Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.74' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 70.755454][ T2953] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 71.315484][ T2953] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 71.324791][ T2953] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 71.333766][ T2953] usb 1-1: Product: syz [ 71.338591][ T2953] usb 1-1: Manufacturer: syz [ 71.343217][ T2953] usb 1-1: SerialNumber: syz [ 71.400999][ T2953] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 72.015392][ T2953] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 72.455417][ C1] ================================================================== [ 72.463777][ C1] BUG: KASAN: slab-out-of-bounds in ath9k_hif_usb_rx_cb+0x3d3/0x1050 [ 72.471867][ C1] Read of size 49085 at addr ffff888012f00000 by task swapper/1/0 [ 72.479664][ C1] [ 72.481977][ C1] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.12.0-rc6-next-20210408-syzkaller #0 [ 72.491177][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 72.501222][ C1] Call Trace: [ 72.504510][ C1] [ 72.507344][ C1] dump_stack+0x141/0x1d7 [ 72.511682][ C1] ? ath9k_hif_usb_rx_cb+0x3d3/0x1050 [ 72.517051][ C1] print_address_description.constprop.0.cold+0x5b/0x2f8 [ 72.524089][ C1] ? ath9k_hif_usb_rx_cb+0x3d3/0x1050 [ 72.529457][ C1] ? ath9k_hif_usb_rx_cb+0x3d3/0x1050 [ 72.534824][ C1] kasan_report.cold+0x7c/0xd8 [ 72.539584][ C1] ? rwlock_bug.part.0+0x30/0x90 [ 72.544520][ C1] ? ath9k_hif_usb_rx_cb+0x3d3/0x1050 [ 72.549890][ C1] kasan_check_range+0x13d/0x180 [ 72.554827][ C1] memcpy+0x20/0x60 [ 72.558633][ C1] ath9k_hif_usb_rx_cb+0x3d3/0x1050 [ 72.563841][ C1] ? hif_usb_start+0xa0/0xa0 [ 72.568430][ C1] ? __usb_hcd_giveback_urb+0x413/0x5c0 [ 72.573987][ C1] ? lock_downgrade+0x6e0/0x6e0 [ 72.578860][ C1] __usb_hcd_giveback_urb+0x2b0/0x5c0 [ 72.584231][ C1] usb_hcd_giveback_urb+0x367/0x410 [ 72.589432][ C1] dummy_timer+0x11f4/0x32a0 [ 72.594064][ C1] ? dummy_dequeue+0x500/0x500 [ 72.598829][ C1] ? dummy_dequeue+0x500/0x500 [ 72.603589][ C1] call_timer_fn+0x1a5/0x6b0 [ 72.608189][ C1] ? add_timer_on+0x4a0/0x4a0 [ 72.612864][ C1] ? lock_downgrade+0x6e0/0x6e0 [ 72.617741][ C1] ? _find_next_bit+0x1e3/0x260 [ 72.622593][ C1] ? _raw_spin_unlock_irq+0x1f/0x40 [ 72.627808][ C1] ? dummy_dequeue+0x500/0x500 [ 72.632591][ C1] __run_timers.part.0+0x67c/0xa50 [ 72.637704][ C1] ? call_timer_fn+0x6b0/0x6b0 [ 72.642476][ C1] ? lapic_next_event+0x4d/0x80 [ 72.647326][ C1] ? kvm_sched_clock_read+0x14/0x40 [ 72.652517][ C1] ? sched_clock_cpu+0x18/0x1f0 [ 72.657367][ C1] run_timer_softirq+0xb3/0x1d0 [ 72.662225][ C1] __do_softirq+0x29b/0x9fe [ 72.667957][ C1] __irq_exit_rcu+0x136/0x200 [ 72.672642][ C1] irq_exit_rcu+0x5/0x20 [ 72.676881][ C1] sysvec_apic_timer_interrupt+0x93/0xc0 [ 72.682521][ C1] [ 72.685463][ C1] asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 72.691447][ C1] RIP: 0010:acpi_idle_do_entry+0x1c9/0x250 [ 72.697257][ C1] Code: 6d 0d 62 f8 84 db 75 ac e8 b4 06 62 f8 e8 7f 0c 68 f8 e9 0c 00 00 00 e8 a5 06 62 f8 0f 00 2d 0e aa bb 00 e8 99 06 62 f8 fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 a4 0e 62 f8 48 85 db [ 72.716862][ C1] RSP: 0018:ffffc90000d57d18 EFLAGS: 00000293 [ 72.722937][ C1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 72.730900][ C1] RDX: ffff888011c05580 RSI: ffffffff89122937 RDI: 0000000000000000 [ 72.738861][ C1] RBP: ffff88801560b864 R08: 0000000000000001 R09: 0000000000000001 [ 72.746916][ C1] R10: ffffffff817a35d8 R11: 0000000000000000 R12: 0000000000000001 [ 72.754878][ C1] R13: ffff88801560b800 R14: ffff88801560b864 R15: ffff8881419a5804 [ 72.762854][ C1] ? trace_hardirqs_on+0x38/0x1c0 [ 72.767897][ C1] ? acpi_idle_do_entry+0x1c7/0x250 [ 72.773097][ C1] ? acpi_idle_do_entry+0x1c7/0x250 [ 72.778292][ C1] acpi_idle_enter+0x361/0x500 [ 72.783061][ C1] cpuidle_enter_state+0x1b1/0xc80 [ 72.788189][ C1] cpuidle_enter+0x4a/0xa0 [ 72.792617][ C1] do_idle+0x3e8/0x590 [ 72.796696][ C1] ? arch_cpu_idle_exit+0x30/0x30 [ 72.801751][ C1] ? _raw_spin_unlock_irqrestore+0x40/0x70 [ 72.807572][ C1] ? lockdep_hardirqs_on+0x79/0x100 [ 72.812782][ C1] cpu_startup_entry+0x14/0x20 [ 72.817683][ C1] start_secondary+0x274/0x350 [ 72.822455][ C1] ? set_cpu_sibling_map+0x2620/0x2620 [ 72.827922][ C1] secondary_startup_64_no_verify+0xb0/0xbb [ 72.833826][ C1] [ 72.836136][ C1] The buggy address belongs to the page: [ 72.841752][ C1] page:ffffea00004bc000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12f00 [ 72.851915][ C1] head:ffffea00004bc000 order:3 compound_mapcount:0 compound_pincount:0 [ 72.860243][ C1] flags: 0xfff00000010000(head|node=0|zone=1|lastcpupid=0x7ff) [ 72.867792][ C1] raw: 00fff00000010000 dead000000000100 dead000000000122 0000000000000000 [ 72.876370][ C1] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 72.884949][ C1] page dumped because: kasan: bad access detected [ 72.891349][ C1] [ 72.893661][ C1] Memory state around the buggy address: [ 72.899291][ C1] ffff888012f08f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 72.907358][ C1] ffff888012f09000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 72.915409][ C1] >ffff888012f09080: 00 00 00 00 00 fc fc fc fc fc fc fc fc 00 00 00 [ 72.923457][ C1] ^ [ 72.928810][ C1] ffff888012f09100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 72.936862][ C1] ffff888012f09180: 00 00 fc fc fc fc fc fc fc fc 00 00 00 00 00 00 [ 72.944915][ C1] ================================================================== [ 72.952971][ C1] Disabling lock debugging due to kernel taint [ 72.959118][ C1] Kernel panic - not syncing: panic_on_warn set ... [ 72.965683][ C1] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G B 5.12.0-rc6-next-20210408-syzkaller #0 [ 72.976266][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 72.986319][ C1] Call Trace: [ 72.989582][ C1] [ 72.992412][ C1] dump_stack+0x141/0x1d7 [ 72.996749][ C1] panic+0x306/0x73d [ 73.000646][ C1] ? __warn_printk+0xf3/0xf3 [ 73.005254][ C1] ? ath9k_hif_usb_rx_cb+0x3d3/0x1050 [ 73.010628][ C1] ? ath9k_hif_usb_rx_cb+0x3d3/0x1050 [ 73.016010][ C1] end_report.cold+0x5a/0x5a [ 73.020592][ C1] kasan_report.cold+0x6a/0xd8 [ 73.025348][ C1] ? rwlock_bug.part.0+0x30/0x90 [ 73.030280][ C1] ? ath9k_hif_usb_rx_cb+0x3d3/0x1050 [ 73.035646][ C1] kasan_check_range+0x13d/0x180 [ 73.040578][ C1] memcpy+0x20/0x60 [ 73.044380][ C1] ath9k_hif_usb_rx_cb+0x3d3/0x1050 [ 73.049588][ C1] ? hif_usb_start+0xa0/0xa0 [ 73.054172][ C1] ? __usb_hcd_giveback_urb+0x413/0x5c0 [ 73.059723][ C1] ? lock_downgrade+0x6e0/0x6e0 [ 73.064583][ C1] __usb_hcd_giveback_urb+0x2b0/0x5c0 [ 73.069962][ C1] usb_hcd_giveback_urb+0x367/0x410 [ 73.075159][ C1] dummy_timer+0x11f4/0x32a0 [ 73.079752][ C1] ? dummy_dequeue+0x500/0x500 [ 73.084510][ C1] ? dummy_dequeue+0x500/0x500 [ 73.089267][ C1] call_timer_fn+0x1a5/0x6b0 [ 73.093844][ C1] ? add_timer_on+0x4a0/0x4a0 [ 73.098521][ C1] ? lock_downgrade+0x6e0/0x6e0 [ 73.103362][ C1] ? _find_next_bit+0x1e3/0x260 [ 73.108201][ C1] ? _raw_spin_unlock_irq+0x1f/0x40 [ 73.113395][ C1] ? dummy_dequeue+0x500/0x500 [ 73.118153][ C1] __run_timers.part.0+0x67c/0xa50 [ 73.123254][ C1] ? call_timer_fn+0x6b0/0x6b0 [ 73.128006][ C1] ? lapic_next_event+0x4d/0x80 [ 73.132852][ C1] ? kvm_sched_clock_read+0x14/0x40 [ 73.138037][ C1] ? sched_clock_cpu+0x18/0x1f0 [ 73.142876][ C1] run_timer_softirq+0xb3/0x1d0 [ 73.147803][ C1] __do_softirq+0x29b/0x9fe [ 73.152298][ C1] __irq_exit_rcu+0x136/0x200 [ 73.156964][ C1] irq_exit_rcu+0x5/0x20 [ 73.161209][ C1] sysvec_apic_timer_interrupt+0x93/0xc0 [ 73.166841][ C1] [ 73.169776][ C1] asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 73.175748][ C1] RIP: 0010:acpi_idle_do_entry+0x1c9/0x250 [ 73.181550][ C1] Code: 6d 0d 62 f8 84 db 75 ac e8 b4 06 62 f8 e8 7f 0c 68 f8 e9 0c 00 00 00 e8 a5 06 62 f8 0f 00 2d 0e aa bb 00 e8 99 06 62 f8 fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 a4 0e 62 f8 48 85 db [ 73.201161][ C1] RSP: 0018:ffffc90000d57d18 EFLAGS: 00000293 [ 73.207217][ C1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 73.215177][ C1] RDX: ffff888011c05580 RSI: ffffffff89122937 RDI: 0000000000000000 [ 73.223135][ C1] RBP: ffff88801560b864 R08: 0000000000000001 R09: 0000000000000001 [ 73.231093][ C1] R10: ffffffff817a35d8 R11: 0000000000000000 R12: 0000000000000001 [ 73.239065][ C1] R13: ffff88801560b800 R14: ffff88801560b864 R15: ffff8881419a5804 [ 73.247025][ C1] ? trace_hardirqs_on+0x38/0x1c0 [ 73.252046][ C1] ? acpi_idle_do_entry+0x1c7/0x250 [ 73.257242][ C1] ? acpi_idle_do_entry+0x1c7/0x250 [ 73.262437][ C1] acpi_idle_enter+0x361/0x500 [ 73.267209][ C1] cpuidle_enter_state+0x1b1/0xc80 [ 73.272315][ C1] cpuidle_enter+0x4a/0xa0 [ 73.276721][ C1] do_idle+0x3e8/0x590 [ 73.280783][ C1] ? arch_cpu_idle_exit+0x30/0x30 [ 73.285798][ C1] ? _raw_spin_unlock_irqrestore+0x40/0x70 [ 73.291615][ C1] ? lockdep_hardirqs_on+0x79/0x100 [ 73.296806][ C1] cpu_startup_entry+0x14/0x20 [ 73.301560][ C1] start_secondary+0x274/0x350 [ 73.306362][ C1] ? set_cpu_sibling_map+0x2620/0x2620 [ 73.311815][ C1] secondary_startup_64_no_verify+0xb0/0xbb [ 73.318176][ C1] Kernel Offset: disabled [ 73.322486][ C1] Rebooting in 86400 seconds..