program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='vhci_hcd.0\x00', 0xb)
[ 84.778031][ T5312] vhci_hcd vhci_hcd.0: remove, state 4
[ 84.781676][ T5312] usb usb7: USB disconnect, device number 1
[ 84.836097][ T5273] Bluetooth: hci0: command tx timeout
[ 84.930549][ T1074] vhci_hcd vhci_hcd.0: stop threads
[ 84.949597][ T1074] vhci_hcd vhci_hcd.0: release socket
[ 84.952554][ T1074] vhci_hcd vhci_hcd.0: disconnect device
[ 85.000966][ T12] vhci_hcd vhci_hcd.0: stop threads
[ 85.003823][ T12] vhci_hcd vhci_hcd.0: release socket
[ 85.006734][ T12] vhci_hcd vhci_hcd.0: disconnect device
[ 85.069173][ T1074] vhci_hcd vhci_hcd.0: stop threads
[ 85.072810][ T1074] vhci_hcd vhci_hcd.0: release socket
[ 85.076009][ T1074] vhci_hcd vhci_hcd.0: disconnect device
[ 85.103932][ T71] vhci_hcd vhci_hcd.0: stop threads
[ 85.107350][ T71] vhci_hcd vhci_hcd.0: release socket
[ 85.110439][ T71] vhci_hcd vhci_hcd.0: disconnect device
[ 85.118046][ T1074] vhci_hcd vhci_hcd.0: stop threads
[ 85.121542][ T1074] vhci_hcd vhci_hcd.0: release socket
[ 85.124462][ T1074] vhci_hcd vhci_hcd.0: disconnect device
[ 85.144101][ T1074] vhci_hcd vhci_hcd.0: stop threads
[ 85.146812][ T1074] vhci_hcd vhci_hcd.0: release socket
[ 85.149685][ T1074] vhci_hcd vhci_hcd.0: disconnect device
[ 85.157195][ T71] vhci_hcd vhci_hcd.0: stop threads
[ 85.161144][ T71] vhci_hcd vhci_hcd.0: release socket
[ 85.164930][ T71] vhci_hcd vhci_hcd.0: disconnect device
[ 85.168865][ T1074] vhci_hcd vhci_hcd.0: stop threads
[ 85.172003][ T1074] vhci_hcd vhci_hcd.0: release socket
[ 85.175373][ T1074] vhci_hcd vhci_hcd.0: disconnect device
[ 85.190039][ T5312] vhci_hcd vhci_hcd.0: USB bus 7 deregistered
[ 85.229964][ T5312] vhci_hcd vhci_hcd.0: remove, state 4
[ 85.240121][ T5312] usb usb6: USB disconnect, device number 1
[ 85.574751][ T71] vhci_hcd vhci_hcd.0: stop threads
[ 85.577856][ T71] vhci_hcd vhci_hcd.0: release socket
[ 85.591037][ T71] vhci_hcd vhci_hcd.0: disconnect device
[ 85.597673][ T71] vhci_hcd vhci_hcd.0: stop threads
[ 85.604626][ T71] vhci_hcd vhci_hcd.0: release socket
[ 85.614632][ T71] vhci_hcd vhci_hcd.0: disconnect device
[ 85.618573][ T5312] vhci_hcd vhci_hcd.0: USB bus 6 deregistered
[ 85.622215][ T71] vhci_hcd vhci_hcd.0: stop threads
[ 85.624963][ T71] vhci_hcd vhci_hcd.0: release socket
[ 85.628188][ T71] vhci_hcd vhci_hcd.0: disconnect device
[ 85.644470][ T71] ==================================================================
[ 85.648707][ T71] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0x40/0x60
[ 85.652677][ T71] Read of size 1 at addr ffff888034a2c918 by task kworker/u4:5/71
[ 85.658579][ T71]
[ 85.660464][ T71] CPU: 0 UID: 0 PID: 71 Comm: kworker/u4:5 Not tainted syzkaller #0 PREEMPT(full)
[ 85.660486][ T71] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 85.660497][ T71] Workqueue: usbip_event event_handler
[ 85.660555][ T71] Call Trace:
[ 85.660564][ T71]
[ 85.660572][ T71] dump_stack_lvl+0xe8/0x150
[ 85.660594][ T71] print_address_description+0x55/0x1e0
[ 85.660614][ T71] ? _raw_spin_lock_irqsave+0x40/0x60
[ 85.660631][ T71] print_report+0x58/0x70
[ 85.660647][ T71] kasan_report+0x117/0x150
[ 85.660667][ T71] ? _raw_spin_lock_irqsave+0x40/0x60
[ 85.660684][ T71] ? event_handler+0x2b0/0x4b0
[ 85.660703][ T71] __kasan_check_byte+0x2a/0x40
[ 85.660720][ T71] lock_acquire+0x84/0x350
[ 85.660738][ T71] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 85.660754][ T71] ? rcu_is_watching+0x15/0xb0
[ 85.660776][ T71] _raw_spin_lock_irqsave+0x40/0x60
[ 85.660791][ T71] ? event_handler+0x2b0/0x4b0
[ 85.660810][ T71] event_handler+0x2b0/0x4b0
[ 85.660832][ T71] ? process_scheduled_works+0xa20/0x14e0
[ 85.660848][ T71] process_scheduled_works+0xa8e/0x14e0
[ 85.660869][ T71] ? __pfx_process_scheduled_works+0x10/0x10
[ 85.660884][ T71] ? assign_work+0x3cf/0x5d0
[ 85.660899][ T71] worker_thread+0xa47/0xfb0
[ 85.660919][ T71] ? __kthread_parkme+0x71/0x1f0
[ 85.660938][ T71] kthread+0x388/0x470
[ 85.660956][ T71] ? __pfx_worker_thread+0x10/0x10
[ 85.660971][ T71] ? __pfx_kthread+0x10/0x10
[ 85.660988][ T71] ret_from_fork+0x514/0xb70
[ 85.661010][ T71] ? __pfx_ret_from_fork+0x10/0x10
[ 85.661027][ T71] ? __switch_to+0xc89/0x1420
[ 85.661044][ T71] ? __pfx_kthread+0x10/0x10
[ 85.661061][ T71] ret_from_fork_asm+0x1a/0x30
[ 85.661086][ T71]
[ 85.661091][ T71]
[ 85.759506][ T71] Allocated by task 1:
[ 85.761625][ T71] kasan_save_track+0x3e/0x80
[ 85.764194][ T71] __kasan_kmalloc+0x93/0xb0
[ 85.766817][ T71] __kmalloc_noprof+0x375/0x720
[ 85.769737][ T71] __usb_create_hcd+0x67/0x900
[ 85.772361][ T71] vhci_hcd_probe+0x104/0x3e0
[ 85.775012][ T71] platform_probe+0xf9/0x190
[ 85.777684][ T71] really_probe+0x254/0xae0
[ 85.780273][ T71] __driver_probe_device+0x1e8/0x360
[ 85.783141][ T71] driver_probe_device+0x4f/0x240
[ 85.786082][ T71] __device_attach_driver+0x270/0x410
[ 85.789175][ T71] bus_for_each_drv+0x258/0x2f0
[ 85.791748][ T71] __device_attach+0x2c4/0x450
[ 85.794400][ T71] device_initial_probe+0xa1/0xd0
[ 85.797255][ T71] bus_probe_device+0x12a/0x220
[ 85.800792][ T71] device_add+0x7d7/0xb80
[ 85.803344][ T71] platform_device_add+0x4bd/0x860
[ 85.806377][ T71] platform_device_register_full+0x62d/0x710
[ 85.809277][ T71] vhci_hcd_init+0x227/0x360
[ 85.811996][ T71] do_one_initcall+0x250/0x870
[ 85.814767][ T71] do_initcall_level+0x10a/0x1a0
[ 85.817378][ T71] do_initcalls+0x59/0xa0
[ 85.819530][ T71] kernel_init_freeable+0x29d/0x3e0
[ 85.822328][ T71] kernel_init+0x1d/0x1d0
[ 85.824800][ T71] ret_from_fork+0x514/0xb70
[ 85.827669][ T71] ret_from_fork_asm+0x1a/0x30
[ 85.830360][ T71]
[ 85.831596][ T71] Freed by task 5312:
[ 85.833797][ T71] kasan_save_track+0x3e/0x80
[ 85.836494][ T71] kasan_save_free_info+0x40/0x50
[ 85.839401][ T71] __kasan_slab_free+0x5c/0x80
[ 85.841947][ T71] kfree+0x1c5/0x640
[ 85.844265][ T71] vhci_hcd_remove+0xe4/0x110
[ 85.847022][ T71] device_release_driver_internal+0x48b/0x880
[ 85.850454][ T71] unbind_store+0x1a1/0x1d0
[ 85.852938][ T71] kernfs_fop_write_iter+0x3a4/0x540
[ 85.855669][ T71] vfs_write+0x612/0xba0
[ 85.857960][ T71] ksys_write+0x150/0x270
[ 85.860532][ T71] do_syscall_64+0x174/0x580
[ 85.863228][ T71] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.866421][ T71]
[ 85.867641][ T71] Last potentially related work creation:
[ 85.870599][ T71] kasan_save_stack+0x3e/0x60
[ 85.873278][ T71] kasan_record_aux_stack+0xbd/0xd0
[ 85.876418][ T71] insert_work+0x3d/0x330
[ 85.878708][ T71] __queue_work+0xcd8/0x10a0
[ 85.881005][ T71] queue_work_on+0x106/0x1d0
[ 85.883618][ T71] unlink1+0x344/0x3e0
[ 85.886052][ T71] usb_hcd_unlink_urb+0xe6/0x1e0
[ 85.888977][ T71] usb_kill_urb+0x10b/0x2f0
[ 85.891409][ T71] hub_quiesce+0x211/0x330
[ 85.893673][ T71] hub_suspend+0x904/0xad0
[ 85.896064][ T71] usb_suspend_both+0x285/0x1040
[ 85.898957][ T71] usb_runtime_suspend+0x58/0x110
[ 85.902071][ T71] __rpm_callback+0x2c7/0x950
[ 85.904748][ T71] rpm_suspend+0x8a0/0x17b0
[ 85.907105][ T71] __pm_runtime_suspend+0x12f/0x1a0
[ 85.909999][ T71] usb_runtime_idle+0x76/0x90
[ 85.912870][ T71] rpm_idle+0x5b4/0x980
[ 85.915380][ T71] pm_runtime_work+0x11e/0x1b0
[ 85.917812][ T71] process_scheduled_works+0xa8e/0x14e0
[ 85.921020][ T71] worker_thread+0xa47/0xfb0
[ 85.923767][ T71] kthread+0x388/0x470
[ 85.926041][ T71] ret_from_fork+0x514/0xb70
[ 85.928527][ T71] ret_from_fork_asm+0x1a/0x30
[ 85.930990][ T71]
[ 85.932211][ T71] Second to last potentially related work creation:
[ 85.935874][ T71] kasan_save_stack+0x3e/0x60
[ 85.938751][ T71] kasan_record_aux_stack+0xbd/0xd0
[ 85.941232][ T71] insert_work+0x3d/0x330
[ 85.943353][ T71] __queue_work+0xcd8/0x10a0
[ 85.946038][ T71] queue_work_on+0x106/0x1d0
[ 85.949657][ T71] usb_hcd_submit_urb+0xa3b/0x1b60
[ 85.952604][ T71] usb_start_wait_urb+0x13f/0x5b0
[ 85.955367][ T71] usb_control_msg+0x234/0x3e0
[ 85.958140][ T71] hub_ext_port_status+0x114/0x810
[ 85.960973][ T71] hub_activate+0x740/0x1b20
[ 85.963584][ T71] process_scheduled_works+0xa8e/0x14e0
[ 85.966579][ T71] worker_thread+0xa47/0xfb0
[ 85.969688][ T71] kthread+0x388/0x470
[ 85.972080][ T71] ret_from_fork+0x514/0xb70
[ 85.974599][ T71] ret_from_fork_asm+0x1a/0x30
[ 85.977039][ T71]
[ 85.978348][ T71] The buggy address belongs to the object at ffff888034a2c000
[ 85.978348][ T71] which belongs to the cache kmalloc-8k of size 8192
[ 85.985888][ T71] The buggy address is located 2328 bytes inside of
[ 85.985888][ T71] freed 8192-byte region [ffff888034a2c000, ffff888034a2e000)
[ 85.993620][ T71]
[ 85.995131][ T71] The buggy address belongs to the physical page:
[ 85.998920][ T71] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34a28
[ 86.003634][ T71] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 86.008396][ T71] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff)
[ 86.012511][ T71] page_type: f5(slab)
[ 86.014756][ T71] raw: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000
[ 86.019966][ T71] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
[ 86.024336][ T71] head: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000
[ 86.029082][ T71] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
[ 86.033962][ T71] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 86.038331][ T71] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 86.043621][ T71] page dumped because: kasan: bad access detected
[ 86.047065][ T71] page_owner tracks the page as allocated
[ 86.050627][ T71] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 15471714238, free_ts 15456300483
[ 86.062292][ T71] post_alloc_hook+0x1f9/0x250
[ 86.065297][ T71] get_page_from_freelist+0x21fa/0x2270
[ 86.068996][ T71] __alloc_frozen_pages_noprof+0x18d/0x380
[ 86.072189][ T71] allocate_slab+0x79/0x5e0
[ 86.074518][ T71] refill_objects+0x2d5/0x350
[ 86.077210][ T71] __pcs_replace_empty_main+0x2bf/0x6b0
[ 86.080812][ T71] __kmalloc_noprof+0x485/0x720
[ 86.083492][ T71] __usb_create_hcd+0x67/0x900
[ 86.085840][ T71] vhci_hcd_probe+0x104/0x3e0
[ 86.088414][ T71] platform_probe+0xf9/0x190
[ 86.091137][ T71] really_probe+0x254/0xae0
[ 86.093963][ T71] __driver_probe_device+0x1e8/0x360
[ 86.096935][ T71] driver_probe_device+0x4f/0x240
[ 86.099554][ T71] __device_attach_driver+0x270/0x410
[ 86.102491][ T71] bus_for_each_drv+0x258/0x2f0
[ 86.105361][ T71] __device_attach+0x2c4/0x450
[ 86.108385][ T71] page last free pid 803 tgid 803 stack trace:
[ 86.111815][ T71] free_pages_prepare+0x960/0xa60
[ 86.114526][ T71] __free_contig_range_common+0x174/0x340
[ 86.117620][ T71] free_pages_bulk+0x48/0x120
[ 86.120354][ T71] vfree+0x224/0x4a0
[ 86.122510][ T71] delayed_vfree_work+0x55/0x80
[ 86.124937][ T71] process_scheduled_works+0xa8e/0x14e0
[ 86.127430][ T71] worker_thread+0xa47/0xfb0
[ 86.130036][ T71] kthread+0x388/0x470
[ 86.132602][ T71] ret_from_fork+0x514/0xb70
[ 86.135225][ T71] ret_from_fork_asm+0x1a/0x30
[ 86.137524][ T71]
[ 86.138690][ T71] Memory state around the buggy address:
[ 86.141447][ T71] ffff888034a2c800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 86.145648][ T71] ffff888034a2c880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 86.150157][ T71] >ffff888034a2c900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 86.154586][ T71] ^
[ 86.157015][ T71] ffff888034a2c980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 86.161467][ T71] ffff888034a2ca00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 86.166002][ T71] ==================================================================
[ 86.169947][ T71] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 86.174206][ T71] CPU: 0 UID: 0 PID: 71 Comm: kworker/u4:5 Not tainted syzkaller #0 PREEMPT(full)
[ 86.179113][ T71] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.183976][ T71] Workqueue: usbip_event event_handler
[ 86.187149][ T71] Call Trace:
[ 86.189298][ T71]
[ 86.191148][ T71] vpanic+0x56c/0xa60
[ 86.192879][ T71] ? __pfx_vpanic+0x10/0x10
[ 86.194941][ T71] panic+0xc5/0xd0
[ 86.196558][ T71] ? __pfx_panic+0x10/0x10
[ 86.199296][ T71] ? _raw_spin_lock_irqsave+0x40/0x60
[ 86.203182][ T71] ? rcu_is_watching+0x15/0xb0
[ 86.205771][ T71] ? _raw_spin_lock_irqsave+0x40/0x60
[ 86.208267][ T71] ? _raw_spin_lock_irqsave+0x40/0x60
[ 86.210993][ T71] check_panic_on_warn+0x89/0xb0
[ 86.214447][ T71] ? _raw_spin_lock_irqsave+0x40/0x60
[ 86.217948][ T71] end_report+0x73/0x170
[ 86.220463][ T71] ? _raw_spin_lock_irqsave+0x40/0x60
[ 86.223249][ T71] kasan_report+0x128/0x150
[ 86.225663][ T71] ? _raw_spin_lock_irqsave+0x40/0x60
[ 86.228618][ T71] ? event_handler+0x2b0/0x4b0
[ 86.231810][ T71] __kasan_check_byte+0x2a/0x40
[ 86.234602][ T71] lock_acquire+0x84/0x350
[ 86.236850][ T71] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 86.241041][ T71] ? rcu_is_watching+0x15/0xb0
[ 86.245075][ T71] _raw_spin_lock_irqsave+0x40/0x60
[ 86.247969][ T71] ? event_handler+0x2b0/0x4b0
[ 86.250384][ T71] event_handler+0x2b0/0x4b0
[ 86.252800][ T71] ? process_scheduled_works+0xa20/0x14e0
[ 86.256301][ T71] process_scheduled_works+0xa8e/0x14e0
[ 86.259548][ T71] ? __pfx_process_scheduled_works+0x10/0x10
[ 86.262661][ T71] ? assign_work+0x3cf/0x5d0
[ 86.265016][ T71] worker_thread+0xa47/0xfb0
[ 86.267612][ T71] ? __kthread_parkme+0x71/0x1f0
[ 86.270734][ T71] kthread+0x388/0x470
[ 86.273233][ T71] ? __pfx_worker_thread+0x10/0x10
[ 86.275856][ T71] ? __pfx_kthread+0x10/0x10
[ 86.278215][ T71] ret_from_fork+0x514/0xb70
[ 86.280931][ T71] ? __pfx_ret_from_fork+0x10/0x10
[ 86.284179][ T71] ? __switch_to+0xc89/0x1420
[ 86.286938][ T71] ? __pfx_kthread+0x10/0x10
[ 86.289332][ T71] ret_from_fork_asm+0x1a/0x30
[ 86.292000][ T71]
[ 86.294520][ T71] Kernel Offset: disabled
[ 86.297091][ T71] Rebooting in 86400 seconds..