Starting getty on tty2-tty6 if dbus and logind are not available... Starting OpenBSD Secure Shell server... Starting System Logging Service... Starting Permit User Sessions... [ OK ] Found device /dev/ttyS0. [ OK ] Started System Logging Service. [ 62.670214][ T8142] sshd (8142) used greatest stack depth: 22504 bytes left [ OK ] Started Permit User Sessions. [ OK ] Started OpenBSD Secure Shell server. [ OK ] Started getty on tty2-tty6 if dbus and logind are not available. [ OK ] Listening on Load/Save RF Kill Switch Status /dev/rfkill Watch. [ OK ] Started Getty on tty6. [ OK ] Started Getty on tty5. [ OK ] Started Getty on tty4. [ OK ] Started Getty on tty3. [ OK ] Started Getty on tty2. [ OK ] Started Getty on tty1. [ OK ] Started Serial Getty on ttyS0. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Update UTMP about System Runlevel Changes. [ OK ] Started Load/Save RF Kill Switch Status. Warning: Permanently added '10.128.0.245' (ECDSA) to the list of known hosts. Debian GNU/Linux 9 syzkaller ttyS0 executing program syzkaller login: [ 81.955697][ T36] audit: type=1400 audit(1612360097.527:8): avc: denied { execmem } for pid=8452 comm="syz-executor248" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 82.255749][ T5] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 82.615136][ T5] usb 1-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 82.626256][ T5] usb 1-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 6 [ 82.795988][ T5] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 82.805981][ T5] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 82.814157][ T5] usb 1-1: Product: syz [ 82.819047][ T5] usb 1-1: Manufacturer: syz [ 82.823836][ T5] usb 1-1: SerialNumber: syz [ 82.877560][ T5] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 83.515027][ T5] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 83.944991][ C0] ================================================================== [ 83.953679][ C0] BUG: KASAN: slab-out-of-bounds in ath9k_hif_usb_rx_cb+0x3d3/0x1050 [ 83.961941][ C0] Read of size 40655 at addr ffff8880393b0000 by task swapper/0/0 [ 83.969852][ C0] [ 83.972168][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.11.0-rc6-syzkaller #0 [ 83.980421][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 83.990504][ C0] Call Trace: [ 83.993812][ C0] [ 83.996677][ C0] dump_stack+0x107/0x163 [ 84.001112][ C0] ? ath9k_hif_usb_rx_cb+0x3d3/0x1050 [ 84.006525][ C0] ? ath9k_hif_usb_rx_cb+0x3d3/0x1050 [ 84.011895][ C0] print_address_description.constprop.0.cold+0x5b/0x2c6 [ 84.019110][ C0] ? ath9k_hif_usb_rx_cb+0x3d3/0x1050 [ 84.024586][ C0] ? ath9k_hif_usb_rx_cb+0x3d3/0x1050 [ 84.030156][ C0] kasan_report.cold+0x79/0xd5 [ 84.034954][ C0] ? rwlock_bug.part.0+0x10/0x90 [ 84.040150][ C0] ? ath9k_hif_usb_rx_cb+0x3d3/0x1050 [ 84.045625][ C0] check_memory_region+0x13d/0x180 [ 84.050734][ C0] memcpy+0x20/0x60 [ 84.054711][ C0] ath9k_hif_usb_rx_cb+0x3d3/0x1050 [ 84.060187][ C0] ? hif_usb_start+0xa0/0xa0 [ 84.064969][ C0] ? __usb_hcd_giveback_urb+0x413/0x5c0 [ 84.070515][ C0] ? lock_downgrade+0x6d0/0x6d0 [ 84.075385][ C0] __usb_hcd_giveback_urb+0x2b0/0x5c0 [ 84.080765][ C0] usb_hcd_giveback_urb+0x367/0x410 [ 84.085966][ C0] dummy_timer+0x11f4/0x32a0 [ 84.090581][ C0] ? dummy_dequeue+0x4c0/0x4c0 [ 84.095346][ C0] ? dummy_dequeue+0x4c0/0x4c0 [ 84.100206][ C0] call_timer_fn+0x1a5/0x6b0 [ 84.104964][ C0] ? add_timer_on+0x4a0/0x4a0 [ 84.109639][ C0] ? lock_downgrade+0x6d0/0x6d0 [ 84.114529][ C0] ? _raw_spin_unlock_irq+0x1f/0x40 [ 84.119888][ C0] ? dummy_dequeue+0x4c0/0x4c0 [ 84.124697][ C0] __run_timers.part.0+0x67c/0xa50 [ 84.130125][ C0] ? call_timer_fn+0x6b0/0x6b0 [ 84.135522][ C0] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 84.141876][ C0] ? kvm_sched_clock_read+0x14/0x40 [ 84.147587][ C0] ? sched_clock+0x2a/0x40 [ 84.152098][ C0] ? sched_clock_cpu+0x18/0x1f0 [ 84.157355][ C0] run_timer_softirq+0xb3/0x1d0 [ 84.162474][ C0] __do_softirq+0x29b/0x9f6 [ 84.167254][ C0] asm_call_irq_on_stack+0xf/0x20 [ 84.172297][ C0] [ 84.175844][ C0] do_softirq_own_stack+0xaa/0xd0 [ 84.181245][ C0] irq_exit_rcu+0x134/0x200 [ 84.185917][ C0] sysvec_apic_timer_interrupt+0x4d/0x100 [ 84.191923][ C0] asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 84.197922][ C0] RIP: 0010:acpi_idle_do_entry+0x1c9/0x250 [ 84.203730][ C0] Code: fd 74 75 f8 84 db 75 ac e8 14 6d 75 f8 e8 4f 40 7b f8 e9 0c 00 00 00 e8 05 6d 75 f8 0f 00 2d 5e 36 ac 00 e8 f9 6c 75 f8 fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 74 73 75 f8 48 85 db [ 84.223341][ C0] RSP: 0018:ffffffff8ba07d60 EFLAGS: 00000293 [ 84.229417][ C0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 84.237538][ C0] RDX: ffffffff8babc340 RSI: ffffffff88fd5327 RDI: 0000000000000000 [ 84.245792][ C0] RBP: ffff8881415c2864 R08: 0000000000000001 R09: 0000000000000001 [ 84.254052][ C0] R10: ffffffff81789398 R11: 0000000000000000 R12: 0000000000000001 [ 84.262524][ C0] R13: ffff8881415c2800 R14: ffff8881415c2864 R15: ffff88814332f004 [ 84.270627][ C0] ? trace_hardirqs_on+0x38/0x1c0 [ 84.275902][ C0] ? acpi_idle_do_entry+0x1c7/0x250 [ 84.281221][ C0] acpi_idle_enter+0x361/0x500 [ 84.286013][ C0] cpuidle_enter_state+0x1b1/0xc80 [ 84.291132][ C0] cpuidle_enter+0x4a/0xa0 [ 84.295548][ C0] do_idle+0x3e1/0x590 [ 84.299632][ C0] ? arch_cpu_idle_exit+0x30/0x30 [ 84.304664][ C0] ? trace_init_perf_perm_irq_work_exit+0xe/0xe [ 84.310919][ C0] cpu_startup_entry+0x14/0x20 [ 84.315783][ C0] start_kernel+0x46b/0x48c [ 84.320474][ C0] secondary_startup_64_no_verify+0xb0/0xbb [ 84.326481][ C0] [ 84.328958][ C0] Allocated by task 5: [ 84.333025][ C0] kasan_save_stack+0x1b/0x40 [ 84.337705][ C0] ____kasan_kmalloc.constprop.0+0x7f/0xa0 [ 84.343613][ C0] __alloc_skb+0xae/0x5a0 [ 84.348414][ C0] ath9k_hif_usb_alloc_urbs+0x665/0x1040 [ 84.354460][ C0] ath9k_hif_usb_firmware_cb+0x148/0x530 [ 84.360425][ C0] request_firmware_work_func+0x12c/0x230 [ 84.366324][ C0] process_one_work+0x98d/0x15f0 [ 84.371851][ C0] worker_thread+0x64c/0x1120 [ 84.376536][ C0] kthread+0x3b1/0x4a0 [ 84.380605][ C0] ret_from_fork+0x1f/0x30 [ 84.385189][ C0] [ 84.387500][ C0] The buggy address belongs to the object at ffff8880393b0000 [ 84.387500][ C0] which belongs to the cache kmalloc-32k of size 32768 [ 84.402414][ C0] The buggy address is located 0 bytes inside of [ 84.402414][ C0] 32768-byte region [ffff8880393b0000, ffff8880393b8000) [ 84.415897][ C0] The buggy address belongs to the page: [ 84.422435][ C0] page:000000007009f8e3 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x393b0 [ 84.432679][ C0] head:000000007009f8e3 order:4 compound_mapcount:0 compound_pincount:0 [ 84.441090][ C0] flags: 0xfff00000010200(slab|head) [ 84.446409][ C0] raw: 00fff00000010200 ffffea0000e4e808 ffffea0000e4f008 ffff888010c40c00 [ 84.455693][ C0] raw: 0000000000000000 ffff8880393b0000 0000000100000001 0000000000000000 [ 84.464862][ C0] page dumped because: kasan: bad access detected [ 84.471808][ C0] [ 84.474129][ C0] Memory state around the buggy address: [ 84.479945][ C0] ffff8880393b7f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 84.488467][ C0] ffff8880393b7f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 84.497091][ C0] >ffff8880393b8000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 84.505429][ C0] ^ [ 84.509897][ C0] ffff8880393b8080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 84.518082][ C0] ffff8880393b8100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 84.526147][ C0] ================================================================== [ 84.534315][ C0] Disabling lock debugging due to kernel taint [ 84.540476][ C0] Kernel panic - not syncing: panic_on_warn set ... [ 84.547411][ C0] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G B 5.11.0-rc6-syzkaller #0 [ 84.556889][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 84.567207][ C0] Call Trace: [ 84.570564][ C0] [ 84.573419][ C0] dump_stack+0x107/0x163 [ 84.577945][ C0] ? ath9k_hif_usb_rx_cb+0x310/0x1050 [ 84.583312][ C0] panic+0x306/0x73d [ 84.587616][ C0] ? __warn_printk+0xf3/0xf3 [ 84.592475][ C0] ? ath9k_hif_usb_rx_cb+0x3d3/0x1050 [ 84.597854][ C0] ? ath9k_hif_usb_rx_cb+0x3d3/0x1050 [ 84.603401][ C0] ? ath9k_hif_usb_rx_cb+0x3d3/0x1050 [ 84.608772][ C0] end_report+0x58/0x5e [ 84.613089][ C0] kasan_report.cold+0x67/0xd5 [ 84.617848][ C0] ? rwlock_bug.part.0+0x10/0x90 [ 84.622868][ C0] ? ath9k_hif_usb_rx_cb+0x3d3/0x1050 [ 84.628234][ C0] check_memory_region+0x13d/0x180 [ 84.633429][ C0] memcpy+0x20/0x60 [ 84.637227][ C0] ath9k_hif_usb_rx_cb+0x3d3/0x1050 [ 84.642421][ C0] ? hif_usb_start+0xa0/0xa0 [ 84.647176][ C0] ? __usb_hcd_giveback_urb+0x413/0x5c0 [ 84.652737][ C0] ? lock_downgrade+0x6d0/0x6d0 [ 84.657788][ C0] __usb_hcd_giveback_urb+0x2b0/0x5c0 [ 84.663328][ C0] usb_hcd_giveback_urb+0x367/0x410 [ 84.668622][ C0] dummy_timer+0x11f4/0x32a0 [ 84.673221][ C0] ? dummy_dequeue+0x4c0/0x4c0 [ 84.678420][ C0] ? dummy_dequeue+0x4c0/0x4c0 [ 84.683477][ C0] call_timer_fn+0x1a5/0x6b0 [ 84.688301][ C0] ? add_timer_on+0x4a0/0x4a0 [ 84.693199][ C0] ? lock_downgrade+0x6d0/0x6d0 [ 84.698147][ C0] ? _raw_spin_unlock_irq+0x1f/0x40 [ 84.703692][ C0] ? dummy_dequeue+0x4c0/0x4c0 [ 84.708836][ C0] __run_timers.part.0+0x67c/0xa50 [ 84.713961][ C0] ? call_timer_fn+0x6b0/0x6b0 [ 84.718722][ C0] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 84.724972][ C0] ? kvm_sched_clock_read+0x14/0x40 [ 84.730258][ C0] ? sched_clock+0x2a/0x40 [ 84.734660][ C0] ? sched_clock_cpu+0x18/0x1f0 [ 84.739623][ C0] run_timer_softirq+0xb3/0x1d0 [ 84.744464][ C0] __do_softirq+0x29b/0x9f6 [ 84.749044][ C0] asm_call_irq_on_stack+0xf/0x20 [ 84.754271][ C0] [ 84.757290][ C0] do_softirq_own_stack+0xaa/0xd0 [ 84.762311][ C0] irq_exit_rcu+0x134/0x200 [ 84.767067][ C0] sysvec_apic_timer_interrupt+0x4d/0x100 [ 84.773097][ C0] asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 84.779086][ C0] RIP: 0010:acpi_idle_do_entry+0x1c9/0x250 [ 84.785039][ C0] Code: fd 74 75 f8 84 db 75 ac e8 14 6d 75 f8 e8 4f 40 7b f8 e9 0c 00 00 00 e8 05 6d 75 f8 0f 00 2d 5e 36 ac 00 e8 f9 6c 75 f8 fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 74 73 75 f8 48 85 db [ 84.805447][ C0] RSP: 0018:ffffffff8ba07d60 EFLAGS: 00000293 [ 84.811513][ C0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 84.819475][ C0] RDX: ffffffff8babc340 RSI: ffffffff88fd5327 RDI: 0000000000000000 [ 84.827460][ C0] RBP: ffff8881415c2864 R08: 0000000000000001 R09: 0000000000000001 [ 84.835523][ C0] R10: ffffffff81789398 R11: 0000000000000000 R12: 0000000000000001 [ 84.843480][ C0] R13: ffff8881415c2800 R14: ffff8881415c2864 R15: ffff88814332f004 [ 84.851441][ C0] ? trace_hardirqs_on+0x38/0x1c0 [ 84.856551][ C0] ? acpi_idle_do_entry+0x1c7/0x250 [ 84.861763][ C0] acpi_idle_enter+0x361/0x500 [ 84.866591][ C0] cpuidle_enter_state+0x1b1/0xc80 [ 84.871707][ C0] cpuidle_enter+0x4a/0xa0 [ 84.876113][ C0] do_idle+0x3e1/0x590 [ 84.880192][ C0] ? arch_cpu_idle_exit+0x30/0x30 [ 84.885439][ C0] ? trace_init_perf_perm_irq_work_exit+0xe/0xe [ 84.891774][ C0] cpu_startup_entry+0x14/0x20 [ 84.896832][ C0] start_kernel+0x46b/0x48c [ 84.901324][ C0] secondary_startup_64_no_verify+0xb0/0xbb [ 84.908610][ C0] Kernel Offset: disabled [ 84.912939][ C0] Rebooting in 86400 seconds..