program: socketpair(0x1, 0x1, 0x0, &(0x7f0000000100)={0x0, 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, &(0x7f0000000180)) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/usb/drivers/usbip-host/match_busid\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='add 1-1\x00', 0x8) write(r1, &(0x7f0000000240)='add 2-1\x00', 0x8) close(r1) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/usb/drivers/usb/unbind\x00', 0x1, 0x0) write(r2, &(0x7f00000002c0)='1-1\x00', 0x4) write(r2, &(0x7f0000000340)='2-1\x00', 0x4) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/bus/usb/drivers/usbip-host/bind\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='1-1\x00', 0x4) write(r3, &(0x7f0000000400)='2-1\x00', 0x4) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/bus/usb/devices/1-1/usbip_sockfd\x00', 0x1, 0x0) write(r4, &(0x7f0000000480)='3\x00', 0x2) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/bus/usb/devices/2-1/usbip_sockfd\x00', 0x1, 0x0) write(r5, &(0x7f0000000500)='3\x00', 0x2) close(r5) nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0) write(r0, &(0x7f0000000540)="00000001000000010001000200"/48, 0x30) write(r0, &(0x7f0000000580)="00000002000000030001000200000000000000000000000100"/48, 0x30) write(r0, &(0x7f00000005c0)="00000001000000050001000200"/48, 0x30) nanosleep(&(0x7f0000000300)={0x1}, 0x0) [ 74.810249][ T4648] Bluetooth: hci0: command tx timeout [ 75.189506][ T5297] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 75.339652][ T5297] usb 5-1: Using ep0 maxpacket: 8 [ 75.345097][ T5297] usb 5-1: config 0 has an invalid interface number: 143 but max is 0 [ 75.348836][ T5297] usb 5-1: config 0 has no interface number 0 [ 75.352331][ T5297] usb 5-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 75.358741][ T5297] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 75.376521][ T5297] usb 5-1: config 0 descriptor?? [ 75.510548][ T5297] viperboard 5-1:0.143: version 0.00 found at bus 005 address 002 [ 75.574476][ T5297] viperboard-i2c viperboard-i2c.3.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 75.590546][ T5297] viperboard-i2c viperboard-i2c.3.auto: probe with driver viperboard-i2c failed with error -5 [ 75.784920][ T5322] usbip-host 1-1: usbip-host: register new device (bus 1 dev 2) [ 75.816874][ T5316] usbip-host 1-1: stub up [ 75.894786][ C0] usbip-host 1-1: endpoint 0 is stalled [ 75.914390][ T5323] ================================================================== [ 75.917903][ T5323] BUG: KASAN: slab-use-after-free in stub_rx_loop+0x2965/0x2ee0 [ 75.921303][ T5323] Read of size 4 at addr ffff888043609db0 by task stub_rx/5323 [ 75.924543][ T5323] [ 75.925593][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: stub_rx Not tainted syzkaller #0 PREEMPT(full) [ 75.925608][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 75.925616][ T5323] Call Trace: [ 75.925622][ T5323] [ 75.925627][ T5323] dump_stack_lvl+0xe8/0x150 [ 75.925645][ T5323] print_address_description+0x55/0x1e0 [ 75.925663][ T5323] ? stub_rx_loop+0x2965/0x2ee0 [ 75.925676][ T5323] print_report+0x58/0x70 [ 75.925689][ T5323] kasan_report+0x117/0x150 [ 75.925705][ T5323] ? stub_rx_loop+0x2965/0x2ee0 [ 75.925716][ T5323] stub_rx_loop+0x2965/0x2ee0 [ 75.925732][ T5323] ? __pfx_stub_rx_loop+0x10/0x10 [ 75.925746][ T5323] ? __kthread_parkme+0x196/0x1f0 [ 75.925762][ T5323] kthread+0x388/0x470 [ 75.925775][ T5323] ? __pfx_stub_rx_loop+0x10/0x10 [ 75.925786][ T5323] ? __pfx_kthread+0x10/0x10 [ 75.925800][ T5323] ret_from_fork+0x514/0xb70 [ 75.925817][ T5323] ? __pfx_ret_from_fork+0x10/0x10 [ 75.925830][ T5323] ? __switch_to+0xc89/0x1420 [ 75.925844][ T5323] ? __pfx_kthread+0x10/0x10 [ 75.925860][ T5323] ret_from_fork_asm+0x1a/0x30 [ 75.925873][ T5323] [ 75.925876][ T5323] [ 75.973631][ T5323] Allocated by task 5323: [ 75.975475][ T5323] kasan_save_track+0x3e/0x80 [ 75.977453][ T5323] __kasan_slab_alloc+0x6c/0x80 [ 75.979472][ T5323] kmem_cache_alloc_noprof+0x2a0/0x5f0 [ 75.981776][ T5323] stub_rx_loop+0xad9/0x2ee0 [ 75.983849][ T5323] kthread+0x388/0x470 [ 75.985647][ T5323] ret_from_fork+0x514/0xb70 [ 75.987665][ T5323] ret_from_fork_asm+0x1a/0x30 [ 75.989797][ T5323] [ 75.990888][ T5323] Freed by task 5324: [ 75.992668][ T5323] kasan_save_track+0x3e/0x80 [ 75.994606][ T5323] kasan_save_free_info+0x40/0x50 [ 75.996784][ T5323] __kasan_slab_free+0x5c/0x80 [ 75.998889][ T5323] kmem_cache_free+0x182/0x650 [ 76.001054][ T5323] stub_tx_loop+0x1b16/0x2800 [ 76.003062][ T5323] kthread+0x388/0x470 [ 76.004782][ T5323] ret_from_fork+0x514/0xb70 [ 76.006816][ T5323] ret_from_fork_asm+0x1a/0x30 [ 76.008868][ T5323] [ 76.009825][ T5323] The buggy address belongs to the object at ffff888043609d80 [ 76.009825][ T5323] which belongs to the cache stub_priv of size 64 [ 76.015181][ T5323] The buggy address is located 48 bytes inside of [ 76.015181][ T5323] freed 64-byte region [ffff888043609d80, ffff888043609dc0) [ 76.020668][ T5323] [ 76.021747][ T5323] The buggy address belongs to the physical page: [ 76.024443][ T5323] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888043609e00 pfn:0x43609 [ 76.028644][ T5323] flags: 0x4fff00000000200(workingset|node=1|zone=1|lastcpupid=0x7ff) [ 76.031996][ T5323] page_type: f5(slab) [ 76.033733][ T5323] raw: 04fff00000000200 ffff888032de3dc0 ffff88803405d288 ffff88803405d288 [ 76.037336][ T5323] raw: ffff888043609e00 000000080020001c 00000000f5000000 0000000000000000 [ 76.041003][ T5323] page dumped because: kasan: bad access detected [ 76.043646][ T5323] page_owner tracks the page as allocated [ 76.046110][ T5323] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5323, tgid 5323 (stub_rx), ts 75893424441, free_ts 74908929172 [ 76.054646][ T5323] post_alloc_hook+0x1f9/0x250 [ 76.056754][ T5323] get_page_from_freelist+0x21fa/0x2270 [ 76.059146][ T5323] __alloc_frozen_pages_noprof+0x18d/0x380 [ 76.061684][ T5323] allocate_slab+0x79/0x5e0 [ 76.063564][ T5323] refill_objects+0x2d5/0x350 [ 76.065547][ T5323] __pcs_replace_empty_main+0x2bf/0x6b0 [ 76.067938][ T5323] kmem_cache_alloc_noprof+0x382/0x5f0 [ 76.070329][ T5323] stub_rx_loop+0xad9/0x2ee0 [ 76.072399][ T5323] kthread+0x388/0x470 [ 76.074165][ T5323] ret_from_fork+0x514/0xb70 [ 76.076066][ T5323] ret_from_fork_asm+0x1a/0x30 [ 76.078115][ T5323] page last free pid 5316 tgid 5315 stack trace: [ 76.080906][ T5323] __free_frozen_pages+0xc1e/0xd10 [ 76.083085][ T5323] __slab_free+0x274/0x2c0 [ 76.085035][ T5323] qlist_free_all+0x99/0x100 [ 76.086948][ T5323] kasan_quarantine_reduce+0x148/0x160 [ 76.089243][ T5323] __kasan_slab_alloc+0x22/0x80 [ 76.091252][ T5323] kmem_cache_alloc_noprof+0x2a0/0x5f0 [ 76.093634][ T5323] do_getname+0x2e/0x250 [ 76.095479][ T5323] do_sys_openat2+0xcc/0x200 [ 76.097482][ T5323] __x64_sys_openat+0x138/0x170 [ 76.099515][ T5323] do_syscall_64+0x174/0x580 [ 76.101531][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.104019][ T5323] [ 76.105054][ T5323] Memory state around the buggy address: [ 76.107335][ T5323] ffff888043609c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 76.110595][ T5323] ffff888043609d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 76.113949][ T5323] >ffff888043609d80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 76.117143][ T5323] ^ [ 76.119394][ T5323] ffff888043609e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 76.122593][ T5323] ffff888043609e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 76.125792][ T5323] ================================================================== [ 76.273493][ T5323] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 76.276395][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: stub_rx Not tainted syzkaller #0 PREEMPT(full) [ 76.280135][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 76.284349][ T5323] Call Trace: [ 76.285799][ T5323] [ 76.287098][ T5323] vpanic+0x56c/0xa60 [ 76.288889][ T5323] ? __pfx_vpanic+0x10/0x10 [ 76.290927][ T5323] panic+0xc5/0xd0 [ 76.292628][ T5323] ? __pfx_panic+0x10/0x10 [ 76.294589][ T5323] ? preempt_schedule_thunk+0x16/0x40 [ 76.296970][ T5323] ? stub_rx_loop+0x2965/0x2ee0 [ 76.299080][ T5323] ? preempt_schedule_thunk+0x16/0x40 [ 76.301459][ T5323] ? stub_rx_loop+0x2965/0x2ee0 [ 76.303565][ T5323] check_panic_on_warn+0x89/0xb0 [ 76.305676][ T5323] ? stub_rx_loop+0x2965/0x2ee0 [ 76.307709][ T5323] end_report+0x73/0x170 [ 76.309600][ T5323] ? stub_rx_loop+0x2965/0x2ee0 [ 76.311721][ T5323] kasan_report+0x128/0x150 [ 76.313655][ T5323] ? stub_rx_loop+0x2965/0x2ee0 [ 76.315637][ T5323] stub_rx_loop+0x2965/0x2ee0 [ 76.317649][ T5323] ? __pfx_stub_rx_loop+0x10/0x10 [ 76.319822][ T5323] ? __kthread_parkme+0x196/0x1f0 [ 76.322103][ T5323] kthread+0x388/0x470 [ 76.323864][ T5323] ? __pfx_stub_rx_loop+0x10/0x10 [ 76.326008][ T5323] ? __pfx_kthread+0x10/0x10 [ 76.327923][ T5323] ret_from_fork+0x514/0xb70 [ 76.329950][ T5323] ? __pfx_ret_from_fork+0x10/0x10 [ 76.332097][ T5323] ? __switch_to+0xc89/0x1420 [ 76.334234][ T5323] ? __pfx_kthread+0x10/0x10 [ 76.336234][ T5323] ret_from_fork_asm+0x1a/0x30 [ 76.338285][ T5323] [ 76.340023][ T5323] Kernel Offset: disabled [ 76.341895][ T5323] Rebooting in 86400 seconds..