program: socketpair(0x1, 0x1, 0x0, &(0x7f0000000100)={0x0, 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, &(0x7f0000000180)) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/usb/drivers/usbip-host/match_busid\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='add 1-1\x00', 0x8) write(r1, &(0x7f0000000240)='add 2-1\x00', 0x8) close(r1) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/usb/drivers/usb/unbind\x00', 0x1, 0x0) write(r2, &(0x7f00000002c0)='1-1\x00', 0x4) write(r2, &(0x7f0000000340)='2-1\x00', 0x4) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/bus/usb/drivers/usbip-host/bind\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='1-1\x00', 0x4) write(r3, &(0x7f0000000400)='2-1\x00', 0x4) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/bus/usb/devices/1-1/usbip_sockfd\x00', 0x1, 0x0) write(r4, &(0x7f0000000480)='3\x00', 0x2) close(r4) openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/bus/usb/devices/2-1/usbip_sockfd\x00', 0x1, 0x0) write(r0, &(0x7f0000000540)="00000001000000010001000200"/48, 0x30) [ 94.673049][ T5287] Bluetooth: hci0: command tx timeout [ 94.932587][ T804] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 95.082660][ T804] usb 5-1: Using ep0 maxpacket: 8 [ 95.088544][ T804] usb 5-1: config 0 has an invalid interface number: 143 but max is 0 [ 95.091859][ T804] usb 5-1: config 0 has no interface number 0 [ 95.094907][ T804] usb 5-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 95.099328][ T804] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.112350][ T804] usb 5-1: config 0 descriptor?? [ 95.233898][ T804] viperboard 5-1:0.143: version 0.00 found at bus 005 address 002 [ 95.278162][ T804] viperboard-i2c viperboard-i2c.3.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 95.285287][ T804] viperboard-i2c viperboard-i2c.3.auto: probe with driver viperboard-i2c failed with error -5 [ 95.457667][ T5329] usbip-host 1-1: usbip-host: register new device (bus 1 dev 2) [ 95.475575][ T5329] usbip-host 1-1: stub up [ 95.488121][ C0] usbip-host 1-1: endpoint 0 is stalled [ 95.494710][ T804] usb 5-1: USB disconnect, device number 2 [ 95.503476][ T5331] ================================================================== [ 95.506775][ T5331] BUG: KASAN: slab-use-after-free in stub_rx_loop+0x2965/0x2ee0 [ 95.509920][ T5331] Read of size 4 at addr ffff88803ebdfdb0 by task stub_rx/5331 [ 95.513006][ T5331] [ 95.513956][ T5331] CPU: 0 UID: 0 PID: 5331 Comm: stub_rx Not tainted syzkaller #0 PREEMPT(full) [ 95.513969][ T5331] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.513976][ T5331] Call Trace: [ 95.513982][ T5331] [ 95.513985][ T5331] dump_stack_lvl+0xe8/0x150 [ 95.513998][ T5331] print_address_description+0x55/0x1e0 [ 95.514008][ T5331] ? stub_rx_loop+0x2965/0x2ee0 [ 95.514016][ T5331] print_report+0x58/0x70 [ 95.514024][ T5331] kasan_report+0x117/0x150 [ 95.514033][ T5331] ? stub_rx_loop+0x2965/0x2ee0 [ 95.514041][ T5331] stub_rx_loop+0x2965/0x2ee0 [ 95.514052][ T5331] ? __pfx_stub_rx_loop+0x10/0x10 [ 95.514060][ T5331] ? __kthread_parkme+0x196/0x1f0 [ 95.514072][ T5331] kthread+0x388/0x470 [ 95.514085][ T5331] ? __pfx_stub_rx_loop+0x10/0x10 [ 95.514094][ T5331] ? __pfx_kthread+0x10/0x10 [ 95.514107][ T5331] ret_from_fork+0x514/0xb70 [ 95.514122][ T5331] ? __pfx_ret_from_fork+0x10/0x10 [ 95.514141][ T5331] ? __switch_to+0xc89/0x1420 [ 95.514153][ T5331] ? __pfx_kthread+0x10/0x10 [ 95.514165][ T5331] ret_from_fork_asm+0x1a/0x30 [ 95.514178][ T5331] [ 95.514181][ T5331] [ 95.561346][ T5331] Allocated by task 5331: [ 95.563176][ T5331] kasan_save_track+0x3e/0x80 [ 95.565156][ T5331] __kasan_slab_alloc+0x6c/0x80 [ 95.567221][ T5331] kmem_cache_alloc_noprof+0x2a0/0x5f0 [ 95.569415][ T5331] stub_rx_loop+0xad9/0x2ee0 [ 95.571418][ T5331] kthread+0x388/0x470 [ 95.573062][ T5331] ret_from_fork+0x514/0xb70 [ 95.574877][ T5331] ret_from_fork_asm+0x1a/0x30 [ 95.576893][ T5331] [ 95.577991][ T5331] Freed by task 5332: [ 95.579797][ T5331] kasan_save_track+0x3e/0x80 [ 95.581682][ T5331] kasan_save_free_info+0x40/0x50 [ 95.583893][ T5331] __kasan_slab_free+0x5c/0x80 [ 95.585991][ T5331] kmem_cache_free+0x182/0x650 [ 95.588033][ T5331] stub_tx_loop+0x1b16/0x2800 [ 95.589966][ T5331] kthread+0x388/0x470 [ 95.591682][ T5331] ret_from_fork+0x514/0xb70 [ 95.593668][ T5331] ret_from_fork_asm+0x1a/0x30 [ 95.595744][ T5331] [ 95.596792][ T5331] The buggy address belongs to the object at ffff88803ebdfd80 [ 95.596792][ T5331] which belongs to the cache stub_priv of size 64 [ 95.602360][ T5331] The buggy address is located 48 bytes inside of [ 95.602360][ T5331] freed 64-byte region [ffff88803ebdfd80, ffff88803ebdfdc0) [ 95.607992][ T5331] [ 95.609037][ T5331] The buggy address belongs to the physical page: [ 95.611771][ T5331] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803ebdfe00 pfn:0x3ebdf [ 95.616103][ T5331] flags: 0x4fff00000000200(workingset|node=1|zone=1|lastcpupid=0x7ff) [ 95.619508][ T5331] page_type: f5(slab) [ 95.621239][ T5331] raw: 04fff00000000200 ffff888033ecd140 ffff888033f94288 ffff888033f94288 [ 95.624833][ T5331] raw: ffff88803ebdfe00 000000080020001c 00000000f5000000 0000000000000000 [ 95.628530][ T5331] page dumped because: kasan: bad access detected [ 95.631321][ T5331] page_owner tracks the page as allocated [ 95.633785][ T5331] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5331, tgid 5331 (stub_rx), ts 95486694493, free_ts 95484580106 [ 95.642164][ T5331] post_alloc_hook+0x1f9/0x250 [ 95.644338][ T5331] get_page_from_freelist+0x21fa/0x2270 [ 95.646740][ T5331] __alloc_frozen_pages_noprof+0x18d/0x380 [ 95.649335][ T5331] allocate_slab+0x79/0x5e0 [ 95.651300][ T5331] refill_objects+0x2d5/0x350 [ 95.653176][ T5331] __pcs_replace_empty_main+0x2bf/0x6b0 [ 95.655430][ T5331] kmem_cache_alloc_noprof+0x382/0x5f0 [ 95.657717][ T5331] stub_rx_loop+0xad9/0x2ee0 [ 95.659705][ T5331] kthread+0x388/0x470 [ 95.661400][ T5331] ret_from_fork+0x514/0xb70 [ 95.663254][ T5331] ret_from_fork_asm+0x1a/0x30 [ 95.665330][ T5331] page last free pid 2 tgid 2 stack trace: [ 95.667990][ T5331] __free_frozen_pages+0xc1e/0xd10 [ 95.670201][ T5331] __kasan_populate_vmalloc+0x12d/0x1c0 [ 95.672638][ T5331] alloc_vmap_area+0xd1a/0x1420 [ 95.674783][ T5331] __get_vm_area_node+0x1f2/0x300 [ 95.676990][ T5331] __vmalloc_node_range_noprof+0x358/0x1730 [ 95.679508][ T5331] __vmalloc_node_noprof+0xc2/0x100 [ 95.681711][ T5331] dup_task_struct+0x2a0/0x8e0 [ 95.683761][ T5331] copy_process+0x820/0x4390 [ 95.685660][ T5331] kernel_clone+0x2d7/0x940 [ 95.687642][ T5331] kernel_thread+0x13f/0x1b0 [ 95.689568][ T5331] kthreadd+0x4ec/0x6e0 [ 95.691410][ T5331] ret_from_fork+0x514/0xb70 [ 95.693425][ T5331] ret_from_fork_asm+0x1a/0x30 [ 95.695534][ T5331] [ 95.696598][ T5331] Memory state around the buggy address: [ 95.699014][ T5331] ffff88803ebdfc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 95.702452][ T5331] ffff88803ebdfd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 95.705576][ T5331] >ffff88803ebdfd80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 95.708917][ T5331] ^ [ 95.711326][ T5331] ffff88803ebdfe00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 95.714597][ T5331] ffff88803ebdfe80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 95.718007][ T5331] ================================================================== [ 95.795934][ T5331] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 95.798958][ T5331] CPU: 0 UID: 0 PID: 5331 Comm: stub_rx Not tainted syzkaller #0 PREEMPT(full) [ 95.802568][ T5331] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.806570][ T5331] Call Trace: [ 95.807941][ T5331] [ 95.809109][ T5331] vpanic+0x56c/0xa60 [ 95.810773][ T5331] ? __pfx_vpanic+0x10/0x10 [ 95.813325][ T5331] panic+0xc5/0xd0 [ 95.814888][ T5331] ? __pfx_panic+0x10/0x10 [ 95.816699][ T5331] ? preempt_schedule_thunk+0x16/0x40 [ 95.819059][ T5331] ? stub_rx_loop+0x2965/0x2ee0 [ 95.821063][ T5331] ? preempt_schedule_thunk+0x16/0x40 [ 95.823354][ T5331] ? stub_rx_loop+0x2965/0x2ee0 [ 95.825445][ T5331] check_panic_on_warn+0x89/0xb0 [ 95.827426][ T5331] ? stub_rx_loop+0x2965/0x2ee0 [ 95.829406][ T5331] end_report+0x73/0x170 [ 95.831000][ T5331] ? stub_rx_loop+0x2965/0x2ee0 [ 95.832825][ T5331] kasan_report+0x128/0x150 [ 95.834657][ T5331] ? stub_rx_loop+0x2965/0x2ee0 [ 95.836648][ T5331] stub_rx_loop+0x2965/0x2ee0 [ 95.838649][ T5331] ? __pfx_stub_rx_loop+0x10/0x10 [ 95.840518][ T5331] ? __kthread_parkme+0x196/0x1f0 [ 95.842573][ T5331] kthread+0x388/0x470 [ 95.844182][ T5331] ? __pfx_stub_rx_loop+0x10/0x10 [ 95.846202][ T5331] ? __pfx_kthread+0x10/0x10 [ 95.848091][ T5331] ret_from_fork+0x514/0xb70 [ 95.849944][ T5331] ? __pfx_ret_from_fork+0x10/0x10 [ 95.852078][ T5331] ? __switch_to+0xc89/0x1420 [ 95.853931][ T5331] ? __pfx_kthread+0x10/0x10 [ 95.855878][ T5331] ret_from_fork_asm+0x1a/0x30 [ 95.857828][ T5331] [ 95.859837][ T5331] Kernel Offset: disabled [ 95.862215][ T5331] Rebooting in 86400 seconds..