program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
r1 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10)
r2 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r2, &(0x7f0000000300)={0x2, 0x4e23, @multicast1}, 0x10)
sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10)
setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='batadv_slave_1\x00', 0x10)
r3 = socket$inet(0x2, 0x801, 0x0)
bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @multicast1}, 0x10)
sendto$inet(r3, 0x0, 0xffffffffffffffb5, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10)
shutdown(r3, 0x1)
sendto$inet(r1, 0x0, 0x0, 0x200007bd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10)
write(r0, &(0x7f0000000300)='vhci_hcd.0\x00', 0xb)
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000080)='./file0\x00', 0x8002, &(0x7f00000000c0), 0x1, 0x4b4, &(0x7f0000000c80)="$eJzs3E9sFNUfAPDvbHdpgR8/KiIKoi6isdHYQkHh4AWjiQdMjHjQY9MWghRqaE2EECmJwaMh8W48evXgVb0ZTyZe8WhiSIjhAnhaM7sz7e52t//Y7oL7+SRL35t9s+99982bfTNvlwD6Vjn9J4n4X0TcjIidtWxjgXLtz707Vybv37kyGQuVyqm/k2q5u2k+k++3PcuMFCIKXyRNL1gzd+nyuYmZmemLWX5s/vwnY3OXLr969vzEmekz0xfGjx8/euTwsdfHX1t/UC3qS+O6u+/z2f173/noxruTxXz7UPa3Po5OKUe5VVOqXux0ZT22oy6dFHvYENZlICLS7ipVx//OGAidB/2iUqlUBts/vVBpdm3ZFuCRlUSvWwD0Rv5Bn17/5o8uTT0eCrdP1C6A0rjvZY/aM8UoZGVKTde3nTQUER8u/PNN+ohNug8BAFDvpxP5TLB5/leIPXXl/p+toQxHxGMRsSsiHo+I3RHxRES17JMR8VTT65cjorJC/eWm/PL5T+HWAwW4inT+90a2ttU4/8tnfzE8kOV2ROQT5ulD2XsyEqXB02dnpg+vUMfPb/3+VbvnynXzv/SR1p/PBbN23Co23aCbmpif2HDATW5fi9hXbI4/KUYkiysBSUTsjYh963jd4br02Ze/27+YKTWWWz3+qkrLdbQOLFVUvo14qdb/C9HQ/0s1JiuvT44Nxcz0obH0KDjUso5ff7v+Xrv6V43/hz+bd3n72I+nHjTsRWn/b6s7/iNfv12KfziJSBbXa+fWX8f1P75se02ztuP/asM+6fG/Jfmgmt6SbftsYn7+4uGILcnJ5dvHl/bN83n5NP6Rg63H/65sn/SdeDoi0oP4mYh4NiKey9p+ICKej4iDK8T/y5svfLzx+DdXGv9Uy/NfQ/8vrdfPncwTl9aaGDh34Ob9NiePtfX/0WpqJNvS+vyXNJwi1trADryFAAAA8NArRPW7/4XRxXShMDpauwe0O7YVZmbn5l85PfvphanabwSGo1TI73TV7geXkvz+53BdfrwpfyS7b/z1wNZqfnRydmaq18FDn9teHfPJsvGf+mug160DNp2f/ED/Wm3877nRpYYAXefzH/pX3fhfaFNkwTdl4L+p9ed/qevtALqv1fi/uoF9gEdLxViGvmb8Q/8qxvuL6UJPWwJ0m89/6Etr/xX/RhKVwdZPDcXywjG0Oc3Y2qKuniTSmVVPat+6kb3y/02hbZkorPY6xYZjbDCWlxmInvTFmT0dP/gr2XflO93U71cep/l0fRPeqO6ehwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADbLvwEAAP//cdfX0w==")
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) (async)
socket$inet(0x2, 0x4000000000000001, 0x0) (async)
bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) (async)
socket$inet(0x2, 0x4000000000000001, 0x0) (async)
bind$inet(r2, &(0x7f0000000300)={0x2, 0x4e23, @multicast1}, 0x10) (async)
sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) (async)
setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='batadv_slave_1\x00', 0x10) (async)
socket$inet(0x2, 0x801, 0x0) (async)
bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @multicast1}, 0x10) (async)
sendto$inet(r3, 0x0, 0xffffffffffffffb5, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) (async)
shutdown(r3, 0x1) (async)
sendto$inet(r1, 0x0, 0x0, 0x200007bd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) (async)
write(r0, &(0x7f0000000300)='vhci_hcd.0\x00', 0xb) (async)
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000080)='./file0\x00', 0x8002, &(0x7f00000000c0), 0x1, 0x4b4, &(0x7f0000000c80)="$eJzs3E9sFNUfAPDvbHdpgR8/KiIKoi6isdHYQkHh4AWjiQdMjHjQY9MWghRqaE2EECmJwaMh8W48evXgVb0ZTyZe8WhiSIjhAnhaM7sz7e52t//Y7oL7+SRL35t9s+99982bfTNvlwD6Vjn9J4n4X0TcjIidtWxjgXLtz707Vybv37kyGQuVyqm/k2q5u2k+k++3PcuMFCIKXyRNL1gzd+nyuYmZmemLWX5s/vwnY3OXLr969vzEmekz0xfGjx8/euTwsdfHX1t/UC3qS+O6u+/z2f173/noxruTxXz7UPa3Po5OKUe5VVOqXux0ZT22oy6dFHvYENZlICLS7ipVx//OGAidB/2iUqlUBts/vVBpdm3ZFuCRlUSvWwD0Rv5Bn17/5o8uTT0eCrdP1C6A0rjvZY/aM8UoZGVKTde3nTQUER8u/PNN+ohNug8BAFDvpxP5TLB5/leIPXXl/p+toQxHxGMRsSsiHo+I3RHxRES17JMR8VTT65cjorJC/eWm/PL5T+HWAwW4inT+90a2ttU4/8tnfzE8kOV2ROQT5ulD2XsyEqXB02dnpg+vUMfPb/3+VbvnynXzv/SR1p/PBbN23Co23aCbmpif2HDATW5fi9hXbI4/KUYkiysBSUTsjYh963jd4br02Ze/27+YKTWWWz3+qkrLdbQOLFVUvo14qdb/C9HQ/0s1JiuvT44Nxcz0obH0KDjUso5ff7v+Xrv6V43/hz+bd3n72I+nHjTsRWn/b6s7/iNfv12KfziJSBbXa+fWX8f1P75se02ztuP/asM+6fG/Jfmgmt6SbftsYn7+4uGILcnJ5dvHl/bN83n5NP6Rg63H/65sn/SdeDoi0oP4mYh4NiKey9p+ICKej4iDK8T/y5svfLzx+DdXGv9Uy/NfQ/8vrdfPncwTl9aaGDh34Ob9NiePtfX/0WpqJNvS+vyXNJwi1trADryFAAAA8NArRPW7/4XRxXShMDpauwe0O7YVZmbn5l85PfvphanabwSGo1TI73TV7geXkvz+53BdfrwpfyS7b/z1wNZqfnRydmaq18FDn9teHfPJsvGf+mug160DNp2f/ED/Wm3877nRpYYAXefzH/pX3fhfaFNkwTdl4L+p9ed/qevtALqv1fi/uoF9gEdLxViGvmb8Q/8qxvuL6UJPWwJ0m89/6Etr/xX/RhKVwdZPDcXywjG0Oc3Y2qKuniTSmVVPat+6kb3y/02hbZkorPY6xYZjbDCWlxmInvTFmT0dP/gr2XflO93U71cep/l0fRPeqO6ehwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADbLvwEAAP//cdfX0w==") (async)
[ 94.207914][ T5289] Bluetooth: hci0: command tx timeout
[ 94.336705][ T5328] vhci_hcd vhci_hcd.0: remove, state 4
[ 94.347864][ T5328] usb usb7: USB disconnect, device number 1
[ 94.384313][ T5329] loop0: detected capacity change from 0 to 512
[ 94.464662][ T13] vhci_hcd vhci_hcd.0: stop threads
[ 94.475225][ T13] vhci_hcd vhci_hcd.0: release socket
[ 94.483075][ T13] vhci_hcd vhci_hcd.0: disconnect device
[ 94.490724][ T5329] EXT4-fs error (device loop0): ext4_validate_block_bitmap:441: comm syz.0.0: bg 0: block 393: padding at end of block bitmap is not set
[ 94.509184][ T41] vhci_hcd vhci_hcd.0: stop threads
[ 94.511957][ T5329] loop0: lost filesystem error report for type 5 error -117
[ 94.512429][ T41] vhci_hcd vhci_hcd.0: release socket
[ 94.518003][ C0] EXT4-fs (loop0): error count since last fsck: 1
[ 94.518059][ C0] EXT4-fs (loop0): initial error at time 1785490833: ext4_validate_block_bitmap:441
[ 94.518073][ C0] EXT4-fs (loop0): last error at time 1785490833: ext4_validate_block_bitmap:441
[ 94.534447][ T5329] EXT4-fs error (device loop0) in ext4_mb_clear_bb:6679: Corrupt filesystem
[ 94.540319][ T5329] loop0: lost filesystem error report for type 5 error -117
[ 94.540867][ T5329] EXT4-fs (loop0): 2 truncates cleaned up
[ 94.547440][ T5329] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[ 94.552973][ T41] vhci_hcd vhci_hcd.0: disconnect device
[ 94.557575][ T41] vhci_hcd vhci_hcd.0: stop threads
[ 94.562606][ T41] vhci_hcd vhci_hcd.0: release socket
[ 94.565964][ T5328] vhci_hcd vhci_hcd.0: USB bus 7 deregistered
[ 94.568900][ T41] vhci_hcd vhci_hcd.0: disconnect device
[ 94.572529][ T41] vhci_hcd vhci_hcd.0: stop threads
[ 94.578474][ T41] vhci_hcd vhci_hcd.0: release socket
[ 94.586431][ T41] vhci_hcd vhci_hcd.0: disconnect device
[ 94.589565][ T5328] vhci_hcd vhci_hcd.0: remove, state 4
[ 94.593551][ T41] ==================================================================
[ 94.597388][ T41] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0x40/0x60
[ 94.601695][ T41] Read of size 1 at addr ffff888034c70b68 by task kworker/u4:3/41
[ 94.605078][ T41]
[ 94.606162][ T41] CPU: 0 UID: 0 PID: 41 Comm: kworker/u4:3 Not tainted syzkaller #0 PREEMPT(full)
[ 94.606176][ T41] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.606184][ T41] Workqueue: usbip_event event_handler
[ 94.606201][ T41] Call Trace:
[ 94.606208][ T41]
[ 94.606222][ T41] dump_stack_lvl+0xe8/0x150
[ 94.606247][ T41] print_address_description+0x55/0x1e0
[ 94.606262][ T41] ? _raw_spin_lock_irqsave+0x40/0x60
[ 94.606273][ T41] print_report+0x58/0x70
[ 94.606285][ T41] kasan_report+0x117/0x150
[ 94.606299][ T41] ? _raw_spin_lock_irqsave+0x40/0x60
[ 94.606310][ T41] ? event_handler+0x2b0/0x4b0
[ 94.606319][ T41] __kasan_check_byte+0x2a/0x40
[ 94.606331][ T41] lock_acquire+0x84/0x350
[ 94.606345][ T41] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 94.606355][ T41] ? rcu_is_watching+0x15/0xb0
[ 94.606365][ T41] _raw_spin_lock_irqsave+0x40/0x60
[ 94.606375][ T41] ? event_handler+0x2b0/0x4b0
[ 94.606385][ T41] event_handler+0x2b0/0x4b0
[ 94.606394][ T41] ? process_scheduled_works+0xa20/0x14e0
[ 94.606406][ T41] process_scheduled_works+0xa8e/0x14e0
[ 94.606422][ T41] ? __pfx_process_scheduled_works+0x10/0x10
[ 94.606435][ T41] ? assign_work+0x3cf/0x5d0
[ 94.606446][ T41] worker_thread+0xa47/0xfb0
[ 94.606460][ T41] ? __kthread_parkme+0x71/0x1f0
[ 94.606475][ T41] kthread+0x388/0x470
[ 94.606489][ T41] ? __pfx_worker_thread+0x10/0x10
[ 94.606500][ T41] ? __pfx_kthread+0x10/0x10
[ 94.606514][ T41] ret_from_fork+0x514/0xb70
[ 94.606529][ T41] ? __pfx_ret_from_fork+0x10/0x10
[ 94.606542][ T41] ? __switch_to+0xc89/0x1420
[ 94.606554][ T41] ? __pfx_kthread+0x10/0x10
[ 94.606568][ T41] ret_from_fork_asm+0x1a/0x30
[ 94.606581][ T41]
[ 94.606584][ T41]
[ 94.686199][ T41] Allocated by task 1:
[ 94.687793][ T41] kasan_save_track+0x3e/0x80
[ 94.689498][ T41] __kasan_kmalloc+0x93/0xb0
[ 94.691535][ T41] __kmalloc_noprof+0x375/0x720
[ 94.693264][ T41] __usb_create_hcd+0x67/0x900
[ 94.694993][ T41] vhci_hcd_probe+0x1e6/0x3e0
[ 94.696615][ T41] platform_probe+0xf9/0x190
[ 94.698222][ T41] really_probe+0x254/0xae0
[ 94.699928][ T41] __driver_probe_device+0x1e8/0x360
[ 94.702046][ T41] driver_probe_device+0x4f/0x240
[ 94.704368][ T41] __device_attach_driver+0x270/0x410
[ 94.707120][ T41] bus_for_each_drv+0x258/0x2f0
[ 94.709237][ T41] __device_attach+0x2c4/0x450
[ 94.711262][ T41] device_initial_probe+0xa1/0xd0
[ 94.713263][ T41] bus_probe_device+0x12a/0x220
[ 94.715046][ T41] device_add+0x7d7/0xb80
[ 94.716860][ T41] platform_device_add+0x4bd/0x860
[ 94.719165][ T41] platform_device_register_full+0x62d/0x710
[ 94.721758][ T41] vhci_hcd_init+0x227/0x360
[ 94.723912][ T41] do_one_initcall+0x250/0x870
[ 94.726024][ T41] do_initcall_level+0x10a/0x1a0
[ 94.728328][ T41] do_initcalls+0x59/0xa0
[ 94.729944][ T41] kernel_init_freeable+0x29d/0x3e0
[ 94.731901][ T41] kernel_init+0x1d/0x1d0
[ 94.733691][ T41] ret_from_fork+0x514/0xb70
[ 94.735514][ T41] ret_from_fork_asm+0x1a/0x30
[ 94.737458][ T41]
[ 94.738474][ T41] Freed by task 5328:
[ 94.740202][ T41] kasan_save_track+0x3e/0x80
[ 94.742259][ T41] kasan_save_free_info+0x40/0x50
[ 94.744470][ T41] __kasan_slab_free+0x5c/0x80
[ 94.746458][ T41] kfree+0x1c5/0x640
[ 94.748186][ T41] vhci_hcd_remove+0x9e/0x110
[ 94.750427][ T41] device_release_driver_internal+0x48b/0x880
[ 94.753018][ T41] unbind_store+0x1a1/0x1d0
[ 94.754732][ T41] kernfs_fop_write_iter+0x3a4/0x540
[ 94.756652][ T41] vfs_write+0x612/0xba0
[ 94.758378][ T41] ksys_write+0x150/0x270
[ 94.760233][ T41] do_syscall_64+0x174/0x580
[ 94.762164][ T41] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.764485][ T41]
[ 94.765409][ T41] Last potentially related work creation:
[ 94.767529][ T41] kasan_save_stack+0x3e/0x60
[ 94.769546][ T41] kasan_record_aux_stack+0xbd/0xd0
[ 94.771694][ T41] insert_work+0x3d/0x330
[ 94.773382][ T41] __queue_work+0xcd8/0x10a0
[ 94.775402][ T41] queue_work_on+0x106/0x1d0
[ 94.777230][ T41] unlink1+0x344/0x3e0
[ 94.778793][ T41] usb_hcd_unlink_urb+0xe6/0x1e0
[ 94.780862][ T41] usb_kill_urb+0x10b/0x2f0
[ 94.782837][ T41] hub_quiesce+0x211/0x330
[ 94.784734][ T41] hub_suspend+0x904/0xad0
[ 94.786629][ T41] usb_suspend_both+0x285/0x1040
[ 94.788468][ T41] usb_runtime_suspend+0x58/0x110
[ 94.790359][ T41] __rpm_callback+0x2c7/0x950
[ 94.792114][ T41] rpm_suspend+0x8a0/0x17b0
[ 94.793758][ T41] __pm_runtime_suspend+0x12f/0x1a0
[ 94.795553][ T41] usb_new_device+0xadf/0x1620
[ 94.797350][ T41] register_root_hub+0x250/0x5c0
[ 94.799536][ T41] usb_add_hcd+0xac7/0xf80
[ 94.801606][ T41] vhci_hcd_probe+0x1fa/0x3e0
[ 94.803739][ T41] platform_probe+0xf9/0x190
[ 94.805668][ T41] really_probe+0x254/0xae0
[ 94.807443][ T41] __driver_probe_device+0x1e8/0x360
[ 94.809557][ T41] driver_probe_device+0x4f/0x240
[ 94.811452][ T41] __device_attach_driver+0x270/0x410
[ 94.813524][ T41] bus_for_each_drv+0x258/0x2f0
[ 94.815402][ T41] __device_attach+0x2c4/0x450
[ 94.817300][ T41] device_initial_probe+0xa1/0xd0
[ 94.819395][ T41] bus_probe_device+0x12a/0x220
[ 94.821451][ T41] device_add+0x7d7/0xb80
[ 94.823297][ T41] platform_device_add+0x4bd/0x860
[ 94.825464][ T41] platform_device_register_full+0x62d/0x710
[ 94.828084][ T41] vhci_hcd_init+0x227/0x360
[ 94.830256][ T41] do_one_initcall+0x250/0x870
[ 94.832487][ T41] do_initcall_level+0x10a/0x1a0
[ 94.834641][ T41] do_initcalls+0x59/0xa0
[ 94.836521][ T41] kernel_init_freeable+0x29d/0x3e0
[ 94.838798][ T41] kernel_init+0x1d/0x1d0
[ 94.840736][ T41] ret_from_fork+0x514/0xb70
[ 94.842815][ T41] ret_from_fork_asm+0x1a/0x30
[ 94.845124][ T41]
[ 94.846687][ T41] Second to last potentially related work creation:
[ 94.849988][ T41] kasan_save_stack+0x3e/0x60
[ 94.852091][ T41] kasan_record_aux_stack+0xbd/0xd0
[ 94.854170][ T41] insert_work+0x3d/0x330
[ 94.856115][ T41] __queue_work+0xcd8/0x10a0
[ 94.858619][ T41] queue_work_on+0x106/0x1d0
[ 94.861377][ T41] usb_hcd_submit_urb+0xa3b/0x1b60
[ 94.864472][ T41] usb_start_wait_urb+0x13f/0x5b0
[ 94.867646][ T41] usb_control_msg+0x234/0x3e0
[ 94.870555][ T41] hub_suspend+0x891/0xad0
[ 94.873168][ T41] usb_suspend_both+0x285/0x1040
[ 94.876007][ T41] usb_runtime_suspend+0x58/0x110
[ 94.878222][ T41] __rpm_callback+0x2c7/0x950
[ 94.880404][ T41] rpm_suspend+0x8a0/0x17b0
[ 94.882838][ T41] __pm_runtime_suspend+0x12f/0x1a0
[ 94.885788][ T41] usb_new_device+0xadf/0x1620
[ 94.887718][ T41] register_root_hub+0x250/0x5c0
[ 94.890045][ T41] usb_add_hcd+0xac7/0xf80
[ 94.892053][ T41] vhci_hcd_probe+0x1fa/0x3e0
[ 94.894005][ T41] platform_probe+0xf9/0x190
[ 94.896040][ T41] really_probe+0x254/0xae0
[ 94.898138][ T41] __driver_probe_device+0x1e8/0x360
[ 94.900611][ T41] driver_probe_device+0x4f/0x240
[ 94.902838][ T41] __device_attach_driver+0x270/0x410
[ 94.905228][ T41] bus_for_each_drv+0x258/0x2f0
[ 94.907435][ T41] __device_attach+0x2c4/0x450
[ 94.909453][ T41] device_initial_probe+0xa1/0xd0
[ 94.911542][ T41] bus_probe_device+0x12a/0x220
[ 94.913662][ T41] device_add+0x7d7/0xb80
[ 94.915552][ T41] platform_device_add+0x4bd/0x860
[ 94.917890][ T41] platform_device_register_full+0x62d/0x710
[ 94.920817][ T41] vhci_hcd_init+0x227/0x360
[ 94.922935][ T41] do_one_initcall+0x250/0x870
[ 94.925094][ T41] do_initcall_level+0x10a/0x1a0
[ 94.927216][ T41] do_initcalls+0x59/0xa0
[ 94.929165][ T41] kernel_init_freeable+0x29d/0x3e0
[ 94.931632][ T41] kernel_init+0x1d/0x1d0
[ 94.933725][ T41] ret_from_fork+0x514/0xb70
[ 94.935765][ T41] ret_from_fork_asm+0x1a/0x30
[ 94.937767][ T41]
[ 94.938785][ T41] The buggy address belongs to the object at ffff888034c70000
[ 94.938785][ T41] which belongs to the cache kmalloc-8k of size 8192
[ 94.945321][ T41] The buggy address is located 2920 bytes inside of
[ 94.945321][ T41] freed 8192-byte region [ffff888034c70000, ffff888034c72000)
[ 94.951328][ T41]
[ 94.952338][ T41] The buggy address belongs to the physical page:
[ 94.955067][ T41] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34c70
[ 94.958789][ T41] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 94.963121][ T41] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff)
[ 94.967404][ T41] page_type: f5(slab)
[ 94.969580][ T41] raw: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000
[ 94.973281][ T41] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
[ 94.976855][ T41] head: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000
[ 94.980599][ T41] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
[ 94.984889][ T41] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 94.988574][ T41] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 94.992911][ T41] page dumped because: kasan: bad access detected
[ 94.995650][ T41] page_owner tracks the page as allocated
[ 94.997884][ T41] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 17039167431, free_ts 17033873455
[ 95.005783][ T41] post_alloc_hook+0x1f9/0x250
[ 95.007684][ T41] get_page_from_freelist+0x21fa/0x2270
[ 95.010125][ T41] __alloc_frozen_pages_noprof+0x18d/0x380
[ 95.012480][ T41] allocate_slab+0x79/0x5e0
[ 95.014044][ T41] refill_objects+0x2d5/0x350
[ 95.015600][ T41] __pcs_replace_empty_main+0x2bf/0x6b0
[ 95.017795][ T41] __kmalloc_noprof+0x485/0x720
[ 95.019765][ T41] __usb_create_hcd+0x67/0x900
[ 95.021695][ T41] vhci_hcd_probe+0x104/0x3e0
[ 95.023737][ T41] platform_probe+0xf9/0x190
[ 95.025786][ T41] really_probe+0x254/0xae0
[ 95.027739][ T41] __driver_probe_device+0x1e8/0x360
[ 95.030023][ T41] driver_probe_device+0x4f/0x240
[ 95.032306][ T41] __device_attach_driver+0x270/0x410
[ 95.034866][ T41] bus_for_each_drv+0x258/0x2f0
[ 95.037086][ T41] __device_attach+0x2c4/0x450
[ 95.039137][ T41] page last free pid 1 tgid 1 stack trace:
[ 95.041683][ T41] __free_frozen_pages+0xc1e/0xd10
[ 95.043825][ T41] __slab_free+0x274/0x2c0
[ 95.045654][ T41] qlist_free_all+0x99/0x100
[ 95.047692][ T41] kasan_quarantine_reduce+0x148/0x160
[ 95.050048][ T41] __kasan_slab_alloc+0x22/0x80
[ 95.052195][ T41] __kmalloc_cache_noprof+0x2ab/0x660
[ 95.054801][ T41] device_create_with_groups+0x13d/0x300
[ 95.057355][ T41] misc_register+0x2f7/0x560
[ 95.059474][ T41] do_one_initcall+0x250/0x870
[ 95.061659][ T41] do_initcall_level+0x10a/0x1a0
[ 95.063868][ T41] do_initcalls+0x59/0xa0
[ 95.065747][ T41] kernel_init_freeable+0x29d/0x3e0
[ 95.067975][ T41] kernel_init+0x1d/0x1d0
[ 95.070061][ T41] ret_from_fork+0x514/0xb70
[ 95.072483][ T41] ret_from_fork_asm+0x1a/0x30
[ 95.075172][ T41]
[ 95.076622][ T41] Memory state around the buggy address:
[ 95.079603][ T41] ffff888034c70a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 95.083481][ T41] ffff888034c70a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 95.086765][ T41] >ffff888034c70b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 95.089999][ T41] ^
[ 95.093215][ T41] ffff888034c70b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 95.096681][ T41] ffff888034c70c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 95.100408][ T41] ==================================================================
[ 95.104090][ T41] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 95.107424][ T41] CPU: 0 UID: 0 PID: 41 Comm: kworker/u4:3 Not tainted syzkaller #0 PREEMPT(full)
[ 95.111581][ T41] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.116078][ T41] Workqueue: usbip_event event_handler
[ 95.118537][ T41] Call Trace:
[ 95.120121][ T41]
[ 95.121496][ T41] vpanic+0x56c/0xa60
[ 95.123346][ T41] ? __pfx_vpanic+0x10/0x10
[ 95.125558][ T41] panic+0xc5/0xd0
[ 95.127428][ T41] ? __pfx_panic+0x10/0x10
[ 95.129713][ T41] ? _raw_spin_lock_irqsave+0x40/0x60
[ 95.132123][ T41] ? rcu_is_watching+0x15/0xb0
[ 95.134100][ T41] ? _raw_spin_lock_irqsave+0x40/0x60
[ 95.136329][ T41] ? _raw_spin_lock_irqsave+0x40/0x60
[ 95.138562][ T41] check_panic_on_warn+0x89/0xb0
[ 95.140773][ T41] ? _raw_spin_lock_irqsave+0x40/0x60
[ 95.143027][ T41] end_report+0x73/0x170
[ 95.144811][ T41] ? _raw_spin_lock_irqsave+0x40/0x60
[ 95.147263][ T41] kasan_report+0x128/0x150
[ 95.149437][ T41] ? _raw_spin_lock_irqsave+0x40/0x60
[ 95.152054][ T41] ? event_handler+0x2b0/0x4b0
[ 95.154173][ T41] __kasan_check_byte+0x2a/0x40
[ 95.156313][ T41] lock_acquire+0x84/0x350
[ 95.158224][ T41] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 95.160685][ T41] ? rcu_is_watching+0x15/0xb0
[ 95.162800][ T41] _raw_spin_lock_irqsave+0x40/0x60
[ 95.165145][ T41] ? event_handler+0x2b0/0x4b0
[ 95.167294][ T41] event_handler+0x2b0/0x4b0
[ 95.169383][ T41] ? process_scheduled_works+0xa20/0x14e0
[ 95.171778][ T41] process_scheduled_works+0xa8e/0x14e0
[ 95.174189][ T41] ? __pfx_process_scheduled_works+0x10/0x10
[ 95.176803][ T41] ? assign_work+0x3cf/0x5d0
[ 95.178874][ T41] worker_thread+0xa47/0xfb0
[ 95.180935][ T41] ? __kthread_parkme+0x71/0x1f0
[ 95.183150][ T41] kthread+0x388/0x470
[ 95.184934][ T41] ? __pfx_worker_thread+0x10/0x10
[ 95.187362][ T41] ? __pfx_kthread+0x10/0x10
[ 95.189534][ T41] ret_from_fork+0x514/0xb70
[ 95.191732][ T41] ? __pfx_ret_from_fork+0x10/0x10
[ 95.193981][ T41] ? __switch_to+0xc89/0x1420
[ 95.196024][ T41] ? __pfx_kthread+0x10/0x10
[ 95.197976][ T41] ret_from_fork_asm+0x1a/0x30
[ 95.199755][ T41]
[ 95.201213][ T41] Kernel Offset: disabled
[ 95.202697][ T41] Rebooting in 86400 seconds..