ci-upstream-linux-next-kasan-gce-root/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci-upstream-linux-next-kasan-gce-root/syz-executor273385491 <...> Warning: Permanently added '10.128.1.97' (ED25519) to the list of known hosts. execve("ci-upstream-linux-next-kasan-gce-root/syz-executor273385491", ["ci-upstream-linux-next-kasan-gce-root/syz-executor273385491"], 0x7ffe6c175290 /* 10 vars */) = 0 brk(NULL) = 0x555581693000 brk(0x555581693d80) = 0x555581693d80 arch_prctl(ARCH_SET_FS, 0x555581693400) = 0 set_tid_address(0x5555816936d0) = 5626 set_robust_list(0x5555816936e0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci-upstream-linux-next-kasan-gce-root/syz-executor273385491", 4096) = 65 getrandom("\xce\xcb\xbc\x96\x38\x95\xcc\xfe", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555581693d80 brk(0x5555816b4d80) = 0x5555816b4d80 brk(0x5555816b5000) = 0x5555816b5000 mprotect(0x7fc3b3e05000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 getrandom("\x4c\x90\x5f\x5c\x21\x48\xa9\x44", 8, GRND_NONBLOCK) = 8 mkdir("./syzkaller.4WjEY1", 0700) = 0 chmod("./syzkaller.4WjEY1", 0777) = 0 chdir("./syzkaller.4WjEY1") = 0 mkdir("./0", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-linux-next-kasan-gce-root/strace-static-x86_64: Process 5627 attached , child_tidptr=0x5555816936d0) = 5627 [pid 5626] rt_sigprocmask(SIG_SETMASK, [] [pid 5627] set_robust_list(0x5555816936e0, 24 [pid 5626] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5627] <... set_robust_list resumed>) = 0 [pid 5627] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5627] chdir("./0") = 0 [pid 5627] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5627] setpgid(0, 0) = 0 [pid 5627] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5627] write(3, "1000", 4) = 4 [pid 5627] close(3) = 0 [pid 5627] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5627] write(1, "executing program\n", 18) = 18 executing program [pid 5627] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 5627] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 5627] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 5627] mkdirat(AT_FDCWD, "./config/usb_gadget/g1/functions/uac1.usb0", 0777) = 0 [pid 5627] mkdirat(AT_FDCWD, "./config/usb_gadget/g1/configs/c.1", 0776) = 0 [pid 5627] symlinkat("./config/usb_gadget/g1/functions/uac1.usb0", AT_FDCWD, "./config/usb_gadget/g1/configs/c.1/uac1.usb0") = 0 [pid 5627] sched_setaffinity(0, 0, NULL) = -1 EINVAL (Invalid argument) [pid 5627] openat(AT_FDCWD, "./config/usb_gadget/g1/UDC", O_WRONLY) = 3 [ 86.770353][ T5627] ================================================================== [ 86.770366][ T5627] BUG: KASAN: global-out-of-bounds in usb_copy_descriptors+0x1b8/0x320 [ 86.770398][ T5627] Read of size 128 at addr ffffffff9ad9cd80 by task syz-executor273/5627 [ 86.770410][ ** replaying previous printk message ** [ 86.770410][ T5627] [ 86.770429][ T5627] CPU: 1 UID: 0 PID: 5627 Comm: syz-executor273 Not tainted syzkaller #0 PREEMPT(full) [ 86.770450][ T5627] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 86.770466][ T5627] Call Trace: [ 86.770471][ T5627] [ 86.770480][ T5627] dump_stack_lvl+0xe8/0x150 [ 86.770495][ T5627] print_address_description+0x55/0x1e0 [ 86.770510][ T5627] ? usb_copy_descriptors+0x1b8/0x320 [ 86.770523][ T5627] print_report+0x58/0x70 [ 86.770535][ T5627] kasan_report+0x117/0x150 [ 86.770549][ T5627] ? usb_copy_descriptors+0x1b8/0x320 [ 86.770566][ T5627] kasan_check_range+0x264/0x2c0 [ 86.770578][ T5627] ? usb_copy_descriptors+0x1b8/0x320 [ 86.770594][ T5627] __asan_memcpy+0x29/0x70 [ 86.770607][ T5627] usb_copy_descriptors+0x1b8/0x320 [ 86.770623][ T5627] usb_assign_descriptors+0xcf/0x290 [ 86.770638][ T5627] f_audio_bind+0x1b5e/0x34b0 [ 86.770657][ T5627] usb_add_function+0x2e1/0x9f0 [ 86.770670][ T5627] ? check_remote_wakeup_config+0x58/0x1c0 [ 86.770685][ T5627] configfs_composite_bind+0xde0/0x1410 [ 86.770703][ T5627] ? __pfx_configfs_composite_bind+0x10/0x10 [ 86.770717][ T5627] gadget_bind_driver+0x2ca/0x9e0 [ 86.770734][ T5627] ? __pfx_gadget_bind_driver+0x10/0x10 [ 86.770746][ T5627] really_probe+0x254/0xae0 [ 86.770764][ T5627] __driver_probe_device+0x1e8/0x360 [ 86.770779][ T5627] driver_probe_device+0x4f/0x240 [ 86.770792][ T5627] __driver_attach+0x339/0x600 [ 86.770806][ T5627] bus_for_each_dev+0x23b/0x2c0 [ 86.770819][ T5627] ? __pfx___driver_attach+0x10/0x10 [ 86.770832][ T5627] ? __pfx_bus_for_each_dev+0x10/0x10 [ 86.770846][ T5627] ? do_raw_spin_unlock+0xf5/0x200 [ 86.770862][ T5627] bus_add_driver+0x38f/0x6e0 [ 86.770878][ T5627] driver_register+0x23a/0x320 [ 86.770891][ T5627] usb_gadget_register_driver_owner+0xf9/0x270 [ 86.770907][ T5627] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 86.770920][ T5627] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10 [ 86.770935][ T5627] configfs_write_iter+0x337/0x430 [ 86.770949][ T5627] vfs_write+0x612/0xba0 [ 86.770965][ T5627] ? __pfx_vfs_write+0x10/0x10 [ 86.770982][ T5627] ? fdget+0x16b/0x250 [ 86.770996][ T5627] ksys_write+0x150/0x270 [ 86.771009][ T5627] ? __pfx_ksys_write+0x10/0x10 [ 86.771025][ T5627] do_syscall_64+0x166/0x520 [ 86.771037][ T5627] ? trace_irq_disable+0x3b/0x140 [ 86.771068][ T5627] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.771082][ T5627] ? clear_bhb_loop+0x70/0xc0 [ 86.771108][ T5627] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.771148][ T5627] RIP: 0033:0x7fc3b3d71df9 [ 86.771172][ T5627] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 86.771189][ T5627] RSP: 002b:00007fff154ebbf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 86.771218][ T5627] RAX: ffffffffffffffda RBX: 0000200000000400 RCX: 00007fc3b3d71df9 [ 86.771230][ T5627] RDX: 000000000000000c RSI: 0000200000000480 RDI: 0000000000000003 [ 86.771240][ T5627] RBP: 0000200000000000 R08: 0000555581694060 R09: 0000555581694060 [ 86.771250][ T5627] R10: 0000555581694060 R11: 0000000000000246 R12: 00007fff154ebef8 [ 86.771261][ T5627] R13: 0000000000000002 R14: 00007fff154ebc30 R15: 0000200000000008 [ 86.771278][ T5627] [ 86.771283][ T5627] [ 86.771286][ T5627] The buggy address belongs to the variable: [ 86.771291][ T5627] ac_header_desc+0x0/0x20 [ 86.771307][ T5627] [ 86.771311][ T5627] The buggy address belongs to the physical page: [ 86.771326][ T5627] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1ad9c [ 86.771339][ T5627] flags: 0xfff00000002000(reserved|node=0|zone=1|lastcpupid=0x7ff) [ 86.771366][ T5627] raw: 00fff00000002000 ffffea00006b6708 ffffea00006b6708 0000000000000000 [ 86.771379][ T5627] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 86.771387][ T5627] page dumped because: kasan: bad access detected [ 86.771397][ T5627] page_owner info is not present (never set?) [ 86.771402][ T5627] [ 86.771405][ T5627] Memory state around the buggy address: [ 86.771413][ T5627] ffffffff9ad9cc80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 86.771423][ T5627] ffffffff9ad9cd00: 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 [ 86.771433][ T5627] >ffffffff9ad9cd80: 00 f9 f9 f9 00 f9 f9 f9 00 f9 f9 f9 00 00 f9 f9 [ 86.771440][ T5627] ^ [ 86.771448][ T5627] ffffffff9ad9ce00: 00 00 f9 f9 00 00 f9 f9 00 00 f9 f9 00 00 00 00 [ 86.771458][ T5627] ffffffff9ad9ce80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 86.771465][ T5627] ================================================================== [ 86.797446][ T5627] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 87.253582][ T5627] CPU: 0 UID: 0 PID: 5627 Comm: syz-executor273 Not tainted syzkaller #0 PREEMPT(full) [ 87.263296][ T5627] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 87.273345][ T5627] Call Trace: [ 87.276708][ T5627] [ 87.279661][ T5627] vpanic+0x26f/0x710 [ 87.283649][ T5627] panic+0xc5/0xd0 [ 87.287366][ T5627] ? __pfx_panic+0x10/0x10 [ 87.291780][ T5627] ? preempt_schedule_thunk+0x16/0x40 [ 87.297148][ T5627] ? usb_copy_descriptors+0x1b8/0x320 [ 87.302516][ T5627] ? preempt_schedule_thunk+0x16/0x40 [ 87.307888][ T5627] ? usb_copy_descriptors+0x1b8/0x320 [ 87.313261][ T5627] check_panic_on_warn+0x89/0xb0 [ 87.318196][ T5627] ? usb_copy_descriptors+0x1b8/0x320 [ 87.323568][ T5627] end_report+0x73/0x170 [ 87.327806][ T5627] ? usb_copy_descriptors+0x1b8/0x320 [ 87.333174][ T5627] kasan_report+0x128/0x150 [ 87.337691][ T5627] ? usb_copy_descriptors+0x1b8/0x320 [ 87.343066][ T5627] kasan_check_range+0x264/0x2c0 [ 87.348002][ T5627] ? usb_copy_descriptors+0x1b8/0x320 [ 87.353371][ T5627] __asan_memcpy+0x29/0x70 [ 87.357787][ T5627] usb_copy_descriptors+0x1b8/0x320 [ 87.362998][ T5627] usb_assign_descriptors+0xcf/0x290 [ 87.368278][ T5627] f_audio_bind+0x1b5e/0x34b0 [ 87.372958][ T5627] usb_add_function+0x2e1/0x9f0 [ 87.377802][ T5627] ? check_remote_wakeup_config+0x58/0x1c0 [ 87.383611][ T5627] configfs_composite_bind+0xde0/0x1410 [ 87.389161][ T5627] ? __pfx_configfs_composite_bind+0x10/0x10 [ 87.395134][ T5627] gadget_bind_driver+0x2ca/0x9e0 [ 87.400166][ T5627] ? __pfx_gadget_bind_driver+0x10/0x10 [ 87.405709][ T5627] really_probe+0x254/0xae0 [ 87.410213][ T5627] __driver_probe_device+0x1e8/0x360 [ 87.415512][ T5627] driver_probe_device+0x4f/0x240 [ 87.420543][ T5627] __driver_attach+0x339/0x600 [ 87.425323][ T5627] bus_for_each_dev+0x23b/0x2c0 [ 87.430188][ T5627] ? __pfx___driver_attach+0x10/0x10 [ 87.435474][ T5627] ? __pfx_bus_for_each_dev+0x10/0x10 [ 87.440850][ T5627] ? do_raw_spin_unlock+0xf5/0x200 [ 87.445959][ T5627] bus_add_driver+0x38f/0x6e0 [ 87.450635][ T5627] driver_register+0x23a/0x320 [ 87.455401][ T5627] usb_gadget_register_driver_owner+0xf9/0x270 [ 87.461555][ T5627] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 87.467186][ T5627] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10 [ 87.473342][ T5627] configfs_write_iter+0x337/0x430 [ 87.478542][ T5627] vfs_write+0x612/0xba0 [ 87.482795][ T5627] ? __pfx_vfs_write+0x10/0x10 [ 87.487561][ T5627] ? fdget+0x16b/0x250 [ 87.491627][ T5627] ksys_write+0x150/0x270 [ 87.495973][ T5627] ? __pfx_ksys_write+0x10/0x10 [ 87.500830][ T5627] do_syscall_64+0x166/0x520 [ 87.505422][ T5627] ? trace_irq_disable+0x3b/0x140 [ 87.510444][ T5627] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.516527][ T5627] ? clear_bhb_loop+0x70/0xc0 [ 87.521203][ T5627] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.527106][ T5627] RIP: 0033:0x7fc3b3d71df9 [ 87.531523][ T5627] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 87.551211][ T5627] RSP: 002b:00007fff154ebbf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 87.559634][ T5627] RAX: ffffffffffffffda RBX: 0000200000000400 RCX: 00007fc3b3d71df9 [ 87.567602][ T5627] RDX: 000000000000000c RSI: 0000200000000480 RDI: 0000000000000003 [ 87.575654][ T5627] RBP: 0000200000000000 R08: 0000555581694060 R09: 0000555581694060 [ 87.583621][ T5627] R10: 0000555581694060 R11: 0000000000000246 R12: 00007fff154ebef8 [ 87.591587][ T5627] R13: 0000000000000002 R14: 00007fff154ebc30 R15: 0000200000000008 [ 87.599570][ T5627] [ 87.602804][ T5627] Kernel Offset: disabled [ 87.607156][ T5627] Rebooting in 86400 seconds..