[ OK ] Listening on Load/Save RF Kill Switch Status /dev/rfkill Watch. [ OK ] Started Getty on tty6. [ OK ] Started Getty on tty5. [ OK ] Started Getty on tty4. [ OK ] Started Getty on tty3. [ OK ] Started Getty on tty2. [ OK ] Started Getty on tty1. [ OK ] Started Serial Getty on ttyS0. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Update UTMP about System Runlevel Changes. [ OK ] Started Load/Save RF Kill Switch Status. Warning: Permanently added '10.128.0.219' (ECDSA) to the list of known hosts. [ 79.821058][ T37] audit: type=1400 audit(1625868315.529:8): avc: denied { execmem } for pid=8464 comm="syz-executor678" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 80.089056][ T8157] usb 1-1: new high-speed USB device number 2 using dummy_hcd Debian GNU/Linux 9 syzkaller ttyS0 syzkaller login: [ 80.459152][ T8157] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 80.629119][ T8157] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 80.638291][ T8157] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 80.646410][ T8157] usb 1-1: Product: syz [ 80.650961][ T8157] usb 1-1: Manufacturer: syz [ 80.655558][ T8157] usb 1-1: SerialNumber: syz [ 80.715423][ T8157] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 81.349061][ T8157] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 81.358489][ T8157] ------------[ cut here ]------------ [ 81.367111][ T8157] usb 1-1: BOGUS urb xfer, pipe 3 != type 1 [ 81.373884][ T8157] WARNING: CPU: 1 PID: 8157 at drivers/usb/core/urb.c:493 usb_submit_urb+0xd27/0x1540 [ 81.384102][ T8157] Modules linked in: [ 81.388006][ T8157] CPU: 1 PID: 8157 Comm: kworker/1:4 Not tainted 5.13.0-syzkaller #0 [ 81.396999][ T8157] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 81.407692][ T8157] Workqueue: events request_firmware_work_func [ 81.414558][ T8157] RIP: 0010:usb_submit_urb+0xd27/0x1540 [ 81.420773][ T8157] Code: 84 d4 02 00 00 e8 a9 78 23 fc 4c 89 ef e8 a1 85 0c ff 41 89 d8 44 89 e1 4c 89 f2 48 89 c6 48 c7 c7 20 f2 26 8a e8 c0 65 8e 03 <0f> 0b e9 81 f8 ff ff e8 7d 78 23 fc 48 81 c5 40 06 00 00 e9 ad f7 [ 81.441064][ T8157] RSP: 0018:ffffc9000c657b58 EFLAGS: 00010282 [ 81.447146][ T8157] RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 [ 81.456200][ T8157] RDX: ffff888031b98300 RSI: ffffffff815ca6f5 RDI: fffff520018caf5d [ 81.464789][ T8157] RBP: ffff888019913c50 R08: 0000000000000000 R09: 0000000000000000 [ 81.473507][ T8157] R10: ffffffff815c452e R11: 0000000000000000 R12: 0000000000000003 [ 81.482263][ T8157] R13: ffff8880178700a8 R14: ffff88802da56c40 R15: ffff888016df4700 [ 81.490948][ T8157] FS: 0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 [ 81.500464][ T8157] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 81.507041][ T8157] CR2: 00007f4477cee000 CR3: 00000000190b3000 CR4: 00000000001506e0 [ 81.515896][ T8157] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 81.525353][ T8157] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 81.533883][ T8157] Call Trace: [ 81.537156][ T8157] ath9k_hif_usb_alloc_urbs+0x7cf/0x1040 [ 81.543651][ T8157] ath9k_hif_usb_firmware_cb+0x148/0x530 [ 81.