[ 45.017275][ T40] audit: type=1400 audit(1653883922.125:73): avc: denied { transition } for pid=3596 comm="sshd" path="/bin/sh" dev="sda1" ino=73 scontext=system_u:system_r:initrc_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 45.022848][ T40] audit: type=1400 audit(1653883922.135:74): avc: denied { write } for pid=3596 comm="sh" path="pipe:[28926]" dev="pipefs" ino=28926 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:initrc_t tclass=fifo_file permissive=1 [ 82.474716][ T973] cfg80211: failed to load regulatory.db Warning: Permanently added '[localhost]:62277' (ECDSA) to the list of known hosts. [ 86.283095][ T40] audit: type=1400 audit(1653883963.395:75): avc: denied { execute } for pid=3670 comm="sh" name="syz-executor1339496602" dev="sda1" ino=1136 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 86.283367][ T40] audit: type=1400 audit(1653883963.395:76): avc: denied { execute_no_trans } for pid=3670 comm="sh" path="/syz-executor1339496602" dev="sda1" ino=1136 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 86.322804][ T40] audit: type=1400 audit(1653883963.425:77): avc: denied { execmem } for pid=3670 comm="syz-executor133" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 86.322855][ T40] audit: type=1400 audit(1653883963.425:78): avc: denied { mounton } for pid=3673 comm="syz-executor133" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 86.322894][ T40] audit: type=1400 audit(1653883963.425:79): avc: denied { mounton } for pid=3675 comm="syz-executor133" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 86.322932][ T40] audit: type=1400 audit(1653883963.425:80): avc: denied { mount } for pid=3673 comm="syz-executor133" name="/" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 86.322970][ T40] audit: type=1400 audit(1653883963.425:81): avc: denied { create } for pid=3673 comm="syz-executor133" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 86.323048][ T40] audit: type=1400 audit(1653883963.425:82): avc: denied { read write } for pid=3673 comm="syz-executor133" name="vhci" dev="devtmpfs" ino=1102 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 86.323096][ T40] audit: type=1400 audit(1653883963.425:83): avc: denied { read write } for pid=3677 comm="syz-executor133" name="vhci" dev="devtmpfs" ino=1102 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 86.323133][ T40] audit: type=1400 audit(1653883963.425:84): avc: denied { read write } for pid=3675 comm="syz-executor133" name="vhci" dev="devtmpfs" ino=1102 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 87.375698][ T3689] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 87.375698][ T3688] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 87.377186][ T3689] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 87.379422][ T3688] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 87.380124][ T3689] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 87.380378][ T3688] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 87.381727][ T3688] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 87.381868][ T3689] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 87.383006][ T3689] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 87.383198][ T3691] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 87.383741][ T3692] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 87.384866][ T3688] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 87.385976][ T3690] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 87.386668][ T3688] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 87.387136][ T3688] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 87.387456][ T3690] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 87.387507][ T3691] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 87.387803][ T3691] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 87.388314][ T3691] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 87.388804][ T3690] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 executing program [ 87.389153][ T3690] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 executing program [ 87.390547][ T3692] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 executing program [ 87.390888][ T3692] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 executing program [ 87.391613][ T3692] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 87.858925][ T25] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 87.858933][ T41] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 87.859158][ T1260] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 87.881984][ T3696] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 88.139511][ T25] usb 7-1: too many configurations: 160, using maximum allowed: 8 [ 88.140416][ T1260] usb 6-1: too many configurations: 160, using maximum allowed: 8 [ 88.149444][ T41] usb 8-1: too many configurations: 160, using maximum allowed: 8 [ 88.159362][ T3696] usb 5-1: too many configurations: 160, using maximum allowed: 8 [ 88.229057][ T1260] usb 6-1: config index 0 descriptor too short (expected 65204, got 72) [ 88.229181][ T25] usb 7-1: config index 0 descriptor too short (expected 65204, got 72) [ 88.229971][ T41] usb 8-1: config index 0 descriptor too short (expected 65204, got 72) [ 88.249886][ T3696] usb 5-1: config index 0 descriptor too short (expected 65204, got 72) [ 88.319252][ T41] usb 8-1: config index 1 descriptor too short (expected 65204, got 72) [ 88.319263][ T25] usb 7-1: config index 1 descriptor too short (expected 65204, got 72) [ 88.319412][ T1260] usb 6-1: config index 1 descriptor too short (expected 65204, got 72) [ 88.341320][ T3696] usb 5-1: config index 1 descriptor too short (expected 65204, got 72) [ 88.398933][ T41] usb 8-1: config index 2 descriptor too short (expected 65204, got 72) [ 88.399030][ T25] usb 7-1: config index 2 descriptor too short (expected 65204, got 72) [ 88.399431][ T1260] usb 6-1: config index 2 descriptor too short (expected 65204, got 72) [ 88.422060][ T3696] usb 5-1: config index 2 descriptor too short (expected 65204, got 72) [ 88.479000][ T41] usb 8-1: config index 3 descriptor too short (expected 65204, got 72) [ 88.479032][ T25] usb 7-1: config index 3 descriptor too short (expected 65204, got 72) [ 88.479153][ T1260] usb 6-1: config index 3 descriptor too short (expected 65204, got 72) [ 88.509171][ T3696] usb 5-1: config index 3 descriptor too short (expected 65204, got 72) [ 88.558890][ T41] usb 8-1: config index 4 descriptor too short (expected 65204, got 72) [ 88.579045][ T25] usb 7-1: config index 4 descriptor too short (expected 65204, got 72) [ 88.579167][ T1260] usb 6-1: config index 4 descriptor too short (expected 65204, got 72) [ 88.609061][ T3696] usb 5-1: config index 4 descriptor too short (expected 65204, got 72) [ 88.639010][ T41] usb 8-1: config index 5 descriptor too short (expected 65204, got 72) [ 88.669081][ T25] usb 7-1: config index 5 descriptor too short (expected 65204, got 72) [ 88.669205][ T1260] usb 6-1: config index 5 descriptor too short (expected 65204, got 72) [ 88.689072][ T3696] usb 5-1: config index 5 descriptor too short (expected 65204, got 72) [ 88.719124][ T41] usb 8-1: config index 6 descriptor too short (expected 65204, got 72) [ 88.749134][ T25] usb 7-1: config index 6 descriptor too short (expected 65204, got 72) [ 88.749259][ T1260] usb 6-1: config index 6 descriptor too short (expected 65204, got 72) [ 88.769030][ T3696] usb 5-1: config index 6 descriptor too short (expected 65204, got 72) [ 88.798897][ T41] usb 8-1: config index 7 descriptor too short (expected 65204, got 72) [ 88.829219][ T25] usb 7-1: config index 7 descriptor too short (expected 65204, got 72) [ 88.829375][ T1260] usb 6-1: config index 7 descriptor too short (expected 65204, got 72) [ 88.852905][ T3696] usb 5-1: config index 7 descriptor too short (expected 65204, got 72) [ 88.959027][ T41] usb 8-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 88.959058][ T41] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 88.959080][ T41] usb 8-1: Product: syz [ 88.959094][ T41] usb 8-1: Manufacturer: syz [ 88.959108][ T41] usb 8-1: SerialNumber: syz [ 89.008017][ T41] usb 8-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 89.009519][ T25] usb 7-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 89.009547][ T25] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 89.009568][ T25] usb 7-1: Product: syz [ 89.009583][ T25] usb 7-1: Manufacturer: syz [ 89.009598][ T25] usb 7-1: SerialNumber: syz [ 89.010854][ T1260] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 89.010881][ T1260] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 89.010901][ T1260] usb 6-1: Product: syz [ 89.010916][ T1260] usb 6-1: Manufacturer: syz [ 89.010930][ T1260] usb 6-1: SerialNumber: syz [ 89.042694][ T3696] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 89.042724][ T3696] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 89.042746][ T3696] usb 5-1: Product: syz [ 89.042760][ T3696] usb 5-1: Manufacturer: syz [ 89.042776][ T3696] usb 5-1: SerialNumber: syz [ 89.059931][ T1260] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 89.075279][ T25] usb 7-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 89.089864][ T3696] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 89.430611][ T41] Bluetooth: hci1: command 0x0409 tx timeout [ 89.430669][ T3683] Bluetooth: hci2: command 0x0409 tx timeout [ 89.431242][ T41] Bluetooth: hci0: command 0x0409 tx timeout [ 89.431555][ T41] Bluetooth: hci3: command 0x0409 tx timeout [ 89.619112][ T973] usb 8-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 89.639142][ T3696] usb 7-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 89.659528][ T3698] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 89.682682][ T3701] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 90.629205][ T973] ath9k_htc 8-1:1.0: ath9k_htc: Target is unresponsive [ 90.629578][ T973] ath9k_htc: Failed to initialize the device [ 90.709596][ T3701] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 90.709765][ T3701] ath9k_htc: Failed to initialize the device [ 90.709831][ T3698] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 90.709932][ T3698] ath9k_htc: Failed to initialize the device [ 90.709978][ T3696] ath9k_htc 7-1:1.0: ath9k_htc: Target is unresponsive [ 90.710067][ T3696] ath9k_htc: Failed to initialize the device executing program [ 90.831071][ T41] usb 8-1: USB disconnect, device number 2 [ 90.852525][ T41] usb 8-1: ath9k_htc: USB layer deinitialized executing program [ 90.853281][ T30] usb 7-1: USB disconnect, device number 2 [ 90.866259][ T3683] usb 6-1: USB disconnect, device number 2 executing program [ 90.880317][ T30] usb 7-1: ath9k_htc: USB layer deinitialized [ 90.887218][ T3683] usb 6-1: ath9k_htc: USB layer deinitialized executing program [ 90.887227][ T1260] usb 5-1: USB disconnect, device number 2 [ 90.902429][ T1260] usb 5-1: ath9k_htc: USB layer deinitialized [ 91.235967][ T41] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 91.258807][ T30] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 91.258851][ T1260] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 91.288844][ T3683] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 91.508825][ T3709] Bluetooth: hci0: command 0x041b tx timeout [ 91.519026][ T3702] Bluetooth: hci3: command 0x041b tx timeout [ 91.519224][ T3702] Bluetooth: hci2: command 0x041b tx timeout [ 91.519300][ T3702] Bluetooth: hci1: command 0x041b tx timeout [ 91.519530][ T41] usb 8-1: too many configurations: 160, using maximum allowed: 8 [ 91.544300][ T30] usb 7-1: too many configurations: 160, using maximum allowed: 8 [ 91.559337][ T1260] usb 5-1: too many configurations: 160, using maximum allowed: 8 [ 91.589574][ T3683] usb 6-1: too many configurations: 160, using maximum allowed: 8 [ 91.609103][ T41] usb 8-1: config index 0 descriptor too short (expected 65204, got 72) [ 91.621768][ T30] usb 7-1: config index 0 descriptor too short (expected 65204, got 72) [ 91.659113][ T1260] usb 5-1: config index 0 descriptor too short (expected 65204, got 72) [ 91.686523][ T3683] usb 6-1: config index 0 descriptor too short (expected 65204, got 72) [ 91.688880][ T41] usb 8-1: config index 1 descriptor too short (expected 65204, got 72) [ 91.699277][ T30] usb 7-1: config index 1 descriptor too short (expected 65204, got 72) [ 91.759119][ T3683] usb 6-1: config index 1 descriptor too short (expected 65204, got 72) [ 91.759120][ T1260] usb 5-1: config index 1 descriptor too short (expected 65204, got 72) [ 91.769407][ T41] usb 8-1: config index 2 descriptor too short (expected 65204, got 72) [ 91.795889][ T30] usb 7-1: config index 2 descriptor too short (expected 65204, got 72) [ 91.849028][ T3683] usb 6-1: config index 2 descriptor too short (expected 65204, got 72) [ 91.849115][ T1260] usb 5-1: config index 2 descriptor too short (expected 65204, got 72) [ 91.859805][ T41] usb 8-1: config index 3 descriptor too short (expected 65204, got 72) [ 91.889126][ T30] usb 7-1: config index 3 descriptor too short (expected 65204, got 72) [ 91.938919][ T3683] usb 6-1: config index 3 descriptor too short (expected 65204, got 72) [ 91.949013][ T41] usb 8-1: config index 4 descriptor too short (expected 65204, got 72) [ 91.959659][ T1260] usb 5-1: config index 3 descriptor too short (expected 65204, got 72) [ 91.979022][ T30] usb 7-1: config index 4 descriptor too short (expected 65204, got 72) [ 92.029117][ T3683] usb 6-1: config index 4 descriptor too short (expected 65204, got 72) [ 92.032637][ T41] usb 8-1: config index 5 descriptor too short (expected 65204, got 72) [ 92.051275][ T1260] usb 5-1: config index 4 descriptor too short (expected 65204, got 72) [ 92.059554][ T30] usb 7-1: config index 5 descriptor too short (expected 65204, got 72) [ 92.118941][ T3683] usb 6-1: config index 5 descriptor too short (expected 65204, got 72) [ 92.119048][ T41] usb 8-1: config index 6 descriptor too short (expected 65204, got 72) [ 92.129237][ T1260] usb 5-1: config index 5 descriptor too short (expected 65204, got 72) [ 92.169482][ T30] usb 7-1: config index 6 descriptor too short (expected 65204, got 72) [ 92.199072][ T41] usb 8-1: config index 7 descriptor too short (expected 65204, got 72) [ 92.209209][ T3683] usb 6-1: config index 6 descriptor too short (expected 65204, got 72) [ 92.228872][ T1260] usb 5-1: config index 6 descriptor too short (expected 65204, got 72) [ 92.249175][ T30] usb 7-1: config index 7 descriptor too short (expected 65204, got 72) [ 92.288890][ T3683] usb 6-1: config index 7 descriptor too short (expected 65204, got 72) [ 92.299652][ T1260] usb 5-1: config index 7 descriptor too short (expected 65204, got 72) [ 92.359251][ T41] usb 8-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 92.359282][ T41] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 92.359303][ T41] usb 8-1: Product: syz [ 92.359318][ T41] usb 8-1: Manufacturer: syz [ 92.359333][ T41] usb 8-1: SerialNumber: syz [ 92.403198][ T41] usb 8-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 92.439567][ T30] usb 7-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 92.439598][ T30] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 92.439676][ T30] usb 7-1: Product: syz [ 92.439691][ T30] usb 7-1: Manufacturer: syz [ 92.439705][ T30] usb 7-1: SerialNumber: syz [ 92.468934][ T3683] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 92.468964][ T3683] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 92.468984][ T3683] usb 6-1: Product: syz [ 92.468998][ T3683] usb 6-1: Manufacturer: syz [ 92.469011][ T3683] usb 6-1: SerialNumber: syz [ 92.479452][ T1260] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 92.479478][ T1260] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 92.479497][ T1260] usb 5-1: Product: syz [ 92.479513][ T1260] usb 5-1: Manufacturer: syz [ 92.479528][ T1260] usb 5-1: SerialNumber: syz [ 92.489979][ T30] usb 7-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 92.519869][ T3683] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 92.529909][ T1260] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 92.979084][ T41] usb 8-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 93.128880][ T3709] usb 7-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 93.178916][ T3683] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 93.209052][ T3696] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 93.588972][ T15] Bluetooth: hci0: command 0x040f tx timeout [ 93.589028][ T1260] Bluetooth: hci1: command 0x040f tx timeout [ 93.589093][ T1260] Bluetooth: hci2: command 0x040f tx timeout [ 93.589416][ T1260] Bluetooth: hci3: command 0x040f tx timeout [ 93.989016][ T41] ath9k_htc 8-1:1.0: ath9k_htc: Target is unresponsive [ 93.989016][ T41] ath9k_htc 8-1:1.0: ath9k_htc: Target is unresponsive [ 93.989112][ T41] ath9k_htc: Failed to initialize the device [ 93.999075][ C3] ================================================================== [ 93.999087][ C3] BUG: KASAN: use-after-free in ath9k_hif_usb_rx_cb+0xd17/0x10d0 [ 93.999555][ C3] Read of size 4 at addr ffff88802b0142f4 by task swapper/3/0 [ 93.999573][ C3] [ 93.999599][ C3] CPU: 3 PID: 0 Comm: swapper/3 Not tainted 5.18.0-syzkaller-11179-gc3a9a3c5f559 #0 [ 93.999623][ C3] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 [ 93.999648][ C3] Call Trace: [ 93.999721][ C3] [ 93.999728][ C3] dump_stack_lvl+0xcd/0x134 [ 94.000130][ C3] print_address_description.constprop.0.cold+0xeb/0x467 [ 94.000217][ C3] ? ath9k_hif_usb_rx_cb+0xd17/0x10d0 [ 94.000238][ C3] kasan_report.cold+0xf4/0x1c6 [ 94.000254][ C3] ? ath9k_hif_usb_rx_cb+0xd17/0x10d0 [ 94.000272][ C3] ath9k_hif_usb_rx_cb+0xd17/0x10d0 [ 94.000293][ C3] ? __bpf_trace_lock_acquire+0x90/0x200 [ 94.000511][ C3] ? lock_downgrade+0x6e0/0x6e0 [ 94.000535][ C3] ? hif_usb_start+0xa0/0xa0 [ 94.000552][ C3] ? rwlock_bug.part.0+0x90/0x90 [ 94.000579][ C3] __usb_hcd_giveback_urb+0x2b0/0x5c0 [ 94.000686][ C3] usb_hcd_giveback_urb+0x367/0x410 [ 94.000711][ C3] dummy_timer+0x11f9/0x32b0 [ 94.000813][ C3] ? dummy_dequeue+0x500/0x500 [ 94.000838][ C3] ? dummy_dequeue+0x500/0x500 [ 94.000860][ C3] call_timer_fn+0x1a5/0x6b0 [ 94.000925][ C3] ? timer_fixup_activate+0x350/0x350 [ 94.000947][ C3] ? lock_downgrade+0x6e0/0x6e0 [ 94.000973][ C3] ? _raw_spin_unlock_irq+0x1f/0x40 [ 94.001183][ C3] ? _raw_spin_unlock_irq+0x1f/0x40 [ 94.001199][ C3] ? dummy_dequeue+0x500/0x500 [ 94.001218][ C3] __run_timers.part.0+0x679/0xa80 [ 94.001237][ C3] ? call_timer_fn+0x6b0/0x6b0 [ 94.001252][ C3] ? __wake_up_locked_sync_key+0x20/0x20 [ 94.001290][ C3] ? kvm_sched_clock_read+0x14/0x40 [ 94.001392][ C3] ? sched_clock_cpu+0x69/0x2b0 [ 94.001413][ C3] run_timer_softirq+0xb3/0x1d0 [ 94.001431][ C3] __do_softirq+0x29b/0x9c2 [ 94.001455][ C3] __irq_exit_rcu+0x123/0x180 [ 94.001532][ C3] irq_exit_rcu+0x5/0x20 [ 94.001549][ C3] sysvec_apic_timer_interrupt+0x93/0xc0 [ 94.001701][ C3] [ 94.001707][ C3] [ 94.001713][ C3] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 94.001739][ C3] RIP: 0010:default_idle+0xb/0x10 [ 94.001773][ C3] Code: ff ff ff 48 89 df e8 74 cf 4c f8 e9 55 ff ff ff 4c 89 e7 e8 67 cf 4c f8 eb 96 0f 1f 44 00 00 eb 07 0f 00 2d 17 c5 4d 00 fb f4 cc cc cc cc 41 55 41 54 55 48 89 fd 53 e8 a2 b1 00 f8 e8 9d 0d [ 94.001793][ C3] RSP: 0018:ffffc900006afe00 EFLAGS: 00000206 [ 94.001826][ C3] RAX: 00000000000254c5 RBX: ffff88801194c0c0 RCX: ffffffff8975f451 [ 94.001839][ C3] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 94.001851][ C3] RBP: 0000000000000003 R08: 0000000000000001 R09: ffff88802cd3af93 [ 94.001862][ C3] R10: ffffed10059a75f2 R11: 0000000000000001 R12: ffffed1002329818 [ 94.001875][ C3] R13: 0000000000000003 R14: ffffffff8dbafb50 R15: 0000000000000000 [ 94.001889][ C3] ? rcu_eqs_enter.constprop.0+0xc1/0x100 [ 94.001916][ C3] default_idle_call+0x80/0xc0 [ 94.001934][ C3] do_idle+0x401/0x590 [ 94.001953][ C3] ? arch_cpu_idle_exit+0x30/0x30 [ 94.001970][ C3] ? _raw_spin_unlock_irqrestore+0x50/0x70 [ 94.001988][ C3] ? lockdep_hardirqs_on+0x79/0x100 [ 94.002010][ C3] cpu_startup_entry+0x14/0x20 [ 94.002028][ C3] start_secondary+0x21d/0x2b0 [ 94.002119][ C3] ? set_cpu_sibling_map+0x1ef0/0x1ef0 [ 94.002159][ C3] secondary_startup_64_no_verify+0xce/0xdb [ 94.002226][ C3] [ 94.002233][ C3] [ 94.002237][ C3] Allocated by task 41: [ 94.002295][ C3] kasan_save_stack+0x1e/0x40 [ 94.002463][ C3] __kasan_kmalloc+0xa6/0xd0 [ 94.002480][ C3] __kmalloc+0x209/0x4d0 [ 94.002496][ C3] wiphy_new_nm+0x6f0/0x2080 [ 94.002642][ C3] ieee80211_alloc_hw_nm+0x373/0x2270 [ 94.002697][ C3] ath9k_htc_probe_device+0x97/0x1f30 [ 94.002720][ C3] ath9k_htc_hw_init+0x31/0x60 [ 94.002738][ C3] ath9k_hif_usb_firmware_cb+0x274/0x530 [ 94.002757][ C3] request_firmware_work_func+0x12c/0x230 [ 94.002972][ C3] process_one_work+0x996/0x1610 [ 94.003010][ C3] worker_thread+0x665/0x1080 [ 94.003034][ C3] kthread+0x2e9/0x3a0 [ 94.003053][ C3] ret_from_fork+0x1f/0x30 [ 94.003074][ C3] [ 94.003077][ C3] Freed by task 41: [ 94.003086][ C3] kasan_save_stack+0x1e/0x40 [ 94.003105][ C3] kasan_set_track+0x21/0x30 [ 94.003124][ C3] kasan_set_free_info+0x20/0x30 [ 94.003145][ C3] ____kasan_slab_free+0x13d/0x180 [ 94.003165][ C3] kfree+0x113/0x310 [ 94.003182][ C3] device_release+0x9f/0x240 [ 94.003223][ C3] kobject_put+0x1c8/0x540 [ 94.003369][ C3] put_device+0x1b/0x30 [ 94.003403][ C3] ath9k_htc_probe_device+0x1c7/0x1f30 [ 94.003427][ C3] ath9k_htc_hw_init+0x31/0x60 [ 94.003444][ C3] ath9k_hif_usb_firmware_cb+0x274/0x530 [ 94.003464][ C3] request_firmware_work_func+0x12c/0x230 [ 94.003485][ C3] process_one_work+0x996/0x1610 [ 94.003504][ C3] worker_thread+0x665/0x1080 [ 94.003520][ C3] kthread+0x2e9/0x3a0 [ 94.003535][ C3] ret_from_fork+0x1f/0x30 [ 94.003554][ C3] [ 94.003557][ C3] The buggy address belongs to the object at ffff88802b010000 [ 94.003557][ C3] which belongs to the cache kmalloc-32k of size 32768 [ 94.003573][ C3] The buggy address is located 17140 bytes inside of [ 94.003573][ C3] 32768-byte region [ffff88802b010000, ffff88802b018000) [ 94.003590][ C3] [ 94.003593][ C3] The buggy address belongs to the physical page: [ 94.003616][ C3] page:ffffea0000ac0400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2b010 [ 94.003689][ C3] head:ffffea0000ac0400 order:4 compound_mapcount:0 compound_pincount:0 [ 94.003705][ C3] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 94.003801][ C3] raw: 00fff00000010200 ffffea0000ac0008 ffffea0000ac0808 ffff888010c40c00 [ 94.003842][ C3] raw: 0000000000000000 ffff88802b010000 0000000100000001 0000000000000000 [ 94.003853][ C3] page dumped because: kasan: bad access detected [ 94.003876][ C3] page_owner tracks the page as allocated [ 94.003894][ C3] page last allocated via order 4, migratetype Unmovable, gfp_mask 0x2420c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_COMP|__GFP_THISNODE), pid 41, tgid 41 (kworker/3:1), ts 92985922661, free_ts 0 [ 94.003937][ C3] get_page_from_freelist+0x1290/0x3b70 [ 94.003968][ C3] __alloc_pages+0x1c7/0x510 [ 94.003985][ C3] cache_grow_begin+0x75/0x350 [ 94.004004][ C3] cache_alloc_refill+0x27f/0x380 [ 94.004022][ C3] __kmalloc+0x3b3/0x4d0 [ 94.004039][ C3] wiphy_new_nm+0x6f0/0x2080 [ 94.004061][ C3] ieee80211_alloc_hw_nm+0x373/0x2270 [ 94.004080][ C3] ath9k_htc_probe_device+0x97/0x1f30 [ 94.004103][ C3] ath9k_htc_hw_init+0x31/0x60 [ 94.004120][ C3] ath9k_hif_usb_firmware_cb+0x274/0x530 [ 94.004139][ C3] request_firmware_work_func+0x12c/0x230 [ 94.004162][ C3] process_one_work+0x996/0x1610 [ 94.004182][ C3] worker_thread+0x665/0x1080 [ 94.004199][ C3] kthread+0x2e9/0x3a0 [ 94.004213][ C3] ret_from_fork+0x1f/0x30 [ 94.004233][ C3] page_owner free stack trace missing [ 94.004238][ C3] [ 94.004240][ C3] Memory state around the buggy address: [ 94.004250][ C3] ffff88802b014180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.004263][ C3] ffff88802b014200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.004275][ C3] >ffff88802b014280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.004286][ C3] ^ [ 94.004295][ C3] ffff88802b014300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.004308][ C3] ffff88802b014380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.004318][ C3] ================================================================== [ 94.004366][ C3] Kernel panic - not syncing: panic_on_warn set ... [ 94.004378][ C3] CPU: 3 PID: 0 Comm: swapper/3 Not tainted 5.18.0-syzkaller-11179-gc3a9a3c5f559 #0 [ 94.004401][ C3] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 [ 94.004427][ C3] Call Trace: [ 94.004436][ C3] [ 94.004443][ C3] dump_stack_lvl+0xcd/0x134 [ 94.004469][ C3] panic+0x2d7/0x636 [ 94.004619][ C3] ? panic_print_sys_info.part.0+0x10b/0x10b [ 94.004644][ C3] ? ath9k_hif_usb_rx_cb+0xd17/0x10d0 [ 94.004673][ C3] end_report.part.0+0x3f/0x7c [ 94.004693][ C3] kasan_report.cold+0x93/0x1c6 [ 94.004711][ C3] ? ath9k_hif_usb_rx_cb+0xd17/0x10d0 [ 94.004733][ C3] ath9k_hif_usb_rx_cb+0xd17/0x10d0 [ 94.004754][ C3] ? __bpf_trace_lock_acquire+0x90/0x200 [ 94.004779][ C3] ? lock_downgrade+0x6e0/0x6e0 [ 94.004802][ C3] ? hif_usb_start+0xa0/0xa0 [ 94.004820][ C3] ? rwlock_bug.part.0+0x90/0x90 [ 94.004847][ C3] __usb_hcd_giveback_urb+0x2b0/0x5c0 [ 94.004876][ C3] usb_hcd_giveback_urb+0x367/0x410 [ 94.004903][ C3] dummy_timer+0x11f9/0x32b0 [ 94.004929][ C3] ? dummy_dequeue+0x500/0x500 [ 94.004949][ C3] ? dummy_dequeue+0x500/0x500 [ 94.004969][ C3] call_timer_fn+0x1a5/0x6b0 [ 94.004989][ C3] ? timer_fixup_activate+0x350/0x350 [ 94.005009][ C3] ? lock_downgrade+0x6e0/0x6e0 [ 94.005033][ C3] ? _raw_spin_unlock_irq+0x1f/0x40 [ 94.005054][ C3] ? _raw_spin_unlock_irq+0x1f/0x40 [ 94.005073][ C3] ? dummy_dequeue+0x500/0x500 [ 94.005122][ C3] __run_timers.part.0+0x679/0xa80 [ 94.005143][ C3] ? call_timer_fn+0x6b0/0x6b0 [ 94.005162][ C3] ? __wake_up_locked_sync_key+0x20/0x20 [ 94.005190][ C3] ? kvm_sched_clock_read+0x14/0x40 [ 94.005212][ C3] ? sched_clock_cpu+0x69/0x2b0 [ 94.005237][ C3] run_timer_softirq+0xb3/0x1d0 [ 94.005256][ C3] __do_softirq+0x29b/0x9c2 [ 94.005279][ C3] __irq_exit_rcu+0x123/0x180 [ 94.005299][ C3] irq_exit_rcu+0x5/0x20 [ 94.005316][ C3] sysvec_apic_timer_interrupt+0x93/0xc0 [ 94.005345][ C3] [ 94.005352][ C3] [ 94.005358][ C3] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 94.005383][ C3] RIP: 0010:default_idle+0xb/0x10 [ 94.005402][ C3] Code: ff ff ff 48 89 df e8 74 cf 4c f8 e9 55 ff ff ff 4c 89 e7 e8 67 cf 4c f8 eb 96 0f 1f 44 00 00 eb 07 0f 00 2d 17 c5 4d 00 fb f4 cc cc cc cc 41 55 41 54 55 48 89 fd 53 e8 a2 b1 00 f8 e8 9d 0d [ 94.005423][ C3] RSP: 0018:ffffc900006afe00 EFLAGS: 00000206 [ 94.005441][ C3] RAX: 00000000000254c5 RBX: ffff88801194c0c0 RCX: ffffffff8975f451 [ 94.005456][ C3] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 94.005469][ C3] RBP: 0000000000000003 R08: 0000000000000001 R09: ffff88802cd3af93 [ 94.005498][ C3] R10: ffffed10059a75f2 R11: 0000000000000001 R12: ffffed1002329818 [ 94.005511][ C3] R13: 0000000000000003 R14: ffffffff8dbafb50 R15: 0000000000000000 [ 94.005524][ C3] ? rcu_eqs_enter.constprop.0+0xc1/0x100 [ 94.005552][ C3] default_idle_call+0x80/0xc0 [ 94.005570][ C3] do_idle+0x401/0x590 [ 94.005589][ C3] ? arch_cpu_idle_exit+0x30/0x30 [ 94.005609][ C3] ? _raw_spin_unlock_irqrestore+0x50/0x70 [ 94.005628][ C3] ? lockdep_hardirqs_on+0x79/0x100 [ 94.005653][ C3] cpu_startup_entry+0x14/0x20 [ 94.005679][ C3] start_secondary+0x21d/0x2b0 [ 94.005706][ C3] ? set_cpu_sibling_map+0x1ef0/0x1ef0 [ 94.005731][ C3] secondary_startup_64_no_verify+0xce/0xdb [ 94.005760][ C3] [ 94.013853][ C3] Kernel Offset: disabled VM DIAGNOSIS: 04:12:52 Registers: info registers vcpu 0 RAX=0000000000000007 RBX=0000000000000340 RCX=0000000000000340 RDX=0000000000000000 RSI=ffffffff812cba9f RDI=0000000000000001 RBP=0000000000000000 RSP=ffffc90000007f70 R8 =0000000000000001 R9 =0000000000000000 R10=0000000000000001 R11=0000000000000001 R12=0000000000000000 R13=0000000000000000 R14=0000000000000000 R15=0000000000000000 RIP=ffffffff812cbab8 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff88802ca00000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007ffc9ea78968 CR3=0000000025c20000 CR4=00150ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000fffe0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=ffffffffffffffffffffffffffffffff XMM02=000000524f5252450000000000000000 XMM03=00000000000000000000000000000000 XMM04=00000000000000000000000000000000 XMM05=00000000000000000000000000000000 XMM06=0000000000000000000000524f525245 XMM07=00000000000000000000000000000000 XMM08=000000000000000000524f5252450040 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=0000000000000007 RBX=0000000000000340 RCX=0000000000000340 RDX=0000000000000000 RSI=ffffffff812cba9f RDI=0000000000000001 RBP=0000000000000001 RSP=ffffc90000758f70 R8 =0000000000000001 R9 =0000000000000000 R10=0000000000000001 R11=0000000000000001 R12=0000000000000001 R13=0000000000000000 R14=0000000000000000 R15=0000000000000000 RIP=ffffffff812cbab8 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff88802cb00000 ffffffff 00c00000 LDT=0000 0000000000000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007ffc9ea71668 CR3=000000001d6d6000 CR4=00150ee0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000fffe0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=ffffffffffffffffffffffffffffffff XMM02=000000524f5252450000000000000000 XMM03=00000000000000000000000000000000 XMM04=00000000000000000000000000000000 XMM05=00000000000000000000000000000000 XMM06=0000000000000000000000524f525245 XMM07=00000000000000000000000000000000 XMM08=000000000000000000524f5252450040 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 2 RAX=0000000000000007 RBX=0000000000000340 RCX=0000000000000340 RDX=0000000000000000 RSI=ffffffff812cba9f RDI=0000000000000001 RBP=0000000000000002 RSP=ffffc900007b0f70 R8 =0000000000000001 R9 =0000000000000000 R10=0000000000000001 R11=0000000000000001 R12=0000000000000001 R13=0000000000000000 R14=0000000000000000 R15=0000000000000000 RIP=ffffffff812cbab8 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff88802cc00000 ffffffff 00c00000 LDT=0000 0000000000000000 00000000 00000000 TR =0040 fffffe0000091000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f02b4e7a130 CR3=0000000023d9d000 CR4=00150ee0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000fffe0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=ffffffffffffffffffffffffffffffff XMM02=000000524f5252450000000000000000 XMM03=00000000000000000000000000000000 XMM04=00000000000000000000000000000000 XMM05=00000000000000000000000000000000 XMM06=0000000000000000000000524f525245 XMM07=00000000000000000000000000000000 XMM08=000000000000000000524f5252450040 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 3 RAX=0000000000000020 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff845fc821 RDI=ffffffff908d4c00 RBP=ffffffff908d4bc0 RSP=ffffc90000808410 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=20666f2064616552 R12=0000000000000000 R13=0000000000000020 R14=ffffffff908d4bc0 R15=dffffc0000000000 RIP=ffffffff845fc84b RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff88802cd00000 ffffffff 00c00000 LDT=0000 0000000000000000 00000000 00000000 TR =0040 fffffe00000d8000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f02b4e7a130 CR3=000000001d133000 CR4=00150ee0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000fffe0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=ffffffffffffffffffffffffffffffff XMM02=000000524f5252450000000000000000 XMM03=00000000000000000000000000000000 XMM04=00000000000000000000000000000000 XMM05=00000000000000000000000000000000 XMM06=0000000000000000000000524f525245 XMM07=00000000000000000000000000000000 XMM08=000000000000000000524f5252450040 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000