program: socketpair(0x1, 0x1, 0x0, &(0x7f0000000100)={0x0, 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, &(0x7f0000000180)) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/usb/drivers/usbip-host/match_busid\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='add 1-1\x00', 0x8) close(r1) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/usb/drivers/usb/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000280)='1-1\x00', 0x4) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/bus/usb/drivers/usbip-host/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000340)='1-1\x00', 0x4) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/bus/usb/devices/1-1/usbip_sockfd\x00', 0x1, 0x0) write(r4, &(0x7f00000003c0)='3\x00', 0x2) close(r4) nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0) write(r0, &(0x7f0000000400)="00000001000000010001000200"/48, 0x30) write(r0, &(0x7f0000000440)="00000002000000030001000200000000000000000000000100"/48, 0x30) write(r0, &(0x7f0000000480)="00000001000000050001000200"/48, 0x30) [ 93.452874][ T4648] Bluetooth: hci0: command tx timeout [ 93.928880][ T804] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 94.088152][ T804] usb 5-1: Using ep0 maxpacket: 8 [ 94.093794][ T804] usb 5-1: config 0 has an invalid interface number: 143 but max is 0 [ 94.097039][ T804] usb 5-1: config 0 has no interface number 0 [ 94.099952][ T804] usb 5-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 94.103314][ T804] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 94.112438][ T804] usb 5-1: config 0 descriptor?? [ 94.239791][ T804] viperboard 5-1:0.143: version 0.00 found at bus 005 address 002 [ 94.292779][ T804] viperboard-i2c viperboard-i2c.3.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 94.302301][ T804] viperboard-i2c viperboard-i2c.3.auto: probe with driver viperboard-i2c failed with error -5 [ 94.481458][ T5325] usbip-host 1-1: usbip-host: register new device (bus 1 dev 2) [ 94.501194][ T5324] usbip-host 1-1: stub up [ 94.575753][ T5330] ================================================================== [ 94.578926][ T5330] BUG: KASAN: slab-use-after-free in stub_rx_loop+0x87a/0x2ee0 [ 94.582045][ T5330] Read of size 4 at addr ffff88804382fdb0 by task stub_rx/5330 [ 94.585251][ T5330] [ 94.586272][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: stub_rx Not tainted syzkaller #0 PREEMPT(full) [ 94.586284][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.586290][ T5330] Call Trace: [ 94.586298][ T5330] [ 94.586304][ T5330] dump_stack_lvl+0xe8/0x150 [ 94.586322][ T5330] print_address_description+0x55/0x1e0 [ 94.586336][ T5330] ? stub_rx_loop+0x87a/0x2ee0 [ 94.586347][ T5330] print_report+0x58/0x70 [ 94.586360][ T5330] kasan_report+0x117/0x150 [ 94.586373][ T5330] ? stub_rx_loop+0x87a/0x2ee0 [ 94.586391][ T5330] stub_rx_loop+0x87a/0x2ee0 [ 94.586407][ T5330] ? __pfx_stub_rx_loop+0x10/0x10 [ 94.586419][ T5330] ? __kthread_parkme+0x196/0x1f0 [ 94.586433][ T5330] kthread+0x388/0x470 [ 94.586446][ T5330] ? __pfx_stub_rx_loop+0x10/0x10 [ 94.586456][ T5330] ? __pfx_kthread+0x10/0x10 [ 94.586469][ T5330] ret_from_fork+0x514/0xb70 [ 94.586485][ T5330] ? __pfx_ret_from_fork+0x10/0x10 [ 94.586498][ T5330] ? __switch_to+0xc89/0x1420 [ 94.586509][ T5330] ? __pfx_kthread+0x10/0x10 [ 94.586521][ T5330] ret_from_fork_asm+0x1a/0x30 [ 94.586534][ T5330] [ 94.586538][ T5330] [ 94.632978][ T5330] Allocated by task 5330: [ 94.634803][ T5330] kasan_save_track+0x3e/0x80 [ 94.636829][ T5330] __kasan_slab_alloc+0x6c/0x80 [ 94.638864][ T5330] kmem_cache_alloc_noprof+0x2a0/0x5f0 [ 94.641079][ T5330] stub_rx_loop+0xad9/0x2ee0 [ 94.642993][ T5330] kthread+0x388/0x470 [ 94.644800][ T5330] ret_from_fork+0x514/0xb70 [ 94.646746][ T5330] ret_from_fork_asm+0x1a/0x30 [ 94.648750][ T5330] [ 94.649752][ T5330] Freed by task 5330: [ 94.651368][ T5330] kasan_save_track+0x3e/0x80 [ 94.653377][ T5330] kasan_save_free_info+0x40/0x50 [ 94.655424][ T5330] __kasan_slab_free+0x5c/0x80 [ 94.657460][ T5330] kmem_cache_free+0x182/0x650 [ 94.659452][ T5330] stub_complete+0x582/0xac0 [ 94.661735][ T5330] __usb_hcd_giveback_urb+0x374/0x530 [ 94.664058][ T5330] usb_giveback_urb_bh+0x299/0x430 [ 94.666142][ T5330] process_scheduled_works+0xa8e/0x14e0 [ 94.668346][ T5330] bh_worker+0x44e/0x840 [ 94.670067][ T5330] tasklet_action+0xc/0x70 [ 94.671938][ T5330] handle_softirqs+0x225/0x840 [ 94.674157][ T5330] __irq_exit_rcu+0xca/0x220 [ 94.676292][ T5330] irq_exit_rcu+0x9/0x30 [ 94.678029][ T5330] common_interrupt+0xbb/0xe0 [ 94.679955][ T5330] asm_common_interrupt+0x26/0x40 [ 94.681998][ T5330] [ 94.683007][ T5330] The buggy address belongs to the object at ffff88804382fd80 [ 94.683007][ T5330] which belongs to the cache stub_priv of size 64 [ 94.688455][ T5330] The buggy address is located 48 bytes inside of [ 94.688455][ T5330] freed 64-byte region [ffff88804382fd80, ffff88804382fdc0) [ 94.693865][ T5330] [ 94.694871][ T5330] The buggy address belongs to the physical page: [ 94.697513][ T5330] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88804382fe00 pfn:0x4382f [ 94.701402][ T5330] flags: 0x4fff00000000200(workingset|node=1|zone=1|lastcpupid=0x7ff) [ 94.704673][ T5330] page_type: f5(slab) [ 94.706269][ T5330] raw: 04fff00000000200 ffff888033e3c140 ffff888037678108 ffff888037678108 [ 94.709784][ T5330] raw: ffff88804382fe00 000000080020001c 00000000f5000000 0000000000000000 [ 94.713395][ T5330] page dumped because: kasan: bad access detected [ 94.716082][ T5330] page_owner tracks the page as allocated [ 94.718372][ T5330] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5330, tgid 5330 (stub_rx), ts 94565385812, free_ts 94498440907 [ 94.726965][ T5330] post_alloc_hook+0x1f9/0x250 [ 94.729013][ T5330] get_page_from_freelist+0x21fa/0x2270 [ 94.731428][ T5330] __alloc_frozen_pages_noprof+0x18d/0x380 [ 94.733865][ T5330] allocate_slab+0x79/0x5e0 [ 94.735761][ T5330] refill_objects+0x2d5/0x350 [ 94.737770][ T5330] __pcs_replace_empty_main+0x2bf/0x6b0 [ 94.740077][ T5330] kmem_cache_alloc_noprof+0x382/0x5f0 [ 94.742338][ T5330] stub_rx_loop+0xad9/0x2ee0 [ 94.744338][ T5330] kthread+0x388/0x470 [ 94.746037][ T5330] ret_from_fork+0x514/0xb70 [ 94.748002][ T5330] ret_from_fork_asm+0x1a/0x30 [ 94.750006][ T5330] page last free pid 5278 tgid 5278 stack trace: [ 94.752614][ T5330] __free_frozen_pages+0xc1e/0xd10 [ 94.754737][ T5330] __slab_free+0x274/0x2c0 [ 94.756728][ T5330] qlist_free_all+0x99/0x100 [ 94.758601][ T5330] kasan_quarantine_reduce+0x148/0x160 [ 94.760861][ T5330] __kasan_slab_alloc+0x22/0x80 [ 94.762900][ T5330] __kmalloc_noprof+0x311/0x720 [ 94.764940][ T5330] tomoyo_realpath_from_path+0xef/0x640 [ 94.767222][ T5330] tomoyo_path_perm+0x283/0x560 [ 94.769270][ T5330] security_inode_getattr+0x12b/0x310 [ 94.771520][ T5330] __x64_sys_newfstat+0x133/0x270 [ 94.773747][ T5330] do_syscall_64+0x174/0x580 [ 94.775670][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.778114][ T5330] [ 94.779090][ T5330] Memory state around the buggy address: [ 94.781381][ T5330] ffff88804382fc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 94.784652][ T5330] ffff88804382fd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 94.787795][ T5330] >ffff88804382fd80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 94.790980][ T5330] ^ [ 94.793210][ T5330] ffff88804382fe00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 94.796295][ T5330] ffff88804382fe80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 94.799506][ T5330] ================================================================== [ 94.815874][ T5320] usb 5-1: USB disconnect, device number 2 [ 94.903043][ T5330] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 94.905940][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: stub_rx Not tainted syzkaller #0 PREEMPT(full) [ 94.909331][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.913539][ T5330] Call Trace: [ 94.915007][ T5330] [ 94.916285][ T5330] vpanic+0x56c/0xa60 [ 94.918029][ T5330] ? __pfx_vpanic+0x10/0x10 [ 94.920025][ T5330] panic+0xc5/0xd0 [ 94.921642][ T5330] ? __pfx_panic+0x10/0x10 [ 94.923576][ T5330] ? preempt_schedule_thunk+0x16/0x40 [ 94.925831][ T5330] ? stub_rx_loop+0x87a/0x2ee0 [ 94.927875][ T5330] ? preempt_schedule_thunk+0x16/0x40 [ 94.930163][ T5330] ? stub_rx_loop+0x87a/0x2ee0 [ 94.932127][ T5330] check_panic_on_warn+0x89/0xb0 [ 94.934171][ T5330] ? stub_rx_loop+0x87a/0x2ee0 [ 94.936227][ T5330] end_report+0x73/0x170 [ 94.937948][ T5330] ? stub_rx_loop+0x87a/0x2ee0 [ 94.939992][ T5330] kasan_report+0x128/0x150 [ 94.941952][ T5330] ? stub_rx_loop+0x87a/0x2ee0 [ 94.943992][ T5330] stub_rx_loop+0x87a/0x2ee0 [ 94.945885][ T5330] ? __pfx_stub_rx_loop+0x10/0x10 [ 94.948067][ T5330] ? __kthread_parkme+0x196/0x1f0 [ 94.950226][ T5330] kthread+0x388/0x470 [ 94.952012][ T5330] ? __pfx_stub_rx_loop+0x10/0x10 [ 94.954238][ T5330] ? __pfx_kthread+0x10/0x10 [ 94.956336][ T5330] ret_from_fork+0x514/0xb70 [ 94.958338][ T5330] ? __pfx_ret_from_fork+0x10/0x10 [ 94.960563][ T5330] ? __switch_to+0xc89/0x1420 [ 94.962550][ T5330] ? __pfx_kthread+0x10/0x10 [ 94.964428][ T5330] ret_from_fork_asm+0x1a/0x30 [ 94.966340][ T5330] [ 94.968199][ T5330] Kernel Offset: disabled [ 94.969930][ T5330] Rebooting in 86400 seconds..