[[0;32m OK [0m] Reached target Graphical Interface.
Starting Update UTMP about System Runlevel Changes...
[[0;32m OK [0m] Listening on Load/Save RF Kill Switch Status /dev/rfkill Watch.
[[0;32m OK [0m] Started Update UTMP about System Runlevel Changes.
Debian GNU/Linux 9 syzkaller ttyS0
syzkaller login: [ 15.648682][ C1] random: crng init done
[ 15.652989][ C1] random: 7 urandom warning(s) missed due to ratelimiting
Warning: Permanently added '10.128.0.80' (ECDSA) to the list of known hosts.
executing program
[ 43.380535][ T73] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[ 43.910550][ T73] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 43.919784][ T73] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 43.927851][ T73] usb 1-1: Product: syz
[ 43.932099][ T73] usb 1-1: Manufacturer: syz
[ 43.936683][ T73] usb 1-1: SerialNumber: syz
[ 43.981831][ T73] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 44.690323][ T73] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[ 45.130263][ C1] ==================================================================
[ 45.138476][ C1] BUG: KASAN: use-after-free in ath9k_hif_usb_rx_cb+0x3a8/0xf80
[ 45.146119][ C1] Read of size 48858 at addr ffff88810d620000 by task swapper/1/0
[ 45.153908][ C1]
[ 45.156227][ C1] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.9.0-syzkaller #0
[ 45.163771][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 45.173826][ C1] Call Trace:
[ 45.177119][ C1]
[ 45.179975][ C1] dump_stack+0x107/0x163
[ 45.184286][ C1] ? ath9k_hif_usb_rx_cb+0x3a8/0xf80
[ 45.189576][ C1] ? ath9k_hif_usb_rx_cb+0x3a8/0xf80
[ 45.194873][ C1] print_address_description.constprop.0+0x1c/0x210
[ 45.201448][ C1] ? lock_acquire+0x1a7/0x830
[ 45.206114][ C1] ? ath9k_hif_usb_rx_cb+0x23e/0xf80
[ 45.211416][ C1] ? vprintk_func+0x93/0x140
[ 45.215994][ C1] ? ath9k_hif_usb_rx_cb+0x3a8/0xf80
[ 45.221282][ C1] ? ath9k_hif_usb_rx_cb+0x3a8/0xf80
[ 45.226576][ C1] kasan_report.cold+0x37/0x7c
[ 45.231326][ C1] ? rwlock_bug.part.0+0x40/0x90
[ 45.236253][ C1] ? ath9k_hif_usb_rx_cb+0x3a8/0xf80
[ 45.241530][ C1] check_memory_region+0xf4/0x1c0
[ 45.246538][ C1] memcpy+0x20/0x60
[ 45.250353][ C1] ath9k_hif_usb_rx_cb+0x3a8/0xf80
[ 45.255461][ C1] ? lock_acquire+0x1a7/0x830
[ 45.260127][ C1] ? kcov_remote_start+0xce/0x400
[ 45.265199][ C1] ? hif_usb_start+0xa0/0xa0
[ 45.269773][ C1] ? __usb_hcd_giveback_urb+0x302/0x560
[ 45.275305][ C1] ? lock_downgrade+0x6d0/0x6d0
[ 45.280213][ C1] __usb_hcd_giveback_urb+0x32d/0x560
[ 45.285585][ C1] usb_hcd_giveback_urb+0x367/0x410
[ 45.290782][ C1] dummy_timer+0x11f2/0x3240
[ 45.295467][ C1] ? __lock_acquire+0x16ae/0x5a60
[ 45.300491][ C1] ? dummy_dequeue+0x4c0/0x4c0
[ 45.305235][ C1] ? dummy_dequeue+0x4c0/0x4c0
[ 45.309996][ C1] call_timer_fn+0x1a5/0x630
[ 45.314589][ C1] ? timer_fixup_init+0x60/0x60
[ 45.319424][ C1] ? lock_downgrade+0x6d0/0x6d0
[ 45.324271][ C1] ? lockdep_hardirqs_on_prepare+0x129/0x3e0
[ 45.330244][ C1] ? dummy_dequeue+0x4c0/0x4c0
[ 45.335001][ C1] __run_timers.part.0+0x67c/0xa10
[ 45.340102][ C1] ? call_timer_fn+0x630/0x630
[ 45.344870][ C1] ? lapic_next_event+0x4d/0x80
[ 45.349719][ C1] ? clockevents_program_event+0x12b/0x350
[ 45.355519][ C1] ? tick_program_event+0xa8/0x130
[ 45.360623][ C1] ? hrtimer_interrupt+0x6c0/0x8f0
[ 45.365717][ C1] run_timer_softirq+0x80/0x120
[ 45.370567][ C1] __do_softirq+0x1b1/0x8d1
[ 45.375052][ C1] asm_call_irq_on_stack+0xf/0x20
[ 45.380058][ C1]
[ 45.383004][ C1] do_softirq_own_stack+0x80/0xa0
[ 45.388019][ C1] irq_exit_rcu+0x110/0x1a0
[ 45.392503][ C1] sysvec_apic_timer_interrupt+0x43/0xa0
[ 45.398117][ C1] asm_sysvec_apic_timer_interrupt+0x12/0x20
[ 45.404079][ C1] RIP: 0010:acpi_idle_do_entry+0x1c9/0x250
[ 45.409878][ C1] Code: bd d6 7f fb 84 db 75 ac e8 44 de 7f fb e8 1f 72 85 fb e9 0c 00 00 00 e8 35 de 7f fb 0f 00 2d de 88 65 00 e8 29 de 7f fb fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 e4 d6 7f fb 48 85 db
[ 45.429476][ C1] RSP: 0018:ffff88810029fd18 EFLAGS: 00000293
[ 45.435541][ C1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 1ffffffff103b869
[ 45.443510][ C1] RDX: ffff888100283280 RSI: ffffffff85bf7667 RDI: ffffffff85bf7651
[ 45.451476][ C1] RBP: ffff8881015a2064 R08: 0000000000000001 R09: 0000000000000001
[ 45.459457][ C1] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
[ 45.467419][ C1] R13: ffff8881015a2000 R14: ffff8881015a2064 R15: ffff888103730804
[ 45.475395][ C1] ? acpi_idle_do_entry+0x1c7/0x250
[ 45.480620][ C1] ? acpi_idle_do_entry+0x1b1/0x250
[ 45.485827][ C1] ? acpi_idle_do_entry+0x1c7/0x250
[ 45.491017][ C1] acpi_idle_enter+0x337/0x490
[ 45.495775][ C1] cpuidle_enter_state+0x1a2/0xa80
[ 45.500874][ C1] ? tick_nohz_idle_stop_tick+0x526/0xa90
[ 45.506576][ C1] cpuidle_enter+0x4a/0xa0
[ 45.510979][ C1] do_idle+0x3d5/0x580
[ 45.515032][ C1] ? arch_cpu_idle_exit+0x40/0x40
[ 45.520054][ C1] ? lockdep_hardirqs_on_prepare+0x273/0x3e0
[ 45.526036][ C1] ? _raw_spin_unlock_irqrestore+0x34/0x40
[ 45.531841][ C1] ? trace_hardirqs_on+0x5b/0x1a0
[ 45.536867][ C1] cpu_startup_entry+0x14/0x20
[ 45.541621][ C1] start_secondary+0x25b/0x320
[ 45.546374][ C1] ? set_cpu_sibling_map+0x1ff0/0x1ff0
[ 45.551822][ C1] secondary_startup_64_no_verify+0xb8/0xbb
[ 45.557711][ C1]
[ 45.560030][ C1] The buggy address belongs to the page:
[ 45.565669][ C1] page:00000000aea1c8a6 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10d620
[ 45.575908][ C1] head:00000000aea1c8a6 order:3 compound_mapcount:0 compound_pincount:0
[ 45.584222][ C1] flags: 0x200000000010000(head)
[ 45.589163][ C1] raw: 0200000000010000 dead000000000100 dead000000000122 0000000000000000
[ 45.597855][ C1] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[ 45.606441][ C1] page dumped because: kasan: bad access detected
[ 45.612848][ C1]
[ 45.615157][ C1] Memory state around the buggy address:
[ 45.620772][ C1] ffff88810d627f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 45.628875][ C1] ffff88810d627f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 45.636941][ C1] >ffff88810d628000: fa fb fb fb fb fb fb fb fb fb fc fc fc fc fa fb
[ 45.645002][ C1] ^
[ 45.649228][ C1] ffff88810d628080: fb fb fb fb fb fb fb fb fc fc fc fc fa fb fb fb
[ 45.657275][ C1] ffff88810d628100: fb fb fb fb fb fb fc fc fc fc fa fb fb fb fb fb
[ 45.665329][ C1] ==================================================================
[ 45.673389][ C1] Disabling lock debugging due to kernel taint
[ 45.679559][ C1] Kernel panic - not syncing: panic_on_warn set ...
[ 45.686137][ C1] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G B 5.9.0-syzkaller #0
[ 45.695059][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 45.705109][ C1] Call Trace:
[ 45.708388][ C1]
[ 45.711234][ C1] dump_stack+0x107/0x163
[ 45.715579][ C1] ? ath9k_hif_usb_rx_cb+0x2b0/0xf80
[ 45.721026][ C1] panic+0x2cb/0x702
[ 45.724912][ C1] ? __warn_printk+0xf3/0xf3
[ 45.729491][ C1] ? do_raw_spin_unlock+0x50/0x1f0
[ 45.736341][ C1] ? ath9k_hif_usb_rx_cb+0x3a8/0xf80
[ 45.741616][ C1] ? ath9k_hif_usb_rx_cb+0x3a8/0xf80
[ 45.746890][ C1] end_report+0x58/0x5e
[ 45.751053][ C1] kasan_report.cold+0x72/0x7c
[ 45.755824][ C1] ? rwlock_bug.part.0+0x40/0x90
[ 45.760772][ C1] ? ath9k_hif_usb_rx_cb+0x3a8/0xf80
[ 45.766140][ C1] check_memory_region+0xf4/0x1c0
[ 45.771165][ C1] memcpy+0x20/0x60
[ 45.774993][ C1] ath9k_hif_usb_rx_cb+0x3a8/0xf80
[ 45.780198][ C1] ? lock_acquire+0x1a7/0x830
[ 45.784889][ C1] ? kcov_remote_start+0xce/0x400
[ 45.789915][ C1] ? hif_usb_start+0xa0/0xa0
[ 45.794519][ C1] ? __usb_hcd_giveback_urb+0x302/0x560
[ 45.800064][ C1] ? lock_downgrade+0x6d0/0x6d0
[ 45.804928][ C1] __usb_hcd_giveback_urb+0x32d/0x560
[ 45.810305][ C1] usb_hcd_giveback_urb+0x367/0x410
[ 45.815502][ C1] dummy_timer+0x11f2/0x3240
[ 45.820106][ C1] ? __lock_acquire+0x16ae/0x5a60
[ 45.825135][ C1] ? dummy_dequeue+0x4c0/0x4c0
[ 45.829907][ C1] ? dummy_dequeue+0x4c0/0x4c0
[ 45.834668][ C1] call_timer_fn+0x1a5/0x630
[ 45.839249][ C1] ? timer_fixup_init+0x60/0x60
[ 45.844091][ C1] ? lock_downgrade+0x6d0/0x6d0
[ 45.848939][ C1] ? lockdep_hardirqs_on_prepare+0x129/0x3e0
[ 45.854924][ C1] ? dummy_dequeue+0x4c0/0x4c0
[ 45.859686][ C1] __run_timers.part.0+0x67c/0xa10
[ 45.864786][ C1] ? call_timer_fn+0x630/0x630
[ 45.869543][ C1] ? lapic_next_event+0x4d/0x80
[ 45.874392][ C1] ? clockevents_program_event+0x12b/0x350
[ 45.880192][ C1] ? tick_program_event+0xa8/0x130
[ 45.885296][ C1] ? hrtimer_interrupt+0x6c0/0x8f0
[ 45.890406][ C1] run_timer_softirq+0x80/0x120
[ 45.895251][ C1] __do_softirq+0x1b1/0x8d1
[ 45.899753][ C1] asm_call_irq_on_stack+0xf/0x20
[ 45.904770][ C1]
[ 45.907706][ C1] do_softirq_own_stack+0x80/0xa0
[ 45.912720][ C1] irq_exit_rcu+0x110/0x1a0
[ 45.917233][ C1] sysvec_apic_timer_interrupt+0x43/0xa0
[ 45.922865][ C1] asm_sysvec_apic_timer_interrupt+0x12/0x20
[ 45.930337][ C1] RIP: 0010:acpi_idle_do_entry+0x1c9/0x250
[ 45.936138][ C1] Code: bd d6 7f fb 84 db 75 ac e8 44 de 7f fb e8 1f 72 85 fb e9 0c 00 00 00 e8 35 de 7f fb 0f 00 2d de 88 65 00 e8 29 de 7f fb fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 e4 d6 7f fb 48 85 db
[ 45.955742][ C1] RSP: 0018:ffff88810029fd18 EFLAGS: 00000293
[ 45.961802][ C1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 1ffffffff103b869
[ 45.969766][ C1] RDX: ffff888100283280 RSI: ffffffff85bf7667 RDI: ffffffff85bf7651
[ 45.977858][ C1] RBP: ffff8881015a2064 R08: 0000000000000001 R09: 0000000000000001
[ 45.985827][ C1] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
[ 45.993793][ C1] R13: ffff8881015a2000 R14: ffff8881015a2064 R15: ffff888103730804
[ 46.001766][ C1] ? acpi_idle_do_entry+0x1c7/0x250
[ 46.006954][ C1] ? acpi_idle_do_entry+0x1b1/0x250
[ 46.012161][ C1] ? acpi_idle_do_entry+0x1c7/0x250
[ 46.017368][ C1] acpi_idle_enter+0x337/0x490
[ 46.022135][ C1] cpuidle_enter_state+0x1a2/0xa80
[ 46.027239][ C1] ? tick_nohz_idle_stop_tick+0x526/0xa90
[ 46.032953][ C1] cpuidle_enter+0x4a/0xa0
[ 46.037369][ C1] do_idle+0x3d5/0x580
[ 46.041449][ C1] ? arch_cpu_idle_exit+0x40/0x40
[ 46.046484][ C1] ? lockdep_hardirqs_on_prepare+0x273/0x3e0
[ 46.052457][ C1] ? _raw_spin_unlock_irqrestore+0x34/0x40
[ 46.058346][ C1] ? trace_hardirqs_on+0x5b/0x1a0
[ 46.063460][ C1] cpu_startup_entry+0x14/0x20
[ 46.068223][ C1] start_secondary+0x25b/0x320
[ 46.072985][ C1] ? set_cpu_sibling_map+0x1ff0/0x1ff0
[ 46.078443][ C1] secondary_startup_64_no_verify+0xb8/0xbb
[ 46.084778][ C1] Kernel Offset: disabled
[ 46.089115][ C1] Rebooting in 86400 seconds..