Warning: Permanently added '10.128.1.35' (ECDSA) to the list of known hosts.
executing program
executing program
executing program
executing program
executing program
executing program
[ 23.996871][ T95] usb 4-1: new high-speed USB device number 2 using dummy_hcd
[ 24.004546][ T12] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[ 24.016943][ T165] usb 2-1: new high-speed USB device number 2 using dummy_hcd
[ 24.016951][ T371] usb 3-1: new high-speed USB device number 2 using dummy_hcd
[ 24.017060][ T5] usb 6-1: new high-speed USB device number 2 using dummy_hcd
[ 24.024487][ T22] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 24.536598][ T165] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 24.536608][ T95] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 24.536650][ T165] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 24.545766][ T95] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 24.545778][ T95] usb 4-1: Product: syz
[ 24.545792][ T95] usb 4-1: Manufacturer: syz
[ 24.545803][ T95] usb 4-1: SerialNumber: syz
[ 24.546683][ T12] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 24.554886][ T165] usb 2-1: Product: syz
[ 24.563127][ T12] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 24.570914][ T165] usb 2-1: Manufacturer: syz
[ 24.575045][ T12] usb 1-1: Product: syz
[ 24.579639][ T165] usb 2-1: SerialNumber: syz
[ 24.616441][ T22] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 24.618817][ T12] usb 1-1: Manufacturer: syz
[ 24.618831][ T12] usb 1-1: SerialNumber: syz
[ 24.618906][ T5] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 24.628095][ T22] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 24.632621][ T5] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 24.637227][ T22] usb 5-1: Product: syz
[ 24.646216][ T5] usb 6-1: Product: syz
[ 24.654194][ T22] usb 5-1: Manufacturer: syz
[ 24.662213][ T5] usb 6-1: Manufacturer: syz
[ 24.666334][ T22] usb 5-1: SerialNumber: syz
[ 24.670460][ T5] usb 6-1: SerialNumber: syz
[ 24.676837][ T165] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 24.679932][ T371] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 24.706034][ T371] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 24.714087][ T371] usb 3-1: Product: syz
[ 24.718314][ T371] usb 3-1: Manufacturer: syz
[ 24.722901][ T371] usb 3-1: SerialNumber: syz
[ 24.737227][ T22] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 24.777038][ T95] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 24.786816][ T371] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 24.796951][ T5] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 24.806861][ T12] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 25.315934][ T165] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[ 25.335923][ T22] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[ 25.405933][ T371] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[ 25.414961][ T5] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[ 25.425775][ T12] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[ 25.435765][ T95] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[ 25.516358][ T365] udc-core: couldn't find an available UDC or it's busy
[ 25.523370][ T365] misc raw-gadget: fail, usb_gadget_probe_driver returned -16
[ 25.535925][ T363] udc-core: couldn't find an available UDC or it's busy
[ 25.542968][ T363] misc raw-gadget: fail, usb_gadget_probe_driver returned -16
[ 25.605931][ T358] udc-core: couldn't find an available UDC or it's busy
[ 25.605934][ T366] udc-core: couldn't find an available UDC or it's busy
[ 25.605955][ T366] misc raw-gadget: fail, usb_gadget_probe_driver returned -16
[ 25.613041][ T358] misc raw-gadget: fail, usb_gadget_probe_driver returned -16
[ 25.620168][ T367] udc-core: couldn't find an available UDC or it's busy
[ 25.631143][ T364] udc-core: couldn't find an available UDC or it's busy
[ 25.634915][ T367] misc raw-gadget: fail, usb_gadget_probe_driver returned -16
[ 25.642465][ T364] misc raw-gadget: fail, usb_gadget_probe_driver returned -16
[ 26.365226][ T22] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive
[ 26.372331][ T22] ath9k_htc: Failed to initialize the device
[ 26.380025][ T165] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive
[ 26.388370][ T165] ath9k_htc: Failed to initialize the device
executing program
executing program
[ 26.525025][ T95] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive
[ 26.532042][ T95] ath9k_htc: Failed to initialize the device
[ 26.538248][ T12] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive
[ 26.545205][ T5] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive
[ 26.549067][ T83] usb 2-1: USB disconnect, device number 2
[ 26.554552][ T371] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive
[ 26.566493][ T5] ath9k_htc: Failed to initialize the device
executing program
[ 26.569282][ T83] usb 2-1: ath9k_htc: USB layer deinitialized
[ 26.575367][ T12] ath9k_htc: Failed to initialize the device
[ 26.595313][ T371] ath9k_htc: Failed to initialize the device
[ 26.602514][ T374] usb 5-1: USB disconnect, device number 2
[ 26.610679][ T374] usb 5-1: ath9k_htc: USB layer deinitialized
executing program
executing program
executing program
[ 26.636725][ T388] usb 1-1: USB disconnect, device number 2
[ 26.657292][ T382] usb 3-1: USB disconnect, device number 2
[ 26.659000][ T388] usb 1-1: ath9k_htc: USB layer deinitialized
[ 26.679799][ T382] usb 3-1: ath9k_htc: USB layer deinitialized
[ 26.684105][ T390] usb 6-1: USB disconnect, device number 2
[ 26.700334][ T390] usb 6-1: ath9k_htc: USB layer deinitialized
[ 26.710907][ T398] usb 4-1: USB disconnect, device number 2
[ 26.724448][ T398] usb 4-1: ath9k_htc: USB layer deinitialized
[ 26.964718][ T374] usb 5-1: new high-speed USB device number 3 using dummy_hcd
[ 27.004696][ T83] usb 2-1: new high-speed USB device number 3 using dummy_hcd
[ 27.024703][ T388] usb 1-1: new high-speed USB device number 3 using dummy_hcd
[ 27.034678][ T382] usb 3-1: new high-speed USB device number 3 using dummy_hcd
[ 27.054672][ T390] usb 6-1: new high-speed USB device number 3 using dummy_hcd
[ 27.084660][ T398] usb 4-1: new high-speed USB device number 3 using dummy_hcd
[ 27.494561][ T374] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 27.503649][ T374] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 27.511837][ T374] usb 5-1: Product: syz
[ 27.516083][ T374] usb 5-1: Manufacturer: syz
[ 27.520655][ T374] usb 5-1: SerialNumber: syz
[ 27.564623][ T388] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 27.573704][ T388] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 27.581739][ T388] usb 1-1: Product: syz
[ 27.585810][ T83] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 27.585952][ T388] usb 1-1: Manufacturer: syz
[ 27.595022][ T83] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 27.599504][ T388] usb 1-1: SerialNumber: syz
[ 27.607502][ T83] usb 2-1: Product: syz
[ 27.613098][ T374] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 27.616232][ T83] usb 2-1: Manufacturer: syz
[ 27.628877][ T83] usb 2-1: SerialNumber: syz
[ 27.641351][ T382] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 27.644571][ T398] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 27.650459][ T382] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 27.659440][ T398] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 27.659453][ T398] usb 4-1: Product: syz
[ 27.659466][ T398] usb 4-1: Manufacturer: syz
[ 27.667449][ T382] usb 3-1: Product: syz
[ 27.667467][ T382] usb 3-1: Manufacturer: syz
[ 27.675461][ T398] usb 4-1: SerialNumber: syz
[ 27.679589][ T382] usb 3-1: SerialNumber: syz
[ 27.684277][ T390] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 27.711229][ T390] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 27.719247][ T390] usb 6-1: Product: syz
[ 27.723401][ T390] usb 6-1: Manufacturer: syz
[ 27.728045][ T390] usb 6-1: SerialNumber: syz
[ 27.733670][ T388] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 27.734972][ T83] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 27.750212][ T382] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 27.784858][ T398] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 27.794995][ T390] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 28.253979][ T374] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[ 28.304029][ T388] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[ 28.353939][ T165] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[ 28.362977][ T83] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[ 28.364010][ T398] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[ 28.381008][ T390] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[ 28.454010][ T385] udc-core: couldn't find an available UDC or it's busy
[ 28.460978][ T385] misc raw-gadget: fail, usb_gadget_probe_driver returned -16
[ 28.504096][ T391] udc-core: couldn't find an available UDC or it's busy
[ 28.511168][ T391] misc raw-gadget: fail, usb_gadget_probe_driver returned -16
[ 28.553957][ T394] udc-core: couldn't find an available UDC or it's busy
[ 28.560991][ T394] misc raw-gadget: fail, usb_gadget_probe_driver returned -16
[ 28.563036][ T384] udc-core: couldn't find an available UDC or it's busy
[ 28.570424][ T396] udc-core: couldn't find an available UDC or it's busy
[ 28.575581][ T384] misc raw-gadget: fail, usb_gadget_probe_driver returned -16
[ 28.575738][ T399] udc-core: couldn't find an available UDC or it's busy
[ 28.582625][ T396] misc raw-gadget: fail, usb_gadget_probe_driver returned -16
[ 28.604678][ T399] misc raw-gadget: fail, usb_gadget_probe_driver returned -16
[ 29.323540][ T388] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive
[ 29.330637][ T388] ath9k_htc: Failed to initialize the device
[ 29.337025][ T374] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive
[ 29.344119][ T374] ath9k_htc: Failed to initialize the device
[ 29.403238][ T83] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive
[ 29.403385][ T398] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive
[ 29.410238][ T83] ath9k_htc: Failed to initialize the device
[ 29.417118][ T390] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive
[ 29.423196][ T165] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive
[ 29.437012][ T390] ath9k_htc: Failed to initialize the device
[ 29.437276][ T165] ath9k_htc: Failed to initialize the device
[ 29.443394][ C0] ==================================================================
[ 29.457122][ C0] BUG: KASAN: slab-out-of-bounds in ath9k_hif_usb_rx_cb+0xad3/0xf90
[ 29.465070][ C0] Read of size 4 at addr ffff8881c2f5c0dc by task kworker/0:8/398
[ 29.472841][ C0]
[ 29.475151][ C0] CPU: 0 PID: 398 Comm: kworker/0:8 Not tainted 5.7.0-rc5-syzkaller #0
[ 29.483358][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 29.493495][ C0] Workqueue: events request_firmware_work_func
[ 29.499633][ C0] Call Trace:
executing program
[ 29.502894][ C0]
[ 29.505726][ C0] dump_stack+0xef/0x16e
[ 29.509944][ C0] print_address_description.constprop.0.cold+0xd3/0x314
[ 29.516977][ C0] ? ath9k_hif_usb_rx_cb+0xad3/0xf90
[ 29.522241][ C0] __kasan_report.cold+0x37/0x92
[ 29.527179][ C0] ? ath9k_hif_usb_rx_cb+0xad3/0xf90
[ 29.527348][ T382] usb 1-1: USB disconnect, device number 3
[ 29.532451][ C0] ? ath9k_hif_usb_rx_cb+0xad3/0xf90
[ 29.532466][ C0] kasan_report+0x33/0x50
[ 29.547826][ C0] ath9k_hif_usb_rx_cb+0xad3/0xf90
executing program
[ 29.552937][ C0] ? find_held_lock+0x2d/0x110
[ 29.557699][ C0] ? hif_usb_mgmt_cb+0x310/0x310
[ 29.562709][ C0] ? usb_hcd_unmap_urb_setup_for_dma+0x8a/0x470
[ 29.568923][ C0] ? do_raw_read_unlock+0x3b/0x70
[ 29.573923][ C0] ? _raw_read_unlock+0x1a/0x30
[ 29.578755][ C0] __usb_hcd_giveback_urb+0x1f2/0x470
[ 29.584108][ C0] usb_hcd_giveback_urb+0x368/0x420
[ 29.584724][ T22] usb 6-1: USB disconnect, device number 3
[ 29.589298][ C0] dummy_timer+0x125e/0x32b4
[ 29.599665][ C0] ? dummy_udc_probe+0x980/0x980
[ 29.604600][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 29.610143][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 29.615424][ C0] call_timer_fn+0x1ac/0x700
[ 29.620002][ C0] ? dummy_udc_probe+0x980/0x980
[ 29.624928][ C0] ? timer_fixup_init+0x60/0x60
[ 29.629761][ C0] ? lock_downgrade+0x720/0x720
[ 29.634594][ C0] ? mark_held_locks+0x9f/0xe0
[ 29.639331][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 29.644604][ C0] ? _raw_spin_unlock_irq+0x1f/0x30
[ 29.649786][ C0] ? dummy_udc_probe+0x980/0x980
[ 29.650628][ T393] usb 4-1: USB disconnect, device number 3
[ 29.654709][ C0] run_timer_softirq+0x5f9/0x1500
[ 29.654721][ C0] ? add_timer+0x7a0/0x7a0
[ 29.654733][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 29.654749][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 29.680721][ C0] ? mark_held_locks+0x9f/0xe0
[ 29.685461][ C0] __do_softirq+0x21e/0x9aa
[ 29.689941][ C0] irq_exit+0x178/0x1a0
[ 29.694082][ C0] smp_apic_timer_interrupt+0x141/0x540
[ 29.699610][ C0] apic_timer_interrupt+0xf/0x20
[ 29.704518][ C0]
[ 29.707434][ C0] RIP: 0010:_raw_spin_unlock_irq+0x27/0x30
[ 29.713213][ C0] Code: 44 00 00 55 48 8b 74 24 08 48 89 fd 48 8d 7f 18 e8 1e b4 90 fb 48 89 ef e8 b6 b0 91 fb e8 a1 54 af fb fb 65 ff 0d 51 ca 6b 7a <5d> c3 0f 1f 80 00 00 00 00 55 48 89 fd 48 83 c7 18 53 48 89 f3 48
[ 29.733145][ C0] RSP: 0018:ffff8881cd6175e8 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13
[ 29.741532][ C0] RAX: 0000000000000007 RBX: ffff8881c1d04a40 RCX: 1ffffffff1270ab2
[ 29.749493][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8881c1d052bc
[ 29.757440][ C0] RBP: ffff8881db234900 R08: 0000000000000001 R09: fffffbfff126c8c8
[ 29.765394][ C0] R10: ffffffff8936463f R11: fffffbfff126c8c7 R12: ffff8881db234900
[ 29.773517][ C0] R13: ffff8881ce3ee300 R14: 0000000000000000 R15: 0000000000000001
[ 29.781480][ C0] ? _raw_spin_unlock_irq+0x1f/0x30
[ 29.786662][ C0] finish_task_switch+0x11d/0x5d0
[ 29.791663][ C0] ? finish_task_switch+0xef/0x5d0
[ 29.796747][ C0] ? __switch_to+0x5bd/0xe90
[ 29.801315][ C0] __schedule+0x89a/0x1d80
[ 29.805718][ C0] ? __sched_text_start+0x8/0x8
[ 29.810545][ C0] preempt_schedule_common+0x30/0x60
[ 29.815807][ C0] _cond_resched+0x18/0x20
[ 29.820205][ C0] __flush_work+0x117/0xa90
[ 29.824692][ C0] ? print_usage_bug+0x200/0x200
[ 29.829600][ C0] ? queue_delayed_work_on+0xc0/0xc0
[ 29.834878][ C0] ? mark_held_locks+0xe0/0xe0
[ 29.839615][ C0] ? mark_lock+0x12b/0x1510
[ 29.844092][ C0] ? mark_lock+0x12b/0x1510
[ 29.848569][ C0] ? print_usage_bug+0x200/0x200
[ 29.853480][ C0] ? print_usage_bug+0x200/0x200
[ 29.858391][ C0] ? lock_acquire+0x18b/0x7c0
[ 29.863041][ C0] ? lock_timer_base+0x55/0x1a0
[ 29.867869][ C0] ? mark_held_locks+0x9f/0xe0
[ 29.872606][ C0] __cancel_work_timer+0x32c/0x460
[ 29.877691][ C0] ? mod_delayed_work_on+0x150/0x150
[ 29.882950][ C0] ? lock_downgrade+0x720/0x720
[ 29.887784][ C0] ? mark_held_locks+0x9f/0xe0
[ 29.892537][ C0] ? _raw_spin_unlock_irqrestore+0x39/0x40
[ 29.898355][ C0] ? lockdep_hardirqs_on+0x3c7/0x5d0
[ 29.903631][ C0] rhashtable_free_and_destroy+0x29/0x8b0
[ 29.909324][ C0] ? del_timer_sync+0x115/0x130
[ 29.914153][ C0] ieee80211_free_hw+0xab/0x270
[ 29.918977][ C0] ath9k_htc_probe_device+0x1c2/0x1da0
[ 29.924452][ C0] ? ath9k_init_htc_services.constprop.0+0x650/0x650
[ 29.931137][ C0] ? usb_submit_urb+0x6ed/0x1460
[ 29.936166][ C0] ? usb_free_urb.part.0+0x52/0x110
[ 29.941343][ C0] ? usb_free_urb+0x1b/0x30
[ 29.945825][ C0] ath9k_htc_hw_init+0x31/0x60
[ 29.950571][ C0] ath9k_hif_usb_firmware_cb+0x274/0x510
[ 29.956231][ C0] ? ath9k_hif_usb_resume+0x320/0x320
[ 29.961623][ C0] request_firmware_work_func+0x126/0x242
[ 29.967324][ C0] ? request_firmware_into_buf+0x90/0x90
[ 29.972932][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 29.978453][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 29.983713][ C0] ? _raw_spin_unlock_irq+0x1f/0x30
[ 29.988892][ C0] process_one_work+0x965/0x1630
[ 29.993817][ C0] ? lock_release+0x720/0x720
[ 29.998467][ C0] ? pwq_dec_nr_in_flight+0x310/0x310
[ 30.003813][ C0] ? rwlock_bug.part.0+0x90/0x90
[ 30.008722][ C0] worker_thread+0x96/0xe20
[ 30.013207][ C0] ? process_one_work+0x1630/0x1630
[ 30.018389][ C0] kthread+0x326/0x430
[ 30.022455][ C0] ? kthread_create_on_node+0xf0/0xf0
[ 30.027801][ C0] ret_from_fork+0x24/0x30
[ 30.032185][ C0]
[ 30.034502][ C0] Allocated by task 150:
[ 30.038726][ C0] save_stack+0x1b/0x40
[ 30.042864][ C0] __kasan_kmalloc.constprop.0+0xbf/0xd0
[ 30.048482][ C0] kmem_cache_alloc+0xd8/0x300
[ 30.053219][ C0] getname_flags+0xd2/0x5b0
[ 30.057710][ C0] do_sys_openat2+0x3fc/0x7d0
[ 30.062369][ C0] do_sys_open+0xc3/0x140
[ 30.066670][ C0] do_syscall_64+0xb6/0x5a0
[ 30.071146][ C0] entry_SYSCALL_64_after_hwframe+0x49/0xb3
[ 30.077003][ C0]
[ 30.079305][ C0] Freed by task 150:
[ 30.083175][ C0] save_stack+0x1b/0x40
[ 30.087317][ C0] __kasan_slab_free+0x117/0x160
[ 30.092240][ C0] kmem_cache_free+0x9b/0x360
[ 30.096998][ C0] putname+0xe1/0x120
[ 30.100964][ C0] do_sys_openat2+0x467/0x7d0
[ 30.105615][ C0] do_sys_open+0xc3/0x140
[ 30.109923][ C0] do_syscall_64+0xb6/0x5a0
[ 30.114401][ C0] entry_SYSCALL_64_after_hwframe+0x49/0xb3
[ 30.120260][ C0]
[ 30.122565][ C0] The buggy address belongs to the object at ffff8881c2f5b300
[ 30.122565][ C0] which belongs to the cache names_cache of size 4096
[ 30.136690][ C0] The buggy address is located 3548 bytes inside of
[ 30.136690][ C0] 4096-byte region [ffff8881c2f5b300, ffff8881c2f5c300)
[ 30.150113][ C0] The buggy address belongs to the page:
[ 30.155735][ C0] page:ffffea00070bd600 refcount:1 mapcount:0 mapping:00000000b9a8a87e index:0x0 head:ffffea00070bd600 order:3 compound_mapcount:0 compound_pincount:0
[ 30.170891][ C0] flags: 0x200000000010200(slab|head)
[ 30.176241][ C0] raw: 0200000000010200 dead000000000100 dead000000000122 ffff8881da11e000
[ 30.184811][ C0] raw: 0000000000000000 0000000000070007 00000001ffffffff 0000000000000000
[ 30.193402][ C0] page dumped because: kasan: bad access detected
[ 30.199797][ C0]
[ 30.202097][ C0] Memory state around the buggy address:
[ 30.207700][ C0] ffff8881c2f5bf80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 30.215765][ C0] ffff8881c2f5c000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 30.223820][ C0] >ffff8881c2f5c080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 30.231859][ C0] ^
[ 30.238777][ C0] ffff8881c2f5c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 30.246818][ C0] ffff8881c2f5c180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 30.254859][ C0] ==================================================================
[ 30.262888][ C0] Disabling lock debugging due to kernel taint
[ 30.269019][ C0] Kernel panic - not syncing: panic_on_warn set ...
[ 30.275577][ C0] CPU: 0 PID: 398 Comm: kworker/0:8 Tainted: G B 5.7.0-rc5-syzkaller #0
[ 30.285169][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 30.295213][ C0] Workqueue: events request_firmware_work_func
[ 30.301334][ C0] Call Trace:
[ 30.304590][ C0]
[ 30.307420][ C0] dump_stack+0xef/0x16e
[ 30.311634][ C0] panic+0x2aa/0x6e1
[ 30.315498][ C0] ? add_taint.cold+0x16/0x16
[ 30.320153][ C0] ? print_shadow_for_address+0xb8/0x114
[ 30.325764][ C0] ? trace_hardirqs_off+0x50/0x200
[ 30.330844][ C0] ? ath9k_hif_usb_rx_cb+0xad3/0xf90
[ 30.336109][ C0] end_report+0x4d/0x53
[ 30.340234][ C0] __kasan_report.cold+0x72/0x92
[ 30.345141][ C0] ? ath9k_hif_usb_rx_cb+0xad3/0xf90
[ 30.350493][ C0] ? ath9k_hif_usb_rx_cb+0xad3/0xf90
[ 30.355758][ C0] kasan_report+0x33/0x50
[ 30.360059][ C0] ath9k_hif_usb_rx_cb+0xad3/0xf90
[ 30.365141][ C0] ? find_held_lock+0x2d/0x110
[ 30.369878][ C0] ? hif_usb_mgmt_cb+0x310/0x310
[ 30.374786][ C0] ? usb_hcd_unmap_urb_setup_for_dma+0x8a/0x470
[ 30.381006][ C0] ? do_raw_read_unlock+0x3b/0x70
[ 30.385999][ C0] ? _raw_read_unlock+0x1a/0x30
[ 30.393607][ C0] __usb_hcd_giveback_urb+0x1f2/0x470
[ 30.398951][ C0] usb_hcd_giveback_urb+0x368/0x420
[ 30.404120][ C0] dummy_timer+0x125e/0x32b4
[ 30.408693][ C0] ? dummy_udc_probe+0x980/0x980
[ 30.413604][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 30.419129][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 30.424382][ C0] call_timer_fn+0x1ac/0x700
[ 30.428951][ C0] ? dummy_udc_probe+0x980/0x980
[ 30.433856][ C0] ? timer_fixup_init+0x60/0x60
[ 30.438675][ C0] ? lock_downgrade+0x720/0x720
[ 30.443602][ C0] ? mark_held_locks+0x9f/0xe0
[ 30.448345][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 30.453603][ C0] ? _raw_spin_unlock_irq+0x1f/0x30
[ 30.458786][ C0] ? dummy_udc_probe+0x980/0x980
[ 30.463704][ C0] run_timer_softirq+0x5f9/0x1500
[ 30.468696][ C0] ? add_timer+0x7a0/0x7a0
[ 30.473097][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 30.478611][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 30.483863][ C0] ? mark_held_locks+0x9f/0xe0
[ 30.488598][ C0] __do_softirq+0x21e/0x9aa
[ 30.493088][ C0] irq_exit+0x178/0x1a0
[ 30.497214][ C0] smp_apic_timer_interrupt+0x141/0x540
[ 30.502740][ C0] apic_timer_interrupt+0xf/0x20
[ 30.507647][ C0]
[ 30.510567][ C0] RIP: 0010:_raw_spin_unlock_irq+0x27/0x30
[ 30.516362][ C0] Code: 44 00 00 55 48 8b 74 24 08 48 89 fd 48 8d 7f 18 e8 1e b4 90 fb 48 89 ef e8 b6 b0 91 fb e8 a1 54 af fb fb 65 ff 0d 51 ca 6b 7a <5d> c3 0f 1f 80 00 00 00 00 55 48 89 fd 48 83 c7 18 53 48 89 f3 48
[ 30.535961][ C0] RSP: 0018:ffff8881cd6175e8 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13
[ 30.544349][ C0] RAX: 0000000000000007 RBX: ffff8881c1d04a40 RCX: 1ffffffff1270ab2
[ 30.552306][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8881c1d052bc
[ 30.560254][ C0] RBP: ffff8881db234900 R08: 0000000000000001 R09: fffffbfff126c8c8
[ 30.568197][ C0] R10: ffffffff8936463f R11: fffffbfff126c8c7 R12: ffff8881db234900
[ 30.576140][ C0] R13: ffff8881ce3ee300 R14: 0000000000000000 R15: 0000000000000001
[ 30.584104][ C0] ? _raw_spin_unlock_irq+0x1f/0x30
[ 30.589272][ C0] finish_task_switch+0x11d/0x5d0
[ 30.594266][ C0] ? finish_task_switch+0xef/0x5d0
[ 30.599360][ C0] ? __switch_to+0x5bd/0xe90
[ 30.603921][ C0] __schedule+0x89a/0x1d80
[ 30.608309][ C0] ? __sched_text_start+0x8/0x8
[ 30.613127][ C0] preempt_schedule_common+0x30/0x60
[ 30.622042][ C0] _cond_resched+0x18/0x20
[ 30.626427][ C0] __flush_work+0x117/0xa90
[ 30.630918][ C0] ? print_usage_bug+0x200/0x200
[ 30.635836][ C0] ? queue_delayed_work_on+0xc0/0xc0
[ 30.641090][ C0] ? mark_held_locks+0xe0/0xe0
[ 30.645821][ C0] ? mark_lock+0x12b/0x1510
[ 30.650303][ C0] ? mark_lock+0x12b/0x1510
[ 30.654775][ C0] ? print_usage_bug+0x200/0x200
[ 30.659687][ C0] ? print_usage_bug+0x200/0x200
[ 30.664592][ C0] ? lock_acquire+0x18b/0x7c0
[ 30.669245][ C0] ? lock_timer_base+0x55/0x1a0
[ 30.674064][ C0] ? mark_held_locks+0x9f/0xe0
[ 30.678803][ C0] __cancel_work_timer+0x32c/0x460
[ 30.683906][ C0] ? mod_delayed_work_on+0x150/0x150
[ 30.689160][ C0] ? lock_downgrade+0x720/0x720
[ 30.693981][ C0] ? mark_held_locks+0x9f/0xe0
[ 30.698979][ C0] ? _raw_spin_unlock_irqrestore+0x39/0x40
[ 30.704765][ C0] ? lockdep_hardirqs_on+0x3c7/0x5d0
[ 30.710019][ C0] rhashtable_free_and_destroy+0x29/0x8b0
[ 30.715709][ C0] ? del_timer_sync+0x115/0x130
[ 30.720544][ C0] ieee80211_free_hw+0xab/0x270
[ 30.725379][ C0] ath9k_htc_probe_device+0x1c2/0x1da0
[ 30.730822][ C0] ? ath9k_init_htc_services.constprop.0+0x650/0x650
[ 30.737475][ C0] ? usb_submit_urb+0x6ed/0x1460
[ 30.742403][ C0] ? usb_free_urb.part.0+0x52/0x110
[ 30.747586][ C0] ? usb_free_urb+0x1b/0x30
[ 30.752064][ C0] ath9k_htc_hw_init+0x31/0x60
[ 30.757213][ C0] ath9k_hif_usb_firmware_cb+0x274/0x510
[ 30.762834][ C0] ? ath9k_hif_usb_resume+0x320/0x320
[ 30.768188][ C0] request_firmware_work_func+0x126/0x242
[ 30.773880][ C0] ? request_firmware_into_buf+0x90/0x90
[ 30.779484][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 30.785002][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 30.790869][ C0] ? _raw_spin_unlock_irq+0x1f/0x30
[ 30.796042][ C0] process_one_work+0x965/0x1630
[ 30.800952][ C0] ? lock_release+0x720/0x720
[ 30.805599][ C0] ? pwq_dec_nr_in_flight+0x310/0x310
[ 30.810940][ C0] ? rwlock_bug.part.0+0x90/0x90
[ 30.815847][ C0] worker_thread+0x96/0xe20
[ 30.820322][ C0] ? process_one_work+0x1630/0x1630
[ 30.825489][ C0] kthread+0x326/0x430
[ 30.829529][ C0] ? kthread_create_on_node+0xf0/0xf0
[ 30.834880][ C0] ret_from_fork+0x24/0x30
[ 30.839971][ C0] Kernel Offset: disabled
[ 30.844281][ C0] Rebooting in 86400 seconds..