program: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f00000000c0)={0xcf47, 0x4cc, 0xffff, 0xe, 0x1, "8003e3ffff072000"}) (async, rerun: 64) write$binfmt_aout(r0, &(0x7f00000006c0)=ANY=[], 0xff2e) (rerun: 64) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0xb, 0x1, 0x2, 0x8001, 0x3e, "41bf6ebbff4000"}) (async) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000000)=0xff) r3 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/comedi4\x00', 0x181001, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) write(r4, &(0x7f0000000300)='vhci_hcd.0\x00', 0xb) (async) r5 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0x4e21, @local}], 0x10) (async, rerun: 32) sendmsg$inet_sctp(r5, &(0x7f0000000080)={&(0x7f0000000340)=@in={0x2, 0x5e21, @multicast1}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000380)='N', 0x1}], 0x1, 0x0, 0x0, 0x20048001}, 0xc851) (async, rerun: 32) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) (async) syz_usb_connect$cdc_ecm(0x3, 0x52, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020000202505a1a440000000010109024000010100c07d090400fe1602020000052486000005240000000d240f010000000000000000000524"], 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_merged\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x12, r0, 0x0) (async, rerun: 64) ftruncate(r6, 0x4) (async, rerun: 64) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x4000, &(0x7f0000000080)=0x9, 0x8, 0x0) (async) mremap(&(0x7f000008f000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000486000/0x1000)=nil) (async, rerun: 32) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x0) (async, rerun: 32) r7 = syz_open_dev$usbfs(&(0x7f0000000180), 0x5, 0x400) ioctl$USBDEVFS_IOCTL(r7, 0xc0105512, &(0x7f0000000200)=@usbdevfs_connect) (async) ioctl$COMEDI_INSN(r3, 0x8028640c, &(0x7f0000000080)={0xe000003, 0xf, &(0x7f0000001540)=[0x8, 0x4, 0x8, 0x6, 0xffff, 0x0, 0xd, 0x1, 0xf, 0x9, 0xfffffc88, 0xffffffff, 0x1, 0xf1, 0x5], 0x6, 0xe0000}) (async) fcntl$getownex(r3, 0x10, &(0x7f0000000000)) syz_mount_image$bfs(&(0x7f00000000c0), &(0x7f0000000240)='./file0\x00', 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0000005823dc14bc393bdf6c475eee642d36aa00"], 0x21, 0x9e, &(0x7f0000000300)="$eJzszrGJAlEUBdC7syy7bDANGNjB9GApYqiZkSIoWI+tWIIdGJiajAxfEUwEQRQ5B/6D9y8P7va46aVO2mXS3pjO5uPhpMyfFN/hk1RJfpP8JenXZd8PSvZ1zneHxejyuv/VizsDAACPqdJcl3U3mub+1f8zKwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC8lVMAAAD//7T0JGU=") (async) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x105042, 0x1ff) (async) renameat2(0xffffffffffffff9c, &(0x7f0000000580)='./file1\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./file7\x00', 0x5) [ 93.959964][ T5286] Bluetooth: hci0: command tx timeout [ 94.104938][ T5329] vhci_hcd vhci_hcd.0: remove, state 4 [ 94.113600][ T5329] usb usb7: USB disconnect, device number 1 [ 94.237716][ T5329] vhci_hcd vhci_hcd.0: USB bus 7 deregistered [ 94.241238][ T1063] vhci_hcd vhci_hcd.0: stop threads [ 94.246832][ T1063] vhci_hcd vhci_hcd.0: release socket [ 94.251956][ T1063] vhci_hcd vhci_hcd.0: disconnect device [ 94.260427][ T1063] vhci_hcd vhci_hcd.0: stop threads [ 94.263156][ T5329] vhci_hcd vhci_hcd.0: remove, state 4 [ 94.266279][ T1063] ================================================================== [ 94.269710][ T1063] BUG: KASAN: slab-use-after-free in vhci_shutdown_connection+0x1d4/0x650 [ 94.273486][ T1063] Read of size 8 at addr ffff888034cf4780 by task kworker/u4:9/1063 [ 94.276894][ T1063] [ 94.278046][ T1063] CPU: 0 UID: 0 PID: 1063 Comm: kworker/u4:9 Not tainted syzkaller #0 PREEMPT(full) [ 94.278061][ T1063] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.278069][ T1063] Workqueue: usbip_event event_handler [ 94.278086][ T1063] Call Trace: [ 94.278093][ T1063] [ 94.278099][ T1063] dump_stack_lvl+0xe8/0x150 [ 94.278194][ T1063] print_address_description+0x55/0x1e0 [ 94.278211][ T1063] ? vhci_shutdown_connection+0x1d4/0x650 [ 94.278225][ T1063] print_report+0x58/0x70 [ 94.278238][ T1063] kasan_report+0x117/0x150 [ 94.278293][ T1063] ? vhci_shutdown_connection+0x1d4/0x650 [ 94.278309][ T1063] vhci_shutdown_connection+0x1d4/0x650 [ 94.278322][ T1063] event_handler+0x2a4/0x4b0 [ 94.278334][ T1063] ? process_scheduled_works+0xa20/0x14e0 [ 94.278361][ T1063] process_scheduled_works+0xa8e/0x14e0 [ 94.278379][ T1063] ? __pfx_process_scheduled_works+0x10/0x10 [ 94.278393][ T1063] ? assign_work+0x3cf/0x5d0 [ 94.278405][ T1063] worker_thread+0xa47/0xfb0 [ 94.278424][ T1063] kthread+0x388/0x470 [ 94.278469][ T1063] ? __pfx_worker_thread+0x10/0x10 [ 94.278482][ T1063] ? __pfx_kthread+0x10/0x10 [ 94.278497][ T1063] ret_from_fork+0x514/0xb70 [ 94.278516][ T1063] ? __pfx_ret_from_fork+0x10/0x10 [ 94.278538][ T1063] ? __switch_to+0xc89/0x1420 [ 94.278554][ T1063] ? __pfx_kthread+0x10/0x10 [ 94.278569][ T1063] ret_from_fork_asm+0x1a/0x30 [ 94.278584][ T1063] [ 94.278588][ T1063] [ 94.339108][ T1063] Allocated by task 1: [ 94.340803][ T1063] kasan_save_track+0x3e/0x80 [ 94.342885][ T1063] __kasan_kmalloc+0x93/0xb0 [ 94.344707][ T1063] __kmalloc_noprof+0x375/0x720 [ 94.346798][ T1063] __usb_create_hcd+0x67/0x900 [ 94.348944][ T1063] vhci_hcd_probe+0x1e6/0x3e0 [ 94.350974][ T1063] platform_probe+0xf9/0x190 [ 94.353179][ T1063] really_probe+0x254/0xae0 [ 94.355270][ T1063] __driver_probe_device+0x1e8/0x360 [ 94.357664][ T1063] driver_probe_device+0x4f/0x240 [ 94.360000][ T1063] __device_attach_driver+0x270/0x410 [ 94.362554][ T1063] bus_for_each_drv+0x258/0x2f0 [ 94.364642][ T1063] __device_attach+0x2c4/0x450 [ 94.366722][ T1063] device_initial_probe+0xa1/0xd0 [ 94.368763][ T1063] bus_probe_device+0x12a/0x220 [ 94.370736][ T1063] device_add+0x7d7/0xb80 [ 94.372437][ T1063] platform_device_add+0x4bd/0x860 [ 94.374508][ T1063] platform_device_register_full+0x62d/0x710 [ 94.377075][ T1063] vhci_hcd_init+0x227/0x360 [ 94.379140][ T1063] do_one_initcall+0x250/0x870 [ 94.381255][ T1063] do_initcall_level+0x10a/0x1a0 [ 94.383431][ T1063] do_initcalls+0x59/0xa0 [ 94.385283][ T1063] kernel_init_freeable+0x29d/0x3e0 [ 94.387483][ T1063] kernel_init+0x1d/0x1d0 [ 94.389368][ T1063] ret_from_fork+0x514/0xb70 [ 94.391361][ T1063] ret_from_fork_asm+0x1a/0x30 [ 94.393416][ T1063] [ 94.394460][ T1063] Freed by task 5329: [ 94.396101][ T1063] kasan_save_track+0x3e/0x80 [ 94.398085][ T1063] kasan_save_free_info+0x40/0x50 [ 94.400217][ T1063] __kasan_slab_free+0x5c/0x80 [ 94.402301][ T1063] kfree+0x1c5/0x640 [ 94.404046][ T1063] vhci_hcd_remove+0x9e/0x110 [ 94.406126][ T1063] device_release_driver_internal+0x48b/0x880 [ 94.408744][ T1063] unbind_store+0x1a1/0x1d0 [ 94.410698][ T1063] kernfs_fop_write_iter+0x3a4/0x540 [ 94.412904][ T1063] vfs_write+0x612/0xba0 [ 94.414749][ T1063] ksys_write+0x150/0x270 [ 94.416661][ T1063] do_syscall_64+0x174/0x580 [ 94.418770][ T1063] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.421293][ T1063] [ 94.422333][ T1063] Last potentially related work creation: [ 94.424670][ T1063] kasan_save_stack+0x3e/0x60 [ 94.426647][ T1063] kasan_record_aux_stack+0xbd/0xd0 [ 94.428784][ T1063] insert_work+0x3d/0x330 [ 94.430792][ T1063] __queue_work+0xcd8/0x10a0 [ 94.432897][ T1063] queue_work_on+0x106/0x1d0 [ 94.434896][ T1063] unlink1+0x344/0x3e0 [ 94.436652][ T1063] usb_hcd_unlink_urb+0xe6/0x1e0 [ 94.438768][ T1063] usb_kill_urb+0x10b/0x2f0 [ 94.440780][ T1063] hub_quiesce+0x211/0x330 [ 94.442776][ T1063] hub_suspend+0x904/0xad0 [ 94.444726][ T1063] usb_suspend_both+0x285/0x1040 [ 94.446876][ T1063] usb_runtime_suspend+0x58/0x110 [ 94.449009][ T1063] __rpm_callback+0x2c7/0x950 [ 94.451093][ T1063] rpm_suspend+0x8a0/0x17b0 [ 94.453058][ T1063] __pm_runtime_suspend+0x12f/0x1a0 [ 94.455282][ T1063] usb_new_device+0xadf/0x1620 [ 94.457286][ T1063] register_root_hub+0x250/0x5c0 [ 94.459364][ T1063] usb_add_hcd+0xac7/0xf80 [ 94.461209][ T1063] vhci_hcd_probe+0x1fa/0x3e0 [ 94.463209][ T1063] platform_probe+0xf9/0x190 [ 94.465163][ T1063] really_probe+0x254/0xae0 [ 94.467112][ T1063] __driver_probe_device+0x1e8/0x360 [ 94.469374][ T1063] driver_probe_device+0x4f/0x240 [ 94.471546][ T1063] __device_attach_driver+0x270/0x410 [ 94.473808][ T1063] bus_for_each_drv+0x258/0x2f0 [ 94.475858][ T1063] __device_attach+0x2c4/0x450 [ 94.477859][ T1063] device_initial_probe+0xa1/0xd0 [ 94.480000][ T1063] bus_probe_device+0x12a/0x220 [ 94.482100][ T1063] device_add+0x7d7/0xb80 [ 94.483952][ T1063] platform_device_add+0x4bd/0x860 [ 94.486085][ T1063] platform_device_register_full+0x62d/0x710 [ 94.488599][ T1063] vhci_hcd_init+0x227/0x360 [ 94.490542][ T1063] do_one_initcall+0x250/0x870 [ 94.492649][ T1063] do_initcall_level+0x10a/0x1a0 [ 94.494688][ T1063] do_initcalls+0x59/0xa0 [ 94.496501][ T1063] kernel_init_freeable+0x29d/0x3e0 [ 94.498616][ T1063] kernel_init+0x1d/0x1d0 [ 94.500437][ T1063] ret_from_fork+0x514/0xb70 [ 94.502391][ T1063] ret_from_fork_asm+0x1a/0x30 [ 94.504466][ T1063] [ 94.505492][ T1063] Second to last potentially related work creation: [ 94.508214][ T1063] kasan_save_stack+0x3e/0x60 [ 94.510272][ T1063] kasan_record_aux_stack+0xbd/0xd0 [ 94.512504][ T1063] insert_work+0x3d/0x330 [ 94.514338][ T1063] __queue_work+0xcd8/0x10a0 [ 94.516337][ T1063] queue_work_on+0x106/0x1d0 [ 94.518295][ T1063] usb_hcd_submit_urb+0xa3b/0x1b60 [ 94.520473][ T1063] usb_start_wait_urb+0x13f/0x5b0 [ 94.522654][ T1063] usb_control_msg+0x234/0x3e0 [ 94.524653][ T1063] hub_suspend+0x891/0xad0 [ 94.526629][ T1063] usb_suspend_both+0x285/0x1040 [ 94.528711][ T1063] usb_runtime_suspend+0x58/0x110 [ 94.530831][ T1063] __rpm_callback+0x2c7/0x950 [ 94.532907][ T1063] rpm_suspend+0x8a0/0x17b0 [ 94.534866][ T1063] __pm_runtime_suspend+0x12f/0x1a0 [ 94.537073][ T1063] usb_new_device+0xadf/0x1620 [ 94.539110][ T1063] register_root_hub+0x250/0x5c0 [ 94.541166][ T1063] usb_add_hcd+0xac7/0xf80 [ 94.543138][ T1063] vhci_hcd_probe+0x1fa/0x3e0 [ 94.545106][ T1063] platform_probe+0xf9/0x190 [ 94.547111][ T1063] really_probe+0x254/0xae0 [ 94.549021][ T1063] __driver_probe_device+0x1e8/0x360 [ 94.551281][ T1063] driver_probe_device+0x4f/0x240 [ 94.553365][ T1063] __device_attach_driver+0x270/0x410 [ 94.555631][ T1063] bus_for_each_drv+0x258/0x2f0 [ 94.557485][ T1063] __device_attach+0x2c4/0x450 [ 94.559474][ T1063] device_initial_probe+0xa1/0xd0 [ 94.561671][ T1063] bus_probe_device+0x12a/0x220 [ 94.563790][ T1063] device_add+0x7d7/0xb80 [ 94.565554][ T1063] platform_device_add+0x4bd/0x860 [ 94.567660][ T1063] platform_device_register_full+0x62d/0x710 [ 94.570169][ T1063] vhci_hcd_init+0x227/0x360 [ 94.572136][ T1063] do_one_initcall+0x250/0x870 [ 94.574200][ T1063] do_initcall_level+0x10a/0x1a0 [ 94.576203][ T1063] do_initcalls+0x59/0xa0 [ 94.578004][ T1063] kernel_init_freeable+0x29d/0x3e0 [ 94.580306][ T1063] kernel_init+0x1d/0x1d0 [ 94.582145][ T1063] ret_from_fork+0x514/0xb70 [ 94.584159][ T1063] ret_from_fork_asm+0x1a/0x30 [ 94.586079][ T1063] [ 94.587103][ T1063] The buggy address belongs to the object at ffff888034cf4000 [ 94.587103][ T1063] which belongs to the cache kmalloc-8k of size 8192 [ 94.592754][ T1063] The buggy address is located 1920 bytes inside of [ 94.592754][ T1063] freed 8192-byte region [ffff888034cf4000, ffff888034cf6000) [ 94.598027][ T1063] [ 94.599032][ T1063] The buggy address belongs to the physical page: [ 94.601669][ T1063] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34cf0 [ 94.605285][ T1063] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 94.608537][ T1063] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 94.611728][ T1063] page_type: f5(slab) [ 94.613395][ T1063] raw: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 94.616877][ T1063] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 94.620361][ T1063] head: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 94.623952][ T1063] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 94.627553][ T1063] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 94.631125][ T1063] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 94.634747][ T1063] page dumped because: kasan: bad access detected [ 94.637495][ T1063] page_owner tracks the page as allocated [ 94.640059][ T1063] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 16943160894, free_ts 16886828682 [ 94.648524][ T1063] post_alloc_hook+0x1f9/0x250 [ 94.650616][ T1063] get_page_from_freelist+0x21fa/0x2270 [ 94.652984][ T1063] __alloc_frozen_pages_noprof+0x18d/0x380 [ 94.655494][ T1063] allocate_slab+0x79/0x5e0 [ 94.657380][ T1063] refill_objects+0x2d5/0x350 [ 94.659505][ T1063] __pcs_replace_empty_main+0x2bf/0x6b0 [ 94.661859][ T1063] __kmalloc_noprof+0x485/0x720 [ 94.663975][ T1063] __usb_create_hcd+0x67/0x900 [ 94.666021][ T1063] vhci_hcd_probe+0x1e6/0x3e0 [ 94.668021][ T1063] platform_probe+0xf9/0x190 [ 94.669996][ T1063] really_probe+0x254/0xae0 [ 94.671979][ T1063] __driver_probe_device+0x1e8/0x360 [ 94.674260][ T1063] driver_probe_device+0x4f/0x240 [ 94.676466][ T1063] __device_attach_driver+0x270/0x410 [ 94.678928][ T1063] bus_for_each_drv+0x258/0x2f0 [ 94.681108][ T1063] __device_attach+0x2c4/0x450 [ 94.683277][ T1063] page last free pid 15 tgid 15 stack trace: [ 94.685896][ T1063] __free_frozen_pages+0xc1e/0xd10 [ 94.688074][ T1063] rcu_core+0x78b/0x10a0 [ 94.689822][ T1063] handle_softirqs+0x225/0x840 [ 94.691862][ T1063] run_ksoftirqd+0x36/0x60 [ 94.693767][ T1063] smpboot_thread_fn+0x57c/0xa80 [ 94.695983][ T1063] kthread+0x388/0x470 [ 94.697848][ T1063] ret_from_fork+0x514/0xb70 [ 94.700041][ T1063] ret_from_fork_asm+0x1a/0x30 [ 94.702304][ T1063] [ 94.703423][ T1063] Memory state around the buggy address: [ 94.705935][ T1063] ffff888034cf4680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.709361][ T1063] ffff888034cf4700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.712773][ T1063] >ffff888034cf4780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.716220][ T1063] ^ [ 94.717943][ T1063] ffff888034cf4800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.721275][ T1063] ffff888034cf4880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.724674][ T1063] ================================================================== [ 94.729169][ T5329] usb usb6: USB disconnect, device number 1 [ 94.798721][ T5329] vhci_hcd vhci_hcd.0: USB bus 6 deregistered