program: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = gettid() r2 = syz_open_dev$sndpcmc(&(0x7f0000000040), 0x1, 0x0) ioctl$SNDRV_PCM_IOCTL_WRITEI_FRAMES(r2, 0x40184150, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f00000000c0)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r4 = fanotify_init(0x200, 0x0) r5 = dup2(r4, r3) readv(r5, &(0x7f0000001400)=[{&(0x7f0000000040)=""/81, 0x51}], 0x1) fcntl$setstatus(r4, 0x4, 0x2800) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c0000001000010027bd7004ffdbdf2500000000", @ANYRES32=r7, @ANYBLOB="984e0600c16a01001c001280110001006272696467655f776c6166650000000004000580"], 0x3c}, 0x1, 0x0, 0x0, 0x400c080}, 0x200088c2) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) recvmsg$unix(r5, &(0x7f0000000780)={&(0x7f0000000380)=@abs, 0x6e, &(0x7f0000000680)=[{&(0x7f0000000400)=""/70, 0x46}, {&(0x7f0000000480)=""/100, 0x64}, {&(0x7f0000000500)=""/116, 0x74}, {&(0x7f0000000600)=""/88, 0x58}], 0x4, &(0x7f00000006c0)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xb0}, 0x41) ioctl$F2FS_IOC_SHUTDOWN(r8, 0x8004587d, &(0x7f0000000140)=0x3) write(r8, &(0x7f0000000300)='vhci_hcd.0\x00', 0xb) [ 94.743928][ T4638] Bluetooth: hci0: command tx timeout [ 95.024477][ T5311] bridge0: port 2(bridge_slave_1) entered disabled state [ 95.058154][ T5310] vhci_hcd vhci_hcd.0: remove, state 4 [ 95.061085][ T5310] usb usb7: USB disconnect, device number 1 [ 95.107085][ T177] vhci_hcd vhci_hcd.0: stop threads [ 95.109827][ T177] vhci_hcd vhci_hcd.0: release socket [ 95.122489][ T177] vhci_hcd vhci_hcd.0: disconnect device [ 95.130437][ T52] vhci_hcd vhci_hcd.0: stop threads [ 95.133252][ T52] vhci_hcd vhci_hcd.0: release socket [ 95.135701][ T52] vhci_hcd vhci_hcd.0: disconnect device [ 95.138612][ T5310] vhci_hcd vhci_hcd.0: USB bus 7 deregistered [ 95.143908][ T52] vhci_hcd vhci_hcd.0: stop threads [ 95.149067][ T52] vhci_hcd vhci_hcd.0: release socket [ 95.154536][ T52] vhci_hcd vhci_hcd.0: disconnect device [ 95.164494][ T52] vhci_hcd vhci_hcd.0: stop threads [ 95.170455][ T5310] vhci_hcd vhci_hcd.0: remove, state 4 [ 95.173737][ T52] ================================================================== [ 95.176999][ T52] BUG: KASAN: slab-use-after-free in vhci_shutdown_connection+0x1d4/0x650 [ 95.180427][ T52] Read of size 8 at addr ffff888034ed0c20 by task kworker/u4:4/52 [ 95.183555][ T52] [ 95.184578][ T52] CPU: 0 UID: 0 PID: 52 Comm: kworker/u4:4 Not tainted syzkaller #0 PREEMPT(full) [ 95.184593][ T52] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.184601][ T52] Workqueue: usbip_event event_handler [ 95.184615][ T52] Call Trace: [ 95.184621][ T52] [ 95.184626][ T52] dump_stack_lvl+0xe8/0x150 [ 95.184641][ T52] print_address_description+0x55/0x1e0 [ 95.184655][ T52] ? vhci_shutdown_connection+0x1d4/0x650 [ 95.184666][ T52] print_report+0x58/0x70 [ 95.184679][ T52] kasan_report+0x117/0x150 [ 95.184693][ T52] ? vhci_shutdown_connection+0x1d4/0x650 [ 95.184707][ T52] vhci_shutdown_connection+0x1d4/0x650 [ 95.184721][ T52] event_handler+0x2a4/0x4b0 [ 95.184730][ T52] ? process_scheduled_works+0x97a/0x1630 [ 95.184742][ T52] process_scheduled_works+0xc3d/0x1630 [ 95.184756][ T52] ? __pfx_process_scheduled_works+0x10/0x10 [ 95.184767][ T52] ? assign_work+0x3cf/0x5d0 [ 95.184776][ T52] worker_thread+0xa47/0xfb0 [ 95.184789][ T52] ? __kthread_parkme+0x71/0x1f0 [ 95.184801][ T52] kthread+0x38b/0x480 [ 95.184816][ T52] ? __pfx_worker_thread+0x10/0x10 [ 95.184826][ T52] ? __pfx_kthread+0x10/0x10 [ 95.184838][ T52] ret_from_fork+0x514/0xb70 [ 95.184851][ T52] ? __pfx_ret_from_fork+0x10/0x10 [ 95.184863][ T52] ? __switch_to+0xc89/0x1420 [ 95.184890][ T52] ? __pfx_kthread+0x10/0x10 [ 95.184905][ T52] ret_from_fork_asm+0x1a/0x30 [ 95.184922][ T52] [ 95.184925][ T52] [ 95.248739][ T52] Allocated by task 1: [ 95.250542][ T52] kasan_save_track+0x3e/0x80 [ 95.252609][ T52] __kasan_kmalloc+0x93/0xb0 [ 95.254711][ T52] __kmalloc_noprof+0x379/0x720 [ 95.256883][ T52] __usb_create_hcd+0x67/0x900 [ 95.259042][ T52] vhci_hcd_probe+0x1e6/0x3e0 [ 95.261042][ T52] platform_probe+0xf9/0x190 [ 95.263116][ T52] really_probe+0x254/0xae0 [ 95.265165][ T52] __driver_probe_device+0x1e8/0x360 [ 95.267472][ T52] driver_probe_device+0x4f/0x240 [ 95.269674][ T52] __device_attach_driver+0x270/0x410 [ 95.272050][ T52] bus_for_each_drv+0x258/0x2f0 [ 95.274204][ T52] __device_attach+0x2c4/0x450 [ 95.276341][ T52] device_initial_probe+0xa1/0xd0 [ 95.278612][ T52] bus_probe_device+0x12a/0x220 [ 95.280822][ T52] device_add+0x7d7/0xb80 [ 95.282725][ T52] platform_device_add+0x4bd/0x860 [ 95.284938][ T52] platform_device_register_full+0x53a/0x620 [ 95.287553][ T52] vhci_hcd_init+0x227/0x360 [ 95.289694][ T52] do_one_initcall+0x250/0x870 [ 95.291670][ T52] do_initcall_level+0x10a/0x1a0 [ 95.293690][ T52] do_initcalls+0x59/0xa0 [ 95.295536][ T52] kernel_init_freeable+0x29d/0x3e0 [ 95.297535][ T52] kernel_init+0x22/0x1d0 [ 95.299144][ T52] ret_from_fork+0x514/0xb70 [ 95.300712][ T52] ret_from_fork_asm+0x1a/0x30 [ 95.302441][ T52] [ 95.303382][ T52] Freed by task 5310: [ 95.304826][ T52] kasan_save_track+0x3e/0x80 [ 95.306658][ T52] kasan_save_free_info+0x40/0x50 [ 95.308747][ T52] __kasan_slab_free+0x5c/0x80 [ 95.310879][ T52] kfree+0x1c5/0x640 [ 95.312589][ T52] vhci_hcd_remove+0x9e/0x110 [ 95.314590][ T52] device_release_driver_internal+0x48b/0x880 [ 95.317287][ T52] unbind_store+0x1a1/0x1d0 [ 95.319221][ T52] kernfs_fop_write_iter+0x3a4/0x540 [ 95.321459][ T52] vfs_write+0x612/0xba0 [ 95.323271][ T52] ksys_write+0x150/0x270 [ 95.325036][ T52] do_syscall_64+0x166/0x520 [ 95.327156][ T52] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.329531][ T52] [ 95.330553][ T52] Last potentially related work creation: [ 95.333038][ T52] kasan_save_stack+0x3e/0x60 [ 95.335427][ T52] kasan_record_aux_stack+0xbd/0xd0 [ 95.338032][ T52] insert_work+0x3d/0x330 [ 95.340097][ T52] __queue_work+0xd07/0x10d0 [ 95.342222][ T52] queue_work_on+0x106/0x1d0 [ 95.344353][ T52] unlink1+0x344/0x3e0 [ 95.346269][ T52] usb_hcd_unlink_urb+0xe6/0x1e0 [ 95.348535][ T52] usb_kill_urb+0x10b/0x2f0 [ 95.350598][ T52] hub_quiesce+0x211/0x330 [ 95.352651][ T52] hub_suspend+0x904/0xad0 [ 95.354692][ T52] usb_suspend_both+0x285/0x1040 [ 95.356830][ T52] usb_runtime_suspend+0x58/0x110 [ 95.359119][ T52] __rpm_callback+0x2c7/0x950 [ 95.361254][ T52] rpm_suspend+0x89d/0x17a0 [ 95.363302][ T52] __pm_runtime_suspend+0x12f/0x1a0 [ 95.365747][ T52] usb_new_device+0xaee/0x1690 [ 95.367970][ T52] register_root_hub+0x250/0x5c0 [ 95.370184][ T52] usb_add_hcd+0xac7/0xf80 [ 95.372108][ T52] vhci_hcd_probe+0x1fa/0x3e0 [ 95.374195][ T52] platform_probe+0xf9/0x190 [ 95.376262][ T52] really_probe+0x254/0xae0 [ 95.378275][ T52] __driver_probe_device+0x1e8/0x360 [ 95.380580][ T52] driver_probe_device+0x4f/0x240 [ 95.382835][ T52] __device_attach_driver+0x270/0x410 [ 95.385175][ T52] bus_for_each_drv+0x258/0x2f0 [ 95.387360][ T52] __device_attach+0x2c4/0x450 [ 95.389465][ T52] device_initial_probe+0xa1/0xd0 [ 95.391642][ T52] bus_probe_device+0x12a/0x220 [ 95.393627][ T52] device_add+0x7d7/0xb80 [ 95.395474][ T52] platform_device_add+0x4bd/0x860 [ 95.397706][ T52] platform_device_register_full+0x53a/0x620 [ 95.400379][ T52] vhci_hcd_init+0x227/0x360 [ 95.402428][ T52] do_one_initcall+0x250/0x870 [ 95.404531][ T52] do_initcall_level+0x10a/0x1a0 [ 95.406686][ T52] do_initcalls+0x59/0xa0 [ 95.408551][ T52] kernel_init_freeable+0x29d/0x3e0 [ 95.410750][ T52] kernel_init+0x22/0x1d0 [ 95.412486][ T52] ret_from_fork+0x514/0xb70 [ 95.414426][ T52] ret_from_fork_asm+0x1a/0x30 [ 95.416442][ T52] [ 95.417479][ T52] Second to last potentially related work creation: [ 95.420150][ T52] kasan_save_stack+0x3e/0x60 [ 95.422089][ T52] kasan_record_aux_stack+0xbd/0xd0 [ 95.424173][ T52] insert_work+0x3d/0x330 [ 95.426049][ T52] __queue_work+0xd07/0x10d0 [ 95.428024][ T52] queue_work_on+0x106/0x1d0 [ 95.430042][ T52] usb_hcd_submit_urb+0xa3b/0x1b60 [ 95.432197][ T52] usb_start_wait_urb+0x13f/0x5b0 [ 95.434384][ T52] usb_control_msg+0x234/0x3e0 [ 95.436571][ T52] hub_suspend+0x891/0xad0 [ 95.438378][ T52] usb_suspend_both+0x285/0x1040 [ 95.440310][ T52] usb_runtime_suspend+0x58/0x110 [ 95.442403][ T52] __rpm_callback+0x2c7/0x950 [ 95.444394][ T52] rpm_suspend+0x89d/0x17a0 [ 95.446357][ T52] __pm_runtime_suspend+0x12f/0x1a0 [ 95.448567][ T52] usb_new_device+0xaee/0x1690 [ 95.450586][ T52] register_root_hub+0x250/0x5c0 [ 95.452793][ T52] usb_add_hcd+0xac7/0xf80 [ 95.454756][ T52] vhci_hcd_probe+0x1fa/0x3e0 [ 95.456590][ T52] platform_probe+0xf9/0x190 [ 95.458358][ T52] really_probe+0x254/0xae0 [ 95.460161][ T52] __driver_probe_device+0x1e8/0x360 [ 95.462206][ T52] driver_probe_device+0x4f/0x240 [ 95.464291][ T52] __device_attach_driver+0x270/0x410 [ 95.466428][ T52] bus_for_each_drv+0x258/0x2f0 [ 95.468383][ T52] __device_attach+0x2c4/0x450 [ 95.470377][ T52] device_initial_probe+0xa1/0xd0 [ 95.472489][ T52] bus_probe_device+0x12a/0x220 [ 95.474646][ T52] device_add+0x7d7/0xb80 [ 95.476490][ T52] platform_device_add+0x4bd/0x860 [ 95.478666][ T52] platform_device_register_full+0x53a/0x620 [ 95.481306][ T52] vhci_hcd_init+0x227/0x360 [ 95.483242][ T52] do_one_initcall+0x250/0x870 [ 95.485421][ T52] do_initcall_level+0x10a/0x1a0 [ 95.487538][ T52] do_initcalls+0x59/0xa0 [ 95.489419][ T52] kernel_init_freeable+0x29d/0x3e0 [ 95.491684][ T52] kernel_init+0x22/0x1d0 [ 95.493512][ T52] ret_from_fork+0x514/0xb70 [ 95.495537][ T52] ret_from_fork_asm+0x1a/0x30 [ 95.497834][ T52] [ 95.498862][ T52] The buggy address belongs to the object at ffff888034ed0000 [ 95.498862][ T52] which belongs to the cache kmalloc-8k of size 8192 [ 95.504657][ T52] The buggy address is located 3104 bytes inside of [ 95.504657][ T52] freed 8192-byte region [ffff888034ed0000, ffff888034ed2000) [ 95.510416][ T52] [ 95.511534][ T52] The buggy address belongs to the physical page: [ 95.515292][ T52] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34ed0 [ 95.519093][ T52] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 95.522681][ T52] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 95.525989][ T52] page_type: f5(slab) [ 95.527846][ T52] raw: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 95.531310][ T52] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 95.534931][ T52] head: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 95.538778][ T52] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 95.542569][ T52] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 95.546265][ T52] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 95.549910][ T52] page dumped because: kasan: bad access detected [ 95.552678][ T52] page_owner tracks the page as allocated [ 95.554885][ T52] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 16957277920 [ 95.562107][ T52] post_alloc_hook+0x1f9/0x250 [ 95.563850][ T52] get_page_from_freelist+0x2209/0x2280 [ 95.566330][ T52] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 95.568773][ T52] allocate_slab+0x7c/0x5e0 [ 95.570751][ T52] refill_objects+0x2d5/0x350 [ 95.572889][ T52] __pcs_replace_empty_main+0x2c3/0x6b0 [ 95.575417][ T52] __kmalloc_noprof+0x489/0x720 [ 95.577592][ T52] __usb_create_hcd+0x67/0x900 [ 95.579718][ T52] vhci_hcd_probe+0x104/0x3e0 [ 95.581792][ T52] platform_probe+0xf9/0x190 [ 95.583877][ T52] really_probe+0x254/0xae0 [ 95.585900][ T52] __driver_probe_device+0x1e8/0x360 [ 95.588242][ T52] driver_probe_device+0x4f/0x240 [ 95.590343][ T52] __device_attach_driver+0x270/0x410 [ 95.592660][ T52] bus_for_each_drv+0x258/0x2f0 [ 95.594809][ T52] __device_attach+0x2c4/0x450 [ 95.596924][ T52] page last free pid 1 tgid 1 ts 16954371634 stack trace: [ 95.599984][ T52] __free_frozen_pages+0xc93/0xd90 [ 95.602216][ T52] __slab_free+0x274/0x2c0 [ 95.604119][ T52] qlist_free_all+0x99/0x100 [ 95.606265][ T52] kasan_quarantine_reduce+0x148/0x160 [ 95.608563][ T52] __kasan_slab_alloc+0x22/0x80 [ 95.610696][ T52] __kmalloc_noprof+0x315/0x720 [ 95.612880][ T52] __alloc_workqueue+0x111/0x1fe0 [ 95.614976][ T52] alloc_workqueue_noprof+0xe3/0x210 [ 95.617142][ T52] usbip_init_eh+0x26/0x60 [ 95.619084][ T52] do_one_initcall+0x250/0x870 [ 95.621171][ T52] do_initcall_level+0x10a/0x1a0 [ 95.623467][ T52] do_initcalls+0x59/0xa0 [ 95.625384][ T52] kernel_init_freeable+0x29d/0x3e0 [ 95.627658][ T52] kernel_init+0x22/0x1d0 [ 95.629501][ T52] ret_from_fork+0x514/0xb70 [ 95.631572][ T52] ret_from_fork_asm+0x1a/0x30 [ 95.634168][ T52] [ 95.635139][ T52] Memory state around the buggy address: [ 95.637609][ T52] ffff888034ed0b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.641142][ T52] ffff888034ed0b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.645328][ T52] >ffff888034ed0c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.648652][ T52] ^ [ 95.650812][ T52] ffff888034ed0c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.654203][ T52] ffff888034ed0d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.657253][ T52] ================================================================== [ 95.663085][ T5310] usb usb6: USB disconnect, device number 1 [ 95.716810][ T5310] vhci_hcd vhci_hcd.0: USB bus 6 deregistered