Warning: Permanently added '10.128.0.9' (ECDSA) to the list of known hosts.
2020/04/03 02:16:09 parsed 1 programs
2020/04/03 02:16:09 executed programs: 0
[ 32.051849][ T532] cgroup: Unknown subsys name 'perf_event'
[ 32.054404][ T536] cgroup: Unknown subsys name 'perf_event'
[ 32.057917][ T534] cgroup: Unknown subsys name 'perf_event'
[ 32.064896][ T538] cgroup: Unknown subsys name 'perf_event'
[ 32.076769][ T532] cgroup: Unknown subsys name 'net_cls'
[ 32.077844][ T536] cgroup: Unknown subsys name 'net_cls'
[ 32.087088][ T540] cgroup: Unknown subsys name 'perf_event'
[ 32.089150][ T538] cgroup: Unknown subsys name 'net_cls'
[ 32.093849][ T540] cgroup: Unknown subsys name 'net_cls'
[ 32.100210][ T534] cgroup: Unknown subsys name 'net_cls'
[ 32.107949][ T541] cgroup: Unknown subsys name 'perf_event'
[ 32.122439][ T541] cgroup: Unknown subsys name 'net_cls'
[ 40.053816][ T169] usb 6-1: new high-speed USB device number 2 using dummy_hcd
[ 40.263747][ T167] usb 3-1: new high-speed USB device number 2 using dummy_hcd
[ 40.274136][ T169] usb 6-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config
[ 40.284819][ T169] usb 6-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 6
[ 40.303932][ T22] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 40.413641][ T95] usb 4-1: new high-speed USB device number 2 using dummy_hcd
[ 40.453688][ T17] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[ 40.461354][ T83] usb 2-1: new high-speed USB device number 2 using dummy_hcd
[ 40.473899][ T169] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 40.482952][ T169] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 40.491015][ T169] usb 6-1: Product: syz
[ 40.495278][ T169] usb 6-1: Manufacturer: syz
[ 40.499871][ T169] usb 6-1: SerialNumber: syz
[ 40.504565][ T167] usb 3-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config
[ 40.514825][ T167] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 6
[ 40.523880][ T22] usb 5-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config
[ 40.538127][ T22] usb 5-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 6
[ 40.574961][ T169] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 40.663664][ T17] usb 1-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config
[ 40.674096][ T83] usb 2-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config
[ 40.684789][ T17] usb 1-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 6
[ 40.693723][ T95] usb 4-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config
[ 40.698503][ T83] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 6
[ 40.708826][ T167] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 40.723637][ T22] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 40.730616][ T167] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 40.739697][ T22] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 40.747644][ T167] usb 3-1: Product: syz
[ 40.755764][ T22] usb 5-1: Product: syz
[ 40.759896][ T167] usb 3-1: Manufacturer: syz
[ 40.764092][ T22] usb 5-1: Manufacturer: syz
[ 40.768665][ T167] usb 3-1: SerialNumber: syz
[ 40.773235][ T22] usb 5-1: SerialNumber: syz
[ 40.778327][ T95] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 6
[ 40.824289][ T22] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 40.854134][ T167] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 40.913691][ T83] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 40.922917][ T83] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 40.931049][ T83] usb 2-1: Product: syz
[ 40.935322][ T83] usb 2-1: Manufacturer: syz
[ 40.939908][ T83] usb 2-1: SerialNumber: syz
[ 40.944735][ T17] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 40.953871][ T17] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 40.961873][ T17] usb 1-1: Product: syz
[ 40.966114][ T17] usb 1-1: Manufacturer: syz
[ 40.970707][ T17] usb 1-1: SerialNumber: syz
[ 40.983692][ T95] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 40.992756][ T95] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 41.000779][ T95] usb 4-1: Product: syz
[ 41.005013][ T95] usb 4-1: Manufacturer: syz
[ 41.009607][ T95] usb 4-1: SerialNumber: syz
[ 41.014241][ T17] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 41.022956][ T83] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 41.054464][ T95] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 41.303729][ T169] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[ 41.453454][ T22] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[ 41.463606][ T167] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[ 41.524065][ T169] ath9k_htc 6-1:1.0: ath9k_htc: Unable to initialize HTC services
[ 41.532134][ T169] ath9k_htc: Failed to initialize the device
[ 41.603414][ T17] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[ 41.612524][ T83] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[ 41.663473][ T95] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[ 41.675044][ T22] ath9k_htc 5-1:1.0: ath9k_htc: Unable to initialize HTC services
[ 41.683081][ T22] ath9k_htc: Failed to initialize the device
[ 41.693575][ T167] ath9k_htc 3-1:1.0: ath9k_htc: Unable to initialize HTC services
[ 41.701581][ T167] ath9k_htc: Failed to initialize the device
[ 41.723558][ C0] ==================================================================
[ 41.732584][ C0] BUG: KASAN: use-after-free in ath9k_wmi_ctrl_rx+0x416/0x500
[ 41.740029][ C0] Read of size 1 at addr ffff8881d335b17c by task swapper/0/0
[ 41.747480][ C0]
[ 41.749795][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.6.0-rc7-syzkaller #0
[ 41.757764][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 41.767804][ C0] Call Trace:
[ 41.771080][ C0]
[ 41.773929][ C0] dump_stack+0xef/0x16e
[ 41.778177][ C0] ? ath9k_wmi_ctrl_rx+0x416/0x500
[ 41.783279][ C0] ? ath9k_wmi_ctrl_rx+0x416/0x500
[ 41.788384][ C0] print_address_description.constprop.0.cold+0xd3/0x314
[ 41.795400][ C0] ? ath9k_wmi_ctrl_rx+0x416/0x500
[ 41.800554][ C0] ? ath9k_wmi_ctrl_rx+0x416/0x500
[ 41.805684][ C0] __kasan_report.cold+0x37/0x77
[ 41.810670][ C0] ? ath9k_wmi_ctrl_rx+0x416/0x500
[ 41.816093][ C0] ? ath9k_wmi_event_tasklet+0x440/0x440
[ 41.821713][ C0] kasan_report+0xe/0x20
[ 41.825961][ C0] ath9k_wmi_ctrl_rx+0x416/0x500
[ 41.830897][ C0] ? ath9k_wmi_event_tasklet+0x440/0x440
[ 41.836509][ C0] ath9k_htc_rx_msg+0x2d9/0xac0
[ 41.841357][ C0] ath9k_hif_usb_reg_in_cb+0x1ba/0x630
[ 41.846813][ C0] ? _raw_read_unlock+0x1a/0x30
[ 41.851657][ C0] ? led_trigger_blink_oneshot+0xb4/0xe0
[ 41.857282][ C0] __usb_hcd_giveback_urb+0x1f2/0x470
[ 41.862640][ C0] usb_hcd_giveback_urb+0x368/0x420
[ 41.868134][ C0] dummy_timer+0x1258/0x32ae
[ 41.872734][ C0] ? dummy_udc_probe+0x930/0x930
[ 41.877668][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 41.883202][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 41.888503][ C0] call_timer_fn+0x195/0x6f0
[ 41.893075][ C0] ? dummy_udc_probe+0x930/0x930
[ 41.897996][ C0] ? msleep_interruptible+0x130/0x130
[ 41.903357][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 41.908976][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 41.914257][ C0] ? _raw_spin_unlock_irq+0x1f/0x30
[ 41.919441][ C0] ? dummy_udc_probe+0x930/0x930
[ 41.924373][ C0] run_timer_softirq+0x5f9/0x1500
[ 41.924880][ T3248] usb 6-1: USB disconnect, device number 2
[ 41.929421][ C0] ? add_timer+0x7a0/0x7a0
[ 41.939642][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 41.945204][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 41.950498][ C0] __do_softirq+0x21e/0x950
[ 41.955006][ C0] irq_exit+0x178/0x1a0
[ 41.959177][ C0] smp_apic_timer_interrupt+0x141/0x540
[ 41.964721][ C0] apic_timer_interrupt+0xf/0x20
[ 41.969635][ C0]
[ 41.972657][ C0] RIP: 0010:default_idle+0x28/0x300
[ 41.977870][ C0] Code: cc cc 41 56 41 55 65 44 8b 2d 04 3b 72 7a 41 54 55 53 0f 1f 44 00 00 e8 b6 27 b5 fb e9 07 00 00 00 0f 00 2d aa d0 52 00 fb f4 <65> 44 8b 2d e0 3a 72 7a 0f 1f 44 00 00 5b 5d 41 5c 41 5d 41 5e c3
[ 41.997646][ C0] RSP: 0018:ffffffff87007d80 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
[ 42.006061][ C0] RAX: 0000000000000007 RBX: ffffffff8702cc40 RCX: 0000000000000000
[ 42.014029][ C0] RDX: 0000000000000000 RSI: 0000000000000006 RDI: ffffffff8702d48c
[ 42.022003][ C0] RBP: fffffbfff0e05988 R08: ffffffff8702cc40 R09: 0000000000000000
[ 42.029960][ C0] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[ 42.037921][ C0] R13: 0000000000000000 R14: ffffffff87e612c0 R15: 0000000000000000
[ 42.045915][ C0] do_idle+0x3e0/0x500
[ 42.051188][ C0] ? arch_cpu_idle_exit+0x40/0x40
[ 42.056194][ C0] ? schedule+0xe1/0x2b0
[ 42.060416][ C0] cpu_startup_entry+0x14/0x20
[ 42.065173][ C0] start_kernel+0xe16/0xe5a
[ 42.069655][ C0] ? mem_encrypt_init+0x5/0x5
[ 42.074324][ C0] ? x86_family+0x3d/0x50
[ 42.076540][ T3257] usb 5-1: USB disconnect, device number 2
[ 42.078655][ C0] ? load_ucode_bsp+0x23d/0x27d
[ 42.089293][ C0] secondary_startup_64+0xb6/0xc0
[ 42.094313][ C0]
[ 42.096649][ C0] Allocated by task 169:
[ 42.100901][ C0] save_stack+0x1b/0x80
[ 42.103838][ T3257] usb 5-1: ath9k_htc: USB layer deinitialized
[ 42.105077][ C0] __kasan_kmalloc.constprop.0+0xbf/0xd0
[ 42.105089][ C0] ath9k_init_wmi+0x40/0x310
[ 42.105100][ C0] ath9k_htc_probe_device+0x21c/0x1d80
[ 42.105114][ C0] ath9k_htc_hw_init+0x31/0x60
[ 42.131867][ C0] ath9k_hif_usb_firmware_cb+0x26b/0x500
[ 42.137497][ C0] request_firmware_work_func+0x126/0x242
[ 42.143246][ C0] process_one_work+0x94b/0x1620
[ 42.148189][ C0] worker_thread+0x96/0xe20
[ 42.152727][ C0] kthread+0x318/0x420
[ 42.156785][ C0] ret_from_fork+0x24/0x30
[ 42.161189][ C0]
[ 42.163511][ C0] Freed by task 169:
[ 42.167393][ C0] save_stack+0x1b/0x80
[ 42.171614][ C0] __kasan_slab_free+0x117/0x160
[ 42.176588][ C0] kfree+0xd5/0x300
[ 42.180381][ C0] ath9k_htc_probe_device+0x278/0x1d80
[ 42.185827][ C0] ath9k_htc_hw_init+0x31/0x60
[ 42.190602][ C0] ath9k_hif_usb_firmware_cb+0x26b/0x500
[ 42.196221][ C0] request_firmware_work_func+0x126/0x242
[ 42.202062][ C0] process_one_work+0x94b/0x1620
[ 42.207367][ C0] worker_thread+0x96/0xe20
[ 42.211859][ C0] kthread+0x318/0x420
[ 42.215919][ C0] ret_from_fork+0x24/0x30
[ 42.220412][ C0]
[ 42.222758][ C0] The buggy address belongs to the object at ffff8881d335b000
[ 42.222758][ C0] which belongs to the cache kmalloc-2k of size 2048
[ 42.237087][ C0] The buggy address is located 380 bytes inside of
[ 42.237087][ C0] 2048-byte region [ffff8881d335b000, ffff8881d335b800)
[ 42.251380][ C0] The buggy address belongs to the page:
[ 42.257443][ C0] page:ffffea00074cd600 refcount:1 mapcount:0 mapping:ffff8881da00c000 index:0x0 compound_mapcount: 0
[ 42.268378][ C0] flags: 0x200000000010200(slab|head)
[ 42.273749][ C0] raw: 0200000000010200 dead000000000100 dead000000000122 ffff8881da00c000
[ 42.282324][ C0] raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
[ 42.290885][ C0] page dumped because: kasan: bad access detected
[ 42.297369][ C0]
[ 42.299678][ C0] Memory state around the buggy address:
[ 42.305317][ C0] ffff8881d335b000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 42.313808][ C0] ffff8881d335b080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 42.321850][ C0] >ffff8881d335b100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 42.329891][ C0] ^
[ 42.337864][ C0] ffff8881d335b180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 42.345913][ C0] ffff8881d335b200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 42.353988][ C0] ==================================================================
[ 42.362139][ C0] Disabling lock debugging due to kernel taint
[ 42.368279][ C0] Kernel panic - not syncing: panic_on_warn set ...
[ 42.374866][ C0] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G B 5.6.0-rc7-syzkaller #0
[ 42.384211][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 42.394251][ C0] Call Trace:
[ 42.397542][ C0]
[ 42.400605][ C0] dump_stack+0xef/0x16e
[ 42.404845][ C0] panic+0x2aa/0x6e1
[ 42.408776][ C0] ? add_taint.cold+0x16/0x16
[ 42.413444][ C0] ? print_shadow_for_address+0xb8/0x114
[ 42.419063][ C0] ? trace_hardirqs_off+0x50/0x200
[ 42.424159][ C0] ? ath9k_wmi_ctrl_rx+0x416/0x500
[ 42.429262][ C0] end_report+0x43/0x49
[ 42.433420][ C0] ? ath9k_wmi_ctrl_rx+0x416/0x500
[ 42.438545][ C0] __kasan_report.cold+0x55/0x77
[ 42.443491][ C0] ? ath9k_wmi_ctrl_rx+0x416/0x500
[ 42.448667][ C0] ? ath9k_wmi_event_tasklet+0x440/0x440
[ 42.454276][ C0] kasan_report+0xe/0x20
[ 42.458496][ C0] ath9k_wmi_ctrl_rx+0x416/0x500
[ 42.463420][ C0] ? ath9k_wmi_event_tasklet+0x440/0x440
[ 42.469044][ C0] ath9k_htc_rx_msg+0x2d9/0xac0
[ 42.473881][ C0] ath9k_hif_usb_reg_in_cb+0x1ba/0x630
[ 42.479354][ C0] ? _raw_read_unlock+0x1a/0x30
[ 42.484363][ C0] ? led_trigger_blink_oneshot+0xb4/0xe0
[ 42.489983][ C0] __usb_hcd_giveback_urb+0x1f2/0x470
[ 42.495598][ C0] usb_hcd_giveback_urb+0x368/0x420
[ 42.500785][ C0] dummy_timer+0x1258/0x32ae
[ 42.505357][ C0] ? dummy_udc_probe+0x930/0x930
[ 42.510426][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 42.515968][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 42.521232][ C0] call_timer_fn+0x195/0x6f0
[ 42.525804][ C0] ? dummy_udc_probe+0x930/0x930
[ 42.530775][ C0] ? msleep_interruptible+0x130/0x130
[ 42.536177][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 42.541701][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 42.547025][ C0] ? _raw_spin_unlock_irq+0x1f/0x30
[ 42.552226][ C0] ? dummy_udc_probe+0x930/0x930
[ 42.557166][ C0] run_timer_softirq+0x5f9/0x1500
[ 42.562172][ C0] ? add_timer+0x7a0/0x7a0
[ 42.566568][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 42.572106][ C0] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 42.577386][ C0] __do_softirq+0x21e/0x950
[ 42.581894][ C0] irq_exit+0x178/0x1a0
[ 42.586209][ C0] smp_apic_timer_interrupt+0x141/0x540
[ 42.591742][ C0] apic_timer_interrupt+0xf/0x20
[ 42.596662][ C0]
[ 42.599586][ C0] RIP: 0010:default_idle+0x28/0x300
[ 42.604824][ C0] Code: cc cc 41 56 41 55 65 44 8b 2d 04 3b 72 7a 41 54 55 53 0f 1f 44 00 00 e8 b6 27 b5 fb e9 07 00 00 00 0f 00 2d aa d0 52 00 fb f4 <65> 44 8b 2d e0 3a 72 7a 0f 1f 44 00 00 5b 5d 41 5c 41 5d 41 5e c3
[ 42.624413][ C0] RSP: 0018:ffffffff87007d80 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
[ 42.632889][ C0] RAX: 0000000000000007 RBX: ffffffff8702cc40 RCX: 0000000000000000
[ 42.640843][ C0] RDX: 0000000000000000 RSI: 0000000000000006 RDI: ffffffff8702d48c
[ 42.643096][ T17] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive
[ 42.648802][ C0] RBP: fffffbfff0e05988 R08: ffffffff8702cc40 R09: 0000000000000000
[ 42.648809][ C0] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[ 42.648815][ C0] R13: 0000000000000000 R14: ffffffff87e612c0 R15: 0000000000000000
[ 42.648841][ C0] do_idle+0x3e0/0x500
[ 42.655750][ T83] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive
[ 42.663646][ C0] ? arch_cpu_idle_exit+0x40/0x40
[ 42.663655][ C0] ? schedule+0xe1/0x2b0
[ 42.663665][ C0] cpu_startup_entry+0x14/0x20
[ 42.663676][ C0] start_kernel+0xe16/0xe5a
[ 42.663688][ C0] ? mem_encrypt_init+0x5/0x5
[ 42.663698][ C0] ? x86_family+0x3d/0x50
[ 42.663709][ C0] ? load_ucode_bsp+0x23d/0x27d
[ 42.663718][ C0] secondary_startup_64+0xb6/0xc0
[ 42.672382][ C0] Kernel Offset: disabled
[ 42.732774][ C0] Rebooting in 86400 seconds..