usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 usb 2-1: config 0 descriptor?? usb 2-1: string descriptor 0 read error: -71 usb 2-1: USB disconnect, device number 2 ------------[ cut here ]------------ WARNING: CPU: 1 PID: 44 at lib/refcount.c:28 refcount_warn_saturate+0x13c/0x174 lib/refcount.c:28 refcount_t: underflow; use-after-free. Modules linked in: Kernel panic - not syncing: kernel: panic_on_warn set ... CPU: 1 UID: 0 PID: 44 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT Hardware name: ARM-Versatile Express Workqueue: usb_hub_wq hub_event Call trace: [<80201a24>] (dump_backtrace) from [<80201b20>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257) r7:00000000 r6:8281f77c r5:00000000 r4:82260500 [<80201b08>] (show_stack) from [<8021fb74>] (__dump_stack lib/dump_stack.c:94 [inline]) [<80201b08>] (show_stack) from [<8021fb74>] (dump_stack_lvl+0x54/0x7c lib/dump_stack.c:120) [<8021fb20>] (dump_stack_lvl) from [<8021fbb4>] (dump_stack+0x18/0x1c lib/dump_stack.c:129) r5:00000000 r4:82a77d18 [<8021fb9c>] (dump_stack) from [<80202624>] (vpanic+0x10c/0x30c kernel/panic.c:430) [<80202518>] (vpanic) from [<80202858>] (trace_suspend_resume+0x0/0xd8 kernel/panic.c:566) r7:808bb7a4 [<80202824>] (panic) from [<80254960>] (check_panic_on_warn kernel/panic.c:323 [inline]) [<80202824>] (panic) from [<80254960>] (get_taint+0x0/0x1c kernel/panic.c:318) r3:8280c684 r2:00000001 r1:82246f1c r0:8224e998 [<802548e8>] (check_panic_on_warn) from [<80254ac4>] (__warn+0x80/0x188 kernel/panic.c:837) [<80254a44>] (__warn) from [<80254db4>] (warn_slowpath_fmt+0x1e8/0x1f4 kernel/panic.c:872) r8:00000009 r7:822b900c r6:df915bfc r5:83306000 r4:00000000 [<80254bd0>] (warn_slowpath_fmt) from [<808bb7a4>] (refcount_warn_saturate+0x13c/0x174 lib/refcount.c:28) r10:00000100 r9:829d567c r8:84b8b488 r7:84b8b874 r6:85414fb4 r5:84b8b800 r4:8547b600 [<808bb668>] (refcount_warn_saturate) from [<81a13168>] (__refcount_sub_and_test include/linux/refcount.h:400 [inline]) [<808bb668>] (refcount_warn_saturate) from [<81a13168>] (__refcount_dec_and_test include/linux/refcount.h:432 [inline]) [<808bb668>] (refcount_warn_saturate) from [<81a13168>] (refcount_dec_and_test include/linux/refcount.h:450 [inline]) [<808bb668>] (refcount_warn_saturate) from [<81a13168>] (kref_put include/linux/kref.h:64 [inline]) [<808bb668>] (refcount_warn_saturate) from [<81a13168>] (kobject_put+0x158/0x1f4 lib/kobject.c:737) [<81a13010>] (kobject_put) from [<80b3d2ec>] (put_device+0x18/0x1c drivers/base/core.c:3797) r7:84b8b874 r6:85414fb4 r5:84b8b800 r4:85414800 [<80b3d2d4>] (put_device) from [<81436338>] (hdm_disconnect+0x90/0x9c drivers/most/most_usb.c:1129) [<814362a8>] (hdm_disconnect) from [<80e9c7c4>] (usb_unbind_interface+0x84/0x2bc drivers/usb/core/driver.c:458) r7:84b8b874 r6:84b8b830 r5:00000000 r4:84b8b400 [<80e9c740>] (usb_unbind_interface) from [<80b45468>] (device_remove drivers/base/dd.c:571 [inline]) [<80e9c740>] (usb_unbind_interface) from [<80b45468>] (device_remove+0x64/0x6c drivers/base/dd.c:563) r10:00000100 r9:84b8b488 r8:00000044 r7:84b8b874 r6:829d567c r5:00000000 r4:84b8b830 [<80b45404>] (device_remove) from [<80b46958>] (__device_release_driver drivers/base/dd.c:1274 [inline]) [<80b45404>] (device_remove) from [<80b46958>] (device_release_driver_internal+0x18c/0x200 drivers/base/dd.c:1297) r5:00000000 r4:84b8b830 [<80b467cc>] (device_release_driver_internal) from [<80b469e4>] (device_release_driver+0x18/0x1c drivers/base/dd.c:1320) r9:84b8b488 r8:833ba240 r7:833ba238 r6:833ba20c r5:84b8b830 r4:833ba230 [<80b469cc>] (device_release_driver) from [<80b44aa8>] (bus_remove_device+0xcc/0x120 drivers/base/bus.c:579) [<80b449dc>] (bus_remove_device) from [<80b3ed40>] (device_del+0x148/0x38c drivers/base/core.c:3878) r9:84b8b488 r8:83306000 r7:04208060 r6:00000000 r5:84b8b830 r4:84b8b874 [<80b3ebf8>] (device_del) from [<80e9a200>] (usb_disable_device+0xd4/0x1e8 drivers/usb/core/message.c:1418) r10:00000100 r9:00000000 r8:00000000 r7:84b8b800 r6:84b8b400 r5:849b4908 r4:60000013 [<80e9a12c>] (usb_disable_device) from [<80e8efc8>] (usb_disconnect+0xec/0x2ac drivers/usb/core/hub.c:2344) r9:8547b200 r8:84b8b4cc r7:83c8dc00 r6:84b8b488 r5:84b8b400 r4:60000013 [<80e8eedc>] (usb_disconnect) from [<80e91fc4>] (hub_port_connect drivers/usb/core/hub.c:5406 [inline]) [<80e8eedc>] (usb_disconnect) from [<80e91fc4>] (hub_port_connect_change drivers/usb/core/hub.c:5706 [inline]) [<80e8eedc>] (usb_disconnect) from [<80e91fc4>] (port_event drivers/usb/core/hub.c:5870 [inline]) [<80e8eedc>] (usb_disconnect) from [<80e91fc4>] (hub_event+0x1194/0x1950 drivers/usb/core/hub.c:5952) r10:00000100 r9:83d0dd2c r8:83c8d400 r7:84b8b400 r6:83d0d600 r5:00000001 r4:00000001 [<80e90e30>] (hub_event) from [<8027a398>] (process_one_work+0x1b4/0x4f4 kernel/workqueue.c:3236) r10:833ba470 r9:8335d805 r8:83306000 r7:ddde2d40 r6:8335d800 r5:83d0dd2c r4:833be500 [<8027a1e4>] (process_one_work) from [<8027afe0>] (process_scheduled_works kernel/workqueue.c:3319 [inline]) [<8027a1e4>] (process_one_work) from [<8027afe0>] (worker_thread+0x1fc/0x3d8 kernel/workqueue.c:3400) r10:61c88647 r9:83306000 r8:833be52c r7:82804d40 r6:ddde2d40 r5:ddde2d60 r4:833be500 [<8027ade4>] (worker_thread) from [<80281fc8>] (kthread+0x12c/0x280 kernel/kthread.c:463) r10:00000000 r9:833be500 r8:8027ade4 r7:df911e60 r6:833be580 r5:83306000 r4:00000001 [<80281e9c>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:137) Exception stack(0xdf915fb0 to 0xdf915ff8) 5fa0: 00000000 00000000 00000000 00000000 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000 r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:80281e9c r4:833bc900 Rebooting in 86400 seconds..