[[0;32m OK [0m] Started Daily Cleanup of Temporary Directories.
[[0;32m OK [0m] Started Daily apt download activities.
[[0;32m OK [0m] Started Daily apt upgrade and clean activities.
[[0;32m OK [0m] Reached target Timers.
[[0;32m OK [0m] Started Regular background program processing daemon.
[[0;32m OK [0m] Started System Logging Service.
[[0;32m OK [0m] Started Permit User Sessions.
[[0;32m OK [0m] Found device /dev/ttyS0.
[[0;32m OK [0m] Started OpenBSD Secure Shell server.
[[0;32m OK [0m] Started getty on tty2-tty6 if dbus and logind are not available.
[[0;32m OK [0m] Listening on Load/Save RF Kill Switch Status /dev/rfkill Watch.
[[0;32m OK [0m] Started Getty on tty6.
[[0;32m OK [0m] Started Getty on tty5.
[[0;32m OK [0m] Started Getty on tty4.
[[0;32m OK [0m] Started Getty on tty3.
[[0;32m OK [0m] Started Getty on tty2.
[[0;32m OK [0m] Started Getty on tty1.
[[0;32m OK [0m] Started Serial Getty on ttyS0.
[[0;32m OK [0m] Reached target Login Prompts.
[[0;32m OK [0m] Reached target Multi-User System.
[[0;32m OK [0m] Reached target Graphical Interface.
Starting Update UTMP about System Runlevel Changes...
Starting Load/Save RF Kill Switch Status...
[[0;32m OK [0m] Started Update UTMP about System Runlevel Changes.
[[0;32m OK [0m] Started Load/Save RF Kill Switch Status.
Warning: Permanently added '10.128.10.40' (ECDSA) to the list of known hosts.
executing program
[ 80.309085][ T37] audit: type=1400 audit(1618480489.438:8): avc: denied { execmem } for pid=8390 comm="syz-executor798" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
[ 80.577877][ T3129] usb 1-1: new high-speed USB device number 2 using dummy_hcd
Debian GNU/Linux 9 syzkaller ttyS0
syzkaller login: [ 81.097959][ T3129] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 81.107175][ T3129] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 81.115702][ T3129] usb 1-1: Product: syz
[ 81.120127][ T3129] usb 1-1: Manufacturer: syz
[ 81.124782][ T3129] usb 1-1: SerialNumber: syz
[ 81.170603][ T3129] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 81.767897][ T3129] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[ 82.177876][ C1] ==================================================================
[ 82.186672][ C1] BUG: KASAN: slab-out-of-bounds in ath9k_hif_usb_rx_cb+0x3d3/0x1050
[ 82.194773][ C1] Read of size 41740 at addr ffff888039730000 by task swapper/1/0
[ 82.202668][ C1]
[ 82.204984][ C1] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.12.0-rc7-syzkaller #0
[ 82.213648][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 82.223727][ C1] Call Trace:
[ 82.227088][ C1]
[ 82.230365][ C1] dump_stack+0x141/0x1d7
[ 82.234701][ C1] ? ath9k_hif_usb_rx_cb+0x3d3/0x1050
[ 82.240073][ C1] print_address_description.constprop.0.cold+0x5b/0x2c6
[ 82.247098][ C1] ? ath9k_hif_usb_rx_cb+0x3d3/0x1050
[ 82.252468][ C1] ? ath9k_hif_usb_rx_cb+0x3d3/0x1050
[ 82.257852][ C1] kasan_report.cold+0x7c/0xd8
[ 82.262617][ C1] ? spin_bug+0xb0/0x100
[ 82.266879][ C1] ? ath9k_hif_usb_rx_cb+0x3d3/0x1050
[ 82.272246][ C1] kasan_check_range+0x13d/0x180
[ 82.277179][ C1] memcpy+0x20/0x60
[ 82.280990][ C1] ath9k_hif_usb_rx_cb+0x3d3/0x1050
[ 82.286183][ C1] ? hif_usb_start+0xa0/0xa0
[ 82.290767][ C1] ? __usb_hcd_giveback_urb+0x413/0x5c0
[ 82.296310][ C1] ? lock_downgrade+0x6e0/0x6e0
[ 82.301159][ C1] __usb_hcd_giveback_urb+0x2b0/0x5c0
[ 82.306537][ C1] usb_hcd_giveback_urb+0x367/0x410
[ 82.311735][ C1] dummy_timer+0x11f4/0x32a0
[ 82.316320][ C1] ? dummy_dequeue+0x500/0x500
[ 82.321075][ C1] ? dummy_dequeue+0x500/0x500
[ 82.325849][ C1] call_timer_fn+0x1a5/0x6b0
[ 82.330430][ C1] ? add_timer_on+0x4a0/0x4a0
[ 82.335111][ C1] ? lock_downgrade+0x6e0/0x6e0
[ 82.339952][ C1] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70
[ 82.346189][ C1] ? _raw_spin_unlock_irq+0x1f/0x40
[ 82.351382][ C1] ? dummy_dequeue+0x500/0x500
[ 82.356138][ C1] __run_timers.part.0+0x67c/0xa50
[ 82.361248][ C1] ? call_timer_fn+0x6b0/0x6b0
[ 82.366014][ C1] ? lapic_next_event+0x4d/0x80
[ 82.370860][ C1] ? kvm_sched_clock_read+0x14/0x40
[ 82.376052][ C1] ? sched_clock+0x2a/0x40
[ 82.380464][ C1] ? sched_clock_cpu+0x18/0x1f0
[ 82.385307][ C1] run_timer_softirq+0xb3/0x1d0
[ 82.390149][ C1] __do_softirq+0x29b/0x9f6
[ 82.394656][ C1] irq_exit_rcu+0x134/0x200
[ 82.399158][ C1] sysvec_apic_timer_interrupt+0x93/0xc0
[ 82.404786][ C1]
[ 82.407706][ C1] asm_sysvec_apic_timer_interrupt+0x12/0x20
[ 82.413771][ C1] RIP: 0010:acpi_idle_do_entry+0x1c9/0x250
[ 82.419571][ C1] Code: dd 9a 6d f8 84 db 75 ac e8 c4 92 6d f8 e8 8f 82 73 f8 e9 0c 00 00 00 e8 b5 92 6d f8 0f 00 2d fe 1f c7 00 e8 a9 92 6d f8 fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 54 99 6d f8 48 85 db
[ 82.439172][ C1] RSP: 0018:ffffc90000d6fd18 EFLAGS: 00000293
[ 82.445230][ C1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 82.453191][ C1] RDX: ffff8880116de040 RSI: ffffffff89059327 RDI: 0000000000000000
[ 82.461172][ C1] RBP: ffff88801598b064 R08: 0000000000000001 R09: 0000000000000001
[ 82.469133][ C1] R10: ffffffff817915d8 R11: 0000000000000000 R12: 0000000000000001
[ 82.477094][ C1] R13: ffff88801598b000 R14: ffff88801598b064 R15: ffff888143941804
[ 82.485058][ C1] ? trace_hardirqs_on+0x38/0x1c0
[ 82.490082][ C1] ? acpi_idle_do_entry+0x1c7/0x250
[ 82.495276][ C1] ? acpi_idle_do_entry+0x1c7/0x250
[ 82.500467][ C1] acpi_idle_enter+0x361/0x500
[ 82.505265][ C1] cpuidle_enter_state+0x1b1/0xc80
[ 82.510374][ C1] cpuidle_enter+0x4a/0xa0
[ 82.514796][ C1] do_idle+0x3e1/0x590
[ 82.518859][ C1] ? arch_cpu_idle_exit+0x30/0x30
[ 82.523878][ C1] cpu_startup_entry+0x14/0x20
[ 82.528635][ C1] start_secondary+0x274/0x350
[ 82.533395][ C1] ? set_cpu_sibling_map+0x2460/0x2460
[ 82.538849][ C1] secondary_startup_64_no_verify+0xb0/0xbb
[ 82.544759][ C1]
[ 82.547090][ C1] Allocated by task 3129:
[ 82.551402][ C1] kasan_save_stack+0x1b/0x40
[ 82.556074][ C1] __kasan_kmalloc+0x96/0xc0
[ 82.560668][ C1] __alloc_skb+0xde/0x340
[ 82.565001][ C1] ath9k_hif_usb_alloc_urbs+0x665/0x1040
[ 82.570640][ C1] ath9k_hif_usb_firmware_cb+0x148/0x530
[ 82.576312][ C1] request_firmware_work_func+0x12c/0x230
[ 82.582043][ C1] process_one_work+0x98d/0x1600
[ 82.586988][ C1] worker_thread+0x64c/0x1120
[ 82.591661][ C1] kthread+0x3b1/0x4a0
[ 82.595734][ C1] ret_from_fork+0x1f/0x30
[ 82.600146][ C1]
[ 82.602457][ C1] The buggy address belongs to the object at ffff888039730000
[ 82.602457][ C1] which belongs to the cache kmalloc-32k of size 32768
[ 82.616779][ C1] The buggy address is located 0 bytes inside of
[ 82.616779][ C1] 32768-byte region [ffff888039730000, ffff888039738000)
[ 82.630146][ C1] The buggy address belongs to the page:
[ 82.635769][ C1] page:ffffea0000e5cc00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x39730
[ 82.645921][ C1] head:ffffea0000e5cc00 order:4 compound_mapcount:0 compound_pincount:0
[ 82.654681][ C1] flags: 0xfff00000010200(slab|head)
[ 82.659970][ C1] raw: 00fff00000010200 ffffea0000e5c808 ffffea0000e5d008 ffff888010840c00
[ 82.668633][ C1] raw: 0000000000000000 ffff888039730000 0000000100000001 0000000000000000
[ 82.677199][ C1] page dumped because: kasan: bad access detected
[ 82.683614][ C1]
[ 82.685924][ C1] Memory state around the buggy address:
[ 82.691554][ C1] ffff888039737f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 82.699604][ C1] ffff888039737f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 82.707653][ C1] >ffff888039738000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 82.715698][ C1] ^
[ 82.719751][ C1] ffff888039738080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 82.727807][ C1] ffff888039738100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 82.735862][ C1] ==================================================================
[ 82.743931][ C1] Disabling lock debugging due to kernel taint
[ 82.750079][ C1] Kernel panic - not syncing: panic_on_warn set ...
[ 82.756648][ C1] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G B 5.12.0-rc7-syzkaller #0
[ 82.766006][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 82.776056][ C1] Call Trace:
[ 82.779325][ C1]
[ 82.782155][ C1] dump_stack+0x141/0x1d7
[ 82.786474][ C1] panic+0x306/0x73d
[ 82.790355][ C1] ? __warn_printk+0xf3/0xf3
[ 82.794933][ C1] ? ath9k_hif_usb_rx_cb+0x3d3/0x1050
[ 82.800336][ C1] ? ath9k_hif_usb_rx_cb+0x3d3/0x1050
[ 82.805696][ C1] end_report.cold+0x5a/0x5a
[ 82.810277][ C1] kasan_report.cold+0x6a/0xd8
[ 82.815033][ C1] ? spin_bug+0xb0/0x100
[ 82.819263][ C1] ? ath9k_hif_usb_rx_cb+0x3d3/0x1050
[ 82.824624][ C1] kasan_check_range+0x13d/0x180
[ 82.829549][ C1] memcpy+0x20/0x60
[ 82.833356][ C1] ath9k_hif_usb_rx_cb+0x3d3/0x1050
[ 82.838634][ C1] ? hif_usb_start+0xa0/0xa0
[ 82.843214][ C1] ? __usb_hcd_giveback_urb+0x413/0x5c0
[ 82.848765][ C1] ? lock_downgrade+0x6e0/0x6e0
[ 82.853607][ C1] __usb_hcd_giveback_urb+0x2b0/0x5c0
[ 82.858999][ C1] usb_hcd_giveback_urb+0x367/0x410
[ 82.864188][ C1] dummy_timer+0x11f4/0x32a0
[ 82.868768][ C1] ? dummy_dequeue+0x500/0x500
[ 82.873528][ C1] ? dummy_dequeue+0x500/0x500
[ 82.878365][ C1] call_timer_fn+0x1a5/0x6b0
[ 82.883551][ C1] ? add_timer_on+0x4a0/0x4a0
[ 82.888213][ C1] ? lock_downgrade+0x6e0/0x6e0
[ 82.893082][ C1] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70
[ 82.899312][ C1] ? _raw_spin_unlock_irq+0x1f/0x40
[ 82.904501][ C1] ? dummy_dequeue+0x500/0x500
[ 82.909254][ C1] __run_timers.part.0+0x67c/0xa50
[ 82.914355][ C1] ? call_timer_fn+0x6b0/0x6b0
[ 82.919289][ C1] ? lapic_next_event+0x4d/0x80
[ 82.924481][ C1] ? kvm_sched_clock_read+0x14/0x40
[ 82.929688][ C1] ? sched_clock+0x2a/0x40
[ 82.934111][ C1] ? sched_clock_cpu+0x18/0x1f0
[ 82.938961][ C1] run_timer_softirq+0xb3/0x1d0
[ 82.943805][ C1] __do_softirq+0x29b/0x9f6
[ 82.948301][ C1] irq_exit_rcu+0x134/0x200
[ 82.952792][ C1] sysvec_apic_timer_interrupt+0x93/0xc0
[ 82.958416][ C1]
[ 82.961330][ C1] asm_sysvec_apic_timer_interrupt+0x12/0x20
[ 82.967313][ C1] RIP: 0010:acpi_idle_do_entry+0x1c9/0x250
[ 82.973112][ C1] Code: dd 9a 6d f8 84 db 75 ac e8 c4 92 6d f8 e8 8f 82 73 f8 e9 0c 00 00 00 e8 b5 92 6d f8 0f 00 2d fe 1f c7 00 e8 a9 92 6d f8 fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 54 99 6d f8 48 85 db
[ 82.992719][ C1] RSP: 0018:ffffc90000d6fd18 EFLAGS: 00000293
[ 82.998915][ C1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 83.006872][ C1] RDX: ffff8880116de040 RSI: ffffffff89059327 RDI: 0000000000000000
[ 83.014841][ C1] RBP: ffff88801598b064 R08: 0000000000000001 R09: 0000000000000001
[ 83.022812][ C1] R10: ffffffff817915d8 R11: 0000000000000000 R12: 0000000000000001
[ 83.030794][ C1] R13: ffff88801598b000 R14: ffff88801598b064 R15: ffff888143941804
[ 83.038763][ C1] ? trace_hardirqs_on+0x38/0x1c0
[ 83.043788][ C1] ? acpi_idle_do_entry+0x1c7/0x250
[ 83.048981][ C1] ? acpi_idle_do_entry+0x1c7/0x250
[ 83.054269][ C1] acpi_idle_enter+0x361/0x500
[ 83.059023][ C1] cpuidle_enter_state+0x1b1/0xc80
[ 83.064125][ C1] cpuidle_enter+0x4a/0xa0
[ 83.068566][ C1] do_idle+0x3e1/0x590
[ 83.072623][ C1] ? arch_cpu_idle_exit+0x30/0x30
[ 83.077728][ C1] cpu_startup_entry+0x14/0x20
[ 83.082481][ C1] start_secondary+0x274/0x350
[ 83.087236][ C1] ? set_cpu_sibling_map+0x2460/0x2460
[ 83.092689][ C1] secondary_startup_64_no_verify+0xb0/0xbb
[ 83.099379][ C1] Kernel Offset: disabled
[ 83.103751][ C1] Rebooting in 86400 seconds..