Warning: Permanently added '10.128.15.214' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 22.091544][ T95] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 22.461237][ T95] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 22.470560][ T95] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 22.479078][ T95] usb 1-1: Product: syz [ 22.483333][ T95] usb 1-1: Manufacturer: syz [ 22.488189][ T95] usb 1-1: SerialNumber: syz [ 22.532132][ T95] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 23.140493][ T95] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 23.360171][ C0] ================================================================== [ 23.368602][ C0] BUG: KASAN: slab-out-of-bounds in ath9k_htc_rx_msg+0xa25/0xaf0 [ 23.376464][ C0] Write of size 2 at addr ffff8881ced8a7f0 by task swapper/0/0 [ 23.384432][ C0] [ 23.386763][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.6.0-rc5-syzkaller #0 [ 23.395146][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 23.405672][ C0] Call Trace: [ 23.408982][ C0] [ 23.411857][ C0] dump_stack+0xef/0x16e [ 23.416237][ C0] ? ath9k_htc_rx_msg+0xa25/0xaf0 [ 23.421381][ C0] ? ath9k_htc_rx_msg+0xa25/0xaf0 [ 23.426424][ C0] print_address_description.constprop.0.cold+0xd3/0x314 [ 23.434786][ C0] ? ath9k_htc_rx_msg+0xa25/0xaf0 [ 23.439805][ C0] ? ath9k_htc_rx_msg+0xa25/0xaf0 [ 23.445103][ C0] __kasan_report.cold+0x37/0x77 [ 23.450217][ C0] ? do_raw_spin_lock+0x61/0x290 [ 23.455413][ C0] ? ath9k_htc_rx_msg+0xa25/0xaf0 [ 23.460730][ C0] kasan_report+0xe/0x20 [ 23.465235][ C0] ath9k_htc_rx_msg+0xa25/0xaf0 [ 23.470237][ C0] ath9k_hif_usb_reg_in_cb+0x1ba/0x630 [ 23.475694][ C0] ? trace_hardirqs_off+0x50/0x200 [ 23.480801][ C0] __usb_hcd_giveback_urb+0x29a/0x550 [ 23.486166][ C0] usb_hcd_giveback_urb+0x368/0x420 [ 23.491536][ C0] dummy_timer+0x1258/0x32ae [ 23.496242][ C0] ? dummy_udc_probe+0x930/0x930 [ 23.501302][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 23.506983][ C0] ? rcu_read_lock_bh_held