program: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000200)={r0, 0x401, 0x5, 0xffff}) setsockopt$inet_tcp_int(r1, 0x6, 0xa, &(0x7f0000000240)=0xfe1e9a2, 0x4) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) write(r4, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa) (async) r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0) write(r5, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa) (async) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0x7, 0xfff2}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_RATE_ENABLE={0x8}]}}]}, 0x38}}, 0x0) (async) r6 = socket$inet_sctp(0x2, 0x1, 0x84) bind$inet(r6, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) (async) sendto$inet(r6, &(0x7f00000000c0)='}', 0x1, 0x0, &(0x7f00000001c0)={0x2, 0x4e22, @local}, 0x10) [ 93.640025][ T4653] Bluetooth: hci0: command tx timeout [ 93.724787][ T5330] vhci_hcd vhci_hcd.0: remove, state 4 [ 93.766446][ T5330] usb usb7: USB disconnect, device number 1 [ 93.869789][ T5330] vhci_hcd vhci_hcd.0: USB bus 7 deregistered [ 93.873733][ T1117] vhci_hcd vhci_hcd.0: stop threads [ 93.880418][ T1117] vhci_hcd vhci_hcd.0: release socket [ 93.887976][ T1117] vhci_hcd vhci_hcd.0: disconnect device [ 93.896110][ T1117] vhci_hcd vhci_hcd.0: stop threads [ 93.900073][ T5330] vhci_hcd vhci_hcd.0: remove, state 4 [ 93.902870][ T1117] ================================================================== [ 93.905979][ T1117] BUG: KASAN: slab-use-after-free in vhci_shutdown_connection+0x1d4/0x650 [ 93.909333][ T1117] Read of size 8 at addr ffff888034c84780 by task kworker/u4:10/1117 [ 93.912586][ T1117] [ 93.913618][ T1117] CPU: 0 UID: 0 PID: 1117 Comm: kworker/u4:10 Not tainted syzkaller #0 PREEMPT(full) [ 93.913628][ T1117] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.913634][ T1117] Workqueue: usbip_event event_handler [ 93.913645][ T1117] Call Trace: [ 93.913650][ T1117] [ 93.913654][ T1117] dump_stack_lvl+0xe8/0x150 [ 93.913665][ T1117] print_address_description+0x55/0x1e0 [ 93.913675][ T1117] ? vhci_shutdown_connection+0x1d4/0x650 [ 93.913682][ T1117] print_report+0x58/0x70 [ 93.913690][ T1117] kasan_report+0x117/0x150 [ 93.913699][ T1117] ? vhci_shutdown_connection+0x1d4/0x650 [ 93.913707][ T1117] vhci_shutdown_connection+0x1d4/0x650 [ 93.913715][ T1117] event_handler+0x2a4/0x4b0 [ 93.913721][ T1117] ? process_scheduled_works+0xa20/0x14e0 [ 93.913729][ T1117] process_scheduled_works+0xa8e/0x14e0 [ 93.913740][ T1117] ? __pfx_process_scheduled_works+0x10/0x10 [ 93.913748][ T1117] ? assign_work+0x3cf/0x5d0 [ 93.913755][ T1117] worker_thread+0xa47/0xfb0 [ 93.913764][ T1117] ? __kthread_parkme+0x71/0x1f0 [ 93.913773][ T1117] kthread+0x388/0x470 [ 93.913782][ T1117] ? __pfx_worker_thread+0x10/0x10 [ 93.913789][ T1117] ? __pfx_kthread+0x10/0x10 [ 93.913798][ T1117] ret_from_fork+0x514/0xb70 [ 93.913808][ T1117] ? __pfx_ret_from_fork+0x10/0x10 [ 93.913816][ T1117] ? __switch_to+0xc89/0x1420 [ 93.913824][ T1117] ? __pfx_kthread+0x10/0x10 [ 93.913833][ T1117] ret_from_fork_asm+0x1a/0x30 [ 93.913841][ T1117] [ 93.913843][ T1117] [ 93.973821][ T1117] Allocated by task 1: [ 93.975571][ T1117] kasan_save_track+0x3e/0x80 [ 93.977518][ T1117] __kasan_kmalloc+0x93/0xb0 [ 93.979379][ T1117] __kmalloc_noprof+0x375/0x720 [ 93.981655][ T1117] __usb_create_hcd+0x67/0x900 [ 93.984052][ T1117] vhci_hcd_probe+0x1e6/0x3e0 [ 93.986135][ T1117] platform_probe+0xf9/0x190 [ 93.988090][ T1117] really_probe+0x254/0xae0 [ 93.990100][ T1117] __driver_probe_device+0x1e8/0x360 [ 93.992541][ T1117] driver_probe_device+0x4f/0x240 [ 93.994669][ T1117] __device_attach_driver+0x270/0x410 [ 93.996767][ T1117] bus_for_each_drv+0x258/0x2f0 [ 93.998751][ T1117] __device_attach+0x2c4/0x450 [ 94.000769][ T1117] device_initial_probe+0xa1/0xd0 [ 94.002846][ T1117] bus_probe_device+0x12a/0x220 [ 94.004853][ T1117] device_add+0x7d7/0xb80 [ 94.006685][ T1117] platform_device_add+0x4bd/0x860 [ 94.008889][ T1117] platform_device_register_full+0x62d/0x710 [ 94.011457][ T1117] vhci_hcd_init+0x227/0x360 [ 94.013472][ T1117] do_one_initcall+0x250/0x870 [ 94.015339][ T1117] do_initcall_level+0x10a/0x1a0 [ 94.017214][ T1117] do_initcalls+0x59/0xa0 [ 94.019019][ T1117] kernel_init_freeable+0x29d/0x3e0 [ 94.021263][ T1117] kernel_init+0x1d/0x1d0 [ 94.023128][ T1117] ret_from_fork+0x514/0xb70 [ 94.025175][ T1117] ret_from_fork_asm+0x1a/0x30 [ 94.027251][ T1117] [ 94.028269][ T1117] Freed by task 5330: [ 94.029999][ T1117] kasan_save_track+0x3e/0x80 [ 94.031982][ T1117] kasan_save_free_info+0x40/0x50 [ 94.034126][ T1117] __kasan_slab_free+0x5c/0x80 [ 94.036188][ T1117] kfree+0x1c5/0x640 [ 94.037906][ T1117] vhci_hcd_remove+0x9e/0x110 [ 94.039951][ T1117] device_release_driver_internal+0x48b/0x880 [ 94.042296][ T1117] unbind_store+0x1a1/0x1d0 [ 94.044117][ T1117] kernfs_fop_write_iter+0x3a4/0x540 [ 94.046335][ T1117] vfs_write+0x612/0xba0 [ 94.048172][ T1117] ksys_write+0x150/0x270 [ 94.050008][ T1117] do_syscall_64+0x174/0x580 [ 94.051934][ T1117] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.054445][ T1117] [ 94.055444][ T1117] Last potentially related work creation: [ 94.057634][ T1117] kasan_save_stack+0x3e/0x60 [ 94.059518][ T1117] kasan_record_aux_stack+0xbd/0xd0 [ 94.061994][ T1117] insert_work+0x3d/0x330 [ 94.063950][ T1117] __queue_work+0xcd8/0x10a0 [ 94.065987][ T1117] queue_work_on+0x106/0x1d0 [ 94.068086][ T1117] unlink1+0x344/0x3e0 [ 94.069982][ T1117] usb_hcd_unlink_urb+0xe6/0x1e0 [ 94.072171][ T1117] usb_kill_urb+0x10b/0x2f0 [ 94.074144][ T1117] hub_quiesce+0x211/0x330 [ 94.076103][ T1117] hub_suspend+0x904/0xad0 [ 94.078137][ T1117] usb_suspend_both+0x285/0x1040 [ 94.080366][ T1117] usb_runtime_suspend+0x58/0x110 [ 94.082606][ T1117] __rpm_callback+0x2c7/0x950 [ 94.084688][ T1117] rpm_suspend+0x8a0/0x17b0 [ 94.086708][ T1117] __pm_runtime_suspend+0x12f/0x1a0 [ 94.089109][ T1117] usb_new_device+0xadf/0x1620 [ 94.091288][ T1117] register_root_hub+0x250/0x5c0 [ 94.093420][ T1117] usb_add_hcd+0xac7/0xf80 [ 94.095371][ T1117] vhci_hcd_probe+0x1fa/0x3e0 [ 94.097462][ T1117] platform_probe+0xf9/0x190 [ 94.099572][ T1117] really_probe+0x254/0xae0 [ 94.101666][ T1117] __driver_probe_device+0x1e8/0x360 [ 94.104028][ T1117] driver_probe_device+0x4f/0x240 [ 94.106170][ T1117] __device_attach_driver+0x270/0x410 [ 94.108511][ T1117] bus_for_each_drv+0x258/0x2f0 [ 94.110618][ T1117] __device_attach+0x2c4/0x450 [ 94.112616][ T1117] device_initial_probe+0xa1/0xd0 [ 94.114790][ T1117] bus_probe_device+0x12a/0x220 [ 94.116888][ T1117] device_add+0x7d7/0xb80 [ 94.118774][ T1117] platform_device_add+0x4bd/0x860 [ 94.120976][ T1117] platform_device_register_full+0x62d/0x710 [ 94.123554][ T1117] vhci_hcd_init+0x227/0x360 [ 94.125547][ T1117] do_one_initcall+0x250/0x870 [ 94.127650][ T1117] do_initcall_level+0x10a/0x1a0 [ 94.129787][ T1117] do_initcalls+0x59/0xa0 [ 94.131674][ T1117] kernel_init_freeable+0x29d/0x3e0 [ 94.133906][ T1117] kernel_init+0x1d/0x1d0 [ 94.135770][ T1117] ret_from_fork+0x514/0xb70 [ 94.137737][ T1117] ret_from_fork_asm+0x1a/0x30 [ 94.139819][ T1117] [ 94.140866][ T1117] Second to last potentially related work creation: [ 94.143618][ T1117] kasan_save_stack+0x3e/0x60 [ 94.145616][ T1117] kasan_record_aux_stack+0xbd/0xd0 [ 94.147978][ T1117] insert_work+0x3d/0x330 [ 94.149916][ T1117] __queue_work+0xcd8/0x10a0 [ 94.152014][ T1117] queue_work_on+0x106/0x1d0 [ 94.154093][ T1117] usb_hcd_submit_urb+0xa3b/0x1b60 [ 94.156344][ T1117] usb_start_wait_urb+0x13f/0x5b0 [ 94.158634][ T1117] usb_control_msg+0x234/0x3e0 [ 94.160757][ T1117] hub_suspend+0x891/0xad0 [ 94.162615][ T1117] usb_suspend_both+0x285/0x1040 [ 94.164664][ T1117] usb_runtime_suspend+0x58/0x110 [ 94.166760][ T1117] __rpm_callback+0x2c7/0x950 [ 94.168856][ T1117] rpm_suspend+0x8a0/0x17b0 [ 94.170982][ T1117] __pm_runtime_suspend+0x12f/0x1a0 [ 94.173261][ T1117] usb_new_device+0xadf/0x1620 [ 94.175373][ T1117] register_root_hub+0x250/0x5c0 [ 94.177536][ T1117] usb_add_hcd+0xac7/0xf80 [ 94.179605][ T1117] vhci_hcd_probe+0x1fa/0x3e0 [ 94.181738][ T1117] platform_probe+0xf9/0x190 [ 94.183775][ T1117] really_probe+0x254/0xae0 [ 94.185774][ T1117] __driver_probe_device+0x1e8/0x360 [ 94.188184][ T1117] driver_probe_device+0x4f/0x240 [ 94.190531][ T1117] __device_attach_driver+0x270/0x410 [ 94.193005][ T1117] bus_for_each_drv+0x258/0x2f0 [ 94.195101][ T1117] __device_attach+0x2c4/0x450 [ 94.197208][ T1117] device_initial_probe+0xa1/0xd0 [ 94.199400][ T1117] bus_probe_device+0x12a/0x220 [ 94.201496][ T1117] device_add+0x7d7/0xb80 [ 94.203405][ T1117] platform_device_add+0x4bd/0x860 [ 94.205648][ T1117] platform_device_register_full+0x62d/0x710 [ 94.208270][ T1117] vhci_hcd_init+0x227/0x360 [ 94.210376][ T1117] do_one_initcall+0x250/0x870 [ 94.212509][ T1117] do_initcall_level+0x10a/0x1a0 [ 94.214716][ T1117] do_initcalls+0x59/0xa0 [ 94.216618][ T1117] kernel_init_freeable+0x29d/0x3e0 [ 94.218902][ T1117] kernel_init+0x1d/0x1d0 [ 94.220823][ T1117] ret_from_fork+0x514/0xb70 [ 94.222915][ T1117] ret_from_fork_asm+0x1a/0x30 [ 94.224987][ T1117] [ 94.226049][ T1117] The buggy address belongs to the object at ffff888034c84000 [ 94.226049][ T1117] which belongs to the cache kmalloc-8k of size 8192 [ 94.231996][ T1117] The buggy address is located 1920 bytes inside of [ 94.231996][ T1117] freed 8192-byte region [ffff888034c84000, ffff888034c86000) [ 94.237950][ T1117] [ 94.239046][ T1117] The buggy address belongs to the physical page: [ 94.241830][ T1117] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34c80 [ 94.245622][ T1117] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 94.249291][ T1117] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 94.252549][ T1117] page_type: f5(slab) [ 94.254319][ T1117] raw: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 94.258050][ T1117] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 94.261695][ T1117] head: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 94.265296][ T1117] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 94.268965][ T1117] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 94.272651][ T1117] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 94.276354][ T1117] page dumped because: kasan: bad access detected [ 94.279230][ T1117] page_owner tracks the page as allocated [ 94.281626][ T1117] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 16843522527, free_ts 16769469424 [ 94.290111][ T1117] post_alloc_hook+0x1f9/0x250 [ 94.292187][ T1117] get_page_from_freelist+0x21fa/0x2270 [ 94.294623][ T1117] __alloc_frozen_pages_noprof+0x18d/0x380 [ 94.297220][ T1117] allocate_slab+0x79/0x5e0 [ 94.299258][ T1117] refill_objects+0x2d5/0x350 [ 94.301335][ T1117] __pcs_replace_empty_main+0x2bf/0x6b0 [ 94.303728][ T1117] __kmalloc_noprof+0x485/0x720 [ 94.305837][ T1117] __usb_create_hcd+0x67/0x900 [ 94.307884][ T1117] vhci_hcd_probe+0x1e6/0x3e0 [ 94.309977][ T1117] platform_probe+0xf9/0x190 [ 94.311979][ T1117] really_probe+0x254/0xae0 [ 94.313998][ T1117] __driver_probe_device+0x1e8/0x360 [ 94.316389][ T1117] driver_probe_device+0x4f/0x240 [ 94.318552][ T1117] __device_attach_driver+0x270/0x410 [ 94.320896][ T1117] bus_for_each_drv+0x258/0x2f0 [ 94.323064][ T1117] __device_attach+0x2c4/0x450 [ 94.325204][ T1117] page last free pid 15 tgid 15 stack trace: [ 94.327839][ T1117] __free_frozen_pages+0xc1e/0xd10 [ 94.330173][ T1117] rcu_core+0x78b/0x10a0 [ 94.332072][ T1117] handle_softirqs+0x225/0x840 [ 94.334212][ T1117] run_ksoftirqd+0x36/0x60 [ 94.336156][ T1117] smpboot_thread_fn+0x57c/0xa80 [ 94.338363][ T1117] kthread+0x388/0x470 [ 94.340112][ T1117] ret_from_fork+0x514/0xb70 [ 94.342138][ T1117] ret_from_fork_asm+0x1a/0x30 [ 94.344365][ T1117] [ 94.345458][ T1117] Memory state around the buggy address: [ 94.347925][ T1117] ffff888034c84680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.351420][ T1117] ffff888034c84700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.354626][ T1117] >ffff888034c84780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.357777][ T1117] ^ [ 94.359444][ T1117] ffff888034c84800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.362656][ T1117] ffff888034c84880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.365853][ T1117] ================================================================== [ 94.370222][ T5330] usb usb6: USB disconnect, device number 1 [ 94.413299][ T5330] vhci_hcd vhci_hcd.0: USB bus 6 deregistered