program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x15, 0x10, 0x8}, 0x50) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001e40)={r0, &(0x7f0000000300), 0x0}, 0x20) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000300)='vhci_hcd.0\x00', 0xb) (async) write(r1, &(0x7f0000000300)='vhci_hcd.0\x00', 0xb) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, &(0x7f0000000040)={0x0, 0x1, 0xb, 0xc, @vifc_lcl_ifindex, @empty}, 0x10) (async) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, &(0x7f0000000040)={0x0, 0x1, 0xb, 0xc, @vifc_lcl_ifindex, @empty}, 0x10) r3 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r3, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f0258ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100040810000000000000040000", 0x58}], 0x1) statx(r1, &(0x7f0000000240)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x2000, 0x10, &(0x7f0000000340)) [ 93.393026][ T4641] Bluetooth: hci0: command tx timeout [ 93.401688][ T805] cfg80211: failed to load regulatory.db [ 93.500171][ T5314] vhci_hcd vhci_hcd.0: remove, state 4 [ 93.504685][ T5314] usb usb7: USB disconnect, device number 1 [ 93.547617][ T181] vhci_hcd vhci_hcd.0: stop threads [ 93.550766][ T181] vhci_hcd vhci_hcd.0: release socket [ 93.555984][ T181] vhci_hcd vhci_hcd.0: disconnect device [ 93.567366][ T181] vhci_hcd vhci_hcd.0: stop threads [ 93.570204][ T181] vhci_hcd vhci_hcd.0: release socket [ 93.572834][ T181] vhci_hcd vhci_hcd.0: disconnect device [ 93.575713][ T181] vhci_hcd vhci_hcd.0: stop threads [ 93.580275][ T5314] vhci_hcd vhci_hcd.0: USB bus 7 deregistered [ 93.583925][ T181] vhci_hcd vhci_hcd.0: release socket [ 93.586271][ T181] vhci_hcd vhci_hcd.0: disconnect device [ 93.588658][ T181] vhci_hcd vhci_hcd.0: stop threads [ 93.590913][ T181] vhci_hcd vhci_hcd.0: release socket [ 93.605440][ T181] vhci_hcd vhci_hcd.0: disconnect device [ 93.610290][ T181] vhci_hcd vhci_hcd.0: stop threads [ 93.612758][ T5314] vhci_hcd vhci_hcd.0: remove, state 4 [ 93.616705][ T181] ================================================================== [ 93.619850][ T181] BUG: KASAN: slab-use-after-free in vhci_shutdown_connection+0x1d4/0x650 [ 93.623384][ T181] Read of size 8 at addr ffff888034cb8e70 by task kworker/u4:7/181 [ 93.626515][ T181] [ 93.627553][ T181] CPU: 0 UID: 0 PID: 181 Comm: kworker/u4:7 Not tainted syzkaller #0 PREEMPT(full) [ 93.627563][ T181] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.627568][ T181] Workqueue: usbip_event event_handler [ 93.627580][ T181] Call Trace: [ 93.627585][ T181] [ 93.627589][ T181] dump_stack_lvl+0xe8/0x150 [ 93.627601][ T181] print_address_description+0x55/0x1e0 [ 93.627610][ T181] ? vhci_shutdown_connection+0x1d4/0x650 [ 93.627617][ T181] print_report+0x58/0x70 [ 93.627624][ T181] kasan_report+0x117/0x150 [ 93.627633][ T181] ? vhci_shutdown_connection+0x1d4/0x650 [ 93.627642][ T181] vhci_shutdown_connection+0x1d4/0x650 [ 93.627650][ T181] event_handler+0x2a4/0x4b0 [ 93.627656][ T181] ? process_scheduled_works+0x97a/0x1630 [ 93.627663][ T181] process_scheduled_works+0xc3d/0x1630 [ 93.627675][ T181] ? __pfx_process_scheduled_works+0x10/0x10 [ 93.627683][ T181] ? assign_work+0x3cf/0x5d0 [ 93.627690][ T181] worker_thread+0xa47/0xfb0 [ 93.627701][ T181] kthread+0x38b/0x480 [ 93.627710][ T181] ? __pfx_worker_thread+0x10/0x10 [ 93.627716][ T181] ? __pfx_kthread+0x10/0x10 [ 93.627725][ T181] ret_from_fork+0x514/0xb70 [ 93.627740][ T181] ? __pfx_ret_from_fork+0x10/0x10 [ 93.627752][ T181] ? __switch_to+0xc89/0x1420 [ 93.627764][ T181] ? __pfx_kthread+0x10/0x10 [ 93.627777][ T181] ret_from_fork_asm+0x1a/0x30 [ 93.627795][ T181] [ 93.627799][ T181] [ 93.685388][ T181] Allocated by task 1: [ 93.687216][ T181] kasan_save_track+0x3e/0x80 [ 93.689329][ T181] __kasan_kmalloc+0x93/0xb0 [ 93.691462][ T181] __kmalloc_noprof+0x379/0x720 [ 93.693767][ T181] __usb_create_hcd+0x67/0x900 [ 93.696015][ T181] vhci_hcd_probe+0x1e6/0x3e0 [ 93.698353][ T181] platform_probe+0xf9/0x190 [ 93.700565][ T181] really_probe+0x254/0xae0 [ 93.702539][ T181] __driver_probe_device+0x1e8/0x360 [ 93.704752][ T181] driver_probe_device+0x4f/0x240 [ 93.706871][ T181] __device_attach_driver+0x270/0x410 [ 93.709159][ T181] bus_for_each_drv+0x258/0x2f0 [ 93.711308][ T181] __device_attach+0x2c4/0x450 [ 93.713310][ T181] device_initial_probe+0xa1/0xd0 [ 93.715489][ T181] bus_probe_device+0x12a/0x220 [ 93.717551][ T181] device_add+0x7d7/0xb80 [ 93.719454][ T181] platform_device_add+0x4bd/0x860 [ 93.721595][ T181] platform_device_register_full+0x53a/0x620 [ 93.724187][ T181] vhci_hcd_init+0x227/0x360 [ 93.726294][ T181] do_one_initcall+0x250/0x870 [ 93.728160][ T181] do_initcall_level+0x10a/0x1a0 [ 93.730310][ T181] do_initcalls+0x59/0xa0 [ 93.732206][ T181] kernel_init_freeable+0x29d/0x3e0 [ 93.734525][ T181] kernel_init+0x22/0x1d0 [ 93.736797][ T181] ret_from_fork+0x514/0xb70 [ 93.739197][ T181] ret_from_fork_asm+0x1a/0x30 [ 93.741318][ T181] [ 93.742440][ T181] Freed by task 5314: [ 93.744191][ T181] kasan_save_track+0x3e/0x80 [ 93.746438][ T181] kasan_save_free_info+0x40/0x50 [ 93.748704][ T181] __kasan_slab_free+0x5c/0x80 [ 93.750794][ T181] kfree+0x1c5/0x640 [ 93.752502][ T181] vhci_hcd_remove+0x9e/0x110 [ 93.754518][ T181] device_release_driver_internal+0x48b/0x880 [ 93.757115][ T181] unbind_store+0x1a1/0x1d0 [ 93.759085][ T181] kernfs_fop_write_iter+0x3a4/0x540 [ 93.761323][ T181] vfs_write+0x612/0xba0 [ 93.763170][ T181] ksys_write+0x150/0x270 [ 93.764983][ T181] do_syscall_64+0x166/0x520 [ 93.766922][ T181] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.769203][ T181] [ 93.770215][ T181] Last potentially related work creation: [ 93.772636][ T181] kasan_save_stack+0x3e/0x60 [ 93.774704][ T181] kasan_record_aux_stack+0xbd/0xd0 [ 93.777032][ T181] insert_work+0x3d/0x330 [ 93.778995][ T181] __queue_work+0xd07/0x10d0 [ 93.781076][ T181] queue_work_on+0x106/0x1d0 [ 93.783140][ T181] unlink1+0x344/0x3e0 [ 93.784836][ T181] usb_hcd_unlink_urb+0xe6/0x1e0 [ 93.786906][ T181] usb_kill_urb+0x10b/0x2f0 [ 93.788921][ T181] hub_quiesce+0x211/0x330 [ 93.790874][ T181] hub_suspend+0x904/0xad0 [ 93.792741][ T181] usb_suspend_both+0x285/0x1040 [ 93.794859][ T181] usb_runtime_suspend+0x58/0x110 [ 93.796987][ T181] __rpm_callback+0x2c7/0x950 [ 93.799067][ T181] rpm_suspend+0x89d/0x17a0 [ 93.801155][ T181] __pm_runtime_suspend+0x12f/0x1a0 [ 93.803517][ T181] usb_new_device+0xaee/0x1690 [ 93.805626][ T181] register_root_hub+0x250/0x5c0 [ 93.807785][ T181] usb_add_hcd+0xac7/0xf80 [ 93.809685][ T181] vhci_hcd_probe+0x1fa/0x3e0 [ 93.811870][ T181] platform_probe+0xf9/0x190 [ 93.814140][ T181] really_probe+0x254/0xae0 [ 93.816190][ T181] __driver_probe_device+0x1e8/0x360 [ 93.818495][ T181] driver_probe_device+0x4f/0x240 [ 93.820638][ T181] __device_attach_driver+0x270/0x410 [ 93.822990][ T181] bus_for_each_drv+0x258/0x2f0 [ 93.825042][ T181] __device_attach+0x2c4/0x450 [ 93.827179][ T181] device_initial_probe+0xa1/0xd0 [ 93.829262][ T181] bus_probe_device+0x12a/0x220 [ 93.831325][ T181] device_add+0x7d7/0xb80 [ 93.833056][ T181] platform_device_add+0x4bd/0x860 [ 93.835134][ T181] platform_device_register_full+0x53a/0x620 [ 93.837551][ T181] vhci_hcd_init+0x227/0x360 [ 93.839450][ T181] do_one_initcall+0x250/0x870 [ 93.841428][ T181] do_initcall_level+0x10a/0x1a0 [ 93.843925][ T181] do_initcalls+0x59/0xa0 [ 93.845858][ T181] kernel_init_freeable+0x29d/0x3e0 [ 93.848087][ T181] kernel_init+0x22/0x1d0 [ 93.849899][ T181] ret_from_fork+0x514/0xb70 [ 93.852334][ T181] ret_from_fork_asm+0x1a/0x30 [ 93.854684][ T181] [ 93.855694][ T181] Second to last potentially related work creation: [ 93.858426][ T181] kasan_save_stack+0x3e/0x60 [ 93.860472][ T181] kasan_record_aux_stack+0xbd/0xd0 [ 93.862847][ T181] insert_work+0x3d/0x330 [ 93.864683][ T181] __queue_work+0xd07/0x10d0 [ 93.866705][ T181] queue_work_on+0x106/0x1d0 [ 93.868744][ T181] usb_hcd_submit_urb+0xa3b/0x1b60 [ 93.871082][ T181] usb_start_wait_urb+0x13f/0x5b0 [ 93.873210][ T181] usb_control_msg+0x234/0x3e0 [ 93.875223][ T181] hub_suspend+0x891/0xad0 [ 93.877051][ T181] usb_suspend_both+0x285/0x1040 [ 93.879121][ T181] usb_runtime_suspend+0x58/0x110 [ 93.881288][ T181] __rpm_callback+0x2c7/0x950 [ 93.883210][ T181] rpm_suspend+0x89d/0x17a0 [ 93.885149][ T181] __pm_runtime_suspend+0x12f/0x1a0 [ 93.887322][ T181] usb_new_device+0xaee/0x1690 [ 93.889383][ T181] register_root_hub+0x250/0x5c0 [ 93.891605][ T181] usb_add_hcd+0xac7/0xf80 [ 93.893689][ T181] vhci_hcd_probe+0x1fa/0x3e0 [ 93.895702][ T181] platform_probe+0xf9/0x190 [ 93.897670][ T181] really_probe+0x254/0xae0 [ 93.899600][ T181] __driver_probe_device+0x1e8/0x360 [ 93.901882][ T181] driver_probe_device+0x4f/0x240 [ 93.904133][ T181] __device_attach_driver+0x270/0x410 [ 93.906498][ T181] bus_for_each_drv+0x258/0x2f0 [ 93.908661][ T181] __device_attach+0x2c4/0x450 [ 93.910746][ T181] device_initial_probe+0xa1/0xd0 [ 93.912945][ T181] bus_probe_device+0x12a/0x220 [ 93.915109][ T181] device_add+0x7d7/0xb80 [ 93.917023][ T181] platform_device_add+0x4bd/0x860 [ 93.919252][ T181] platform_device_register_full+0x53a/0x620 [ 93.921839][ T181] vhci_hcd_init+0x227/0x360 [ 93.923849][ T181] do_one_initcall+0x250/0x870 [ 93.925918][ T181] do_initcall_level+0x10a/0x1a0 [ 93.928039][ T181] do_initcalls+0x59/0xa0 [ 93.929817][ T181] kernel_init_freeable+0x29d/0x3e0 [ 93.932229][ T181] kernel_init+0x22/0x1d0 [ 93.934032][ T181] ret_from_fork+0x514/0xb70 [ 93.935860][ T181] ret_from_fork_asm+0x1a/0x30 [ 93.937804][ T181] [ 93.938799][ T181] The buggy address belongs to the object at ffff888034cb8000 [ 93.938799][ T181] which belongs to the cache kmalloc-8k of size 8192 [ 93.944665][ T181] The buggy address is located 3696 bytes inside of [ 93.944665][ T181] freed 8192-byte region [ffff888034cb8000, ffff888034cba000) [ 93.950665][ T181] [ 93.951759][ T181] The buggy address belongs to the physical page: [ 93.954413][ T181] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34cb8 [ 93.958102][ T181] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 93.961560][ T181] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 93.964800][ T181] page_type: f5(slab) [ 93.966534][ T181] raw: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 93.969952][ T181] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 93.973442][ T181] head: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 93.977061][ T181] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 93.980760][ T181] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 93.984405][ T181] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 93.988093][ T181] page dumped because: kasan: bad access detected [ 93.990974][ T181] page_owner tracks the page as allocated [ 93.993308][ T181] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 17522681441 [ 94.001087][ T181] post_alloc_hook+0x1f9/0x250 [ 94.003163][ T181] get_page_from_freelist+0x2209/0x2280 [ 94.005501][ T181] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 94.008010][ T181] allocate_slab+0x7c/0x5e0 [ 94.010001][ T181] refill_objects+0x2d5/0x350 [ 94.012120][ T181] __pcs_replace_empty_main+0x2c3/0x6b0 [ 94.014525][ T181] __kmalloc_noprof+0x489/0x720 [ 94.016646][ T181] __usb_create_hcd+0x67/0x900 [ 94.018655][ T181] vhci_hcd_probe+0x104/0x3e0 [ 94.020642][ T181] platform_probe+0xf9/0x190 [ 94.022666][ T181] really_probe+0x254/0xae0 [ 94.024616][ T181] __driver_probe_device+0x1e8/0x360 [ 94.026868][ T181] driver_probe_device+0x4f/0x240 [ 94.029002][ T181] __device_attach_driver+0x270/0x410 [ 94.031219][ T181] bus_for_each_drv+0x258/0x2f0 [ 94.033198][ T181] __device_attach+0x2c4/0x450 [ 94.035224][ T181] page last free pid 1 tgid 1 ts 17506794700 stack trace: [ 94.038086][ T181] __free_frozen_pages+0xc93/0xd90 [ 94.040299][ T181] __slab_free+0x274/0x2c0 [ 94.042495][ T181] qlist_free_all+0x99/0x100 [ 94.044524][ T181] kasan_quarantine_reduce+0x148/0x160 [ 94.046912][ T181] __kasan_slab_alloc+0x22/0x80 [ 94.049022][ T181] __kmalloc_cache_noprof+0x2af/0x660 [ 94.051350][ T181] device_create_with_groups+0x13d/0x300 [ 94.053840][ T181] misc_register+0x2f7/0x560 [ 94.055911][ T181] do_one_initcall+0x250/0x870 [ 94.058030][ T181] do_initcall_level+0x10a/0x1a0 [ 94.060202][ T181] do_initcalls+0x59/0xa0 [ 94.062155][ T181] kernel_init_freeable+0x29d/0x3e0 [ 94.064390][ T181] kernel_init+0x22/0x1d0 [ 94.066228][ T181] ret_from_fork+0x514/0xb70 [ 94.068222][ T181] ret_from_fork_asm+0x1a/0x30 [ 94.070231][ T181] [ 94.071328][ T181] Memory state around the buggy address: [ 94.073670][ T181] ffff888034cb8d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.076831][ T181] ffff888034cb8d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.080042][ T181] >ffff888034cb8e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.083197][ T181] ^ [ 94.086821][ T181] ffff888034cb8e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.092298][ T181] ffff888034cb8f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.095777][ T181] ================================================================== [ 94.102036][ T5314] usb usb6: USB disconnect, device number 1 [ 94.142143][ T5314] vhci_hcd vhci_hcd.0: USB bus 6 deregistered