Warning: Permanently added '10.128.15.214' (ECDSA) to the list of known hosts.
executing program
[   22.040326][  T142] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[   22.559800][  T142] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[   22.568893][  T142] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   22.577512][  T142] usb 1-1: Product: syz
[   22.581752][  T142] usb 1-1: Manufacturer: syz
[   22.586324][  T142] usb 1-1: SerialNumber: syz
[   22.630591][  T142] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[   23.199175][  T142] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[   23.418930][    C1] ==================================================================
[   23.427073][    C1] BUG: KASAN: use-after-free in ath9k_htc_rx_msg+0xa25/0xaf0
[   23.434425][    C1] Write of size 2 at addr ffff8881cd2804b0 by task swapper/1/0
[   23.441933][    C1] 
[   23.444246][    C1] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.7.0-rc6-syzkaller #0
[   23.452107][    C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   23.462144][    C1] Call Trace:
[   23.465399][    C1]  <IRQ>
[   23.468228][    C1]  dump_stack+0xef/0x16e
[   23.472445][    C1]  print_address_description.constprop.0.cold+0xd3/0x415
[   23.479437][    C1]  ? vprintk_func+0x7d/0x113
[   23.484042][    C1]  ? ath9k_htc_rx_msg+0xa25/0xaf0
[   23.489125][    C1]  __kasan_report.cold+0x37/0x7d
[   23.494035][    C1]  ? ath9k_htc_rx_msg+0xa25/0xaf0
[   23.499031][    C1]  ? ath9k_htc_rx_msg+0xa25/0xaf0
[   23.504026][    C1]  kasan_report+0x33/0x50
[   23.508327][    C1]  ath9k_htc_rx_msg+0xa25/0xaf0
[   23.513149][    C1]  ath9k_hif_usb_reg_in_cb+0x1c0/0x630
[   23.518586][    C1]  ? trace_hardirqs_off+0x50/0x200
[   23.523667][    C1]  __usb_hcd_giveback_urb+0x29a/0x550
[   23.529011][    C1]  usb_hcd_giveback_urb+0x368/0x420
[   23.534204][    C1]  dummy_timer+0x125e/0x32b4
[   23.538766][    C1]  ? dummy_udc_probe+0x980/0x980
[   23.543675][    C1]  ? rcu_read_lock_sched_held+0x9c/0xd0
[   23.549192][    C1]  ? rcu_read_lock_bh_held+0xb0/0xb0
[   23.554449][    C1]  call_timer_fn+0x1ac/0x700
[   23.559013][    C1]  ? dummy_udc_probe+0x980/0x980
[   23.563922][    C1]  ? timer_fixup_init+0x60/0x60
[   23.5687