Warning: Permanently added '10.128.0.55' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 31.292577][ T5] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 31.572118][ T5] usb 1-1: too many configurations: 82, using maximum allowed: 8 [ 32.411561][ T5] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 32.420643][ T5] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.428708][ T5] usb 1-1: Product: syz [ 32.432926][ T5] usb 1-1: Manufacturer: syz [ 32.437517][ T5] usb 1-1: SerialNumber: syz [ 32.482605][ T5] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 33.071284][ T5] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 33.491067][ C0] ================================================================== [ 33.499221][ C0] BUG: KASAN: use-after-free in ath9k_hif_usb_rx_cb+0x3a8/0xf80 [ 33.506849][ C0] Read of size 48828 at addr ffff8881ccda8000 by task swapper/0/0 [ 33.514632][ C0] [ 33.516952][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.9.0-rc8-syzkaller #0 [ 33.524816][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 33.534858][ C0] Call Trace: [ 33.538126][ C0] [ 33.540963][ C0] dump_stack+0x107/0x16e [ 33.545287][ C0] ? ath9k_hif_usb_rx_cb+0x3a8/0xf80 [ 33.550551][ C0] ? ath9k_hif_usb_rx_cb+0x3a8/0xf80 [ 33.555841][ C0] print_address_description.constprop.0+0x1c/0x210 [ 33.562418][ C0] ? ath9k_hif_usb_rx_cb+0x23e/0xf80 [ 33.567685][ C0] ? vprintk_func+0x93/0x133 [ 33.572265][ C0] ? ath9k_hif_usb_rx_cb+0x3a8/0xf80 [ 33.577544][ C0] ? ath9k_hif_usb_rx_cb+0x3a8/0xf80 [ 33.582822][ C0] kasan_report.cold+0x37/0x7c [ 33.587580][ C0] ? spin_bug+0xf0/0x100 [ 33.591799][ C0] ? ath9k_hif_usb_rx_cb+0x3a8/0xf80 [ 33.597070][ C0] check_memory_region+0xf4/0x1c0 [ 33.602073][ C0] memcpy+0x20/0x60 [ 33.605861][ C0] ath9k_hif_usb_rx_cb+0x3a8/0xf80 [ 33.610952][ C0] ? kcov_remote_start+0xce/0x400 [ 33.615954][ C0] ? hif_usb_start+0xa0/0xa0 [ 33.620531][ C0] ? lock_downgrade+0x740/0x740 [ 33.625357][ C0] __usb_hcd_giveback_urb+0x32d/0x560 [ 33.630707][ C0] usb_hcd_giveback_urb+0x367/0x410 [ 33.635883][ C0] dummy_timer+0x11f2/0x3240 [ 33.640451][ C0] ? lock_downgrade+0x740/0x740 [ 33.645290][ C0] ? dummy_dequeue+0x4c0/0x4c0 [ 33.650043][ C0] call_timer_fn+0x1ac/0x6e0 [ 33.654619][ C0] ? dummy_dequeue+0x4c0/0x4c0 [ 33.659373][ C0] ? timer_fixup_init+0x60/0x60 [ 33.664202][ C0] ? lock_downgrade+0x740/0x740 [ 33.669040][ C0] ? _raw_spin_unlock_irq+0x1f/0x30 [ 33.674215][ C0] ? lockdep_hardirqs_on_prepare+0x19c/0x4f0 [ 33.680183][ C0] ? trace_hardirqs_on+0x5f/0x200 [ 33.685197][ C0] ? dummy_dequeue+0x4c0/0x4c0 [ 33.689951][ C0] __run_timers.part.0+0x67c/0xa60 [ 33.695057][ C0] ? call_timer_fn+0x6e0/0x6e0 [ 33.699803][ C0] ? clockevents_program_event+0x12b/0x350 [ 33.705615][ C0] ? tick_program_event+0xa8/0x130 [ 33.710751][ C0] run_timer_softirq+0x80/0x120 [ 33.715608][ C0] __do_softirq+0x1af/0x92c [ 33.720091][ C0] asm_call_irq_on_stack+0xf/0x20 [ 33.725087][ C0] [ 33.728015][ C0] do_softirq_own_stack+0x71/0x90 [ 33.733016][ C0] irq_exit_rcu+0x110/0x1a0 [ 33.737503][ C0] sysvec_apic_timer_interrupt+0x43/0x90 [ 33.743137][ C0] asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 33.749114][ C0] RIP: 0010:acpi_idle_do_entry+0x1c9/0x250 [ 33.754914][ C0] Code: 4d 5c 88 fb 84 db 75 ac e8 d4 63 88 fb e8 7f 01 8e fb e9 0c 00 00 00 e8 c5 63 88 fb 0f 00 2d 5e 1c 6d 00 e8 b9 63 88 fb fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 74 5c 88 fb 48 85 db [ 33.774513][ C0] RSP: 0018:ffffffff87207d68 EFLAGS: 00000293 [ 33.780583][ C0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 1ffffffff1016c01 [ 33.788544][ C0] RDX: ffffffff8722f240 RSI: ffffffff85b7ae07 RDI: ffffffff85b7adf1 [ 33.796501][ C0] RBP: ffff8881d8d52064 R08: 0000000000000001 R09: 0000000000000001 [ 33.804481][ C0] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001 [ 33.812462][ C0] R13: ffff8881d8d52000 R14: ffff8881d8d52064 R15: ffff8881d6f30004 [ 33.820429][ C0] ? acpi_idle_do_entry+0x1c7/0x250 [ 33.825625][ C0] ? acpi_idle_do_entry+0x1b1/0x250 [ 33.830809][ C0] ? acpi_idle_do_entry+0x1c7/0x250 [ 33.835990][ C0] acpi_idle_enter+0x337/0x490 [ 33.840738][ C0] cpuidle_enter_state+0x19e/0xa10 [ 33.845842][ C0] cpuidle_enter+0x4a/0xa0 [ 33.850239][ C0] do_idle+0x3d5/0x580 [ 33.854298][ C0] ? arch_cpu_idle_exit+0x40/0x40 [ 33.859308][ C0] ? schedule+0xe1/0x2b0 [ 33.863529][ C0] cpu_startup_entry+0x14/0x20 [ 33.868275][ C0] start_kernel+0x495/0x4b6 [ 33.872760][ C0] secondary_startup_64+0xb6/0xc0 [ 33.877760][ C0] [ 33.880082][ C0] The buggy address belongs to the page: [ 33.885718][ C0] page:0000000014c9552e refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1ccda8 [ 33.895933][ C0] head:0000000014c9552e order:3 compound_mapcount:0 compound_pincount:0 [ 33.904238][ C0] flags: 0x200000000010000(head) [ 33.909344][ C0] raw: 0200000000010000 dead000000000100 dead000000000122 0000000000000000 [ 33.917928][ C0] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 33.926502][ C0] page dumped because: kasan: bad access detected [ 33.932903][ C0] [ 33.935222][ C0] Memory state around the buggy address: [ 33.940833][ C0] ffff8881ccdaff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.949066][ C0] ffff8881ccdaff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.957136][ C0] >ffff8881ccdb0000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 33.965183][ C0] ^ [ 33.969255][ C0] ffff8881ccdb0080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 33.977296][ C0] ffff8881ccdb0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 33.985340][ C0] ================================================================== [ 33.993378][ C0] Disabling lock debugging due to kernel taint [ 33.999515][ C0] Kernel panic - not syncing: panic_on_warn set ... [ 34.006083][ C0] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G B 5.9.0-rc8-syzkaller #0 [ 34.015369][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 34.025438][ C0] Call Trace: [ 34.028697][ C0] [ 34.032863][ C0] dump_stack+0x107/0x16e [ 34.037173][ C0] ? ath9k_hif_usb_rx_cb+0x310/0xf80 [ 34.042437][ C0] panic+0x2cb/0x702 [ 34.046309][ C0] ? __warn_printk+0xf3/0xf3 [ 34.050890][ C0] ? do_raw_spin_unlock+0x50/0x1f0 [ 34.056032][ C0] ? ath9k_hif_usb_rx_cb+0x3a8/0xf80 [ 34.061296][ C0] ? ath9k_hif_usb_rx_cb+0x3a8/0xf80 [ 34.066602][ C0] end_report+0x4d/0x53 [ 34.070782][ C0] kasan_report.cold+0x72/0x7c [ 34.075533][ C0] ? spin_bug+0xf0/0x100 [ 34.079761][ C0] ? ath9k_hif_usb_rx_cb+0x3a8/0xf80 [ 34.085038][ C0] check_memory_region+0xf4/0x1c0 [ 34.090155][ C0] memcpy+0x20/0x60 [ 34.093966][ C0] ath9k_hif_usb_rx_cb+0x3a8/0xf80 [ 34.099072][ C0] ? kcov_remote_start+0xce/0x400 [ 34.104091][ C0] ? hif_usb_start+0xa0/0xa0 [ 34.108659][ C0] ? lock_downgrade+0x740/0x740 [ 34.113488][ C0] __usb_hcd_giveback_urb+0x32d/0x560 [ 34.118869][ C0] usb_hcd_giveback_urb+0x367/0x410 [ 34.124057][ C0] dummy_timer+0x11f2/0x3240 [ 34.128625][ C0] ? lock_downgrade+0x740/0x740 [ 34.133468][ C0] ? dummy_dequeue+0x4c0/0x4c0 [ 34.138210][ C0] call_timer_fn+0x1ac/0x6e0 [ 34.142790][ C0] ? dummy_dequeue+0x4c0/0x4c0 [ 34.147545][ C0] ? timer_fixup_init+0x60/0x60 [ 34.152375][ C0] ? lock_downgrade+0x740/0x740 [ 34.157212][ C0] ? _raw_spin_unlock_irq+0x1f/0x30 [ 34.162413][ C0] ? lockdep_hardirqs_on_prepare+0x19c/0x4f0 [ 34.168386][ C0] ? trace_hardirqs_on+0x5f/0x200 [ 34.173391][ C0] ? dummy_dequeue+0x4c0/0x4c0 [ 34.178150][ C0] __run_timers.part.0+0x67c/0xa60 [ 34.183241][ C0] ? call_timer_fn+0x6e0/0x6e0 [ 34.188000][ C0] ? clockevents_program_event+0x12b/0x350 [ 34.193783][ C0] ? tick_program_event+0xa8/0x130 [ 34.198911][ C0] run_timer_softirq+0x80/0x120 [ 34.203747][ C0] __do_softirq+0x1af/0x92c [ 34.208258][ C0] asm_call_irq_on_stack+0xf/0x20 [ 34.213291][ C0] [ 34.216210][ C0] do_softirq_own_stack+0x71/0x90 [ 34.221224][ C0] irq_exit_rcu+0x110/0x1a0 [ 34.225703][ C0] sysvec_apic_timer_interrupt+0x43/0x90 [ 34.231329][ C0] asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 34.237290][ C0] RIP: 0010:acpi_idle_do_entry+0x1c9/0x250 [ 34.243071][ C0] Code: 4d 5c 88 fb 84 db 75 ac e8 d4 63 88 fb e8 7f 01 8e fb e9 0c 00 00 00 e8 c5 63 88 fb 0f 00 2d 5e 1c 6d 00 e8 b9 63 88 fb fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 74 5c 88 fb 48 85 db [ 34.262672][ C0] RSP: 0018:ffffffff87207d68 EFLAGS: 00000293 [ 34.268719][ C0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 1ffffffff1016c01 [ 34.276695][ C0] RDX: ffffffff8722f240 RSI: ffffffff85b7ae07 RDI: ffffffff85b7adf1 [ 34.284821][ C0] RBP: ffff8881d8d52064 R08: 0000000000000001 R09: 0000000000000001 [ 34.292794][ C0] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001 [ 34.300751][ C0] R13: ffff8881d8d52000 R14: ffff8881d8d52064 R15: ffff8881d6f30004 [ 34.308708][ C0] ? acpi_idle_do_entry+0x1c7/0x250 [ 34.313885][ C0] ? acpi_idle_do_entry+0x1b1/0x250 [ 34.319063][ C0] ? acpi_idle_do_entry+0x1c7/0x250 [ 34.324251][ C0] acpi_idle_enter+0x337/0x490 [ 34.328990][ C0] cpuidle_enter_state+0x19e/0xa10 [ 34.334075][ C0] cpuidle_enter+0x4a/0xa0 [ 34.338466][ C0] do_idle+0x3d5/0x580 [ 34.342526][ C0] ? arch_cpu_idle_exit+0x40/0x40 [ 34.347525][ C0] ? schedule+0xe1/0x2b0 [ 34.351743][ C0] cpu_startup_entry+0x14/0x20 [ 34.356483][ C0] start_kernel+0x495/0x4b6 [ 34.360963][ C0] secondary_startup_64+0xb6/0xc0 [ 34.366441][ C0] Kernel Offset: disabled [ 34.370757][ C0] Rebooting in 86400 seconds..