Warning: Permanently added '10.128.0.200' (ECDSA) to the list of known hosts.
executing program
syzkaller login: [ 83.115208][ T37] audit: type=1400 audit(1617794293.949:8): avc: denied { execmem } for pid=8395 comm="syz-executor509" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
[ 83.394188][ T4808] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[ 83.954253][ T4808] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 83.963509][ T4808] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 83.971749][ T4808] usb 1-1: Product: syz
[ 83.976151][ T4808] usb 1-1: Manufacturer: syz
[ 83.980769][ T4808] usb 1-1: SerialNumber: syz
[ 84.040198][ T4808] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 84.714151][ T4808] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[ 85.144134][ C0] ==================================================================
[ 85.152388][ C0] BUG: KASAN: slab-out-of-bounds in ath9k_hif_usb_rx_cb+0x3d3/0x1050
[ 85.160466][ C0] Read of size 50462 at addr ffff888035310000 by task swapper/0/0
[ 85.168297][ C0]
[ 85.170649][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.12.0-rc6-syzkaller #0
[ 85.178626][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 85.188669][ C0] Call Trace:
[ 85.191948][ C0]
[ 85.194779][ C0] dump_stack+0x141/0x1d7
[ 85.199110][ C0] ? ath9k_hif_usb_rx_cb+0x3d3/0x1050
[ 85.204483][ C0] print_address_description.constprop.0.cold+0x5b/0x2c6
[ 85.211501][ C0] ? ath9k_hif_usb_rx_cb+0x3d3/0x1050
[ 85.216863][ C0] ? ath9k_hif_usb_rx_cb+0x3d3/0x1050
[ 85.222256][ C0] kasan_report.cold+0x7c/0xd8
[ 85.227037][ C0] ? spin_bug+0xc0/0x100
[ 85.231272][ C0] ? ath9k_hif_usb_rx_cb+0x3d3/0x1050
[ 85.236657][ C0] kasan_check_range+0x13d/0x180
[ 85.241588][ C0] memcpy+0x20/0x60
[ 85.245385][ C0] ath9k_hif_usb_rx_cb+0x3d3/0x1050
[ 85.250574][ C0] ? hif_usb_start+0xa0/0xa0
[ 85.255167][ C0] ? __usb_hcd_giveback_urb+0x413/0x5c0
[ 85.260702][ C0] ? lock_downgrade+0x6e0/0x6e0
[ 85.265542][ C0] __usb_hcd_giveback_urb+0x2b0/0x5c0
[ 85.270924][ C0] usb_hcd_giveback_urb+0x367/0x410
[ 85.276112][ C0] dummy_timer+0x11f4/0x32a0
[ 85.280695][ C0] ? dummy_dequeue+0x500/0x500
[ 85.285450][ C0] ? dummy_dequeue+0x500/0x500
[ 85.290217][ C0] call_timer_fn+0x1a5/0x6b0
[ 85.294796][ C0] ? add_timer_on+0x4a0/0x4a0
[ 85.299460][ C0] ? lock_downgrade+0x6e0/0x6e0
[ 85.304311][ C0] ? _raw_spin_unlock_irq+0x1f/0x40
[ 85.309499][ C0] ? dummy_dequeue+0x500/0x500
[ 85.314261][ C0] __run_timers.part.0+0x67c/0xa50
[ 85.319383][ C0] ? call_timer_fn+0x6b0/0x6b0
[ 85.324221][ C0] ? lapic_next_event+0x4d/0x80
[ 85.329075][ C0] ? kvm_sched_clock_read+0x14/0x40
[ 85.334300][ C0] ? sched_clock+0x2a/0x40
[ 85.338704][ C0] ? sched_clock_cpu+0x18/0x1f0
[ 85.343547][ C0] run_timer_softirq+0xb3/0x1d0
[ 85.348387][ C0] __do_softirq+0x29b/0x9f6
[ 85.352889][ C0] irq_exit_rcu+0x134/0x200
[ 85.357382][ C0] sysvec_apic_timer_interrupt+0x93/0xc0
[ 85.363008][ C0]
[ 85.365939][ C0] asm_sysvec_apic_timer_interrupt+0x12/0x20
[ 85.371928][ C0] RIP: 0010:acpi_idle_do_entry+0x1c9/0x250
[ 85.377725][ C0] Code: ed ef 6d f8 84 db 75 ac e8 d4 e7 6d f8 e8 9f d7 73 f8 e9 0c 00 00 00 e8 c5 e7 6d f8 0f 00 2d 1e 73 c7 00 e8 b9 e7 6d f8 fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 64 ee 6d f8 48 85 db
[ 85.397343][ C0] RSP: 0018:ffffffff8bc07d60 EFLAGS: 00000293
[ 85.403398][ C0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 85.411354][ C0] RDX: ffffffff8bcbc400 RSI: ffffffff89053e07 RDI: 0000000000000000
[ 85.419310][ C0] RBP: ffff8880156df064 R08: 0000000000000001 R09: 0000000000000001
[ 85.427362][ C0] R10: ffffffff817915c8 R11: 0000000000000000 R12: 0000000000000001
[ 85.435337][ C0] R13: ffff8880156df000 R14: ffff8880156df064 R15: ffff888018ec6004
[ 85.443294][ C0] ? trace_hardirqs_on+0x38/0x1c0
[ 85.448311][ C0] ? acpi_idle_do_entry+0x1c7/0x250
[ 85.453512][ C0] acpi_idle_enter+0x361/0x500
[ 85.458276][ C0] cpuidle_enter_state+0x1b1/0xc80
[ 85.463392][ C0] cpuidle_enter+0x4a/0xa0
[ 85.467836][ C0] do_idle+0x3e1/0x590
[ 85.471905][ C0] ? arch_cpu_idle_exit+0x30/0x30
[ 85.476925][ C0] ? trace_init_perf_perm_irq_work_exit+0xe/0xe
[ 85.483190][ C0] cpu_startup_entry+0x14/0x20
[ 85.487956][ C0] start_kernel+0x475/0x496
[ 85.492467][ C0] secondary_startup_64_no_verify+0xb0/0xbb
[ 85.498355][ C0]
[ 85.500681][ C0] Allocated by task 4808:
[ 85.505003][ C0] kasan_save_stack+0x1b/0x40
[ 85.509689][ C0] __kasan_kmalloc+0x96/0xc0
[ 85.514613][ C0] __alloc_skb+0xde/0x340
[ 85.518936][ C0] ath9k_hif_usb_alloc_urbs+0x665/0x1040
[ 85.524571][ C0] ath9k_hif_usb_firmware_cb+0x148/0x530
[ 85.530193][ C0] request_firmware_work_func+0x12c/0x230
[ 85.535900][ C0] process_one_work+0x98d/0x1600
[ 85.540823][ C0] worker_thread+0x64c/0x1120
[ 85.545484][ C0] kthread+0x3b1/0x4a0
[ 85.549537][ C0] ret_from_fork+0x1f/0x30
[ 85.554036][ C0]
[ 85.556348][ C0] The buggy address belongs to the object at ffff888035310000
[ 85.556348][ C0] which belongs to the cache kmalloc-32k of size 32768
[ 85.570749][ C0] The buggy address is located 0 bytes inside of
[ 85.570749][ C0] 32768-byte region [ffff888035310000, ffff888035318000)
[ 85.584016][ C0] The buggy address belongs to the page:
[ 85.589637][ C0] page:ffffea0000d4c400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x35310
[ 85.599772][ C0] head:ffffea0000d4c400 order:4 compound_mapcount:0 compound_pincount:0
[ 85.608078][ C0] flags: 0xfff00000010200(slab|head)
[ 85.613368][ C0] raw: 00fff00000010200 ffffea0000ddac08 ffffea0000d4c808 ffff888010840c00
[ 85.621935][ C0] raw: 0000000000000000 ffff888035310000 0000000100000001 0000000000000000
[ 85.630496][ C0] page dumped because: kasan: bad access detected
[ 85.636886][ C0]
[ 85.639195][ C0] Memory state around the buggy address:
[ 85.644820][ C0] ffff888035317f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 85.652863][ C0] ffff888035317f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 85.660906][ C0] >ffff888035318000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 85.668947][ C0] ^
[ 85.673008][ C0] ffff888035318080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 85.681053][ C0] ffff888035318100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 85.689104][ C0] ==================================================================
[ 85.697142][ C0] Disabling lock debugging due to kernel taint
[ 85.703266][ C0] Kernel panic - not syncing: panic_on_warn set ...
[ 85.709839][ C0] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G B 5.12.0-rc6-syzkaller #0
[ 85.719183][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 85.729217][ C0] Call Trace:
[ 85.732478][ C0]
[ 85.735316][ C0] dump_stack+0x141/0x1d7
[ 85.739657][ C0] panic+0x306/0x73d
[ 85.743534][ C0] ? __warn_printk+0xf3/0xf3
[ 85.748111][ C0] ? ath9k_hif_usb_rx_cb+0x3d3/0x1050
[ 85.753489][ C0] ? ath9k_hif_usb_rx_cb+0x3d3/0x1050
[ 85.758871][ C0] end_report.cold+0x5a/0x5a
[ 85.763452][ C0] kasan_report.cold+0x6a/0xd8
[ 85.768217][ C0] ? spin_bug+0xc0/0x100
[ 85.772447][ C0] ? ath9k_hif_usb_rx_cb+0x3d3/0x1050
[ 85.777804][ C0] kasan_check_range+0x13d/0x180
[ 85.782735][ C0] memcpy+0x20/0x60
[ 85.786529][ C0] ath9k_hif_usb_rx_cb+0x3d3/0x1050
[ 85.791716][ C0] ? hif_usb_start+0xa0/0xa0
[ 85.796291][ C0] ? __usb_hcd_giveback_urb+0x413/0x5c0
[ 85.801824][ C0] ? lock_downgrade+0x6e0/0x6e0
[ 85.806658][ C0] __usb_hcd_giveback_urb+0x2b0/0x5c0
[ 85.812018][ C0] usb_hcd_giveback_urb+0x367/0x410
[ 85.817201][ C0] dummy_timer+0x11f4/0x32a0
[ 85.821777][ C0] ? dummy_dequeue+0x500/0x500
[ 85.826527][ C0] ? dummy_dequeue+0x500/0x500
[ 85.831296][ C0] call_timer_fn+0x1a5/0x6b0
[ 85.835871][ C0] ? add_timer_on+0x4a0/0x4a0
[ 85.840846][ C0] ? lock_downgrade+0x6e0/0x6e0
[ 85.845726][ C0] ? _raw_spin_unlock_irq+0x1f/0x40
[ 85.850910][ C0] ? dummy_dequeue+0x500/0x500
[ 85.855753][ C0] __run_timers.part.0+0x67c/0xa50
[ 85.860854][ C0] ? call_timer_fn+0x6b0/0x6b0
[ 85.865607][ C0] ? lapic_next_event+0x4d/0x80
[ 85.870446][ C0] ? kvm_sched_clock_read+0x14/0x40
[ 85.875626][ C0] ? sched_clock+0x2a/0x40
[ 85.880026][ C0] ? sched_clock_cpu+0x18/0x1f0
[ 85.884859][ C0] run_timer_softirq+0xb3/0x1d0
[ 85.889690][ C0] __do_softirq+0x29b/0x9f6
[ 85.894182][ C0] irq_exit_rcu+0x134/0x200
[ 85.898687][ C0] sysvec_apic_timer_interrupt+0x93/0xc0
[ 85.904307][ C0]
[ 85.907235][ C0] asm_sysvec_apic_timer_interrupt+0x12/0x20
[ 85.913198][ C0] RIP: 0010:acpi_idle_do_entry+0x1c9/0x250
[ 85.918987][ C0] Code: ed ef 6d f8 84 db 75 ac e8 d4 e7 6d f8 e8 9f d7 73 f8 e9 0c 00 00 00 e8 c5 e7 6d f8 0f 00 2d 1e 73 c7 00 e8 b9 e7 6d f8 fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 64 ee 6d f8 48 85 db
[ 85.938577][ C0] RSP: 0018:ffffffff8bc07d60 EFLAGS: 00000293
[ 85.944633][ C0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 85.952586][ C0] RDX: ffffffff8bcbc400 RSI: ffffffff89053e07 RDI: 0000000000000000
[ 85.960544][ C0] RBP: ffff8880156df064 R08: 0000000000000001 R09: 0000000000000001
[ 85.968497][ C0] R10: ffffffff817915c8 R11: 0000000000000000 R12: 0000000000000001
[ 85.976465][ C0] R13: ffff8880156df000 R14: ffff8880156df064 R15: ffff888018ec6004
[ 85.984417][ C0] ? trace_hardirqs_on+0x38/0x1c0
[ 85.989434][ C0] ? acpi_idle_do_entry+0x1c7/0x250
[ 85.994624][ C0] acpi_idle_enter+0x361/0x500
[ 85.999375][ C0] cpuidle_enter_state+0x1b1/0xc80
[ 86.004476][ C0] cpuidle_enter+0x4a/0xa0
[ 86.008878][ C0] do_idle+0x3e1/0x590
[ 86.012930][ C0] ? arch_cpu_idle_exit+0x30/0x30
[ 86.017941][ C0] ? trace_init_perf_perm_irq_work_exit+0xe/0xe
[ 86.024168][ C0] cpu_startup_entry+0x14/0x20
[ 86.028915][ C0] start_kernel+0x475/0x496
[ 86.033422][ C0] secondary_startup_64_no_verify+0xb0/0xbb
[ 86.039817][ C0] Kernel Offset: disabled
[ 86.044135][ C0] Rebooting in 86400 seconds..