program: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000900)="880100"/64) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(&(0x7f0000000d00)=@filename='none\x00', &(0x7f0000000e00)='./sys\x00', &(0x7f0000000f00)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./sys/devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/adsl_state\x00', 0x2, 0x0) write(r1, &(0x7f0000001200)='stop\x00', 0x5) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000001300)) [ 93.813622][ T4652] Bluetooth: hci0: command tx timeout [ 94.125511][ T5315] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 94.278596][ T5315] usb 5-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 94.282039][ T5315] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.257518][ T5315] cxacru 5-1:1.0: invalid response length to cm 0x84: 0 [ 95.260408][ T5315] ATM dev 0: cxacru_atm_start: CHIP_ADSL_LINE_START returned -5 [ 95.458421][ T5315] ATM dev 0: ADSL state: running [ 95.460506][ T5315] ATM dev 0: ADSL line: down [ 95.896572][ T4652] Bluetooth: hci0: command tx timeout [ 97.736418][ T5332] cxacru 5-1:1.0: receive of cm 0x85 failed (-104) [ 97.742713][ T5332] ATM dev 0: change adsl state: CHIP_ADSL_LINE_STOP returned -104 [ 97.770397][ C0] ATM dev 0: usbatm_complete: urb 0xffff88801c7f3500 failed (-71)! [ 97.773502][ C0] ATM dev 0: usbatm_complete: urb 0xffff88801c7f3400 failed (-71)! [ 97.776486][ C0] ATM dev 0: usbatm_complete: urb 0xffff88801c7f3300 failed (-71)! [ 97.779539][ C0] ATM dev 0: usbatm_complete: urb 0xffff88801c7f3200 failed (-71)! [ 97.786046][ T5315] usb 5-1: USB disconnect, device number 2 [ 97.788993][ T9] cxacru 5-1:1.0: send of cm 0x88 failed (-71) [ 97.799824][ T9] ATM dev 0: poll status: error -71 [ 97.806238][ T9] ATM dev 0: polling disabled, set adsl_state to 'start' or 'poll' to resume [ 97.821135][ T9] ================================================================== [ 97.824021][ T9] BUG: KASAN: slab-use-after-free in __mutex_lock+0x154/0x1550 [ 97.826952][ T9] Read of size 8 at addr ffff88801f480218 by task kworker/0:0/9 [ 97.829867][ T9] [ 97.830829][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full) [ 97.830839][ T9] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 97.830844][ T9] Workqueue: events cxacru_poll_status [ 97.830858][ T9] Call Trace: [ 97.830863][ T9] [ 97.830867][ T9] dump_stack_lvl+0xe8/0x150 [ 97.830878][ T9] print_address_description+0x55/0x1e0 [ 97.830888][ T9] ? __mutex_lock+0x154/0x1550 [ 97.830896][ T9] print_report+0x58/0x70 [ 97.830903][ T9] kasan_report+0x117/0x150 [ 97.830913][ T9] ? __mutex_lock+0x154/0x1550 [ 97.830920][ T9] __mutex_lock+0x154/0x1550 [ 97.830927][ T9] ? preempt_schedule_common+0x82/0xd0 [ 97.830934][ T9] ? preempt_schedule_thunk+0x16/0x40 [ 97.830946][ T9] ? cxacru_poll_status+0x73a/0x1110 [ 97.830958][ T9] ? __mutex_unlock_slowpath+0x794/0x900 [ 97.830968][ T9] ? __pfx___mutex_lock+0x10/0x10 [ 97.830981][ T9] ? kfree+0x1c5/0x640 [ 97.830990][ T9] ? cxacru_poll_status+0x381/0x1110 [ 97.831003][ T9] cxacru_poll_status+0x73a/0x1110 [ 97.831016][ T9] ? irqentry_exit+0x218/0x8f0 [ 97.831027][ T9] ? trace_irq_disable+0x3b/0x140 [ 97.831040][ T9] ? __pfx_cxacru_poll_status+0x10/0x10 [ 97.831055][ T9] ? rcu_is_watching+0x15/0xb0 [ 97.831065][ T9] ? process_scheduled_works+0xa20/0x14e0 [ 97.831077][ T9] process_scheduled_works+0xa8e/0x14e0 [ 97.831094][ T9] ? __pfx_process_scheduled_works+0x10/0x10 [ 97.831107][ T9] ? assign_work+0x3cf/0x5d0 [ 97.831119][ T9] worker_thread+0xa47/0xfb0 [ 97.831136][ T9] kthread+0x388/0x470 [ 97.831150][ T9] ? __pfx_worker_thread+0x10/0x10 [ 97.831161][ T9] ? __pfx_kthread+0x10/0x10 [ 97.831175][ T9] ret_from_fork+0x514/0xb70 [ 97.831190][ T9] ? __pfx_ret_from_fork+0x10/0x10 [ 97.831205][ T9] ? __switch_to+0xc89/0x1420 [ 97.831218][ T9] ? __pfx_kthread+0x10/0x10 [ 97.831233][ T9] ret_from_fork_asm+0x1a/0x30 [ 97.831246][ T9] [ 97.831250][ T9] [ 97.910917][ T9] Allocated by task 5315: [ 97.912670][ T9] kasan_save_track+0x3e/0x80 [ 97.914587][ T9] __kasan_kmalloc+0x93/0xb0 [ 97.916455][ T9] __kmalloc_cache_noprof+0x32d/0x660 [ 97.918730][ T9] cxacru_bind+0xa3/0x1130 [ 97.920620][ T9] usbatm_usb_probe+0x37f/0x1db0 [ 97.922660][ T9] cxacru_usb_probe+0x17f/0x220 [ 97.924670][ T9] usb_probe_interface+0x653/0xc60 [ 97.926824][ T9] really_probe+0x254/0xae0 [ 97.928711][ T9] __driver_probe_device+0x1e8/0x360 [ 97.930883][ T9] driver_probe_device+0x4f/0x240 [ 97.932992][ T9] __device_attach_driver+0x270/0x410 [ 97.935166][ T9] bus_for_each_drv+0x258/0x2f0 [ 97.937223][ T9] __device_attach+0x2c4/0x450 [ 97.939176][ T9] device_initial_probe+0xa1/0xd0 [ 97.941205][ T9] bus_probe_device+0x12a/0x220 [ 97.943189][ T9] device_add+0x7d7/0xb80 [ 97.944991][ T9] usb_set_configuration+0x1ad8/0x2180 [ 97.947243][ T9] usb_generic_driver_probe+0x8d/0x150 [ 97.949505][ T9] usb_probe_device+0x1c3/0x3b0 [ 97.951516][ T9] really_probe+0x254/0xae0 [ 97.953405][ T9] __driver_probe_device+0x1e8/0x360 [ 97.955595][ T9] driver_probe_device+0x4f/0x240 [ 97.957686][ T9] __device_attach_driver+0x270/0x410 [ 97.959878][ T9] bus_for_each_drv+0x258/0x2f0 [ 97.961891][ T9] __device_attach+0x2c4/0x450 [ 97.963832][ T9] device_initial_probe+0xa1/0xd0 [ 97.965962][ T9] bus_probe_device+0x12a/0x220 [ 97.967969][ T9] device_add+0x7d7/0xb80 [ 97.969730][ T9] usb_new_device+0x99d/0x1620 [ 97.971736][ T9] hub_event+0x28e8/0x4d30 [ 97.973627][ T9] process_scheduled_works+0xa8e/0x14e0 [ 97.975904][ T9] worker_thread+0xa47/0xfb0 [ 97.977822][ T9] kthread+0x388/0x470 [ 97.979521][ T9] ret_from_fork+0x514/0xb70 [ 97.981469][ T9] ret_from_fork_asm+0x1a/0x30 [ 97.983521][ T9] [ 97.984548][ T9] Freed by task 5315: [ 97.986189][ T9] kasan_save_track+0x3e/0x80 [ 97.988136][ T9] kasan_save_free_info+0x40/0x50 [ 97.990218][ T9] __kasan_slab_free+0x5c/0x80 [ 97.992193][ T9] kfree+0x1c5/0x640 [ 97.993815][ T9] cxacru_unbind+0x1c8/0x340 [ 97.995736][ T9] usbatm_usb_disconnect+0x42b/0x620 [ 97.997907][ T9] usb_unbind_interface+0x295/0x9f0 [ 98.000064][ T9] device_release_driver_internal+0x4f5/0x880 [ 98.002608][ T9] bus_remove_device+0x444/0x560 [ 98.004674][ T9] device_del+0x524/0x8f0 [ 98.006471][ T9] usb_disable_device+0x3d4/0x8d0 [ 98.008558][ T9] usb_disconnect+0x346/0x9a0 [ 98.010539][ T9] hub_event+0x1bbb/0x4d30 [ 98.012413][ T9] process_scheduled_works+0xa8e/0x14e0 [ 98.014721][ T9] worker_thread+0xa47/0xfb0 [ 98.016668][ T9] kthread+0x388/0x470 [ 98.018435][ T9] ret_from_fork+0x514/0xb70 [ 98.020333][ T9] ret_from_fork_asm+0x1a/0x30 [ 98.022406][ T9] [ 98.023402][ T9] Last potentially related work creation: [ 98.025753][ T9] kasan_save_stack+0x3e/0x60 [ 98.027702][ T9] kasan_record_aux_stack+0xbd/0xd0 [ 98.029899][ T9] insert_work+0x3d/0x330 [ 98.031706][ T9] __queue_work+0xcd8/0x10a0 [ 98.033645][ T9] call_timer_fn+0x192/0x5e0 [ 98.035605][ T9] __run_timer_base+0x67e/0x8b0 [ 98.037627][ T9] run_timer_softirq+0xb7/0x170 [ 98.039630][ T9] handle_softirqs+0x225/0x840 [ 98.041698][ T9] __irq_exit_rcu+0xca/0x220 [ 98.043710][ T9] irq_exit_rcu+0x9/0x30 [ 98.045507][ T9] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 98.047799][ T9] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 98.050257][ T9] [ 98.051300][ T9] The buggy address belongs to the object at ffff88801f480000 [ 98.051300][ T9] which belongs to the cache kmalloc-1k of size 1024 [ 98.056883][ T9] The buggy address is located 536 bytes inside of [ 98.056883][ T9] freed 1024-byte region [ffff88801f480000, ffff88801f480400) [ 98.062464][ T9] [ 98.063540][ T9] The buggy address belongs to the physical page: [ 98.066119][ T9] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1f480 [ 98.069700][ T9] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 98.073147][ T9] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 98.076210][ T9] page_type: f5(slab) [ 98.077942][ T9] raw: 00fff00000000040 ffff88801b041dc0 dead000000000122 0000000000000000 [ 98.081453][ T9] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 98.084883][ T9] head: 00fff00000000040 ffff88801b041dc0 dead000000000122 0000000000000000 [ 98.088459][ T9] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 98.091998][ T9] head: 00fff00000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff [ 98.095459][ T9] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 98.099026][ T9] page dumped because: kasan: bad access detected [ 98.101668][ T9] page_owner tracks the page as allocated [ 98.104045][ T9] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1062, tgid 1062 (kworker/u4:8), ts 94168938986, free_ts 93936061593 [ 98.112299][ T9] post_alloc_hook+0x1f9/0x250 [ 98.115440][ T9] get_page_from_freelist+0x21fa/0x2270 [ 98.117755][ T9] __alloc_frozen_pages_noprof+0x18d/0x380 [ 98.120151][ T9] allocate_slab+0x79/0x5e0 [ 98.122117][ T9] refill_objects+0x2d5/0x350 [ 98.124080][ T9] __pcs_replace_empty_main+0x2bf/0x6b0 [ 98.126402][ T9] __kmalloc_noprof+0x485/0x720 [ 98.128422][ T9] ieee802_11_parse_elems_full+0x14b/0x2db0 [ 98.130876][ T9] ieee80211_ibss_rx_queued_mgmt+0x509/0x2c40 [ 98.133459][ T9] ieee80211_iface_work+0x78a/0x1010 [ 98.135635][ T9] cfg80211_wiphy_work+0x29e/0x420 [ 98.137812][ T9] process_scheduled_works+0xa8e/0x14e0 [ 98.140065][ T9] worker_thread+0xa47/0xfb0 [ 98.142017][ T9] kthread+0x388/0x470 [ 98.143733][ T9] ret_from_fork+0x514/0xb70 [ 98.145650][ T9] ret_from_fork_asm+0x1a/0x30 [ 98.147675][ T9] page last free pid 15 tgid 15 stack trace: [ 98.150135][ T9] __free_frozen_pages+0xc1e/0xd10 [ 98.152292][ T9] tlb_remove_table_rcu+0x85/0x100 [ 98.154398][ T9] rcu_core+0x78b/0x10a0 [ 98.156139][ T9] handle_softirqs+0x225/0x840 [ 98.158211][ T9] run_ksoftirqd+0x36/0x60 [ 98.160026][ T9] smpboot_thread_fn+0x57c/0xa80 [ 98.162148][ T9] kthread+0x388/0x470 [ 98.163834][ T9] ret_from_fork+0x514/0xb70 [ 98.165758][ T9] ret_from_fork_asm+0x1a/0x30 [ 98.167726][ T9] [ 98.168788][ T9] Memory state around the buggy address: [ 98.171164][ T9] ffff88801f480100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 98.174366][ T9] ffff88801f480180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 98.177609][ T9] >ffff88801f480200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 98.181117][ T9] ^ [ 98.183117][ T9] ffff88801f480280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 98.186399][ T9] ffff88801f480300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 98.189684][ T9] ==================================================================