vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed)
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
vhci_hcd: connection closed
==================================================================
BUG: KASAN: null-ptr-deref in atomic_inc include/asm-generic/atomic-instrumented.h:109 [inline]
BUG: KASAN: null-ptr-deref in kthread_stop+0x72/0x6b0 kernel/kthread.c:558
Write of size 4 at addr 000000000000001c by task kworker/u4:6/9463

CPU: 0 PID: 9463 Comm: kworker/u4:6 Not tainted 4.19.161-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: usbip_event event_handler
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2fe lib/dump_stack.c:118
 kasan_report_error.cold+0x15b/0x1c7 mm/kasan/report.c:352
 kasan_report+0x8f/0x96 mm/kasan/report.c:412
 atomic_inc include/asm-generic/atomic-instrumented.h:109 [inline]
 kthread_stop+0x72/0x6b0 kernel/kthread.c:558
 vhci_shutdown_connection+0x14e/0x280 drivers/usb/usbip/vhci_hcd.c:1021
 event_handler+0x1f0/0x4f0 drivers/usb/usbip/usbip_event.c:78
 process_one_work+0x864/0x1570 kernel/workqueue.c:2155
 worker_thread+0x64c/0x1130 kernel/workqueue.c:2298
 kthread+0x33f/0x460 kernel/kthread.c:259
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
==================================================================
CPU: 1 PID: 17369 Comm: syz-executor.4 Not tainted 4.19.161-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2fe lib/dump_stack.c:118
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold+0xa/0x14 lib/fault-inject.c:149
 __should_failslab+0x115/0x180 mm/failslab.c:32
 should_failslab+0x5/0xf mm/slab_common.c:1588
 slab_pre_alloc_hook mm/slab.h:424 [inline]
 slab_alloc_node mm/slab.c:3304 [inline]
 kmem_cache_alloc_node_trace+0x57/0x3b0 mm/slab.c:3666
 __do_kmalloc_node mm/slab.c:3688 [inline]
 __kmalloc_node_track_caller+0x38/0x70 mm/slab.c:3703
 __kmalloc_reserve net/core/skbuff.c:137 [inline]
 pskb_expand_head+0x159/0xf20 net/core/skbuff.c:1464
 netlink_trim+0x200/0x250 net/netlink/af_netlink.c:1300
 netlink_broadcast_filtered+0x61/0xbc0 net/netlink/af_netlink.c:1497
 netlink_broadcast+0x35/0x40 net/netlink/af_netlink.c:1542
vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(4)
 rtnetlink_send+0xa4/0x100 net/core/rtnetlink.c:713
vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed)
 qdisc_notify.isra.0+0x1cb/0x320 net/sched/sch_api.c:908
 notify_and_destroy net/sched/sch_api.c:921 [inline]
 qdisc_graft+0xef3/0x1130 net/sched/sch_api.c:982
 tc_modify_qdisc+0xd3d/0x1a80 net/sched/sch_api.c:1582
vhci_hcd: connection closed