program: socket$nl_netfilter(0x10, 0x3, 0xc) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x8, 0xf, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8}, {{}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x4}, {0xac}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_mount_image$msdos(&(0x7f00000001c0), &(0x7f0000000040)='./file0\x00', 0x100c404, &(0x7f0000000240)={[{@nodots}, {@fat=@fmask={'fmask', 0x3d, 0xdbd}}, {@fat=@uid}, {@fat=@uid}, {@dots}, {@nodots}, {@fat=@gid={'gid', 0x3d, 0xee00}}, {@nodots}, {@fat=@nfs_nostale_ro}, {@dots}, {@nodots}, {@nodots}, {@fat=@fmask={'fmask', 0x3d, 0x133}}, {@fat=@flush}, {@fat=@usefree}, {@nodots}, {@nodots}, {@fat=@gid}, {@fat=@flush}, {@fat=@umask={'umask', 0x3d, 0x7}}, {@dots}, {@dots}]}, 0x1, 0x1f5, &(0x7f0000000600)="$eJzs3cFqE1EUANCbmCYTcdGdIAgjLnRV1C+oSAUxIFSy0J2gK7NqN6mb9jP8Bf/LD5CuspEncSadmKYxBDKj7Tmb3pn7Xt+7M2SSTW5SFL7f/RpZ1or2fuzHpBW70Y6ZswAArpNJSvEjFZreCwBQjzXe/3/WvCUAYMvevnv/+vlgcHCY51nE+dl4OB4Wf4v8y1eDgyf5b7vVrPPxeHjrIv80X/zsMM3vxO0y/6yYn1+kuxEx7Mbjh0V+mnvxZpD/Ob8XH7dcOwAAAAAAAAAAAAAAAAAAAAAANOV+5DNL+/vs7S3m+2W+OJrrD7TQv6cT9zrlYdUeKJ3WURQAAAAAAAAAAAAAAAAAAAD8Z45Pvnz+MBp9OqqCXkTMn+ksGXN10Cr/8VqDmw/asdn0flnmBou2yku03QL7y2/uOkF0/pW7s2mQ17BWf+XlTWkaLH8VzNpiXDm9GxGrV390uOnmJyml0bcHR8cnkVYOrp4RvVqfSAAAAAAAAAAAAAAAAAAAcHPNfev7kqyJDQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAA6rf/58Gl8+sDE4j4k78dfBsrZ3IGq0VAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA6+tXAAAA//85ziI4") (async, rerun: 32) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (rerun: 32) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000300)='vhci_hcd.0\x00', 0xb) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'gre0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0xffffffffffffff2d, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r1, 0xc018937a, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0, {0x5}}, '.\x00'}) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000880)=@newtfilter={0x90, 0x2c, 0xf3f, 0x30bd29, 0x25dfd3f5, {0x0, 0x0, 0x0, r3, {0x1}, {}, {0x7, 0x4}}, [@filter_kind_options=@f_flower={{0xb}, {0x60, 0x2, [@TCA_FLOWER_ACT={0x5c, 0x3, [@m_skbedit={0x58, 0x1, 0x0, 0x0, {{0xc}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PTYPE={0x6, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x9}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x27a, 0x7fff, 0x6, 0x4, 0x3}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0x90}, 0x1, 0x0, 0x0, 0x20041890}, 0x0) [ 93.842235][ T5272] Bluetooth: hci0: command tx timeout [ 94.019887][ T5314] loop0: detected capacity change from 0 to 256 [ 94.041501][ T5315] vhci_hcd vhci_hcd.0: remove, state 4 [ 94.044800][ T5315] usb usb7: USB disconnect, device number 1 [ 94.150185][ T5315] vhci_hcd vhci_hcd.0: USB bus 7 deregistered [ 94.153566][ T12] vhci_hcd vhci_hcd.0: stop threads [ 94.163847][ T12] vhci_hcd vhci_hcd.0: release socket [ 94.169603][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 94.177338][ T12] vhci_hcd vhci_hcd.0: stop threads [ 94.180071][ T12] vhci_hcd vhci_hcd.0: release socket [ 94.185573][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 94.195073][ T12] vhci_hcd vhci_hcd.0: stop threads [ 94.198772][ T12] vhci_hcd vhci_hcd.0: release socket [ 94.207139][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 94.210104][ T12] vhci_hcd vhci_hcd.0: stop threads [ 94.215358][ T12] vhci_hcd vhci_hcd.0: release socket [ 94.221501][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 94.229086][ T12] vhci_hcd vhci_hcd.0: stop threads [ 94.243541][ T12] vhci_hcd vhci_hcd.0: release socket [ 94.248245][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 94.252218][ T12] vhci_hcd vhci_hcd.0: stop threads [ 94.256269][ T12] vhci_hcd vhci_hcd.0: release socket [ 94.260760][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 94.265877][ T12] vhci_hcd vhci_hcd.0: stop threads [ 94.269629][ T5315] vhci_hcd vhci_hcd.0: remove, state 4 [ 94.272730][ T12] ================================================================== [ 94.275881][ T12] BUG: KASAN: slab-use-after-free in vhci_shutdown_connection+0x1d4/0x650 [ 94.279265][ T12] Read of size 8 at addr ffff888034029310 by task kworker/u4:0/12 [ 94.282353][ T12] [ 94.283411][ T12] CPU: 0 UID: 0 PID: 12 Comm: kworker/u4:0 Not tainted syzkaller #0 PREEMPT(full) [ 94.283426][ T12] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.283434][ T12] Workqueue: usbip_event event_handler [ 94.283455][ T12] Call Trace: [ 94.283461][ T12] [ 94.283466][ T12] dump_stack_lvl+0xe8/0x150 [ 94.283484][ T12] print_address_description+0x55/0x1e0 [ 94.283499][ T12] ? vhci_shutdown_connection+0x1d4/0x650 [ 94.283509][ T12] print_report+0x58/0x70 [ 94.283521][ T12] kasan_report+0x117/0x150 [ 94.283536][ T12] ? vhci_shutdown_connection+0x1d4/0x650 [ 94.283548][ T12] vhci_shutdown_connection+0x1d4/0x650 [ 94.283560][ T12] event_handler+0x2a4/0x4b0 [ 94.283575][ T12] ? process_scheduled_works+0xa1a/0x14c0 [ 94.283587][ T12] process_scheduled_works+0xa88/0x14c0 [ 94.283604][ T12] ? __pfx_process_scheduled_works+0x10/0x10 [ 94.283617][ T12] ? assign_work+0x3cf/0x5d0 [ 94.283628][ T12] worker_thread+0xa47/0xfb0 [ 94.283646][ T12] kthread+0x38b/0x480 [ 94.283661][ T12] ? __pfx_worker_thread+0x10/0x10 [ 94.283672][ T12] ? __pfx_kthread+0x10/0x10 [ 94.283685][ T12] ret_from_fork+0x514/0xb70 [ 94.283701][ T12] ? __pfx_ret_from_fork+0x10/0x10 [ 94.283716][ T12] ? __switch_to+0xc89/0x1420 [ 94.283729][ T12] ? __pfx_kthread+0x10/0x10 [ 94.283743][ T12] ret_from_fork_asm+0x1a/0x30 [ 94.283761][ T12] [ 94.283765][ T12] [ 94.341203][ T12] Allocated by task 1: [ 94.342890][ T12] kasan_save_track+0x3e/0x80 [ 94.344867][ T12] __kasan_kmalloc+0x93/0xb0 [ 94.346723][ T12] __kmalloc_noprof+0x379/0x720 [ 94.348665][ T12] __usb_create_hcd+0x67/0x900 [ 94.350583][ T12] vhci_hcd_probe+0x1e6/0x3e0 [ 94.352530][ T12] platform_probe+0xf9/0x190 [ 94.354390][ T12] really_probe+0x254/0xae0 [ 94.356236][ T12] __driver_probe_device+0x1e8/0x360 [ 94.358334][ T12] driver_probe_device+0x4f/0x240 [ 94.360415][ T12] __device_attach_driver+0x270/0x410 [ 94.362612][ T12] bus_for_each_drv+0x258/0x2f0 [ 94.364580][ T12] __device_attach+0x2c4/0x450 [ 94.366558][ T12] device_initial_probe+0xa1/0xd0 [ 94.368669][ T12] bus_probe_device+0x12a/0x220 [ 94.370655][ T12] device_add+0x7d7/0xb80 [ 94.372449][ T12] platform_device_add+0x4bd/0x860 [ 94.374608][ T12] platform_device_register_full+0x62d/0x710 [ 94.376934][ T12] vhci_hcd_init+0x227/0x360 [ 94.378827][ T12] do_one_initcall+0x250/0x870 [ 94.380808][ T12] do_initcall_level+0x10a/0x1a0 [ 94.382787][ T12] do_initcalls+0x59/0xa0 [ 94.384503][ T12] kernel_init_freeable+0x29d/0x3e0 [ 94.386550][ T12] kernel_init+0x22/0x1d0 [ 94.388291][ T12] ret_from_fork+0x514/0xb70 [ 94.390197][ T12] ret_from_fork_asm+0x1a/0x30 [ 94.392132][ T12] [ 94.393108][ T12] Freed by task 5315: [ 94.394721][ T12] kasan_save_track+0x3e/0x80 [ 94.396629][ T12] kasan_save_free_info+0x40/0x50 [ 94.398670][ T12] __kasan_slab_free+0x5c/0x80 [ 94.400668][ T12] kfree+0x1c5/0x640 [ 94.402350][ T12] vhci_hcd_remove+0x9e/0x110 [ 94.404283][ T12] device_release_driver_internal+0x48b/0x880 [ 94.406659][ T12] unbind_store+0x1a1/0x1d0 [ 94.408502][ T12] kernfs_fop_write_iter+0x3a4/0x540 [ 94.410581][ T12] vfs_write+0x612/0xba0 [ 94.412294][ T12] ksys_write+0x150/0x270 [ 94.414091][ T12] do_syscall_64+0x166/0x520 [ 94.416027][ T12] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.418447][ T12] [ 94.419479][ T12] Last potentially related work creation: [ 94.421803][ T12] kasan_save_stack+0x3e/0x60 [ 94.423713][ T12] kasan_record_aux_stack+0xbd/0xd0 [ 94.425810][ T12] insert_work+0x3d/0x330 [ 94.427613][ T12] __queue_work+0xcda/0x10a0 [ 94.429514][ T12] queue_work_on+0x106/0x1d0 [ 94.431400][ T12] unlink1+0x344/0x3e0 [ 94.432986][ T12] usb_hcd_unlink_urb+0xe6/0x1e0 [ 94.435173][ T12] usb_kill_urb+0x10b/0x2f0 [ 94.437204][ T12] hub_quiesce+0x211/0x330 [ 94.439270][ T12] hub_suspend+0x904/0xad0 [ 94.441312][ T12] usb_suspend_both+0x285/0x1040 [ 94.443577][ T12] usb_runtime_suspend+0x58/0x110 [ 94.445882][ T12] __rpm_callback+0x2c7/0x950 [ 94.448033][ T12] rpm_suspend+0x89d/0x17a0 [ 94.450054][ T12] __pm_runtime_suspend+0x12f/0x1a0 [ 94.452150][ T12] usb_new_device+0xaee/0x1690 [ 94.454044][ T12] register_root_hub+0x250/0x5c0 [ 94.456020][ T12] usb_add_hcd+0xac7/0xf80 [ 94.457880][ T12] vhci_hcd_probe+0x1fa/0x3e0 [ 94.459937][ T12] platform_probe+0xf9/0x190 [ 94.461880][ T12] really_probe+0x254/0xae0 [ 94.463852][ T12] __driver_probe_device+0x1e8/0x360 [ 94.466055][ T12] driver_probe_device+0x4f/0x240 [ 94.468088][ T12] __device_attach_driver+0x270/0x410 [ 94.470427][ T12] bus_for_each_drv+0x258/0x2f0 [ 94.472490][ T12] __device_attach+0x2c4/0x450 [ 94.474508][ T12] device_initial_probe+0xa1/0xd0 [ 94.476599][ T12] bus_probe_device+0x12a/0x220 [ 94.478636][ T12] device_add+0x7d7/0xb80 [ 94.480527][ T12] platform_device_add+0x4bd/0x860 [ 94.482663][ T12] platform_device_register_full+0x62d/0x710 [ 94.485284][ T12] vhci_hcd_init+0x227/0x360 [ 94.487210][ T12] do_one_initcall+0x250/0x870 [ 94.489204][ T12] do_initcall_level+0x10a/0x1a0 [ 94.491282][ T12] do_initcalls+0x59/0xa0 [ 94.493089][ T12] kernel_init_freeable+0x29d/0x3e0 [ 94.495223][ T12] kernel_init+0x22/0x1d0 [ 94.496931][ T12] ret_from_fork+0x514/0xb70 [ 94.498938][ T12] ret_from_fork_asm+0x1a/0x30 [ 94.500850][ T12] [ 94.501841][ T12] Second to last potentially related work creation: [ 94.504483][ T12] kasan_save_stack+0x3e/0x60 [ 94.506454][ T12] kasan_record_aux_stack+0xbd/0xd0 [ 94.508686][ T12] insert_work+0x3d/0x330 [ 94.510485][ T12] __queue_work+0xcda/0x10a0 [ 94.512386][ T12] queue_work_on+0x106/0x1d0 [ 94.514258][ T12] usb_hcd_submit_urb+0xa3b/0x1b60 [ 94.516399][ T12] usb_start_wait_urb+0x13f/0x5b0 [ 94.518467][ T12] usb_control_msg+0x234/0x3e0 [ 94.520462][ T12] hub_suspend+0x891/0xad0 [ 94.522242][ T12] usb_suspend_both+0x285/0x1040 [ 94.524208][ T12] usb_runtime_suspend+0x58/0x110 [ 94.526162][ T12] __rpm_callback+0x2c7/0x950 [ 94.528068][ T12] rpm_suspend+0x89d/0x17a0 [ 94.530023][ T12] __pm_runtime_suspend+0x12f/0x1a0 [ 94.532180][ T12] usb_new_device+0xaee/0x1690 [ 94.534222][ T12] register_root_hub+0x250/0x5c0 [ 94.536250][ T12] usb_add_hcd+0xac7/0xf80 [ 94.538101][ T12] vhci_hcd_probe+0x1fa/0x3e0 [ 94.540093][ T12] platform_probe+0xf9/0x190 [ 94.541954][ T12] really_probe+0x254/0xae0 [ 94.543834][ T12] __driver_probe_device+0x1e8/0x360 [ 94.546003][ T12] driver_probe_device+0x4f/0x240 [ 94.548022][ T12] __device_attach_driver+0x270/0x410 [ 94.550221][ T12] bus_for_each_drv+0x258/0x2f0 [ 94.552145][ T12] __device_attach+0x2c4/0x450 [ 94.554281][ T12] device_initial_probe+0xa1/0xd0 [ 94.556229][ T12] bus_probe_device+0x12a/0x220 [ 94.558185][ T12] device_add+0x7d7/0xb80 [ 94.559911][ T12] platform_device_add+0x4bd/0x860 [ 94.561686][ T12] platform_device_register_full+0x62d/0x710 [ 94.563864][ T12] vhci_hcd_init+0x227/0x360 [ 94.565722][ T12] do_one_initcall+0x250/0x870 [ 94.567570][ T12] do_initcall_level+0x10a/0x1a0 [ 94.569466][ T12] do_initcalls+0x59/0xa0 [ 94.571152][ T12] kernel_init_freeable+0x29d/0x3e0 [ 94.573273][ T12] kernel_init+0x22/0x1d0 [ 94.574995][ T12] ret_from_fork+0x514/0xb70 [ 94.576798][ T12] ret_from_fork_asm+0x1a/0x30 [ 94.578762][ T12] [ 94.579880][ T12] The buggy address belongs to the object at ffff888034028000 [ 94.579880][ T12] which belongs to the cache kmalloc-8k of size 8192 [ 94.585499][ T12] The buggy address is located 4880 bytes inside of [ 94.585499][ T12] freed 8192-byte region [ffff888034028000, ffff88803402a000) [ 94.590973][ T12] [ 94.591996][ T12] The buggy address belongs to the physical page: [ 94.594537][ T12] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34028 [ 94.598130][ T12] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 94.601512][ T12] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 94.604508][ T12] page_type: f5(slab) [ 94.606127][ T12] raw: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 94.609513][ T12] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 94.613056][ T12] head: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 94.616448][ T12] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 94.619919][ T12] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 94.623403][ T12] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 94.626905][ T12] page dumped because: kasan: bad access detected [ 94.629388][ T12] page_owner tracks the page as allocated [ 94.631737][ T12] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 16867106917, free_ts 15432835337 [ 94.639897][ T12] post_alloc_hook+0x1f9/0x250 [ 94.641911][ T12] get_page_from_freelist+0x21fe/0x2270 [ 94.644235][ T12] __alloc_frozen_pages_noprof+0x18d/0x380 [ 94.646523][ T12] allocate_slab+0x79/0x5e0 [ 94.648395][ T12] refill_objects+0x2d5/0x350 [ 94.650314][ T12] __pcs_replace_empty_main+0x2c3/0x6b0 [ 94.652504][ T12] __kmalloc_noprof+0x489/0x720 [ 94.654415][ T12] __usb_create_hcd+0x67/0x900 [ 94.656437][ T12] vhci_hcd_probe+0x104/0x3e0 [ 94.658311][ T12] platform_probe+0xf9/0x190 [ 94.660274][ T12] really_probe+0x254/0xae0 [ 94.662098][ T12] __driver_probe_device+0x1e8/0x360 [ 94.664139][ T12] driver_probe_device+0x4f/0x240 [ 94.666226][ T12] __device_attach_driver+0x270/0x410 [ 94.668404][ T12] bus_for_each_drv+0x258/0x2f0 [ 94.670411][ T12] __device_attach+0x2c4/0x450 [ 94.672383][ T12] page last free pid 1239 tgid 1239 stack trace: [ 94.674844][ T12] free_pages_prepare+0x960/0xa60 [ 94.676875][ T12] __free_contig_range_common+0x174/0x340 [ 94.679148][ T12] free_pages_bulk+0x48/0x120 [ 94.681044][ T12] vfree+0x226/0x4a0 [ 94.682651][ T12] delayed_vfree_work+0x55/0x80 [ 94.684577][ T12] process_scheduled_works+0xa88/0x14c0 [ 94.686780][ T12] worker_thread+0xa47/0xfb0 [ 94.688618][ T12] kthread+0x38b/0x480 [ 94.690388][ T12] ret_from_fork+0x514/0xb70 [ 94.692237][ T12] ret_from_fork_asm+0x1a/0x30 [ 94.694040][ T12] [ 94.695059][ T12] Memory state around the buggy address: [ 94.697295][ T12] ffff888034029200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.700792][ T12] ffff888034029280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.703973][ T12] >ffff888034029300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.707383][ T12] ^ [ 94.709349][ T12] ffff888034029380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.712663][ T12] ffff888034029400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.715860][ T12] ================================================================== [ 94.721497][ T5315] usb usb6: USB disconnect, device number 1 [ 94.741099][ T5315] vhci_hcd vhci_hcd.0: USB bus 6 deregistered