./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3800986198

<...>
Warning: Permanently added '10.128.0.184' (ECDSA) to the list of known hosts.
execve("./syz-executor3800986198", ["./syz-executor3800986198"], 0x7ffc55a7f5b0 /* 10 vars */) = 0
brk(NULL)                               = 0x55555664d000
brk(0x55555664dc40)                     = 0x55555664dc40
arch_prctl(ARCH_SET_FS, 0x55555664d300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor3800986198", 4096) = 28
brk(0x55555666ec40)                     = 0x55555666ec40
brk(0x55555666f000)                     = 0x55555666f000
mprotect(0x7fac64167000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 3
ioctl(3, USB_RAW_IOCTL_INIT, 0x7ffe25fa82b0) = 0
ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe25fa82b0) = 0
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe25fa82b0) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe25fa72a0) = 18
syzkaller login: [   52.338268][   T14] usb 1-1: new high-speed USB device number 2 using dummy_hcd
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe25fa82b0) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe25fa72a0) = 18
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe25fa82b0) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe25fa72a0) = 9
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe25fa82b0) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe25fa72a0) = 72
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe25fa82b0) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe25fa72a0) = 4
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe25fa82b0) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe25fa72a0) = 8
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe25fa82b0) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe25fa72a0) = 8
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe25fa82b0) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe25fa72a0) = 8
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe25fa82b0) = 0
ioctl(3, USB_RAW_IOCTL_VBUS_DRAW, 0xfa) = 0
ioctl(3, USB_RAW_IOCTL_CONFIGURE, 0)    = 0
ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7fac6416d3ac) = 9
ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7fac6416d3bc) = 10
ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7fac6416d3cc) = 12
ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7fac6416d3dc) = 11
ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7fac6416d3ec) = 13
ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7fac6416d3fc) = 14
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffe25fa72a0) = 0
[   52.858998][   T14] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[   52.868239][   T14] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   52.876219][   T14] usb 1-1: Product: syz
[   52.880631][   T14] usb 1-1: Manufacturer: syz
[   52.885239][   T14] usb 1-1: SerialNumber: syz
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe25fa82b0) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffe25fa72a0) = 4096
[   52.931287][   T14] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe25fa82b0) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffe25fa72a0) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe25fa82b0) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffe25fa72a0) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe25fa82b0) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffe25fa72a0) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe25fa82b0) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffe25fa72a0) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe25fa82b0) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffe25fa72a0) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe25fa82b0) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffe25fa72a0) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe25fa82b0) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffe25fa72a0) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe25fa82b0) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffe25fa72a0) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe25fa82b0) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffe25fa72a0) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe25fa82b0) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffe25fa72a0) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe25fa82b0) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffe25fa72a0) = 4096
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe25fa82b0) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffe25fa72a0) = 1856
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe25fa82b0) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffe25fa72a0) = 0
[   53.538332][  T143] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
ioctl(3, USB_RAW_IOCTL_EP_WRITE, 0x7ffe25fa82f0) = 620
ioctl(3, USB_RAW_IOCTL_EP_WRITE, 0x7ffe25fa82f0) = 620
ioctl(3, USB_RAW_IOCTL_EP_WRITE, 0x7ffe25fa82f0) = 620
ioctl(3, USB_RAW_IOCTL_EP_WRITE, 0x7ffe25fa82f0) = 620
[   54.568455][  T143] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive
[   54.575673][  T143] ath9k_htc: Failed to initialize the device
[   54.638183][    C0] ==================================================================
[   54.646271][    C0] BUG: KASAN: use-after-free in ath9k_hif_usb_rx_cb+0xd17/0x10d0
[   54.653990][    C0] Read of size 4 at addr ffff888074d44454 by task swapper/0/0
[   54.661435][    C0] 
[   54.663749][    C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.19.0-rc4-next-20220628-syzkaller #0
[   54.672933][    C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[   54.682988][    C0] Call Trace:
[   54.686273][    C0]  <IRQ>
[   54.689207][    C0]  dump_stack_lvl+0xcd/0x134
[   54.693818][    C0]  print_report.cold+0x2ba/0x719
[   54.698766][    C0]  ? ath9k_hif_usb_rx_cb+0xd17/0x10d0
[   54.704134][    C0]  kasan_report+0xbe/0x1f0
[   54.709156][    C0]  ? ath9k_hif_usb_rx_cb+0xd17/0x10d0
[   54.714524][    C0]  ath9k_hif_usb_rx_cb+0xd17/0x10d0
[   54.719717][    C0]  ? perf_trace_contention_begin+0x360/0x3a0
[   54.725699][    C0]  ? lock_downgrade+0x6e0/0x6e0
[   54.730545][    C0]  ? hif_usb_start+0xa0/0xa0
[   54.735128][    C0]  ? rwlock_bug.part.0+0x90/0x90
[   54.740090][    C0]  __usb_hcd_giveback_urb+0x2b0/0x5c0
[   54.745469][    C0]  usb_hcd_giveback_urb+0x367/0x410
[   54.750673][    C0]  dummy_timer+0x11ff/0x32c0
[   54.755273][    C0]  ? dummy_dequeue+0x500/0x500
[   54.760034][    C0]  ? dummy_dequeue+0x500/0x500
[   54.764794][    C0]  call_timer_fn+0x1a0/0x6b0
[   54.769379][    C0]  ? timer_fixup_activate+0x350/0x350
[   54.774755][    C0]  ? lock_downgrade+0x6e0/0x6e0
[   54.779603][    C0]  ? _raw_spin_unlock_irq+0x1f/0x40
[   54.784806][    C0]  ? _raw_spin_unlock_irq+0x1f/0x40
[   54.790022][    C0]  ? dummy_dequeue+0x500/0x500
[   54.794783][    C0]  __run_timers.part.0+0x674/0xa80
[   54.799896][    C0]  ? call_timer_fn+0x6b0/0x6b0
[   54.804657][    C0]  ? set_next_task_stop+0x140/0x140
[   54.809850][    C0]  ? kvm_sched_clock_read+0x14/0x40
[   54.815059][    C0]  ? sched_clock_cpu+0x69/0x2b0
[   54.819907][    C0]  run_timer_softirq+0xb3/0x1d0
[   54.824757][    C0]  __do_softirq+0x29b/0x9c2
[   54.829262][    C0]  __irq_exit_rcu+0x123/0x180
[   54.833945][    C0]  irq_exit_rcu+0x5/0x20
[   54.838190][    C0]  sysvec_apic_timer_interrupt+0x93/0xc0
[   54.843825][    C0]  </IRQ>
[   54.846747][    C0]  <TASK>
[   54.849688][    C0]  asm_sysvec_apic_timer_interrupt+0x1b/0x20
[   54.855696][    C0] RIP: 0010:acpi_idle_do_entry+0x1c9/0x240
[   54.861524][    C0] Code: 89 de e8 9a 7a fe f7 84 db 75 98 e8 01 7e fe f7 e8 ec cc 04 f8 66 90 e8 f5 7d fe f7 0f 00 2d 7e 28 b8 00 e8 e9 7d fe f7 fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 c4 7a fe f7 48 85 db
[   54.881125][    C0] RSP: 0018:ffffffff8ba07d38 EFLAGS: 00000293
[   54.887185][    C0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[   54.895148][    C0] RDX: ffffffff8babc980 RSI: ffffffff897c3927 RDI: 0000000000000000
[   54.903127][    C0] RBP: ffff8881455e1064 R08: 0000000000000001 R09: 0000000000000001
[   54.911121][    C0] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
[   54.919093][    C0] R13: ffff8881455e1000 R14: ffff8881455e1064 R15: ffff88814635a004
[   54.927062][    C0]  ? acpi_idle_do_entry+0x1c7/0x240
[   54.932272][    C0]  ? acpi_idle_do_entry+0x1c7/0x240
[   54.937473][    C0]  acpi_idle_enter+0x364/0x500
[   54.942242][    C0]  cpuidle_enter_state+0x1b1/0xc80
[   54.947357][    C0]  cpuidle_enter+0x4a/0xa0
[   54.951777][    C0]  do_idle+0x3e8/0x590
[   54.955843][    C0]  ? arch_cpu_idle_exit+0x30/0x30
[   54.960868][    C0]  cpu_startup_entry+0x14/0x20
[   54.965630][    C0]  rest_init+0x169/0x270
[   54.969877][    C0]  ? trace_init_perf_perm_irq_work_exit+0xe/0xe
[   54.976120][    C0]  arch_call_rest_init+0xf/0x14
[   54.980986][    C0]  start_kernel+0x473/0x494
[   54.985492][    C0]  secondary_startup_64_no_verify+0xce/0xdb
[   54.991392][    C0]  </TASK>
[   54.994399][    C0] 
[   54.996710][    C0] The buggy address belongs to the physical page:
[   55.003107][    C0] page:ffffea0001d35100 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x74d44
[   55.013246][    C0] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[   55.020372][    C0] raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000
[   55.028966][    C0] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[   55.037558][    C0] page dumped because: kasan: bad access detected
[   55.043973][    C0] page_owner tracks the page as freed
[   55.049345][    C0] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x40dc0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO), pid 143, tgid 143 (kworker/0:2), ts 53549627473, free_ts 54575649060
[   55.066966][    C0]  get_page_from_freelist+0x210d/0x3a30
[   55.072512][    C0]  __alloc_pages+0x1c7/0x510
[   55.077098][    C0]  alloc_pages+0x1aa/0x310
[   55.081506][    C0]  kmalloc_order+0x34/0xf0
[   55.086007][    C0]  kmalloc_order_trace+0x13/0x120
[   55.091047][    C0]  wiphy_new_nm+0x6fc/0x2090
[   55.095868][    C0]  ieee80211_alloc_hw_nm+0x428/0x2330
[   55.101253][    C0]  ath9k_htc_probe_device+0x97/0x1f00
[   55.106631][    C0]  ath9k_htc_hw_init+0x31/0x60
[   55.111393][    C0]  ath9k_hif_usb_firmware_cb+0x274/0x530
[   55.117038][    C0]  request_firmware_work_func+0x12c/0x230
[   55.122757][    C0]  process_one_work+0x991/0x1610
[   55.127692][    C0]  worker_thread+0x665/0x1080
[   55.132362][    C0]  kthread+0x2e9/0x3a0
[   55.136423][    C0]  ret_from_fork+0x1f/0x30
[   55.140847][    C0] page last free stack trace:
[   55.145592][    C0]  free_pcp_prepare+0x5e4/0xd20
[   55.150803][    C0]  free_unref_page+0x19/0x4d0
[   55.156231][    C0]  device_release+0x9f/0x240
[   55.161033][    C0]  kobject_put+0x1be/0x4c0
[   55.165565][    C0]  put_device+0x1b/0x30
[   55.169735][    C0]  ath9k_htc_probe_device+0x1c7/0x1f00
[   55.175197][    C0]  ath9k_htc_hw_init+0x31/0x60
[   55.179952][    C0]  ath9k_hif_usb_firmware_cb+0x274/0x530
[   55.185579][    C0]  request_firmware_work_func+0x12c/0x230
[   55.191299][    C0]  process_one_work+0x991/0x1610
[   55.196235][    C0]  worker_thread+0x665/0x1080
[   55.200914][    C0]  kthread+0x2e9/0x3a0
[   55.204975][    C0]  ret_from_fork+0x1f/0x30
[   55.209390][    C0] 
[   55.211704][    C0] Memory state around the buggy address:
[   55.217342][    C0]  ffff888074d44300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   55.225411][    C0]  ffff888074d44380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   55.233466][    C0] >ffff888074d44400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   55.241545][    C0]                                                  ^
[   55.248212][    C0]  ffff888074d44480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   55.256259][    C0]  ffff888074d44500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   55.264308][    C0] ==================================================================
[   55.272351][    C0] Kernel panic - not syncing: panic_on_warn set ...
[   55.279009][    C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.19.0-rc4-next-20220628-syzkaller #0
[   55.288203][    C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[   55.298251][    C0] Call Trace:
[   55.301526][    C0]  <IRQ>
[   55.304363][    C0]  dump_stack_lvl+0xcd/0x134
[   55.308964][    C0]  panic+0x2d7/0x636
[   55.312864][    C0]  ? panic_print_sys_info.part.0+0x10b/0x10b
[   55.318850][    C0]  ? print_report.cold+0x4f6/0x719
[   55.324050][    C0]  ? ath9k_hif_usb_rx_cb+0xd17/0x10d0
[   55.329420][    C0]  end_report.part.0+0x3f/0x7c
[   55.334196][    C0]  kasan_report.cold+0x8/0x12
[   55.338877][    C0]  ? ath9k_hif_usb_rx_cb+0xd17/0x10d0
[   55.344244][    C0]  ath9k_hif_usb_rx_cb+0xd17/0x10d0
[   55.349448][    C0]  ? perf_trace_contention_begin+0x360/0x3a0
[   55.355433][    C0]  ? lock_downgrade+0x6e0/0x6e0
[   55.360275][    C0]  ? hif_usb_start+0xa0/0xa0
[   55.364861][    C0]  ? rwlock_bug.part.0+0x90/0x90
[   55.369809][    C0]  __usb_hcd_giveback_urb+0x2b0/0x5c0
[   55.375188][    C0]  usb_hcd_giveback_urb+0x367/0x410
[   55.380388][    C0]  dummy_timer+0x11ff/0x32c0
[   55.384984][    C0]  ? dummy_dequeue+0x500/0x500
[   55.389750][    C0]  ? dummy_dequeue+0x500/0x500
[   55.394508][    C0]  call_timer_fn+0x1a0/0x6b0
[   55.399094][    C0]  ? timer_fixup_activate+0x350/0x350
[   55.404461][    C0]  ? lock_downgrade+0x6e0/0x6e0
[   55.409305][    C0]  ? _raw_spin_unlock_irq+0x1f/0x40
[   55.414509][    C0]  ? _raw_spin_unlock_irq+0x1f/0x40
[   55.419711][    C0]  ? dummy_dequeue+0x500/0x500
[   55.424557][    C0]  __run_timers.part.0+0x674/0xa80
[   55.429670][    C0]  ? call_timer_fn+0x6b0/0x6b0
[   55.434430][    C0]  ? set_next_task_stop+0x140/0x140
[   55.439620][    C0]  ? kvm_sched_clock_read+0x14/0x40
[   55.444814][    C0]  ? sched_clock_cpu+0x69/0x2b0
[   55.449835][    C0]  run_timer_softirq+0xb3/0x1d0
[   55.454684][    C0]  __do_softirq+0x29b/0x9c2
[   55.459189][    C0]  __irq_exit_rcu+0x123/0x180
[   55.463872][    C0]  irq_exit_rcu+0x5/0x20
[   55.468197][    C0]  sysvec_apic_timer_interrupt+0x93/0xc0
[   55.474014][    C0]  </IRQ>
[   55.476953][    C0]  <TASK>
[   55.479883][    C0]  asm_sysvec_apic_timer_interrupt+0x1b/0x20
[   55.485869][    C0] RIP: 0010:acpi_idle_do_entry+0x1c9/0x240
[   55.491686][    C0] Code: 89 de e8 9a 7a fe f7 84 db 75 98 e8 01 7e fe f7 e8 ec cc 04 f8 66 90 e8 f5 7d fe f7 0f 00 2d 7e 28 b8 00 e8 e9 7d fe f7 fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 c4 7a fe f7 48 85 db
[   55.511288][    C0] RSP: 0018:ffffffff8ba07d38 EFLAGS: 00000293
[   55.517358][    C0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[   55.525318][    C0] RDX: ffffffff8babc980 RSI: ffffffff897c3927 RDI: 0000000000000000
[   55.533280][    C0] RBP: ffff8881455e1064 R08: 0000000000000001 R09: 0000000000000001
[   55.541328][    C0] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
[   55.549290][    C0] R13: ffff8881455e1000 R14: ffff8881455e1064 R15: ffff88814635a004
[   55.557348][    C0]  ? acpi_idle_do_entry+0x1c7/0x240
[   55.562568][    C0]  ? acpi_idle_do_entry+0x1c7/0x240
[   55.567768][    C0]  acpi_idle_enter+0x364/0x500
[   55.572535][    C0]  cpuidle_enter_state+0x1b1/0xc80
[   55.577659][    C0]  cpuidle_enter+0x4a/0xa0
[   55.582076][    C0]  do_idle+0x3e8/0x590
[   55.586151][    C0]  ? arch_cpu_idle_exit+0x30/0x30
[   55.591173][    C0]  cpu_startup_entry+0x14/0x20
[   55.595934][    C0]  rest_init+0x169/0x270
[   55.600184][    C0]  ? trace_init_perf_perm_irq_work_exit+0xe/0xe
[   55.606436][    C0]  arch_call_rest_init+0xf/0x14
[   55.611290][    C0]  start_kernel+0x473/0x494
[   55.615793][    C0]  secondary_startup_64_no_verify+0xce/0xdb
[   55.621692][    C0]  </TASK>
[   55.624879][    C0] Kernel Offset: disabled
[   55.629197][    C0] Rebooting in 86400 seconds..