==================================================================
BUG: KASAN: slab-out-of-bounds in vhci_hub_control+0x1b6d/0x1be0 drivers/usb/usbip/vhci_hcd.c:441
Read of size 4 at addr ffff8801ce356a7c by task syz-executor3/24965

CPU: 1 PID: 24965 Comm: syz-executor3 Not tainted 4.19.0-rc7+ #186
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113
 print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:432
 vhci_hub_control+0x1b6d/0x1be0 drivers/usb/usbip/vhci_hcd.c:441
 rh_call_control drivers/usb/core/hcd.c:679 [inline]
 rh_urb_enqueue drivers/usb/core/hcd.c:838 [inline]
 usb_hcd_submit_urb+0x17bb/0x20a0 drivers/usb/core/hcd.c:1651
sg_write: data in/out 393180/74 bytes for SCSI command 0xff-- guessing data in;
   program syz-executor5 not setting count and/or reply_len properly
 usb_submit_urb+0x893/0x14e0 drivers/usb/core/urb.c:570
 usb_start_wait_urb+0x13d/0x370 drivers/usb/core/message.c:57
 usb_internal_control_msg drivers/usb/core/message.c:101 [inline]
 usb_control_msg+0x332/0x4e0 drivers/usb/core/message.c:152
 proc_control+0x99b/0xef0 drivers/usb/core/devio.c:1106
 usbdev_do_ioctl+0x1eb8/0x3b50 drivers/usb/core/devio.c:2412
sg_write: data in/out 393180/74 bytes for SCSI command 0xff-- guessing data in;
   program syz-executor5 not setting count and/or reply_len properly
 usbdev_compat_ioctl+0x24/0x30 drivers/usb/core/devio.c:2580
 __do_compat_sys_ioctl fs/compat_ioctl.c:1419 [inline]
 __se_compat_sys_ioctl fs/compat_ioctl.c:1365 [inline]
 __ia32_compat_sys_ioctl+0x20e/0x630 fs/compat_ioctl.c:1365
 do_syscall_32_irqs_on arch/x86/entry/common.c:326 [inline]
 do_fast_syscall_32+0x34d/0xfb2 arch/x86/entry/common.c:397
 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139
RIP: 0023:0xf7f3bca9
Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 0c 24 c3 8b 1c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90
sg_write: data in/out 393180/74 bytes for SCSI command 0xff-- guessing data in;
   program syz-executor5 not setting count and/or reply_len properly
RSP: 002b:00000000f5f370cc EFLAGS: 00000296 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c0185500
RDX: 0000000020000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000

Allocated by task 24188:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553
 kmem_cache_alloc_trace+0x152/0x750 mm/slab.c:3620
 kmalloc include/linux/slab.h:513 [inline]
 alloc_fdtable+0x89/0x280 fs/file.c:111
 dup_fd+0xa71/0xf50 fs/file.c:310
 copy_files kernel/fork.c:1379 [inline]
 copy_process+0x2735/0x8780 kernel/fork.c:1857
 _do_fork+0x1cb/0x11d0 kernel/fork.c:2166
 __do_compat_sys_x86_clone arch/x86/ia32/sys_ia32.c:240 [inline]
 __se_compat_sys_x86_clone arch/x86/ia32/sys_ia32.c:236 [inline]
 __ia32_compat_sys_x86_clone+0xbc/0x140 arch/x86/ia32/sys_ia32.c:236
 do_syscall_32_irqs_on arch/x86/entry/common.c:326 [inline]
 do_fast_syscall_32+0x34d/0xfb2 arch/x86/entry/common.c:397
 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139

Freed by task 24581:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
 __cache_free mm/slab.c:3498 [inline]
 kfree+0xcf/0x230 mm/slab.c:3813
 __free_fdtable+0x5d/0x70 fs/file.c:33
 put_files_struct+0x31d/0x3c0 fs/file.c:420
 exit_files+0x83/0xb0 fs/file.c:445
 do_exit+0xf45/0x2610 kernel/exit.c:862
 do_group_exit+0x177/0x440 kernel/exit.c:970
 get_signal+0x8b0/0x1980 kernel/signal.c:2513
 do_signal+0x9c/0x21e0 arch/x86/kernel/signal.c:816
 exit_to_usermode_loop+0x2e5/0x380 arch/x86/entry/common.c:162
 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
 do_syscall_32_irqs_on arch/x86/entry/common.c:341 [inline]
 do_fast_syscall_32+0xcd5/0xfb2 arch/x86/entry/common.c:397
 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139

The buggy address belongs to the object at ffff8801ce356a00
 which belongs to the cache kmalloc-64(65:syz3) of size 64
The buggy address is located 60 bytes to the right of
 64-byte region [ffff8801ce356a00, ffff8801ce356a40)
The buggy address belongs to the page:
page:ffffea000738d580 count:1 mapcount:0 mapping:ffff8801bff0b9c0 index:0x0
flags: 0x2fffc0000000100(slab)
raw: 02fffc0000000100 ffffea0006de5708 ffff8801cce74948 ffff8801bff0b9c0
raw: 0000000000000000 ffff8801ce356000 0000000100000020 ffff8801901a8480
page dumped because: kasan: bad access detected
page->mem_cgroup:ffff8801901a8480

Memory state around the buggy address:
 ffff8801ce356900: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff8801ce356980: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
>ffff8801ce356a00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
                                                                ^
 ffff8801ce356a80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff8801ce356b00: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
kobject: 'loop4' (000000006934b752): fill_kobj_path: path = '/devices/virtual/block/loop4'
==================================================================