[[0;32m OK [0m] Reached target Graphical Interface.
Starting Update UTMP about System Runlevel Changes...
[[0;32m OK [0m] Listening on Load/Save RF Kill Switch Status /dev/rfkill Watch.
Starting Load/Save RF Kill Switch Status...
[[0;32m OK [0m] Started Update UTMP about System Runlevel Changes.
[ 15.272349][ C1] random: crng init done
[ 15.273931][ C1] random: 7 urandom warning(s) missed due to ratelimiting
Debian GNU/Linux 9 syzkaller ttyS0
Warning: Permanently added '10.128.15.195' (ECDSA) to the list of known hosts.
executing program
syzkaller login: [ 22.507346][ T83] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[ 22.877090][ T83] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 22.886231][ T83] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 22.894591][ T83] usb 1-1: Product: syz
[ 22.898867][ T83] usb 1-1: Manufacturer: syz
[ 22.903486][ T83] usb 1-1: SerialNumber: syz
[ 22.947925][ T83] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 23.676336][ T83] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
executing program
[ 24.078134][ T17] usb 1-1: USB disconnect, device number 2
[ 24.735647][ T83] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive
[ 24.742727][ T83] ath9k_htc: Failed to initialize the device
[ 24.749517][ T17] usb 1-1: ath9k_htc: USB layer deinitialized
[ 25.115128][ T17] usb 1-1: new high-speed USB device number 3 using dummy_hcd
[ 25.495014][ T17] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 25.504063][ T17] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 25.512099][ T17] usb 1-1: Product: syz
[ 25.516411][ T17] usb 1-1: Manufacturer: syz
[ 25.520991][ T17] usb 1-1: SerialNumber: syz
[ 25.565767][ T17] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 26.134501][ T17] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[ 26.354361][ C1] ==================================================================
[ 26.362530][ C1] BUG: KASAN: use-after-free in ath9k_htc_rx_msg+0xa25/0xaf0
[ 26.369894][ C1] Write of size 2 at addr ffff8881cea291f0 by task swapper/1/0
[ 26.377415][ C1]
[ 26.379751][ C1] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.6.0-rc5-syzkaller #0
[ 26.387622][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 26.397692][ C1] Call Trace:
[ 26.400973][ C1]
[ 26.403810][ C1] dump_stack+0xef/0x16e
[ 26.408034][ C1] ? ath9k_htc_rx_msg+0xa25/0xaf0
[ 26.413053][ C1] ? ath9k_htc_rx_msg+0xa25/0xaf0
[ 26.418060][ C1] print_address_description.constprop.0.cold+0xd3/0x314
[ 26.425088][ C1] ? ath9k_htc_rx_msg+0xa25/0xaf0
[ 26.430101][ C1] ? ath9k_htc_rx_msg+0xa25/0xaf0
[ 26.435120][ C1] __kasan_report.cold+0x37/0x77
[ 26.440038][ C1] ? do_raw_spin_lock+0x61/0x290
[ 26.444968][ C1] ? ath9k_htc_rx_msg+0xa25/0xaf0
[ 26.449978][ C1] kasan_report+0xe/0x20
[ 26.454203][ C1] ath9k_htc_rx_msg+0xa25/0xaf0
[ 26.459072][ C1] ath9k_hif_usb_reg_in_cb+0x1ba/0x630
[ 26.464518][ C1] ? trace_hardirqs_off+0x50/0x200
[ 26.469623][ C1] __usb_hcd_giveback_urb+0x29a/0x550
[ 26.474990][ C1] usb_hcd_giveback_urb+0x368/0x420
[ 26.480182][ C1] dummy_timer+0x1258/0x32ae
[ 26.484755][ C1] ? dummy_udc_probe+0x930/0x930
[ 26.489676][ C1] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 26.495202][ C1] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 26.500465][ C1] call_timer_fn+0x195/0x6f0
[ 26.505038][ C1] ? dummy_udc_probe+0x930/0x930
[ 26.510001][ C1] ? msleep_interruptible+0x130/0x130
[ 26.515360][ C1] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 26.520891][ C1] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 26.526157][ C1] ? _raw_spin_unlock_irq+0x1f/0x30
[ 26.531334][ C1] ? dummy_udc_probe+0x930/0x930
[ 26.536252][ C1] run_timer_softirq+0x5f9/0x1500
[ 26.541257][ C1] ? add_timer+0x7a0/0x7a0
[ 26.545656][ C1] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 26.551179][ C1] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 26.556459][ C1] __do_softirq+0x21e/0x950
[ 26.560978][ C1] irq_exit+0x178/0x1a0
[ 26.565114][ C1] smp_apic_timer_interrupt+0x141/0x540
[ 26.570728][ C1] apic_timer_interrupt+0xf/0x20
[ 26.575640][ C1]
[ 26.578559][ C1] RIP: 0010:default_idle+0x28/0x300
[ 26.583740][ C1] Code: cc cc 41 56 41 55 65 44 8b 2d 44 77 72 7a 41 54 55 53 0f 1f 44 00 00 e8 b6 62 b5 fb e9 07 00 00 00 0f 00 2d ea 0c 53 00 fb f4 <65> 44 8b 2d 20 77 72 7a 0f 1f 44 00 00 5b 5d 41 5c 41 5d 41 5e c3
[ 26.603327][ C1] RSP: 0018:ffff8881da22fda8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
[ 26.611719][ C1] RAX: 0000000000000007 RBX: ffff8881da213100 RCX: 0000000000000000
[ 26.619670][ C1] RDX: 0000000000000000 RSI: 0000000000000006 RDI: ffff8881da21394c
[ 26.627638][ C1] RBP: ffffed103b442620 R08: ffff8881da213100 R09: 0000000000000000
[ 26.635597][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001
[ 26.643571][ C1] R13: 0000000000000001 R14: ffffffff87e607c0 R15: 0000000000000000
[ 26.651555][ C1] ? default_idle+0x1a/0x300
[ 26.656139][ C1] do_idle+0x3e0/0x500
[ 26.660189][ C1] ? arch_cpu_idle_exit+0x40/0x40
[ 26.665231][ C1] cpu_startup_entry+0x14/0x20
[ 26.669990][ C1] start_secondary+0x2a4/0x390
[ 26.674740][ C1] ? set_cpu_sibling_map+0x1e90/0x1e90
[ 26.680194][ C1] secondary_startup_64+0xb6/0xc0
[ 26.685189][ C1]
[ 26.687531][ C1] Allocated by task 371:
[ 26.691788][ C1] save_stack+0x1b/0x80
[ 26.695928][ C1] __kasan_kmalloc.constprop.0+0xbf/0xd0
[ 26.701542][ C1] raw_alloc_io_data+0x150/0x1c0
[ 26.706588][ C1] raw_ioctl+0x686/0x1a70
[ 26.710916][ C1] ksys_ioctl+0x11a/0x180
[ 26.715224][ C1] __x64_sys_ioctl+0x6f/0xb0
[ 26.719839][ C1] do_syscall_64+0xb6/0x5a0
[ 26.724375][ C1] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 26.730255][ C1]
[ 26.732567][ C1] Freed by task 371:
[ 26.736453][ C1] save_stack+0x1b/0x80
[ 26.740600][ C1] __kasan_slab_free+0x117/0x160
[ 26.745535][ C1] kfree+0xd5/0x300
[ 26.749358][ C1] raw_ioctl+0x189/0x1a70
[ 26.753665][ C1] ksys_ioctl+0x11a/0x180
[ 26.757971][ C1] __x64_sys_ioctl+0x6f/0xb0
[ 26.762541][ C1] do_syscall_64+0xb6/0x5a0
[ 26.767022][ C1] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 26.772885][ C1]
[ 26.775206][ C1] The buggy address belongs to the object at ffff8881cea29000
[ 26.775206][ C1] which belongs to the cache kmalloc-2k of size 2048
[ 26.789264][ C1] The buggy address is located 496 bytes inside of
[ 26.789264][ C1] 2048-byte region [ffff8881cea29000, ffff8881cea29800)
[ 26.802646][ C1] The buggy address belongs to the page:
[ 26.808264][ C1] page:ffffea00073a8a00 refcount:1 mapcount:0 mapping:ffff8881da00c000 index:0x0 compound_mapcount: 0
[ 26.819176][ C1] flags: 0x200000000010200(slab|head)
[ 26.824581][ C1] raw: 0200000000010200 dead000000000100 dead000000000122 ffff8881da00c000
[ 26.833271][ C1] raw: 0000000000000000 0000000080080008 00000001ffffffff 0000000000000000
[ 26.841833][ C1] page dumped because: kasan: bad access detected
[ 26.848257][ C1]
[ 26.850576][ C1] Memory state around the buggy address:
[ 26.856195][ C1] ffff8881cea29080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 26.864237][ C1] ffff8881cea29100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 26.872420][ C1] >ffff8881cea29180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 26.880511][ C1] ^
[ 26.888239][ C1] ffff8881cea29200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 26.896333][ C1] ffff8881cea29280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 26.904375][ C1] ==================================================================
[ 26.912432][ C1] Disabling lock debugging due to kernel taint
[ 26.918587][ C1] Kernel panic - not syncing: panic_on_warn set ...
[ 26.925169][ C1] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G B 5.6.0-rc5-syzkaller #0
[ 26.934431][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 26.944488][ C1] Call Trace:
[ 26.947759][ C1]
[ 26.950596][ C1] dump_stack+0xef/0x16e
[ 26.954820][ C1] panic+0x2aa/0x6e1
[ 26.958694][ C1] ? add_taint.cold+0x16/0x16
[ 26.963351][ C1] ? print_shadow_for_address+0xb8/0x114
[ 26.968965][ C1] ? trace_hardirqs_off+0x50/0x200
[ 26.974082][ C1] ? ath9k_htc_rx_msg+0xa25/0xaf0
[ 26.979124][ C1] end_report+0x43/0x49
[ 26.983266][ C1] ? ath9k_htc_rx_msg+0xa25/0xaf0
[ 26.988271][ C1] __kasan_report.cold+0x55/0x77
[ 26.993191][ C1] ? do_raw_spin_lock+0x61/0x290
[ 26.998108][ C1] ? ath9k_htc_rx_msg+0xa25/0xaf0
[ 27.003121][ C1] kasan_report+0xe/0x20
[ 27.007341][ C1] ath9k_htc_rx_msg+0xa25/0xaf0
[ 27.012170][ C1] ath9k_hif_usb_reg_in_cb+0x1ba/0x630
[ 27.017654][ C1] ? trace_hardirqs_off+0x50/0x200
[ 27.022745][ C1] __usb_hcd_giveback_urb+0x29a/0x550
[ 27.028094][ C1] usb_hcd_giveback_urb+0x368/0x420
[ 27.033287][ C1] dummy_timer+0x1258/0x32ae
[ 27.037873][ C1] ? dummy_udc_probe+0x930/0x930
[ 27.042808][ C1] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 27.048331][ C1] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 27.053603][ C1] call_timer_fn+0x195/0x6f0
[ 27.058246][ C1] ? dummy_udc_probe+0x930/0x930
[ 27.063177][ C1] ? msleep_interruptible+0x130/0x130
[ 27.068530][ C1] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 27.074072][ C1] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 27.079334][ C1] ? _raw_spin_unlock_irq+0x1f/0x30
[ 27.084512][ C1] ? dummy_udc_probe+0x930/0x930
[ 27.089427][ C1] run_timer_softirq+0x5f9/0x1500
[ 27.094434][ C1] ? add_timer+0x7a0/0x7a0
[ 27.098880][ C1] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 27.104415][ C1] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 27.109682][ C1] __do_softirq+0x21e/0x950
[ 27.114168][ C1] irq_exit+0x178/0x1a0
[ 27.118316][ C1] smp_apic_timer_interrupt+0x141/0x540
[ 27.123838][ C1] apic_timer_interrupt+0xf/0x20
[ 27.128764][ C1]
[ 27.131690][ C1] RIP: 0010:default_idle+0x28/0x300
[ 27.136877][ C1] Code: cc cc 41 56 41 55 65 44 8b 2d 44 77 72 7a 41 54 55 53 0f 1f 44 00 00 e8 b6 62 b5 fb e9 07 00 00 00 0f 00 2d ea 0c 53 00 fb f4 <65> 44 8b 2d 20 77 72 7a 0f 1f 44 00 00 5b 5d 41 5c 41 5d 41 5e c3
[ 27.156477][ C1] RSP: 0018:ffff8881da22fda8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
[ 27.164868][ C1] RAX: 0000000000000007 RBX: ffff8881da213100 RCX: 0000000000000000
[ 27.172833][ C1] RDX: 0000000000000000 RSI: 0000000000000006 RDI: ffff8881da21394c
[ 27.180783][ C1] RBP: ffffed103b442620 R08: ffff8881da213100 R09: 0000000000000000
[ 27.188736][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001
[ 27.196690][ C1] R13: 0000000000000001 R14: ffffffff87e607c0 R15: 0000000000000000
[ 27.204697][ C1] ? default_idle+0x1a/0x300
[ 27.209268][ C1] do_idle+0x3e0/0x500
[ 27.213316][ C1] ? arch_cpu_idle_exit+0x40/0x40
[ 27.218319][ C1] cpu_startup_entry+0x14/0x20
[ 27.223065][ C1] start_secondary+0x2a4/0x390
[ 27.227821][ C1] ? set_cpu_sibling_map+0x1e90/0x1e90
[ 27.233285][ C1] secondary_startup_64+0xb6/0xc0
[ 27.238868][ C1] Kernel Offset: disabled
[ 27.243230][ C1] Rebooting in 86400 seconds..