usb 1-1: USB disconnect, device number 2 ================================================================== BUG: KASAN: use-after-free in hdm_disconnect+0xf8/0x190 drivers/most/most_usb.c:1125 Read of size 8 at addr ffff0000d8f018b0 by task kworker/0:6/4345 CPU: 0 PID: 4345 Comm: kworker/0:6 Not tainted 6.1.110-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Workqueue: usb_hub_wq hub_event Call trace: dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x174/0x4c0 mm/kasan/report.c:395 kasan_report+0xd4/0x130 mm/kasan/report.c:495 __asan_report_load8_noabort+0x2c/0x38 mm/kasan/report_generic.c:351 hdm_disconnect+0xf8/0x190 drivers/most/most_usb.c:1125 usb_unbind_interface+0x1a4/0x758 drivers/usb/core/driver.c:458 device_remove drivers/base/dd.c:550 [inline] __device_release_driver drivers/base/dd.c:1260 [inline] device_release_driver_internal+0x474/0x724 drivers/base/dd.c:1286 device_release_driver+0x28/0x38 drivers/base/dd.c:1309 bus_remove_device+0x298/0x38c drivers/base/bus.c:529 device_del+0x57c/0x9bc drivers/base/core.c:3880 usb_disable_device+0x354/0x760 drivers/usb/core/message.c:1414 usb_disconnect+0x290/0x7b0 drivers/usb/core/hub.c:2275 hub_port_connect drivers/usb/core/hub.c:5321 [inline] hub_port_connect_change drivers/usb/core/hub.c:5617 [inline] port_event drivers/usb/core/hub.c:5773 [inline] hub_event+0x1804/0x42e4 drivers/usb/core/hub.c:5855 process_one_work+0x7ac/0x1404 kernel/workqueue.c:2292 process_scheduled_works kernel/workqueue.c:2355 [inline] worker_thread+0xb6c/0xfec kernel/workqueue.c:2441 kthread+0x250/0x2d8 kernel/kthread.c:376 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864 Allocated by task 4345: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4c/0x80 mm/kasan/common.c:52 kasan_save_alloc_info+0x24/0x30 mm/kasan/generic.c:505 ____kasan_kmalloc mm/kasan/common.c:374 [inline] __kasan_kmalloc+0xac/0xc4 mm/kasan/common.c:383 kasan_kmalloc include/linux/kasan.h:211 [inline] kmalloc_trace+0x7c/0x94 mm/slab_common.c:1031 kmalloc include/linux/slab.h:557 [inline] kzalloc include/linux/slab.h:693 [inline] hdm_probe+0xa4/0x1044 drivers/most/most_usb.c:959 usb_probe_interface+0x500/0x984 drivers/usb/core/driver.c:396 really_probe+0x394/0xacc drivers/base/dd.c:639 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:785 driver_probe_device+0x78/0x330 drivers/base/dd.c:815 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:943 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:1015 device_initial_probe+0x24/0x34 drivers/base/dd.c:1064 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3692 usb_set_configuration+0x15c0/0x1b40 drivers/usb/core/message.c:2165 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:238 usb_probe_device+0x120/0x25c drivers/usb/core/driver.c:293 really_probe+0x394/0xacc drivers/base/dd.c:639 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:785 driver_probe_device+0x78/0x330 drivers/base/dd.c:815 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:943 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:1015 device_initial_probe+0x24/0x34 drivers/base/dd.c:1064 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3692 usb_new_device+0x908/0x1440 drivers/usb/core/hub.c:2620 hub_port_connect drivers/usb/core/hub.c:5477 [inline] hub_port_connect_change drivers/usb/core/hub.c:5617 [inline] port_event drivers/usb/core/hub.c:5773 [inline] hub_event+0x243c/0x42e4 drivers/usb/core/hub.c:5855 process_one_work+0x7ac/0x1404 kernel/workqueue.c:2292 worker_thread+0x8e4/0xfec kernel/workqueue.c:2439 kthread+0x250/0x2d8 kernel/kthread.c:376 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864 Freed by task 4345: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4c/0x80 mm/kasan/common.c:52 kasan_save_free_info+0x38/0x5c mm/kasan/generic.c:516 ____kasan_slab_free+0x144/0x1c0 mm/kasan/common.c:236 __kasan_slab_free+0x18/0x28 mm/kasan/common.c:244 kasan_slab_free include/linux/kasan.h:177 [inline] slab_free_hook mm/slub.c:1724 [inline] slab_free_freelist_hook mm/slub.c:1750 [inline] slab_free mm/slub.c:3661 [inline] __kmem_cache_free+0x2c0/0x4b4 mm/slub.c:3674 kfree+0xcc/0x1b8 mm/slab_common.c:988 release_mdev+0x20/0x30 drivers/most/most_usb.c:932 device_release+0x8c/0x1ac kobject_cleanup lib/kobject.c:681 [inline] kobject_release lib/kobject.c:712 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x2a8/0x41c lib/kobject.c:729 put_device drivers/base/core.c:3800 [inline] device_unregister+0x3c/0xcc drivers/base/core.c:3924 most_deregister_interface+0x3e0/0x42c drivers/most/core.c:1402 hdm_disconnect+0xe0/0x190 drivers/most/most_usb.c:1123 usb_unbind_interface+0x1a4/0x758 drivers/usb/core/driver.c:458 device_remove drivers/base/dd.c:550 [inline] __device_release_driver drivers/base/dd.c:1260 [inline] device_release_driver_internal+0x474/0x724 drivers/base/dd.c:1286 device_release_driver+0x28/0x38 drivers/base/dd.c:1309 bus_remove_device+0x298/0x38c drivers/base/bus.c:529 device_del+0x57c/0x9bc drivers/base/core.c:3880 usb_disable_device+0x354/0x760 drivers/usb/core/message.c:1414 usb_disconnect+0x290/0x7b0 drivers/usb/core/hub.c:2275 hub_port_connect drivers/usb/core/hub.c:5321 [inline] hub_port_connect_change drivers/usb/core/hub.c:5617 [inline] port_event drivers/usb/core/hub.c:5773 [inline] hub_event+0x1804/0x42e4 drivers/usb/core/hub.c:5855 process_one_work+0x7ac/0x1404 kernel/workqueue.c:2292 process_scheduled_works kernel/workqueue.c:2355 [inline] worker_thread+0xb6c/0xfec kernel/workqueue.c:2441 kthread+0x250/0x2d8 kernel/kthread.c:376 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864 The buggy address belongs to the object at ffff0000d8f00000 which belongs to the cache kmalloc-8k of size 8192 The buggy address is located 6320 bytes inside of 8192-byte region [ffff0000d8f00000, ffff0000d8f02000) The buggy address belongs to the physical page: page:00000000e5b92994 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118f00 head:00000000e5b92994 order:3 compound_mapcount:0 compound_pincount:0 flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000010200 0000000000000000 dead000000000001 ffff0000c0002c00 raw: 0000000000000000 0000000080020002 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000d8f01780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff0000d8f01800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff0000d8f01880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff0000d8f01900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff0000d8f01980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 0 PID: 4345 at lib/refcount.c:28 refcount_warn_saturate+0x1c8/0x20c lib/refcount.c:28 Modules linked in: CPU: 0 PID: 4345 Comm: kworker/0:6 Tainted: G B 6.1.110-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Workqueue: usb_hub_wq hub_event pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : refcount_warn_saturate+0x1c8/0x20c lib/refcount.c:28 lr : refcount_warn_saturate+0x1c8/0x20c lib/refcount.c:28 sp : ffff8000218d72f0 x29: ffff8000218d72f0 x28: ffff800017d33480 x27: ffff0000ed961000 x26: 1fffe0001b1e0007 x25: dfff800000000000 x24: ffff0000d9edd030 x23: 1fffe0001b1e00a2 x22: ffff0000d8f0003c x21: 0000000000000003 x20: ffff0000d8f00038 x19: ffff80001833b000 x18: 1fffe0003679f176 x17: ffff8000159cd000 x16: ffff8000122937dc x15: ffff0001b3cf8bbc x14: ffff0001b3cf8bb8 x13: 1fffe0003679f176 x12: 0000000000000001 x11: 0000000000ff0100 x10: 0000000040000002 x9 : 8c79fba52670b000 x8 : 8c79fba52670b000 x7 : 1fffe0003679f177 x6 : ffff80000827d484 x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000 x2 : ffff8000218d6e40 x1 : 0000000000000000 x0 : ffff80000827d524 Call trace: refcount_warn_saturate+0x1c8/0x20c lib/refcount.c:28 __refcount_sub_and_test include/linux/refcount.h:283 [inline] __refcount_dec_and_test include/linux/refcount.h:315 [inline] refcount_dec_and_test include/linux/refcount.h:333 [inline] kref_put include/linux/kref.h:64 [inline] kobject_put+0x1a0/0x41c lib/kobject.c:729 put_device+0x28/0x40 drivers/base/core.c:3800 hdm_disconnect+0x178/0x190 drivers/most/most_usb.c:1130 usb_unbind_interface+0x1a4/0x758 drivers/usb/core/driver.c:458 device_remove drivers/base/dd.c:550 [inline] __device_release_driver drivers/base/dd.c:1260 [inline] device_release_driver_internal+0x474/0x724 drivers/base/dd.c:1286 device_release_driver+0x28/0x38 drivers/base/dd.c:1309 bus_remove_device+0x298/0x38c drivers/base/bus.c:529 device_del+0x57c/0x9bc drivers/base/core.c:3880 usb_disable_device+0x354/0x760 drivers/usb/core/message.c:1414 usb_disconnect+0x290/0x7b0 drivers/usb/core/hub.c:2275 hub_port_connect drivers/usb/core/hub.c:5321 [inline] hub_port_connect_change drivers/usb/core/hub.c:5617 [inline] port_event drivers/usb/core/hub.c:5773 [inline] hub_event+0x1804/0x42e4 drivers/usb/core/hub.c:5855 process_one_work+0x7ac/0x1404 kernel/workqueue.c:2292 process_scheduled_works kernel/workqueue.c:2355 [inline] worker_thread+0xb6c/0xfec kernel/workqueue.c:2441 kthread+0x250/0x2d8 kernel/kthread.c:376 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864 irq event stamp: 117345 hardirqs last enabled at (117345): [] raw_spin_rq_unlock_irq kernel/sched/sched.h:1367 [inline] hardirqs last enabled at (117345): [] finish_lock_switch+0xbc/0x1e8 kernel/sched/core.c:5000 hardirqs last disabled at (117344): [] __schedule+0x2a4/0x1d44 kernel/sched/core.c:6456 softirqs last enabled at (116680): [] softirq_handle_end kernel/softirq.c:414 [inline] softirqs last enabled at (116680): [] handle_softirqs+0xb84/0xd58 kernel/softirq.c:599 softirqs last disabled at (116657): [] __do_softirq+0x14/0x20 kernel/softirq.c:605 ---[ end trace 0000000000000000 ]---