Warning: Permanently added '10.128.1.3' (ECDSA) to the list of known hosts. 2020/04/04 01:13:20 parsed 1 programs 2020/04/04 01:13:20 executed programs: 0 [ 30.298932][ T520] cgroup: Unknown subsys name 'perf_event' [ 30.302086][ T518] cgroup: Unknown subsys name 'perf_event' [ 30.306076][ T523] cgroup: Unknown subsys name 'perf_event' [ 30.315202][ T522] cgroup: Unknown subsys name 'perf_event' [ 30.320852][ T520] cgroup: Unknown subsys name 'net_cls' [ 30.324586][ T518] cgroup: Unknown subsys name 'net_cls' [ 30.328704][ T523] cgroup: Unknown subsys name 'net_cls' [ 30.339166][ T525] cgroup: Unknown subsys name 'perf_event' [ 30.341856][ T522] cgroup: Unknown subsys name 'net_cls' [ 30.346237][ T526] cgroup: Unknown subsys name 'perf_event' [ 30.358434][ T525] cgroup: Unknown subsys name 'net_cls' [ 30.367753][ T526] cgroup: Unknown subsys name 'net_cls' [ 38.362734][ T94] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 38.449382][ T164] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 38.499060][ T136] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 38.609192][ T94] usb 6-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 38.619624][ T12] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 38.627454][ T94] usb 6-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 6 [ 38.669110][ T17] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 38.689050][ T3219] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 38.699288][ T164] usb 4-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 38.709739][ T164] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 6 [ 38.729101][ T136] usb 5-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 38.739435][ T136] usb 5-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 6 [ 38.799051][ T94] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 38.808124][ T94] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.817795][ T94] usb 6-1: Product: syz [ 38.822086][ T94] usb 6-1: Manufacturer: syz [ 38.826671][ T94] usb 6-1: SerialNumber: syz [ 38.831535][ T12] usb 2-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 38.841813][ T12] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 6 [ 38.890151][ T94] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 38.909071][ T3219] usb 1-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 38.919479][ T164] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 38.928619][ T164] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.936763][ T164] usb 4-1: Product: syz [ 38.938954][ T17] usb 3-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 38.940967][ T164] usb 4-1: Manufacturer: syz [ 38.940979][ T164] usb 4-1: SerialNumber: syz [ 38.941857][ T3219] usb 1-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 6 [ 38.951756][ T136] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 38.982361][ T136] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.989622][ T164] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 38.990391][ T136] usb 5-1: Product: syz [ 39.002671][ T136] usb 5-1: Manufacturer: syz [ 39.007284][ T136] usb 5-1: SerialNumber: syz [ 39.012456][ T17] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 6 [ 39.018921][ T12] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 39.034689][ T12] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 39.042745][ T12] usb 2-1: Product: syz [ 39.046899][ T12] usb 2-1: Manufacturer: syz [ 39.051832][ T12] usb 2-1: SerialNumber: syz [ 39.060406][ T136] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 39.089590][ T12] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 39.128964][ T3219] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 39.138078][ T3219] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 39.146560][ T3219] usb 1-1: Product: syz [ 39.150780][ T3219] usb 1-1: Manufacturer: syz [ 39.155371][ T3219] usb 1-1: SerialNumber: syz [ 39.199722][ T3219] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 39.210477][ T17] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 39.219602][ T17] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 39.227585][ T17] usb 3-1: Product: syz [ 39.232267][ T17] usb 3-1: Manufacturer: syz [ 39.236849][ T17] usb 3-1: SerialNumber: syz [ 39.279501][ T17] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 39.598695][ T164] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 39.607745][ T94] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 39.678831][ T136] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 39.690147][ T12] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 39.778621][ T3219] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 39.808926][ T164] haley: wmi 0xffff8881d26ca000, ath9k_htc_probe_device, 959 [ 39.816357][ T164] haley: wmi 0xffff8881d26ca000, ath9k_wmi_connect, 287 [ 39.823617][ T164] haley: skb 0xffff8881cfc67640, htc_connect_service, 275 [ 39.830880][ T94] haley: wmi 0xffff8881d26ce000, ath9k_htc_probe_device, 959 [ 39.838248][ T94] haley: wmi 0xffff8881d26ce000, ath9k_wmi_connect, 287 [ 39.846400][ T94] haley: skb 0xffff8881cfc67780, htc_connect_service, 275 [ 39.853783][ T164] haley: -2, htc_connect_service, 278 [ 39.859333][ T164] haley: -2, 110, ath9k_wmi_connect, 291 [ 39.864965][ T164] haley: -2, ath9k_wmi_connect, 296 [ 39.870255][ T164] ath9k_htc 4-1:1.0: ath9k_htc: Unable to initialize HTC services [ 39.879153][ T164] haley: ath9k_deinit_wmi, 118 [ 39.884006][ T94] haley: -2, htc_connect_service, 278 [ 39.888712][ T17] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 39.889487][ T94] haley: -2, 110, ath9k_wmi_connect, 291 [ 39.898868][ T136] haley: wmi 0xffff8881d6cb9000, ath9k_htc_probe_device, 959 [ 39.904065][ T94] haley: -2, ath9k_wmi_connect, 296 [ 39.911481][ T136] haley: wmi 0xffff8881d6cb9000, ath9k_wmi_connect, 287 [ 39.916603][ T94] ath9k_htc 6-1:1.0: ath9k_htc: Unable to initialize HTC services [ 39.923580][ T136] haley: skb 0xffff8881c650fa00, htc_connect_service, 275 [ 39.931771][ T136] haley: -2, htc_connect_service, 278 [ 39.938778][ T94] haley: ath9k_deinit_wmi, 118 [ 39.939634][ T164] ath9k_htc: Failed to initialize the device [ 39.944188][ T136] haley: -2, 110, ath9k_wmi_connect, 291 [ 39.949420][ T94] ath9k_htc: Failed to initialize the device [ 39.954984][ T136] haley: -2, ath9k_wmi_connect, 296 [ 39.960936][ T12] haley: wmi 0xffff8881d26cf000, ath9k_htc_probe_device, 959 [ 39.966674][ T136] ath9k_htc 5-1:1.0: ath9k_htc: Unable to initialize HTC services [ 39.966681][ T136] haley: ath9k_deinit_wmi, 118 [ 39.971723][ T136] ath9k_htc: Failed to initialize the device [ 39.972400][ T12] haley: wmi 0xffff8881d26cf000, ath9k_wmi_connect, 287 [ 40.006069][ T12] haley: skb 0xffff8881cfc67b40, htc_connect_service, 275 [ 40.013356][ C0] haley: skb 0xffff8881d25cc500, ath9k_wmi_ctrl_rx, 235 [ 40.013567][ C0] ================================================================== [ 40.013624][ C0] BUG: KASAN: use-after-free in ath9k_wmi_ctrl_rx+0x5e/0x444 [ 40.013634][ C0] Read of size 1 at addr ffff8881d26ca17c by task kworker/0:1/12 [ 40.013637][ C0] [ 40.013651][ C0] CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.6.0-rc7-syzkaller #0 [ 40.013658][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 40.013673][ C0] Workqueue: events request_firmware_work_func [ 40.013678][ C0] Call Trace: [ 40.013683][ C0] [ 40.013695][ C0] dump_stack+0xef/0x16e [ 40.013707][ C0] ? ath9k_wmi_ctrl_rx+0x5e/0x444 [ 40.013718][ C0] ? ath9k_wmi_ctrl_rx+0x5e/0x444 [ 40.013732][ C0] print_address_description.constprop.0.cold+0xd3/0x314 [ 40.013743][ C0] ? ath9k_wmi_ctrl_rx+0x5e/0x444 [ 40.013753][ C0] ? ath9k_wmi_ctrl_rx+0x5e/0x444 [ 40.013770][ C0] __kasan_report.cold+0x37/0x77 [ 40.013782][ C0] ? ath9k_wmi_ctrl_rx+0x5e/0x444 [ 40.013792][ C0] ? ath9k_wmi_cmd+0x585/0x585 [ 40.013804][ C0] kasan_report+0xe/0x20 [ 40.013815][ C0] ath9k_wmi_ctrl_rx+0x5e/0x444 [ 40.013826][ C0] ? ath9k_wmi_cmd+0x585/0x585 [ 40.013837][ C0] ath9k_htc_rx_msg+0x2d9/0xb00 [ 40.013848][ C0] ath9k_hif_usb_reg_in_cb+0x1a6/0x620 [ 40.013860][ C0] ? _raw_read_unlock+0x1a/0x30 [ 40.013875][ C0] ? led_trigger_blink_oneshot+0xb4/0xe0 [ 40.013887][ C0] __usb_hcd_giveback_urb+0x1f2/0x470 [ 40.013899][ C0] usb_hcd_giveback_urb+0x368/0x420 [ 40.013911][ C0] dummy_timer+0x1258/0x32ae [ 40.013924][ C0] ? dummy_udc_probe+0x930/0x930 [ 40.013937][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 40.013949][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 40.013960][ C0] call_timer_fn+0x195/0x6f0 [ 40.013970][ C0] ? dummy_udc_probe+0x930/0x930 [ 40.013981][ C0] ? msleep_interruptible+0x130/0x130 [ 40.013993][ C0] ? mark_held_locks+0x9f/0xe0 [ 40.014004][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 40.014014][ C0] ? _raw_spin_unlock_irq+0x1f/0x30 [ 40.014031][ C0] ? dummy_udc_probe+0x930/0x930 [ 40.014041][ C0] run_timer_softirq+0x5f9/0x1500 [ 40.014052][ C0] ? add_timer+0x7a0/0x7a0 [ 40.014063][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 40.014075][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 40.014092][ C0] ? mark_held_locks+0x9f/0xe0 [ 40.014105][ C0] __do_softirq+0x21e/0x950 [ 40.014118][ C0] irq_exit+0x178/0x1a0 [ 40.014131][ C0] smp_apic_timer_interrupt+0x141/0x540 [ 40.014144][ C0] apic_timer_interrupt+0xf/0x20 [ 40.014149][ C0] [ 40.014167][ C0] RIP: 0010:console_unlock+0xa6b/0xca0 [ 40.014179][ C0] Code: 00 89 ee 48 c7 c7 60 43 14 87 e8 10 c3 03 00 65 ff 0d c1 ed d8 7e e9 b5 f9 ff ff e8 0f 37 16 00 e8 0a 7f 1b 00 ff 74 24 30 9d fd fd ff ff e8 fb 36 16 00 48 8d 7d 08 48 89 f8 48 c1 e8 03 42 [ 40.014186][ C0] RSP: 0018:ffff8881da2277e0 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13 [ 40.014197][ C0] RAX: 0000000000000007 RBX: 0000000000000200 RCX: 0000000000000006 [ 40.014205][ C0] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8881da2120cc [ 40.014212][ C0] RBP: 0000000000000000 R08: ffff8881da211880 R09: fffffbfff1267085 [ 40.014220][ C0] R10: fffffbfff1267084 R11: ffffffff89338427 R12: ffffffff82a092f0 [ 40.014228][ C0] R13: ffffffff874d4830 R14: 000000000000004f R15: dffffc0000000000 [ 40.014241][ C0] ? netconsole_netdev_event+0x2a0/0x2a0 [ 40.014255][ C0] vprintk_emit+0x171/0x3d0 [ 40.014268][ C0] vprintk_func+0x75/0x113 [ 40.014279][ C0] printk+0xba/0xed [ 40.014291][ C0] ? kmsg_dump_rewind_nolock+0xd9/0xd9 [ 40.014305][ C0] ? __kmalloc_reserve.isra.0+0xe0/0xe0 [ 40.014318][ C0] ? kmsg_dump_rewind_nolock+0xd9/0xd9 [ 40.014328][ C0] htc_connect_service+0x5a1/0x840 [ 40.014340][ C0] ath9k_wmi_connect+0xec/0x22b [ 40.014349][ C0] ? ath9k_stop_wmi+0x9d/0x9d [ 40.014377][ C0] ? printk+0xba/0xed [ 40.014390][ C0] ? ath9k_hif_usb_firmware_cb.cold+0xdc/0xdc [ 40.014400][ C0] ? ath9k_wmi_cmd+0x585/0x585 [ 40.014412][ C0] ? lockdep_init_map+0x1b0/0x5e0 [ 40.014426][ C0] ath9k_init_htc_services.constprop.0+0x5b/0xa0 [ 40.014439][ C0] ath9k_htc_probe_device.cold+0x35/0x2103 [ 40.014450][ C0] ? mark_lock+0xbc/0x1160 [ 40.014463][ C0] ? ath9k_reg_rmw_flush+0x2d0/0x2d0 [ 40.014474][ C0] ? usb_submit_urb+0x6ed/0x1460 [ 40.014485][ C0] ? usb_free_urb.part.0+0x52/0x110 [ 40.014496][ C0] ? usb_free_urb+0x1b/0x30 [ 40.014508][ C0] ? ath9k_hif_usb_alloc_urbs+0xbbb/0x1030 [ 40.014519][ C0] ath9k_htc_hw_init+0x31/0x60 [ 40.014530][ C0] ath9k_hif_usb_firmware_cb+0x26b/0x500 [ 40.014541][ C0] ? ath9k_hif_usb_resume+0x320/0x320 [ 40.014554][ C0] request_firmware_work_func+0x126/0x242 [ 40.014568][ C0] ? request_firmware_into_buf+0x90/0x90 [ 40.014579][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 40.014591][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 40.014604][ C0] process_one_work+0x94b/0x1620 [ 40.014616][ C0] ? pwq_dec_nr_in_flight+0x310/0x310 [ 40.014629][ C0] ? do_raw_spin_lock+0x129/0x290 [ 40.014649][ C0] worker_thread+0x96/0xe20 [ 40.014662][ C0] ? process_one_work+0x1620/0x1620 [ 40.014672][ C0] kthread+0x318/0x420 [ 40.014684][ C0] ? kthread_create_on_node+0xf0/0xf0 [ 40.014696][ C0] ret_from_fork+0x24/0x30 [ 40.014700][ C0] [ 40.014707][ C0] Allocated by task 164: [ 40.014718][ C0] save_stack+0x1b/0x80 [ 40.014731][ C0] __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 40.014740][ C0] ath9k_init_wmi+0x40/0x310 [ 40.014752][ C0] ath9k_htc_probe_device+0x21b/0x300 [ 40.014761][ C0] ath9k_htc_hw_init+0x31/0x60 [ 40.014772][ C0] ath9k_hif_usb_firmware_cb+0x26b/0x500 [ 40.014784][ C0] request_firmware_work_func+0x126/0x242 [ 40.014796][ C0] process_one_work+0x94b/0x1620 [ 40.014806][ C0] worker_thread+0x96/0xe20 [ 40.014816][ C0] kthread+0x318/0x420 [ 40.014826][ C0] ret_from_fork+0x24/0x30 [ 40.014830][ C0] [ 40.014835][ C0] Freed by task 164: [ 40.014845][ C0] save_stack+0x1b/0x80 [ 40.014857][ C0] __kasan_slab_free+0x117/0x160 [ 40.014867][ C0] kfree+0xd5/0x300 [ 40.014878][ C0] ath9k_htc_probe_device.cold+0x53/0x2103 [ 40.014888][ C0] ath9k_htc_hw_init+0x31/0x60 [ 40.014897][ C0] ath9k_hif_usb_firmware_cb+0x26b/0x500 [ 40.014914][ C0] request_firmware_work_func+0x126/0x242 [ 40.014925][ C0] process_one_work+0x94b/0x1620 [ 40.014936][ C0] worker_thread+0x96/0xe20 [ 40.014945][ C0] kthread+0x318/0x420 [ 40.014956][ C0] ret_from_fork+0x24/0x30 [ 40.014959][ C0] [ 40.014968][ C0] The buggy address belongs to the object at ffff8881d26ca000 [ 40.014968][ C0] which belongs to the cache kmalloc-2k of size 2048 [ 40.014979][ C0] The buggy address is located 380 bytes inside of [ 40.014979][ C0] 2048-byte region [ffff8881d26ca000, ffff8881d26ca800) [ 40.014983][ C0] The buggy address belongs to the page: [ 40.014995][ C0] page:ffffea000749b200 refcount:1 mapcount:0 mapping:ffff8881da00c000 index:0x0 compound_mapcount: 0 [ 40.015005][ C0] flags: 0x200000000010200(slab|head) [ 40.015020][ C0] raw: 0200000000010200 0000000000000000 0000000400000001 ffff8881da00c000 [ 40.015041][ C0] raw: 0000000000000000 0000000080080008 00000001ffffffff 0000000000000000 [ 40.015046][ C0] page dumped because: kasan: bad access detected [ 40.015049][ C0] [ 40.015053][ C0] Memory state around the buggy address: [ 40.015063][ C0] ffff8881d26ca000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.015072][ C0] ffff8881d26ca080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.015081][ C0] >ffff8881d26ca100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.015086][ C0] ^ [ 40.015095][ C0] ffff8881d26ca180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.015103][ C0] ffff8881d26ca200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.015107][ C0] ================================================================== [ 40.015110][ C0] Disabling lock debugging due to kernel taint [ 40.015115][ C0] Kernel panic - not syncing: panic_on_warn set ... [ 40.015126][ C0] CPU: 0 PID: 12 Comm: kworker/0:1 Tainted: G B 5.6.0-rc7-syzkaller #0 [ 40.015130][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 40.015142][ C0] Workqueue: events request_firmware_work_func [ 40.015147][ C0] Call Trace: [ 40.015151][ C0] [ 40.015162][ C0] dump_stack+0xef/0x16e [ 40.015171][ C0] panic+0x2aa/0x6e1 [ 40.015181][ C0] ? add_taint.cold+0x16/0x16 [ 40.015191][ C0] ? print_shadow_for_address+0xb8/0x114 [ 40.015211][ C0] ? trace_hardirqs_off+0x50/0x200 [ 40.015221][ C0] ? ath9k_wmi_ctrl_rx+0x5e/0x444 [ 40.015231][ C0] end_report+0x43/0x49 [ 40.015242][ C0] ? ath9k_wmi_ctrl_rx+0x5e/0x444 [ 40.015253][ C0] __kasan_report.cold+0x55/0x77 [ 40.015264][ C0] ? ath9k_wmi_ctrl_rx+0x5e/0x444 [ 40.015274][ C0] ? ath9k_wmi_cmd+0x585/0x585 [ 40.015284][ C0] kasan_report+0xe/0x20 [ 40.015294][ C0] ath9k_wmi_ctrl_rx+0x5e/0x444 [ 40.015305][ C0] ? ath9k_wmi_cmd+0x585/0x585 [ 40.015314][ C0] ath9k_htc_rx_msg+0x2d9/0xb00 [ 40.015325][ C0] ath9k_hif_usb_reg_in_cb+0x1a6/0x620 [ 40.015336][ C0] ? _raw_read_unlock+0x1a/0x30 [ 40.015348][ C0] ? led_trigger_blink_oneshot+0xb4/0xe0 [ 40.015359][ C0] __usb_hcd_giveback_urb+0x1f2/0x470 [ 40.015369][ C0] usb_hcd_giveback_urb+0x368/0x420 [ 40.015380][ C0] dummy_timer+0x1258/0x32ae [ 40.015392][ C0] ? dummy_udc_probe+0x930/0x930 [ 40.015402][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 40.015413][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 40.015420][ C0] call_timer_fn+0x195/0x6f0 [ 40.015437][ C0] ? dummy_udc_probe+0x930/0x930 [ 40.015447][ C0] ? msleep_interruptible+0x130/0x130 [ 40.015457][ C0] ? mark_held_locks+0x9f/0xe0 [ 40.015467][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 40.015478][ C0] ? _raw_spin_unlock_irq+0x1f/0x30 [ 40.015487][ C0] ? dummy_udc_probe+0x930/0x930 [ 40.015497][ C0] run_timer_softirq+0x5f9/0x1500 [ 40.015507][ C0] ? add_timer+0x7a0/0x7a0 [ 40.015518][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 40.015528][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 40.015537][ C0] ? mark_held_locks+0x9f/0xe0 [ 40.015549][ C0] __do_softirq+0x21e/0x950 [ 40.015560][ C0] irq_exit+0x178/0x1a0 [ 40.015573][ C0] smp_apic_timer_interrupt+0x141/0x540 [ 40.015584][ C0] apic_timer_interrupt+0xf/0x20 [ 40.015588][ C0] [ 40.015600][ C0] RIP: 0010:console_unlock+0xa6b/0xca0 [ 40.015611][ C0] Code: 00 89 ee 48 c7 c7 60 43 14 87 e8 10 c3 03 00 65 ff 0d c1 ed d8 7e e9 b5 f9 ff ff e8 0f 37 16 00 e8 0a 7f 1b 00 ff 74 24 30 9d fd fd ff ff e8 fb 36 16 00 48 8d 7d 08 48 89 f8 48 c1 e8 03 42 [ 40.015617][ C0] RSP: 0018:ffff8881da2277e0 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13 [ 40.015628][ C0] RAX: 0000000000000007 RBX: 0000000000000200 RCX: 0000000000000006 [ 40.015634][ C0] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8881da2120cc [ 40.015640][ C0] RBP: 0000000000000000 R08: ffff8881da211880 R09: fffffbfff1267085 [ 40.015647][ C0] R10: fffffbfff1267084 R11: ffffffff89338427 R12: ffffffff82a092f0 [ 40.015660][ C0] R13: ffffffff874d4830 R14: 000000000000004f R15: dffffc0000000000 [ 40.015671][ C0] ? netconsole_netdev_event+0x2a0/0x2a0 [ 40.015683][ C0] vprintk_emit+0x171/0x3d0 [ 40.015693][ C0] vprintk_func+0x75/0x113 [ 40.015703][ C0] printk+0xba/0xed [ 40.015715][ C0] ? kmsg_dump_rewind_nolock+0xd9/0xd9 [ 40.015727][ C0] ? __kmalloc_reserve.isra.0+0xe0/0xe0 [ 40.015739][ C0] ? kmsg_dump_rewind_nolock+0xd9/0xd9 [ 40.015749][ C0] htc_connect_service+0x5a1/0x840 [ 40.015759][ C0] ath9k_wmi_connect+0xec/0x22b [ 40.015769][ C0] ? ath9k_stop_wmi+0x9d/0x9d [ 40.015779][ C0] ? printk+0xba/0xed [ 40.015791][ C0] ? ath9k_hif_usb_firmware_cb.cold+0xdc/0xdc [ 40.015800][ C0] ? ath9k_wmi_cmd+0x585/0x585 [ 40.015810][ C0] ? lockdep_init_map+0x1b0/0x5e0 [ 40.015822][ C0] ath9k_init_htc_services.constprop.0+0x5b/0xa0 [ 40.015835][ C0] ath9k_htc_probe_device.cold+0x35/0x2103 [ 40.015844][ C0] ? mark_lock+0xbc/0x1160 [ 40.015856][ C0] ? ath9k_reg_rmw_flush+0x2d0/0x2d0 [ 40.015867][ C0] ? usb_submit_urb+0x6ed/0x1460 [ 40.015877][ C0] ? usb_free_urb.part.0+0x52/0x110 [ 40.015887][ C0] ? usb_free_urb+0x1b/0x30 [ 40.015895][ C0] ? ath9k_hif_usb_alloc_urbs+0xbbb/0x1030 [ 40.015910][ C0] ath9k_htc_hw_init+0x31/0x60 [ 40.015921][ C0] ath9k_hif_usb_firmware_cb+0x26b/0x500 [ 40.015932][ C0] ? ath9k_hif_usb_resume+0x320/0x320 [ 40.015944][ C0] request_firmware_work_func+0x126/0x242 [ 40.015956][ C0] ? request_firmware_into_buf+0x90/0x90 [ 40.015967][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 40.015978][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 40.015989][ C0] process_one_work+0x94b/0x1620 [ 40.016001][ C0] ? pwq_dec_nr_in_flight+0x310/0x310 [ 40.016018][ C0] ? do_raw_spin_lock+0x129/0x290 [ 40.016035][ C0] worker_thread+0x96/0xe20 [ 40.016047][ C0] ? process_one_work+0x1620/0x1620 [ 40.016057][ C0] kthread+0x318/0x420 [ 40.016067][ C0] ? kthread_create_on_node+0xf0/0xf0 [ 40.016077][ C0] ret_from_fork+0x24/0x30 [ 40.016127][ C0] Kernel Offset: disabled [ 41.329771][ C0] Rebooting in 86400 seconds..