program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$vimc2(0xffffffffffffff9c, 0x0, 0x2, 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)={0x5c, 0x2, 0x6, 0x301, 0x0, 0xf0ffff, {}, [@IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x0}]}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x5c}}, 0x0) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000300)='vhci_hcd.0\x00', 0xb) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) openat$vimc2(0xffffffffffffff9c, 0x0, 0x2, 0x0) (async) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)={0x5c, 0x2, 0x6, 0x301, 0x0, 0xf0ffff, {}, [@IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x0}]}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x5c}}, 0x0) (async) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) (async) write(r1, &(0x7f0000000300)='vhci_hcd.0\x00', 0xb) (async) [ 102.624954][ T4654] Bluetooth: hci0: command tx timeout [ 102.726843][ T5334] vhci_hcd vhci_hcd.0: remove, state 4 [ 102.737003][ T5334] usb usb7: USB disconnect, device number 1 [ 102.803089][ T21] vhci_hcd vhci_hcd.0: stop threads [ 102.806149][ T5334] vhci_hcd vhci_hcd.0: USB bus 7 deregistered [ 102.810750][ T21] vhci_hcd vhci_hcd.0: release socket [ 102.815852][ T21] vhci_hcd vhci_hcd.0: disconnect device [ 102.822994][ T21] vhci_hcd vhci_hcd.0: stop threads [ 102.826153][ T5334] vhci_hcd vhci_hcd.0: remove, state 4 [ 102.829786][ T21] ================================================================== [ 102.833056][ T21] BUG: KASAN: slab-use-after-free in vhci_shutdown_connection+0x1d4/0x650 [ 102.836758][ T21] Read of size 8 at addr ffff88803481c780 by task kworker/u4:2/21 [ 102.840029][ T21] [ 102.841096][ T21] CPU: 0 UID: 0 PID: 21 Comm: kworker/u4:2 Not tainted syzkaller #0 PREEMPT(full) [ 102.841112][ T21] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.841122][ T21] Workqueue: usbip_event event_handler [ 102.841141][ T21] Call Trace: [ 102.841148][ T21] [ 102.841155][ T21] dump_stack_lvl+0xe8/0x150 [ 102.841174][ T21] print_address_description+0x55/0x1e0 [ 102.841192][ T21] ? vhci_shutdown_connection+0x1d4/0x650 [ 102.841206][ T21] print_report+0x58/0x70 [ 102.841221][ T21] kasan_report+0x117/0x150 [ 102.841240][ T21] ? vhci_shutdown_connection+0x1d4/0x650 [ 102.841257][ T21] vhci_shutdown_connection+0x1d4/0x650 [ 102.841272][ T21] event_handler+0x2a4/0x4b0 [ 102.841286][ T21] ? process_scheduled_works+0xa20/0x14e0 [ 102.841303][ T21] process_scheduled_works+0xa8e/0x14e0 [ 102.841323][ T21] ? __pfx_process_scheduled_works+0x10/0x10 [ 102.841339][ T21] ? assign_work+0x3cf/0x5d0 [ 102.841353][ T21] worker_thread+0xa47/0xfb0 [ 102.841369][ T21] ? __kthread_parkme+0x71/0x1f0 [ 102.841386][ T21] kthread+0x388/0x470 [ 102.841402][ T21] ? __pfx_worker_thread+0x10/0x10 [ 102.841415][ T21] ? __pfx_kthread+0x10/0x10 [ 102.841431][ T21] ret_from_fork+0x514/0xb70 [ 102.841449][ T21] ? __pfx_ret_from_fork+0x10/0x10 [ 102.841470][ T21] ? __switch_to+0xc89/0x1420 [ 102.841485][ T21] ? __pfx_kthread+0x10/0x10 [ 102.841501][ T21] ret_from_fork_asm+0x1a/0x30 [ 102.841516][ T21] [ 102.841521][ T21] [ 102.902975][ T21] Allocated by task 1: [ 102.904766][ T21] kasan_save_track+0x3e/0x80 [ 102.906862][ T21] __kasan_kmalloc+0x93/0xb0 [ 102.908878][ T21] __kmalloc_noprof+0x375/0x720 [ 102.911017][ T21] __usb_create_hcd+0x67/0x900 [ 102.913112][ T21] vhci_hcd_probe+0x1e6/0x3e0 [ 102.915151][ T21] platform_probe+0xf9/0x190 [ 102.917108][ T21] really_probe+0x254/0xae0 [ 102.919109][ T21] __driver_probe_device+0x1e8/0x360 [ 102.921377][ T21] driver_probe_device+0x4f/0x240 [ 102.923544][ T21] __device_attach_driver+0x270/0x410 [ 102.925809][ T21] bus_for_each_drv+0x258/0x2f0 [ 102.927870][ T21] __device_attach+0x2c4/0x450 [ 102.929916][ T21] device_initial_probe+0xa1/0xd0 [ 102.932104][ T21] bus_probe_device+0x12a/0x220 [ 102.934101][ T21] device_add+0x7d7/0xb80 [ 102.935923][ T21] platform_device_add+0x4bd/0x860 [ 102.938100][ T21] platform_device_register_full+0x62d/0x710 [ 102.940449][ T21] vhci_hcd_init+0x227/0x360 [ 102.942333][ T21] do_one_initcall+0x250/0x870 [ 102.944308][ T21] do_initcall_level+0x10a/0x1a0 [ 102.946446][ T21] do_initcalls+0x59/0xa0 [ 102.948232][ T21] kernel_init_freeable+0x29d/0x3e0 [ 102.950317][ T21] kernel_init+0x1d/0x1d0 [ 102.952056][ T21] ret_from_fork+0x514/0xb70 [ 102.953912][ T21] ret_from_fork_asm+0x1a/0x30 [ 102.955903][ T21] [ 102.956958][ T21] Freed by task 5334: [ 102.958665][ T21] kasan_save_track+0x3e/0x80 [ 102.960605][ T21] kasan_save_free_info+0x40/0x50 [ 102.962779][ T21] __kasan_slab_free+0x5c/0x80 [ 102.964880][ T21] kfree+0x1c5/0x640 [ 102.966506][ T21] vhci_hcd_remove+0x9e/0x110 [ 102.968415][ T21] device_release_driver_internal+0x48b/0x880 [ 102.970837][ T21] unbind_store+0x1a1/0x1d0 [ 102.972819][ T21] kernfs_fop_write_iter+0x3a4/0x540 [ 102.975075][ T21] vfs_write+0x612/0xba0 [ 102.976951][ T21] ksys_write+0x150/0x270 [ 102.978829][ T21] do_syscall_64+0x174/0x580 [ 102.980812][ T21] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.983230][ T21] [ 102.984248][ T21] Last potentially related work creation: [ 102.986596][ T21] kasan_save_stack+0x3e/0x60 [ 102.988657][ T21] kasan_record_aux_stack+0xbd/0xd0 [ 102.990851][ T21] insert_work+0x3d/0x330 [ 102.992640][ T21] __queue_work+0xcd8/0x10a0 [ 102.994563][ T21] queue_work_on+0x106/0x1d0 [ 102.996527][ T21] unlink1+0x344/0x3e0 [ 102.998232][ T21] usb_hcd_unlink_urb+0xe6/0x1e0 [ 103.000285][ T21] usb_kill_urb+0x10b/0x2f0 [ 103.002204][ T21] hub_quiesce+0x211/0x330 [ 103.004073][ T21] hub_suspend+0x904/0xad0 [ 103.005940][ T21] usb_suspend_both+0x285/0x1040 [ 103.007987][ T21] usb_runtime_suspend+0x58/0x110 [ 103.010080][ T21] __rpm_callback+0x2c7/0x950 [ 103.012148][ T21] rpm_suspend+0x8a0/0x17b0 [ 103.014145][ T21] __pm_runtime_suspend+0x12f/0x1a0 [ 103.016644][ T21] usb_new_device+0xadf/0x1620 [ 103.018825][ T21] register_root_hub+0x250/0x5c0 [ 103.021074][ T21] usb_add_hcd+0xac7/0xf80 [ 103.022996][ T21] vhci_hcd_probe+0x1fa/0x3e0 [ 103.025130][ T21] platform_probe+0xf9/0x190 [ 103.027253][ T21] really_probe+0x254/0xae0 [ 103.029278][ T21] __driver_probe_device+0x1e8/0x360 [ 103.031628][ T21] driver_probe_device+0x4f/0x240 [ 103.033908][ T21] __device_attach_driver+0x270/0x410 [ 103.036349][ T21] bus_for_each_drv+0x258/0x2f0 [ 103.038495][ T21] __device_attach+0x2c4/0x450 [ 103.040657][ T21] device_initial_probe+0xa1/0xd0 [ 103.042846][ T21] bus_probe_device+0x12a/0x220 [ 103.044930][ T21] device_add+0x7d7/0xb80 [ 103.046773][ T21] platform_device_add+0x4bd/0x860 [ 103.048975][ T21] platform_device_register_full+0x62d/0x710 [ 103.051604][ T21] vhci_hcd_init+0x227/0x360 [ 103.053526][ T21] do_one_initcall+0x250/0x870 [ 103.055524][ T21] do_initcall_level+0x10a/0x1a0 [ 103.057443][ T21] do_initcalls+0x59/0xa0 [ 103.058892][ T21] kernel_init_freeable+0x29d/0x3e0 [ 103.060809][ T21] kernel_init+0x1d/0x1d0 [ 103.062656][ T21] ret_from_fork+0x514/0xb70 [ 103.064542][ T21] ret_from_fork_asm+0x1a/0x30 [ 103.066549][ T21] [ 103.067608][ T21] Second to last potentially related work creation: [ 103.070143][ T21] kasan_save_stack+0x3e/0x60 [ 103.072013][ T21] kasan_record_aux_stack+0xbd/0xd0 [ 103.074054][ T21] insert_work+0x3d/0x330 [ 103.075868][ T21] __queue_work+0xcd8/0x10a0 [ 103.077736][ T21] queue_work_on+0x106/0x1d0 [ 103.079619][ T21] usb_hcd_submit_urb+0xa3b/0x1b60 [ 103.081759][ T21] usb_start_wait_urb+0x13f/0x5b0 [ 103.084146][ T21] usb_control_msg+0x234/0x3e0 [ 103.086224][ T21] hub_suspend+0x891/0xad0 [ 103.088116][ T21] usb_suspend_both+0x285/0x1040 [ 103.090250][ T21] usb_runtime_suspend+0x58/0x110 [ 103.092469][ T21] __rpm_callback+0x2c7/0x950 [ 103.094399][ T21] rpm_suspend+0x8a0/0x17b0 [ 103.096272][ T21] __pm_runtime_suspend+0x12f/0x1a0 [ 103.098425][ T21] usb_new_device+0xadf/0x1620 [ 103.100450][ T21] register_root_hub+0x250/0x5c0 [ 103.102533][ T21] usb_add_hcd+0xac7/0xf80 [ 103.104337][ T21] vhci_hcd_probe+0x1fa/0x3e0 [ 103.106438][ T21] platform_probe+0xf9/0x190 [ 103.108512][ T21] really_probe+0x254/0xae0 [ 103.110491][ T21] __driver_probe_device+0x1e8/0x360 [ 103.112732][ T21] driver_probe_device+0x4f/0x240 [ 103.114946][ T21] __device_attach_driver+0x270/0x410 [ 103.117257][ T21] bus_for_each_drv+0x258/0x2f0 [ 103.119472][ T21] __device_attach+0x2c4/0x450 [ 103.121627][ T21] device_initial_probe+0xa1/0xd0 [ 103.123848][ T21] bus_probe_device+0x12a/0x220 [ 103.126005][ T21] device_add+0x7d7/0xb80 [ 103.127918][ T21] platform_device_add+0x4bd/0x860 [ 103.130159][ T21] platform_device_register_full+0x62d/0x710 [ 103.132782][ T21] vhci_hcd_init+0x227/0x360 [ 103.134847][ T21] do_one_initcall+0x250/0x870 [ 103.136946][ T21] do_initcall_level+0x10a/0x1a0 [ 103.139208][ T21] do_initcalls+0x59/0xa0 [ 103.141094][ T21] kernel_init_freeable+0x29d/0x3e0 [ 103.143340][ T21] kernel_init+0x1d/0x1d0 [ 103.145235][ T21] ret_from_fork+0x514/0xb70 [ 103.147267][ T21] ret_from_fork_asm+0x1a/0x30 [ 103.149349][ T21] [ 103.150412][ T21] The buggy address belongs to the object at ffff88803481c000 [ 103.150412][ T21] which belongs to the cache kmalloc-8k of size 8192 [ 103.156127][ T21] The buggy address is located 1920 bytes inside of [ 103.156127][ T21] freed 8192-byte region [ffff88803481c000, ffff88803481e000) [ 103.161888][ T21] [ 103.162966][ T21] The buggy address belongs to the physical page: [ 103.165749][ T21] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34818 [ 103.169409][ T21] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 103.172994][ T21] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 103.176076][ T21] page_type: f5(slab) [ 103.177770][ T21] raw: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 103.181425][ T21] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 103.185225][ T21] head: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 103.188901][ T21] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 103.192582][ T21] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 103.196035][ T21] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 103.199752][ T21] page dumped because: kasan: bad access detected [ 103.202326][ T21] page_owner tracks the page as allocated [ 103.204848][ T21] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 18087184018, free_ts 17966528603 [ 103.213045][ T21] post_alloc_hook+0x1f9/0x250 [ 103.215125][ T21] get_page_from_freelist+0x21fa/0x2270 [ 103.217334][ T21] __alloc_frozen_pages_noprof+0x18d/0x380 [ 103.219850][ T21] allocate_slab+0x79/0x5e0 [ 103.221821][ T21] refill_objects+0x2d5/0x350 [ 103.223836][ T21] __pcs_replace_empty_main+0x2bf/0x6b0 [ 103.226154][ T21] __kmalloc_noprof+0x485/0x720 [ 103.228242][ T21] __usb_create_hcd+0x67/0x900 [ 103.230198][ T21] vhci_hcd_probe+0x1e6/0x3e0 [ 103.232214][ T21] platform_probe+0xf9/0x190 [ 103.234227][ T21] really_probe+0x254/0xae0 [ 103.236206][ T21] __driver_probe_device+0x1e8/0x360 [ 103.238449][ T21] driver_probe_device+0x4f/0x240 [ 103.240624][ T21] __device_attach_driver+0x270/0x410 [ 103.242933][ T21] bus_for_each_drv+0x258/0x2f0 [ 103.244867][ T21] __device_attach+0x2c4/0x450 [ 103.246909][ T21] page last free pid 1 tgid 1 stack trace: [ 103.249320][ T21] __free_frozen_pages+0xc1e/0xd10 [ 103.251460][ T21] __slab_free+0x274/0x2c0 [ 103.253392][ T21] qlist_free_all+0x99/0x100 [ 103.255426][ T21] kasan_quarantine_reduce+0x148/0x160 [ 103.257592][ T21] __kasan_slab_alloc+0x22/0x80 [ 103.259706][ T21] __kmalloc_node_track_caller_noprof+0x461/0x730 [ 103.262458][ T21] kvasprintf+0xeb/0x1a0 [ 103.264284][ T21] kasprintf+0xe2/0x140 [ 103.266149][ T21] alloc_workqueue_noprof+0x12e/0x210 [ 103.268457][ T21] usbip_init_eh+0x26/0x60 [ 103.270360][ T21] do_one_initcall+0x250/0x870 [ 103.272341][ T21] do_initcall_level+0x10a/0x1a0 [ 103.274433][ T21] do_initcalls+0x59/0xa0 [ 103.276314][ T21] kernel_init_freeable+0x29d/0x3e0 [ 103.278331][ T21] kernel_init+0x1d/0x1d0 [ 103.280116][ T21] ret_from_fork+0x514/0xb70 [ 103.282095][ T21] [ 103.283147][ T21] Memory state around the buggy address: [ 103.285556][ T21] ffff88803481c680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 103.288837][ T21] ffff88803481c700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 103.292188][ T21] >ffff88803481c780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 103.295495][ T21] ^ [ 103.297209][ T21] ffff88803481c800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 103.300429][ T21] ffff88803481c880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 103.303633][ T21] ================================================================== [ 103.308090][ T5334] usb usb6: USB disconnect, device number 1 [ 103.371478][ T5334] vhci_hcd vhci_hcd.0: USB bus 6 deregistered