[[0;32m OK [0m] Reached target Multi-User System.
[[0;32m OK [0m] Reached target Graphical Interface.
Starting Update UTMP about System Runlevel Changes...
[[0;32m OK [0m] Started Update UTMP about System Runlevel Changes.
Debian GNU/Linux 9 syzkaller ttyS0
syzkaller login: [ 12.758106][ C0] random: crng init done
[ 12.762386][ C0] random: 7 urandom warning(s) missed due to ratelimiting
Warning: Permanently added '10.128.0.225' (ECDSA) to the list of known hosts.
executing program
[ 19.717603][ T168] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[ 20.087389][ T168] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 20.096499][ T168] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 20.104571][ T168] usb 1-1: Product: syz
[ 20.108800][ T168] usb 1-1: Manufacturer: syz
[ 20.113389][ T168] usb 1-1: SerialNumber: syz
[ 20.158443][ T168] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 20.786936][ T168] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[ 21.006852][ C0] ==================================================================
[ 21.015172][ C0] BUG: KASAN: slab-out-of-bounds in ath9k_htc_rx_msg+0xa25/0xaf0
[ 21.022876][ C0] Write of size 2 at addr ffff8881cf367c20 by task swapper/0/0
[ 21.030389][ C0]
[ 21.032716][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.6.0-rc5-syzkaller #0
[ 21.040585][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 21.050630][ C0] Call Trace:
[ 21.053896][ C0]
[ 21.056748][ C0] dump_stack+0xef/0x16e
[ 21.060969][ C0] ? ath9k_htc_rx_msg+0xa25/0xaf0
[ 21.065990][ C0] ? ath9k_htc_rx_msg+0xa25/0xaf0
[ 21.071008][ C0] print_address_description.constprop.0.cold+0xd3/0x314
[ 21.078022][ C0] ? ath9k_htc_rx_msg+0xa25/0xaf0
[ 21.083034][ C0] ? ath9k_htc_rx_msg+0xa25/0xaf0
[ 21.088045][ C0] __kasan_report.cold+0x37/0x77
[ 21.092983][ C0] ? do_raw_spin_lock+0x61/0x290
[ 21.097941][ C0] ? ath9k_htc_rx_msg+0xa25/0xaf0
[ 21.102951][ C0] kasan_report+0xe/0x20
[ 21.107174][ C0] ath9k_htc_rx_msg+0xa25/0xaf0
[ 21.111999][ C0] ath9k_hif_usb_reg_in_cb+0x1ba/0x630
[ 21.117434][ C0] ? trace_hardirqs_off+0x50/0x200
[ 21.122522][ C0] __usb_hcd_giveback_urb+0x29a/0x550
[ 21.127868][ C0] usb_hcd_giveback_urb+0x368/0x420
[ 21.133052][ C0] dummy_timer+0x1258/0x32ae
[ 21.137620][ C0] ? dummy_udc_probe+0x930/0x930
[ 21.142536][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 21.148054][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 21.153314][ C0] call_timer_fn+0x195/0x6f0
[ 21.157936][ C0] ? dummy_udc_probe+0x930/0x930
[ 21.162859][ C0] ? msleep_interruptible+0x130/0x130
[ 21.168218][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 21.173751][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 21.179016][ C0] ? _raw_spin_unlock_irq+0x1f/0x30
[ 21.184201][ C0] ? dummy_udc_probe+0x930/0x930
[ 21.189113][ C0] run_timer_softirq+0x5f9/0x1500
[ 21.194112][ C0] ? add_timer+0x7a0/0x7a0
[ 21.198504][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 21.204031][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 21.209292][ C0] __do_softirq+0x21e/0x950
[ 21.213774][ C0] irq_exit+0x178/0x1a0
[ 21.217909][ C0] smp_apic_timer_interrupt+0x141/0x540
[ 21.223432][ C0] apic_timer_interrupt+0xf/0x20
[ 21.228342][ C0]
[ 21.231259][ C0] RIP: 0010:default_idle+0x28/0x300
[ 21.236443][ C0] Code: cc cc 41 56 41 55 65 44 8b 2d 44 77 72 7a 41 54 55 53 0f 1f 44 00 00 e8 b6 62 b5 fb e9 07 00 00 00 0f 00 2d ea 0c 53 00 fb f4 <65> 44 8b 2d 20 77 72 7a 0f 1f 44 00 00 5b 5d 41 5c 41 5d 41 5e c3
[ 21.256048][ C0] RSP: 0018:ffffffff87007d80 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
[ 21.264445][ C0] RAX: 0000000000000007 RBX: ffffffff8702cc40 RCX: 0000000000000000
[ 21.272396][ C0] RDX: 0000000000000000 RSI: 0000000000000006 RDI: ffffffff8702d48c
[ 21.280345][ C0] RBP: fffffbfff0e05988 R08: ffffffff8702cc40 R09: 0000000000000000
[ 21.288301][ C0] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[ 21.296261][ C0] R13: 0000000000000000 R14: ffffffff87e607c0 R15: 0000000000000000
[ 21.304243][ C0] do_idle+0x3e0/0x500
[ 21.308293][ C0] ? arch_cpu_idle_exit+0x40/0x40
[ 21.313298][ C0] ? schedule+0xe1/0x2b0
[ 21.317518][ C0] cpu_startup_entry+0x14/0x20
[ 21.322262][ C0] start_kernel+0xe16/0xe5a
[ 21.326756][ C0] ? mem_encrypt_init+0x5/0x5
[ 21.331410][ C0] ? x86_family+0x3d/0x50
[ 21.335728][ C0] ? load_ucode_bsp+0x23d/0x27d
[ 21.340575][ C0] secondary_startup_64+0xb6/0xc0
[ 21.345573][ C0]
[ 21.347884][ C0] Allocated by task 168:
[ 21.352106][ C0] save_stack+0x1b/0x80
[ 21.356237][ C0] __kasan_kmalloc.constprop.0+0xbf/0xd0
[ 21.361854][ C0] ath9k_htc_hw_alloc+0x49/0x2e0
[ 21.366774][ C0] ath9k_hif_usb_firmware_cb+0x5f/0x500
[ 21.372298][ C0] request_firmware_work_func+0x126/0x242
[ 21.377997][ C0] process_one_work+0x94b/0x1620
[ 21.382910][ C0] worker_thread+0x96/0xe20
[ 21.387391][ C0] kthread+0x318/0x420
[ 21.391447][ C0] ret_from_fork+0x24/0x30
[ 21.395841][ C0]
[ 21.398149][ C0] Freed by task 0:
[ 21.401840][ C0] (stack is not available)
[ 21.406228][ C0]
[ 21.408539][ C0] The buggy address belongs to the object at ffff8881cf367000
[ 21.408539][ C0] which belongs to the cache kmalloc-2k of size 2048
[ 21.422579][ C0] The buggy address is located 1056 bytes to the right of
[ 21.422579][ C0] 2048-byte region [ffff8881cf367000, ffff8881cf367800)
[ 21.436516][ C0] The buggy address belongs to the page:
[ 21.442141][ C0] page:ffffea00073cd800 refcount:1 mapcount:0 mapping:ffff8881da00c000 index:0x0 compound_mapcount: 0
[ 21.453045][ C0] flags: 0x200000000010200(slab|head)
[ 21.458404][ C0] raw: 0200000000010200 dead000000000100 dead000000000122 ffff8881da00c000
[ 21.466973][ C0] raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
[ 21.475526][ C0] page dumped because: kasan: bad access detected
[ 21.481909][ C0]
[ 21.484222][ C0] Memory state around the buggy address:
[ 21.490796][ C0] ffff8881cf367b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 21.498848][ C0] ffff8881cf367b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 21.506896][ C0] >ffff8881cf367c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 21.514930][ C0] ^
[ 21.520022][ C0] ffff8881cf367c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 21.528067][ C0] ffff8881cf367d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 21.536108][ C0] ==================================================================
[ 21.544140][ C0] Disabling lock debugging due to kernel taint
[ 21.550262][ C0] Kernel panic - not syncing: panic_on_warn set ...
[ 21.556823][ C0] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G B 5.6.0-rc5-syzkaller #0
[ 21.566069][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 21.576103][ C0] Call Trace:
[ 21.579361][ C0]
[ 21.582193][ C0] dump_stack+0xef/0x16e
[ 21.586422][ C0] panic+0x2aa/0x6e1
[ 21.590302][ C0] ? add_taint.cold+0x16/0x16
[ 21.594959][ C0] ? print_shadow_for_address+0xb8/0x114
[ 21.600571][ C0] ? trace_hardirqs_off+0x50/0x200
[ 21.605663][ C0] ? ath9k_htc_rx_msg+0xa25/0xaf0
[ 21.610666][ C0] end_report+0x43/0x49
[ 21.614797][ C0] ? ath9k_htc_rx_msg+0xa25/0xaf0
[ 21.619791][ C0] __kasan_report.cold+0x55/0x77
[ 21.624707][ C0] ? do_raw_spin_lock+0x61/0x290
[ 21.629625][ C0] ? ath9k_htc_rx_msg+0xa25/0xaf0
[ 21.635511][ C0] kasan_report+0xe/0x20
[ 21.639730][ C0] ath9k_htc_rx_msg+0xa25/0xaf0
[ 21.644562][ C0] ath9k_hif_usb_reg_in_cb+0x1ba/0x630
[ 21.650038][ C0] ? trace_hardirqs_off+0x50/0x200
[ 21.655127][ C0] __usb_hcd_giveback_urb+0x29a/0x550
[ 21.660471][ C0] usb_hcd_giveback_urb+0x368/0x420
[ 21.665645][ C0] dummy_timer+0x1258/0x32ae
[ 21.670207][ C0] ? dummy_udc_probe+0x930/0x930
[ 21.675120][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 21.680639][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 21.685896][ C0] call_timer_fn+0x195/0x6f0
[ 21.690470][ C0] ? dummy_udc_probe+0x930/0x930
[ 21.695405][ C0] ? msleep_interruptible+0x130/0x130
[ 21.700761][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 21.706293][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 21.711553][ C0] ? _raw_spin_unlock_irq+0x1f/0x30
[ 21.716730][ C0] ? dummy_udc_probe+0x930/0x930
[ 21.721682][ C0] run_timer_softirq+0x5f9/0x1500
[ 21.726708][ C0] ? add_timer+0x7a0/0x7a0
[ 21.731103][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 21.736625][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 21.741891][ C0] __do_softirq+0x21e/0x950
[ 21.746372][ C0] irq_exit+0x178/0x1a0
[ 21.750508][ C0] smp_apic_timer_interrupt+0x141/0x540
[ 21.756042][ C0] apic_timer_interrupt+0xf/0x20
[ 21.760971][ C0]
[ 21.763888][ C0] RIP: 0010:default_idle+0x28/0x300
[ 21.769060][ C0] Code: cc cc 41 56 41 55 65 44 8b 2d 44 77 72 7a 41 54 55 53 0f 1f 44 00 00 e8 b6 62 b5 fb e9 07 00 00 00 0f 00 2d ea 0c 53 00 fb f4 <65> 44 8b 2d 20 77 72 7a 0f 1f 44 00 00 5b 5d 41 5c 41 5d 41 5e c3
[ 21.788642][ C0] RSP: 0018:ffffffff87007d80 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
[ 21.797031][ C0] RAX: 0000000000000007 RBX: ffffffff8702cc40 RCX: 0000000000000000
[ 21.804985][ C0] RDX: 0000000000000000 RSI: 0000000000000006 RDI: ffffffff8702d48c
[ 21.812965][ C0] RBP: fffffbfff0e05988 R08: ffffffff8702cc40 R09: 0000000000000000
[ 21.820915][ C0] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[ 21.828875][ C0] R13: 0000000000000000 R14: ffffffff87e607c0 R15: 0000000000000000
[ 21.836839][ C0] do_idle+0x3e0/0x500
[ 21.840912][ C0] ? arch_cpu_idle_exit+0x40/0x40
[ 21.845944][ C0] ? schedule+0xe1/0x2b0
[ 21.850194][ C0] cpu_startup_entry+0x14/0x20
[ 21.854939][ C0] start_kernel+0xe16/0xe5a
[ 21.859416][ C0] ? mem_encrypt_init+0x5/0x5
[ 21.864069][ C0] ? x86_family+0x3d/0x50
[ 21.868371][ C0] ? load_ucode_bsp+0x23d/0x27d
[ 21.873194][ C0] secondary_startup_64+0xb6/0xc0
[ 21.878654][ C0] Kernel Offset: disabled
[ 21.882970][ C0] Rebooting in 86400 seconds..