dhcpcd-9.4.0 starting
dev: loaded udev
DUID 00:04:60:53:42:71:88:b7:f6:77:35:a2:41:23:0b:7b:f3:52
forked to background, child pid 1216
Starting sshd: OK

syzkaller
Warning: Permanently added '10.128.0.84' (ECDSA) to the list of known hosts.
executing program
syzkaller login: [   25.945362][ T1144] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[   26.225566][ T1144] usb 1-1: too many configurations: 130, using maximum allowed: 8
[   26.305434][ T1144] usb 1-1: config index 0 descriptor too short (expected 65163, got 72)
[   26.385412][ T1144] usb 1-1: config index 1 descriptor too short (expected 65163, got 72)
[   26.465433][ T1144] usb 1-1: config index 2 descriptor too short (expected 65163, got 72)
[   26.565492][ T1144] usb 1-1: config index 3 descriptor too short (expected 65163, got 72)
[   26.645458][ T1144] usb 1-1: config index 4 descriptor too short (expected 65163, got 72)
[   26.735423][ T1144] usb 1-1: config index 5 descriptor too short (expected 65163, got 72)
[   26.815452][ T1144] usb 1-1: config index 6 descriptor too short (expected 65163, got 72)
[   26.895406][ T1144] usb 1-1: config index 7 descriptor too short (expected 65163, got 72)
[   27.055443][ T1144] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[   27.064555][ T1144] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   27.072679][ T1144] usb 1-1: Product: syz
[   27.076972][ T1144] usb 1-1: Manufacturer: syz
[   27.081559][ T1144] usb 1-1: SerialNumber: syz
[   27.126895][ T1144] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[   27.705412][ T1144] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[   28.795299][ T1144] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive
[   28.802514][ T1144] ath9k_htc: Failed to initialize the device
[   28.925289][    C1] ==================================================================
[   28.933364][    C1] BUG: KASAN: use-after-free in ath9k_hif_usb_rx_cb+0xd17/0x10d0
[   28.941106][    C1] Read of size 4 at addr ffff888108c8c2f4 by task swapper/1/0
[   28.948586][    C1] 
[   28.950908][    C1] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.19.0-rc7-syzkaller-00199-g8288c99fc263 #0
[   28.960704][    C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
[   28.970750][    C1] Call Trace:
[   28.974036][    C1]  <IRQ>
[   28.976912][    C1]  dump_stack_lvl+0xcd/0x134
[   28.981503][    C1]  print_address_description.constprop.0.cold+0xeb/0x495
[   28.988525][    C1]  ? ath9k_hif_usb_rx_cb+0xd17/0x10d0
[   28.993905][    C1]  kasan_report.cold+0xf4/0x1c6
[   28.998754][    C1]  ? ath9k_hif_usb_rx_cb+0xd17/0x10d0
[   29.004148][    C1]  ath9k_hif_usb_rx_cb+0xd17/0x10d0
[   29.009339][    C1]  ? sched_init_numa+0xd80/0xe40
[   29.014267][    C1]  ? lock_downgrade+0x6e0/0x6e0
[   29.019107][    C1]  ? hif_usb_start+0xa0/0xa0
[   29.023684][    C1]  ? rwlock_bug.part.0+0x90/0x90
[   29.028614][    C1]  __usb_hcd_giveback_urb+0x2b0/0x5c0
[   29.033988][    C1]  usb_hcd_giveback_urb+0x380/0x430
[   29.039190][    C1]  dummy_timer+0x11f9/0x32b0
[   29.043771][    C1]  ? dummy_dequeue+0x500/0x500
[   29.048527][    C1]  ? dummy_dequeue+0x500/0x500
[   29.053300][    C1]  call_timer_fn+0x1a5/0x6b0
[   29.057878][    C1]  ? timer_fixup_activate+0x350/0x350
[   29.063250][    C1]  ? lock_downgrade+0x6e0/0x6e0
[   29.068124][    C1]  ? _raw_spin_unlock_irq+0x1f/0x40
[   29.073314][    C1]  ? _raw_spin_unlock_irq+0x1f/0x40
[   29.078529][    C1]  ? dummy_dequeue+0x500/0x500
[   29.083296][    C1]  __run_timers.part.0+0x679/0xa80
[   29.088397][    C1]  ? call_timer_fn+0x6b0/0x6b0
[   29.093151][    C1]  ? lapic_next_event+0x4d/0x80
[   29.097991][    C1]  ? clockevents_program_event+0x12b/0x370
[   29.103788][    C1]  run_timer_softirq+0xb3/0x1d0
[   29.108645][    C1]  __do_softirq+0x288/0x9a5
[   29.113139][    C1]  __irq_exit_rcu+0x113/0x170
[   29.117818][    C1]  irq_exit_rcu+0x5/0x20
[   29.122058][    C1]  sysvec_apic_timer_interrupt+0x8e/0xc0
[   29.127685][    C1]  </IRQ>
[   29.130600][    C1]  <TASK>
[   29.133513][    C1]  asm_sysvec_apic_timer_interrupt+0x16/0x20
[   29.139571][    C1] RIP: 0010:acpi_idle_do_entry+0x1c9/0x240
[   29.145367][    C1] Code: 89 de e8 fa f3 54 fb 84 db 75 98 e8 f1 f7 54 fb e8 ac 3c 5b fb 66 90 e8 e5 f7 54 fb 0f 00 2d ae a0 7b 00 e8 d9 f7 54 fb fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 24 f4 54 fb 48 85 db
[   29.164971][    C1] RSP: 0018:ffffc9000010fd20 EFLAGS: 00000293
[   29.171073][    C1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[   29.179046][    C1] RDX: ffff8881002cd580 RSI: ffffffff85f03117 RDI: 0000000000000000
[   29.187036][    C1] RBP: ffff8881094c7064 R08: 0000000000000001 R09: 0000000000000001
[   29.195022][    C1] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
[   29.202983][    C1] R13: ffff8881094c7000 R14: ffff8881094c7064 R15: ffff88810c8d1804
[   29.210945][    C1]  ? acpi_idle_do_entry+0x1c7/0x240
[   29.216141][    C1]  acpi_idle_enter+0x369/0x510
[   29.220907][    C1]  cpuidle_enter_state+0x1b1/0xc80
[   29.226008][    C1]  cpuidle_enter+0x4a/0xa0
[   29.230420][    C1]  do_idle+0x3e8/0x590
[   29.234510][    C1]  ? arch_cpu_idle_exit+0x30/0x30
[   29.239528][    C1]  cpu_startup_entry+0x14/0x20
[   29.244279][    C1]  start_secondary+0x21d/0x2b0
[   29.249065][    C1]  ? set_cpu_sibling_map+0x1ef0/0x1ef0
[   29.254527][    C1]  secondary_startup_64_no_verify+0xce/0xdb
[   29.260410][    C1]  </TASK>
[   29.263417][    C1] 
[   29.265731][    C1] The buggy address belongs to the physical page:
[   29.272209][    C1] page:ffffea0004232300 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x108c8c
[   29.282430][    C1] flags: 0x200000000000000(node=0|zone=2)
[   29.288146][    C1] raw: 0200000000000000 0000000000000000 ffffea0004232308 0000000000000000
[   29.296739][    C1] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[   29.305312][    C1] page dumped because: kasan: bad access detected
[   29.311714][    C1] page_owner tracks the page as freed
[   29.317074][    C1] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x40dc0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO), pid 1144, tgid 1144 (kworker/1:2), ts 27716258144, free_ts 28802491854
[   29.334859][    C1]  get_page_from_freelist+0x138c/0x27a0
[   29.340398][    C1]  __alloc_pages+0x1c7/0x510
[   29.344980][    C1]  alloc_pages+0x1aa/0x310
[   29.349391][    C1]  kmalloc_order+0x34/0xf0
[   29.353796][    C1]  kmalloc_order_trace+0x14/0x120
[   29.358820][    C1]  wiphy_new_nm+0x6f0/0x2080
[   29.363409][    C1]  ieee80211_alloc_hw_nm+0x373/0x2270
[   29.368769][    C1]  ath9k_htc_probe_device+0x97/0x1f00
[   29.374133][    C1]  ath9k_htc_hw_init+0x31/0x60
[   29.378897][    C1]  ath9k_hif_usb_firmware_cb+0x274/0x530
[   29.384540][    C1]  request_firmware_work_func+0x12c/0x230
[   29.390256][    C1]  process_one_work+0x996/0x1610
[   29.395191][    C1]  worker_thread+0x665/0x1080
[   29.399873][    C1]  kthread+0x2ef/0x3a0
[   29.403955][    C1]  ret_from_fork+0x1f/0x30
[   29.408367][    C1] page last free stack trace:
[   29.413039][    C1]  free_pcp_prepare+0x537/0xb80
[   29.417885][    C1]  free_unref_page+0x19/0x5a0
[   29.422568][    C1]  device_release+0x9f/0x240
[   29.427344][    C1]  kobject_put+0x1c8/0x540
[   29.431746][    C1]  put_device+0x1b/0x30
[   29.435977][    C1]  ath9k_htc_probe_device+0x1c7/0x1f00
[   29.441428][    C1]  ath9k_htc_hw_init+0x31/0x60
[   29.446179][    C1]  ath9k_hif_usb_firmware_cb+0x274/0x530
[   29.451797][    C1]  request_firmware_work_func+0x12c/0x230
[   29.457511][    C1]  process_one_work+0x996/0x1610
[   29.462446][    C1]  worker_thread+0x665/0x1080
[   29.467116][    C1]  kthread+0x2ef/0x3a0
[   29.471186][    C1]  ret_from_fork+0x1f/0x30
[   29.475616][    C1] 
[   29.477941][    C1] Memory state around the buggy address:
[   29.483558][    C1]  ffff888108c8c180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   29.491610][    C1]  ffff888108c8c200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   29.499659][    C1] >ffff888108c8c280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   29.507723][    C1]                                                              ^
[   29.515425][    C1]  ffff888108c8c300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   29.523494][    C1]  ffff888108c8c380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   29.531561][    C1] ==================================================================
[   29.539606][    C1] Kernel panic - not syncing: panic_on_warn set ...
[   29.546198][    C1] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.19.0-rc7-syzkaller-00199-g8288c99fc263 #0
[   29.555911][    C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
[   29.565960][    C1] Call Trace:
[   29.569254][    C1]  <IRQ>
[   29.572089][    C1]  dump_stack_lvl+0xcd/0x134
[   29.576672][    C1]  panic+0x2d7/0x636
[   29.580556][    C1]  ? panic_print_sys_info.part.0+0x10b/0x10b
[   29.586526][    C1]  ? ath9k_hif_usb_rx_cb+0xd17/0x10d0
[   29.592029][    C1]  end_report.part.0+0x3f/0x7c
[   29.596780][    C1]  kasan_report.cold+0x93/0x1c6
[   29.601616][    C1]  ? ath9k_hif_usb_rx_cb+0xd17/0x10d0
[   29.606984][    C1]  ath9k_hif_usb_rx_cb+0xd17/0x10d0
[   29.612180][    C1]  ? sched_init_numa+0xd80/0xe40
[   29.617108][    C1]  ? lock_downgrade+0x6e0/0x6e0
[   29.621952][    C1]  ? hif_usb_start+0xa0/0xa0
[   29.626529][    C1]  ? rwlock_bug.part.0+0x90/0x90
[   29.631455][    C1]  __usb_hcd_giveback_urb+0x2b0/0x5c0
[   29.636835][    C1]  usb_hcd_giveback_urb+0x380/0x430
[   29.642081][    C1]  dummy_timer+0x11f9/0x32b0
[   29.646669][    C1]  ? dummy_dequeue+0x500/0x500
[   29.651417][    C1]  ? dummy_dequeue+0x500/0x500
[   29.656168][    C1]  call_timer_fn+0x1a5/0x6b0
[   29.660849][    C1]  ? timer_fixup_activate+0x350/0x350
[   29.666204][    C1]  ? lock_downgrade+0x6e0/0x6e0
[   29.671040][    C1]  ? _raw_spin_unlock_irq+0x1f/0x40
[   29.676228][    C1]  ? _raw_spin_unlock_irq+0x1f/0x40
[   29.681426][    C1]  ? dummy_dequeue+0x500/0x500
[   29.686175][    C1]  __run_timers.part.0+0x679/0xa80
[   29.691281][    C1]  ? call_timer_fn+0x6b0/0x6b0
[   29.696134][    C1]  ? lapic_next_event+0x4d/0x80
[   29.700981][    C1]  ? clockevents_program_event+0x12b/0x370
[   29.706797][    C1]  run_timer_softirq+0xb3/0x1d0
[   29.711642][    C1]  __do_softirq+0x288/0x9a5
[   29.716137][    C1]  __irq_exit_rcu+0x113/0x170
[   29.720801][    C1]  irq_exit_rcu+0x5/0x20
[   29.725037][    C1]  sysvec_apic_timer_interrupt+0x8e/0xc0
[   29.730687][    C1]  </IRQ>
[   29.733618][    C1]  <TASK>
[   29.736540][    C1]  asm_sysvec_apic_timer_interrupt+0x16/0x20
[   29.742506][    C1] RIP: 0010:acpi_idle_do_entry+0x1c9/0x240
[   29.748313][    C1] Code: 89 de e8 fa f3 54 fb 84 db 75 98 e8 f1 f7 54 fb e8 ac 3c 5b fb 66 90 e8 e5 f7 54 fb 0f 00 2d ae a0 7b 00 e8 d9 f7 54 fb fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 24 f4 54 fb 48 85 db
[   29.767915][    C1] RSP: 0018:ffffc9000010fd20 EFLAGS: 00000293
[   29.773976][    C1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[   29.781938][    C1] RDX: ffff8881002cd580 RSI: ffffffff85f03117 RDI: 0000000000000000
[   29.789904][    C1] RBP: ffff8881094c7064 R08: 0000000000000001 R09: 0000000000000001
[   29.797950][    C1] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
[   29.805912][    C1] R13: ffff8881094c7000 R14: ffff8881094c7064 R15: ffff88810c8d1804
[   29.813896][    C1]  ? acpi_idle_do_entry+0x1c7/0x240
[   29.819094][    C1]  acpi_idle_enter+0x369/0x510
[   29.823852][    C1]  cpuidle_enter_state+0x1b1/0xc80
[   29.828953][    C1]  cpuidle_enter+0x4a/0xa0
[   29.833363][    C1]  do_idle+0x3e8/0x590
[   29.837426][    C1]  ? arch_cpu_idle_exit+0x30/0x30
[   29.842437][    C1]  cpu_startup_entry+0x14/0x20
[   29.847186][    C1]  start_secondary+0x21d/0x2b0
[   29.851942][    C1]  ? set_cpu_sibling_map+0x1ef0/0x1ef0
[   29.857411][    C1]  secondary_startup_64_no_verify+0xce/0xdb
[   29.863312][    C1]  </TASK>
[   29.866397][    C1] Kernel Offset: disabled
[   29.870720][    C1] Rebooting in 86400 seconds..