Extracting prog: 2m6.0164608s
Minimizing prog: 19m29.958661376s
Simplifying prog options: 0s
Extracting C: 48.802695679s
Simplifying C: 9m37.276843825s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-syz_usb_connect-ioctl$FS_IOC_GETVERSION-close_range
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000080)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200de7e001009058b1e200202ed5905def6"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) (rerun: 64)
syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12"], 0x0) (rerun: 64)
ioctl$FS_IOC_GETVERSION(r1, 0xc0145b0e, &(0x7f0000000040)) (async, rerun: 64)
close_range(r1, 0xffffffffffffffff, 0x0)

program crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
single: successfully extracted reproducer
found reproducer with 6 syscalls
minimizing guilty program
testing program (duration=47.73242038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-syz_usb_connect-ioctl$FS_IOC_GETVERSION
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000080)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200de7e001009058b1e200202ed5905def6"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) (rerun: 64)
syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12"], 0x0) (rerun: 64)
ioctl$FS_IOC_GETVERSION(r1, 0xc0145b0e, &(0x7f0000000040)) (async, rerun: 64)

program did not crash
testing program (duration=47.73242038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-syz_usb_connect-close_range
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000080)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200de7e001009058b1e200202ed5905def6"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) (rerun: 64)
syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12"], 0x0) (rerun: 64)
close_range(r1, 0xffffffffffffffff, 0x0)

program did not crash
testing program (duration=47.73242038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-ioctl$FS_IOC_GETVERSION-close_range
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000080)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200de7e001009058b1e200202ed5905def6"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) (rerun: 64)
ioctl$FS_IOC_GETVERSION(r1, 0xc0145b0e, &(0x7f0000000040)) (async, rerun: 64)
close_range(r1, 0xffffffffffffffff, 0x0)

program did not crash
testing program (duration=47.73242038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_connect-ioctl$FS_IOC_GETVERSION-close_range
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000080)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200de7e001009058b1e200202ed5905def6"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12"], 0x0) (rerun: 64)
ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0xc0145b0e, &(0x7f0000000040)) (async, rerun: 64)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0)

program did not crash
testing program (duration=47.73242038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$char_usb-syz_usb_connect-ioctl$FS_IOC_GETVERSION-close_range
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x3f, &(0x7f0000000080)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200de7e001009058b1e200202ed5905def6"], 0x0)
r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) (rerun: 64)
syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12"], 0x0) (rerun: 64)
ioctl$FS_IOC_GETVERSION(r0, 0xc0145b0e, &(0x7f0000000040)) (async, rerun: 64)
close_range(r0, 0xffffffffffffffff, 0x0)

program did not crash
testing program (duration=47.73242038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_control_io-syz_open_dev$char_usb-syz_usb_connect-ioctl$FS_IOC_GETVERSION-close_range
detailed listing:
executing program 0:
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) (rerun: 64)
syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12"], 0x0) (rerun: 64)
ioctl$FS_IOC_GETVERSION(r0, 0xc0145b0e, &(0x7f0000000040)) (async, rerun: 64)
close_range(r0, 0xffffffffffffffff, 0x0)

program did not crash
testing program (duration=47.73242038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-syz_usb_connect-ioctl$FS_IOC_GETVERSION-close_range
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000080)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200de7e001009058b1e200202ed5905def6"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12"], 0x0)
ioctl$FS_IOC_GETVERSION(r1, 0xc0145b0e, &(0x7f0000000040))
close_range(r1, 0xffffffffffffffff, 0x0)

program did not crash
testing program (duration=47.73242038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-syz_usb_connect-ioctl$FS_IOC_GETVERSION-close_range
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x3f, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) (rerun: 64)
syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12"], 0x0) (rerun: 64)
ioctl$FS_IOC_GETVERSION(r1, 0xc0145b0e, &(0x7f0000000040)) (async, rerun: 64)
close_range(r1, 0xffffffffffffffff, 0x0)

program did not crash
testing program (duration=47.73242038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-syz_usb_connect-ioctl$FS_IOC_GETVERSION-close_range
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) (rerun: 64)
syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12"], 0x0) (rerun: 64)
ioctl$FS_IOC_GETVERSION(r1, 0xc0145b0e, &(0x7f0000000040)) (async, rerun: 64)
close_range(r1, 0xffffffffffffffff, 0x0)

program did not crash
testing program (duration=47.73242038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-syz_usb_connect-ioctl$FS_IOC_GETVERSION-close_range
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000080)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200de7e001009058b1e200202ed5905def6"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12"], 0x0) (rerun: 64)
ioctl$FS_IOC_GETVERSION(r1, 0xc0145b0e, &(0x7f0000000040)) (async, rerun: 64)
close_range(r1, 0xffffffffffffffff, 0x0)

program did not crash
testing program (duration=47.73242038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-syz_usb_connect-ioctl$FS_IOC_GETVERSION-close_range
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000080)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200de7e001009058b1e200202ed5905def6"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) (rerun: 64)
syz_usb_connect(0x0, 0x24, 0x0, 0x0) (rerun: 64)
ioctl$FS_IOC_GETVERSION(r1, 0xc0145b0e, &(0x7f0000000040)) (async, rerun: 64)
close_range(r1, 0xffffffffffffffff, 0x0)

program did not crash
testing program (duration=47.73242038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-syz_usb_connect-ioctl$FS_IOC_GETVERSION-close_range
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000080)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200de7e001009058b1e200202ed5905def6"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) (rerun: 64)
syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0) (rerun: 64)
ioctl$FS_IOC_GETVERSION(r1, 0xc0145b0e, &(0x7f0000000040)) (async, rerun: 64)
close_range(r1, 0xffffffffffffffff, 0x0)

program did not crash
testing program (duration=47.73242038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-syz_usb_connect-ioctl$FS_IOC_GETVERSION-close_range
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000080)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200de7e001009058b1e200202ed5905def6"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) (rerun: 64)
syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12"], 0x0)
ioctl$FS_IOC_GETVERSION(r1, 0xc0145b0e, &(0x7f0000000040)) (async, rerun: 64)
close_range(r1, 0xffffffffffffffff, 0x0)

program did not crash
testing program (duration=47.73242038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-syz_usb_connect-ioctl$FS_IOC_GETVERSION-close_range
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000080)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200de7e001009058b1e200202ed5905def6"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) (rerun: 64)
syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12"], 0x0) (rerun: 64)
ioctl$FS_IOC_GETVERSION(r1, 0xc0145b0e, 0x0) (async, rerun: 64)
close_range(r1, 0xffffffffffffffff, 0x0)

program did not crash
testing program (duration=47.73242038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-syz_usb_connect-ioctl$FS_IOC_GETVERSION-close_range
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000080)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200de7e001009058b1e200202ed5905def6"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) (rerun: 64)
syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12"], 0x0) (rerun: 64)
ioctl$FS_IOC_GETVERSION(r1, 0xc0145b0e, &(0x7f0000000040)) (rerun: 64)
close_range(r1, 0xffffffffffffffff, 0x0)

program crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
testing program (duration=47.73242038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-syz_usb_connect-ioctl$FS_IOC_GETVERSION-close_range
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000080)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200de7e001009058b1e200202ed5905def6"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) (rerun: 64)
syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12"], 0x0) (rerun: 64)
ioctl$FS_IOC_GETVERSION(r1, 0xc0145b0e, &(0x7f0000000040))
close_range(r1, 0xffffffffffffffff, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=47.73242038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-syz_usb_connect-ioctl$FS_IOC_GETVERSION-close_range
program crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
simplifying C reproducer
testing compiled C program (duration=47.73242038s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-syz_usb_connect-ioctl$FS_IOC_GETVERSION-close_range
program did not crash
testing compiled C program (duration=47.73242038s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-syz_usb_connect-ioctl$FS_IOC_GETVERSION-close_range
program did not crash
testing compiled C program (duration=47.73242038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-syz_usb_connect-ioctl$FS_IOC_GETVERSION-close_range
program did not crash
testing compiled C program (duration=47.73242038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-syz_usb_connect-ioctl$FS_IOC_GETVERSION-close_range
program crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
testing compiled C program (duration=47.73242038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-syz_usb_connect-ioctl$FS_IOC_GETVERSION-close_range
program crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
testing compiled C program (duration=47.73242038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-syz_usb_connect-ioctl$FS_IOC_GETVERSION-close_range
program crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
testing compiled C program (duration=47.73242038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-syz_usb_connect-ioctl$FS_IOC_GETVERSION-close_range
program crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
testing compiled C program (duration=47.73242038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-syz_usb_connect-ioctl$FS_IOC_GETVERSION-close_range
program crashed: KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
reproducing took 32m2.054685469s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
BUG: KASAN: slab-use-after-free in atomic_inc include/linux/atomic/atomic-instrumented.h:435 [inline]
BUG: KASAN: slab-use-after-free in usb_anchor_suspend_wakeups drivers/usb/core/urb.c:927 [inline]
BUG: KASAN: slab-use-after-free in usb_anchor_suspend_wakeups+0x28/0x40 drivers/usb/core/urb.c:924
Write of size 4 at addr ffff88802755e910 by task rcu_preempt/16

CPU: 1 UID: 0 PID: 16 Comm: rcu_preempt Not tainted 6.15.0-syzkaller-10401-gdee264c16a63 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xcd/0x680 mm/kasan/report.c:521
 kasan_report+0xe0/0x110 mm/kasan/report.c:634
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0x100/0x1b0 mm/kasan/generic.c:189
 instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
 atomic_inc include/linux/atomic/atomic-instrumented.h:435 [inline]
 usb_anchor_suspend_wakeups drivers/usb/core/urb.c:927 [inline]
 usb_anchor_suspend_wakeups+0x28/0x40 drivers/usb/core/urb.c:924
 __usb_hcd_giveback_urb+0x224/0x6e0 drivers/usb/core/hcd.c:1636
 usb_hcd_giveback_urb+0x39b/0x450 drivers/usb/core/hcd.c:1734
 dummy_timer+0x180e/0x3a20 drivers/usb/gadget/udc/dummy_hcd.c:1994
 __run_hrtimer kernel/time/hrtimer.c:1761 [inline]
 __hrtimer_run_queues+0x202/0xad0 kernel/time/hrtimer.c:1825
 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1842
 handle_softirqs+0x219/0x8e0 kernel/softirq.c:579
 __do_softirq kernel/softirq.c:613 [inline]
 invoke_softirq kernel/softirq.c:453 [inline]
 __irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1050
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lock_acquire+0x62/0x350 kernel/locking/lockdep.c:5875
Code: a6 32 12 83 f8 07 0f 87 bc 02 00 00 89 c0 48 0f a3 05 d2 0e 0f 0f 0f 82 74 02 00 00 8b 35 ba 40 0f 0f 85 f6 0f 85 8d 00 00 00 <48> 8b 44 24 30 65 48 2b 05 69 a6 32 12 0f 85 c7 02 00 00 48 83 c4
RSP: 0018:ffffc90000157b18 EFLAGS: 00000206
RAX: 0000000000000046 RBX: ffffffff8e491580 RCX: 00000000ffce192d
RDX: 0000000000000000 RSI: ffffffff8dde190c RDI: ffffffff8c1532c0
RBP: 0000000000000000 R08: 5a638b1d2248410d R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
 sched_submit_work kernel/sched/core.c:6815 [inline]
 schedule+0x21c/0x3a0 kernel/sched/core.c:6873
 schedule_timeout+0x123/0x290 kernel/time/sleep_timeout.c:99
 rcu_gp_fqs_loop+0x1ea/0xb00 kernel/rcu/tree.c:2054
 rcu_gp_kthread+0x270/0x380 kernel/rcu/tree.c:2256
 kthread+0x3c2/0x780 kernel/kthread.c:464
 ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 5837:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394
 kmalloc_noprof include/linux/slab.h:905 [inline]
 kzalloc_noprof include/linux/slab.h:1039 [inline]
 usbtmc_open+0xa9/0x9b0 drivers/usb/class/usbtmc.c:175
 usb_open+0x186/0x220 drivers/usb/core/file.c:47
 chrdev_open+0x234/0x6a0 fs/char_dev.c:414
 do_dentry_open+0x744/0x1c10 fs/open.c:964
 vfs_open+0x82/0x3f0 fs/open.c:1094
 do_open fs/namei.c:3887 [inline]
 path_openat+0x1de4/0x2cb0 fs/namei.c:4046
 do_filp_open+0x20b/0x470 fs/namei.c:4073
 do_sys_openat2+0x11b/0x1d0 fs/open.c:1437
 do_sys_open fs/open.c:1452 [inline]
 __do_sys_openat fs/open.c:1468 [inline]
 __se_sys_openat fs/open.c:1463 [inline]
 __x64_sys_openat+0x174/0x210 fs/open.c:1463
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 5845:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2380 [inline]
 slab_free mm/slub.c:4642 [inline]
 kfree+0x2b4/0x4d0 mm/slub.c:4841
 usbtmc_release+0x271/0x380 drivers/usb/class/usbtmc.c:261
 __fput+0x402/0xb70 fs/file_table.c:465
 task_work_run+0x150/0x240 kernel/task_work.c:227
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:114
 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline]
 do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff88802755e800
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 272 bytes inside of
 freed 1024-byte region [ffff88802755e800, ffff88802755ec00)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802755f800 pfn:0x27558
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
ksm flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801b841dc0 ffffea0000a46000 0000000000000003
raw: ffff88802755f800 000000000010000f 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801b841dc0 ffffea0000a46000 0000000000000003
head: ffff88802755f800 000000000010000f 00000000f5000000 0000000000000000
head: 00fff00000000003 ffffea00009d5601 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5488, tgid 5488 (dhcpcd-run-hook), ts 37034544258, free_ts 36992233878
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1c0/0x230 mm/page_alloc.c:1710
 prep_new_page mm/page_alloc.c:1718 [inline]
 get_page_from_freelist+0x135c/0x3950 mm/page_alloc.c:3680
 __alloc_frozen_pages_noprof+0x261/0x23f0 mm/page_alloc.c:4970
 alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2301
 alloc_slab_page mm/slub.c:2450 [inline]
 allocate_slab mm/slub.c:2618 [inline]
 new_slab+0x23b/0x330 mm/slub.c:2672
 ___slab_alloc+0xd9c/0x1940 mm/slub.c:3858
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3948
 __slab_alloc_node mm/slub.c:4023 [inline]
 slab_alloc_node mm/slub.c:4184 [inline]
 __do_kmalloc_node mm/slub.c:4326 [inline]
 __kmalloc_noprof+0x2f2/0x510 mm/slub.c:4339
 kmalloc_noprof include/linux/slab.h:909 [inline]
 kzalloc_noprof include/linux/slab.h:1039 [inline]
 tomoyo_init_log+0x1385/0x2140 security/tomoyo/audit.c:275
 tomoyo_supervisor+0x302/0x13b0 security/tomoyo/common.c:2198
 tomoyo_audit_env_log security/tomoyo/environ.c:36 [inline]
 tomoyo_env_perm+0x191/0x200 security/tomoyo/environ.c:63
 tomoyo_environ security/tomoyo/domain.c:672 [inline]
 tomoyo_find_next_domain+0xec2/0x20b0 security/tomoyo/domain.c:888
 tomoyo_bprm_check_security security/tomoyo/tomoyo.c:102 [inline]
 tomoyo_bprm_check_security+0x12e/0x1d0 security/tomoyo/tomoyo.c:92
 security_bprm_check+0x1b9/0x1e0 security/security.c:1302
 search_binary_handler fs/exec.c:1708 [inline]
 exec_binprm fs/exec.c:1750 [inline]
 bprm_execve fs/exec.c:1802 [inline]
 bprm_execve+0x810/0x1650 fs/exec.c:1778
 do_execveat_common.isra.0+0x4a5/0x610 fs/exec.c:1908
page last free pid 5487 tgid 5487 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1254 [inline]
 __free_frozen_pages+0x7fe/0x1180 mm/page_alloc.c:2717
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x4d/0x120 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x195/0x1e0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
 kasan_slab_alloc include/linux/kasan.h:250 [inline]
 slab_post_alloc_hook mm/slub.c:4147 [inline]
 slab_alloc_node mm/slub.c:4196 [inline]
 kmem_cache_alloc_noprof+0x1cb/0x3b0 mm/slub.c:4203
 ima_inode_get+0x120/0x580 security/integrity/ima/ima_iint.c:99
 process_measurement+0x18a7/0x23e0 security/integrity/ima/ima_main.c:263
 ima_bprm_check+0xde/0x200 security/integrity/ima/ima_main.c:560
 security_bprm_check+0xa5/0x1e0 security/security.c:1302
 search_binary_handler fs/exec.c:1708 [inline]
 exec_binprm fs/exec.c:1750 [inline]
 bprm_execve fs/exec.c:1802 [inline]
 bprm_execve+0x810/0x1650 fs/exec.c:1778
 do_execveat_common.isra.0+0x4a5/0x610 fs/exec.c:1908
 do_execve fs/exec.c:1982 [inline]
 __do_sys_execve fs/exec.c:2058 [inline]
 __se_sys_execve fs/exec.c:2053 [inline]
 __x64_sys_execve+0x8e/0xb0 fs/exec.c:2053
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff88802755e800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88802755e880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88802755e900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                         ^
 ffff88802755e980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88802755ea00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
   0:	a6                   	cmpsb  %es:(%rdi),%ds:(%rsi)
   1:	32 12                	xor    (%rdx),%dl
   3:	83 f8 07             	cmp    $0x7,%eax
   6:	0f 87 bc 02 00 00    	ja     0x2c8
   c:	89 c0                	mov    %eax,%eax
   e:	48 0f a3 05 d2 0e 0f 	bt     %rax,0xf0f0ed2(%rip)        # 0xf0f0ee8
  15:	0f
  16:	0f 82 74 02 00 00    	jb     0x290
  1c:	8b 35 ba 40 0f 0f    	mov    0xf0f40ba(%rip),%esi        # 0xf0f40dc
  22:	85 f6                	test   %esi,%esi
  24:	0f 85 8d 00 00 00    	jne    0xb7
* 2a:	48 8b 44 24 30       	mov    0x30(%rsp),%rax <-- trapping instruction
  2f:	65 48 2b 05 69 a6 32 	sub    %gs:0x1232a669(%rip),%rax        # 0x1232a6a0
  36:	12
  37:	0f 85 c7 02 00 00    	jne    0x304
  3d:	48                   	rex.W
  3e:	83                   	.byte 0x83
  3f:	c4                   	.byte 0xc4

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
BUG: KASAN: slab-use-after-free in atomic_inc include/linux/atomic/atomic-instrumented.h:435 [inline]
BUG: KASAN: slab-use-after-free in usb_anchor_suspend_wakeups drivers/usb/core/urb.c:927 [inline]
BUG: KASAN: slab-use-after-free in usb_anchor_suspend_wakeups+0x28/0x40 drivers/usb/core/urb.c:924
Write of size 4 at addr ffff88802755e910 by task rcu_preempt/16

CPU: 1 UID: 0 PID: 16 Comm: rcu_preempt Not tainted 6.15.0-syzkaller-10401-gdee264c16a63 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xcd/0x680 mm/kasan/report.c:521
 kasan_report+0xe0/0x110 mm/kasan/report.c:634
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0x100/0x1b0 mm/kasan/generic.c:189
 instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
 atomic_inc include/linux/atomic/atomic-instrumented.h:435 [inline]
 usb_anchor_suspend_wakeups drivers/usb/core/urb.c:927 [inline]
 usb_anchor_suspend_wakeups+0x28/0x40 drivers/usb/core/urb.c:924
 __usb_hcd_giveback_urb+0x224/0x6e0 drivers/usb/core/hcd.c:1636
 usb_hcd_giveback_urb+0x39b/0x450 drivers/usb/core/hcd.c:1734
 dummy_timer+0x180e/0x3a20 drivers/usb/gadget/udc/dummy_hcd.c:1994
 __run_hrtimer kernel/time/hrtimer.c:1761 [inline]
 __hrtimer_run_queues+0x202/0xad0 kernel/time/hrtimer.c:1825
 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1842
 handle_softirqs+0x219/0x8e0 kernel/softirq.c:579
 __do_softirq kernel/softirq.c:613 [inline]
 invoke_softirq kernel/softirq.c:453 [inline]
 __irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1050
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lock_acquire+0x62/0x350 kernel/locking/lockdep.c:5875
Code: a6 32 12 83 f8 07 0f 87 bc 02 00 00 89 c0 48 0f a3 05 d2 0e 0f 0f 0f 82 74 02 00 00 8b 35 ba 40 0f 0f 85 f6 0f 85 8d 00 00 00 <48> 8b 44 24 30 65 48 2b 05 69 a6 32 12 0f 85 c7 02 00 00 48 83 c4
RSP: 0018:ffffc90000157b18 EFLAGS: 00000206
RAX: 0000000000000046 RBX: ffffffff8e491580 RCX: 00000000ffce192d
RDX: 0000000000000000 RSI: ffffffff8dde190c RDI: ffffffff8c1532c0
RBP: 0000000000000000 R08: 5a638b1d2248410d R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
 sched_submit_work kernel/sched/core.c:6815 [inline]
 schedule+0x21c/0x3a0 kernel/sched/core.c:6873
 schedule_timeout+0x123/0x290 kernel/time/sleep_timeout.c:99
 rcu_gp_fqs_loop+0x1ea/0xb00 kernel/rcu/tree.c:2054
 rcu_gp_kthread+0x270/0x380 kernel/rcu/tree.c:2256
 kthread+0x3c2/0x780 kernel/kthread.c:464
 ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 5837:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394
 kmalloc_noprof include/linux/slab.h:905 [inline]
 kzalloc_noprof include/linux/slab.h:1039 [inline]
 usbtmc_open+0xa9/0x9b0 drivers/usb/class/usbtmc.c:175
 usb_open+0x186/0x220 drivers/usb/core/file.c:47
 chrdev_open+0x234/0x6a0 fs/char_dev.c:414
 do_dentry_open+0x744/0x1c10 fs/open.c:964
 vfs_open+0x82/0x3f0 fs/open.c:1094
 do_open fs/namei.c:3887 [inline]
 path_openat+0x1de4/0x2cb0 fs/namei.c:4046
 do_filp_open+0x20b/0x470 fs/namei.c:4073
 do_sys_openat2+0x11b/0x1d0 fs/open.c:1437
 do_sys_open fs/open.c:1452 [inline]
 __do_sys_openat fs/open.c:1468 [inline]
 __se_sys_openat fs/open.c:1463 [inline]
 __x64_sys_openat+0x174/0x210 fs/open.c:1463
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 5845:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2380 [inline]
 slab_free mm/slub.c:4642 [inline]
 kfree+0x2b4/0x4d0 mm/slub.c:4841
 usbtmc_release+0x271/0x380 drivers/usb/class/usbtmc.c:261
 __fput+0x402/0xb70 fs/file_table.c:465
 task_work_run+0x150/0x240 kernel/task_work.c:227
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:114
 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline]
 do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff88802755e800
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 272 bytes inside of
 freed 1024-byte region [ffff88802755e800, ffff88802755ec00)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802755f800 pfn:0x27558
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
ksm flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801b841dc0 ffffea0000a46000 0000000000000003
raw: ffff88802755f800 000000000010000f 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801b841dc0 ffffea0000a46000 0000000000000003
head: ffff88802755f800 000000000010000f 00000000f5000000 0000000000000000
head: 00fff00000000003 ffffea00009d5601 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5488, tgid 5488 (dhcpcd-run-hook), ts 37034544258, free_ts 36992233878
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1c0/0x230 mm/page_alloc.c:1710
 prep_new_page mm/page_alloc.c:1718 [inline]
 get_page_from_freelist+0x135c/0x3950 mm/page_alloc.c:3680
 __alloc_frozen_pages_noprof+0x261/0x23f0 mm/page_alloc.c:4970
 alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2301
 alloc_slab_page mm/slub.c:2450 [inline]
 allocate_slab mm/slub.c:2618 [inline]
 new_slab+0x23b/0x330 mm/slub.c:2672
 ___slab_alloc+0xd9c/0x1940 mm/slub.c:3858
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3948
 __slab_alloc_node mm/slub.c:4023 [inline]
 slab_alloc_node mm/slub.c:4184 [inline]
 __do_kmalloc_node mm/slub.c:4326 [inline]
 __kmalloc_noprof+0x2f2/0x510 mm/slub.c:4339
 kmalloc_noprof include/linux/slab.h:909 [inline]
 kzalloc_noprof include/linux/slab.h:1039 [inline]
 tomoyo_init_log+0x1385/0x2140 security/tomoyo/audit.c:275
 tomoyo_supervisor+0x302/0x13b0 security/tomoyo/common.c:2198
 tomoyo_audit_env_log security/tomoyo/environ.c:36 [inline]
 tomoyo_env_perm+0x191/0x200 security/tomoyo/environ.c:63
 tomoyo_environ security/tomoyo/domain.c:672 [inline]
 tomoyo_find_next_domain+0xec2/0x20b0 security/tomoyo/domain.c:888
 tomoyo_bprm_check_security security/tomoyo/tomoyo.c:102 [inline]
 tomoyo_bprm_check_security+0x12e/0x1d0 security/tomoyo/tomoyo.c:92
 security_bprm_check+0x1b9/0x1e0 security/security.c:1302
 search_binary_handler fs/exec.c:1708 [inline]
 exec_binprm fs/exec.c:1750 [inline]
 bprm_execve fs/exec.c:1802 [inline]
 bprm_execve+0x810/0x1650 fs/exec.c:1778
 do_execveat_common.isra.0+0x4a5/0x610 fs/exec.c:1908
page last free pid 5487 tgid 5487 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1254 [inline]
 __free_frozen_pages+0x7fe/0x1180 mm/page_alloc.c:2717
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x4d/0x120 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x195/0x1e0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
 kasan_slab_alloc include/linux/kasan.h:250 [inline]
 slab_post_alloc_hook mm/slub.c:4147 [inline]
 slab_alloc_node mm/slub.c:4196 [inline]
 kmem_cache_alloc_noprof+0x1cb/0x3b0 mm/slub.c:4203
 ima_inode_get+0x120/0x580 security/integrity/ima/ima_iint.c:99
 process_measurement+0x18a7/0x23e0 security/integrity/ima/ima_main.c:263
 ima_bprm_check+0xde/0x200 security/integrity/ima/ima_main.c:560
 security_bprm_check+0xa5/0x1e0 security/security.c:1302
 search_binary_handler fs/exec.c:1708 [inline]
 exec_binprm fs/exec.c:1750 [inline]
 bprm_execve fs/exec.c:1802 [inline]
 bprm_execve+0x810/0x1650 fs/exec.c:1778
 do_execveat_common.isra.0+0x4a5/0x610 fs/exec.c:1908
 do_execve fs/exec.c:1982 [inline]
 __do_sys_execve fs/exec.c:2058 [inline]
 __se_sys_execve fs/exec.c:2053 [inline]
 __x64_sys_execve+0x8e/0xb0 fs/exec.c:2053
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff88802755e800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88802755e880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88802755e900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                         ^
 ffff88802755e980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88802755ea00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
   0:	a6                   	cmpsb  %es:(%rdi),%ds:(%rsi)
   1:	32 12                	xor    (%rdx),%dl
   3:	83 f8 07             	cmp    $0x7,%eax
   6:	0f 87 bc 02 00 00    	ja     0x2c8
   c:	89 c0                	mov    %eax,%eax
   e:	48 0f a3 05 d2 0e 0f 	bt     %rax,0xf0f0ed2(%rip)        # 0xf0f0ee8
  15:	0f
  16:	0f 82 74 02 00 00    	jb     0x290
  1c:	8b 35 ba 40 0f 0f    	mov    0xf0f40ba(%rip),%esi        # 0xf0f40dc
  22:	85 f6                	test   %esi,%esi
  24:	0f 85 8d 00 00 00    	jne    0xb7
* 2a:	48 8b 44 24 30       	mov    0x30(%rsp),%rax <-- trapping instruction
  2f:	65 48 2b 05 69 a6 32 	sub    %gs:0x1232a669(%rip),%rax        # 0x1232a6a0
  36:	12
  37:	0f 85 c7 02 00 00    	jne    0x304
  3d:	48                   	rex.W
  3e:	83                   	.byte 0x83
  3f:	c4                   	.byte 0xc4