[ 47.043191] audit: type=1800 audit(1555042953.946:27): pid=5347 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2469 res=0 [ 47.063244] audit: type=1800 audit(1555042953.946:28): pid=5347 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="ssh" dev="sda1" ino=2450 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [ 47.757078] audit: type=1800 audit(1555042954.686:29): pid=5347 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2465 res=0 [ 47.776667] audit: type=1800 audit(1555042954.686:30): pid=5347 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2456 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.37' (ECDSA) to the list of known hosts. syzkaller login: [ 55.447623] IPVS: ftp: loaded support on port[0] = 21 [ 55.522237] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.528777] bridge0: port 1(bridge_slave_0) entered disabled state [ 55.535977] device bridge_slave_0 entered promiscuous mode [ 55.543186] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.549527] bridge0: port 2(bridge_slave_1) entered disabled state [ 55.556800] device bridge_slave_1 entered promiscuous mode [ 55.570977] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 55.579704] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 55.595508] team0: Port device team_slave_0 added [ 55.601350] team0: Port device team_slave_1 added [ 55.625341] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.631780] bridge0: port 2(bridge_slave_1) entered forwarding state [ 55.638818] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.645175] bridge0: port 1(bridge_slave_0) entered forwarding state [ 55.672613] 8021q: adding VLAN 0 to HW filter on device bond0 [ 55.683934] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 55.693470] bridge0: port 1(bridge_slave_0) entered disabled state [ 55.700755] bridge0: port 2(bridge_slave_1) entered disabled state [ 55.708782] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 55.720251] 8021q: adding VLAN 0 to HW filter on device team0 [ 55.729364] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 55.737980] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.744377] bridge0: port 1(bridge_slave_0) entered forwarding state [ 55.763276] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 55.771197] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.777623] bridge0: port 2(bridge_slave_1) entered forwarding state [ 55.785448] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 55.793605] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 55.801472] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 55.810164] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 55.819755] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready executing program [ 55.873549] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 56.183481] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 56.452734] usb 1-1: Using ep0 maxpacket: 8 [ 56.573274] usb 1-1: config index 0 descriptor too short (expected 588, got 236) [ 56.581197] usb 1-1: config 0 has an invalid interface number: 27 but max is 0 [ 56.589621] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 56.599125] usb 1-1: config 0 has no interface number 0 [ 56.604908] usb 1-1: New USB device found, idVendor=9022, idProduct=d421, bcdDevice=b7.eb [ 56.613907] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 56.627463] usb 1-1: config 0 descriptor?? [ 56.665499] dw2102: su3000_identify_state [ 56.669929] dvb-usb: found a 'TeVii S421 PCI' in warm state. [ 56.676320] dw2102: su3000_power_ctrl: 1, initialized 0 [ 56.682177] dvb-usb: bulk message failed: -22 (2/-1471295048) [ 56.697989] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 56.723492] dvbdev: DVB: registering new adapter (TeVii S421 PCI) [ 56.730351] dvb-usb: bulk message failed: -22 (6/-1861366664) [ 56.736500] dw2102: i2c transfer failed. [ 56.740927] dvb-usb: bulk message failed: -22 (6/-1861366664) [ 56.747069] dw2102: i2c transfer failed. [ 56.751239] dvb-usb: bulk message failed: -22 (6/-1861366664) [ 56.757318] dw2102: i2c transfer failed. [ 56.761463] dvb-usb: bulk message failed: -22 (6/-1861366664) [ 56.771681] dw2102: i2c transfer failed. [ 56.775962] dvb-usb: bulk message failed: -22 (6/-1861366664) [ 56.781934] dw2102: i2c transfer failed. [ 56.786064] dvb-usb: bulk message failed: -22 (6/-1861366664) [ 56.791953] dw2102: i2c transfer failed. [ 56.796107] dvb-usb: MAC address: 02:02:02:02:02:02 [ 56.805919] dvb-usb: bulk message failed: -22 (1/2) [ 56.810991] dw2102: command 0x51 transfer failed. [ 56.818574] dvb-usb: bulk message failed: -22 (5/-1861366664) [ 56.824671] dw2102: i2c transfer failed. [ 56.828903] dvb-usb: bulk message failed: -22 (5/-1861366664) [ 56.834861] dw2102: i2c transfer failed. [ 56.838980] dvb-usb: bulk message failed: -22 (5/-1861366664) [ 56.845019] dw2102: i2c transfer failed. [ 56.849454] dvb-usb: bulk message failed: -22 (5/-1861366664) [ 56.855463] dw2102: i2c transfer failed. [ 56.859647] dvb-usb: bulk message failed: -22 (5/-1861366664) [ 56.865588] dw2102: i2c transfer failed. [ 56.869701] dvb-usb: bulk message failed: -22 (5/-1861366664) [ 56.875649] dw2102: i2c transfer failed. [ 56.922780] dvb-usb: bulk message failed: -22 (5/-1861366664) [ 56.928799] dw2102: i2c transfer failed. [ 56.932991] dvb-usb: bulk message failed: -22 (5/-1861366664) [ 56.938879] dw2102: i2c transfer failed. [ 56.943196] dvb-usb: bulk message failed: -22 (5/-1861366664) [ 56.949190] dw2102: i2c transfer failed. [ 56.953634] dvb-usb: bulk message failed: -22 (5/-1861366664) [ 56.959522] dw2102: i2c transfer failed. [ 56.963845] dvb-usb: bulk message failed: -22 (5/-1861366664) [ 56.969733] dw2102: i2c transfer failed. [ 56.973876] dvb-usb: bulk message failed: -22 (5/-1861366664) [ 56.979932] dw2102: i2c transfer failed. [ 56.984098] ts2020 0-0060: Montage Technology TS2020 successfully identified [ 56.992392] dw2102: Attached RS2000/TS2020! [ 56.997133] usb 1-1: DVB: registering adapter 0 frontend 0 (M88RS2000 DVB-S)... [ 57.043157] Registered IR keymap rc-su3000 [ 57.051832] rc rc1: TeVii S421 PCI as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc1 [ 57.072866] input: TeVii S421 PCI as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc1/input10 [ 57.086060] rc rc1: lirc_dev: driver dw2102 registered at minor = 1, scancode receiver, no transmitter [ 57.095853] dvb-usb: schedule remote query interval to 150 msecs. [ 57.102106] dw2102: su3000_power_ctrl: 0, initialized 1 [ 57.107561] dvb-usb: TeVii S421 PCI successfully initialized and connected. [ 57.116788] usb 1-1: USB disconnect, device number 2 [ 57.123391] ================================================================== [ 57.130953] BUG: KASAN: use-after-free in dvb_usb_device_exit+0xbb/0xd0 [ 57.137699] Read of size 8 at addr ffff88809ec693d8 by task kworker/1:1/21 [ 57.144693] [ 57.146311] CPU: 1 PID: 21 Comm: kworker/1:1 Not tainted 5.1.0-rc4-319354-g9a33b36 #3 [ 57.154303] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 57.163671] Workqueue: usb_hub_wq hub_event [ 57.167989] Call Trace: [ 57.170568] dump_stack+0xe8/0x16e [ 57.174097] ? dvb_usb_device_exit+0xbb/0xd0 [ 57.178514] ? dvb_usb_device_exit+0xbb/0xd0 [ 57.182927] print_address_description+0x6c/0x236 [ 57.187788] ? dvb_usb_device_exit+0xbb/0xd0 [ 57.192203] ? dvb_usb_device_exit+0xbb/0xd0 [ 57.196642] kasan_report.cold+0x1a/0x3c [ 57.200721] ? usb_disable_endpoint+0x1e0/0x1f0 [ 57.205392] ? dvb_usb_device_exit+0xbb/0xd0 [ 57.209799] dvb_usb_device_exit+0xbb/0xd0 [ 57.214037] usb_unbind_interface+0x1c9/0x980 [ 57.218553] ? usb_autoresume_device+0x60/0x60 [ 57.223247] device_release_driver_internal+0x436/0x4f0 [ 57.228633] bus_remove_device+0x302/0x5c0 [ 57.232884] device_del+0x467/0xb90 [ 57.236512] ? mark_held_locks+0x9f/0xe0 [ 57.240572] ? __device_links_no_driver+0x240/0x240 [ 57.245935] ? lockdep_hardirqs_on+0x37e/0x580 [ 57.250512] ? remove_intf_ep_devs+0x144/0x1d0 [ 57.255089] usb_disable_device+0x242/0x790 [ 57.259405] usb_disconnect+0x298/0x870 [ 57.263371] hub_event+0xcd2/0x3b00 [ 57.267284] ? mark_held_locks+0xe0/0xe0 [ 57.271350] ? hub_port_debounce+0x350/0x350 [ 57.275763] ? _raw_spin_unlock_irq+0x29/0x40 [ 57.280257] process_one_work+0x90f/0x1580 [ 57.284492] ? wq_pool_ids_show+0x300/0x300 [ 57.288837] ? do_raw_spin_lock+0x11f/0x290 [ 57.293361] worker_thread+0x7b0/0xe20 [ 57.297284] ? process_one_work+0x1580/0x1580 [ 57.301778] kthread+0x313/0x420 [ 57.305132] ? kthread_park+0x1a0/0x1a0 [ 57.309104] ret_from_fork+0x3a/0x50 [ 57.312819] [ 57.314451] Allocated by task 21: [ 57.325550] __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 57.330480] __kmalloc_track_caller+0xf0/0x2c0 [ 57.335056] kmemdup+0x23/0x50 [ 57.338255] dw2102_probe+0x62c/0xc50 [ 57.342040] usb_probe_interface+0x31d/0x820 [ 57.346431] really_probe+0x2da/0xb10 [ 57.350309] driver_probe_device+0x21d/0x350 [ 57.354701] __device_attach_driver+0x1d8/0x290 [ 57.359372] bus_for_each_drv+0x163/0x1e0 [ 57.363502] __device_attach+0x223/0x3a0 [ 57.368750] bus_probe_device+0x1f1/0x2a0 [ 57.373071] device_add+0xad2/0x16e0 [ 57.376778] usb_set_configuration+0xdf7/0x1740 [ 57.381444] generic_probe+0xa2/0xda [ 57.385237] usb_probe_device+0xc0/0x150 [ 57.389285] really_probe+0x2da/0xb10 [ 57.393098] driver_probe_device+0x21d/0x350 [ 57.397510] __device_attach_driver+0x1d8/0x290 [ 57.402164] bus_for_each_drv+0x163/0x1e0 [ 57.406403] __device_attach+0x223/0x3a0 [ 57.410472] bus_probe_device+0x1f1/0x2a0 [ 57.414626] device_add+0xad2/0x16e0 [ 57.418332] usb_new_device.cold+0x537/0xccf [ 57.422725] hub_event+0x138e/0x3b00 [ 57.426429] process_one_work+0x90f/0x1580 [ 57.430671] worker_thread+0x9b/0xe20 [ 57.434484] kthread+0x313/0x420 [ 57.437857] ret_from_fork+0x3a/0x50 [ 57.441551] [ 57.443177] Freed by task 21: [ 57.446273] __kasan_slab_free+0x130/0x180 [ 57.450518] slab_free_freelist_hook+0x5e/0x140 [ 57.455179] kfree+0xce/0x290 [ 57.458297] dw2102_probe+0x876/0xc50 [ 57.462091] usb_probe_interface+0x31d/0x820 [ 57.466609] really_probe+0x2da/0xb10 [ 57.470402] driver_probe_device+0x21d/0x350 [ 57.475424] __device_attach_driver+0x1d8/0x290 [ 57.488203] bus_for_each_drv+0x163/0x1e0 [ 57.499668] __device_attach+0x223/0x3a0 [ 57.503739] bus_probe_device+0x1f1/0x2a0 [ 57.508258] device_add+0xad2/0x16e0 [ 57.511964] usb_set_configuration+0xdf7/0x1740 [ 57.516628] generic_probe+0xa2/0xda [ 57.520332] usb_probe_device+0xc0/0x150 [ 57.524385] really_probe+0x2da/0xb10 [ 57.528172] driver_probe_device+0x21d/0x350 [ 57.532601] __device_attach_driver+0x1d8/0x290 [ 57.537626] bus_for_each_drv+0x163/0x1e0 [ 57.541766] __device_attach+0x223/0x3a0 [ 57.545823] bus_probe_device+0x1f1/0x2a0 [ 57.549970] device_add+0xad2/0x16e0 [ 57.553694] usb_new_device.cold+0x537/0xccf [ 57.558100] hub_event+0x138e/0x3b00 [ 57.561811] process_one_work+0x90f/0x1580 [ 57.566277] worker_thread+0x9b/0xe20 [ 57.570075] kthread+0x313/0x420 [ 57.573454] ret_from_fork+0x3a/0x50 [ 57.577182] [ 57.578822] The buggy address belongs to the object at ffff88809ec69100 [ 57.578822] which belongs to the cache kmalloc-4k of size 4096 [ 57.591482] The buggy address is located 728 bytes inside of [ 57.591482] 4096-byte region [ffff88809ec69100, ffff88809ec6a100) [ 57.603451] The buggy address belongs to the page: [ 57.608384] page:ffffea00027b1a00 count:1 mapcount:0 mapping:ffff88812c3f4600 index:0x0 compound_mapcount: 0 [ 57.618354] flags: 0xfff00000010200(slab|head) [ 57.622956] raw: 00fff00000010200 dead000000000100 dead000000000200 ffff88812c3f4600 [ 57.630844] raw: 0000000000000000 0000000000070007 00000001ffffffff 0000000000000000 [ 57.638727] page dumped because: kasan: bad access detected [ 57.644434] [ 57.646050] Memory state around the buggy address: [ 57.651001] ffff88809ec69280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 57.658365] ffff88809ec69300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 57.665728] >ffff88809ec69380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 57.673098] ^ [ 57.679434] ffff88809ec69400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 57.686953] ffff88809ec69480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 57.694302] ================================================================== [ 57.701658] Disabling lock debugging due to kernel taint [ 57.707524] Kernel panic - not syncing: panic_on_warn set ... [ 57.713433] CPU: 1 PID: 21 Comm: kworker/1:1 Tainted: G B 5.1.0-rc4-319354-g9a33b36 #3 [ 57.722791] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 57.732171] Workqueue: usb_hub_wq hub_event [ 57.736503] Call Trace: [ 57.739090] dump_stack+0xe8/0x16e [ 57.742637] panic+0x29d/0x5f2 [ 57.745849] ? __warn_printk+0xf8/0xf8 [ 57.749730] ? dvb_usb_device_exit+0xbb/0xd0 [ 57.754136] ? trace_hardirqs_on+0x55/0x1c0 [ 57.758542] ? dvb_usb_device_exit+0xbb/0xd0 [ 57.763030] end_report+0x48/0x4e [ 57.766476] ? dvb_usb_device_exit+0xbb/0xd0 [ 57.770892] kasan_report.cold+0xd/0x3c [ 57.774860] ? usb_disable_endpoint+0x1e0/0x1f0 [ 57.779530] ? dvb_usb_device_exit+0xbb/0xd0 [ 57.783934] dvb_usb_device_exit+0xbb/0xd0 [ 57.788163] usb_unbind_interface+0x1c9/0x980 [ 57.792694] ? usb_autoresume_device+0x60/0x60 [ 57.797285] device_release_driver_internal+0x436/0x4f0 [ 57.802677] bus_remove_device+0x302/0x5c0 [ 57.806918] device_del+0x467/0xb90 [ 57.810535] ? mark_held_locks+0x9f/0xe0 [ 57.814601] ? __device_links_no_driver+0x240/0x240 [ 57.819626] ? lockdep_hardirqs_on+0x37e/0x580 [ 57.824201] ? remove_intf_ep_devs+0x144/0x1d0 [ 57.828781] usb_disable_device+0x242/0x790 [ 57.833107] usb_disconnect+0x298/0x870 [ 57.837080] hub_event+0xcd2/0x3b00 [ 57.840699] ? mark_held_locks+0xe0/0xe0 [ 57.844761] ? hub_port_debounce+0x350/0x350 [ 57.849184] ? _raw_spin_unlock_irq+0x29/0x40 [ 57.853680] process_one_work+0x90f/0x1580 [ 57.857946] ? wq_pool_ids_show+0x300/0x300 [ 57.862269] ? do_raw_spin_lock+0x11f/0x290 [ 57.866592] worker_thread+0x7b0/0xe20 [ 57.870481] ? process_one_work+0x1580/0x1580 [ 57.874969] kthread+0x313/0x420 [ 57.878331] ? kthread_park+0x1a0/0x1a0 [ 57.882301] ret_from_fork+0x3a/0x50 [ 57.887002] Kernel Offset: disabled [ 57.890635] Rebooting in 86400 seconds..