[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. [ 14.077900][ C1] random: crng init done [ 14.082473][ C1] random: 7 urandom warning(s) missed due to ratelimiting Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.15.197' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 25.377066][ T172] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 25.745986][ T172] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 25.755172][ T172] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.763263][ T172] usb 1-1: Product: syz [ 25.767514][ T172] usb 1-1: Manufacturer: syz [ 25.772098][ T172] usb 1-1: SerialNumber: syz [ 25.816685][ T172] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 26.465281][ T172] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 26.684520][ C1] ================================================================== [ 26.692696][ C1] BUG: KASAN: slab-out-of-bounds in ath9k_htc_rx_msg+0xa25/0xaf0 [ 26.700398][ C1] Write of size 2 at addr ffff8881ce92e850 by task swapper/1/0 [ 26.707955][ C1] [ 26.710272][ C1] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.6.0-rc5-syzkaller #0 [ 26.718147][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 26.728185][ C1] Call Trace: [ 26.731454][ C1] [ 26.734340][ C1] dump_stack+0xef/0x16e [ 26.738585][ C1] ? ath9k_htc_rx_msg+0xa25/0xaf0 [ 26.743598][ C1] ? ath9k_htc_rx_msg+0xa25/0xaf0 [ 26.748606][ C1] print_address_description.constprop.0.cold+0xd3/0x314 [ 26.755730][ C1] ? ath9k_htc_rx_msg+0xa25/0xaf0 [ 26.760760][ C1] ? ath9k_htc_rx_msg+0xa25/0xaf0 [ 26.765787][ C1] __kasan_report.cold+0x37/0x77 [ 26.770810][ C1] ? do_raw_spin_lock+0x61/0x290 [ 26.775725][ C1] ? ath9k_htc_rx_msg+0xa25/0xaf0 [ 26.780726][ C1] kasan_report+0xe/0x20 [ 26.784958][ C1] ath9k_htc_rx_msg+0xa25/0xaf0 [ 26.789795][ C1] ath9k_hif_usb_reg_in_cb+0x1ba/0x630 [ 26.795229][ C1] ? trace_hardirqs_off+0x50/0x200 [ 26.800315][ C1] __usb_hcd_giveback_urb+0x29a/0x550 [ 26.805677][ C1] usb_hcd_giveback_urb+0x368/0x420 [ 26.810852][ C1] dummy_timer+0x1258/0x32ae [ 26.815431][ C1] ? dummy_udc_probe+0x930/0x930 [ 26.820345][ C1] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 26.825873][ C1] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 26.831140][ C1] call_timer_fn+0x195/0x6f