==================================================================
BUG: KASAN: slab-out-of-bounds in htc_process_conn_rsp drivers/net/wireless/ath/ath9k/htc_hst.c:131 [inline]
BUG: KASAN: slab-out-of-bounds in ath9k_htc_rx_msg+0xa25/0xaf0 drivers/net/wireless/ath/ath9k/htc_hst.c:443
Write of size 2 at addr ffff8881cfa8f830 by task kworker/1:2/95
CPU: 1 PID: 95 Comm: kworker/1:2 Not tainted 5.7.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xef/0x16e lib/dump_stack.c:118
print_address_description.constprop.0.cold+0xd3/0x415 mm/kasan/report.c:382
__kasan_report.cold+0x37/0x7d mm/kasan/report.c:511
kasan_report+0x33/0x50 mm/kasan/common.c:625
htc_process_conn_rsp drivers/net/wireless/ath/ath9k/htc_hst.c:131 [inline]
ath9k_htc_rx_msg+0xa25/0xaf0 drivers/net/wireless/ath/ath9k/htc_hst.c:443
ath9k_hif_usb_reg_in_cb+0x1c0/0x630 drivers/net/wireless/ath/ath9k/hif_usb.c:718
__usb_hcd_giveback_urb+0x29a/0x550 drivers/usb/core/hcd.c:1650
usb_hcd_giveback_urb+0x368/0x420 drivers/usb/core/hcd.c:1716
dummy_timer+0x125e/0x32b4 drivers/usb/gadget/udc/dummy_hcd.c:1967
call_timer_fn+0x1ac/0x700 kernel/time/timer.c:1405
expire_timers kernel/time/timer.c:1450 [inline]
__run_timers kernel/time/timer.c:1774 [inline]
__run_timers kernel/time/timer.c:1741 [inline]
run_timer_softirq+0x5f9/0x1500 kernel/time/timer.c:1787
__do_softirq+0x21e/0x9aa kernel/softirq.c:292
invoke_softirq kernel/softirq.c:373 [inline]
irq_exit+0x178/0x1a0 kernel/softirq.c:413
exiting_irq arch/x86/include/asm/apic.h:546 [inline]
smp_apic_timer_interrupt+0x141/0x540 arch/x86/kernel/apic/apic.c:1140
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/irqflags.h:85 [inline]
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x3b/0x40 kernel/locking/spinlock.c:191
Code: e8 fa 71 90 fb 48 89 ef e8 92 6e 91 fb f6 c7 02 75 11 53 9d e8 76 15 af fb 65 ff 0d 87 86 6b 7a 5b 5d c3 e8 67 13 af fb 53 9d ed 0f 1f 00 55 48 89 fd 65 ff 05 6d 86 6b 7a 45 31 c9 41 b8 01
RSP: 0018:ffff8881d523f618 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000007 RBX: 0000000000000246 RCX: 1ffffffff1270001
RDX: 0000000000000000 RSI: ffff8881d686d338 RDI: ffff8881d686d2bc
RBP: ffff8881d8cb49a8 R08: 0000000000000001 R09: fffffbfff126c8c6
R10: ffffffff8936462f R11: fffffbfff126c8c5 R12: ffff8881d523f6b0
R13: ffff8881d45f7ea0 R14: 0000000000000000 R15: ffff8881d8cb49a8
spin_unlock_irqrestore include/linux/spinlock.h:408 [inline]
klist_next+0x23e/0x490 lib/klist.c:401
next_driver drivers/base/bus.c:389 [inline]
bus_for_each_drv+0x114/0x1e0 drivers/base/bus.c:430
usb_generic_driver_match drivers/usb/core/generic.c:223 [inline]
usb_generic_driver_match+0x74/0xa0 drivers/usb/core/generic.c:214
usb_device_match+0x271/0x300 drivers/usb/core/driver.c:840
driver_match_device drivers/base/base.h:140 [inline]
__device_attach_driver+0x8c/0x290 drivers/base/dd.c:784
bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:431
__device_attach+0x21a/0x390 drivers/base/dd.c:870
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:491
device_add+0x1367/0x1c40 drivers/base/core.c:2538
usb_new_device.cold+0x552/0xf6e drivers/usb/core/hub.c:2554
hub_port_connect drivers/usb/core/hub.c:5208 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5348 [inline]
port_event drivers/usb/core/hub.c:5494 [inline]
hub_event+0x226d/0x43c0 drivers/usb/core/hub.c:5576
process_one_work+0x965/0x1630 kernel/workqueue.c:2268
process_scheduled_works kernel/workqueue.c:2330 [inline]
worker_thread+0x7ab/0xe20 kernel/workqueue.c:2416
kthread+0x326/0x430 kernel/kthread.c:268
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:351
Allocated by task 3081:
save_stack+0x1b/0x40 mm/kasan/common.c:49
set_track mm/kasan/common.c:57 [inline]
__kasan_kmalloc mm/kasan/common.c:495 [inline]
__kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:468
kmalloc include/linux/slab.h:555 [inline]
kzalloc include/linux/slab.h:669 [inline]
ath9k_htc_hw_alloc+0x49/0x2e0 drivers/net/wireless/ath/ath9k/htc_hst.c:471
ath9k_hif_usb_firmware_cb+0x62/0x510 drivers/net/wireless/ath/ath9k/hif_usb.c:1173
request_firmware_work_func+0x126/0x242 drivers/base/firmware_loader/main.c:1005
process_one_work+0x965/0x1630 kernel/workqueue.c:2268
worker_thread+0x96/0xe20 kernel/workqueue.c:2414
kthread+0x326/0x430 kernel/kthread.c:268
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:351
Freed by task 3155:
save_stack+0x1b/0x40 mm/kasan/common.c:49
set_track mm/kasan/common.c:57 [inline]
kasan_set_free_info mm/kasan/common.c:317 [inline]
__kasan_slab_free+0x117/0x160 mm/kasan/common.c:456
slab_free_hook mm/slub.c:1455 [inline]
slab_free_freelist_hook mm/slub.c:1488 [inline]
slab_free mm/slub.c:3045 [inline]
kfree+0xd5/0x300 mm/slub.c:4026
sk_prot_free net/core/sock.c:1641 [inline]
__sk_destruct+0x545/0x740 net/core/sock.c:1725
sk_destruct+0xc6/0x100 net/core/sock.c:1740
__sk_free+0xef/0x3d0 net/core/sock.c:1751
sk_free+0x78/0xa0 net/core/sock.c:1762
deferred_put_nlk_sk+0x151/0x2e0 net/netlink/af_netlink.c:729
rcu_do_batch kernel/rcu/tree.c:2206 [inline]
rcu_core+0x5ae/0x1ba0 kernel/rcu/tree.c:2433
__do_softirq+0x21e/0x9aa kernel/softirq.c:292
The buggy address belongs to the object at ffff8881cfa8f000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 48 bytes to the right of
2048-byte region [ffff8881cfa8f000, ffff8881cfa8f800)
The buggy address belongs to the page:
page:ffffea00073ea200 refcount:1 mapcount:0 mapping:00000000c399e71c index:0x0 head:ffffea00073ea200 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x200000000010200(slab|head)
raw: 0200000000010200 dead000000000100 dead000000000122 ffff8881da00c000
raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881cfa8f700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8881cfa8f780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8881cfa8f800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff8881cfa8f880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8881cfa8f900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================