program: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000900)="880100"/64) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(&(0x7f0000000d00)=@filename='none\x00', &(0x7f0000000e00)='./sys\x00', &(0x7f0000000f00)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./sys/devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/adsl_state\x00', 0x2, 0x0) write(r1, &(0x7f0000001200)='stop\x00', 0x5) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000001300)) [ 94.938646][ T4652] Bluetooth: hci0: command tx timeout [ 95.302421][ T10] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 95.457135][ T10] usb 5-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 95.471120][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 96.448973][ T10] cxacru 5-1:1.0: invalid response length to cm 0x84: 0 [ 96.451848][ T10] ATM dev 0: cxacru_atm_start: CHIP_ADSL_LINE_START returned -5 [ 96.649500][ T10] ATM dev 0: ADSL state: running [ 96.652719][ T10] ATM dev 0: ADSL line: down [ 96.944343][ T4652] Bluetooth: hci0: command tx timeout [ 98.942479][ T5325] cxacru 5-1:1.0: receive of cm 0x85 failed (-104) [ 98.948173][ T5325] ATM dev 0: change adsl state: CHIP_ADSL_LINE_STOP returned -104 [ 98.983517][ C0] ATM dev 0: usbatm_complete: urb 0xffff888039c69300 failed (-71)! [ 98.986751][ C0] ATM dev 0: usbatm_complete: urb 0xffff888039c69200 failed (-71)! [ 98.989909][ C0] ATM dev 0: usbatm_complete: urb 0xffff888039c69100 failed (-71)! [ 98.992906][ C0] ATM dev 0: usbatm_complete: urb 0xffff888039c69000 failed (-71)! [ 98.998294][ T10] usb 5-1: USB disconnect, device number 2 [ 99.001736][ T9] cxacru 5-1:1.0: send of cm 0x88 failed (-71) [ 99.007845][ T9] ATM dev 0: poll status: error -71 [ 99.015512][ T9] ATM dev 0: polling disabled, set adsl_state to 'start' or 'poll' to resume [ 99.025199][ T4652] Bluetooth: hci0: command tx timeout [ 99.034139][ T9] ================================================================== [ 99.037435][ T9] BUG: KASAN: slab-use-after-free in __mutex_lock+0x154/0x1550 [ 99.040575][ T9] Read of size 8 at addr ffff8880129d2a18 by task kworker/0:0/9 [ 99.043650][ T9] [ 99.044762][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full) [ 99.044775][ T9] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 99.044782][ T9] Workqueue: events cxacru_poll_status [ 99.044802][ T9] Call Trace: [ 99.044808][ T9] [ 99.044813][ T9] dump_stack_lvl+0xe8/0x150 [ 99.044830][ T9] print_address_description+0x55/0x1e0 [ 99.044845][ T9] ? __mutex_lock+0x154/0x1550 [ 99.044856][ T9] print_report+0x58/0x70 [ 99.044868][ T9] kasan_report+0x117/0x150 [ 99.044883][ T9] ? __mutex_lock+0x154/0x1550 [ 99.044895][ T9] __mutex_lock+0x154/0x1550 [ 99.044905][ T9] ? preempt_schedule_common+0x82/0xd0 [ 99.044915][ T9] ? preempt_schedule_thunk+0x16/0x40 [ 99.044927][ T9] ? cxacru_poll_status+0x73a/0x1110 [ 99.044940][ T9] ? __mutex_unlock_slowpath+0x794/0x900 [ 99.044950][ T9] ? __pfx___mutex_lock+0x10/0x10 [ 99.044963][ T9] ? kfree+0x1c5/0x640 [ 99.044972][ T9] ? cxacru_poll_status+0x381/0x1110 [ 99.044985][ T9] cxacru_poll_status+0x73a/0x1110 [ 99.045000][ T9] ? __pfx_cxacru_poll_status+0x10/0x10 [ 99.045016][ T9] ? rcu_is_watching+0x15/0xb0 [ 99.045026][ T9] ? process_scheduled_works+0xa20/0x14e0 [ 99.045038][ T9] process_scheduled_works+0xa8e/0x14e0 [ 99.045055][ T9] ? __pfx_process_scheduled_works+0x10/0x10 [ 99.045068][ T9] ? assign_work+0x3cf/0x5d0 [ 99.045080][ T9] worker_thread+0xa47/0xfb0 [ 99.045097][ T9] kthread+0x388/0x470 [ 99.045111][ T9] ? __pfx_worker_thread+0x10/0x10 [ 99.045121][ T9] ? __pfx_kthread+0x10/0x10 [ 99.045134][ T9] ret_from_fork+0x514/0xb70 [ 99.045148][ T9] ? __pfx_ret_from_fork+0x10/0x10 [ 99.045161][ T9] ? __switch_to+0xc89/0x1420 [ 99.045174][ T9] ? __pfx_kthread+0x10/0x10 [ 99.045188][ T9] ret_from_fork_asm+0x1a/0x30 [ 99.045201][ T9] [ 99.045204][ T9] [ 99.122717][ T9] Allocated by task 10: [ 99.124526][ T9] kasan_save_track+0x3e/0x80 [ 99.126475][ T9] __kasan_kmalloc+0x93/0xb0 [ 99.128456][ T9] __kmalloc_cache_noprof+0x32d/0x660 [ 99.130750][ T9] cxacru_bind+0xa3/0x1130 [ 99.132641][ T9] usbatm_usb_probe+0x37f/0x1db0 [ 99.134392][ T9] cxacru_usb_probe+0x17f/0x220 [ 99.136039][ T9] usb_probe_interface+0x653/0xc60 [ 99.137877][ T9] really_probe+0x254/0xae0 [ 99.139397][ T9] __driver_probe_device+0x1e8/0x360 [ 99.141181][ T9] driver_probe_device+0x4f/0x240 [ 99.142918][ T9] __device_attach_driver+0x270/0x410 [ 99.144758][ T9] bus_for_each_drv+0x258/0x2f0 [ 99.146492][ T9] __device_attach+0x2c4/0x450 [ 99.148173][ T9] device_initial_probe+0xa1/0xd0 [ 99.149911][ T9] bus_probe_device+0x12a/0x220 [ 99.151550][ T9] device_add+0x7d7/0xb80 [ 99.153185][ T9] usb_set_configuration+0x1ad8/0x2180 [ 99.155195][ T9] usb_generic_driver_probe+0x8d/0x150 [ 99.157312][ T9] usb_probe_device+0x1c3/0x3b0 [ 99.159177][ T9] really_probe+0x254/0xae0 [ 99.160947][ T9] __driver_probe_device+0x1e8/0x360 [ 99.163039][ T9] driver_probe_device+0x4f/0x240 [ 99.164791][ T9] __device_attach_driver+0x270/0x410 [ 99.166681][ T9] bus_for_each_drv+0x258/0x2f0 [ 99.168506][ T9] __device_attach+0x2c4/0x450 [ 99.170307][ T9] device_initial_probe+0xa1/0xd0 [ 99.172367][ T9] bus_probe_device+0x12a/0x220 [ 99.174383][ T9] device_add+0x7d7/0xb80 [ 99.176193][ T9] usb_new_device+0x99d/0x1620 [ 99.178141][ T9] hub_event+0x28e8/0x4d30 [ 99.179931][ T9] process_scheduled_works+0xa8e/0x14e0 [ 99.182273][ T9] worker_thread+0xa47/0xfb0 [ 99.184199][ T9] kthread+0x388/0x470 [ 99.185903][ T9] ret_from_fork+0x514/0xb70 [ 99.187769][ T9] ret_from_fork_asm+0x1a/0x30 [ 99.189793][ T9] [ 99.190832][ T9] Freed by task 10: [ 99.192398][ T9] kasan_save_track+0x3e/0x80 [ 99.194266][ T9] kasan_save_free_info+0x40/0x50 [ 99.196241][ T9] __kasan_slab_free+0x5c/0x80 [ 99.198101][ T9] kfree+0x1c5/0x640 [ 99.199639][ T9] cxacru_unbind+0x1c8/0x340 [ 99.201510][ T9] usbatm_usb_disconnect+0x42b/0x620 [ 99.203495][ T9] usb_unbind_interface+0x295/0x9f0 [ 99.205537][ T9] device_release_driver_internal+0x4f5/0x880 [ 99.207935][ T9] bus_remove_device+0x444/0x560 [ 99.209947][ T9] device_del+0x524/0x8f0 [ 99.211597][ T9] usb_disable_device+0x3d4/0x8d0 [ 99.213671][ T9] usb_disconnect+0x346/0x9a0 [ 99.215636][ T9] hub_event+0x1bbb/0x4d30 [ 99.217480][ T9] process_scheduled_works+0xa8e/0x14e0 [ 99.219562][ T9] worker_thread+0xa47/0xfb0 [ 99.221435][ T9] kthread+0x388/0x470 [ 99.223156][ T9] ret_from_fork+0x514/0xb70 [ 99.225058][ T9] ret_from_fork_asm+0x1a/0x30 [ 99.227066][ T9] [ 99.228076][ T9] Last potentially related work creation: [ 99.230457][ T9] kasan_save_stack+0x3e/0x60 [ 99.232432][ T9] kasan_record_aux_stack+0xbd/0xd0 [ 99.234574][ T9] insert_work+0x3d/0x330 [ 99.236340][ T9] __queue_work+0xcd8/0x10a0 [ 99.238267][ T9] call_timer_fn+0x192/0x5e0 [ 99.240168][ T9] __run_timer_base+0x67e/0x8b0 [ 99.242242][ T9] run_timer_softirq+0xb7/0x170 [ 99.244275][ T9] handle_softirqs+0x225/0x840 [ 99.246332][ T9] run_ksoftirqd+0x36/0x60 [ 99.248185][ T9] smpboot_thread_fn+0x57c/0xa80 [ 99.250322][ T9] kthread+0x388/0x470 [ 99.252024][ T9] ret_from_fork+0x514/0xb70 [ 99.254019][ T9] ret_from_fork_asm+0x1a/0x30 [ 99.256041][ T9] [ 99.257066][ T9] The buggy address belongs to the object at ffff8880129d2800 [ 99.257066][ T9] which belongs to the cache kmalloc-1k of size 1024 [ 99.262246][ T9] The buggy address is located 536 bytes inside of [ 99.262246][ T9] freed 1024-byte region [ffff8880129d2800, ffff8880129d2c00) [ 99.267185][ T9] [ 99.268047][ T9] The buggy address belongs to the physical page: [ 99.270350][ T9] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x129d0 [ 99.273547][ T9] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 99.276677][ T9] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 99.279637][ T9] page_type: f5(slab) [ 99.281224][ T9] raw: 00fff00000000040 ffff88801b041dc0 dead000000000100 dead000000000122 [ 99.284525][ T9] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 99.287837][ T9] head: 00fff00000000040 ffff88801b041dc0 dead000000000100 dead000000000122 [ 99.291163][ T9] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 99.294600][ T9] head: 00fff00000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff [ 99.297946][ T9] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 99.301136][ T9] page dumped because: kasan: bad access detected [ 99.303516][ T9] page_owner tracks the page as allocated [ 99.305722][ T9] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 41, tgid 41 (kworker/u4:3), ts 95497416999, free_ts 95432862342 [ 99.313636][ T9] post_alloc_hook+0x1f9/0x250 [ 99.315595][ T9] get_page_from_freelist+0x21fa/0x2270 [ 99.317874][ T9] __alloc_frozen_pages_noprof+0x18d/0x380 [ 99.320666][ T9] allocate_slab+0x79/0x5e0 [ 99.322877][ T9] refill_objects+0x2d5/0x350 [ 99.324795][ T9] __pcs_replace_empty_main+0x2bf/0x6b0 [ 99.326993][ T9] __kmalloc_noprof+0x485/0x720 [ 99.328862][ T9] ieee802_11_parse_elems_full+0x14b/0x2db0 [ 99.331247][ T9] ieee80211_inform_bss+0x163/0x10d0 [ 99.333286][ T9] cfg80211_inform_single_bss_data+0xd9c/0x1be0 [ 99.335664][ T9] cfg80211_inform_bss_data+0x25b/0x3d50 [ 99.337857][ T9] cfg80211_inform_bss_frame_data+0x3c7/0x840 [ 99.340198][ T9] ieee80211_bss_info_update+0x791/0xa50 [ 99.342504][ T9] ieee80211_ibss_rx_queued_mgmt+0x1ce3/0x2c40 [ 99.345014][ T9] ieee80211_iface_work+0x78a/0x1010 [ 99.347199][ T9] cfg80211_wiphy_work+0x29e/0x420 [ 99.349313][ T9] page last free pid 10 tgid 10 stack trace: [ 99.351781][ T9] __free_frozen_pages+0xc1e/0xd10 [ 99.353950][ T9] stack_depot_save_flags+0x407/0x800 [ 99.356085][ T9] kasan_save_track+0x4f/0x80 [ 99.357999][ T9] __kasan_kmalloc+0x93/0xb0 [ 99.360040][ T9] __kmalloc_cache_noprof+0x32d/0x660 [ 99.362200][ T9] dummy_urb_enqueue+0x7c/0x780 [ 99.363959][ T9] usb_hcd_submit_urb+0x328/0x1b60 [ 99.365974][ T9] usb_start_wait_urb+0x13f/0x5b0 [ 99.367852][ T9] usb_control_msg+0x234/0x3e0 [ 99.369707][ T9] hub_port_init+0xddb/0x28c0 [ 99.371530][ T9] hub_event+0x24e8/0x4d30 [ 99.373355][ T9] process_scheduled_works+0xa8e/0x14e0 [ 99.375581][ T9] worker_thread+0xa47/0xfb0 [ 99.377399][ T9] kthread+0x388/0x470 [ 99.379086][ T9] ret_from_fork+0x514/0xb70 [ 99.381320][ T9] ret_from_fork_asm+0x1a/0x30 [ 99.383832][ T9] [ 99.384862][ T9] Memory state around the buggy address: [ 99.387250][ T9] ffff8880129d2900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 99.390471][ T9] ffff8880129d2980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 99.393659][ T9] >ffff8880129d2a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 99.396840][ T9] ^ [ 99.398872][ T9] ffff8880129d2a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 99.401945][ T9] ffff8880129d2b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 99.404948][ T9] ==================================================================