program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000480), r0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f0000004340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x24, r1, 0x331, 0x1ffc, 0x40000000, {0x8}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}, @BATADV_ATTR_HARD_IFINDEX={0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x400400c}, 0x0) (async) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) (async) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa) (async) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x0) (async) syz_clone(0x200, 0x0, 0x0, 0x0, 0x0, 0x0) (async) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='pagemap\x00') pread64(r4, &(0x7f0000001240)=""/102400, 0x19000, 0x1000000300) r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0) write(r5, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) (async) r7 = openat$sndseq(0xffffff9c, &(0x7f0000001240), 0x80) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r7, 0xc058534b, &(0x7f0000001280)={0x64, 0x4, 0x749c, 0x7, 0xf, 0x3}) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="4400000010004b0401800000000000007a000000", @ANYRES32=0x0, @ANYBLOB="4800000000000000240012"], 0x44}}, 0x4) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f00000003c0)={0x3, 0x0, [{0x3, 0x1, 0x0, 0x0, @msi={0x2, 0x6, 0x1, 0x2}}, {0x3, 0x1, 0x0, 0x0, @msi={0x1, 0x2, 0x0, 0x7}}, {0x3, 0x1, 0x0, 0x0, @sint={0x40, 0x8}}]}) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a14000000000a050000000000000000000a00fffe38000000090a010300000000000000000700000008000f40000000020900010073797a310000000008000a400000000008000f400000000114"], 0x74}, 0x1, 0x0, 0x0, 0x88000}, 0x20000000) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x2, 0xff, 0x8a, 0x2, 0x0, 0xfff, 0x20970, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0xff, 0x2, @perf_bp={0x0, 0xa}, 0x8100, 0x9, 0x6, 0x9, 0x28d4, 0x400, 0xb2d, 0x0, 0x3, 0x0, 0x2}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x8) (async) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="880000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="2b030fffffff0000600012800b00010067656e65766500005000028005000800000000000400380205000900010000000500"], 0x88}}, 0x0) ioctl$COMEDI_SETWSUBD(r5, 0x6411) [ 92.059636][ T44] Bluetooth: hci0: command tx timeout [ 92.081501][ T10] cfg80211: failed to load regulatory.db [ 92.148986][ T5324] vhci_hcd vhci_hcd.0: remove, state 4 [ 92.165416][ T5324] usb usb7: USB disconnect, device number 1 [ 92.217200][ T24] vhci_hcd vhci_hcd.0: stop threads [ 92.220335][ T5324] vhci_hcd vhci_hcd.0: USB bus 7 deregistered [ 92.225861][ T24] vhci_hcd vhci_hcd.0: release socket [ 92.235707][ T24] vhci_hcd vhci_hcd.0: disconnect device [ 92.248106][ T24] vhci_hcd vhci_hcd.0: stop threads [ 92.256731][ T5324] vhci_hcd vhci_hcd.0: remove, state 4 [ 92.259673][ T24] ================================================================== [ 92.262916][ T24] BUG: KASAN: slab-use-after-free in vhci_shutdown_connection+0x1d4/0x650 [ 92.266256][ T24] Read of size 8 at addr ffff888034a84780 by task kworker/u4:2/24 [ 92.269241][ T24] [ 92.270196][ T24] CPU: 0 UID: 0 PID: 24 Comm: kworker/u4:2 Not tainted syzkaller #0 PREEMPT(full) [ 92.270209][ T24] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 92.270216][ T24] Workqueue: usbip_event event_handler [ 92.270233][ T24] Call Trace: [ 92.270240][ T24] [ 92.270246][ T24] dump_stack_lvl+0xe8/0x150 [ 92.270261][ T24] print_address_description+0x55/0x1e0 [ 92.270273][ T24] ? vhci_shutdown_connection+0x1d4/0x650 [ 92.270284][ T24] print_report+0x58/0x70 [ 92.270296][ T24] kasan_report+0x117/0x150 [ 92.270310][ T24] ? vhci_shutdown_connection+0x1d4/0x650 [ 92.270324][ T24] vhci_shutdown_connection+0x1d4/0x650 [ 92.270337][ T24] event_handler+0x2a4/0x4b0 [ 92.270348][ T24] ? process_scheduled_works+0xa20/0x14e0 [ 92.270360][ T24] process_scheduled_works+0xa8e/0x14e0 [ 92.270377][ T24] ? __pfx_process_scheduled_works+0x10/0x10 [ 92.270389][ T24] ? assign_work+0x3cf/0x5d0 [ 92.270401][ T24] worker_thread+0xa47/0xfb0 [ 92.270419][ T24] kthread+0x388/0x470 [ 92.270433][ T24] ? __pfx_worker_thread+0x10/0x10 [ 92.270444][ T24] ? __pfx_kthread+0x10/0x10 [ 92.270458][ T24] ret_from_fork+0x514/0xb70 [ 92.270469][ T24] ? __pfx_ret_from_fork+0x10/0x10 [ 92.270478][ T24] ? __switch_to+0xc89/0x1420 [ 92.270487][ T24] ? __pfx_kthread+0x10/0x10 [ 92.270496][ T24] ret_from_fork_asm+0x1a/0x30 [ 92.270505][ T24] [ 92.270507][ T24] [ 92.328384][ T24] Allocated by task 1: [ 92.330014][ T24] kasan_save_track+0x3e/0x80 [ 92.331840][ T24] __kasan_kmalloc+0x93/0xb0 [ 92.333703][ T24] __kmalloc_noprof+0x375/0x720 [ 92.335721][ T24] __usb_create_hcd+0x67/0x900 [ 92.337816][ T24] vhci_hcd_probe+0x1e6/0x3e0 [ 92.339886][ T24] platform_probe+0xf9/0x190 [ 92.341867][ T24] really_probe+0x254/0xae0 [ 92.343804][ T24] __driver_probe_device+0x1e8/0x360 [ 92.346037][ T24] driver_probe_device+0x4f/0x240 [ 92.348221][ T24] __device_attach_driver+0x270/0x410 [ 92.350234][ T24] bus_for_each_drv+0x258/0x2f0 [ 92.352112][ T24] __device_attach+0x2c4/0x450 [ 92.354044][ T24] device_initial_probe+0xa1/0xd0 [ 92.356074][ T24] bus_probe_device+0x12a/0x220 [ 92.357924][ T24] device_add+0x7d7/0xb80 [ 92.359565][ T24] platform_device_add+0x4bd/0x860 [ 92.361451][ T24] platform_device_register_full+0x62d/0x710 [ 92.363818][ T24] vhci_hcd_init+0x227/0x360 [ 92.365797][ T24] do_one_initcall+0x250/0x870 [ 92.367732][ T24] do_initcall_level+0x10a/0x1a0 [ 92.369731][ T24] do_initcalls+0x59/0xa0 [ 92.371504][ T24] kernel_init_freeable+0x29d/0x3e0 [ 92.373514][ T24] kernel_init+0x1d/0x1d0 [ 92.375444][ T24] ret_from_fork+0x514/0xb70 [ 92.377358][ T24] ret_from_fork_asm+0x1a/0x30 [ 92.379366][ T24] [ 92.380296][ T24] Freed by task 5324: [ 92.381759][ T24] kasan_save_track+0x3e/0x80 [ 92.383559][ T24] kasan_save_free_info+0x40/0x50 [ 92.385450][ T24] __kasan_slab_free+0x5c/0x80 [ 92.387264][ T24] kfree+0x1c5/0x640 [ 92.388881][ T24] vhci_hcd_remove+0x9e/0x110 [ 92.390744][ T24] device_release_driver_internal+0x48b/0x880 [ 92.393117][ T24] unbind_store+0x1a1/0x1d0 [ 92.395069][ T24] kernfs_fop_write_iter+0x3a4/0x540 [ 92.397213][ T24] vfs_write+0x612/0xba0 [ 92.398964][ T24] ksys_write+0x150/0x270 [ 92.400764][ T24] do_syscall_64+0x174/0x580 [ 92.402680][ T24] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.405338][ T24] [ 92.406370][ T24] Last potentially related work creation: [ 92.408869][ T24] kasan_save_stack+0x3e/0x60 [ 92.410983][ T24] kasan_record_aux_stack+0xbd/0xd0 [ 92.413196][ T24] insert_work+0x3d/0x330 [ 92.414911][ T24] __queue_work+0xcd8/0x10a0 [ 92.416920][ T24] queue_work_on+0x106/0x1d0 [ 92.418971][ T24] unlink1+0x344/0x3e0 [ 92.420792][ T24] usb_hcd_unlink_urb+0xe6/0x1e0 [ 92.423071][ T24] usb_kill_urb+0x10b/0x2f0 [ 92.425108][ T24] hub_quiesce+0x211/0x330 [ 92.427016][ T24] hub_suspend+0x904/0xad0 [ 92.428866][ T24] usb_suspend_both+0x285/0x1040 [ 92.430964][ T24] usb_runtime_suspend+0x58/0x110 [ 92.433036][ T24] __rpm_callback+0x2c7/0x950 [ 92.435065][ T24] rpm_suspend+0x8a0/0x17b0 [ 92.436897][ T24] __pm_runtime_suspend+0x12f/0x1a0 [ 92.439034][ T24] usb_new_device+0xadf/0x1620 [ 92.441142][ T24] register_root_hub+0x250/0x5c0 [ 92.443311][ T24] usb_add_hcd+0xac7/0xf80 [ 92.445293][ T24] vhci_hcd_probe+0x1fa/0x3e0 [ 92.447703][ T24] platform_probe+0xf9/0x190 [ 92.449981][ T24] really_probe+0x254/0xae0 [ 92.451798][ T24] __driver_probe_device+0x1e8/0x360 [ 92.453877][ T24] driver_probe_device+0x4f/0x240 [ 92.456111][ T24] __device_attach_driver+0x270/0x410 [ 92.458540][ T24] bus_for_each_drv+0x258/0x2f0 [ 92.461169][ T24] __device_attach+0x2c4/0x450 [ 92.463516][ T24] device_initial_probe+0xa1/0xd0 [ 92.465784][ T24] bus_probe_device+0x12a/0x220 [ 92.467799][ T24] device_add+0x7d7/0xb80 [ 92.469692][ T24] platform_device_add+0x4bd/0x860 [ 92.471938][ T24] platform_device_register_full+0x62d/0x710 [ 92.474430][ T24] vhci_hcd_init+0x227/0x360 [ 92.476484][ T24] do_one_initcall+0x250/0x870 [ 92.478515][ T24] do_initcall_level+0x10a/0x1a0 [ 92.480684][ T24] do_initcalls+0x59/0xa0 [ 92.482611][ T24] kernel_init_freeable+0x29d/0x3e0 [ 92.485066][ T24] kernel_init+0x1d/0x1d0 [ 92.486968][ T24] ret_from_fork+0x514/0xb70 [ 92.488949][ T24] ret_from_fork_asm+0x1a/0x30 [ 92.491039][ T24] [ 92.492089][ T24] Second to last potentially related work creation: [ 92.494903][ T24] kasan_save_stack+0x3e/0x60 [ 92.496801][ T24] kasan_record_aux_stack+0xbd/0xd0 [ 92.498865][ T24] insert_work+0x3d/0x330 [ 92.500800][ T24] __queue_work+0xcd8/0x10a0 [ 92.502856][ T24] queue_work_on+0x106/0x1d0 [ 92.504803][ T24] usb_hcd_submit_urb+0xa3b/0x1b60 [ 92.506942][ T24] usb_start_wait_urb+0x13f/0x5b0 [ 92.509136][ T24] usb_control_msg+0x234/0x3e0 [ 92.511050][ T24] hub_suspend+0x891/0xad0 [ 92.512863][ T24] usb_suspend_both+0x285/0x1040 [ 92.515064][ T24] usb_runtime_suspend+0x58/0x110 [ 92.517206][ T24] __rpm_callback+0x2c7/0x950 [ 92.519180][ T24] rpm_suspend+0x8a0/0x17b0 [ 92.521026][ T24] __pm_runtime_suspend+0x12f/0x1a0 [ 92.523106][ T24] usb_new_device+0xadf/0x1620 [ 92.525075][ T24] register_root_hub+0x250/0x5c0 [ 92.527125][ T24] usb_add_hcd+0xac7/0xf80 [ 92.528909][ T24] vhci_hcd_probe+0x1fa/0x3e0 [ 92.530786][ T24] platform_probe+0xf9/0x190 [ 92.532675][ T24] really_probe+0x254/0xae0 [ 92.534565][ T24] __driver_probe_device+0x1e8/0x360 [ 92.536684][ T24] driver_probe_device+0x4f/0x240 [ 92.538734][ T24] __device_attach_driver+0x270/0x410 [ 92.540839][ T24] bus_for_each_drv+0x258/0x2f0 [ 92.542876][ T24] __device_attach+0x2c4/0x450 [ 92.544797][ T24] device_initial_probe+0xa1/0xd0 [ 92.546803][ T24] bus_probe_device+0x12a/0x220 [ 92.548853][ T24] device_add+0x7d7/0xb80 [ 92.550678][ T24] platform_device_add+0x4bd/0x860 [ 92.552892][ T24] platform_device_register_full+0x62d/0x710 [ 92.555439][ T24] vhci_hcd_init+0x227/0x360 [ 92.557400][ T24] do_one_initcall+0x250/0x870 [ 92.559453][ T24] do_initcall_level+0x10a/0x1a0 [ 92.561502][ T24] do_initcalls+0x59/0xa0 [ 92.563431][ T24] kernel_init_freeable+0x29d/0x3e0 [ 92.565665][ T24] kernel_init+0x1d/0x1d0 [ 92.567549][ T24] ret_from_fork+0x514/0xb70 [ 92.569516][ T24] ret_from_fork_asm+0x1a/0x30 [ 92.571588][ T24] [ 92.572633][ T24] The buggy address belongs to the object at ffff888034a84000 [ 92.572633][ T24] which belongs to the cache kmalloc-8k of size 8192 [ 92.578420][ T24] The buggy address is located 1920 bytes inside of [ 92.578420][ T24] freed 8192-byte region [ffff888034a84000, ffff888034a86000) [ 92.583957][ T24] [ 92.585011][ T24] The buggy address belongs to the physical page: [ 92.587687][ T24] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34a80 [ 92.591143][ T24] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 92.594540][ T24] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 92.597506][ T24] page_type: f5(slab) [ 92.599106][ T24] raw: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 92.602607][ T24] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 92.606060][ T24] head: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 92.609492][ T24] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 92.612832][ T24] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 92.616404][ T24] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 92.619971][ T24] page dumped because: kasan: bad access detected [ 92.622717][ T24] page_owner tracks the page as allocated [ 92.625112][ T24] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 16684356033, free_ts 16609830146 [ 92.633917][ T24] post_alloc_hook+0x1f9/0x250 [ 92.636107][ T24] get_page_from_freelist+0x21fa/0x2270 [ 92.638289][ T24] __alloc_frozen_pages_noprof+0x18d/0x380 [ 92.640589][ T24] allocate_slab+0x79/0x5e0 [ 92.642564][ T24] refill_objects+0x2d5/0x350 [ 92.644550][ T24] __pcs_replace_empty_main+0x2bf/0x6b0 [ 92.646937][ T24] __kmalloc_noprof+0x485/0x720 [ 92.648978][ T24] __usb_create_hcd+0x67/0x900 [ 92.650999][ T24] vhci_hcd_probe+0x1e6/0x3e0 [ 92.652942][ T24] platform_probe+0xf9/0x190 [ 92.654935][ T24] really_probe+0x254/0xae0 [ 92.656705][ T24] __driver_probe_device+0x1e8/0x360 [ 92.658835][ T24] driver_probe_device+0x4f/0x240 [ 92.660773][ T24] __device_attach_driver+0x270/0x410 [ 92.662910][ T24] bus_for_each_drv+0x258/0x2f0 [ 92.665064][ T24] __device_attach+0x2c4/0x450 [ 92.667132][ T24] page last free pid 1387 tgid 1387 stack trace: [ 92.669827][ T24] free_pages_prepare+0x960/0xa60 [ 92.671967][ T24] __free_contig_range_common+0x174/0x340 [ 92.674367][ T24] free_pages_bulk+0x48/0x120 [ 92.676488][ T24] vfree+0x224/0x4a0 [ 92.678101][ T24] delayed_vfree_work+0x55/0x80 [ 92.680172][ T24] process_scheduled_works+0xa8e/0x14e0 [ 92.682498][ T24] worker_thread+0xa47/0xfb0 [ 92.684385][ T24] kthread+0x388/0x470 [ 92.686132][ T24] ret_from_fork+0x514/0xb70 [ 92.688134][ T24] ret_from_fork_asm+0x1a/0x30 [ 92.690027][ T24] [ 92.691060][ T24] Memory state around the buggy address: [ 92.693357][ T24] ffff888034a84680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 92.696809][ T24] ffff888034a84700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 92.700624][ T24] >ffff888034a84780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 92.704697][ T24] ^ [ 92.706909][ T24] ffff888034a84800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 92.710874][ T24] ffff888034a84880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 92.714263][ T24] ================================================================== [ 92.718531][ T5324] usb usb6: USB disconnect, device number 1 [ 92.781318][ T5324] vhci_hcd vhci_hcd.0: USB bus 6 deregistered