usb 1-1: ath: unknown panic pattern!
==================================================================
BUG: KASAN: use-after-free in instrument_atomic_read include/linux/instrumented.h:71 [inline]
BUG: KASAN: use-after-free in atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline]
BUG: KASAN: use-after-free in refcount_read include/linux/refcount.h:147 [inline]
BUG: KASAN: use-after-free in skb_unref include/linux/skbuff.h:1182 [inline]
BUG: KASAN: use-after-free in kfree_skb_reason+0x2f/0x110 net/core/skbuff.c:777
Read of size 4 at addr ffff888073f4fc24 by task sshd/3601

CPU: 0 PID: 3601 Comm: sshd Not tainted 5.19.0-rc4-next-20220628-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/18/2022
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:317 [inline]
 print_report.cold+0x2ba/0x719 mm/kasan/report.c:433
 kasan_report+0xbe/0x1f0 mm/kasan/report.c:495
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189
 instrument_atomic_read include/linux/instrumented.h:71 [inline]
 atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline]
 refcount_read include/linux/refcount.h:147 [inline]
 skb_unref include/linux/skbuff.h:1182 [inline]
 kfree_skb_reason+0x2f/0x110 net/core/skbuff.c:777
 kfree_skb include/linux/skbuff.h:1198 [inline]
 ath9k_hif_usb_reg_in_cb+0x4c5/0x640 drivers/net/wireless/ath/ath9k/hif_usb.c:770
 __usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1670
 usb_hcd_giveback_urb+0x367/0x410 drivers/usb/core/hcd.c:1747
 dummy_timer+0x11ff/0x32c0 drivers/usb/gadget/udc/dummy_hcd.c:1988
 call_timer_fn+0x1a0/0x6b0 kernel/time/timer.c:1474
 expire_timers kernel/time/timer.c:1519 [inline]
 __run_timers.part.0+0x674/0xa80 kernel/time/timer.c:1790
 __run_timers kernel/time/timer.c:1768 [inline]
 run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1803
 __do_softirq+0x29b/0x9c2 kernel/softirq.c:571
 do_softirq.part.0+0xde/0x130 kernel/softirq.c:472
 </IRQ>
 <TASK>
 do_softirq kernel/softirq.c:464 [inline]
 __local_bh_enable_ip+0x102/0x120 kernel/softirq.c:396
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 rcu_read_unlock_bh include/linux/rcupdate.h:776 [inline]
 ip_finish_output2+0x7d0/0x2170 net/ipv4/ip_output.c:229
 __ip_finish_output net/ipv4/ip_output.c:306 [inline]
 __ip_finish_output+0x396/0x650 net/ipv4/ip_output.c:288
 ip_finish_output+0x2d/0x280 net/ipv4/ip_output.c:316
 NF_HOOK_COND include/linux/netfilter.h:296 [inline]
 ip_output+0x19f/0x310 net/ipv4/ip_output.c:430
 dst_output include/net/dst.h:451 [inline]
 ip_local_out net/ipv4/ip_output.c:126 [inline]
 __ip_queue_xmit+0x8de/0x1be0 net/ipv4/ip_output.c:532
 __tcp_transmit_skb+0x1909/0x3870 net/ipv4/tcp_output.c:1405
 tcp_transmit_skb net/ipv4/tcp_output.c:1423 [inline]
 tcp_write_xmit+0xd89/0x6040 net/ipv4/tcp_output.c:2693
 __tcp_push_pending_frames+0xaa/0x380 net/ipv4/tcp_output.c:2877
 tcp_push+0x499/0x720 net/ipv4/tcp.c:728
 tcp_sendmsg_locked+0x1f53/0x2de0 net/ipv4/tcp.c:1445
 tcp_sendmsg+0x2b/0x40 net/ipv4/tcp.c:1473
 inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:819
 sock_sendmsg_nosec net/socket.c:714 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:734
 sock_write_iter+0x284/0x3c0 net/socket.c:1108
 call_write_iter include/linux/fs.h:2188 [inline]
 new_sync_write+0x315/0x4d0 fs/read_write.c:504
 vfs_write+0x7c0/0xac0 fs/read_write.c:591
 ksys_write+0x1e8/0x250 fs/read_write.c:644
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7f25b2afe9a3
Code: 8b 15 d9 f4 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 64 8b 04 25 18 00 00 00 85 c0 75 14 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 55 c3 0f 1f 40 00 48 83 ec 28 48 89 54 24 18
RSP: 002b:00007ffeaf68a8a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 000000000000003c RCX: 00007f25b2afe9a3
RDX: 000000000000003c RSI: 00005614e4666a50 RDI: 0000000000000004
RBP: 00005614e4656ed0 R08: 0000000000000000 R09: 00007ffeaf685f80
R10: 0000000000000e11 R11: 0000000000000246 R12: 0000000000000004
R13: 0000000000000001 R14: 00007ffeaf68a918 R15: 00007ffeaf68a998
 </TASK>

Allocated by task 3615:
 kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:436 [inline]
 __kasan_slab_alloc+0x90/0xc0 mm/kasan/common.c:469
 kasan_slab_alloc include/linux/kasan.h:224 [inline]
 slab_post_alloc_hook mm/slab.h:736 [inline]
 slab_alloc_node mm/slub.c:3243 [inline]
 kmem_cache_alloc_node+0x31f/0x500 mm/slub.c:3293
 __alloc_skb+0x210/0x340 net/core/skbuff.c:418
 alloc_skb include/linux/skbuff.h:1249 [inline]
 ath9k_hif_usb_alloc_reg_in_urbs drivers/net/wireless/ath/ath9k/hif_usb.c:963 [inline]
 ath9k_hif_usb_alloc_urbs+0x91d/0x1050 drivers/net/wireless/ath/ath9k/hif_usb.c:1022
 ath9k_hif_usb_dev_init drivers/net/wireless/ath/ath9k/hif_usb.c:1108 [inline]
 ath9k_hif_usb_firmware_cb+0x148/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1241
 request_firmware_work_func+0x12c/0x230 drivers/base/firmware_loader/main.c:1107
 process_one_work+0x991/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302

Freed by task 3601:
 kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
 kasan_set_track+0x21/0x30 mm/kasan/common.c:45
 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370
 ____kasan_slab_free mm/kasan/common.c:366 [inline]
 ____kasan_slab_free+0x166/0x1c0 mm/kasan/common.c:328
 kasan_slab_free include/linux/kasan.h:200 [inline]
 slab_free_hook mm/slub.c:1754 [inline]
 slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1780
 slab_free mm/slub.c:3534 [inline]
 kmem_cache_free+0xeb/0x5b0 mm/slub.c:3551
 kfree_skbmem+0xef/0x1b0 net/core/skbuff.c:705
 kfree_skb_reason+0x85/0x110 include/linux/refcount.h:279
 kfree_skb include/linux/skbuff.h:1198 [inline]
 ath9k_htc_rx_msg+0x1f0/0xb70 drivers/net/wireless/ath/ath9k/htc_hst.c:456
 ath9k_hif_usb_reg_in_cb+0x1ac/0x640 drivers/net/wireless/ath/ath9k/hif_usb.c:739
 __usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1670
 usb_hcd_giveback_urb+0x367/0x410 drivers/usb/core/hcd.c:1747
 dummy_timer+0x11ff/0x32c0 drivers/usb/gadget/udc/dummy_hcd.c:1988
 call_timer_fn+0x1a0/0x6b0 kernel/time/timer.c:1474
 expire_timers kernel/time/timer.c:1519 [inline]
 __run_timers.part.0+0x674/0xa80 kernel/time/timer.c:1790
 __run_timers kernel/time/timer.c:1768 [inline]
 run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1803
 __do_softirq+0x29b/0x9c2 kernel/softirq.c:571

The buggy address belongs to the object at ffff888073f4fb40
 which belongs to the cache skbuff_head_cache of size 240
The buggy address is located 228 bytes inside of
 240-byte region [ffff888073f4fb40, ffff888073f4fc30)

The buggy address belongs to the physical page:
page:ffffea0001cfd3c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x73f4f
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 0000000000000000 dead000000000122 ffff888140b65500
raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 3615, tgid 3615 (kworker/0:5), ts 64953063500, free_ts 64564184489
 prep_new_page mm/page_alloc.c:2535 [inline]
 get_page_from_freelist+0x210d/0x3a30 mm/page_alloc.c:4282
 __alloc_pages+0x1c7/0x510 mm/page_alloc.c:5506
 alloc_pages+0x1aa/0x310 mm/mempolicy.c:2280
 alloc_slab_page mm/slub.c:1824 [inline]
 allocate_slab+0x27e/0x3d0 mm/slub.c:1969
 new_slab mm/slub.c:2029 [inline]
 ___slab_alloc+0x89d/0xef0 mm/slub.c:3031
 __slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3118
 slab_alloc_node mm/slub.c:3209 [inline]
 kmem_cache_alloc_node+0x18b/0x500 mm/slub.c:3293
 __alloc_skb+0x210/0x340 net/core/skbuff.c:418
 alloc_skb include/linux/skbuff.h:1249 [inline]
 ath9k_hif_usb_alloc_rx_urbs drivers/net/wireless/ath/ath9k/hif_usb.c:888 [inline]
 ath9k_hif_usb_alloc_urbs+0x670/0x1050 drivers/net/wireless/ath/ath9k/hif_usb.c:1018
 ath9k_hif_usb_dev_init drivers/net/wireless/ath/ath9k/hif_usb.c:1108 [inline]
 ath9k_hif_usb_firmware_cb+0x148/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1241
 request_firmware_work_func+0x12c/0x230 drivers/base/firmware_loader/main.c:1107
 process_one_work+0x991/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1453 [inline]
 free_pcp_prepare+0x5e4/0xd20 mm/page_alloc.c:1503
 free_unref_page_prepare mm/page_alloc.c:3383 [inline]
 free_unref_page+0x19/0x4d0 mm/page_alloc.c:3479
 __unfreeze_partials+0x17c/0x1a0 mm/slub.c:2548
 qlink_free mm/kasan/quarantine.c:168 [inline]
 qlist_free_all+0x6a/0x170 mm/kasan/quarantine.c:187
 kasan_quarantine_reduce+0x180/0x200 mm/kasan/quarantine.c:294
 __kasan_slab_alloc+0xa2/0xc0 mm/kasan/common.c:446
 kasan_slab_alloc include/linux/kasan.h:224 [inline]
 slab_post_alloc_hook mm/slab.h:736 [inline]
 slab_alloc_node mm/slub.c:3243 [inline]
 kmem_cache_alloc_node+0x31f/0x500 mm/slub.c:3293
 __alloc_skb+0x210/0x340 net/core/skbuff.c:418
 alloc_skb_fclone include/linux/skbuff.h:1299 [inline]
 tcp_stream_alloc_skb+0x38/0x580 net/ipv4/tcp.c:861
 tcp_sendmsg_locked+0xad1/0x2de0 net/ipv4/tcp.c:1318
 tcp_sendmsg+0x2b/0x40 net/ipv4/tcp.c:1473
 inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:819
 sock_sendmsg_nosec net/socket.c:714 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:734
 sock_write_iter+0x284/0x3c0 net/socket.c:1108
 call_write_iter include/linux/fs.h:2188 [inline]
 new_sync_write+0x315/0x4d0 fs/read_write.c:504
 vfs_write+0x7c0/0xac0 fs/read_write.c:591

Memory state around the buggy address:
 ffff888073f4fb00: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
 ffff888073f4fb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888073f4fc00: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
                               ^
 ffff888073f4fc80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888073f4fd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc
==================================================================