[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. [ 16.361357][ C1] random: crng init done [ 16.365685][ C1] random: 7 urandom warning(s) missed due to ratelimiting Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.217' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 23.156407][ T83] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 23.525607][ T83] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 23.534708][ T83] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 23.542759][ T83] usb 1-1: Product: syz [ 23.546983][ T83] usb 1-1: Manufacturer: syz [ 23.551722][ T83] usb 1-1: SerialNumber: syz [ 23.596376][ T83] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 24.244875][ T83] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 24.464844][ C1] ================================================================== [ 24.473135][ C1] BUG: KASAN: stack-out-of-bounds in ath9k_hif_usb_rx_cb+0xdf6/0xf70 [ 24.481204][ C1] Write of size 8 at addr ffff8881db309a28 by task swapper/1/0 [ 24.488773][ C1] [ 24.491110][ C1] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.6.0-rc7-syzkaller #0 [ 24.498985][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 24.509247][ C1] Call Trace: [ 24.512524][ C1] [ 24.515816][ C1] dump_stack+0xef/0x16e [ 24.520055][ C1] ? ath9k_hif_usb_rx_cb+0xdf6/0xf70 [ 24.525320][ C1] ? ath9k_hif_usb_rx_cb+0xdf6/0xf70 [ 24.530611][ C1] print_address_description.constprop.0.cold+0xd3/0x314 [ 24.537627][ C1] ? ath9k_hif_usb_rx_cb+0xdf6/0xf70 [ 24.542951][ C1] ? ath9k_hif_usb_rx_cb+0xdf6/0xf70 [ 24.548250][ C1] __kasan_report.cold+0x37/0x77 [ 24.553180][ C1] ? ath9k_hif_usb_rx_cb+0xdf6/0xf70 [ 24.558597][ C1] kasan_report+0xe/0x20 [ 24.562920][ C1] ath9k_hif_usb_rx_cb+0xdf6/0xf70 [ 24.568022][ C1] ? hif_usb_mgmt_cb+0x300/0x300 [ 24.572957][ C1] ? do_raw_read_unlock+0x3b/0x70 [ 24.577967][ C1] ? _raw_read_unlock+0x1a/0x30 [ 24.582889][ C1] __usb_hcd_giveback_urb+0x1f2/0x470 [ 24.588248][ C1] usb_hcd_giveback_urb+0x368/0x420 [ 24.593425][ C1] dummy_timer+0x1258/0x32ae [ 24.597992][ C1] ? dummy_udc_probe+0x930/0x930 [ 24.602907][ C1] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 24.608446][ C1] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 24.613709][ C1] call_timer_fn+0x195/0x6f0 [ 24.618288][ C1] ? dummy_udc_probe+0x930/0x930 [ 24.623212][ C1] ? msleep_interruptible+0x130/0x130 [ 24.628579][ C1] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 24.634152][ C1] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 24.639416][ C1] ? _raw_spin_unlock_irq+0x1f/0x30 [ 24.644594][ C1] ? dummy_udc_probe+0x930/0x930 [ 24.649505][ C1] run_timer_softirq+0x5f9/0x1500 [ 24.654562][ C1] ? add_timer+0x7a0/0x7a0 [ 24.658970][ C1] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 24.664498]