program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x4a) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='vhci_hcd.0\x00', 0xb) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='udp 2', 0x5) socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x4000000000000, 0x40, &(0x7f0000000540)=@raw={'raw\x00', 0x41, 0x3, 0x250, 0xe0, 0x50020000, 0x0, 0xe0, 0x0, 0x1b8, 0x1f0, 0x1f0, 0x1b8, 0x1f0, 0x3, 0x0, {[{{@ip={@remote, @broadcast, 0xff000000, 0x0, 'wlan1\x00', 'wg1\x00', {}, {}, 0x1d}, 0x0, 0x70, 0xe0, 0x0, {0x0, 0xffffffffa0028000}}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x4, 0x6, 0x5, 0x0, 0x0, "555d209797219ffafdad524f9d6f291f02d595e170ff980646a87cd26b301e132a1cdca238b63a841d86f53d67d655330f83453ac83306babe9b91ba57d1f42e"}}}, {{@uncond, 0x0, 0x70, 0xd8}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x4, 0x7, 0x58, 0x4, '\x00', 'syz0\x00', {0x7}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x2b0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x100, {0x0, 0x0, 0x0, r4, {0xe, 0x4}}}, 0x24}}, 0x4) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r3, 0x81f8943c, &(0x7f0000000800)) [ 94.880162][ T4642] Bluetooth: hci0: command tx timeout [ 94.995780][ T5314] vhci_hcd vhci_hcd.0: remove, state 4 [ 94.998175][ T5314] usb usb7: USB disconnect, device number 1 [ 95.147495][ T12] vhci_hcd vhci_hcd.0: stop threads [ 95.150245][ T12] vhci_hcd vhci_hcd.0: release socket [ 95.155569][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 95.158203][ T5314] vhci_hcd vhci_hcd.0: USB bus 7 deregistered [ 95.162631][ T12] vhci_hcd vhci_hcd.0: stop threads [ 95.168702][ T12] vhci_hcd vhci_hcd.0: release socket [ 95.174163][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 95.179571][ T12] vhci_hcd vhci_hcd.0: stop threads [ 95.184771][ T12] vhci_hcd vhci_hcd.0: release socket [ 95.187569][ T5314] vhci_hcd vhci_hcd.0: remove, state 4 [ 95.191871][ T12] ================================================================== [ 95.195235][ T12] BUG: KASAN: slab-use-after-free in vhci_cleanup_unlink_list+0x452/0x460 [ 95.198307][ T12] Read of size 4 at addr ffff888034c988f0 by task kworker/u4:0/12 [ 95.200856][ T12] [ 95.201684][ T12] CPU: 0 UID: 0 PID: 12 Comm: kworker/u4:0 Not tainted syzkaller #0 PREEMPT(full) [ 95.201694][ T12] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.201699][ T12] Workqueue: usbip_event event_handler [ 95.201710][ T12] Call Trace: [ 95.201714][ T12] [ 95.201718][ T12] dump_stack_lvl+0xe8/0x150 [ 95.201730][ T12] print_address_description+0x55/0x1e0 [ 95.201739][ T12] ? vhci_cleanup_unlink_list+0x452/0x460 [ 95.201748][ T12] print_report+0x58/0x70 [ 95.201760][ T12] kasan_report+0x117/0x150 [ 95.201774][ T12] ? vhci_cleanup_unlink_list+0x452/0x460 [ 95.201788][ T12] vhci_cleanup_unlink_list+0x452/0x460 [ 95.201797][ T12] ? kasan_quarantine_put+0xbb/0x1f0 [ 95.201805][ T12] vhci_shutdown_connection+0x2af/0x650 [ 95.201814][ T12] event_handler+0x2a4/0x4b0 [ 95.201820][ T12] ? process_scheduled_works+0xa20/0x14e0 [ 95.201828][ T12] process_scheduled_works+0xa8e/0x14e0 [ 95.201839][ T12] ? __pfx_process_scheduled_works+0x10/0x10 [ 95.201847][ T12] ? assign_work+0x3cf/0x5d0 [ 95.201854][ T12] worker_thread+0xa47/0xfb0 [ 95.201865][ T12] kthread+0x388/0x470 [ 95.201875][ T12] ? __pfx_worker_thread+0x10/0x10 [ 95.201882][ T12] ? __pfx_kthread+0x10/0x10 [ 95.201891][ T12] ret_from_fork+0x514/0xb70 [ 95.201902][ T12] ? __pfx_ret_from_fork+0x10/0x10 [ 95.201911][ T12] ? __switch_to+0xc89/0x1420 [ 95.201920][ T12] ? __pfx_kthread+0x10/0x10 [ 95.201929][ T12] ret_from_fork_asm+0x1a/0x30 [ 95.201941][ T12] [ 95.201944][ T12] [ 95.265757][ T12] Allocated by task 1: [ 95.267528][ T12] kasan_save_track+0x3e/0x80 [ 95.269600][ T12] __kasan_kmalloc+0x93/0xb0 [ 95.271539][ T12] __kmalloc_noprof+0x375/0x720 [ 95.273636][ T12] __usb_create_hcd+0x67/0x900 [ 95.275740][ T12] vhci_hcd_probe+0x1e6/0x3e0 [ 95.277791][ T12] platform_probe+0xf9/0x190 [ 95.279833][ T12] really_probe+0x254/0xae0 [ 95.281798][ T12] __driver_probe_device+0x1e8/0x360 [ 95.284061][ T12] driver_probe_device+0x4f/0x240 [ 95.286260][ T12] __device_attach_driver+0x270/0x410 [ 95.288613][ T12] bus_for_each_drv+0x258/0x2f0 [ 95.290819][ T12] __device_attach+0x2c4/0x450 [ 95.292945][ T12] device_initial_probe+0xa1/0xd0 [ 95.295151][ T12] bus_probe_device+0x12a/0x220 [ 95.297262][ T12] device_add+0x7d7/0xb80 [ 95.299155][ T12] platform_device_add+0x4bd/0x860 [ 95.301408][ T12] platform_device_register_full+0x62d/0x710 [ 95.304066][ T12] vhci_hcd_init+0x227/0x360 [ 95.306150][ T12] do_one_initcall+0x250/0x870 [ 95.308234][ T12] do_initcall_level+0x10a/0x1a0 [ 95.310370][ T12] do_initcalls+0x59/0xa0 [ 95.312262][ T12] kernel_init_freeable+0x29d/0x3e0 [ 95.314527][ T12] kernel_init+0x1d/0x1d0 [ 95.316407][ T12] ret_from_fork+0x514/0xb70 [ 95.318430][ T12] ret_from_fork_asm+0x1a/0x30 [ 95.320565][ T12] [ 95.321653][ T12] Freed by task 5314: [ 95.323416][ T12] kasan_save_track+0x3e/0x80 [ 95.325364][ T12] kasan_save_free_info+0x40/0x50 [ 95.327509][ T12] __kasan_slab_free+0x5c/0x80 [ 95.329644][ T12] kfree+0x1c5/0x640 [ 95.331309][ T12] vhci_hcd_remove+0x9e/0x110 [ 95.333200][ T12] device_release_driver_internal+0x48b/0x880 [ 95.335643][ T12] unbind_store+0x1a1/0x1d0 [ 95.337487][ T12] kernfs_fop_write_iter+0x3a4/0x540 [ 95.339577][ T12] vfs_write+0x612/0xba0 [ 95.341271][ T12] ksys_write+0x150/0x270 [ 95.343069][ T12] do_syscall_64+0x174/0x580 [ 95.344968][ T12] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.347445][ T12] [ 95.348497][ T12] Last potentially related work creation: [ 95.350926][ T12] kasan_save_stack+0x3e/0x60 [ 95.353057][ T12] kasan_record_aux_stack+0xbd/0xd0 [ 95.355202][ T12] insert_work+0x3d/0x330 [ 95.356951][ T12] __queue_work+0xcd8/0x10a0 [ 95.358696][ T12] queue_work_on+0x106/0x1d0 [ 95.360281][ T12] unlink1+0x344/0x3e0 [ 95.361712][ T12] usb_hcd_unlink_urb+0xe6/0x1e0 [ 95.363772][ T12] usb_kill_urb+0x10b/0x2f0 [ 95.365666][ T12] hub_quiesce+0x211/0x330 [ 95.367528][ T12] hub_suspend+0x904/0xad0 [ 95.369436][ T12] usb_suspend_both+0x285/0x1040 [ 95.371511][ T12] usb_runtime_suspend+0x58/0x110 [ 95.373566][ T12] __rpm_callback+0x2c7/0x950 [ 95.375506][ T12] rpm_suspend+0x8a0/0x17b0 [ 95.377460][ T12] __pm_runtime_suspend+0x12f/0x1a0 [ 95.379571][ T12] usb_new_device+0xaee/0x1690 [ 95.381563][ T12] register_root_hub+0x250/0x5c0 [ 95.383693][ T12] usb_add_hcd+0xac7/0xf80 [ 95.385521][ T12] vhci_hcd_probe+0x1fa/0x3e0 [ 95.387452][ T12] platform_probe+0xf9/0x190 [ 95.389398][ T12] really_probe+0x254/0xae0 [ 95.391386][ T12] __driver_probe_device+0x1e8/0x360 [ 95.393711][ T12] driver_probe_device+0x4f/0x240 [ 95.395884][ T12] __device_attach_driver+0x270/0x410 [ 95.398195][ T12] bus_for_each_drv+0x258/0x2f0 [ 95.400275][ T12] __device_attach+0x2c4/0x450 [ 95.402418][ T12] device_initial_probe+0xa1/0xd0 [ 95.404486][ T12] bus_probe_device+0x12a/0x220 [ 95.406583][ T12] device_add+0x7d7/0xb80 [ 95.408330][ T12] platform_device_add+0x4bd/0x860 [ 95.410437][ T12] platform_device_register_full+0x62d/0x710 [ 95.413043][ T12] vhci_hcd_init+0x227/0x360 [ 95.415069][ T12] do_one_initcall+0x250/0x870 [ 95.417187][ T12] do_initcall_level+0x10a/0x1a0 [ 95.419300][ T12] do_initcalls+0x59/0xa0 [ 95.421177][ T12] kernel_init_freeable+0x29d/0x3e0 [ 95.423347][ T12] kernel_init+0x1d/0x1d0 [ 95.425176][ T12] ret_from_fork+0x514/0xb70 [ 95.426887][ T12] ret_from_fork_asm+0x1a/0x30 [ 95.428619][ T12] [ 95.429650][ T12] Second to last potentially related work creation: [ 95.432017][ T12] kasan_save_stack+0x3e/0x60 [ 95.433914][ T12] kasan_record_aux_stack+0xbd/0xd0 [ 95.435919][ T12] insert_work+0x3d/0x330 [ 95.437480][ T12] __queue_work+0xcd8/0x10a0 [ 95.439083][ T12] queue_work_on+0x106/0x1d0 [ 95.440767][ T12] usb_hcd_submit_urb+0xa3b/0x1b60 [ 95.442949][ T12] usb_start_wait_urb+0x13f/0x5b0 [ 95.445071][ T12] usb_control_msg+0x234/0x3e0 [ 95.447051][ T12] hub_suspend+0x891/0xad0 [ 95.448968][ T12] usb_suspend_both+0x285/0x1040 [ 95.450949][ T12] usb_runtime_suspend+0x58/0x110 [ 95.452844][ T12] __rpm_callback+0x2c7/0x950 [ 95.454538][ T12] rpm_suspend+0x8a0/0x17b0 [ 95.456126][ T12] __pm_runtime_suspend+0x12f/0x1a0 [ 95.458029][ T12] usb_new_device+0xaee/0x1690 [ 95.459740][ T12] register_root_hub+0x250/0x5c0 [ 95.461668][ T12] usb_add_hcd+0xac7/0xf80 [ 95.463389][ T12] vhci_hcd_probe+0x1fa/0x3e0 [ 95.465159][ T12] platform_probe+0xf9/0x190 [ 95.467071][ T12] really_probe+0x254/0xae0 [ 95.468810][ T12] __driver_probe_device+0x1e8/0x360 [ 95.470807][ T12] driver_probe_device+0x4f/0x240 [ 95.472615][ T12] __device_attach_driver+0x270/0x410 [ 95.474652][ T12] bus_for_each_drv+0x258/0x2f0 [ 95.476520][ T12] __device_attach+0x2c4/0x450 [ 95.478360][ T12] device_initial_probe+0xa1/0xd0 [ 95.480268][ T12] bus_probe_device+0x12a/0x220 [ 95.482230][ T12] device_add+0x7d7/0xb80 [ 95.484038][ T12] platform_device_add+0x4bd/0x860 [ 95.486061][ T12] platform_device_register_full+0x62d/0x710 [ 95.488505][ T12] vhci_hcd_init+0x227/0x360 [ 95.490313][ T12] do_one_initcall+0x250/0x870 [ 95.492175][ T12] do_initcall_level+0x10a/0x1a0 [ 95.494072][ T12] do_initcalls+0x59/0xa0 [ 95.495744][ T12] kernel_init_freeable+0x29d/0x3e0 [ 95.497773][ T12] kernel_init+0x1d/0x1d0 [ 95.499428][ T12] ret_from_fork+0x514/0xb70 [ 95.501218][ T12] ret_from_fork_asm+0x1a/0x30 [ 95.503127][ T12] [ 95.504059][ T12] The buggy address belongs to the object at ffff888034c98000 [ 95.504059][ T12] which belongs to the cache kmalloc-8k of size 8192 [ 95.509225][ T12] The buggy address is located 2288 bytes inside of [ 95.509225][ T12] freed 8192-byte region [ffff888034c98000, ffff888034c9a000) [ 95.514303][ T12] [ 95.515205][ T12] The buggy address belongs to the physical page: [ 95.517689][ T12] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34c98 [ 95.521136][ T12] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 95.524642][ T12] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 95.527968][ T12] page_type: f5(slab) [ 95.529766][ T12] raw: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 95.533551][ T12] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 95.537283][ T12] head: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 95.541119][ T12] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 95.544850][ T12] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 95.548569][ T12] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 95.552257][ T12] page dumped because: kasan: bad access detected [ 95.554997][ T12] page_owner tracks the page as allocated [ 95.557446][ T12] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 17527852571, free_ts 17513378039 [ 95.565997][ T12] post_alloc_hook+0x1f9/0x250 [ 95.568106][ T12] get_page_from_freelist+0x21fa/0x2270 [ 95.570481][ T12] __alloc_frozen_pages_noprof+0x18d/0x380 [ 95.572969][ T12] allocate_slab+0x79/0x5e0 [ 95.575014][ T12] refill_objects+0x2d5/0x350 [ 95.577076][ T12] __pcs_replace_empty_main+0x2bf/0x6b0 [ 95.579537][ T12] __kmalloc_noprof+0x485/0x720 [ 95.581764][ T12] __usb_create_hcd+0x67/0x900 [ 95.583907][ T12] vhci_hcd_probe+0x104/0x3e0 [ 95.585994][ T12] platform_probe+0xf9/0x190 [ 95.588048][ T12] really_probe+0x254/0xae0 [ 95.590079][ T12] __driver_probe_device+0x1e8/0x360 [ 95.592413][ T12] driver_probe_device+0x4f/0x240 [ 95.594688][ T12] __device_attach_driver+0x270/0x410 [ 95.597024][ T12] bus_for_each_drv+0x258/0x2f0 [ 95.599100][ T12] __device_attach+0x2c4/0x450 [ 95.601087][ T12] page last free pid 68 tgid 68 stack trace: [ 95.603596][ T12] __free_frozen_pages+0xc1e/0xd10 [ 95.605957][ T12] __slab_free+0x274/0x2c0 [ 95.607891][ T12] qlist_free_all+0x99/0x100 [ 95.609968][ T12] kasan_quarantine_reduce+0x148/0x160 [ 95.612287][ T12] __kasan_slab_alloc+0x22/0x80 [ 95.614383][ T12] kmem_cache_alloc_node_noprof+0x355/0x610 [ 95.616819][ T12] dup_task_struct+0x52/0x8e0 [ 95.618977][ T12] copy_process+0x820/0x4390 [ 95.620847][ T12] kernel_clone+0x2d7/0x940 [ 95.622708][ T12] user_mode_thread+0x110/0x180 [ 95.624610][ T12] call_usermodehelper_exec_work+0x5c/0x230 [ 95.626896][ T12] process_scheduled_works+0xa8e/0x14e0 [ 95.629096][ T12] worker_thread+0xa47/0xfb0 [ 95.630835][ T12] kthread+0x388/0x470 [ 95.632462][ T12] ret_from_fork+0x514/0xb70 [ 95.634320][ T12] ret_from_fork_asm+0x1a/0x30 [ 95.636271][ T12] [ 95.637324][ T12] Memory state around the buggy address: [ 95.639771][ T12] ffff888034c98780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.643349][ T12] ffff888034c98800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.646839][ T12] >ffff888034c98880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.650435][ T12] ^ [ 95.653809][ T12] ffff888034c98900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.657402][ T12] ffff888034c98980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.661505][ T12] ================================================================== [ 95.666989][ T5314] usb usb6: USB disconnect, device number 1 [ 95.742734][ T5314] vhci_hcd vhci_hcd.0: USB bus 6 deregistered