Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Update UTMP about System Runlevel Changes. [ 16.671628][ C1] random: crng init done [ 16.675959][ C1] random: 7 urandom warning(s) missed due to ratelimiting Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.158' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 24.482554][ T95] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 24.852157][ T95] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 24.861265][ T95] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 24.869445][ T95] usb 1-1: Product: syz [ 24.873688][ T95] usb 1-1: Manufacturer: syz [ 24.878262][ T95] usb 1-1: SerialNumber: syz [ 24.922831][ T95] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 25.491467][ T95] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 25.911052][ C1] ================================================================== [ 25.919239][ C1] BUG: KASAN: use-after-free in ath9k_hif_usb_rx_cb+0x3be/0xf70 [ 25.926864][ C1] Read of size 45022 at addr ffff8881cec48000 by task swapper/1/0 [ 25.934667][ C1] [ 25.936981][ C1] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.6.0-rc5-syzkaller #0 [ 25.944856][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 25.954897][ C1] Call Trace: [ 25.958163][ C1] [ 25.961026][ C1] dump_stack+0xef/0x16e [ 25.965248][ C1] ? ath9k_hif_usb_rx_cb+0x3be/0xf70 [ 25.970534][ C1] ? ath9k_hif_usb_rx_cb+0x3be/0xf70 [ 25.975812][ C1] print_address_description.constprop.0.cold+0xd3/0x314 [ 25.982837][ C1] ? ath9k_hif_usb_rx_cb+0x3be/0xf70 [ 25.988109][ C1] ? ath9k_hif_usb_rx_cb+0x3be/0xf70 [ 25.993412][ C1] __kasan_report.cold+0x37/0x77 [ 25.998328][ C1] ? ath9k_hif_usb_rx_cb+0x3be/0xf70 [ 26.003600][ C1] kasan_report+0xe/0x20 [ 26.007861][ C1] check_memory_region+0x152/0x1c0 [ 26.012967][ C1] memcpy+0x20/0x50 [ 26.016759][ C1] ath9k_hif_usb_rx_cb+0x3be/0xf70 [ 26.021857][ C1] ? find_held_lock+0x2d/0x110 [ 26.026615][ C1] ? hif_usb_mgmt_cb+0x300/0x300 [ 26.031529][ C1] ? do_raw_spin_lock+0x129/0x290 [ 26.036542][ C1] ? lock_downgrade+0x6e0/0x6e0 [ 26.041370][ C1] ? trace_hardirqs_off+0x50/0x200 [ 26.046459][ C1] __usb_hcd_giveback_urb+0x29a/0x550 [ 26.051829][ C1] usb_hcd_giveback_urb+0x368/0x420 [ 26.057547][ C1] dummy_timer+0x1258/0x32a