./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1996798127

<...>
forked to background, child pid 3176
no interfaces have a carrier
[   28.171980][ T3177] 8021q: adding VLAN 0 to HW filter on device bond0
[   28.185471][ T3177] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK

syzkaller
Warning: Permanently added '10.128.1.15' (ECDSA) to the list of known hosts.
execve("./syz-executor1996798127", ["./syz-executor1996798127"], 0x7fffd6331130 /* 10 vars */) = 0
brk(NULL)                               = 0x5555567d2000
brk(0x5555567d2c40)                     = 0x5555567d2c40
arch_prctl(ARCH_SET_FS, 0x5555567d2300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor1996798127", 4096) = 28
brk(0x5555567f3c40)                     = 0x5555567f3c40
brk(0x5555567f4000)                     = 0x5555567f4000
mprotect(0x7fba85b89000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 3
ioctl(3, USB_RAW_IOCTL_INIT, 0x7fff75912e60) = 0
ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff75912e60) = 0
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff75912e60) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fff75911e50) = 18
syzkaller login: [   51.571724][ T3262] usb 1-1: new high-speed USB device number 2 using dummy_hcd
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff75912e60) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fff75911e50) = 18
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff75912e60) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fff75911e50) = 9
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff75912e60) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fff75911e50) = 72
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff75912e60) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fff75911e50) = 4
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff75912e60) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fff75911e50) = 8
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff75912e60) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fff75911e50) = 8
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff75912e60) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fff75911e50) = 8
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff75912e60) = 0
ioctl(3, USB_RAW_IOCTL_VBUS_DRAW, 0xfa) = 0
ioctl(3, USB_RAW_IOCTL_CONFIGURE, 0)    = 0
ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7fba85b8f3ac) = 9
ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7fba85b8f3bc) = 10
ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7fba85b8f3cc) = 12
ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7fba85b8f3dc) = 11
ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7fba85b8f3ec) = 13
ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7fba85b8f3fc) = 14
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7fff75911e50) = 0
[   52.092332][ T3262] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[   52.101638][ T3262] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   52.109619][ T3262] usb 1-1: Product: syz
[   52.114045][ T3262] usb 1-1: Manufacturer: syz
[   52.118648][ T3262] usb 1-1: SerialNumber: syz
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff75912e60) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7fff75911e50) = 4096
[   52.164489][ T3262] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff75912e60) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7fff75911e50) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff75912e60) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7fff75911e50) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff75912e60) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7fff75911e50) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff75912e60) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7fff75911e50) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff75912e60) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7fff75911e50) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff75912e60) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7fff75911e50) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff75912e60) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7fff75911e50) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff75912e60) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7fff75911e50) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff75912e60) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7fff75911e50) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff75912e60) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7fff75911e50) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff75912e60) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7fff75911e50) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff75912e60) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7fff75911e50) = 1856
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff75912e60) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7fff75911e50) = 0
[   52.741996][ T3262] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
ioctl(3, USB_RAW_IOCTL_EP_WRITE, 0x7fff75912ea0) = 36
ioctl(3, USB_RAW_IOCTL_EP_WRITE, 0x7fff75912ea0) = 36
ioctl(3, USB_RAW_IOCTL_EP_WRITE, 0x7fff75912ea0) = 36
ioctl(3, USB_RAW_IOCTL_EP_WRITE, 0x7fff75912ea0) = 36
ioctl(3, USB_RAW_IOCTL_EP_WRITE, 0x7fff75912ea0) = 36
[   53.821746][ T3262] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive
[   53.828934][ T3262] ath9k_htc: Failed to initialize the device
ioctl(3, USB_RAW_IOCTL_EP_WRITE, 0x7fff75912ea0) = 36
[   53.961686][    C0] ==================================================================
[   53.969765][    C0] BUG: KASAN: use-after-free in ath9k_hif_usb_rx_cb+0xea7/0x10d0
[   53.977484][    C0] Read of size 4 at addr ffff88802198c448 by task swapper/0/0
[   53.984923][    C0] 
[   53.987230][    C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.19.0-rc4-next-20220628-syzkaller #0
[   53.996410][    C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[   54.006448][    C0] Call Trace:
[   54.009713][    C0]  <IRQ>
[   54.012543][    C0]  dump_stack_lvl+0xcd/0x134
[   54.017129][    C0]  print_report.cold+0x2ba/0x719
[   54.022058][    C0]  ? ath9k_hif_usb_rx_cb+0xea7/0x10d0
[   54.027425][    C0]  kasan_report+0xbe/0x1f0
[   54.031874][    C0]  ? ath9k_hif_usb_rx_cb+0xea7/0x10d0
[   54.037233][    C0]  ath9k_hif_usb_rx_cb+0xea7/0x10d0
[   54.042458][    C0]  ? perf_trace_contention_begin+0x360/0x3a0
[   54.048473][    C0]  ? hif_usb_start+0xa0/0xa0
[   54.053055][    C0]  ? rwlock_bug.part.0+0x90/0x90
[   54.058005][    C0]  __usb_hcd_giveback_urb+0x2b0/0x5c0
[   54.063386][    C0]  usb_hcd_giveback_urb+0x367/0x410
[   54.068592][    C0]  dummy_timer+0x11ff/0x32c0
[   54.073211][    C0]  ? dummy_dequeue+0x500/0x500
[   54.077975][    C0]  ? dummy_dequeue+0x500/0x500
[   54.082732][    C0]  call_timer_fn+0x1a0/0x6b0
[   54.087328][    C0]  ? timer_fixup_activate+0x350/0x350
[   54.092701][    C0]  ? lock_downgrade+0x6e0/0x6e0
[   54.097563][    C0]  ? _raw_spin_unlock_irq+0x1f/0x40
[   54.102769][    C0]  ? _raw_spin_unlock_irq+0x1f/0x40
[   54.108002][    C0]  ? dummy_dequeue+0x500/0x500
[   54.112764][    C0]  __run_timers.part.0+0x674/0xa80
[   54.117879][    C0]  ? call_timer_fn+0x6b0/0x6b0
[   54.122641][    C0]  ? set_next_task_stop+0x140/0x140
[   54.127842][    C0]  ? kvm_sched_clock_read+0x14/0x40
[   54.133037][    C0]  ? sched_clock_cpu+0x69/0x2b0
[   54.137885][    C0]  run_timer_softirq+0xb3/0x1d0
[   54.142736][    C0]  __do_softirq+0x29b/0x9c2
[   54.147239][    C0]  __irq_exit_rcu+0x123/0x180
[   54.151913][    C0]  irq_exit_rcu+0x5/0x20
[   54.156154][    C0]  sysvec_apic_timer_interrupt+0x93/0xc0
[   54.161789][    C0]  </IRQ>
[   54.164712][    C0]  <TASK>
[   54.167635][    C0]  asm_sysvec_apic_timer_interrupt+0x1b/0x20
[   54.173617][    C0] RIP: 0010:acpi_idle_do_entry+0x1c9/0x240
[   54.179428][    C0] Code: 89 de e8 9a 7a fe f7 84 db 75 98 e8 01 7e fe f7 e8 ec cc 04 f8 66 90 e8 f5 7d fe f7 0f 00 2d 7e 28 b8 00 e8 e9 7d fe f7 fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 c4 7a fe f7 48 85 db
[   54.199030][    C0] RSP: 0018:ffffffff8ba07d38 EFLAGS: 00000293
[   54.205094][    C0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[   54.213059][    C0] RDX: ffffffff8babc980 RSI: ffffffff897c3927 RDI: 0000000000000000
[   54.221046][    C0] RBP: ffff8881458a1064 R08: 0000000000000001 R09: 0000000000000001
[   54.229010][    C0] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
[   54.236977][    C0] R13: ffff8881458a1000 R14: ffff8881458a1064 R15: ffff888018799004
[   54.244946][    C0]  ? acpi_idle_do_entry+0x1c7/0x240
[   54.250154][    C0]  ? acpi_idle_do_entry+0x1c7/0x240
[   54.255356][    C0]  acpi_idle_enter+0x364/0x500
[   54.260231][    C0]  cpuidle_enter_state+0x1b1/0xc80
[   54.265350][    C0]  cpuidle_enter+0x4a/0xa0
[   54.269767][    C0]  do_idle+0x3e8/0x590
[   54.273839][    C0]  ? arch_cpu_idle_exit+0x30/0x30
[   54.278866][    C0]  cpu_startup_entry+0x14/0x20
[   54.283628][    C0]  rest_init+0x169/0x270
[   54.287875][    C0]  ? trace_init_perf_perm_irq_work_exit+0xe/0xe
[   54.294130][    C0]  arch_call_rest_init+0xf/0x14
[   54.299069][    C0]  start_kernel+0x473/0x494
[   54.303576][    C0]  secondary_startup_64_no_verify+0xce/0xdb
[   54.309482][    C0]  </TASK>
[   54.312491][    C0] 
[   54.314812][    C0] The buggy address belongs to the physical page:
[   54.321211][    C0] page:ffffea0000866300 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2198c
[   54.331355][    C0] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[   54.338464][    C0] raw: 00fff00000000000 0000000000000000 ffffea0000866308 0000000000000000
[   54.347041][    C0] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[   54.355611][    C0] page dumped because: kasan: bad access detected
[   54.362008][    C0] page_owner tracks the page as freed
[   54.367360][    C0] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x40dc0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO), pid 3262, tgid 3262 (kworker/0:3), ts 52753261143, free_ts 53828913231
[   54.385153][    C0]  get_page_from_freelist+0x210d/0x3a30
[   54.390704][    C0]  __alloc_pages+0x1c7/0x510
[   54.395306][    C0]  alloc_pages+0x1aa/0x310
[   54.399720][    C0]  kmalloc_order+0x34/0xf0
[   54.404136][    C0]  kmalloc_order_trace+0x13/0x120
[   54.409161][    C0]  wiphy_new_nm+0x6fc/0x2090
[   54.413750][    C0]  ieee80211_alloc_hw_nm+0x428/0x2330
[   54.419126][    C0]  ath9k_htc_probe_device+0x97/0x1f00
[   54.424502][    C0]  ath9k_htc_hw_init+0x31/0x60
[   54.429266][    C0]  ath9k_hif_usb_firmware_cb+0x274/0x530
[   54.434918][    C0]  request_firmware_work_func+0x12c/0x230
[   54.440642][    C0]  process_one_work+0x991/0x1610
[   54.445593][    C0]  worker_thread+0x665/0x1080
[   54.450274][    C0]  kthread+0x2e9/0x3a0
[   54.454342][    C0]  ret_from_fork+0x1f/0x30
[   54.458763][    C0] page last free stack trace:
[   54.463442][    C0]  free_pcp_prepare+0x5e4/0xd20
[   54.468374][    C0]  free_unref_page+0x19/0x4d0
[   54.473072][    C0]  device_release+0x9f/0x240
[   54.477709][    C0]  kobject_put+0x1be/0x4c0
[   54.482129][    C0]  put_device+0x1b/0x30
[   54.486292][    C0]  ath9k_htc_probe_device+0x1c7/0x1f00
[   54.491767][    C0]  ath9k_htc_hw_init+0x31/0x60
[   54.496536][    C0]  ath9k_hif_usb_firmware_cb+0x274/0x530
[   54.502172][    C0]  request_firmware_work_func+0x12c/0x230
[   54.507902][    C0]  process_one_work+0x991/0x1610
[   54.512865][    C0]  worker_thread+0x665/0x1080
[   54.517559][    C0]  kthread+0x2e9/0x3a0
[   54.521636][    C0]  ret_from_fork+0x1f/0x30
[   54.526060][    C0] 
[   54.528378][    C0] Memory state around the buggy address:
[   54.534085][    C0]  ffff88802198c300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   54.542140][    C0]  ffff88802198c380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   54.550190][    C0] >ffff88802198c400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   54.558240][    C0]                                               ^
[   54.564650][    C0]  ffff88802198c480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   54.572703][    C0]  ffff88802198c500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   54.580755][    C0] ==================================================================
[   54.588807][    C0] Kernel panic - not syncing: panic_on_warn set ...
[   54.595398][    C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.19.0-rc4-next-20220628-syzkaller #0
[   54.604586][    C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[   54.614806][    C0] Call Trace:
[   54.618104][    C0]  <IRQ>
[   54.620973][    C0]  dump_stack_lvl+0xcd/0x134
[   54.625658][    C0]  panic+0x2d7/0x636
[   54.629580][    C0]  ? panic_print_sys_info.part.0+0x10b/0x10b
[   54.635580][    C0]  ? print_report.cold+0x4f6/0x719
[   54.640712][    C0]  ? ath9k_hif_usb_rx_cb+0xea7/0x10d0
[   54.646085][    C0]  end_report.part.0+0x3f/0x7c
[   54.650861][    C0]  kasan_report.cold+0x8/0x12
[   54.655547][    C0]  ? ath9k_hif_usb_rx_cb+0xea7/0x10d0
[   54.660941][    C0]  ath9k_hif_usb_rx_cb+0xea7/0x10d0
[   54.666140][    C0]  ? perf_trace_contention_begin+0x360/0x3a0
[   54.672130][    C0]  ? hif_usb_start+0xa0/0xa0
[   54.676723][    C0]  ? rwlock_bug.part.0+0x90/0x90
[   54.681680][    C0]  __usb_hcd_giveback_urb+0x2b0/0x5c0
[   54.687145][    C0]  usb_hcd_giveback_urb+0x367/0x410
[   54.692353][    C0]  dummy_timer+0x11ff/0x32c0
[   54.696958][    C0]  ? dummy_dequeue+0x500/0x500
[   54.701721][    C0]  ? dummy_dequeue+0x500/0x500
[   54.706479][    C0]  call_timer_fn+0x1a0/0x6b0
[   54.711070][    C0]  ? timer_fixup_activate+0x350/0x350
[   54.716441][    C0]  ? lock_downgrade+0x6e0/0x6e0
[   54.721291][    C0]  ? _raw_spin_unlock_irq+0x1f/0x40
[   54.726498][    C0]  ? _raw_spin_unlock_irq+0x1f/0x40
[   54.731701][    C0]  ? dummy_dequeue+0x500/0x500
[   54.736462][    C0]  __run_timers.part.0+0x674/0xa80
[   54.741757][    C0]  ? call_timer_fn+0x6b0/0x6b0
[   54.746518][    C0]  ? set_next_task_stop+0x140/0x140
[   54.751717][    C0]  ? kvm_sched_clock_read+0x14/0x40
[   54.756932][    C0]  ? sched_clock_cpu+0x69/0x2b0
[   54.761781][    C0]  run_timer_softirq+0xb3/0x1d0
[   54.766631][    C0]  __do_softirq+0x29b/0x9c2
[   54.771155][    C0]  __irq_exit_rcu+0x123/0x180
[   54.775836][    C0]  irq_exit_rcu+0x5/0x20
[   54.780076][    C0]  sysvec_apic_timer_interrupt+0x93/0xc0
[   54.785713][    C0]  </IRQ>
[   54.788634][    C0]  <TASK>
[   54.791559][    C0]  asm_sysvec_apic_timer_interrupt+0x1b/0x20
[   54.797557][    C0] RIP: 0010:acpi_idle_do_entry+0x1c9/0x240
[   54.803370][    C0] Code: 89 de e8 9a 7a fe f7 84 db 75 98 e8 01 7e fe f7 e8 ec cc 04 f8 66 90 e8 f5 7d fe f7 0f 00 2d 7e 28 b8 00 e8 e9 7d fe f7 fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 c4 7a fe f7 48 85 db
[   54.822985][    C0] RSP: 0018:ffffffff8ba07d38 EFLAGS: 00000293
[   54.829064][    C0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[   54.837037][    C0] RDX: ffffffff8babc980 RSI: ffffffff897c3927 RDI: 0000000000000000
[   54.845044][    C0] RBP: ffff8881458a1064 R08: 0000000000000001 R09: 0000000000000001
[   54.853018][    C0] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
[   54.861156][    C0] R13: ffff8881458a1000 R14: ffff8881458a1064 R15: ffff888018799004
[   54.869125][    C0]  ? acpi_idle_do_entry+0x1c7/0x240
[   54.874350][    C0]  ? acpi_idle_do_entry+0x1c7/0x240
[   54.879555][    C0]  acpi_idle_enter+0x364/0x500
[   54.884327][    C0]  cpuidle_enter_state+0x1b1/0xc80
[   54.889451][    C0]  cpuidle_enter+0x4a/0xa0
[   54.893871][    C0]  do_idle+0x3e8/0x590
[   54.897942][    C0]  ? arch_cpu_idle_exit+0x30/0x30
[   54.902968][    C0]  cpu_startup_entry+0x14/0x20
[   54.907750][    C0]  rest_init+0x169/0x270
[   54.913211][    C0]  ? trace_init_perf_perm_irq_work_exit+0xe/0xe
[   54.919453][    C0]  arch_call_rest_init+0xf/0x14
[   54.924309][    C0]  start_kernel+0x473/0x494
[   54.928816][    C0]  secondary_startup_64_no_verify+0xce/0xdb
[   54.934716][    C0]  </TASK>
[   54.937888][    C0] Kernel Offset: disabled
[   54.942204][    C0] Rebooting in 86400 seconds..