program: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x801) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x4e071, 0xffffffffffffffff, 0x80000000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='pids.events\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000000), 0x208e24b) ioctl$VIDIOC_S_JPEGCOMP(r1, 0x408c563e, &(0x7f0000000140)={0x555, 0x0, 0xf, "023324dc67635e3f40a784b6389d89cc8e2531eeeb83a84202f003afaabe72230132884bfe478347e7bf5e5cfbaff12803ebfbe8096bc0382ad157a3", 0x36, "24bba61ef9a504f3653a0f76996035fc7e553525b229a94e0c6d4153da87fe86611113ffa577129f14edff31111866ec880af6363e0940ad3a309026", 0x84}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000300)='vhci_hcd.0\x00', 0xb) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x0, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000100)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000339000/0x1000)=nil, 0x800000}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) (async) userfaultfd(0x801) (async) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x4e071, 0xffffffffffffffff, 0x80000000) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='pids.events\x00', 0x275a, 0x0) (async) write$binfmt_script(r1, &(0x7f0000000000), 0x208e24b) (async) ioctl$VIDIOC_S_JPEGCOMP(r1, 0x408c563e, &(0x7f0000000140)={0x555, 0x0, 0xf, "023324dc67635e3f40a784b6389d89cc8e2531eeeb83a84202f003afaabe72230132884bfe478347e7bf5e5cfbaff12803ebfbe8096bc0382ad157a3", 0x36, "24bba61ef9a504f3653a0f76996035fc7e553525b229a94e0c6d4153da87fe86611113ffa577129f14edff31111866ec880af6363e0940ad3a309026", 0x84}) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) (async) write(r2, &(0x7f0000000300)='vhci_hcd.0\x00', 0xb) (async) openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)) (async) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x0, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)) (async) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) (async) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) (async) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000100)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000339000/0x1000)=nil, 0x800000}) (async) [ 94.883214][ T4643] Bluetooth: hci0: command tx timeout [ 95.140310][ T5319] vhci_hcd vhci_hcd.0: remove, state 4 [ 95.153605][ T5319] usb usb7: USB disconnect, device number 1 [ 95.287927][ T53] vhci_hcd vhci_hcd.0: stop threads [ 95.291328][ T53] vhci_hcd vhci_hcd.0: release socket [ 95.296909][ T53] vhci_hcd vhci_hcd.0: disconnect device [ 95.300014][ T53] vhci_hcd vhci_hcd.0: stop threads [ 95.304023][ T5319] vhci_hcd vhci_hcd.0: USB bus 7 deregistered [ 95.306675][ T53] vhci_hcd vhci_hcd.0: release socket [ 95.311756][ T53] vhci_hcd vhci_hcd.0: disconnect device [ 95.328908][ T53] vhci_hcd vhci_hcd.0: stop threads [ 95.339704][ T53] vhci_hcd vhci_hcd.0: release socket [ 95.342873][ T5319] vhci_hcd vhci_hcd.0: remove, state 4 [ 95.346050][ T53] ================================================================== [ 95.349265][ T53] BUG: KASAN: slab-use-after-free in vhci_cleanup_unlink_list+0x452/0x460 [ 95.352829][ T53] Read of size 4 at addr ffff8880370388f0 by task kworker/u4:4/53 [ 95.356103][ T53] [ 95.357155][ T53] CPU: 0 UID: 0 PID: 53 Comm: kworker/u4:4 Not tainted syzkaller #0 PREEMPT(full) [ 95.357170][ T53] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.357178][ T53] Workqueue: usbip_event event_handler [ 95.357194][ T53] Call Trace: [ 95.357201][ T53] [ 95.357206][ T53] dump_stack_lvl+0xe8/0x150 [ 95.357223][ T53] print_address_description+0x55/0x1e0 [ 95.357238][ T53] ? vhci_cleanup_unlink_list+0x452/0x460 [ 95.357250][ T53] print_report+0x58/0x70 [ 95.357263][ T53] kasan_report+0x117/0x150 [ 95.357278][ T53] ? vhci_cleanup_unlink_list+0x452/0x460 [ 95.357292][ T53] vhci_cleanup_unlink_list+0x452/0x460 [ 95.357304][ T53] ? kasan_quarantine_put+0xbb/0x1f0 [ 95.357318][ T53] vhci_shutdown_connection+0x2af/0x650 [ 95.357332][ T53] event_handler+0x2a4/0x4b0 [ 95.357343][ T53] ? process_scheduled_works+0x97a/0x1630 [ 95.357356][ T53] process_scheduled_works+0xc3d/0x1630 [ 95.357375][ T53] ? __pfx_process_scheduled_works+0x10/0x10 [ 95.357389][ T53] ? assign_work+0x3cf/0x5d0 [ 95.357402][ T53] worker_thread+0xa47/0xfb0 [ 95.357446][ T53] ? __kthread_parkme+0x71/0x1f0 [ 95.357464][ T53] kthread+0x38b/0x480 [ 95.357479][ T53] ? __pfx_worker_thread+0x10/0x10 [ 95.357492][ T53] ? __pfx_kthread+0x10/0x10 [ 95.357507][ T53] ret_from_fork+0x514/0xb70 [ 95.357523][ T53] ? __pfx_ret_from_fork+0x10/0x10 [ 95.357537][ T53] ? __switch_to+0xc89/0x1420 [ 95.357550][ T53] ? __pfx_kthread+0x10/0x10 [ 95.357564][ T53] ret_from_fork_asm+0x1a/0x30 [ 95.357584][ T53] [ 95.357588][ T53] [ 95.422564][ T53] Allocated by task 1: [ 95.424253][ T53] kasan_save_track+0x3e/0x80 [ 95.426272][ T53] __kasan_kmalloc+0x93/0xb0 [ 95.428167][ T53] __kmalloc_noprof+0x379/0x720 [ 95.430105][ T53] __usb_create_hcd+0x67/0x900 [ 95.432138][ T53] vhci_hcd_probe+0x1e6/0x3e0 [ 95.434139][ T53] platform_probe+0xf9/0x190 [ 95.436162][ T53] really_probe+0x254/0xae0 [ 95.438112][ T53] __driver_probe_device+0x1e8/0x360 [ 95.440365][ T53] driver_probe_device+0x4f/0x240 [ 95.442498][ T53] __device_attach_driver+0x270/0x410 [ 95.444773][ T53] bus_for_each_drv+0x258/0x2f0 [ 95.446857][ T53] __device_attach+0x2c4/0x450 [ 95.448820][ T53] device_initial_probe+0xa1/0xd0 [ 95.450880][ T53] bus_probe_device+0x12a/0x220 [ 95.452881][ T53] device_add+0x7d7/0xb80 [ 95.454663][ T53] platform_device_add+0x4bd/0x860 [ 95.456801][ T53] platform_device_register_full+0x53a/0x620 [ 95.459300][ T53] vhci_hcd_init+0x227/0x360 [ 95.461363][ T53] do_one_initcall+0x250/0x870 [ 95.463331][ T53] do_initcall_level+0x10a/0x1a0 [ 95.465354][ T53] do_initcalls+0x59/0xa0 [ 95.467096][ T53] kernel_init_freeable+0x29d/0x3e0 [ 95.469257][ T53] kernel_init+0x22/0x1d0 [ 95.470999][ T53] ret_from_fork+0x514/0xb70 [ 95.472850][ T53] ret_from_fork_asm+0x1a/0x30 [ 95.474834][ T53] [ 95.475864][ T53] Freed by task 5319: [ 95.477598][ T53] kasan_save_track+0x3e/0x80 [ 95.479569][ T53] kasan_save_free_info+0x40/0x50 [ 95.481704][ T53] __kasan_slab_free+0x5c/0x80 [ 95.483639][ T53] kfree+0x1c5/0x640 [ 95.485340][ T53] vhci_hcd_remove+0x9e/0x110 [ 95.487337][ T53] device_release_driver_internal+0x48b/0x880 [ 95.489857][ T53] unbind_store+0x1a1/0x1d0 [ 95.491761][ T53] kernfs_fop_write_iter+0x3a4/0x540 [ 95.493971][ T53] vfs_write+0x612/0xba0 [ 95.495792][ T53] ksys_write+0x150/0x270 [ 95.497556][ T53] do_syscall_64+0x166/0x520 [ 95.499479][ T53] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.501921][ T53] [ 95.502923][ T53] Last potentially related work creation: [ 95.505295][ T53] kasan_save_stack+0x3e/0x60 [ 95.507332][ T53] kasan_record_aux_stack+0xbd/0xd0 [ 95.509448][ T53] insert_work+0x3d/0x330 [ 95.511271][ T53] __queue_work+0xd07/0x10d0 [ 95.513215][ T53] queue_work_on+0x106/0x1d0 [ 95.515152][ T53] unlink1+0x344/0x3e0 [ 95.516853][ T53] usb_hcd_unlink_urb+0xe6/0x1e0 [ 95.518942][ T53] usb_kill_urb+0x10b/0x2f0 [ 95.520869][ T53] hub_quiesce+0x211/0x330 [ 95.522774][ T53] hub_suspend+0x904/0xad0 [ 95.524627][ T53] usb_suspend_both+0x285/0x1040 [ 95.526682][ T53] usb_runtime_suspend+0x58/0x110 [ 95.528757][ T53] __rpm_callback+0x2c7/0x950 [ 95.530790][ T53] rpm_suspend+0x89d/0x17a0 [ 95.532764][ T53] __pm_runtime_suspend+0x12f/0x1a0 [ 95.534935][ T53] usb_new_device+0xaee/0x1690 [ 95.536943][ T53] register_root_hub+0x250/0x5c0 [ 95.539016][ T53] usb_add_hcd+0xac7/0xf80 [ 95.540847][ T53] vhci_hcd_probe+0x1fa/0x3e0 [ 95.542802][ T53] platform_probe+0xf9/0x190 [ 95.544703][ T53] really_probe+0x254/0xae0 [ 95.546664][ T53] __driver_probe_device+0x1e8/0x360 [ 95.548862][ T53] driver_probe_device+0x4f/0x240 [ 95.551025][ T53] __device_attach_driver+0x270/0x410 [ 95.553271][ T53] bus_for_each_drv+0x258/0x2f0 [ 95.555334][ T53] __device_attach+0x2c4/0x450 [ 95.557330][ T53] device_initial_probe+0xa1/0xd0 [ 95.559412][ T53] bus_probe_device+0x12a/0x220 [ 95.561449][ T53] device_add+0x7d7/0xb80 [ 95.563255][ T53] platform_device_add+0x4bd/0x860 [ 95.565238][ T53] platform_device_register_full+0x53a/0x620 [ 95.567596][ T53] vhci_hcd_init+0x227/0x360 [ 95.569504][ T53] do_one_initcall+0x250/0x870 [ 95.571519][ T53] do_initcall_level+0x10a/0x1a0 [ 95.573629][ T53] do_initcalls+0x59/0xa0 [ 95.575468][ T53] kernel_init_freeable+0x29d/0x3e0 [ 95.577661][ T53] kernel_init+0x22/0x1d0 [ 95.579391][ T53] ret_from_fork+0x514/0xb70 [ 95.581296][ T53] ret_from_fork_asm+0x1a/0x30 [ 95.583362][ T53] [ 95.584336][ T53] Second to last potentially related work creation: [ 95.587007][ T53] kasan_save_stack+0x3e/0x60 [ 95.588947][ T53] kasan_record_aux_stack+0xbd/0xd0 [ 95.591126][ T53] insert_work+0x3d/0x330 [ 95.592894][ T53] __queue_work+0xd07/0x10d0 [ 95.594825][ T53] queue_work_on+0x106/0x1d0 [ 95.596758][ T53] usb_hcd_submit_urb+0xa3b/0x1b60 [ 95.598894][ T53] usb_start_wait_urb+0x13f/0x5b0 [ 95.600798][ T53] usb_control_msg+0x234/0x3e0 [ 95.602626][ T53] hub_suspend+0x891/0xad0 [ 95.604357][ T53] usb_suspend_both+0x285/0x1040 [ 95.606495][ T53] usb_runtime_suspend+0x58/0x110 [ 95.608605][ T53] __rpm_callback+0x2c7/0x950 [ 95.610560][ T53] rpm_suspend+0x89d/0x17a0 [ 95.612311][ T53] __pm_runtime_suspend+0x12f/0x1a0 [ 95.614358][ T53] usb_new_device+0xaee/0x1690 [ 95.616200][ T53] register_root_hub+0x250/0x5c0 [ 95.618141][ T53] usb_add_hcd+0xac7/0xf80 [ 95.619853][ T53] vhci_hcd_probe+0x1fa/0x3e0 [ 95.621763][ T53] platform_probe+0xf9/0x190 [ 95.623716][ T53] really_probe+0x254/0xae0 [ 95.625598][ T53] __driver_probe_device+0x1e8/0x360 [ 95.627753][ T53] driver_probe_device+0x4f/0x240 [ 95.629829][ T53] __device_attach_driver+0x270/0x410 [ 95.632004][ T53] bus_for_each_drv+0x258/0x2f0 [ 95.634100][ T53] __device_attach+0x2c4/0x450 [ 95.636127][ T53] device_initial_probe+0xa1/0xd0 [ 95.638152][ T53] bus_probe_device+0x12a/0x220 [ 95.640090][ T53] device_add+0x7d7/0xb80 [ 95.641754][ T53] platform_device_add+0x4bd/0x860 [ 95.643783][ T53] platform_device_register_full+0x53a/0x620 [ 95.646138][ T53] vhci_hcd_init+0x227/0x360 [ 95.647908][ T53] do_one_initcall+0x250/0x870 [ 95.649790][ T53] do_initcall_level+0x10a/0x1a0 [ 95.651763][ T53] do_initcalls+0x59/0xa0 [ 95.653540][ T53] kernel_init_freeable+0x29d/0x3e0 [ 95.655707][ T53] kernel_init+0x22/0x1d0 [ 95.657470][ T53] ret_from_fork+0x514/0xb70 [ 95.659326][ T53] ret_from_fork_asm+0x1a/0x30 [ 95.661383][ T53] [ 95.662411][ T53] The buggy address belongs to the object at ffff888037038000 [ 95.662411][ T53] which belongs to the cache kmalloc-8k of size 8192 [ 95.667918][ T53] The buggy address is located 2288 bytes inside of [ 95.667918][ T53] freed 8192-byte region [ffff888037038000, ffff88803703a000) [ 95.673461][ T53] [ 95.674494][ T53] The buggy address belongs to the physical page: [ 95.677179][ T53] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x37038 [ 95.680706][ T53] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 95.684124][ T53] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 95.687214][ T53] page_type: f5(slab) [ 95.688848][ T53] raw: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 95.692264][ T53] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 95.695535][ T53] head: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 95.698992][ T53] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 95.702466][ T53] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 95.705874][ T53] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 95.709341][ T53] page dumped because: kasan: bad access detected [ 95.712008][ T53] page_owner tracks the page as allocated [ 95.714285][ T53] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 17368810962 [ 95.721361][ T53] post_alloc_hook+0x1f9/0x250 [ 95.723259][ T53] get_page_from_freelist+0x2209/0x2280 [ 95.725372][ T53] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 95.727672][ T53] allocate_slab+0x7c/0x5e0 [ 95.729890][ T53] refill_objects+0x2d5/0x350 [ 95.732230][ T53] __pcs_replace_empty_main+0x2c3/0x6b0 [ 95.734645][ T53] __kmalloc_noprof+0x489/0x720 [ 95.736850][ T53] __usb_create_hcd+0x67/0x900 [ 95.739283][ T53] vhci_hcd_probe+0x104/0x3e0 [ 95.741715][ T53] platform_probe+0xf9/0x190 [ 95.744103][ T53] really_probe+0x254/0xae0 [ 95.746051][ T53] __driver_probe_device+0x1e8/0x360 [ 95.748174][ T53] driver_probe_device+0x4f/0x240 [ 95.750269][ T53] __device_attach_driver+0x270/0x410 [ 95.752300][ T53] bus_for_each_drv+0x258/0x2f0 [ 95.754334][ T53] __device_attach+0x2c4/0x450 [ 95.756381][ T53] page last free pid 9 tgid 9 ts 17351278646 stack trace: [ 95.759257][ T53] free_pages_prepare+0x9eb/0xaf0 [ 95.761276][ T53] __free_contig_range_common+0x174/0x340 [ 95.763580][ T53] free_pages_bulk+0x48/0x120 [ 95.765558][ T53] vfree+0x226/0x4a0 [ 95.767173][ T53] delayed_vfree_work+0x55/0x80 [ 95.769061][ T53] process_scheduled_works+0xc3d/0x1630 [ 95.771514][ T53] worker_thread+0xa47/0xfb0 [ 95.774032][ T53] kthread+0x38b/0x480 [ 95.776282][ T53] ret_from_fork+0x514/0xb70 [ 95.778555][ T53] ret_from_fork_asm+0x1a/0x30 [ 95.780583][ T53] [ 95.781664][ T53] Memory state around the buggy address: [ 95.783940][ T53] ffff888037038780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.787273][ T53] ffff888037038800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.790345][ T53] >ffff888037038880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.793345][ T53] ^ [ 95.796599][ T53] ffff888037038900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.799922][ T53] ffff888037038980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.803335][ T53] ================================================================== [ 95.807958][ T5319] usb usb6: USB disconnect, device number 1 [ 95.840355][ T5319] vhci_hcd vhci_hcd.0: USB bus 6 deregistered