program: socketpair(0x1, 0x1, 0x0, &(0x7f0000000100)={0x0, 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, &(0x7f0000000180)) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/usb/drivers/usbip-host/match_busid\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='add 1-1\x00', 0x8) write(r1, &(0x7f0000000240)='add 2-1\x00', 0x8) close(r1) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/usb/drivers/usb/unbind\x00', 0x1, 0x0) write(r2, &(0x7f00000002c0)='1-1\x00', 0x4) write(r2, &(0x7f0000000340)='2-1\x00', 0x4) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/bus/usb/drivers/usbip-host/bind\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='1-1\x00', 0x4) write(r3, &(0x7f0000000400)='2-1\x00', 0x4) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/bus/usb/devices/1-1/usbip_sockfd\x00', 0x1, 0x0) write(r4, &(0x7f0000000480)='3\x00', 0x2) openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/bus/usb/devices/2-1/usbip_sockfd\x00', 0x1, 0x0) write(r0, &(0x7f0000000540)="00000001000000010001000200"/48, 0x30) [ 93.434860][ T44] Bluetooth: hci0: command tx timeout [ 93.751605][ T5316] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 93.900729][ T5316] usb 5-1: Using ep0 maxpacket: 8 [ 93.907474][ T5316] usb 5-1: config 0 has an invalid interface number: 143 but max is 0 [ 93.911082][ T5316] usb 5-1: config 0 has no interface number 0 [ 93.913726][ T5316] usb 5-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 93.917320][ T5316] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 93.931633][ T5316] usb 5-1: config 0 descriptor?? [ 94.072567][ T5316] viperboard 5-1:0.143: version 0.00 found at bus 005 address 002 [ 94.113390][ T5316] viperboard-i2c viperboard-i2c.3.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 94.122750][ T5316] viperboard-i2c viperboard-i2c.3.auto: probe with driver viperboard-i2c failed with error -5 [ 94.327223][ T5323] usbip-host 1-1: usbip-host: register new device (bus 1 dev 2) [ 94.347163][ T5318] usbip-host 1-1: stub up [ 94.363422][ C0] usbip-host 1-1: endpoint 0 is stalled [ 94.373601][ T5316] usb 5-1: USB disconnect, device number 2 [ 94.385185][ T5324] ================================================================== [ 94.388686][ T5324] BUG: KASAN: slab-use-after-free in stub_rx_loop+0x2965/0x2ee0 [ 94.392012][ T5324] Read of size 4 at addr ffff888012cacdb0 by task stub_rx/5324 [ 94.395231][ T5324] [ 94.396294][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: stub_rx Not tainted syzkaller #0 PREEMPT(full) [ 94.396309][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.396316][ T5324] Call Trace: [ 94.396323][ T5324] [ 94.396328][ T5324] dump_stack_lvl+0xe8/0x150 [ 94.396349][ T5324] print_address_description+0x55/0x1e0 [ 94.396366][ T5324] ? stub_rx_loop+0x2965/0x2ee0 [ 94.396380][ T5324] print_report+0x58/0x70 [ 94.396394][ T5324] kasan_report+0x117/0x150 [ 94.396409][ T5324] ? stub_rx_loop+0x2965/0x2ee0 [ 94.396424][ T5324] stub_rx_loop+0x2965/0x2ee0 [ 94.396443][ T5324] ? __pfx_stub_rx_loop+0x10/0x10 [ 94.396457][ T5324] ? __kthread_parkme+0x196/0x1f0 [ 94.396473][ T5324] kthread+0x388/0x470 [ 94.396487][ T5324] ? __pfx_stub_rx_loop+0x10/0x10 [ 94.396498][ T5324] ? __pfx_kthread+0x10/0x10 [ 94.396512][ T5324] ret_from_fork+0x514/0xb70 [ 94.396528][ T5324] ? __pfx_ret_from_fork+0x10/0x10 [ 94.396540][ T5324] ? __switch_to+0xc89/0x1420 [ 94.396553][ T5324] ? __pfx_kthread+0x10/0x10 [ 94.396567][ T5324] ret_from_fork_asm+0x1a/0x30 [ 94.396581][ T5324] [ 94.396585][ T5324] [ 94.445044][ T5324] Allocated by task 5324: [ 94.446991][ T5324] kasan_save_track+0x3e/0x80 [ 94.449082][ T5324] __kasan_slab_alloc+0x6c/0x80 [ 94.451279][ T5324] kmem_cache_alloc_noprof+0x2a0/0x5f0 [ 94.453559][ T5324] stub_rx_loop+0xad9/0x2ee0 [ 94.455586][ T5324] kthread+0x388/0x470 [ 94.457350][ T5324] ret_from_fork+0x514/0xb70 [ 94.459314][ T5324] ret_from_fork_asm+0x1a/0x30 [ 94.461281][ T5324] [ 94.462277][ T5324] Freed by task 5325: [ 94.463892][ T5324] kasan_save_track+0x3e/0x80 [ 94.465799][ T5324] kasan_save_free_info+0x40/0x50 [ 94.467972][ T5324] __kasan_slab_free+0x5c/0x80 [ 94.469949][ T5324] kmem_cache_free+0x182/0x650 [ 94.472051][ T5324] stub_tx_loop+0x1b16/0x2800 [ 94.474068][ T5324] kthread+0x388/0x470 [ 94.475845][ T5324] ret_from_fork+0x514/0xb70 [ 94.477766][ T5324] ret_from_fork_asm+0x1a/0x30 [ 94.479658][ T5324] [ 94.480654][ T5324] The buggy address belongs to the object at ffff888012cacd80 [ 94.480654][ T5324] which belongs to the cache stub_priv of size 64 [ 94.486318][ T5324] The buggy address is located 48 bytes inside of [ 94.486318][ T5324] freed 64-byte region [ffff888012cacd80, ffff888012cacdc0) [ 94.492059][ T5324] [ 94.493132][ T5324] The buggy address belongs to the physical page: [ 94.495828][ T5324] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888012cace00 pfn:0x12cac [ 94.500132][ T5324] flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff) [ 94.503205][ T5324] page_type: f5(slab) [ 94.504778][ T5324] raw: 00fff00000000200 ffff888033fd4280 ffff8880340e27c8 ffff8880340e27c8 [ 94.508049][ T5324] raw: ffff888012cace00 000000080020001c 00000000f5000000 0000000000000000 [ 94.511406][ T5324] page dumped because: kasan: bad access detected [ 94.514050][ T5324] page_owner tracks the page as allocated [ 94.516418][ T5324] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5324, tgid 5324 (stub_rx), ts 94362120884, free_ts 93984048542 [ 94.524663][ T5324] post_alloc_hook+0x1f9/0x250 [ 94.526602][ T5324] get_page_from_freelist+0x21fa/0x2270 [ 94.528827][ T5324] __alloc_frozen_pages_noprof+0x18d/0x380 [ 94.531300][ T5324] allocate_slab+0x79/0x5e0 [ 94.533220][ T5324] refill_objects+0x2d5/0x350 [ 94.535183][ T5324] __pcs_replace_empty_main+0x2bf/0x6b0 [ 94.538106][ T5324] kmem_cache_alloc_noprof+0x382/0x5f0 [ 94.540484][ T5324] stub_rx_loop+0xad9/0x2ee0 [ 94.542084][ T5324] kthread+0x388/0x470 [ 94.543572][ T5324] ret_from_fork+0x514/0xb70 [ 94.545334][ T5324] ret_from_fork_asm+0x1a/0x30 [ 94.547135][ T5324] page last free pid 4993 tgid 4993 stack trace: [ 94.549623][ T5324] __free_frozen_pages+0xc1e/0xd10 [ 94.551772][ T5324] __slab_free+0x274/0x2c0 [ 94.553694][ T5324] qlist_free_all+0x99/0x100 [ 94.555652][ T5324] kasan_quarantine_reduce+0x148/0x160 [ 94.557930][ T5324] __kasan_slab_alloc+0x22/0x80 [ 94.559905][ T5324] kmem_cache_alloc_node_noprof+0x355/0x610 [ 94.562353][ T5324] __alloc_skb+0x1d7/0x7a0 [ 94.564237][ T5324] alloc_skb_with_frags+0xc6/0x760 [ 94.566217][ T5324] sock_alloc_send_pskb+0x878/0x990 [ 94.568457][ T5324] unix_dgram_sendmsg+0x4fe/0x1870 [ 94.570640][ T5324] sock_sendmsg_nosec+0x13a/0x180 [ 94.572668][ T5324] sock_write_iter+0x2de/0x3e0 [ 94.574728][ T5324] do_iter_readv_writev+0x612/0x8c0 [ 94.576978][ T5324] vfs_writev+0x343/0x990 [ 94.578765][ T5324] do_writev+0x154/0x2e0 [ 94.580551][ T5324] do_syscall_64+0x174/0x580 [ 94.582358][ T5324] [ 94.583402][ T5324] Memory state around the buggy address: [ 94.585757][ T5324] ffff888012cacc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 94.589057][ T5324] ffff888012cacd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 94.592311][ T5324] >ffff888012cacd80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 94.595449][ T5324] ^ [ 94.597600][ T5324] ffff888012cace00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 94.600850][ T5324] ffff888012cace80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 94.604139][ T5324] ================================================================== [ 94.815565][ T5324] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 94.818757][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: stub_rx Not tainted syzkaller #0 PREEMPT(full) [ 94.822482][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.826290][ T5324] Call Trace: [ 94.827640][ T5324] [ 94.828825][ T5324] vpanic+0x56c/0xa60 [ 94.830500][ T5324] ? __pfx_vpanic+0x10/0x10 [ 94.832454][ T5324] panic+0xc5/0xd0 [ 94.833991][ T5324] ? __pfx_panic+0x10/0x10 [ 94.835829][ T5324] ? preempt_schedule_thunk+0x16/0x40 [ 94.838085][ T5324] ? stub_rx_loop+0x2965/0x2ee0 [ 94.840307][ T5324] ? preempt_schedule_thunk+0x16/0x40 [ 94.842542][ T5324] ? stub_rx_loop+0x2965/0x2ee0 [ 94.844570][ T5324] check_panic_on_warn+0x89/0xb0 [ 94.846604][ T5324] ? stub_rx_loop+0x2965/0x2ee0 [ 94.848584][ T5324] end_report+0x73/0x170 [ 94.850530][ T5324] ? stub_rx_loop+0x2965/0x2ee0 [ 94.852592][ T5324] kasan_report+0x128/0x150 [ 94.854509][ T5324] ? stub_rx_loop+0x2965/0x2ee0 [ 94.856528][ T5324] stub_rx_loop+0x2965/0x2ee0 [ 94.858570][ T5324] ? __pfx_stub_rx_loop+0x10/0x10 [ 94.860708][ T5324] ? __kthread_parkme+0x196/0x1f0 [ 94.862848][ T5324] kthread+0x388/0x470 [ 94.864675][ T5324] ? __pfx_stub_rx_loop+0x10/0x10 [ 94.866885][ T5324] ? __pfx_kthread+0x10/0x10 [ 94.868925][ T5324] ret_from_fork+0x514/0xb70 [ 94.870964][ T5324] ? __pfx_ret_from_fork+0x10/0x10 [ 94.873130][ T5324] ? __switch_to+0xc89/0x1420 [ 94.875122][ T5324] ? __pfx_kthread+0x10/0x10 [ 94.877116][ T5324] ret_from_fork_asm+0x1a/0x30 [ 94.879209][ T5324] [ 94.880955][ T5324] Kernel Offset: disabled [ 94.882848][ T5324] Rebooting in 86400 seconds..