interface descriptor's value: 12 usb 1-1: config 2 interface 240 has no altsetting 0 usb 1-1: New USB device found, idVendor=0424, idProduct=cf30, bcdDevice=cf.f0 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: syz usb 1-1: Manufacturer: syz usb 1-1: SerialNumber: syz usb 1-1: USB disconnect, device number 3 usb 1-1: new high-speed USB device number 4 using dummy_hcd usb 1-1: Using ep0 maxpacket: 32 usb 1-1: config 2 has an invalid interface number: 240 but max is 0 usb 1-1: config 2 contains an unexpected descriptor of type 0x2, skipping usb 1-1: config 2 has an invalid descriptor of length 138, skipping remainder of the config usb 1-1: config 2 has no interface number 0 usb 1-1: config 2 interface 240 altsetting 57 has 0 endpoint descriptors, different from the interface descriptor's value: 12 usb 1-1: config 2 interface 240 has no altsetting 0 usb 1-1: New USB device found, idVendor=0424, idProduct=cf30, bcdDevice=cf.f0 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: syz usb 1-1: Manufacturer: syz usb 1-1: SerialNumber: syz usb 1-1: USB disconnect, device number 4 usb 1-1: new high-speed USB device number 5 using dummy_hcd usb 1-1: Using ep0 maxpacket: 32 usb 1-1: config 2 has an invalid interface number: 240 but max is 0 usb 1-1: config 2 contains an unexpected descriptor of type 0x2, skipping usb 1-1: config 2 has an invalid descriptor of length 138, skipping remainder of the config usb 1-1: config 2 has no interface number 0 usb 1-1: config 2 interface 240 altsetting 57 has 0 endpoint descriptors, different from the interface descriptor's value: 12 usb 1-1: config 2 interface 240 has no altsetting 0 usb 1-1: New USB device found, idVendor=0424, idProduct=cf30, bcdDevice=cf.f0 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: syz usb 1-1: Manufacturer: syz usb 1-1: SerialNumber: syz usb 1-1: USB disconnect, device number 5 usb 1-1: new high-speed USB device number 6 using dummy_hcd usb 1-1: Using ep0 maxpacket: 32 usb 1-1: config 2 has an invalid interface number: 240 but max is 0 usb 1-1: config 2 contains an unexpected descriptor of type 0x2, skipping usb 1-1: config 2 has an invalid descriptor of length 138, skipping remainder of the config usb 1-1: config 2 has no interface number 0 usb 1-1: config 2 interface 240 altsetting 57 has 0 endpoint descriptors, different from the interface descriptor's value: 12 usb 1-1: config 2 interface 240 has no altsetting 0 usb 1-1: New USB device found, idVendor=0424, idProduct=cf30, bcdDevice=cf.f0 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: syz usb 1-1: Manufacturer: syz usb 1-1: SerialNumber: syz usb 1-1: USB disconnect, device number 6 usb 1-1: new high-speed USB device number 7 using dummy_hcd usb 1-1: Using ep0 maxpacket: 32 usb 1-1: config 2 has an invalid interface number: 240 but max is 0 usb 1-1: config 2 contains an unexpected descriptor of type 0x2, skipping usb 1-1: config 2 has an invalid descriptor of length 138, skipping remainder of the config usb 1-1: config 2 has no interface number 0 usb 1-1: config 2 interface 240 altsetting 57 has 0 endpoint descriptors, different from the interface descriptor's value: 12 usb 1-1: config 2 interface 240 has no altsetting 0 usb 1-1: New USB device found, idVendor=0424, idProduct=cf30, bcdDevice=cf.f0 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: syz usb 1-1: Manufacturer: syz usb 1-1: SerialNumber: syz usb 1-1: USB disconnect, device number 7 usb 1-1: new high-speed USB device number 8 using dummy_hcd usb 1-1: Using ep0 maxpacket: 32 usb 1-1: config 2 has an invalid interface number: 240 but max is 0 usb 1-1: config 2 contains an unexpected descriptor of type 0x2, skipping usb 1-1: config 2 has an invalid descriptor of length 138, skipping remainder of the config usb 1-1: config 2 has no interface number 0 usb 1-1: config 2 interface 240 altsetting 57 has 0 endpoint descriptors, different from the interface descriptor's value: 12 usb 1-1: config 2 interface 240 has no altsetting 0 usb 1-1: New USB device found, idVendor=0424, idProduct=cf30, bcdDevice=cf.f0 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: syz usb 1-1: Manufacturer: syz usb 1-1: SerialNumber: syz usb 1-1: USB disconnect, device number 8 usb 1-1: new high-speed USB device number 9 using dummy_hcd usb 1-1: Using ep0 maxpacket: 32 usb 1-1: config 2 has an invalid interface number: 240 but max is 0 usb 1-1: config 2 contains an unexpected descriptor of type 0x2, skipping usb 1-1: config 2 has an invalid descriptor of length 138, skipping remainder of the config usb 1-1: config 2 has no interface number 0 usb 1-1: config 2 interface 240 altsetting 57 has 0 endpoint descriptors, different from the interface descriptor's value: 12 usb 1-1: config 2 interface 240 has no altsetting 0 usb 1-1: New USB device found, idVendor=0424, idProduct=cf30, bcdDevice=cf.f0 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: syz usb 1-1: Manufacturer: syz usb 1-1: SerialNumber: syz usb 1-1: USB disconnect, device number 9 usb 1-1: new high-speed USB device number 10 using dummy_hcd usb 1-1: Using ep0 maxpacket: 32 usb 1-1: config 2 has an invalid interface number: 240 but max is 0 usb 1-1: config 2 contains an unexpected descriptor of type 0x2, skipping usb 1-1: config 2 has an invalid descriptor of length 138, skipping remainder of the config usb 1-1: config 2 has no interface number 0 usb 1-1: config 2 interface 240 altsetting 57 has 0 endpoint descriptors, different from the interface descriptor's value: 12 usb 1-1: config 2 interface 240 has no altsetting 0 usb 1-1: New USB device found, idVendor=0424, idProduct=cf30, bcdDevice=cf.f0 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: syz usb 1-1: Manufacturer: syz usb 1-1: SerialNumber: syz usb 1-1: USB disconnect, device number 10 usb 1-1: new high-speed USB device number 11 using dummy_hcd usb 1-1: Using ep0 maxpacket: 32 usb 1-1: config 2 has an invalid interface number: 240 but max is 0 usb 1-1: config 2 contains an unexpected descriptor of type 0x2, skipping usb 1-1: config 2 has an invalid descriptor of length 138, skipping remainder of the config usb 1-1: config 2 has no interface number 0 usb 1-1: config 2 interface 240 altsetting 57 has 0 endpoint descriptors, different from the interface descriptor's value: 12 usb 1-1: config 2 interface 240 has no altsetting 0 usb 1-1: New USB device found, idVendor=0424, idProduct=cf30, bcdDevice=cf.f0 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: syz usb 1-1: Manufacturer: syz usb 1-1: SerialNumber: syz usb 1-1: USB disconnect, device number 11 usb 1-1: new high-speed USB device number 12 using dummy_hcd usb 1-1: Using ep0 maxpacket: 32 usb 1-1: config 2 has an invalid interface number: 240 but max is 0 usb 1-1: config 2 contains an unexpected descriptor of type 0x2, skipping usb 1-1: config 2 has an invalid descriptor of length 138, skipping remainder of the config usb 1-1: config 2 has no interface number 0 usb 1-1: config 2 interface 240 altsetting 57 has 0 endpoint descriptors, different from the interface descriptor's value: 12 usb 1-1: config 2 interface 240 has no altsetting 0 usb 1-1: New USB device found, idVendor=0424, idProduct=cf30, bcdDevice=cf.f0 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: syz usb 1-1: Manufacturer: syz usb 1-1: SerialNumber: syz usb 1-1: USB disconnect, device number 12 usb 1-1: new high-speed USB device number 13 using dummy_hcd usb 1-1: Using ep0 maxpacket: 32 usb 1-1: config 2 has an invalid interface number: 240 but max is 0 usb 1-1: config 2 contains an unexpected descriptor of type 0x2, skipping usb 1-1: config 2 has an invalid descriptor of length 138, skipping remainder of the config usb 1-1: config 2 has no interface number 0 usb 1-1: config 2 interface 240 altsetting 57 has 0 endpoint descriptors, different from the interface descriptor's value: 12 usb 1-1: config 2 interface 240 has no altsetting 0 usb 1-1: New USB device found, idVendor=0424, idProduct=cf30, bcdDevice=cf.f0 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: syz usb 1-1: Manufacturer: syz usb 1-1: SerialNumber: syz usb 1-1: USB disconnect, device number 13 usb 1-1: new high-speed USB device number 14 using dummy_hcd usb 1-1: Using ep0 maxpacket: 32 usb 1-1: config 2 has an invalid interface number: 240 but max is 0 usb 1-1: config 2 contains an unexpected descriptor of type 0x2, skipping usb 1-1: config 2 has an invalid descriptor of length 138, skipping remainder of the config usb 1-1: config 2 has no interface number 0 usb 1-1: config 2 interface 240 altsetting 57 has 0 endpoint descriptors, different from the interface descriptor's value: 12 usb 1-1: config 2 interface 240 has no altsetting 0 usb 1-1: New USB device found, idVendor=0424, idProduct=cf30, bcdDevice=cf.f0 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: syz usb 1-1: Manufacturer: syz usb 1-1: SerialNumber: syz usb 1-1: USB disconnect, device number 14 usb 1-1: new high-speed USB device number 15 using dummy_hcd usb 1-1: Using ep0 maxpacket: 32 usb 1-1: config 2 has an invalid interface number: 240 but max is 0 usb 1-1: config 2 contains an unexpected descriptor of type 0x2, skipping usb 1-1: config 2 has an invalid descriptor of length 138, skipping remainder of the config usb 1-1: config 2 has no interface number 0 usb 1-1: config 2 interface 240 altsetting 57 has 0 endpoint descriptors, different from the interface descriptor's value: 12 usb 1-1: config 2 interface 240 has no altsetting 0 usb 1-1: New USB device found, idVendor=0424, idProduct=cf30, bcdDevice=cf.f0 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: syz usb 1-1: Manufacturer: syz usb 1-1: SerialNumber: syz usb 1-1: USB disconnect, device number 15 usb 1-1: new high-speed USB device number 16 using dummy_hcd usb 1-1: Using ep0 maxpacket: 32 usb 1-1: config 2 has an invalid interface number: 240 but max is 0 usb 1-1: config 2 contains an unexpected descriptor of type 0x2, skipping usb 1-1: config 2 has an invalid descriptor of length 138, skipping remainder of the config usb 1-1: config 2 has no interface number 0 usb 1-1: config 2 interface 240 altsetting 57 has 0 endpoint descriptors, different from the interface descriptor's value: 12 usb 1-1: config 2 interface 240 has no altsetting 0 usb 1-1: New USB device found, idVendor=0424, idProduct=cf30, bcdDevice=cf.f0 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: syz usb 1-1: Manufacturer: syz usb 1-1: SerialNumber: syz usb 1-1: USB disconnect, device number 16 usb 1-1: new high-speed USB device number 17 using dummy_hcd usb 1-1: Using ep0 maxpacket: 32 usb 1-1: config 2 has an invalid interface number: 240 but max is 0 usb 1-1: config 2 contains an unexpected descriptor of type 0x2, skipping usb 1-1: config 2 has an invalid descriptor of length 138, skipping remainder of the config usb 1-1: config 2 has no interface number 0 usb 1-1: config 2 interface 240 altsetting 57 has 0 endpoint descriptors, different from the interface descriptor's value: 12 usb 1-1: config 2 interface 240 has no altsetting 0 usb 1-1: New USB device found, idVendor=0424, idProduct=cf30, bcdDevice=cf.f0 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: syz usb 1-1: Manufacturer: syz usb 1-1: SerialNumber: syz usb 1-1: USB disconnect, device number 17 usb 1-1: new high-speed USB device number 18 using dummy_hcd usb 1-1: Using ep0 maxpacket: 32 usb 1-1: config 2 has an invalid interface number: 240 but max is 0 usb 1-1: config 2 contains an unexpected descriptor of type 0x2, skipping usb 1-1: config 2 has an invalid descriptor of length 138, skipping remainder of the config usb 1-1: config 2 has no interface number 0 usb 1-1: config 2 interface 240 altsetting 57 has 0 endpoint descriptors, different from the interface descriptor's value: 12 usb 1-1: config 2 interface 240 has no altsetting 0 usb 1-1: New USB device found, idVendor=0424, idProduct=cf30, bcdDevice=cf.f0 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: syz usb 1-1: Manufacturer: syz usb 1-1: SerialNumber: syz usb 1-1: USB disconnect, device number 18 usb 1-1: new high-speed USB device number 19 using dummy_hcd usb 1-1: Using ep0 maxpacket: 32 usb 1-1: config 2 has an invalid interface number: 240 but max is 0 usb 1-1: config 2 contains an unexpected descriptor of type 0x2, skipping usb 1-1: config 2 has an invalid descriptor of length 138, skipping remainder of the config usb 1-1: config 2 has no interface number 0 usb 1-1: config 2 interface 240 altsetting 57 has 0 endpoint descriptors, different from the interface descriptor's value: 12 usb 1-1: config 2 interface 240 has no altsetting 0 usb 1-1: New USB device found, idVendor=0424, idProduct=cf30, bcdDevice=cf.f0 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: syz usb 1-1: Manufacturer: syz usb 1-1: SerialNumber: syz usb 1-1: USB disconnect, device number 19 usb 1-1: new high-speed USB device number 20 using dummy_hcd usb 1-1: Using ep0 maxpacket: 32 usb 1-1: config 2 has an invalid interface number: 240 but max is 0 usb 1-1: config 2 contains an unexpected descriptor of type 0x2, skipping usb 1-1: config 2 has an invalid descriptor of length 138, skipping remainder of the config usb 1-1: config 2 has no interface number 0 usb 1-1: config 2 interface 240 altsetting 57 has 0 endpoint descriptors, different from the interface descriptor's value: 12 usb 1-1: config 2 interface 240 has no altsetting 0 usb 1-1: New USB device found, idVendor=0424, idProduct=cf30, bcdDevice=cf.f0 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: syz usb 1-1: Manufacturer: syz usb 1-1: SerialNumber: syz usb 1-1: USB disconnect, device number 20 usb 1-1: new high-speed USB device number 21 using dummy_hcd usb 1-1: Using ep0 maxpacket: 32 usb 1-1: config 2 has an invalid interface number: 240 but max is 0 usb 1-1: config 2 contains an unexpected descriptor of type 0x2, skipping usb 1-1: config 2 has an invalid descriptor of length 138, skipping remainder of the config usb 1-1: config 2 has no interface number 0 usb 1-1: config 2 interface 240 altsetting 57 has 0 endpoint descriptors, different from the interface descriptor's value: 12 usb 1-1: config 2 interface 240 has no altsetting 0 usb 1-1: New USB device found, idVendor=0424, idProduct=cf30, bcdDevice=cf.f0 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: syz usb 1-1: Manufacturer: syz usb 1-1: SerialNumber: syz usb 1-1: USB disconnect, device number 21 usb 1-1: new high-speed USB device number 22 using dummy_hcd usb 1-1: Using ep0 maxpacket: 32 usb 1-1: config 2 has an invalid interface number: 240 but max is 0 usb 1-1: config 2 contains an unexpected descriptor of type 0x2, skipping usb 1-1: config 2 has an invalid descriptor of length 138, skipping remainder of the config usb 1-1: config 2 has no interface number 0 usb 1-1: config 2 interface 240 altsetting 57 has 0 endpoint descriptors, different from the interface descriptor's value: 12 usb 1-1: config 2 interface 240 has no altsetting 0 usb 1-1: New USB device found, idVendor=0424, idProduct=cf30, bcdDevice=cf.f0 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: syz usb 1-1: Manufacturer: syz usb 1-1: SerialNumber: syz usb 1-1: USB disconnect, device number 22 usb 1-1: new high-speed USB device number 23 using dummy_hcd usb 1-1: Using ep0 maxpacket: 32 usb 1-1: config 2 has an invalid interface number: 240 but max is 0 usb 1-1: config 2 contains an unexpected descriptor of type 0x2, skipping usb 1-1: config 2 has an invalid descriptor of length 138, skipping remainder of the config usb 1-1: config 2 has no interface number 0 usb 1-1: config 2 interface 240 altsetting 57 has 0 endpoint descriptors, different from the interface descriptor's value: 12 usb 1-1: config 2 interface 240 has no altsetting 0 usb 1-1: New USB device found, idVendor=0424, idProduct=cf30, bcdDevice=cf.f0 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: syz usb 1-1: Manufacturer: syz usb 1-1: SerialNumber: syz usb 1-1: USB disconnect, device number 23 usb 1-1: new high-speed USB device number 24 using dummy_hcd usb 1-1: Using ep0 maxpacket: 32 usb 1-1: config 2 has an invalid interface number: 240 but max is 0 usb 1-1: config 2 contains an unexpected descriptor of type 0x2, skipping usb 1-1: config 2 has an invalid descriptor of length 138, skipping remainder of the config usb 1-1: config 2 has no interface number 0 usb 1-1: config 2 interface 240 altsetting 57 has 0 endpoint descriptors, different from the interface descriptor's value: 12 usb 1-1: config 2 interface 240 has no altsetting 0 usb 1-1: New USB device found, idVendor=0424, idProduct=cf30, bcdDevice=cf.f0 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: syz usb 1-1: Manufacturer: syz usb 1-1: SerialNumber: syz usb 1-1: USB disconnect, device number 24 usb 1-1: new high-speed USB device number 25 using dummy_hcd usb 1-1: Using ep0 maxpacket: 32 usb 1-1: config 2 has an invalid interface number: 240 but max is 0 usb 1-1: config 2 contains an unexpected descriptor of type 0x2, skipping usb 1-1: config 2 has an invalid descriptor of length 138, skipping remainder of the config usb 1-1: config 2 has no interface number 0 usb 1-1: config 2 interface 240 altsetting 57 has 0 endpoint descriptors, different from the interface descriptor's value: 12 usb 1-1: config 2 interface 240 has no altsetting 0 usb 1-1: New USB device found, idVendor=0424, idProduct=cf30, bcdDevice=cf.f0 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: syz usb 1-1: Manufacturer: syz usb 1-1: SerialNumber: syz usb 1-1: USB disconnect, device number 25 usb 1-1: new high-speed USB device number 26 using dummy_hcd usb 1-1: Using ep0 maxpacket: 32 usb 1-1: config 2 has an invalid interface number: 240 but max is 0 usb 1-1: config 2 contains an unexpected descriptor of type 0x2, skipping usb 1-1: config 2 has an invalid descriptor of length 138, skipping remainder of the config usb 1-1: config 2 has no interface number 0 usb 1-1: config 2 interface 240 altsetting 57 has 0 endpoint descriptors, different from the interface descriptor's value: 12 usb 1-1: config 2 interface 240 has no altsetting 0 usb 1-1: New USB device found, idVendor=0424, idProduct=cf30, bcdDevice=cf.f0 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: syz usb 1-1: Manufacturer: syz usb 1-1: SerialNumber: syz usb 1-1: USB disconnect, device number 26