[ OK ] Started Serial Getty on ttyS0. [ OK ] Started Getty on tty1. [ OK ] Started Getty on tty4. [ OK ] Started Getty on tty3. [ OK ] Started Getty on tty2. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.158' (ECDSA) to the list of known hosts. syzkaller login: [ 49.418627][ T31] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 49.779012][ T31] usb 1-1: config 1 interface 0 altsetting 0 has a duplicate endpoint with address 0x4, skipping [ 49.949264][ T31] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 49.958304][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 49.967354][ T31] usb 1-1: Product: syz [ 49.972176][ T31] usb 1-1: Manufacturer: syz [ 49.976785][ T31] usb 1-1: SerialNumber: syz [ 50.033334][ T31] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 50.648473][ T31] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 50.869036][ T31] ------------[ cut here ]------------ [ 50.874508][ T31] usb 1-1: BOGUS urb xfer, pipe 1 != type 3 [ 50.881082][ T31] WARNING: CPU: 1 PID: 31 at drivers/usb/core/urb.c:494 usb_submit_urb+0xacd/0x1550 [ 50.890671][ T31] Modules linked in: [ 50.894580][ T31] CPU: 1 PID: 31 Comm: kworker/1:1 Not tainted 5.11.0-rc5-syzkaller #0 [ 50.902891][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 50.913099][ T31] Workqueue: events request_firmware_work_func [ 50.919315][ T31] RIP: 0010:usb_submit_urb+0xacd/0x1550 [ 50.924867][ T31] Code: d8 48 c1 e8 03 42 8a 04 28 84 c0 0f 85 bd 07 00 00 44 8b 03 48 c7 c7 20 68 5b 8a 4c 89 f6 4c 89 fa 89 e9 31 c0 e8 33 1a d6 fb <0f> 0b 4c 8b 74 24 30 45 89 f7 4c 89 ff 48 c7 c6 f0 e0 68 8c e8 0a [ 50.944616][ T31] RSP: 0018:ffffc90000e2f858 EFLAGS: 00010246 [ 50.950819][ T31] RAX: 9970740e8d019b00 RBX: ffffffff8a5b6648 RCX: ffff8880113b1bc0 [ 50.958904][ T31] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 50.966891][ T31] RBP: 0000000000000001 R08: ffffffff815fa2d2 R09: ffffed10173a60b8 [ 50.974921][ T31] R10: ffffed10173a60b8 R11: 0000000000000000 R12: ffff88801271e800 [ 50.984111][ T31] R13: dffffc0000000000 R14: ffffffff8a5c0880 R15: ffff888014d53168 [ 50.992145][ T31] FS: 0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 [ 51.001202][ T31] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 51.007780][ T31] CR2: 00007f9b00696000 CR3: 000000001201f000 CR4: 00000000001506e0 [ 51.015807][ T31] DR0: 0000000000000000 DR