program: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x800, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) recvmmsg(r4, &(0x7f0000000180), 0x0, 0x141, 0x0) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x6, 0x10, &(0x7f0000000000)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r5}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1ab92b}, {0x85, 0x0, 0x0, 0x8}, {0x4}}, {{0x5, 0x0, 0x4, 0x9, 0x0, 0x1, 0x2000}}, [@call={0x85, 0x0, 0x0, 0xa9}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x9}, {0x85, 0x0, 0x0, 0xa4}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) write(r6, &(0x7f0000000300)='vhci_hcd.0\x00', 0xb) ioctl(r3, 0x4048aecb, &(0x7f0000600100)="070000000000000001000000ffffffff") close_range(r0, 0xffffffffffffffff, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r7, 0x0, 0x0, 0x20000845, &(0x7f0000b63fe4)={0xa, 0x4e24}, 0x1c) r8 = dup(r7) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="c134b168c44b56b661cf624e8b62ea82ecd7110c514f52536b8ef8ffa47e89f19275746c558ecf489c454be52c596c7f0db2d01dcdf90bdb1ca81314b45161060fc372ee9bbb0f8f957dca87a0b2e5c2"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000004a40)={0xc, 0x0, &(0x7f0000000440)=[@free_buffer], 0x0, 0x0, 0x0}) r9 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) r10 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r9, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r9, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r9, 0xc0306201, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="c134b168c44b56b661cf624e8b62ea82ecd7110c514f52536b8ef8ffa47e89f19275746c558ecf489c454be52c596c7f0db2d01dcdf90bdb1ca81314b45161060fc372ee9bbb0f8f957dca87a0b2e5c2"}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000001800)={0x74, 0x0, &(0x7f0000001680)=[@acquire_done={0x40106309, 0x2}, @free_buffer, @register_looper, @free_buffer={0x40086303, r10}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000080)={@fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x1, 0x1}, @flat=@handle={0x73682a85, 0x1, 0x1}}, &(0x7f0000001640)={0x0, 0x18, 0x30}}}], 0xed, 0x0, &(0x7f0000001700)="b472e2a62aa0f92d0c9a30cc39e849957582c1693108ac46bfbfbec1a20e142d6a6b3cc9ba31fbcc3acb75959baeca2dce939899f0d18067b0dd8556654233647f0720de0c450c2658a7a5e8c9dc5c669d151e329258244d322ea578a1393f362b7965bfc07f0762d5941e225886c836ff970d3cd5f45fdce660f2a93ef4e5705719d88276079d620fb63c5e989b776a5b28b094ad6b892878b8e82d0f020e8a25614b83f0bf3a8641252ffce133f4147b03d6194becb3c0ce882a91fc41fa828187d427cbe40a8ffe76ebff2cc50f800662c59b750c2077ff0ee8c00197edd4a3add0c26def61f2791c4c8833"}) connect$unix(r8, &(0x7f0000002200)=@file={0x0, './file0\x00'}, 0x6e) ioctl$KVM_CLEAR_DIRTY_LOG(r7, 0xc018aec0, &(0x7f0000000840)={0x10003, 0x140, 0x400, &(0x7f0000000440)=[0x0, 0x10001, 0x9, 0x2, 0x0, 0xc8e, 0x3, 0xb, 0x0, 0x8000000000, 0x3, 0x6, 0x7, 0x4, 0xffffffff, 0x8, 0x494, 0x1ff, 0xf, 0x100000000dc7, 0x7fffffff, 0x3183, 0xb, 0x61a, 0x7, 0x0, 0x73d4, 0x7, 0xff, 0xffffffff, 0x7, 0x11, 0x7, 0x4, 0xffffffffbfd8d73a, 0x3, 0x1, 0x4, 0xd, 0x2, 0x3, 0x3ff, 0x50000000000, 0x80000000, 0x1, 0x1, 0x5, 0x7, 0x9, 0x40, 0x2, 0x19a, 0x7, 0x4, 0xd, 0x9, 0x3, 0xffffffffffff30f4, 0x1, 0x8001000000, 0x3, 0x80, 0x0, 0x4, 0x6c, 0xffff, 0x6, 0x2, 0x2e4, 0x5, 0x5, 0xc, 0x4, 0x6e00, 0x1, 0x1, 0x9, 0x2, 0x6, 0x13, 0x7fff, 0x200000000008, 0x8, 0x4, 0x8, 0xb, 0x74, 0x0, 0x535b8000000000, 0x4200, 0x18000000000, 0x1, 0xf7b, 0x7, 0x0, 0x100000000, 0x7fff, 0x2, 0x10001, 0x0, 0x0, 0xbb, 0x2, 0x7f, 0x1, 0x5, 0x9, 0x7, 0x0, 0xb, 0xfff, 0x6, 0x10000, 0x5, 0xfffffffffffffff8, 0x1, 0x40, 0x2, 0x401, 0x3, 0x1, 0xaceb, 0x2, 0x9, 0x0, 0x2, 0x3, 0x9]}) [ 92.773840][ T4636] Bluetooth: hci0: command tx timeout [ 92.798978][ T9] cfg80211: failed to load regulatory.db [ 93.018637][ T5316] vhci_hcd vhci_hcd.0: remove, state 4 [ 93.021420][ T5316] usb usb7: USB disconnect, device number 1 [ 93.123235][ T5318] cover enable write trace failed, mode=0 [ 93.123275][ T5318] (errno 9) [ 93.133375][ T30] vhci_hcd vhci_hcd.0: stop threads [ 93.137377][ T30] vhci_hcd vhci_hcd.0: release socket [ 93.140519][ T30] vhci_hcd vhci_hcd.0: disconnect device [ 93.143488][ T30] vhci_hcd vhci_hcd.0: stop threads [ 93.148910][ T30] vhci_hcd vhci_hcd.0: release socket [ 93.151226][ T30] vhci_hcd vhci_hcd.0: disconnect device [ 93.154452][ T30] vhci_hcd vhci_hcd.0: stop threads [ 93.157267][ T30] vhci_hcd vhci_hcd.0: release socket [ 93.161356][ T30] vhci_hcd vhci_hcd.0: disconnect device [ 93.164298][ T5316] vhci_hcd vhci_hcd.0: USB bus 7 deregistered [ 93.167936][ T30] vhci_hcd vhci_hcd.0: stop threads [ 93.169957][ T30] vhci_hcd vhci_hcd.0: release socket [ 93.172199][ T30] vhci_hcd vhci_hcd.0: disconnect device [ 93.178917][ T30] vhci_hcd vhci_hcd.0: stop threads [ 93.185036][ T30] vhci_hcd vhci_hcd.0: release socket [ 93.189792][ T5316] vhci_hcd vhci_hcd.0: remove, state 4 [ 93.199217][ T30] ================================================================== [ 93.202457][ T30] BUG: KASAN: slab-use-after-free in vhci_cleanup_unlink_list+0x452/0x460 [ 93.205851][ T30] Read of size 4 at addr ffff888034b28d90 by task kworker/u4:2/30 [ 93.209021][ T30] [ 93.210009][ T30] CPU: 0 UID: 0 PID: 30 Comm: kworker/u4:2 Not tainted syzkaller #0 PREEMPT(full) [ 93.210024][ T30] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.210032][ T30] Workqueue: usbip_event event_handler [ 93.210050][ T30] Call Trace: [ 93.210057][ T30] [ 93.210063][ T30] dump_stack_lvl+0xe8/0x150 [ 93.210080][ T30] print_address_description+0x55/0x1e0 [ 93.210095][ T30] ? vhci_cleanup_unlink_list+0x452/0x460 [ 93.210106][ T30] print_report+0x58/0x70 [ 93.210119][ T30] kasan_report+0x117/0x150 [ 93.210132][ T30] ? vhci_cleanup_unlink_list+0x452/0x460 [ 93.210146][ T30] vhci_cleanup_unlink_list+0x452/0x460 [ 93.210158][ T30] ? kasan_quarantine_put+0xbb/0x1f0 [ 93.210170][ T30] vhci_shutdown_connection+0x2af/0x650 [ 93.210182][ T30] event_handler+0x2a4/0x4b0 [ 93.210192][ T30] ? process_scheduled_works+0xa1a/0x14c0 [ 93.210204][ T30] process_scheduled_works+0xa88/0x14c0 [ 93.210222][ T30] ? __pfx_process_scheduled_works+0x10/0x10 [ 93.210235][ T30] ? assign_work+0x3cf/0x5d0 [ 93.210246][ T30] worker_thread+0xa47/0xfb0 [ 93.210264][ T30] kthread+0x38b/0x480 [ 93.210279][ T30] ? __pfx_worker_thread+0x10/0x10 [ 93.210290][ T30] ? __pfx_kthread+0x10/0x10 [ 93.210304][ T30] ret_from_fork+0x514/0xb70 [ 93.210319][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 93.210332][ T30] ? __switch_to+0xc89/0x1420 [ 93.210344][ T30] ? __pfx_kthread+0x10/0x10 [ 93.210358][ T30] ret_from_fork_asm+0x1a/0x30 [ 93.210374][ T30] [ 93.210378][ T30] [ 93.270762][ T30] Allocated by task 1: [ 93.272389][ T30] kasan_save_track+0x3e/0x80 [ 93.274191][ T30] __kasan_kmalloc+0x93/0xb0 [ 93.276091][ T30] __kmalloc_noprof+0x379/0x720 [ 93.278083][ T30] __usb_create_hcd+0x67/0x900 [ 93.280108][ T30] vhci_hcd_probe+0x1e6/0x3e0 [ 93.282102][ T30] platform_probe+0xf9/0x190 [ 93.284094][ T30] really_probe+0x254/0xae0 [ 93.285978][ T30] __driver_probe_device+0x1e8/0x360 [ 93.288251][ T30] driver_probe_device+0x4f/0x240 [ 93.290438][ T30] __device_attach_driver+0x270/0x410 [ 93.292696][ T30] bus_for_each_drv+0x258/0x2f0 [ 93.294727][ T30] __device_attach+0x2c4/0x450 [ 93.296804][ T30] device_initial_probe+0xa1/0xd0 [ 93.298799][ T30] bus_probe_device+0x12a/0x220 [ 93.300785][ T30] device_add+0x7d7/0xb80 [ 93.302594][ T30] platform_device_add+0x4bd/0x860 [ 93.304807][ T30] platform_device_register_full+0x53a/0x620 [ 93.307414][ T30] vhci_hcd_init+0x227/0x360 [ 93.309595][ T30] do_one_initcall+0x250/0x870 [ 93.311706][ T30] do_initcall_level+0x10a/0x1a0 [ 93.313913][ T30] do_initcalls+0x59/0xa0 [ 93.315704][ T30] kernel_init_freeable+0x29d/0x3e0 [ 93.317956][ T30] kernel_init+0x22/0x1d0 [ 93.319900][ T30] ret_from_fork+0x514/0xb70 [ 93.321910][ T30] ret_from_fork_asm+0x1a/0x30 [ 93.323959][ T30] [ 93.324976][ T30] Freed by task 5316: [ 93.328209][ T30] kasan_save_track+0x3e/0x80 [ 93.330254][ T30] kasan_save_free_info+0x40/0x50 [ 93.332440][ T30] __kasan_slab_free+0x5c/0x80 [ 93.334553][ T30] kfree+0x1c5/0x640 [ 93.336321][ T30] vhci_hcd_remove+0x9e/0x110 [ 93.338325][ T30] device_release_driver_internal+0x48b/0x880 [ 93.341065][ T30] unbind_store+0x1a1/0x1d0 [ 93.342727][ T30] kernfs_fop_write_iter+0x3a4/0x540 [ 93.344870][ T30] vfs_write+0x612/0xba0 [ 93.346693][ T30] ksys_write+0x150/0x270 [ 93.348450][ T30] do_syscall_64+0x166/0x520 [ 93.350430][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.352969][ T30] [ 93.353991][ T30] Last potentially related work creation: [ 93.356433][ T30] kasan_save_stack+0x3e/0x60 [ 93.358357][ T30] kasan_record_aux_stack+0xbd/0xd0 [ 93.360596][ T30] insert_work+0x3d/0x330 [ 93.362354][ T30] __queue_work+0xcda/0x10a0 [ 93.364306][ T30] queue_work_on+0x106/0x1d0 [ 93.366413][ T30] unlink1+0x344/0x3e0 [ 93.368273][ T30] usb_hcd_unlink_urb+0xe6/0x1e0 [ 93.370241][ T30] usb_kill_urb+0x10b/0x2f0 [ 93.372228][ T30] hub_quiesce+0x211/0x330 [ 93.374142][ T30] hub_suspend+0x904/0xad0 [ 93.376083][ T30] usb_suspend_both+0x285/0x1040 [ 93.378221][ T30] usb_runtime_suspend+0x58/0x110 [ 93.380366][ T30] __rpm_callback+0x2c7/0x950 [ 93.382375][ T30] rpm_suspend+0x89d/0x17a0 [ 93.384271][ T30] __pm_runtime_suspend+0x12f/0x1a0 [ 93.386474][ T30] usb_new_device+0xaee/0x1690 [ 93.388526][ T30] register_root_hub+0x250/0x5c0 [ 93.390565][ T30] usb_add_hcd+0xac7/0xf80 [ 93.392680][ T30] vhci_hcd_probe+0x1fa/0x3e0 [ 93.395288][ T30] platform_probe+0xf9/0x190 [ 93.397513][ T30] really_probe+0x254/0xae0 [ 93.399483][ T30] __driver_probe_device+0x1e8/0x360 [ 93.401908][ T30] driver_probe_device+0x4f/0x240 [ 93.403947][ T30] __device_attach_driver+0x270/0x410 [ 93.406142][ T30] bus_for_each_drv+0x258/0x2f0 [ 93.408154][ T30] __device_attach+0x2c4/0x450 [ 93.410167][ T30] device_initial_probe+0xa1/0xd0 [ 93.412333][ T30] bus_probe_device+0x12a/0x220 [ 93.414290][ T30] device_add+0x7d7/0xb80 [ 93.416202][ T30] platform_device_add+0x4bd/0x860 [ 93.418531][ T30] platform_device_register_full+0x53a/0x620 [ 93.421080][ T30] vhci_hcd_init+0x227/0x360 [ 93.423047][ T30] do_one_initcall+0x250/0x870 [ 93.425123][ T30] do_initcall_level+0x10a/0x1a0 [ 93.427229][ T30] do_initcalls+0x59/0xa0 [ 93.429056][ T30] kernel_init_freeable+0x29d/0x3e0 [ 93.431292][ T30] kernel_init+0x22/0x1d0 [ 93.433021][ T30] ret_from_fork+0x514/0xb70 [ 93.434957][ T30] ret_from_fork_asm+0x1a/0x30 [ 93.437063][ T30] [ 93.438118][ T30] Second to last potentially related work creation: [ 93.440892][ T30] kasan_save_stack+0x3e/0x60 [ 93.442792][ T30] kasan_record_aux_stack+0xbd/0xd0 [ 93.444905][ T30] insert_work+0x3d/0x330 [ 93.446826][ T30] __queue_work+0xcda/0x10a0 [ 93.448761][ T30] queue_work_on+0x106/0x1d0 [ 93.450734][ T30] usb_hcd_submit_urb+0xa3b/0x1b60 [ 93.452862][ T30] usb_start_wait_urb+0x13f/0x5b0 [ 93.454988][ T30] usb_control_msg+0x234/0x3e0 [ 93.457106][ T30] hub_suspend+0x891/0xad0 [ 93.458981][ T30] usb_suspend_both+0x285/0x1040 [ 93.461122][ T30] usb_runtime_suspend+0x58/0x110 [ 93.463229][ T30] __rpm_callback+0x2c7/0x950 [ 93.465091][ T30] rpm_suspend+0x89d/0x17a0 [ 93.466984][ T30] __pm_runtime_suspend+0x12f/0x1a0 [ 93.469098][ T30] usb_new_device+0xaee/0x1690 [ 93.471051][ T30] register_root_hub+0x250/0x5c0 [ 93.473129][ T30] usb_add_hcd+0xac7/0xf80 [ 93.474895][ T30] vhci_hcd_probe+0x1fa/0x3e0 [ 93.476954][ T30] platform_probe+0xf9/0x190 [ 93.478950][ T30] really_probe+0x254/0xae0 [ 93.480800][ T30] __driver_probe_device+0x1e8/0x360 [ 93.482943][ T30] driver_probe_device+0x4f/0x240 [ 93.485011][ T30] __device_attach_driver+0x270/0x410 [ 93.487227][ T30] bus_for_each_drv+0x258/0x2f0 [ 93.489264][ T30] __device_attach+0x2c4/0x450 [ 93.491422][ T30] device_initial_probe+0xa1/0xd0 [ 93.493753][ T30] bus_probe_device+0x12a/0x220 [ 93.495898][ T30] device_add+0x7d7/0xb80 [ 93.497677][ T30] platform_device_add+0x4bd/0x860 [ 93.499765][ T30] platform_device_register_full+0x53a/0x620 [ 93.502226][ T30] vhci_hcd_init+0x227/0x360 [ 93.504255][ T30] do_one_initcall+0x250/0x870 [ 93.506335][ T30] do_initcall_level+0x10a/0x1a0 [ 93.508450][ T30] do_initcalls+0x59/0xa0 [ 93.510219][ T30] kernel_init_freeable+0x29d/0x3e0 [ 93.512313][ T30] kernel_init+0x22/0x1d0 [ 93.514074][ T30] ret_from_fork+0x514/0xb70 [ 93.516024][ T30] ret_from_fork_asm+0x1a/0x30 [ 93.518073][ T30] [ 93.519095][ T30] The buggy address belongs to the object at ffff888034b28000 [ 93.519095][ T30] which belongs to the cache kmalloc-8k of size 8192 [ 93.524811][ T30] The buggy address is located 3472 bytes inside of [ 93.524811][ T30] freed 8192-byte region [ffff888034b28000, ffff888034b2a000) [ 93.530463][ T30] [ 93.531448][ T30] The buggy address belongs to the physical page: [ 93.534001][ T30] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34b28 [ 93.537728][ T30] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 93.541129][ T30] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 93.544098][ T30] page_type: f5(slab) [ 93.545746][ T30] raw: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 93.549359][ T30] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 93.552841][ T30] head: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 93.556487][ T30] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 93.559976][ T30] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 93.563562][ T30] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 93.567528][ T30] page dumped because: kasan: bad access detected [ 93.570262][ T30] page_owner tracks the page as allocated [ 93.572646][ T30] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 16395048038, free_ts 16380441757 [ 93.580857][ T30] post_alloc_hook+0x1f9/0x250 [ 93.582923][ T30] get_page_from_freelist+0x21fe/0x2270 [ 93.585123][ T30] __alloc_frozen_pages_noprof+0x18d/0x380 [ 93.587472][ T30] allocate_slab+0x79/0x5e0 [ 93.589268][ T30] refill_objects+0x2d5/0x350 [ 93.591122][ T30] __pcs_replace_empty_main+0x2c3/0x6b0 [ 93.593383][ T30] __kmalloc_noprof+0x489/0x720 [ 93.595432][ T30] __usb_create_hcd+0x67/0x900 [ 93.597455][ T30] vhci_hcd_probe+0x104/0x3e0 [ 93.599362][ T30] platform_probe+0xf9/0x190 [ 93.601199][ T30] really_probe+0x254/0xae0 [ 93.603002][ T30] __driver_probe_device+0x1e8/0x360 [ 93.605091][ T30] driver_probe_device+0x4f/0x240 [ 93.607217][ T30] __device_attach_driver+0x270/0x410 [ 93.609421][ T30] bus_for_each_drv+0x258/0x2f0 [ 93.611420][ T30] __device_attach+0x2c4/0x450 [ 93.613388][ T30] page last free pid 1 tgid 1 stack trace: [ 93.615743][ T30] __free_frozen_pages+0xc22/0xd20 [ 93.617827][ T30] __slab_free+0x274/0x2c0 [ 93.619645][ T30] qlist_free_all+0x99/0x100 [ 93.621616][ T30] kasan_quarantine_reduce+0x148/0x160 [ 93.623884][ T30] __kasan_slab_alloc+0x22/0x80 [ 93.625846][ T30] __kmalloc_cache_noprof+0x2af/0x660 [ 93.627875][ T30] device_create_with_groups+0x13d/0x300 [ 93.630006][ T30] misc_register+0x2f7/0x560 [ 93.631825][ T30] do_one_initcall+0x250/0x870 [ 93.633674][ T30] do_initcall_level+0x10a/0x1a0 [ 93.635678][ T30] do_initcalls+0x59/0xa0 [ 93.637429][ T30] kernel_init_freeable+0x29d/0x3e0 [ 93.639548][ T30] kernel_init+0x22/0x1d0 [ 93.641179][ T30] ret_from_fork+0x514/0xb70 [ 93.642934][ T30] ret_from_fork_asm+0x1a/0x30 [ 93.644803][ T30] [ 93.645742][ T30] Memory state around the buggy address: [ 93.647859][ T30] ffff888034b28c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 93.650992][ T30] ffff888034b28d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 93.654081][ T30] >ffff888034b28d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 93.657390][ T30] ^ [ 93.659248][ T30] ffff888034b28e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 93.662550][ T30] ffff888034b28e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 93.665922][ T30] ================================================================== [ 93.670078][ T5316] usb usb6: USB disconnect, device number 1 [ 93.730230][ T5316] vhci_hcd vhci_hcd.0: USB bus 6 deregistered