program:
openat$fb1(0xffffff9c, &(0x7f0000000000), 0x100, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000240)='./sys\x00', &(0x7f00000004c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='1', 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
ioctl$FBIOPUT_CON2FBMAP(r1, 0x4610, &(0x7f0000000140)={0x34, 0x1})
write(r1, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
write(0xffffffffffffffff, &(0x7f0000000180)="7668070000010000003000ccd27f8321c2b09b02ff65c07e0e510792648d38eb605a7027eca5e21b388ad4b4c62c7c02cffc542bcd41ea42b4f5502dfad6", 0x3e)
openat$fb1(0xffffff9c, &(0x7f0000000000), 0x100, 0x0) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000240)='./sys\x00', &(0x7f00000004c0)='sysfs\x00', 0x0, 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) (async)
write(r0, &(0x7f00000000c0)='1', 0x1) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) (async)
ioctl$FBIOPUT_CON2FBMAP(r1, 0x4610, &(0x7f0000000140)={0x34, 0x1}) (async)
write(r1, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa) (async)
write(0xffffffffffffffff, &(0x7f0000000180)="7668070000010000003000ccd27f8321c2b09b02ff65c07e0e510792648d38eb605a7027eca5e21b388ad4b4c62c7c02cffc542bcd41ea42b4f5502dfad6", 0x3e) (async)
[ 140.407665][ T5297] Bluetooth: hci0: command tx timeout
[ 140.527056][ T5337] vhci_hcd vhci_hcd.0: remove, state 4
[ 140.530033][ T5337] usb usb7: USB disconnect, device number 1
[ 140.623206][ T75] vhci_hcd vhci_hcd.0: stop threads
[ 140.629356][ T5337] vhci_hcd vhci_hcd.0: USB bus 7 deregistered
[ 140.636533][ T75] vhci_hcd vhci_hcd.0: release socket
[ 140.646719][ T75] vhci_hcd vhci_hcd.0: disconnect device
[ 140.649152][ T75] vhci_hcd vhci_hcd.0: stop threads
[ 140.657460][ T75] vhci_hcd vhci_hcd.0: release socket
[ 140.662309][ T75] vhci_hcd vhci_hcd.0: disconnect device
[ 140.671925][ T75] vhci_hcd vhci_hcd.0: stop threads
[ 140.674421][ T75] vhci_hcd vhci_hcd.0: release socket
[ 140.678588][ T75] vhci_hcd vhci_hcd.0: disconnect device
[ 140.685941][ T75] vhci_hcd vhci_hcd.0: stop threads
[ 140.689408][ T5337] vhci_hcd vhci_hcd.0: remove, state 4
[ 140.692445][ T75] ==================================================================
[ 140.695991][ T75] BUG: KASAN: slab-use-after-free in vhci_shutdown_connection+0x1d4/0x650
[ 140.699737][ T75] Read of size 8 at addr ffff888034c10c20 by task kworker/u4:5/75
[ 140.702969][ T75]
[ 140.704019][ T75] CPU: 0 UID: 0 PID: 75 Comm: kworker/u4:5 Not tainted syzkaller #0 PREEMPT(full)
[ 140.704033][ T75] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 140.704042][ T75] Workqueue: usbip_event event_handler
[ 140.704059][ T75] Call Trace:
[ 140.704066][ T75]
[ 140.704071][ T75] dump_stack_lvl+0xe8/0x150
[ 140.704089][ T75] print_address_description+0x55/0x1e0
[ 140.704105][ T75] ? vhci_shutdown_connection+0x1d4/0x650
[ 140.704117][ T75] print_report+0x58/0x70
[ 140.704131][ T75] kasan_report+0x117/0x150
[ 140.704146][ T75] ? vhci_shutdown_connection+0x1d4/0x650
[ 140.704161][ T75] vhci_shutdown_connection+0x1d4/0x650
[ 140.704175][ T75] event_handler+0x2a4/0x4b0
[ 140.704186][ T75] ? process_scheduled_works+0xa20/0x14e0
[ 140.704200][ T75] process_scheduled_works+0xa8e/0x14e0
[ 140.704219][ T75] ? __pfx_process_scheduled_works+0x10/0x10
[ 140.704233][ T75] ? assign_work+0x3cf/0x5d0
[ 140.704246][ T75] worker_thread+0xa47/0xfb0
[ 140.704263][ T75] ? __kthread_parkme+0x71/0x1f0
[ 140.704279][ T75] kthread+0x388/0x470
[ 140.704294][ T75] ? __pfx_worker_thread+0x10/0x10
[ 140.704306][ T75] ? __pfx_kthread+0x10/0x10
[ 140.704321][ T75] ret_from_fork+0x514/0xb70
[ 140.704338][ T75] ? __pfx_ret_from_fork+0x10/0x10
[ 140.704353][ T75] ? __switch_to+0xc89/0x1420
[ 140.704367][ T75] ? __pfx_kthread+0x10/0x10
[ 140.704382][ T75] ret_from_fork_asm+0x1a/0x30
[ 140.704397][ T75]
[ 140.704401][ T75]
[ 140.767776][ T75] Allocated by task 1:
[ 140.769470][ T75] kasan_save_track+0x3e/0x80
[ 140.771436][ T75] __kasan_kmalloc+0x93/0xb0
[ 140.773326][ T75] __kmalloc_noprof+0x375/0x720
[ 140.775363][ T75] __usb_create_hcd+0x67/0x900
[ 140.777351][ T75] vhci_hcd_probe+0x1e6/0x3e0
[ 140.779216][ T75] platform_probe+0xf9/0x190
[ 140.781162][ T75] really_probe+0x254/0xae0
[ 140.782943][ T75] __driver_probe_device+0x1e8/0x360
[ 140.785254][ T75] driver_probe_device+0x4f/0x240
[ 140.787472][ T75] __device_attach_driver+0x270/0x410
[ 140.789874][ T75] bus_for_each_drv+0x258/0x2f0
[ 140.792059][ T75] __device_attach+0x2c4/0x450
[ 140.794186][ T75] device_initial_probe+0xa1/0xd0
[ 140.796412][ T75] bus_probe_device+0x12a/0x220
[ 140.798577][ T75] device_add+0x7d7/0xb80
[ 140.800593][ T75] platform_device_add+0x4bd/0x860
[ 140.802907][ T75] platform_device_register_full+0x62d/0x710
[ 140.805529][ T75] vhci_hcd_init+0x227/0x360
[ 140.807661][ T75] do_one_initcall+0x250/0x870
[ 140.809682][ T75] do_initcall_level+0x10a/0x1a0
[ 140.811781][ T75] do_initcalls+0x59/0xa0
[ 140.813648][ T75] kernel_init_freeable+0x29d/0x3e0
[ 140.815871][ T75] kernel_init+0x1d/0x1d0
[ 140.817799][ T75] ret_from_fork+0x514/0xb70
[ 140.819862][ T75] ret_from_fork_asm+0x1a/0x30
[ 140.822026][ T75]
[ 140.823151][ T75] Freed by task 5337:
[ 140.825059][ T75] kasan_save_track+0x3e/0x80
[ 140.827183][ T75] kasan_save_free_info+0x40/0x50
[ 140.829421][ T75] __kasan_slab_free+0x5c/0x80
[ 140.831578][ T75] kfree+0x1c5/0x640
[ 140.833358][ T75] vhci_hcd_remove+0x9e/0x110
[ 140.835455][ T75] device_release_driver_internal+0x48b/0x880
[ 140.837919][ T75] unbind_store+0x1a1/0x1d0
[ 140.839812][ T75] kernfs_fop_write_iter+0x3a4/0x540
[ 140.841954][ T75] vfs_write+0x612/0xba0
[ 140.843723][ T75] ksys_write+0x150/0x270
[ 140.845547][ T75] do_syscall_64+0x174/0x580
[ 140.847454][ T75] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 140.849883][ T75]
[ 140.850990][ T75] Last potentially related work creation:
[ 140.853468][ T75] kasan_save_stack+0x3e/0x60
[ 140.855572][ T75] kasan_record_aux_stack+0xbd/0xd0
[ 140.857901][ T75] insert_work+0x3d/0x330
[ 140.859810][ T75] __queue_work+0xcd8/0x10a0
[ 140.861869][ T75] queue_work_on+0x106/0x1d0
[ 140.863859][ T75] unlink1+0x344/0x3e0
[ 140.865585][ T75] usb_hcd_unlink_urb+0xe6/0x1e0
[ 140.867794][ T75] usb_kill_urb+0x10b/0x2f0
[ 140.869762][ T75] hub_quiesce+0x211/0x330
[ 140.871704][ T75] hub_suspend+0x904/0xad0
[ 140.873596][ T75] usb_suspend_both+0x285/0x1040
[ 140.875739][ T75] usb_runtime_suspend+0x58/0x110
[ 140.877945][ T75] __rpm_callback+0x2c7/0x950
[ 140.879988][ T75] rpm_suspend+0x8a0/0x17b0
[ 140.881941][ T75] __pm_runtime_suspend+0x12f/0x1a0
[ 140.884174][ T75] usb_new_device+0xadf/0x1620
[ 140.886241][ T75] register_root_hub+0x250/0x5c0
[ 140.888401][ T75] usb_add_hcd+0xac7/0xf80
[ 140.890292][ T75] vhci_hcd_probe+0x1fa/0x3e0
[ 140.892294][ T75] platform_probe+0xf9/0x190
[ 140.894262][ T75] really_probe+0x254/0xae0
[ 140.896138][ T75] __driver_probe_device+0x1e8/0x360
[ 140.898461][ T75] driver_probe_device+0x4f/0x240
[ 140.900739][ T75] __device_attach_driver+0x270/0x410
[ 140.903119][ T75] bus_for_each_drv+0x258/0x2f0
[ 140.905320][ T75] __device_attach+0x2c4/0x450
[ 140.907463][ T75] device_initial_probe+0xa1/0xd0
[ 140.909663][ T75] bus_probe_device+0x12a/0x220
[ 140.911870][ T75] device_add+0x7d7/0xb80
[ 140.913819][ T75] platform_device_add+0x4bd/0x860
[ 140.916128][ T75] platform_device_register_full+0x62d/0x710
[ 140.918747][ T75] vhci_hcd_init+0x227/0x360
[ 140.920758][ T75] do_one_initcall+0x250/0x870
[ 140.922874][ T75] do_initcall_level+0x10a/0x1a0
[ 140.925046][ T75] do_initcalls+0x59/0xa0
[ 140.926883][ T75] kernel_init_freeable+0x29d/0x3e0
[ 140.929121][ T75] kernel_init+0x1d/0x1d0
[ 140.931019][ T75] ret_from_fork+0x514/0xb70
[ 140.933023][ T75] ret_from_fork_asm+0x1a/0x30
[ 140.935158][ T75]
[ 140.936257][ T75] Second to last potentially related work creation:
[ 140.939061][ T75] kasan_save_stack+0x3e/0x60
[ 140.941101][ T75] kasan_record_aux_stack+0xbd/0xd0
[ 140.943353][ T75] insert_work+0x3d/0x330
[ 140.945260][ T75] __queue_work+0xcd8/0x10a0
[ 140.947291][ T75] queue_work_on+0x106/0x1d0
[ 140.949409][ T75] usb_hcd_submit_urb+0xa3b/0x1b60
[ 140.951694][ T75] usb_start_wait_urb+0x13f/0x5b0
[ 140.953799][ T75] usb_control_msg+0x234/0x3e0
[ 140.955899][ T75] hub_suspend+0x891/0xad0
[ 140.957850][ T75] usb_suspend_both+0x285/0x1040
[ 140.959976][ T75] usb_runtime_suspend+0x58/0x110
[ 140.962120][ T75] __rpm_callback+0x2c7/0x950
[ 140.964109][ T75] rpm_suspend+0x8a0/0x17b0
[ 140.966002][ T75] __pm_runtime_suspend+0x12f/0x1a0
[ 140.968165][ T75] usb_new_device+0xadf/0x1620
[ 140.970178][ T75] register_root_hub+0x250/0x5c0
[ 140.972347][ T75] usb_add_hcd+0xac7/0xf80
[ 140.974317][ T75] vhci_hcd_probe+0x1fa/0x3e0
[ 140.976370][ T75] platform_probe+0xf9/0x190
[ 140.978359][ T75] really_probe+0x254/0xae0
[ 140.980425][ T75] __driver_probe_device+0x1e8/0x360
[ 140.982705][ T75] driver_probe_device+0x4f/0x240
[ 140.984938][ T75] __device_attach_driver+0x270/0x410
[ 140.987289][ T75] bus_for_each_drv+0x258/0x2f0
[ 140.989380][ T75] __device_attach+0x2c4/0x450
[ 140.991408][ T75] device_initial_probe+0xa1/0xd0
[ 140.993523][ T75] bus_probe_device+0x12a/0x220
[ 140.995565][ T75] device_add+0x7d7/0xb80
[ 140.997471][ T75] platform_device_add+0x4bd/0x860
[ 140.999752][ T75] platform_device_register_full+0x62d/0x710
[ 141.002256][ T75] vhci_hcd_init+0x227/0x360
[ 141.004297][ T75] do_one_initcall+0x250/0x870
[ 141.006279][ T75] do_initcall_level+0x10a/0x1a0
[ 141.008327][ T75] do_initcalls+0x59/0xa0
[ 141.010146][ T75] kernel_init_freeable+0x29d/0x3e0
[ 141.012361][ T75] kernel_init+0x1d/0x1d0
[ 141.014190][ T75] ret_from_fork+0x514/0xb70
[ 141.016152][ T75] ret_from_fork_asm+0x1a/0x30
[ 141.018256][ T75]
[ 141.019330][ T75] The buggy address belongs to the object at ffff888034c10000
[ 141.019330][ T75] which belongs to the cache kmalloc-8k of size 8192
[ 141.025344][ T75] The buggy address is located 3104 bytes inside of
[ 141.025344][ T75] freed 8192-byte region [ffff888034c10000, ffff888034c12000)
[ 141.031109][ T75]
[ 141.032170][ T75] The buggy address belongs to the physical page:
[ 141.034843][ T75] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34c10
[ 141.038667][ T75] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 141.042381][ T75] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff)
[ 141.045697][ T75] page_type: f5(slab)
[ 141.047408][ T75] raw: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000
[ 141.051045][ T75] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
[ 141.054682][ T75] head: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000
[ 141.058353][ T75] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
[ 141.062038][ T75] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 141.065716][ T75] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 141.069227][ T75] page dumped because: kasan: bad access detected
[ 141.071942][ T75] page_owner tracks the page as allocated
[ 141.074297][ T75] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 28937752659, free_ts 28919451583
[ 141.082843][ T75] post_alloc_hook+0x1f9/0x250
[ 141.084925][ T75] get_page_from_freelist+0x21fa/0x2270
[ 141.087179][ T75] __alloc_frozen_pages_noprof+0x18d/0x380
[ 141.089620][ T75] allocate_slab+0x79/0x5e0
[ 141.091546][ T75] refill_objects+0x2d5/0x350
[ 141.093481][ T75] __pcs_replace_empty_main+0x2bf/0x6b0
[ 141.095737][ T75] __kmalloc_noprof+0x485/0x720
[ 141.097817][ T75] __usb_create_hcd+0x67/0x900
[ 141.099976][ T75] vhci_hcd_probe+0x104/0x3e0
[ 141.102018][ T75] platform_probe+0xf9/0x190
[ 141.104092][ T75] really_probe+0x254/0xae0
[ 141.106014][ T75] __driver_probe_device+0x1e8/0x360
[ 141.108241][ T75] driver_probe_device+0x4f/0x240
[ 141.110338][ T75] __device_attach_driver+0x270/0x410
[ 141.112631][ T75] bus_for_each_drv+0x258/0x2f0
[ 141.114734][ T75] __device_attach+0x2c4/0x450
[ 141.116828][ T75] page last free pid 9 tgid 9 stack trace:
[ 141.119299][ T75] free_pages_prepare+0x960/0xa60
[ 141.121539][ T75] __free_contig_range_common+0x174/0x340
[ 141.124000][ T75] free_pages_bulk+0x48/0x120
[ 141.126063][ T75] vfree+0x224/0x4a0
[ 141.127773][ T75] delayed_vfree_work+0x55/0x80
[ 141.129895][ T75] process_scheduled_works+0xa8e/0x14e0
[ 141.132332][ T75] worker_thread+0xa47/0xfb0
[ 141.134371][ T75] kthread+0x388/0x470
[ 141.136108][ T75] ret_from_fork+0x514/0xb70
[ 141.138150][ T75] ret_from_fork_asm+0x1a/0x30
[ 141.140295][ T75]
[ 141.141378][ T75] Memory state around the buggy address:
[ 141.143831][ T75] ffff888034c10b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 141.147234][ T75] ffff888034c10b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 141.150587][ T75] >ffff888034c10c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 141.153925][ T75] ^
[ 141.156085][ T75] ffff888034c10c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 141.159571][ T75] ffff888034c10d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 141.163060][ T75] ==================================================================
[ 141.174330][ T5337] usb usb6: USB disconnect, device number 1
[ 141.226305][ T5337] vhci_hcd vhci_hcd.0: USB bus 6 deregistered
[ 141.309824][ T75] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 141.312701][ T75] CPU: 0 UID: 0 PID: 75 Comm: kworker/u4:5 Not tainted syzkaller #0 PREEMPT(full)
[ 141.316010][ T75] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 141.320055][ T75] Workqueue: usbip_event event_handler
[ 141.322890][ T75] Call Trace:
[ 141.324616][ T75]
[ 141.326151][ T75] vpanic+0x56c/0xa60
[ 141.328249][ T75] ? __pfx_vpanic+0x10/0x10
[ 141.330701][ T75] ? __pfx___schedule+0x10/0x10
[ 141.333307][ T75] panic+0xc5/0xd0
[ 141.335352][ T75] ? __pfx_panic+0x10/0x10
[ 141.337455][ T75] ? preempt_schedule_common+0x82/0xd0
[ 141.339907][ T75] ? vhci_shutdown_connection+0x1d4/0x650
[ 141.342362][ T75] check_panic_on_warn+0x89/0xb0
[ 141.344522][ T75] ? vhci_shutdown_connection+0x1d4/0x650
[ 141.346966][ T75] end_report+0x73/0x170
[ 141.348803][ T75] ? vhci_shutdown_connection+0x1d4/0x650
[ 141.351252][ T75] kasan_report+0x128/0x150
[ 141.353165][ T75] ? vhci_shutdown_connection+0x1d4/0x650
[ 141.355574][ T75] vhci_shutdown_connection+0x1d4/0x650
[ 141.357908][ T75] event_handler+0x2a4/0x4b0
[ 141.359963][ T75] ? process_scheduled_works+0xa20/0x14e0
[ 141.362337][ T75] process_scheduled_works+0xa8e/0x14e0
[ 141.364663][ T75] ? __pfx_process_scheduled_works+0x10/0x10
[ 141.367250][ T75] ? assign_work+0x3cf/0x5d0
[ 141.369172][ T75] worker_thread+0xa47/0xfb0
[ 141.371102][ T75] ? __kthread_parkme+0x71/0x1f0
[ 141.373024][ T75] kthread+0x388/0x470
[ 141.374668][ T75] ? __pfx_worker_thread+0x10/0x10
[ 141.376668][ T75] ? __pfx_kthread+0x10/0x10
[ 141.378462][ T75] ret_from_fork+0x514/0xb70
[ 141.380330][ T75] ? __pfx_ret_from_fork+0x10/0x10
[ 141.382356][ T75] ? __switch_to+0xc89/0x1420
[ 141.384344][ T75] ? __pfx_kthread+0x10/0x10
[ 141.386165][ T75] ret_from_fork_asm+0x1a/0x30
[ 141.388255][ T75]
[ 141.390031][ T75] Kernel Offset: disabled
[ 141.391924][ T75] Rebooting in 86400 seconds..