program: r0 = open(&(0x7f0000000040)='./file0\x00', 0x42082, 0x0) write$FUSE_IOCTL(r0, &(0x7f0000000100)={0x20}, 0xfdef) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000140)='scalable', 0x32) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r1, &(0x7f0000000900)="2e552f5d9fd8b0d9627c4980f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9135a01c95d4a128ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x12, 0x0, 0x0) recvfrom$inet(r1, &(0x7f0000000080), 0xffffffffffffffa9, 0xc9100120, 0x0, 0x1500) syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000030020f003176c4000000000010902247251000000000904000012070103"], 0x0) r2 = accept4$inet(r1, &(0x7f0000000040)={0x2, 0x0, @empty}, &(0x7f0000000080)=0x10, 0x800) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x61, &(0x7f00000000c0)={'filter\x00', 0x4}, 0x68) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000300)='vhci_hcd.0\x00', 0xb) r4 = syz_open_dev$usbfs(&(0x7f0000000180), 0x10000001d, 0x8041) ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, &(0x7f0000000200)=@usbdevfs_connect) madvise(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0xf) open(&(0x7f0000000040)='./file0\x00', 0x42082, 0x0) (async) write$FUSE_IOCTL(r0, &(0x7f0000000100)={0x20}, 0xfdef) (async) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, 0x0, 0x0) (async) socket$inet_tcp(0x2, 0x1, 0x0) (async) bind$inet(r1, &(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10) (async) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000140)='scalable', 0x32) (async) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) (async) sendto$inet(r1, &(0x7f0000000900)="2e552f5d9fd8b0d9627c4980f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9135a01c95d4a128ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x12, 0x0, 0x0) (async) recvfrom$inet(r1, &(0x7f0000000080), 0xffffffffffffffa9, 0xc9100120, 0x0, 0x1500) (async) syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000030020f003176c4000000000010902247251000000000904000012070103"], 0x0) (async) accept4$inet(r1, &(0x7f0000000040)={0x2, 0x0, @empty}, &(0x7f0000000080)=0x10, 0x800) (async) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x61, &(0x7f00000000c0)={'filter\x00', 0x4}, 0x68) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) (async) write(r3, &(0x7f0000000300)='vhci_hcd.0\x00', 0xb) (async) syz_open_dev$usbfs(&(0x7f0000000180), 0x10000001d, 0x8041) (async) ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, &(0x7f0000000200)=@usbdevfs_connect) (async) madvise(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0xf) (async) [ 105.601157][ T4641] Bluetooth: hci0: command tx timeout [ 106.093609][ T1359] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 106.242933][ T1359] usb 5-1: Using ep0 maxpacket: 32 [ 106.247924][ T1359] usb 5-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 106.256645][ T1359] usb 5-1: config index 0 descriptor too short (expected 29220, got 36) [ 106.261173][ T1359] usb 5-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 106.268378][ T1359] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 106.272413][ T1359] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 106.276997][ T1359] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 18 [ 106.283614][ T1359] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 106.296236][ T1359] usb 5-1: config 0 descriptor?? [ 106.514997][ T5313] vhci_hcd vhci_hcd.0: remove, state 4 [ 106.518125][ T5313] usb usb7: USB disconnect, device number 1 [ 106.591421][ T68] vhci_hcd vhci_hcd.0: stop threads [ 106.598193][ T5313] vhci_hcd vhci_hcd.0: USB bus 7 deregistered [ 106.602593][ T68] vhci_hcd vhci_hcd.0: release socket [ 106.608928][ T68] vhci_hcd vhci_hcd.0: disconnect device [ 106.620294][ T68] vhci_hcd vhci_hcd.0: stop threads [ 106.627250][ T68] vhci_hcd vhci_hcd.0: release socket [ 106.630068][ T5313] vhci_hcd vhci_hcd.0: remove, state 4 [ 106.632493][ T68] ================================================================== [ 106.637334][ T68] BUG: KASAN: slab-use-after-free in vhci_cleanup_unlink_list+0x452/0x460 [ 106.641474][ T68] Read of size 4 at addr ffff8880348746a0 by task kworker/u4:4/68 [ 106.644876][ T68] [ 106.646044][ T68] CPU: 0 UID: 0 PID: 68 Comm: kworker/u4:4 Not tainted syzkaller #0 PREEMPT(full) [ 106.646064][ T68] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 106.646130][ T68] Workqueue: usbip_event event_handler [ 106.646159][ T68] Call Trace: [ 106.646191][ T68] [ 106.646197][ T68] dump_stack_lvl+0xe8/0x150 [ 106.646214][ T68] print_address_description+0x55/0x1e0 [ 106.646226][ T68] ? vhci_cleanup_unlink_list+0x452/0x460 [ 106.646243][ T68] print_report+0x58/0x70 [ 106.646257][ T68] kasan_report+0x117/0x150 [ 106.646282][ T68] ? vhci_cleanup_unlink_list+0x452/0x460 [ 106.646296][ T68] vhci_cleanup_unlink_list+0x452/0x460 [ 106.646322][ T68] ? kasan_quarantine_put+0xbb/0x1f0 [ 106.646335][ T68] vhci_shutdown_connection+0x2af/0x650 [ 106.646348][ T68] event_handler+0x2a4/0x4b0 [ 106.646364][ T68] ? process_scheduled_works+0xa20/0x14e0 [ 106.646377][ T68] process_scheduled_works+0xa8e/0x14e0 [ 106.646395][ T68] ? __pfx_process_scheduled_works+0x10/0x10 [ 106.646407][ T68] ? assign_work+0x3cf/0x5d0 [ 106.646419][ T68] worker_thread+0xa47/0xfb0 [ 106.646437][ T68] kthread+0x388/0x470 [ 106.646452][ T68] ? __pfx_worker_thread+0x10/0x10 [ 106.646463][ T68] ? __pfx_kthread+0x10/0x10 [ 106.646478][ T68] ret_from_fork+0x514/0xb70 [ 106.646493][ T68] ? __pfx_ret_from_fork+0x10/0x10 [ 106.646508][ T68] ? __switch_to+0xc89/0x1420 [ 106.646520][ T68] ? __pfx_kthread+0x10/0x10 [ 106.646540][ T68] ret_from_fork_asm+0x1a/0x30 [ 106.646560][ T68] [ 106.646564][ T68] [ 106.716548][ T68] Allocated by task 1: [ 106.718413][ T68] kasan_save_track+0x3e/0x80 [ 106.720483][ T68] __kasan_kmalloc+0x93/0xb0 [ 106.722473][ T68] __kmalloc_noprof+0x375/0x720 [ 106.724552][ T68] __usb_create_hcd+0x67/0x900 [ 106.726862][ T68] vhci_hcd_probe+0x1e6/0x3e0 [ 106.729680][ T68] platform_probe+0xf9/0x190 [ 106.732195][ T68] really_probe+0x254/0xae0 [ 106.734221][ T68] __driver_probe_device+0x1e8/0x360 [ 106.736529][ T68] driver_probe_device+0x4f/0x240 [ 106.738849][ T68] __device_attach_driver+0x270/0x410 [ 106.741455][ T68] bus_for_each_drv+0x258/0x2f0 [ 106.743616][ T68] __device_attach+0x2c4/0x450 [ 106.746044][ T68] device_initial_probe+0xa1/0xd0 [ 106.748793][ T68] bus_probe_device+0x12a/0x220 [ 106.751244][ T68] device_add+0x7d7/0xb80 [ 106.753554][ T68] platform_device_add+0x4bd/0x860 [ 106.755880][ T68] platform_device_register_full+0x62d/0x710 [ 106.758596][ T68] vhci_hcd_init+0x227/0x360 [ 106.760718][ T68] do_one_initcall+0x250/0x870 [ 106.762876][ T68] do_initcall_level+0x10a/0x1a0 [ 106.765111][ T68] do_initcalls+0x59/0xa0 [ 106.767142][ T68] kernel_init_freeable+0x29d/0x3e0 [ 106.770189][ T68] kernel_init+0x1d/0x1d0 [ 106.772786][ T68] ret_from_fork+0x514/0xb70 [ 106.775159][ T68] ret_from_fork_asm+0x1a/0x30 [ 106.777244][ T68] [ 106.778362][ T68] Freed by task 5313: [ 106.780212][ T68] kasan_save_track+0x3e/0x80 [ 106.783292][ T68] kasan_save_free_info+0x40/0x50 [ 106.785753][ T68] __kasan_slab_free+0x5c/0x80 [ 106.787855][ T68] kfree+0x1c5/0x640 [ 106.789763][ T68] vhci_hcd_remove+0x9e/0x110 [ 106.792181][ T68] device_release_driver_internal+0x48b/0x880 [ 106.795032][ T68] unbind_store+0x1a1/0x1d0 [ 106.797093][ T68] kernfs_fop_write_iter+0x3a4/0x540 [ 106.799341][ T68] vfs_write+0x612/0xba0 [ 106.801253][ T68] ksys_write+0x150/0x270 [ 106.803282][ T68] do_syscall_64+0x174/0x580 [ 106.805597][ T68] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.808502][ T68] [ 106.809658][ T68] Last potentially related work creation: [ 106.812084][ T68] kasan_save_stack+0x3e/0x60 [ 106.814223][ T68] kasan_record_aux_stack+0xbd/0xd0 [ 106.816701][ T68] insert_work+0x3d/0x330 [ 106.818748][ T68] __queue_work+0xcd8/0x10a0 [ 106.820978][ T68] queue_work_on+0x106/0x1d0 [ 106.823207][ T68] unlink1+0x344/0x3e0 [ 106.825115][ T68] usb_hcd_unlink_urb+0xe6/0x1e0 [ 106.827268][ T68] usb_kill_urb+0x10b/0x2f0 [ 106.829252][ T68] hub_quiesce+0x211/0x330 [ 106.831119][ T68] hub_suspend+0x904/0xad0 [ 106.833024][ T68] usb_suspend_both+0x285/0x1040 [ 106.835287][ T68] usb_runtime_suspend+0x58/0x110 [ 106.837637][ T68] __rpm_callback+0x2c7/0x950 [ 106.839845][ T68] rpm_suspend+0x8a0/0x17b0 [ 106.842100][ T68] __pm_runtime_suspend+0x12f/0x1a0 [ 106.844603][ T68] usb_new_device+0xaee/0x1690 [ 106.846726][ T68] register_root_hub+0x250/0x5c0 [ 106.848812][ T68] usb_add_hcd+0xac7/0xf80 [ 106.850685][ T68] vhci_hcd_probe+0x1fa/0x3e0 [ 106.852877][ T68] platform_probe+0xf9/0x190 [ 106.855515][ T68] really_probe+0x254/0xae0 [ 106.858169][ T68] __driver_probe_device+0x1e8/0x360 [ 106.860585][ T68] driver_probe_device+0x4f/0x240 [ 106.862760][ T68] __device_attach_driver+0x270/0x410 [ 106.865175][ T68] bus_for_each_drv+0x258/0x2f0 [ 106.867322][ T68] __device_attach+0x2c4/0x450 [ 106.869385][ T68] device_initial_probe+0xa1/0xd0 [ 106.871538][ T68] bus_probe_device+0x12a/0x220 [ 106.874252][ T68] device_add+0x7d7/0xb80 [ 106.876423][ T68] platform_device_add+0x4bd/0x860 [ 106.879064][ T68] platform_device_register_full+0x62d/0x710 [ 106.881837][ T68] vhci_hcd_init+0x227/0x360 [ 106.884066][ T68] do_one_initcall+0x250/0x870 [ 106.886210][ T68] do_initcall_level+0x10a/0x1a0 [ 106.888414][ T68] do_initcalls+0x59/0xa0 [ 106.890140][ T68] kernel_init_freeable+0x29d/0x3e0 [ 106.892295][ T68] kernel_init+0x1d/0x1d0 [ 106.894241][ T68] ret_from_fork+0x514/0xb70 [ 106.896451][ T68] ret_from_fork_asm+0x1a/0x30 [ 106.898799][ T68] [ 106.899914][ T68] Second to last potentially related work creation: [ 106.902463][ T68] kasan_save_stack+0x3e/0x60 [ 106.904424][ T68] kasan_record_aux_stack+0xbd/0xd0 [ 106.906824][ T68] insert_work+0x3d/0x330 [ 106.908698][ T68] __queue_work+0xcd8/0x10a0 [ 106.910704][ T68] queue_work_on+0x106/0x1d0 [ 106.912719][ T68] usb_hcd_submit_urb+0xa3b/0x1b60 [ 106.915007][ T68] usb_start_wait_urb+0x13f/0x5b0 [ 106.917232][ T68] usb_control_msg+0x234/0x3e0 [ 106.919285][ T68] hub_suspend+0x891/0xad0 [ 106.921172][ T68] usb_suspend_both+0x285/0x1040 [ 106.923327][ T68] usb_runtime_suspend+0x58/0x110 [ 106.925523][ T68] __rpm_callback+0x2c7/0x950 [ 106.927573][ T68] rpm_suspend+0x8a0/0x17b0 [ 106.929508][ T68] __pm_runtime_suspend+0x12f/0x1a0 [ 106.931754][ T68] usb_new_device+0xaee/0x1690 [ 106.935624][ T68] register_root_hub+0x250/0x5c0 [ 106.939320][ T68] usb_add_hcd+0xac7/0xf80 [ 106.941533][ T68] vhci_hcd_probe+0x1fa/0x3e0 [ 106.943551][ T68] platform_probe+0xf9/0x190 [ 106.945487][ T68] really_probe+0x254/0xae0 [ 106.947373][ T68] __driver_probe_device+0x1e8/0x360 [ 106.949662][ T68] driver_probe_device+0x4f/0x240 [ 106.951784][ T68] __device_attach_driver+0x270/0x410 [ 106.953993][ T68] bus_for_each_drv+0x258/0x2f0 [ 106.956258][ T68] __device_attach+0x2c4/0x450 [ 106.958481][ T68] device_initial_probe+0xa1/0xd0 [ 106.961003][ T68] bus_probe_device+0x12a/0x220 [ 106.963514][ T68] device_add+0x7d7/0xb80 [ 106.965666][ T68] platform_device_add+0x4bd/0x860 [ 106.967893][ T68] platform_device_register_full+0x62d/0x710 [ 106.970403][ T68] vhci_hcd_init+0x227/0x360 [ 106.972446][ T68] do_one_initcall+0x250/0x870 [ 106.974545][ T68] do_initcall_level+0x10a/0x1a0 [ 106.976513][ T68] do_initcalls+0x59/0xa0 [ 106.978372][ T68] kernel_init_freeable+0x29d/0x3e0 [ 106.980591][ T68] kernel_init+0x1d/0x1d0 [ 106.982490][ T68] ret_from_fork+0x514/0xb70 [ 106.984592][ T68] ret_from_fork_asm+0x1a/0x30 [ 106.986905][ T68] [ 106.988236][ T68] The buggy address belongs to the object at ffff888034874000 [ 106.988236][ T68] which belongs to the cache kmalloc-8k of size 8192 [ 106.994409][ T68] The buggy address is located 1696 bytes inside of [ 106.994409][ T68] freed 8192-byte region [ffff888034874000, ffff888034876000) [ 107.000557][ T68] [ 107.001638][ T68] The buggy address belongs to the physical page: [ 107.004559][ T68] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34870 [ 107.009553][ T68] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 107.013670][ T68] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 107.016929][ T68] page_type: f5(slab) [ 107.018703][ T68] raw: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 107.022304][ T68] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 107.026044][ T68] head: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 107.029860][ T68] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 107.033884][ T68] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 107.037757][ T68] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 107.041306][ T68] page dumped because: kasan: bad access detected [ 107.044275][ T68] page_owner tracks the page as allocated [ 107.047142][ T68] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 18727106535, free_ts 18671173780 [ 107.056161][ T68] post_alloc_hook+0x1f9/0x250 [ 107.058530][ T68] get_page_from_freelist+0x21fa/0x2270 [ 107.061178][ T68] __alloc_frozen_pages_noprof+0x18d/0x380 [ 107.063796][ T68] allocate_slab+0x79/0x5e0 [ 107.065855][ T68] refill_objects+0x2d5/0x350 [ 107.068227][ T68] __pcs_replace_empty_main+0x2bf/0x6b0 [ 107.070835][ T68] __kmalloc_cache_noprof+0x3a7/0x660 [ 107.073314][ T68] dummy_hcd_init+0x3e2/0xd00 [ 107.075446][ T68] do_one_initcall+0x250/0x870 [ 107.077600][ T68] do_initcall_level+0x10a/0x1a0 [ 107.079669][ T68] do_initcalls+0x59/0xa0 [ 107.082177][ T68] kernel_init_freeable+0x29d/0x3e0 [ 107.084865][ T68] kernel_init+0x1d/0x1d0 [ 107.086886][ T68] ret_from_fork+0x514/0xb70 [ 107.088906][ T68] ret_from_fork_asm+0x1a/0x30 [ 107.091006][ T68] page last free pid 1 tgid 1 stack trace: [ 107.093576][ T68] __free_frozen_pages+0xc1e/0xd10 [ 107.095702][ T68] __slab_free+0x274/0x2c0 [ 107.097658][ T68] qlist_free_all+0x99/0x100 [ 107.099699][ T68] kasan_quarantine_reduce+0x148/0x160 [ 107.102459][ T68] __kasan_slab_alloc+0x22/0x80 [ 107.104882][ T68] __kmalloc_cache_noprof+0x2ab/0x660 [ 107.107234][ T68] bus_add_driver+0x162/0x670 [ 107.109394][ T68] driver_register+0x23a/0x320 [ 107.111498][ T68] usb3503_init+0x2f/0x70 [ 107.113440][ T68] do_one_initcall+0x250/0x870 [ 107.115493][ T68] do_initcall_level+0x10a/0x1a0 [ 107.117873][ T68] do_initcalls+0x59/0xa0 [ 107.119875][ T68] kernel_init_freeable+0x29d/0x3e0 [ 107.122306][ T68] kernel_init+0x1d/0x1d0 [ 107.124162][ T68] ret_from_fork+0x514/0xb70 [ 107.126108][ T68] ret_from_fork_asm+0x1a/0x30 [ 107.128192][ T68] [ 107.129401][ T68] Memory state around the buggy address: [ 107.132264][ T68] ffff888034874580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 107.136962][ T68] ffff888034874600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 107.140985][ T68] >ffff888034874680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 107.144673][ T68] ^ [ 107.146849][ T68] ffff888034874700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 107.149944][ T68] ffff888034874780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 107.153194][ T68] ================================================================== [ 107.167605][ T5313] usb usb6: USB disconnect, device number 1 [ 107.194174][ T5313] vhci_hcd vhci_hcd.0: USB bus 6 deregistered