[[0;32m OK [0m] Reached target Login Prompts.
[[0;32m OK [0m] Reached target Multi-User System.
[[0;32m OK [0m] Reached target Graphical Interface.
Starting Update UTMP about System Runlevel Changes...
[[0;32m OK [0m] Started Update UTMP about System Runlevel Changes.
Debian GNU/Linux 9 syzkaller ttyS0
Warning: Permanently added '10.128.0.134' (ECDSA) to the list of known hosts.
executing program
syzkaller login: [ 31.200871][ T17] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[ 31.740569][ T17] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 31.749726][ T17] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 31.757744][ T17] usb 1-1: Product: syz
[ 31.762002][ T17] usb 1-1: Manufacturer: syz
[ 31.766577][ T17] usb 1-1: SerialNumber: syz
[ 31.812210][ T17] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 32.430087][ T17] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[ 32.869852][ C1] ==================================================================
[ 32.878200][ C1] BUG: KASAN: use-after-free in ath9k_hif_usb_rx_cb+0x3ab/0x1020
[ 32.885896][ C1] Read of size 50462 at addr ffff88810bf78000 by task swapper/1/0
[ 32.893670][ C1]
[ 32.895983][ C1] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.9.0-syzkaller #0
[ 32.903500][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 32.913661][ C1] Call Trace:
[ 32.916924][ C1]
[ 32.919763][ C1] dump_stack+0x107/0x163
[ 32.924101][ C1] ? ath9k_hif_usb_rx_cb+0x3ab/0x1020
[ 32.929451][ C1] ? ath9k_hif_usb_rx_cb+0x3ab/0x1020
[ 32.934848][ C1] print_address_description.constprop.0.cold+0xae/0x4c8
[ 32.942012][ C1] ? lock_acquire+0x1a7/0x870
[ 32.946683][ C1] ? ath9k_hif_usb_rx_cb+0x244/0x1020
[ 32.952034][ C1] ? vprintk_func+0x93/0x140
[ 32.956601][ C1] ? ath9k_hif_usb_rx_cb+0x3ab/0x1020
[ 32.961953][ C1] ? ath9k_hif_usb_rx_cb+0x3ab/0x1020
[ 32.967299][ C1] kasan_report.cold+0x1f/0x37
[ 32.972042][ C1] ? rwlock_bug.part.0+0x80/0x90
[ 32.977086][ C1] ? ath9k_hif_usb_rx_cb+0x3ab/0x1020
[ 32.982434][ C1] check_memory_region+0x13d/0x180
[ 32.987536][ C1] memcpy+0x20/0x60
[ 32.991324][ C1] ath9k_hif_usb_rx_cb+0x3ab/0x1020
[ 32.996507][ C1] ? lock_acquire+0x1a7/0x870
[ 33.001166][ C1] ? hif_usb_start+0xa0/0xa0
[ 33.005743][ C1] ? __usb_hcd_giveback_urb+0x302/0x560
[ 33.011323][ C1] ? lock_downgrade+0x6d0/0x6d0
executing program
[ 33.016152][ C1] __usb_hcd_giveback_urb+0x32d/0x560
[ 33.021510][ C1] usb_hcd_giveback_urb+0x367/0x410
[ 33.026689][ C1] dummy_timer+0x11f4/0x3280
[ 33.031257][ C1] ? dummy_dequeue+0x4c0/0x4c0
[ 33.036053][ C1] ? dummy_dequeue+0x4c0/0x4c0
[ 33.040793][ C1] call_timer_fn+0x1a5/0x630
[ 33.045360][ C1] ? timer_fixup_init+0x60/0x60
[ 33.050200][ C1] ? lock_downgrade+0x6d0/0x6d0
[ 33.052493][ T2116] usb 1-1: USB disconnect, device number 2
[ 33.055056][ C1] ? lockdep_hardirqs_on_prepare+0x129/0x3e0
[ 33.066807][ C1] ? dummy_dequeue+0x4c0/0x4c0
[ 33.071586][ C1] __run_timers.part.0+0x67c/0xa10
[ 33.076707][ C1] ? call_timer_fn+0x630/0x630
[ 33.081478][ C1] ? clockevents_program_event+0x12b/0x350
[ 33.087304][ C1] ? tick_program_event+0xa8/0x130
[ 33.092418][ C1] run_timer_softirq+0x80/0x120
[ 33.097274][ C1] __do_softirq+0x1b2/0x945
[ 33.101785][ C1] asm_call_irq_on_stack+0xf/0x20
[ 33.106805][ C1]
[ 33.109749][ C1] do_softirq_own_stack+0x80/0xa0
[ 33.114775][ C1] irq_exit_rcu+0x110/0x1a0
[ 33.119274][ C1] sysvec_apic_timer_interrupt+0x43/0xa0
[ 33.124888][ C1] asm_sysvec_apic_timer_interrupt+0x12/0x20
[ 33.130847][ C1] RIP: 0010:acpi_idle_do_entry+0x1c9/0x250
[ 33.136693][ C1] Code: bd c9 a3 fb 84 db 75 ac e8 64 d1 a3 fb e8 9f 77 a9 fb e9 0c 00 00 00 e8 55 d1 a3 fb 0f 00 2d 9e 44 6c 00 e8 49 d1 a3 fb fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 e4 c9 a3 fb 48 85 db
[ 33.156294][ C1] RSP: 0018:ffffc900000dfd18 EFLAGS: 00000293
[ 33.162345][ C1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 1ffffffff10788a1
[ 33.170302][ C1] RDX: ffff888100293280 RSI: ffffffff859afbe7 RDI: ffffffff859afbd1
[ 33.178268][ C1] RBP: ffff888103919864 R08: 0000000000000001 R09: 0000000000000001
[ 33.186230][ C1] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
[ 33.194190][ C1] R13: ffff888103919800 R14: ffff888103919864 R15: ffff888105486804
[ 33.202171][ C1] ? acpi_idle_do_entry+0x1c7/0x250
[ 33.207354][ C1] ? acpi_idle_do_entry+0x1b1/0x250
[ 33.212579][ C1] ? acpi_idle_do_entry+0x1c7/0x250
[ 33.217752][ C1] acpi_idle_enter+0x355/0x4f0
[ 33.222509][ C1] cpuidle_enter_state+0x1b1/0xc80
[ 33.227606][ C1] cpuidle_enter+0x4a/0xa0
[ 33.232000][ C1] do_idle+0x3d5/0x580
[ 33.236042][ C1] ? arch_cpu_idle_exit+0x40/0x40
[ 33.241039][ C1] ? lockdep_hardirqs_on_prepare+0x273/0x3e0
[ 33.246995][ C1] ? _raw_spin_unlock_irqrestore+0x34/0x40
[ 33.252775][ C1] ? trace_hardirqs_on+0x5b/0x1a0
[ 33.257774][ C1] cpu_startup_entry+0x14/0x20
[ 33.262514][ C1] start_secondary+0x265/0x340
[ 33.267255][ C1] ? set_cpu_sibling_map+0x2460/0x2460
[ 33.272697][ C1] secondary_startup_64_no_verify+0xa6/0xab
[ 33.278559][ C1]
[ 33.280863][ C1] The buggy address belongs to the page:
[ 33.286492][ C1] page:00000000c7aa68f3 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10bf78
[ 33.296701][ C1] head:00000000c7aa68f3 order:3 compound_mapcount:0 compound_pincount:0
[ 33.304996][ C1] flags: 0x200000000010000(head)
[ 33.309910][ C1] raw: 0200000000010000 dead000000000100 dead000000000122 0000000000000000
[ 33.318488][ C1] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[ 33.327043][ C1] page dumped because: kasan: bad access detected
[ 33.333425][ C1]
[ 33.335727][ C1] Memory state around the buggy address:
[ 33.341358][ C1] ffff88810bf7ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 33.349437][ C1] ffff88810bf7ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 33.357497][ C1] >ffff88810bf80000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 33.365533][ C1] ^
[ 33.369597][ C1] ffff88810bf80080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 33.377640][ C1] ffff88810bf80100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 33.385764][ C1] ==================================================================
[ 33.393889][ C1] Disabling lock debugging due to kernel taint
[ 33.400014][ C1] Kernel panic - not syncing: panic_on_warn set ...
[ 33.406591][ C1] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G B 5.9.0-syzkaller #0
[ 33.415547][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 33.425577][ C1] Call Trace:
[ 33.428835][ C1]
[ 33.431668][ C1] dump_stack+0x107/0x163
[ 33.435974][ C1] ? ath9k_hif_usb_rx_cb+0x300/0x1020
[ 33.441465][ C1] panic+0x306/0x73d
[ 33.445345][ C1] ? __warn_printk+0xf3/0xf3
[ 33.449919][ C1] ? do_raw_spin_unlock+0x50/0x230
[ 33.455007][ C1] ? ath9k_hif_usb_rx_cb+0x3ab/0x1020
[ 33.460459][ C1] ? ath9k_hif_usb_rx_cb+0x3ab/0x1020
[ 33.465806][ C1] end_report+0x58/0x5e
[ 33.469933][ C1] kasan_report.cold+0xd/0x37
[ 33.474584][ C1] ? rwlock_bug.part.0+0x80/0x90
[ 33.479492][ C1] ? ath9k_hif_usb_rx_cb+0x3ab/0x1020
[ 33.484837][ C1] check_memory_region+0x13d/0x180
[ 33.490096][ C1] memcpy+0x20/0x60
[ 33.493914][ C1] ath9k_hif_usb_rx_cb+0x3ab/0x1020
[ 33.499087][ C1] ? lock_acquire+0x1a7/0x870
[ 33.503740][ C1] ? hif_usb_start+0xa0/0xa0
[ 33.508411][ C1] ? __usb_hcd_giveback_urb+0x302/0x560
[ 33.513930][ C1] ? lock_downgrade+0x6d0/0x6d0
[ 33.518758][ C1] __usb_hcd_giveback_urb+0x32d/0x560
[ 33.524106][ C1] usb_hcd_giveback_urb+0x367/0x410
[ 33.529333][ C1] dummy_timer+0x11f4/0x3280
[ 33.533902][ C1] ? dummy_dequeue+0x4c0/0x4c0
[ 33.538646][ C1] ? dummy_dequeue+0x4c0/0x4c0
[ 33.543535][ C1] call_timer_fn+0x1a5/0x630
[ 33.548096][ C1] ? timer_fixup_init+0x60/0x60
[ 33.552933][ C1] ? lock_downgrade+0x6d0/0x6d0
[ 33.557782][ C1] ? lockdep_hardirqs_on_prepare+0x129/0x3e0
[ 33.563742][ C1] ? dummy_dequeue+0x4c0/0x4c0
[ 33.568480][ C1] __run_timers.part.0+0x67c/0xa10
[ 33.573563][ C1] ? call_timer_fn+0x630/0x630
[ 33.578302][ C1] ? clockevents_program_event+0x12b/0x350
[ 33.584105][ C1] ? tick_program_event+0xa8/0x130
[ 33.589188][ C1] run_timer_softirq+0x80/0x120
[ 33.594012][ C1] __do_softirq+0x1b2/0x945
[ 33.598490][ C1] asm_call_irq_on_stack+0xf/0x20
[ 33.603490][ C1]
[ 33.606404][ C1] do_softirq_own_stack+0x80/0xa0
[ 33.611400][ C1] irq_exit_rcu+0x110/0x1a0
[ 33.615876][ C1] sysvec_apic_timer_interrupt+0x43/0xa0
[ 33.621568][ C1] asm_sysvec_apic_timer_interrupt+0x12/0x20
[ 33.627522][ C1] RIP: 0010:acpi_idle_do_entry+0x1c9/0x250
[ 33.633309][ C1] Code: bd c9 a3 fb 84 db 75 ac e8 64 d1 a3 fb e8 9f 77 a9 fb e9 0c 00 00 00 e8 55 d1 a3 fb 0f 00 2d 9e 44 6c 00 e8 49 d1 a3 fb fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 e4 c9 a3 fb 48 85 db
[ 33.652978][ C1] RSP: 0018:ffffc900000dfd18 EFLAGS: 00000293
[ 33.659017][ C1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 1ffffffff10788a1
[ 33.666967][ C1] RDX: ffff888100293280 RSI: ffffffff859afbe7 RDI: ffffffff859afbd1
[ 33.674929][ C1] RBP: ffff888103919864 R08: 0000000000000001 R09: 0000000000000001
[ 33.682872][ C1] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
[ 33.690904][ C1] R13: ffff888103919800 R14: ffff888103919864 R15: ffff888105486804
[ 33.698858][ C1] ? acpi_idle_do_entry+0x1c7/0x250
[ 33.704027][ C1] ? acpi_idle_do_entry+0x1b1/0x250
[ 33.709204][ C1] ? acpi_idle_do_entry+0x1c7/0x250
[ 33.714382][ C1] acpi_idle_enter+0x355/0x4f0
[ 33.719120][ C1] cpuidle_enter_state+0x1b1/0xc80
[ 33.724200][ C1] cpuidle_enter+0x4a/0xa0
[ 33.728587][ C1] do_idle+0x3d5/0x580
[ 33.732628][ C1] ? arch_cpu_idle_exit+0x40/0x40
[ 33.737625][ C1] ? lockdep_hardirqs_on_prepare+0x273/0x3e0
[ 33.743574][ C1] ? _raw_spin_unlock_irqrestore+0x34/0x40
[ 33.756034][ C1] ? trace_hardirqs_on+0x5b/0x1a0
[ 33.761159][ C1] cpu_startup_entry+0x14/0x20
[ 33.765897][ C1] start_secondary+0x265/0x340
[ 33.770738][ C1] ? set_cpu_sibling_map+0x2460/0x2460
[ 33.776314][ C1] secondary_startup_64_no_verify+0xa6/0xab
[ 33.782783][ C1] Kernel Offset: disabled
[ 33.787115][ C1] Rebooting in 86400 seconds..