[[0;32m OK [0m] Reached target Multi-User System.
[[0;32m OK [0m] Reached target Graphical Interface.
Starting Update UTMP about System Runlevel Changes...
[[0;32m OK [0m] Started Update UTMP about System Runlevel Changes.
Debian GNU/Linux 9 syzkaller ttyS0
syzkaller login: [ 15.634952][ C1] random: crng init done
[ 15.639449][ C1] random: 7 urandom warning(s) missed due to ratelimiting
Warning: Permanently added '10.128.0.59' (ECDSA) to the list of known hosts.
executing program
[ 22.717962][ T12] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[ 23.087407][ T12] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 23.096556][ T12] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 23.104592][ T12] usb 1-1: Product: syz
[ 23.108850][ T12] usb 1-1: Manufacturer: syz
[ 23.113433][ T12] usb 1-1: SerialNumber: syz
[ 23.158147][ T12] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 23.767025][ T12] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[ 23.986958][ C0] ==================================================================
[ 23.995121][ C0] BUG: KASAN: use-after-free in ath9k_htc_rx_msg+0xa25/0xaf0
[ 24.002471][ C0] Write of size 2 at addr ffff8881cd468450 by task swapper/0/0
[ 24.009990][ C0]
[ 24.012360][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.6.0-rc7-syzkaller #0
[ 24.020225][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 24.030260][ C0] Call Trace:
[ 24.033526][ C0]
[ 24.036363][ C0] dump_stack+0xef/0x16e
[ 24.040584][ C0] ? ath9k_htc_rx_msg+0xa25/0xaf0
[ 24.045585][ C0] ? ath9k_htc_rx_msg+0xa25/0xaf0
[ 24.050589][ C0] print_address_description.constprop.0.cold+0xd3/0x314
[ 24.057617][ C0] ? ath9k_htc_rx_msg+0xa25/0xaf0
[ 24.062626][ C0] ? ath9k_htc_rx_msg+0xa25/0xaf0
[ 24.067635][ C0] __kasan_report.cold+0x37/0x77
[ 24.072550][ C0] ? ath9k_htc_rx_msg+0xa25/0xaf0
[ 24.077554][ C0] kasan_report+0xe/0x20
[ 24.081777][ C0] ath9k_htc_rx_msg+0xa25/0xaf0
[ 24.086610][ C0] ath9k_hif_usb_reg_in_cb+0x1ba/0x630
[ 24.092049][ C0] ? _raw_read_unlock+0x1a/0x30
[ 24.097004][ C0] ? led_trigger_blink_oneshot+0xb4/0xe0
[ 24.102649][ C0] __usb_hcd_giveback_urb+0x1f2/0x470
[ 24.107995][ C0] usb_hcd_giveback_urb+0x368/0x420
[ 24.113166][ C0] dummy_timer+0x1258/0x32ae
[ 24.117735][ C0] ? dummy_udc_probe+0x930/0x930
[ 24.122647][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 24.128170][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 24.133432][ C0] call_timer_fn+0x195/0x6f0
[ 24.137999][ C0] ? dummy_udc_probe+0x930/0x930
[ 24.142928][ C0] ? msleep_interruptible+0x130/0x130
[ 24.148292][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 24.153825][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 24.159126][ C0] ? _raw_spin_unlock_irq+0x1f/0x30
[ 24.164303][ C0] ? dummy_udc_probe+0x930/0x930
[ 24.169213][ C0] run_timer_softirq+0x5f9/0x1500
[ 24.174226][ C0] ? add_timer+0x7a0/0x7a0
[ 24.178634][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 24.184161][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 24.189429][ C0] __do_softirq+0x21e/0x950
[ 24.193957][ C0] irq_exit+0x178/0x1a0
[ 24.198094][ C0] smp_apic_timer_interrupt+0x141/0x540
[ 24.203621][ C0] apic_timer_interrupt+0xf/0x20
[ 24.208554][ C0]
[ 24.211520][ C0] RIP: 0010:default_idle+0x28/0x300
[ 24.216704][ C0] Code: cc cc 41 56 41 55 65 44 8b 2d 44 eb 71 7a 41 54 55 53 0f 1f 44 00 00 e8 f6 d7 b4 fb e9 07 00 00 00 0f 00 2d aa 7c 52 00 fb f4 <65> 44 8b 2d 20 eb 71 7a 0f 1f 44 00 00 5b 5d 41 5c 41 5d 41 5e c3
[ 24.236293][ C0] RSP: 0018:ffffffff87007da0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
[ 24.244688][ C0] RAX: 0000000000000007 RBX: ffffffff8702c740 RCX: 0000000000000000
[ 24.252636][ C0] RDX: 0000000000000000 RSI: 0000000000000006 RDI: ffffffff8702cf8c
[ 24.260585][ C0] RBP: fffffbfff0e058e8 R08: ffffffff8702c740 R09: 0000000000000000
[ 24.268530][ C0] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[ 24.276487][ C0] R13: 0000000000000000 R14: ffffffff87e629c0 R15: 0000000000000000
[ 24.284456][ C0] do_idle+0x3e0/0x500
[ 24.288505][ C0] ? arch_cpu_idle_exit+0x40/0x40
[ 24.293509][ C0] ? schedule+0xe1/0x2b0
[ 24.297729][ C0] cpu_startup_entry+0x14/0x20
[ 24.302468][ C0] start_kernel+0x8a5/0x8df
[ 24.306949][ C0] ? mem_encrypt_init+0x5/0x5
[ 24.311613][ C0] ? x86_family+0x3d/0x50
[ 24.315959][ C0] ? load_ucode_bsp+0x23d/0x27d
[ 24.320786][ C0] secondary_startup_64+0xb6/0xc0
[ 24.325778][ C0]
[ 24.328084][ C0] Allocated by task 150:
[ 24.332301][ C0] save_stack+0x1b/0x80
[ 24.336442][ C0] __kasan_kmalloc.constprop.0+0xbf/0xd0
[ 24.342047][ C0] kmem_cache_alloc+0xd8/0x300
[ 24.346786][ C0] getname_flags+0xd2/0x5b0
[ 24.351265][ C0] user_path_at_empty+0x2a/0x50
[ 24.356087][ C0] vfs_statx+0x119/0x1e0
[ 24.360302][ C0] __do_sys_newlstat+0x96/0x120
[ 24.365125][ C0] do_syscall_64+0xb6/0x5a0
[ 24.369692][ C0] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 24.375555][ C0]
[ 24.377947][ C0] Freed by task 150:
[ 24.381903][ C0] save_stack+0x1b/0x80
[ 24.386041][ C0] __kasan_slab_free+0x117/0x160
[ 24.390958][ C0] kmem_cache_free+0x9b/0x360
[ 24.395609][ C0] putname+0xe1/0x120
[ 24.399580][ C0] filename_lookup+0x282/0x3e0
[ 24.404368][ C0] vfs_statx+0x119/0x1e0
[ 24.408587][ C0] __do_sys_newlstat+0x96/0x120
[ 24.413412][ C0] do_syscall_64+0xb6/0x5a0
[ 24.417906][ C0] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 24.423768][ C0]
[ 24.426091][ C0] The buggy address belongs to the object at ffff8881cd468000
[ 24.426091][ C0] which belongs to the cache names_cache of size 4096
[ 24.440206][ C0] The buggy address is located 1104 bytes inside of
[ 24.440206][ C0] 4096-byte region [ffff8881cd468000, ffff8881cd469000)
[ 24.453629][ C0] The buggy address belongs to the page:
[ 24.459250][ C0] page:ffffea0007351a00 refcount:1 mapcount:0 mapping:ffff8881da11c000 index:0x0 compound_mapcount: 0
[ 24.470166][ C0] flags: 0x200000000010200(slab|head)
[ 24.475519][ C0] raw: 0200000000010200 dead000000000100 dead000000000122 ffff8881da11c000
[ 24.484096][ C0] raw: 0000000000000000 0000000000070007 00000001ffffffff 0000000000000000
[ 24.492658][ C0] page dumped because: kasan: bad access detected
[ 24.499051][ C0]
[ 24.501358][ C0] Memory state around the buggy address:
[ 24.506963][ C0] ffff8881cd468300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 24.514998][ C0] ffff8881cd468380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 24.523042][ C0] >ffff8881cd468400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 24.531082][ C0] ^
[ 24.537729][ C0] ffff8881cd468480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 24.545772][ C0] ffff8881cd468500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 24.553819][ C0] ==================================================================
[ 24.561863][ C0] Disabling lock debugging due to kernel taint
[ 24.568032][ C0] Kernel panic - not syncing: panic_on_warn set ...
[ 24.574631][ C0] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G B 5.6.0-rc7-syzkaller #0
[ 24.583882][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 24.593947][ C0] Call Trace:
[ 24.597209][ C0]
[ 24.600038][ C0] dump_stack+0xef/0x16e
[ 24.604254][ C0] panic+0x2aa/0x6e1
[ 24.609336][ C0] ? add_taint.cold+0x16/0x16
[ 24.613999][ C0] ? print_shadow_for_address+0xb8/0x114
[ 24.619613][ C0] ? trace_hardirqs_off+0x50/0x200
[ 24.624695][ C0] ? ath9k_htc_rx_msg+0xa25/0xaf0
[ 24.629689][ C0] end_report+0x43/0x49
[ 24.633841][ C0] ? ath9k_htc_rx_msg+0xa25/0xaf0
[ 24.638851][ C0] __kasan_report.cold+0x55/0x77
[ 24.643766][ C0] ? ath9k_htc_rx_msg+0xa25/0xaf0
[ 24.648766][ C0] kasan_report+0xe/0x20
[ 24.652985][ C0] ath9k_htc_rx_msg+0xa25/0xaf0
[ 24.657818][ C0] ath9k_hif_usb_reg_in_cb+0x1ba/0x630
[ 24.663251][ C0] ? _raw_read_unlock+0x1a/0x30
[ 24.668076][ C0] ? led_trigger_blink_oneshot+0xb4/0xe0
[ 24.673735][ C0] __usb_hcd_giveback_urb+0x1f2/0x470
[ 24.679079][ C0] usb_hcd_giveback_urb+0x368/0x420
[ 24.684249][ C0] dummy_timer+0x1258/0x32ae
[ 24.688827][ C0] ? dummy_udc_probe+0x930/0x930
[ 24.693754][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 24.699286][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 24.704550][ C0] call_timer_fn+0x195/0x6f0
[ 24.709123][ C0] ? dummy_udc_probe+0x930/0x930
[ 24.714074][ C0] ? msleep_interruptible+0x130/0x130
[ 24.719455][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 24.724978][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 24.730238][ C0] ? _raw_spin_unlock_irq+0x1f/0x30
[ 24.735412][ C0] ? dummy_udc_probe+0x930/0x930
[ 24.740331][ C0] run_timer_softirq+0x5f9/0x1500
[ 24.745333][ C0] ? add_timer+0x7a0/0x7a0
[ 24.749730][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 24.755252][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 24.760515][ C0] __do_softirq+0x21e/0x950
[ 24.764995][ C0] irq_exit+0x178/0x1a0
[ 24.769129][ C0] smp_apic_timer_interrupt+0x141/0x540
[ 24.774766][ C0] apic_timer_interrupt+0xf/0x20
[ 24.779673][ C0]
[ 24.782622][ C0] RIP: 0010:default_idle+0x28/0x300
[ 24.787799][ C0] Code: cc cc 41 56 41 55 65 44 8b 2d 44 eb 71 7a 41 54 55 53 0f 1f 44 00 00 e8 f6 d7 b4 fb e9 07 00 00 00 0f 00 2d aa 7c 52 00 fb f4 <65> 44 8b 2d 20 eb 71 7a 0f 1f 44 00 00 5b 5d 41 5c 41 5d 41 5e c3
[ 24.807377][ C0] RSP: 0018:ffffffff87007da0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
[ 24.815759][ C0] RAX: 0000000000000007 RBX: ffffffff8702c740 RCX: 0000000000000000
[ 24.823715][ C0] RDX: 0000000000000000 RSI: 0000000000000006 RDI: ffffffff8702cf8c
[ 24.831672][ C0] RBP: fffffbfff0e058e8 R08: ffffffff8702c740 R09: 0000000000000000
[ 24.839616][ C0] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[ 24.847560][ C0] R13: 0000000000000000 R14: ffffffff87e629c0 R15: 0000000000000000
[ 24.855514][ C0] do_idle+0x3e0/0x500
[ 24.859556][ C0] ? arch_cpu_idle_exit+0x40/0x40
[ 24.864736][ C0] ? schedule+0xe1/0x2b0
[ 24.868959][ C0] cpu_startup_entry+0x14/0x20
[ 24.873705][ C0] start_kernel+0x8a5/0x8df
[ 24.878188][ C0] ? mem_encrypt_init+0x5/0x5
[ 24.882850][ C0] ? x86_family+0x3d/0x50
[ 24.887155][ C0] ? load_ucode_bsp+0x23d/0x27d
[ 24.891989][ C0] secondary_startup_64+0xb6/0xc0
[ 24.897672][ C0] Kernel Offset: disabled
[ 24.901994][ C0] Rebooting in 86400 seconds..