Warning: Permanently added '10.128.15.195' (ECDSA) to the list of known hosts.
2020/04/02 14:06:12 parsed 1 programs
2020/04/02 14:06:12 executed programs: 0
[ 30.451440][ T530] cgroup: Unknown subsys name 'perf_event'
[ 30.455119][ T529] cgroup: Unknown subsys name 'perf_event'
[ 30.463889][ T529] cgroup: Unknown subsys name 'net_cls'
[ 30.466029][ T532] cgroup: Unknown subsys name 'perf_event'
[ 30.473193][ T530] cgroup: Unknown subsys name 'net_cls'
[ 30.477567][ T534] cgroup: Unknown subsys name 'perf_event'
[ 30.488995][ T536] cgroup: Unknown subsys name 'perf_event'
[ 30.497937][ T532] cgroup: Unknown subsys name 'net_cls'
[ 30.500663][ T540] cgroup: Unknown subsys name 'perf_event'
[ 30.504632][ T536] cgroup: Unknown subsys name 'net_cls'
[ 30.514256][ T540] cgroup: Unknown subsys name 'net_cls'
[ 30.522389][ T534] cgroup: Unknown subsys name 'net_cls'
[ 38.234999][ T393] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[ 38.524770][ T17] usb 6-1: new high-speed USB device number 2 using dummy_hcd
[ 38.604880][ T393] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 38.614227][ T393] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 38.622524][ T393] usb 1-1: Product: syz
[ 38.626742][ T393] usb 1-1: Manufacturer: syz
[ 38.631329][ T393] usb 1-1: SerialNumber: syz
[ 38.676135][ T393] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 38.684316][ T393] ath9k_debug ath9k_hif_usb_probe, 1317
[ 38.727424][ T393] ath9k_debug ath9k_hif_usb_firmware_cb, 1171
[ 38.733546][ T393] ath9k_debug ath9k_hif_usb_firmware_cb, 1183
[ 38.764614][ T164] usb 4-1: new high-speed USB device number 2 using dummy_hcd
[ 38.804477][ T12] usb 2-1: new high-speed USB device number 2 using dummy_hcd
[ 38.854580][ T83] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 38.862238][ T21] usb 3-1: new high-speed USB device number 2 using dummy_hcd
[ 38.914598][ T17] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 38.923704][ T17] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 38.931781][ T17] usb 6-1: Product: syz
[ 38.936011][ T17] usb 6-1: Manufacturer: syz
[ 38.940588][ T17] usb 6-1: SerialNumber: syz
[ 38.985879][ T17] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 38.994017][ T17] ath9k_debug ath9k_hif_usb_probe, 1317
[ 39.002713][ T17] ath9k_debug ath9k_hif_usb_firmware_cb, 1171
[ 39.009214][ T17] ath9k_debug ath9k_hif_usb_firmware_cb, 1183
[ 39.154611][ T164] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 39.163666][ T164] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 39.171706][ T164] usb 4-1: Product: syz
[ 39.175963][ T164] usb 4-1: Manufacturer: syz
[ 39.180547][ T164] usb 4-1: SerialNumber: syz
[ 39.204544][ T12] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 39.214332][ T12] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 39.222311][ T12] usb 2-1: Product: syz
[ 39.226619][ T12] usb 2-1: Manufacturer: syz
[ 39.231207][ T12] usb 2-1: SerialNumber: syz
[ 39.236418][ T164] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 39.244694][ T164] ath9k_debug ath9k_hif_usb_probe, 1317
[ 39.252554][ T164] ath9k_debug ath9k_hif_usb_firmware_cb, 1171
[ 39.258801][ T164] ath9k_debug ath9k_hif_usb_firmware_cb, 1183
[ 39.264714][ T21] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 39.273966][ T21] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 39.282289][ T21] usb 3-1: Product: syz
[ 39.286509][ T21] usb 3-1: Manufacturer: syz
[ 39.291094][ T21] usb 3-1: SerialNumber: syz
[ 39.295822][ T83] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 39.304928][ T83] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 39.313259][ T83] usb 5-1: Product: syz
[ 39.314971][ T12] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 39.317473][ T83] usb 5-1: Manufacturer: syz
[ 39.325573][ T12] ath9k_debug ath9k_hif_usb_probe, 1317
[ 39.330158][ T83] usb 5-1: SerialNumber: syz
[ 39.351524][ T12] ath9k_debug ath9k_hif_usb_firmware_cb, 1171
[ 39.357868][ T12] ath9k_debug ath9k_hif_usb_firmware_cb, 1183
[ 39.375152][ T21] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 39.383247][ T21] ath9k_debug ath9k_hif_usb_probe, 1317
[ 39.389575][ T83] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 39.397711][ T83] ath9k_debug ath9k_hif_usb_probe, 1317
[ 39.403523][ T393] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[ 39.412602][ T393] ath9k_debug ath9k_hif_usb_alloc_urbs, 957
[ 39.418605][ T393] CPU: 1 PID: 393 Comm: kworker/1:3 Not tainted 5.6.0-rc7-syzkaller #0
[ 39.426829][ T393] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 39.436967][ T393] Workqueue: events request_firmware_work_func
[ 39.443100][ T393] Call Trace:
[ 39.446493][ T393] dump_stack+0xef/0x16e
[ 39.451348][ T393] ? ath9k_hif_usb_disconnect.cold+0xb9/0xb9
[ 39.457323][ T393] ath9k_hif_usb_alloc_urbs+0x3a/0x9e5
[ 39.462854][ T393] ? ath9k_hif_usb_download_fw+0x34d/0x35f
[ 39.468651][ T393] ? ath9k_hif_usb_disconnect.cold+0xb9/0xb9
[ 39.474618][ T393] ath9k_hif_usb_firmware_cb+0x221/0x51d
[ 39.480260][ T393] ? ath9k_hif_usb_disconnect.cold+0xb9/0xb9
[ 39.486231][ T393] request_firmware_work_func+0x126/0x242
[ 39.491949][ T393] ? request_firmware_into_buf+0x90/0x90
[ 39.497563][ T393] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 39.503087][ T393] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 39.508365][ T393] process_one_work+0x94b/0x1620
[ 39.513284][ T393] ? pwq_dec_nr_in_flight+0x310/0x310
[ 39.518641][ T393] ? do_raw_spin_lock+0x129/0x290
[ 39.523748][ T393] worker_thread+0x96/0xe20
[ 39.528241][ T393] ? process_one_work+0x1620/0x1620
[ 39.533429][ T393] kthread+0x318/0x420
[ 39.538065][ T393] ? kthread_create_on_node+0xf0/0xf0
[ 39.543621][ T393] ret_from_fork+0x24/0x30
[ 39.560934][ T393] ath9k_debug ath9k_hif_usb_alloc_reg_in_urbs, 900
[ 39.567586][ T393] CPU: 1 PID: 393 Comm: kworker/1:3 Not tainted 5.6.0-rc7-syzkaller #0
[ 39.575817][ T393] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 39.586207][ T393] Workqueue: events request_firmware_work_func
[ 39.592444][ T393] Call Trace:
[ 39.595733][ T393] dump_stack+0xef/0x16e
[ 39.601638][ T393] ath9k_hif_usb_alloc_urbs+0x67c/0x9e5
[ 39.607174][ T393] ? ath9k_hif_usb_disconnect.cold+0xb9/0xb9
[ 39.613141][ T393] ath9k_hif_usb_firmware_cb+0x221/0x51d
[ 39.618866][ T393] ? ath9k_hif_usb_disconnect.cold+0xb9/0xb9
[ 39.624835][ T393] request_firmware_work_func+0x126/0x242
[ 39.630568][ T393] ? request_firmware_into_buf+0x90/0x90
[ 39.636184][ T393] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 39.641715][ T393] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 39.647004][ T393] process_one_work+0x94b/0x1620
[ 39.651937][ T393] ? pwq_dec_nr_in_flight+0x310/0x310
[ 39.657302][ T393] ? do_raw_spin_lock+0x129/0x290
[ 39.662317][ T393] worker_thread+0x96/0xe20
[ 39.666821][ T393] ? process_one_work+0x1620/0x1620
[ 39.672935][ T393] kthread+0x318/0x420
[ 39.676988][ T393] ? kthread_create_on_node+0xf0/0xf0
[ 39.682346][ T393] ret_from_fork+0x24/0x30
[ 39.689244][ T21] ath9k_debug ath9k_hif_usb_firmware_cb, 1171
[ 39.695370][ T21] ath9k_debug ath9k_hif_usb_firmware_cb, 1183
[ 39.701511][ T83] ath9k_debug ath9k_hif_usb_firmware_cb, 1171
[ 39.707956][ T83] ath9k_debug ath9k_hif_usb_firmware_cb, 1183
[ 39.806968][ T3243] usb 1-1: USB disconnect, device number 2
[ 39.844277][ T17] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[ 39.853373][ T17] ath9k_debug ath9k_hif_usb_alloc_urbs, 957
[ 39.859405][ T17] CPU: 1 PID: 17 Comm: kworker/1:0 Not tainted 5.6.0-rc7-syzkaller #0
[ 39.867662][ T17] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 39.877729][ T17] Workqueue: events request_firmware_work_func
[ 39.884654][ T17] Call Trace:
[ 39.887953][ T17] dump_stack+0xef/0x16e
[ 39.892190][ T17] ? ath9k_hif_usb_disconnect.cold+0xb9/0xb9
[ 39.898235][ T17] ath9k_hif_usb_alloc_urbs+0x3a/0x9e5
[ 39.904413][ T17] ? ath9k_hif_usb_download_fw+0x34d/0x35f
[ 39.910209][ T17] ? ath9k_hif_usb_disconnect.cold+0xb9/0xb9
[ 39.916177][ T17] ath9k_hif_usb_firmware_cb+0x221/0x51d
[ 39.921801][ T17] ? ath9k_hif_usb_disconnect.cold+0xb9/0xb9
[ 39.927924][ T17] request_firmware_work_func+0x126/0x242
[ 39.933639][ T17] ? request_firmware_into_buf+0x90/0x90
[ 39.939254][ T17] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 39.944787][ T17] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 39.950053][ T17] process_one_work+0x94b/0x1620
[ 39.954976][ T17] ? pwq_dec_nr_in_flight+0x310/0x310
[ 39.960348][ T17] ? do_raw_spin_lock+0x129/0x290
[ 39.965368][ T17] worker_thread+0x96/0xe20
[ 39.969860][ T17] ? process_one_work+0x1620/0x1620
[ 39.975055][ T17] kthread+0x318/0x420
[ 39.979124][ T17] ? kthread_create_on_node+0xf0/0xf0
[ 39.984482][ T17] ret_from_fork+0x24/0x30
[ 39.989682][ T17] ath9k_debug ath9k_hif_usb_alloc_reg_in_urbs, 900
[ 39.996734][ T17] CPU: 1 PID: 17 Comm: kworker/1:0 Not tainted 5.6.0-rc7-syzkaller #0
[ 40.005095][ T17] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 40.015148][ T17] Workqueue: events request_firmware_work_func
[ 40.021283][ T17] Call Trace:
[ 40.025088][ T17] dump_stack+0xef/0x16e
[ 40.030012][ T17] ath9k_hif_usb_alloc_urbs+0x67c/0x9e5
[ 40.035552][ T17] ? ath9k_hif_usb_disconnect.cold+0xb9/0xb9
[ 40.041524][ T17] ath9k_hif_usb_firmware_cb+0x221/0x51d
[ 40.047147][ T17] ? ath9k_hif_usb_disconnect.cold+0xb9/0xb9
[ 40.053117][ T17] request_firmware_work_func+0x126/0x242
[ 40.058849][ T17] ? request_firmware_into_buf+0x90/0x90
[ 40.064499][ T17] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 40.070046][ T17] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 40.075343][ T17] process_one_work+0x94b/0x1620
[ 40.080277][ T17] ? pwq_dec_nr_in_flight+0x310/0x310
[ 40.085664][ T17] ? do_raw_spin_lock+0x129/0x290
[ 40.090722][ T17] worker_thread+0x96/0xe20
[ 40.095325][ T17] ? process_one_work+0x1620/0x1620
[ 40.100507][ T17] kthread+0x318/0x420
[ 40.104566][ T17] ? kthread_create_on_node+0xf0/0xf0
[ 40.109931][ T17] ret_from_fork+0x24/0x30
[ 40.134274][ C1] ==================================================================
[ 40.142435][ C1] BUG: KASAN: use-after-free in ath9k_htc_rx_msg+0xa25/0xaf0
[ 40.149814][ C1] Write of size 2 at addr ffff8881d8b071b0 by task swapper/1/0
[ 40.157340][ C1]
[ 40.159655][ C1] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.6.0-rc7-syzkaller #0
[ 40.167537][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 40.177630][ C1] Call Trace:
[ 40.180912][ C1]
[ 40.183755][ C1] dump_stack+0xef/0x16e
[ 40.187978][ C1] ? ath9k_htc_rx_msg+0xa25/0xaf0
[ 40.192997][ C1] ? ath9k_htc_rx_msg+0xa25/0xaf0
[ 40.198055][ C1] print_address_description.constprop.0.cold+0xd3/0x314
[ 40.205107][ C1] ? ath9k_htc_rx_msg+0xa25/0xaf0
[ 40.210109][ C1] ? ath9k_htc_rx_msg+0xa25/0xaf0
[ 40.215818][ C1] __kasan_report.cold+0x37/0x77
[ 40.220749][ C1] ? ath9k_htc_rx_msg+0xa25/0xaf0
[ 40.225770][ C1] kasan_report+0xe/0x20
[ 40.230012][ C1] ath9k_htc_rx_msg+0xa25/0xaf0
[ 40.234851][ C1] ath9k_hif_usb_reg_in_cb+0x1ba/0x630
[ 40.240300][ C1] ? _raw_read_unlock+0x1a/0x30
[ 40.245144][ C1] ? led_trigger_blink_oneshot+0xb4/0xe0
[ 40.247995][ T5] usb 6-1: USB disconnect, device number 2
[ 40.250782][ C1] __usb_hcd_giveback_urb+0x1f2/0x470
[ 40.261929][ C1] usb_hcd_giveback_urb+0x368/0x420
[ 40.267128][ C1] dummy_timer+0x1258/0x32ae
[ 40.272592][ C1] ? dummy_udc_probe+0x930/0x930
[ 40.277536][ C1] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 40.283081][ C1] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 40.289048][ C1] call_timer_fn+0x195/0x6f0
[ 40.293626][ C1] ? dummy_udc_probe+0x930/0x930
[ 40.298548][ C1] ? msleep_interruptible+0x130/0x130
[ 40.303909][ C1] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 40.309448][ C1] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 40.314720][ C1] ? _raw_spin_unlock_irq+0x1f/0x30
[ 40.319917][ C1] ? dummy_udc_probe+0x930/0x930
[ 40.324199][ T164] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[ 40.324847][ C1] run_timer_softirq+0x5f9/0x1500
[ 40.324859][ C1] ? add_timer+0x7a0/0x7a0
[ 40.324873][ C1] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 40.324885][ C1] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 40.324897][ C1] __do_softirq+0x21e/0x950
[ 40.324914][ C1] irq_exit+0x178/0x1a0
[ 40.333827][ T164] ath9k_debug ath9k_hif_usb_alloc_urbs, 957
[ 40.338836][ C1] smp_apic_timer_interrupt+0x141/0x540
[ 40.338848][ C1] apic_timer_interrupt+0xf/0x20
[ 40.338853][ C1]
[ 40.338864][ C1] RIP: 0010:default_idle+0x28/0x300
[ 40.338877][ C1] Code: cc cc 41 56 41 55 65 44 8b 2d 04 4b 72 7a 41 54 55 53 0f 1f 44 00 00 e8 b6 37 b5 fb e9 07 00 00 00 0f 00 2d aa e0 52 00 fb f4 <65> 44 8b 2d e0 4a 72 7a 0f 1f 44 00 00 5b 5d 41 5c 41 5d 41 5e c3
[ 40.338883][ C1] RSP: 0018:ffff8881da22fda8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
[ 40.338895][ C1] RAX: 0000000000000007 RBX: ffff8881da213100 RCX: 0000000000000000
[ 40.338907][ C1] RDX: 0000000000000000 RSI: 0000000000000006 RDI: ffff8881da21394c
[ 40.432350][ C1] RBP: ffffed103b442620 R08: ffff8881da213100 R09: 0000000000000000
[ 40.440310][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001
[ 40.448267][ C1] R13: 0000000000000001 R14: ffffffff87e615c0 R15: 0000000000000000
[ 40.456324][ C1] ? default_idle+0x1a/0x300
[ 40.460899][ C1] do_idle+0x3e0/0x500
[ 40.464950][ C1] ? __wake_up_common+0x147/0x650
[ 40.469962][ C1] ? arch_cpu_idle_exit+0x40/0x40
[ 40.475418][ C1] ? _raw_spin_unlock_irqrestore+0x39/0x40
[ 40.481209][ C1] ? lockdep_hardirqs_on+0x382/0x580
[ 40.486482][ C1] cpu_startup_entry+0x14/0x20
[ 40.491242][ C1] start_secondary+0x2a4/0x390
[ 40.495984][ C1] ? set_cpu_sibling_map+0x1e90/0x1e90
[ 40.501423][ C1] secondary_startup_64+0xb6/0xc0
[ 40.506424][ C1]
[ 40.506434][ T164] CPU: 0 PID: 164 Comm: kworker/0:3 Not tainted 5.6.0-rc7-syzkaller #0
[ 40.506446][ T164] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 40.508749][ C1] Allocated by task 3041:
[ 40.517681][ T164] Workqueue: events request_firmware_work_func
[ 40.527715][ C1] save_stack+0x1b/0x80
[ 40.532009][ T164] Call Trace:
[ 40.538153][ C1] __kasan_kmalloc.constprop.0+0xbf/0xd0
[ 40.538171][ C1] raw_alloc_io_data+0x150/0x1c0
[ 40.542335][ T164] dump_stack+0xef/0x16e
[ 40.545598][ C1] raw_ioctl+0x686/0x1a70
[ 40.545615][ C1] ksys_ioctl+0x11a/0x180
[ 40.551241][ T164] ? ath9k_hif_usb_disconnect.cold+0xb9/0xb9
[ 40.556153][ C1] __x64_sys_ioctl+0x6f/0xb0
[ 40.556170][ C1] do_syscall_64+0xb6/0x5a0
[ 40.560420][ T164] ath9k_hif_usb_alloc_urbs+0x3a/0x9e5
[ 40.564727][ C1] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 40.569034][ T164] ? ath9k_hif_usb_download_fw+0x34d/0x35f
[ 40.574989][ C1]
[ 40.579563][ T164] ? ath9k_hif_usb_disconnect.cold+0xb9/0xb9
[ 40.584032][ C1] Freed by task 3041:
[ 40.589470][ T164] ath9k_hif_usb_firmware_cb+0x221/0x51d
[ 40.595339][ C1] save_stack+0x1b/0x80
[ 40.601124][ T164] ? ath9k_hif_usb_disconnect.cold+0xb9/0xb9
[ 40.603444][ C1] __kasan_slab_free+0x117/0x160
[ 40.609401][ T164] request_firmware_work_func+0x126/0x242
[ 40.613349][ C1] kfree+0xd5/0x300
[ 40.613364][ C1] raw_ioctl+0x189/0x1a70
[ 40.618994][ T164] ? request_firmware_into_buf+0x90/0x90
[ 40.623120][ C1] ksys_ioctl+0x11a/0x180
[ 40.629074][ T164] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 40.633981][ C1] __x64_sys_ioctl+0x6f/0xb0
[ 40.639676][ T164] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 40.643463][ C1] do_syscall_64+0xb6/0x5a0
[ 40.647777][ T164] process_one_work+0x94b/0x1620
[ 40.653382][ C1] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 40.657688][ T164] ? pwq_dec_nr_in_flight+0x310/0x310
[ 40.663631][ C1]
[ 40.668207][ T164] ? do_raw_spin_lock+0x129/0x290
[ 40.673464][ C1] The buggy address belongs to the object at ffff8881d8b07000
[ 40.673464][ C1] which belongs to the cache kmalloc-2k of size 2048
[ 40.677961][ T164] worker_thread+0x96/0xe20
[ 40.682881][ C1] The buggy address is located 432 bytes inside of
[ 40.682881][ C1] 2048-byte region [ffff8881d8b07000, ffff8881d8b07800)
[ 40.689741][ T164] ? process_one_work+0x1620/0x1620
[ 40.695089][ C1] The buggy address belongs to the page:
[ 40.697424][ T164] kthread+0x318/0x420
[ 40.702425][ C1] page:ffffea000762c000 refcount:1 mapcount:0 mapping:ffff8881da00c000 index:0x0 compound_mapcount: 0
[ 40.716491][ T164] ? kthread_create_on_node+0xf0/0xf0
[ 40.720964][ C1] flags: 0x200000000010200(slab|head)
[ 40.735088][ T164] ret_from_fork+0x24/0x30
[ 40.740293][ C1] raw: 0200000000010200 dead000000000100 dead000000000122 ffff8881da00c000
[ 40.779413][ T164] ath9k_debug ath9k_hif_usb_alloc_reg_in_urbs, 900
[ 40.780432][ C1] raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
[ 40.780439][ C1] page dumped because: kasan: bad access detected
[ 40.780442][ C1]
[ 40.780446][ C1] Memory state around the buggy address:
[ 40.780457][ C1] ffff8881d8b07080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 40.780467][ C1] ffff8881d8b07100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 40.780476][ C1] >ffff8881d8b07180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 40.780487][ C1] ^
[ 40.789136][ T164] CPU: 0 PID: 164 Comm: kworker/0:3 Not tainted 5.6.0-rc7-syzkaller #0
[ 40.796433][ C1] ffff8881d8b07200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 40.805130][ T164] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 40.811538][ C1] ffff8881d8b07280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 40.813862][ T164] Workqueue: events request_firmware_work_func
[ 40.819550][ C1] ==================================================================
[ 40.827602][ T164] Call Trace:
[ 40.837386][ C1] Disabling lock debugging due to kernel taint
[ 40.846586][ T164] dump_stack+0xef/0x16e
[ 40.852189][ C1] Kernel panic - not syncing: panic_on_warn set ...
[ 40.860406][ T164] ath9k_hif_usb_alloc_urbs+0x67c/0x9e5
[ 40.932116][ T164] ? ath9k_hif_usb_disconnect.cold+0xb9/0xb9
[ 40.938077][ T164] ath9k_hif_usb_firmware_cb+0x221/0x51d
[ 40.943708][ T164] ? ath9k_hif_usb_disconnect.cold+0xb9/0xb9
[ 40.949676][ T164] request_firmware_work_func+0x126/0x242
[ 40.955486][ T164] ? request_firmware_into_buf+0x90/0x90
[ 40.961411][ T164] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 40.966940][ T164] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 40.972223][ T164] process_one_work+0x94b/0x1620
[ 40.977145][ T164] ? pwq_dec_nr_in_flight+0x310/0x310
[ 40.982496][ T164] ? do_raw_spin_lock+0x129/0x290
[ 40.987516][ T164] worker_thread+0x96/0xe20
[ 40.992029][ T164] ? process_one_work+0x1620/0x1620
[ 40.997477][ T164] kthread+0x318/0x420
[ 41.001525][ T164] ? kthread_create_on_node+0xf0/0xf0
[ 41.006976][ T164] ret_from_fork+0x24/0x30
[ 41.011394][ C1] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G B 5.6.0-rc7-syzkaller #0
[ 41.013810][ T12] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[ 41.020675][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 41.029646][ T12] ath9k_debug ath9k_hif_usb_alloc_urbs, 957
[ 41.039656][ C1] Call Trace:
[ 41.039664][ C1]
[ 41.039681][ C1] dump_stack+0xef/0x16e
[ 41.039690][ C1] panic+0x2aa/0x6e1
[ 41.039699][ C1] ? add_taint.cold+0x16/0x16
[ 41.039712][ C1] ? print_shadow_for_address+0xb8/0x114
[ 41.039722][ C1] ? trace_hardirqs_off+0x50/0x200
[ 41.039745][ C1] ? ath9k_htc_rx_msg+0xa25/0xaf0
[ 41.080225][ C1] end_report+0x43/0x49
[ 41.084377][ C1] ? ath9k_htc_rx_msg+0xa25/0xaf0
[ 41.089380][ C1] __kasan_report.cold+0x55/0x77
[ 41.094358][ C1] ? ath9k_htc_rx_msg+0xa25/0xaf0
[ 41.099360][ C1] kasan_report+0xe/0x20
[ 41.103593][ C1] ath9k_htc_rx_msg+0xa25/0xaf0
[ 41.108424][ C1] ath9k_hif_usb_reg_in_cb+0x1ba/0x630
[ 41.114009][ C1] ? _raw_read_unlock+0x1a/0x30
[ 41.118851][ C1] ? led_trigger_blink_oneshot+0xb4/0xe0
[ 41.124465][ C1] __usb_hcd_giveback_urb+0x1f2/0x470
[ 41.129818][ C1] usb_hcd_giveback_urb+0x368/0x420
[ 41.134998][ C1] dummy_timer+0x1258/0x32ae
[ 41.139601][ C1] ? dummy_udc_probe+0x930/0x930
[ 41.144519][ C1] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 41.150056][ C1] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 41.155334][ C1] call_timer_fn+0x195/0x6f0
[ 41.159913][ C1] ? dummy_udc_probe+0x930/0x930
[ 41.164831][ C1] ? msleep_interruptible+0x130/0x130
[ 41.170187][ C1] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 41.175711][ C1] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 41.180975][ C1] ? _raw_spin_unlock_irq+0x1f/0x30
[ 41.186151][ C1] ? dummy_udc_probe+0x930/0x930
[ 41.191068][ C1] run_timer_softirq+0x5f9/0x1500
[ 41.196070][ C1] ? add_timer+0x7a0/0x7a0
[ 41.200466][ C1] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 41.206037][ C1] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 41.211305][ C1] __do_softirq+0x21e/0x950
[ 41.215877][ C1] irq_exit+0x178/0x1a0
[ 41.220014][ C1] smp_apic_timer_interrupt+0x141/0x540
[ 41.225540][ C1] apic_timer_interrupt+0xf/0x20
[ 41.230451][ C1]
[ 41.233373][ C1] RIP: 0010:default_idle+0x28/0x300
[ 41.238551][ C1] Code: cc cc 41 56 41 55 65 44 8b 2d 04 4b 72 7a 41 54 55 53 0f 1f 44 00 00 e8 b6 37 b5 fb e9 07 00 00 00 0f 00 2d aa e0 52 00 fb f4 <65> 44 8b 2d e0 4a 72 7a 0f 1f 44 00 00 5b 5d 41 5c 41 5d 41 5e c3
[ 41.258144][ C1] RSP: 0018:ffff8881da22fda8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
[ 41.266629][ C1] RAX: 0000000000000007 RBX: ffff8881da213100 RCX: 0000000000000000
[ 41.274592][ C1] RDX: 0000000000000000 RSI: 0000000000000006 RDI: ffff8881da21394c
[ 41.282663][ C1] RBP: ffffed103b442620 R08: ffff8881da213100 R09: 0000000000000000
[ 41.290614][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001
[ 41.299339][ C1] R13: 0000000000000001 R14: ffffffff87e615c0 R15: 0000000000000000
[ 41.307310][ C1] ? default_idle+0x1a/0x300
[ 41.311891][ C1] do_idle+0x3e0/0x500
[ 41.315944][ C1] ? __wake_up_common+0x147/0x650
[ 41.320958][ C1] ? arch_cpu_idle_exit+0x40/0x40
[ 41.325960][ C1] ? _raw_spin_unlock_irqrestore+0x39/0x40
[ 41.331749][ C1] ? lockdep_hardirqs_on+0x382/0x580
[ 41.337013][ C1] cpu_startup_entry+0x14/0x20
[ 41.341758][ C1] start_secondary+0x2a4/0x390
[ 41.346501][ C1] ? set_cpu_sibling_map+0x1e90/0x1e90
[ 41.351937][ C1] secondary_startup_64+0xb6/0xc0
[ 41.356946][ T12] CPU: 0 PID: 12 Comm: kworker/0:1 Tainted: G B 5.6.0-rc7-syzkaller #0
[ 41.366472][ T12] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 41.376610][ T12] Workqueue: events request_firmware_work_func
[ 41.382739][ T12] Call Trace:
[ 41.386715][ T12] dump_stack+0xef/0x16e
[ 41.390952][ T12] ? ath9k_hif_usb_disconnect.cold+0xb9/0xb9
[ 41.396922][ T12] ath9k_hif_usb_alloc_urbs+0x3a/0x9e5
[ 41.402366][ T12] ? ath9k_hif_usb_download_fw+0x34d/0x35f
[ 41.408160][ T12] ? ath9k_hif_usb_disconnect.cold+0xb9/0xb9
[ 41.414126][ T12] ath9k_hif_usb_firmware_cb+0x221/0x51d
[ 41.419743][ T12] ? ath9k_hif_usb_disconnect.cold+0xb9/0xb9
[ 41.425722][ T12] request_firmware_work_func+0x126/0x242
[ 41.431425][ T12] ? request_firmware_into_buf+0x90/0x90
[ 41.437036][ T12] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 41.442560][ T12] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 41.447830][ T12] process_one_work+0x94b/0x1620
[ 41.452763][ T12] ? pwq_dec_nr_in_flight+0x310/0x310
[ 41.458125][ T12] ? do_raw_spin_lock+0x129/0x290
[ 41.463134][ T12] worker_thread+0x96/0xe20
[ 41.467617][ T12] ? process_one_work+0x1620/0x1620
[ 41.472794][ T12] kthread+0x318/0x420
[ 41.476842][ T12] ? kthread_create_on_node+0xf0/0xf0
[ 41.482193][ T12] ret_from_fork+0x24/0x30
[ 41.487370][ C1] Kernel Offset: disabled
[ 41.491711][ C1] Rebooting in 86400 seconds..