================================================================== BUG: KASAN: slab-use-after-free in vhci_send_cmd_submit drivers/usb/usbip/vhci_tx.c:69 [inline] BUG: KASAN: slab-use-after-free in vhci_tx_loop+0x3e9/0x1c50 drivers/usb/usbip/vhci_tx.c:241 Read of size 8 at addr ffff88802e4982a0 by task vhci_tx/13780 CPU: 0 UID: 0 PID: 13780 Comm: vhci_tx Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description+0x55/0x1e0 mm/kasan/report.c:378 print_report+0x58/0x70 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 vhci_send_cmd_submit drivers/usb/usbip/vhci_tx.c:69 [inline] vhci_tx_loop+0x3e9/0x1c50 drivers/usb/usbip/vhci_tx.c:241 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 5633: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x3a6/0x690 mm/slub.c:5432 kmalloc_noprof include/linux/slab.h:950 [inline] kzalloc_noprof include/linux/slab.h:1188 [inline] vhci_tx_urb drivers/usb/usbip/vhci_hcd.c:674 [inline] vhci_urb_enqueue+0x5c9/0xe10 drivers/usb/usbip/vhci_hcd.c:829 usb_hcd_submit_urb+0x323/0x1b50 drivers/usb/core/hcd.c:1542 usb_start_wait_urb+0x13f/0x5b0 drivers/usb/core/message.c:62 usb_internal_control_msg drivers/usb/core/message.c:117 [inline] usb_control_msg+0x234/0x3e0 drivers/usb/core/message.c:167 get_bMaxPacketSize0 drivers/usb/core/hub.c:4851 [inline] hub_port_init+0xb1e/0x28c0 drivers/usb/core/hub.c:5047 hub_port_connect drivers/usb/core/hub.c:5496 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x25d3/0x4f60 drivers/usb/core/hub.c:5953 process_one_work+0x98b/0x1630 kernel/workqueue.c:3306 process_scheduled_works kernel/workqueue.c:3389 [inline] worker_thread+0xb49/0x1140 kernel/workqueue.c:3470 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 13779: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2700 [inline] slab_free mm/slub.c:6291 [inline] kfree+0x1c5/0x6c0 mm/slub.c:6606 pickup_urb_and_free_priv+0x225/0x3f0 drivers/usb/usbip/vhci_rx.c:46 vhci_recv_ret_submit drivers/usb/usbip/vhci_rx.c:65 [inline] vhci_rx_pdu drivers/usb/usbip/vhci_rx.c:242 [inline] vhci_rx_loop+0x3c5/0xa00 drivers/usb/usbip/vhci_rx.c:265 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the object at ffff88802e498280 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 32 bytes inside of freed 64-byte region [ffff88802e498280, ffff88802e4982c0) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802e498500 pfn:0x2e498 flags: 0x80000000000200(workingset|node=0|zone=1) page_type: f5(slab) raw: 0080000000000200 ffff88813fe168c0 ffffea0000d2cbd0 ffffea0001358810 raw: ffff88802e498500 000000080020001e 00000000f5000000 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 22692419449, free_ts 0 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1861 prep_new_page mm/page_alloc.c:1869 [inline] get_page_from_freelist+0x27d6/0x2850 mm/page_alloc.c:3949 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5292 alloc_slab_page mm/slub.c:3289 [inline] allocate_slab+0x74/0x5e0 mm/slub.c:3404 new_slab mm/slub.c:3447 [inline] refill_objects+0x33c/0x3d0 mm/slub.c:7319 refill_sheaf mm/slub.c:2827 [inline] __pcs_replace_empty_main+0x373/0x720 mm/slub.c:4664 alloc_from_pcs mm/slub.c:4762 [inline] slab_alloc_node mm/slub.c:4896 [inline] __do_kmalloc_node mm/slub.c:5307 [inline] __kmalloc_noprof+0x530/0x7b0 mm/slub.c:5320 kmalloc_noprof include/linux/slab.h:954 [inline] kzalloc_noprof include/linux/slab.h:1188 [inline] handler_new_ref+0x261/0x9c0 drivers/media/v4l2-core/v4l2-ctrls-core.c:1895 v4l2_ctrl_add_handler+0x19f/0x290 drivers/media/v4l2-core/v4l2-ctrls-core.c:2456 vivid_create_controls+0x3403/0x3bd0 drivers/media/test-drivers/vivid/vivid-ctrls.c:2079 vivid_create_instance drivers/media/test-drivers/vivid/vivid-core.c:1933 [inline] vivid_probe+0x425f/0x72c0 drivers/media/test-drivers/vivid/vivid-core.c:2095 platform_probe+0xf9/0x190 drivers/base/platform.c:1418 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x267/0xaf0 drivers/base/dd.c:707 __driver_probe_device+0x1e2/0x350 drivers/base/dd.c:869 driver_probe_device+0x4f/0x240 drivers/base/dd.c:899 __driver_attach+0x33c/0x600 drivers/base/dd.c:1293 page_owner free stack trace missing Memory state around the buggy address: ffff88802e498180: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc ffff88802e498200: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc >ffff88802e498280: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ffff88802e498300: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc ffff88802e498380: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc ==================================================================