syzbot

radio-si470x 3-1:0.128: non-zero urb status (-71)
usb 3-1:0.128: non-zero urb status (-71)
=====================================================
BUG: KMSAN: use-after-free in call_timer_fn+0x232/0x530 kernel/time/timer.c:1404
CPU: 1 PID: 12477 Comm: kworker/1:3 Not tainted 5.4.0-rc2+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x191/0x1f0 lib/dump_stack.c:113
 kmsan_report+0x14c/0x2c0 mm/kmsan/kmsan_report.c:113
 __msan_warning+0x73/0xe0 mm/kmsan/kmsan_instr.c:250
 dummy_timer+0x8d3/0x6770 drivers/usb/gadget/udc/dummy_hcd.c:1821
 call_timer_fn+0x232/0x530 kernel/time/timer.c:1404
 expire_timers kernel/time/timer.c:1449 [inline]
 __run_timers+0xd60/0x1270 kernel/time/timer.c:1773
 run_timer_softirq+0x2d/0x50 kernel/time/timer.c:1786
 __do_softirq+0x4a1/0x83a kernel/softirq.c:293
 invoke_softirq kernel/softirq.c:375 [inline]
 irq_exit+0x230/0x280 kernel/softirq.c:416
 exiting_irq+0xe/0x10 arch/x86/include/asm/apic.h:536
 smp_apic_timer_interrupt+0x48/0x70 arch/x86/kernel/apic/apic.c:1139
 apic_timer_interrupt+0x2e/0x40 arch/x86/entry/entry_64.S:837
 </IRQ>
RIP: 0010:my_phys_addr_valid mm/kmsan/kmsan_shadow.c:77 [inline]
RIP: 0010:my_virt_addr_valid mm/kmsan/kmsan_shadow.c:102 [inline]
RIP: 0010:kmsan_get_shadow_origin_ptr+0x156/0x4c0 mm/kmsan/kmsan_shadow.c:188
Code: 00 00 4c 89 f1 48 81 e9 00 00 00 80 48 89 4d d0 0f 83 20 03 00 00 4c 01 f0 48 39 c8 77 59 8a 0d f1 f2 c1 0d 48 89 c2 48 d3 ea <48> 85 d2 75 48 48 89 c1 48 c1 e9 2e 75 3f 48 8b 0d 55 27 23 0e 48
RSP: 0018:ffff888040fbf558 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 00000000b4c82430 RBX: ffff8880b4c82430 RCX: ffff888134c8242e
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8880b4c82430
RBP: ffff888040fbf588 R08: 0000000000000001 R09: ffff88821f6e0b00
R10: 0000000000000004 R11: 00000000801e0010 R12: ffffffff902a3000
R13: ffff8880b4c82430 R14: ffff8880b4c82430 R15: 0000000000000008
 __msan_metadata_ptr_for_load_8+0x10/0x20 mm/kmsan/kmsan_instr.c:55
 kobject_uevent_env+0x17c/0x27c0 lib/kobject_uevent.c:481
 kobject_uevent+0x6f/0x80 lib/kobject_uevent.c:641
 device_del+0x1bbf/0x1cb0 drivers/base/core.c:2385
 device_unregister+0x37/0x80 drivers/base/core.c:2407
 usb_remove_ep_devs+0x7e/0xe0 drivers/usb/core/endpoint.c:215
 remove_intf_ep_devs drivers/usb/core/message.c:1116 [inline]
 usb_disable_device+0x41a/0x1150 drivers/usb/core/message.c:1240
 usb_disconnect+0x51e/0xd60 drivers/usb/core/hub.c:2199
 hub_port_connect drivers/usb/core/hub.c:4949 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
 port_event drivers/usb/core/hub.c:5359 [inline]
 hub_event+0x3fd0/0x72f0 drivers/usb/core/hub.c:5441
 process_one_work+0x1572/0x1ef0 kernel/workqueue.c:2269
 process_scheduled_works kernel/workqueue.c:2331 [inline]
 worker_thread+0x189c/0x2460 kernel/workqueue.c:2417
 kthread+0x4b5/0x4f0 kernel/kthread.c:256
 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:154 [inline]
 kmsan_internal_chain_origin+0xbd/0x170 mm/kmsan/kmsan.c:321
 __msan_chain_origin+0x6b/0xe0 mm/kmsan/kmsan_instr.c:184
 dummy_urb_enqueue+0x604/0xe10 drivers/usb/gadget/udc/dummy_hcd.c:1252
 usb_hcd_submit_urb+0x672/0x38d0 drivers/usb/core/hcd.c:1552
 usb_submit_urb+0x1ef3/0x1f50 drivers/usb/core/urb.c:571
 si470x_int_in_callback+0x3f7/0x1010 drivers/media/radio/si470x/radio-si470x-usb.c:465
 __usb_hcd_giveback_urb+0x4a7/0x630 drivers/usb/core/hcd.c:1654
 usb_hcd_giveback_urb+0x189/0x670 drivers/usb/core/hcd.c:1719
 dummy_timer+0xab0/0x6770 drivers/usb/gadget/udc/dummy_hcd.c:1965
 call_timer_fn+0x232/0x530 kernel/time/timer.c:1404
 expire_timers kernel/time/timer.c:1449 [inline]
 __run_timers+0xd60/0x1270 kernel/time/timer.c:1773
 run_timer_softirq+0x2d/0x50 kernel/time/timer.c:1786
 __do_softirq+0x4a1/0x83a kernel/softirq.c:293
 invoke_softirq kernel/softirq.c:375 [inline]
 irq_exit+0x230/0x280 kernel/softirq.c:416
 exiting_irq+0xe/0x10 arch/x86/include/asm/apic.h:536
 smp_apic_timer_interrupt+0x48/0x70 arch/x86/kernel/apic/apic.c:1139
 apic_timer_interrupt+0x2e/0x40 arch/x86/entry/entry_64.S:837
 native_restore_fl arch/x86/include/asm/irqflags.h:41 [inline]
 console_unlock+0x191b/0x1cb0 arch/x86/include/asm/irqflags.h:84
 vprintk_emit+0x45b/0x8f0 kernel/printk/printk.c:2013
 vprintk_default+0x90/0xa0 kernel/printk/printk.c:2040
 vprintk_func+0x635/0x810 kernel/printk/printk_safe.c:386
 printk+0x180/0x1c3 kernel/printk/printk.c:2073
 really_probe+0x1dc2/0x1f90 drivers/base/dd.c:628
 driver_probe_device+0x1ba/0x510 drivers/base/dd.c:721
 __device_attach_driver+0x5b8/0x790 drivers/base/dd.c:828
 bus_for_each_drv+0x28e/0x3b0 drivers/base/bus.c:430
 __device_attach+0x489/0x750 drivers/base/dd.c:894
 device_initial_probe+0x4a/0x60 drivers/base/dd.c:941
 bus_probe_device+0x131/0x390 drivers/base/bus.c:490
 device_add+0x25b5/0x2df0 drivers/base/core.c:2201
 usb_set_configuration+0x309f/0x3710 drivers/usb/core/message.c:2027
 generic_probe+0xe7/0x280 drivers/usb/core/generic.c:210
 usb_probe_device+0x146/0x200 drivers/usb/core/driver.c:266
 really_probe+0xd91/0x1f90 drivers/base/dd.c:552
 driver_probe_device+0x1ba/0x510 drivers/base/dd.c:721
 __device_attach_driver+0x5b8/0x790 drivers/base/dd.c:828
 bus_for_each_drv+0x28e/0x3b0 drivers/base/bus.c:430
 __device_attach+0x489/0x750 drivers/base/dd.c:894
 device_initial_probe+0x4a/0x60 drivers/base/dd.c:941
 bus_probe_device+0x131/0x390 drivers/base/bus.c:490
 device_add+0x25b5/0x2df0 drivers/base/core.c:2201
 usb_new_device+0x23e5/0x2fb0 drivers/usb/core/hub.c:2536
 hub_port_connect drivers/usb/core/hub.c:5098 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
 port_event drivers/usb/core/hub.c:5359 [inline]
 hub_event+0x581d/0x72f0 drivers/usb/core/hub.c:5441
 process_one_work+0x1572/0x1ef0 kernel/workqueue.c:2269
 worker_thread+0x111b/0x2460 kernel/workqueue.c:2415
 kthread+0x4b5/0x4f0 kernel/kthread.c:256
 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:154 [inline]
 kmsan_internal_poison_shadow+0x60/0x120 mm/kmsan/kmsan.c:137
 kmsan_slab_free+0x8d/0x100 mm/kmsan/kmsan_hooks.c:123
 slab_free_freelist_hook mm/slub.c:1473 [inline]
 slab_free mm/slub.c:3040 [inline]
 kfree+0x4c1/0x2db0 mm/slub.c:3982
 si470x_usb_driver_probe+0xa7b/0x3240 drivers/media/radio/si470x/radio-si470x-usb.c:766
 usb_probe_interface+0xd19/0x1310 drivers/usb/core/driver.c:361
 really_probe+0xd91/0x1f90 drivers/base/dd.c:552
 driver_probe_device+0x1ba/0x510 drivers/base/dd.c:721
 __device_attach_driver+0x5b8/0x790 drivers/base/dd.c:828
 bus_for_each_drv+0x28e/0x3b0 drivers/base/bus.c:430
 __device_attach+0x489/0x750 drivers/base/dd.c:894
 device_initial_probe+0x4a/0x60 drivers/base/dd.c:941
 bus_probe_device+0x131/0x390 drivers/base/bus.c:490
 device_add+0x25b5/0x2df0 drivers/base/core.c:2201
 usb_set_configuration+0x309f/0x3710 drivers/usb/core/message.c:2027
 generic_probe+0xe7/0x280 drivers/usb/core/generic.c:210
 usb_probe_device+0x146/0x200 drivers/usb/core/driver.c:266
 really_probe+0xd91/0x1f90 drivers/base/dd.c:552
 driver_probe_device+0x1ba/0x510 drivers/base/dd.c:721
 __device_attach_driver+0x5b8/0x790 drivers/base/dd.c:828
 bus_for_each_drv+0x28e/0x3b0 drivers/base/bus.c:430
 __device_attach+0x489/0x750 drivers/base/dd.c:894
 device_initial_probe+0x4a/0x60 drivers/base/dd.c:941
 bus_probe_device+0x131/0x390 drivers/base/bus.c:490
 device_add+0x25b5/0x2df0 drivers/base/core.c:2201
 usb_new_device+0x23e5/0x2fb0 drivers/usb/core/hub.c:2536
 hub_port_connect drivers/usb/core/hub.c:5098 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
 port_event drivers/usb/core/hub.c:5359 [inline]
 hub_event+0x581d/0x72f0 drivers/usb/core/hub.c:5441
 process_one_work+0x1572/0x1ef0 kernel/workqueue.c:2269
 worker_thread+0x111b/0x2460 kernel/workqueue.c:2415
 kthread+0x4b5/0x4f0 kernel/kthread.c:256
 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355
=====================================================