[1] skb 0xffff8881d8d968c0. hfa384x_usbin_callback, 2939
[1] skb 0xffff8881d8d96a00. submit_rx_urb, 345
[1] skb 0xffff8881d8d968c0. hfa384x_usbin_callback, 3012
overlen frm: len=19675
general protection fault, probably for non-canonical address 0xdffffc000000099a: 0000 [#1] SMP KASAN
KASAN: probably user-memory-access in range [0x0000000000004cd0-0x0000000000004cd7]
CPU: 1 PID: 149 Comm: systemd-journal Not tainted 5.6.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:string_nocheck+0x16b/0x220 lib/vsprintf.c:607
Code: 8d 34 07 29 ee e8 45 e1 b3 fb 48 3b 6c 24 10 74 3e e8 99 df b3 fb 48 89 df 48 83 c3 01 48 89 f8 48 89 fa 48 c1 e8 03 83 e2 07 <42> 0f b6 04 30 38 d0 7f 04 84 c0 75 71 44 0f b6 63 ff 31 ff 44 89
RSP: 0000:ffff8881db309648 EFLAGS: 00010002
RAX: 000000000000099a RBX: 0000000000004cd8 RCX: ffffffff858b75bf
RDX: 0000000000000007 RSI: ffffffff858b7647 RDI: 0000000000004cd7
RBP: ffffffff89663be4 R08: ffff8881d1e18000 R09: fffffbfff12cc77d
R10: fffffbfff12cc77c R11: ffffffff89663be3 R12: ffffffff89663f90
R13: 0000000000000000 R14: dffffc0000000000 R15: 00000000ffffffff
FS:  00007efcc57f08c0(0000) GS:ffff8881db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f637d020d40 CR3: 00000001d27f7000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 string+0xe5/0xf0 lib/vsprintf.c:689
 vsnprintf+0x7d3/0x14f0 lib/vsprintf.c:2574
 vscnprintf+0x29/0x80 lib/vsprintf.c:2677
 vprintk_store+0x40/0x4b0 kernel/printk/printk.c:1917
 vprintk_emit+0xc8/0x3d0 kernel/printk/printk.c:1978
 vprintk_func+0x75/0x113 kernel/printk/printk_safe.c:386
 printk+0xba/0xed kernel/printk/printk.c:2056
 hfa384x_int_rxmonitor drivers/staging/wlan-ng/hfa384x_usb.c:3388 [inline]
 hfa384x_usbin_rx drivers/staging/wlan-ng/hfa384x_usb.c:3319 [inline]
 hfa384x_usbin_callback+0x12e7/0x2120 drivers/staging/wlan-ng/hfa384x_usb.c:3032
 __usb_hcd_giveback_urb+0x29a/0x550 drivers/usb/core/hcd.c:1650
 usb_hcd_giveback_urb+0x368/0x420 drivers/usb/core/hcd.c:1716
 dummy_timer+0x1258/0x32ae drivers/usb/gadget/udc/dummy_hcd.c:1966
 call_timer_fn+0x195/0x6f0 kernel/time/timer.c:1404
 expire_timers kernel/time/timer.c:1449 [inline]
 __run_timers kernel/time/timer.c:1773 [inline]
 __run_timers kernel/time/timer.c:1740 [inline]
 run_timer_softirq+0x5f9/0x1500 kernel/time/timer.c:1786
 __do_softirq+0x21e/0x950 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0x178/0x1a0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:546 [inline]
 smp_apic_timer_interrupt+0x141/0x540 arch/x86/kernel/apic/apic.c:1146
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829
 </IRQ>
RIP: 0033:0x7efcc4afa470
Code: 40 0f b6 c6 48 89 fa f3 aa 48 89 d0 c3 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 48 39 d1 0f 82 f7 e0 fc ff 0f 1f 80 00 00 00 00 <c5> f9 6e c6 48 89 f8 c4 e2 7d 78 c0 48 83 fa 20 0f 82 a4 00 00 00
RSP: 002b:00007fffbf7840c8 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff13
RAX: 00007efcc55d5160 RBX: 0000555c32817258 RCX: 0000555c32817258
RDX: 0000000000000018 RSI: 0000000000000000 RDI: 0000555c32817258
RBP: 0000000000000001 R08: 0000000000000041 R09: 0000000000000018
R10: 0000000000000069 R11: 0000000000000246 R12: 0000000000000018
R13: 00000000fffffffe R14: 00007fffbf784400 R15: 0000555c32823de0
Modules linked in:
---[ end trace 7524412d0e9cfbaf ]---
RIP: 0010:string_nocheck+0x16b/0x220 lib/vsprintf.c:607
Code: 8d 34 07 29 ee e8 45 e1 b3 fb 48 3b 6c 24 10 74 3e e8 99 df b3 fb 48 89 df 48 83 c3 01 48 89 f8 48 89 fa 48 c1 e8 03 83 e2 07 <42> 0f b6 04 30 38 d0 7f 04 84 c0 75 71 44 0f b6 63 ff 31 ff 44 89
RSP: 0000:ffff8881db309648 EFLAGS: 00010002
RAX: 000000000000099a RBX: 0000000000004cd8 RCX: ffffffff858b75bf
RDX: 0000000000000007 RSI: ffffffff858b7647 RDI: 0000000000004cd7
RBP: ffffffff89663be4 R08: ffff8881d1e18000 R09: fffffbfff12cc77d
R10: fffffbfff12cc77c R11: ffffffff89663be3 R12: ffffffff89663f90
R13: 0000000000000000 R14: dffffc0000000000 R15: 00000000ffffffff
FS:  00007efcc57f08c0(0000) GS:ffff8881db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f637d020d40 CR3: 00000001d27f7000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400