program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) ioctl$AUTOFS_IOC_PROTOVER(0xffffffffffffffff, 0x80049363, &(0x7f0000000040)) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='vhci_hcd.0\x00', 0xb) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) (async) ioctl$AUTOFS_IOC_PROTOVER(0xffffffffffffffff, 0x80049363, &(0x7f0000000040)) (async) openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) (async) write(r0, &(0x7f0000000300)='vhci_hcd.0\x00', 0xb) (async) [ 94.552155][ T5273] Bluetooth: hci0: command tx timeout [ 94.741214][ T5310] vhci_hcd vhci_hcd.0: remove, state 4 [ 94.743634][ T5310] usb usb7: USB disconnect, device number 1 [ 94.796185][ T13] vhci_hcd vhci_hcd.0: stop threads [ 94.801947][ T13] vhci_hcd vhci_hcd.0: release socket [ 94.804840][ T13] vhci_hcd vhci_hcd.0: disconnect device [ 94.809809][ T13] vhci_hcd vhci_hcd.0: stop threads [ 94.812183][ T13] vhci_hcd vhci_hcd.0: release socket [ 94.814398][ T13] vhci_hcd vhci_hcd.0: disconnect device [ 94.818591][ T13] vhci_hcd vhci_hcd.0: stop threads [ 94.820831][ T13] vhci_hcd vhci_hcd.0: release socket [ 94.823407][ T5310] vhci_hcd vhci_hcd.0: USB bus 7 deregistered [ 94.826735][ T13] vhci_hcd vhci_hcd.0: disconnect device [ 94.832736][ T13] vhci_hcd vhci_hcd.0: stop threads [ 94.838163][ T13] vhci_hcd vhci_hcd.0: release socket [ 94.843380][ T13] vhci_hcd vhci_hcd.0: disconnect device [ 94.852418][ T13] vhci_hcd vhci_hcd.0: stop threads [ 94.855157][ T5310] vhci_hcd vhci_hcd.0: remove, state 4 [ 94.858636][ T13] ================================================================== [ 94.861971][ T13] BUG: KASAN: slab-use-after-free in vhci_shutdown_connection+0x1d4/0x650 [ 94.865604][ T13] Read of size 8 at addr ffff888034e98e70 by task kworker/u4:1/13 [ 94.868884][ T13] [ 94.869939][ T13] CPU: 0 UID: 0 PID: 13 Comm: kworker/u4:1 Not tainted syzkaller #0 PREEMPT(full) [ 94.869952][ T13] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.869959][ T13] Workqueue: usbip_event event_handler [ 94.869974][ T13] Call Trace: [ 94.869980][ T13] [ 94.869986][ T13] dump_stack_lvl+0xe8/0x150 [ 94.870002][ T13] print_address_description+0x55/0x1e0 [ 94.870016][ T13] ? vhci_shutdown_connection+0x1d4/0x650 [ 94.870027][ T13] print_report+0x58/0x70 [ 94.870039][ T13] kasan_report+0x117/0x150 [ 94.870053][ T13] ? vhci_shutdown_connection+0x1d4/0x650 [ 94.870066][ T13] vhci_shutdown_connection+0x1d4/0x650 [ 94.870079][ T13] event_handler+0x2a4/0x4b0 [ 94.870088][ T13] ? process_scheduled_works+0x97a/0x1630 [ 94.870101][ T13] process_scheduled_works+0xc3d/0x1630 [ 94.870120][ T13] ? __pfx_process_scheduled_works+0x10/0x10 [ 94.870133][ T13] ? assign_work+0x3cf/0x5d0 [ 94.870144][ T13] worker_thread+0xa47/0xfb0 [ 94.870161][ T13] kthread+0x38b/0x480 [ 94.870175][ T13] ? __pfx_worker_thread+0x10/0x10 [ 94.870186][ T13] ? __pfx_kthread+0x10/0x10 [ 94.870199][ T13] ret_from_fork+0x514/0xb70 [ 94.870213][ T13] ? __pfx_ret_from_fork+0x10/0x10 [ 94.870226][ T13] ? __switch_to+0xc89/0x1420 [ 94.870238][ T13] ? __pfx_kthread+0x10/0x10 [ 94.870251][ T13] ret_from_fork_asm+0x1a/0x30 [ 94.870267][ T13] [ 94.870271][ T13] [ 94.930625][ T13] Allocated by task 1: [ 94.932389][ T13] kasan_save_track+0x3e/0x80 [ 94.934244][ T13] __kasan_kmalloc+0x93/0xb0 [ 94.936123][ T13] __kmalloc_noprof+0x379/0x720 [ 94.938138][ T13] __usb_create_hcd+0x67/0x900 [ 94.940097][ T13] vhci_hcd_probe+0x1e6/0x3e0 [ 94.941995][ T13] platform_probe+0xf9/0x190 [ 94.943925][ T13] really_probe+0x254/0xae0 [ 94.945822][ T13] __driver_probe_device+0x1e8/0x360 [ 94.948017][ T13] driver_probe_device+0x4f/0x240 [ 94.950234][ T13] __device_attach_driver+0x270/0x410 [ 94.952496][ T13] bus_for_each_drv+0x258/0x2f0 [ 94.954536][ T13] __device_attach+0x2c4/0x450 [ 94.956600][ T13] device_initial_probe+0xa1/0xd0 [ 94.958673][ T13] bus_probe_device+0x12a/0x220 [ 94.960782][ T13] device_add+0x7d7/0xb80 [ 94.962565][ T13] platform_device_add+0x4bd/0x860 [ 94.964796][ T13] platform_device_register_full+0x53a/0x620 [ 94.967321][ T13] vhci_hcd_init+0x227/0x360 [ 94.969350][ T13] do_one_initcall+0x250/0x870 [ 94.971379][ T13] do_initcall_level+0x10a/0x1a0 [ 94.973524][ T13] do_initcalls+0x59/0xa0 [ 94.975528][ T13] kernel_init_freeable+0x29d/0x3e0 [ 94.977692][ T13] kernel_init+0x22/0x1d0 [ 94.979621][ T13] ret_from_fork+0x514/0xb70 [ 94.981458][ T13] ret_from_fork_asm+0x1a/0x30 [ 94.983411][ T13] [ 94.984435][ T13] Freed by task 5310: [ 94.986335][ T13] kasan_save_track+0x3e/0x80 [ 94.988322][ T13] kasan_save_free_info+0x40/0x50 [ 94.990414][ T13] __kasan_slab_free+0x5c/0x80 [ 94.992507][ T13] kfree+0x1c5/0x640 [ 94.994184][ T13] vhci_hcd_remove+0x9e/0x110 [ 94.996318][ T13] device_release_driver_internal+0x48b/0x880 [ 94.999731][ T13] unbind_store+0x1a1/0x1d0 [ 95.002255][ T13] kernfs_fop_write_iter+0x3a4/0x540 [ 95.005228][ T13] vfs_write+0x612/0xba0 [ 95.007080][ T13] ksys_write+0x150/0x270 [ 95.008988][ T13] do_syscall_64+0x166/0x520 [ 95.011070][ T13] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.013547][ T13] [ 95.014601][ T13] Last potentially related work creation: [ 95.016851][ T13] kasan_save_stack+0x3e/0x60 [ 95.018810][ T13] kasan_record_aux_stack+0xbd/0xd0 [ 95.020850][ T13] insert_work+0x3d/0x330 [ 95.022482][ T13] __queue_work+0xd07/0x10d0 [ 95.024139][ T13] queue_work_on+0x106/0x1d0 [ 95.025760][ T13] unlink1+0x344/0x3e0 [ 95.027143][ T13] usb_hcd_unlink_urb+0xe6/0x1e0 [ 95.028991][ T13] usb_kill_urb+0x10b/0x2f0 [ 95.031048][ T13] hub_quiesce+0x211/0x330 [ 95.032992][ T13] hub_suspend+0x904/0xad0 [ 95.034938][ T13] usb_suspend_both+0x285/0x1040 [ 95.037038][ T13] usb_runtime_suspend+0x58/0x110 [ 95.039193][ T13] __rpm_callback+0x2c7/0x950 [ 95.041519][ T13] rpm_suspend+0x89d/0x17a0 [ 95.043435][ T13] __pm_runtime_suspend+0x12f/0x1a0 [ 95.045684][ T13] usb_new_device+0xaee/0x1690 [ 95.047702][ T13] register_root_hub+0x250/0x5c0 [ 95.049821][ T13] usb_add_hcd+0xac7/0xf80 [ 95.051763][ T13] vhci_hcd_probe+0x1fa/0x3e0 [ 95.053905][ T13] platform_probe+0xf9/0x190 [ 95.056428][ T13] really_probe+0x254/0xae0 [ 95.058603][ T13] __driver_probe_device+0x1e8/0x360 [ 95.061095][ T13] driver_probe_device+0x4f/0x240 [ 95.063546][ T13] __device_attach_driver+0x270/0x410 [ 95.065747][ T13] bus_for_each_drv+0x258/0x2f0 [ 95.067830][ T13] __device_attach+0x2c4/0x450 [ 95.069919][ T13] device_initial_probe+0xa1/0xd0 [ 95.072531][ T13] bus_probe_device+0x12a/0x220 [ 95.074655][ T13] device_add+0x7d7/0xb80 [ 95.076553][ T13] platform_device_add+0x4bd/0x860 [ 95.078804][ T13] platform_device_register_full+0x53a/0x620 [ 95.081454][ T13] vhci_hcd_init+0x227/0x360 [ 95.083393][ T13] do_one_initcall+0x250/0x870 [ 95.085506][ T13] do_initcall_level+0x10a/0x1a0 [ 95.087674][ T13] do_initcalls+0x59/0xa0 [ 95.089454][ T13] kernel_init_freeable+0x29d/0x3e0 [ 95.091755][ T13] kernel_init+0x22/0x1d0 [ 95.093621][ T13] ret_from_fork+0x514/0xb70 [ 95.095565][ T13] ret_from_fork_asm+0x1a/0x30 [ 95.097590][ T13] [ 95.098607][ T13] Second to last potentially related work creation: [ 95.101379][ T13] kasan_save_stack+0x3e/0x60 [ 95.103388][ T13] kasan_record_aux_stack+0xbd/0xd0 [ 95.105566][ T13] insert_work+0x3d/0x330 [ 95.107346][ T13] __queue_work+0xd07/0x10d0 [ 95.109249][ T13] queue_work_on+0x106/0x1d0 [ 95.111126][ T13] usb_hcd_submit_urb+0xa3b/0x1b60 [ 95.113401][ T13] usb_start_wait_urb+0x13f/0x5b0 [ 95.115521][ T13] usb_control_msg+0x234/0x3e0 [ 95.117493][ T13] hub_suspend+0x891/0xad0 [ 95.119380][ T13] usb_suspend_both+0x285/0x1040 [ 95.121457][ T13] usb_runtime_suspend+0x58/0x110 [ 95.123525][ T13] __rpm_callback+0x2c7/0x950 [ 95.125479][ T13] rpm_suspend+0x89d/0x17a0 [ 95.127377][ T13] __pm_runtime_suspend+0x12f/0x1a0 [ 95.129657][ T13] usb_new_device+0xaee/0x1690 [ 95.131755][ T13] register_root_hub+0x250/0x5c0 [ 95.133817][ T13] usb_add_hcd+0xac7/0xf80 [ 95.135779][ T13] vhci_hcd_probe+0x1fa/0x3e0 [ 95.137733][ T13] platform_probe+0xf9/0x190 [ 95.139730][ T13] really_probe+0x254/0xae0 [ 95.141661][ T13] __driver_probe_device+0x1e8/0x360 [ 95.143862][ T13] driver_probe_device+0x4f/0x240 [ 95.146008][ T13] __device_attach_driver+0x270/0x410 [ 95.148409][ T13] bus_for_each_drv+0x258/0x2f0 [ 95.150421][ T13] __device_attach+0x2c4/0x450 [ 95.152437][ T13] device_initial_probe+0xa1/0xd0 [ 95.154536][ T13] bus_probe_device+0x12a/0x220 [ 95.156614][ T13] device_add+0x7d7/0xb80 [ 95.158377][ T13] platform_device_add+0x4bd/0x860 [ 95.160426][ T13] platform_device_register_full+0x53a/0x620 [ 95.162923][ T13] vhci_hcd_init+0x227/0x360 [ 95.164862][ T13] do_one_initcall+0x250/0x870 [ 95.166914][ T13] do_initcall_level+0x10a/0x1a0 [ 95.169107][ T13] do_initcalls+0x59/0xa0 [ 95.170901][ T13] kernel_init_freeable+0x29d/0x3e0 [ 95.173035][ T13] kernel_init+0x22/0x1d0 [ 95.174834][ T13] ret_from_fork+0x514/0xb70 [ 95.176768][ T13] ret_from_fork_asm+0x1a/0x30 [ 95.178877][ T13] [ 95.179929][ T13] The buggy address belongs to the object at ffff888034e98000 [ 95.179929][ T13] which belongs to the cache kmalloc-8k of size 8192 [ 95.185687][ T13] The buggy address is located 3696 bytes inside of [ 95.185687][ T13] freed 8192-byte region [ffff888034e98000, ffff888034e9a000) [ 95.191329][ T13] [ 95.192376][ T13] The buggy address belongs to the physical page: [ 95.195089][ T13] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34e98 [ 95.198600][ T13] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 95.202063][ T13] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 95.205349][ T13] page_type: f5(slab) [ 95.207009][ T13] raw: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 95.210515][ T13] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 95.214005][ T13] head: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 95.217576][ T13] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 95.221167][ T13] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 95.224863][ T13] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 95.228435][ T13] page dumped because: kasan: bad access detected [ 95.231219][ T13] page_owner tracks the page as allocated [ 95.233723][ T13] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 17235372026 [ 95.241901][ T13] post_alloc_hook+0x1f9/0x250 [ 95.244038][ T13] get_page_from_freelist+0x2209/0x2280 [ 95.246428][ T13] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 95.249077][ T13] allocate_slab+0x7c/0x5e0 [ 95.251087][ T13] refill_objects+0x2d5/0x350 [ 95.253180][ T13] __pcs_replace_empty_main+0x2c3/0x6b0 [ 95.255547][ T13] __kmalloc_noprof+0x489/0x720 [ 95.257625][ T13] __usb_create_hcd+0x67/0x900 [ 95.259807][ T13] vhci_hcd_probe+0x104/0x3e0 [ 95.261879][ T13] platform_probe+0xf9/0x190 [ 95.263966][ T13] really_probe+0x254/0xae0 [ 95.265860][ T13] __driver_probe_device+0x1e8/0x360 [ 95.268063][ T13] driver_probe_device+0x4f/0x240 [ 95.270225][ T13] __device_attach_driver+0x270/0x410 [ 95.272473][ T13] bus_for_each_drv+0x258/0x2f0 [ 95.274607][ T13] __device_attach+0x2c4/0x450 [ 95.276801][ T13] page last free pid 1 tgid 1 ts 17232284235 stack trace: [ 95.279929][ T13] __free_frozen_pages+0xc93/0xd90 [ 95.282401][ T13] __slab_free+0x274/0x2c0 [ 95.284557][ T13] qlist_free_all+0x99/0x100 [ 95.286628][ T13] kasan_quarantine_reduce+0x148/0x160 [ 95.288954][ T13] __kasan_slab_alloc+0x22/0x80 [ 95.291038][ T13] __kmalloc_noprof+0x315/0x720 [ 95.293192][ T13] __alloc_workqueue+0x111/0x1fe0 [ 95.295409][ T13] alloc_workqueue_noprof+0xe3/0x210 [ 95.297709][ T13] usbip_init_eh+0x26/0x60 [ 95.299597][ T13] do_one_initcall+0x250/0x870 [ 95.301697][ T13] do_initcall_level+0x10a/0x1a0 [ 95.303910][ T13] do_initcalls+0x59/0xa0 [ 95.305823][ T13] kernel_init_freeable+0x29d/0x3e0 [ 95.308031][ T13] kernel_init+0x22/0x1d0 [ 95.309921][ T13] ret_from_fork+0x514/0xb70 [ 95.311942][ T13] ret_from_fork_asm+0x1a/0x30 [ 95.314111][ T13] [ 95.315197][ T13] Memory state around the buggy address: [ 95.317594][ T13] ffff888034e98d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.320868][ T13] ffff888034e98d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.324199][ T13] >ffff888034e98e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.327476][ T13] ^ [ 95.330802][ T13] ffff888034e98e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.334277][ T13] ffff888034e98f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.337799][ T13] ================================================================== [ 95.341915][ T5310] usb usb6: USB disconnect, device number 1 [ 95.383773][ T5310] vhci_hcd vhci_hcd.0: USB bus 6 deregistered