program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x7, 0x4, 0x6, 0xfffa}, 0x1d, [0x6, 0xc95a, 0xfffffff3, 0x9, 0x80, 0x2, 0x1, 0x7f, 0x6, 0x4d, 0xfffffff2, 0x5f, 0xa, 0x3, 0xffff2d37, 0x1dd2, 0x6, 0x7, 0x0, 0x80000001, 0x4, 0x7, 0x3, 0x3c5b, 0x1, 0x24, 0xffffffff, 0x1, 0x1f461e2c, 0x2, 0xe661, 0x4, 0x7, 0x3, 0x7fff, 0x4c74, 0x8f00, 0x642, 0x3, 0xa, 0x0, 0x71, 0x7, 0x7, 0x103, 0x0, 0x5, 0x3c, 0x8f, 0x6, 0x6, 0x3, 0x5, 0x4, 0x8, 0x0, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0xffff, 0x12f, 0x8000, 0x10, 0xfffffff3, 0x129432e6, 0xcb, 0xf9, 0xd, 0x2bf, 0x6c9, 0x9, 0xfffffffc, 0x3, 0x0, 0x7, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0xa, 0x4, 0x4, 0x8000, 0x9, 0x400, 0x1, 0x6, 0x1, 0xff, 0x1005, 0x7ff, 0x5f31, 0x4, 0x0, 0x6, 0x2, 0x9, 0x4, 0x9, 0x8, 0x9, 0x6, 0x5, 0x0, 0x1, 0x8000, 0xffff, 0x2, 0x7f, 0x9, 0x5, 0x3, 0x4, 0x1, 0x7, 0x6, 0x9, 0x48c93690, 0x2, 0xff], [0x7, 0x4, 0x0, 0x64e, 0xfffffdfe, 0x7fffffff, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x9, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x10000009, 0x3e7, 0x2, 0x5, 0x2, 0x2, 0xf, 0x8, 0x4, 0x6d01, 0x5, 0x3b, 0x3, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x0, 0xa2, 0x7, 0x53cf697b, 0x3, 0x6, 0x54fe12d2, 0xbf, 0xb, 0x3, 0x400000, 0xfffffff9, 0x0, 0x1, 0x5, 0x0, 0x6, 0x0, 0x120000, 0x3, 0x6, 0x9, 0x4, 0x3], [0x9, 0xbb31, 0x3, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0x5, 0xce7, 0x1ff, 0x6, 0x7, 0x5, 0x3, 0x101, 0x10000, 0x6, 0x7fff, 0xffff, 0xa620, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x6, 0xffffffff, 0x80000000, 0x5, 0x8, 0xc8, 0x3, 0x3, 0xffff, 0x3, 0x9, 0x100, 0x9602, 0xa, 0x2, 0x4, 0x6, 0x1, 0x10000, 0x5, 0x8, 0x2b91, 0xa1f, 0x8, 0x9, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1c, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0)
write$binfmt_script(r2, &(0x7f0000000100), 0xfecc)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r2, 0x0)
futimesat(0xffffffffffffffff, 0x0, &(0x7f0000000340))
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x4000080000001}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x8}]}}}]}]}], {0x14}}, 0xcc}}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) (async)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa) (async)
openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0) (async)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa) (async)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x7, 0x4, 0x6, 0xfffa}, 0x1d, [0x6, 0xc95a, 0xfffffff3, 0x9, 0x80, 0x2, 0x1, 0x7f, 0x6, 0x4d, 0xfffffff2, 0x5f, 0xa, 0x3, 0xffff2d37, 0x1dd2, 0x6, 0x7, 0x0, 0x80000001, 0x4, 0x7, 0x3, 0x3c5b, 0x1, 0x24, 0xffffffff, 0x1, 0x1f461e2c, 0x2, 0xe661, 0x4, 0x7, 0x3, 0x7fff, 0x4c74, 0x8f00, 0x642, 0x3, 0xa, 0x0, 0x71, 0x7, 0x7, 0x103, 0x0, 0x5, 0x3c, 0x8f, 0x6, 0x6, 0x3, 0x5, 0x4, 0x8, 0x0, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0xffff, 0x12f, 0x8000, 0x10, 0xfffffff3, 0x129432e6, 0xcb, 0xf9, 0xd, 0x2bf, 0x6c9, 0x9, 0xfffffffc, 0x3, 0x0, 0x7, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0xa, 0x4, 0x4, 0x8000, 0x9, 0x400, 0x1, 0x6, 0x1, 0xff, 0x1005, 0x7ff, 0x5f31, 0x4, 0x0, 0x6, 0x2, 0x9, 0x4, 0x9, 0x8, 0x9, 0x6, 0x5, 0x0, 0x1, 0x8000, 0xffff, 0x2, 0x7f, 0x9, 0x5, 0x3, 0x4, 0x1, 0x7, 0x6, 0x9, 0x48c93690, 0x2, 0xff], [0x7, 0x4, 0x0, 0x64e, 0xfffffdfe, 0x7fffffff, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x9, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x10000009, 0x3e7, 0x2, 0x5, 0x2, 0x2, 0xf, 0x8, 0x4, 0x6d01, 0x5, 0x3b, 0x3, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x0, 0xa2, 0x7, 0x53cf697b, 0x3, 0x6, 0x54fe12d2, 0xbf, 0xb, 0x3, 0x400000, 0xfffffff9, 0x0, 0x1, 0x5, 0x0, 0x6, 0x0, 0x120000, 0x3, 0x6, 0x9, 0x4, 0x3], [0x9, 0xbb31, 0x3, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0x5, 0xce7, 0x1ff, 0x6, 0x7, 0x5, 0x3, 0x101, 0x10000, 0x6, 0x7fff, 0xffff, 0xa620, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x6, 0xffffffff, 0x80000000, 0x5, 0x8, 0xc8, 0x3, 0x3, 0xffff, 0x3, 0x9, 0x100, 0x9602, 0xa, 0x2, 0x4, 0x6, 0x1, 0x10000, 0x5, 0x8, 0x2b91, 0xa1f, 0x8, 0x9, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1c, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) (async)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) (async)
write$binfmt_script(r2, &(0x7f0000000100), 0xfecc) (async)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r2, 0x0) (async)
futimesat(0xffffffffffffffff, 0x0, &(0x7f0000000340)) (async)
socket$nl_netfilter(0x10, 0x3, 0xc) (async)
sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x4000080000001}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x8}]}}}]}]}], {0x14}}, 0xcc}}, 0x0) (async)
[ 103.972223][ T4652] Bluetooth: hci0: command tx timeout
[ 104.061187][ T5326] vhci_hcd vhci_hcd.0: remove, state 4
[ 104.084477][ T5326] usb usb7: USB disconnect, device number 1
[ 104.183488][ T177] vhci_hcd vhci_hcd.0: stop threads
[ 104.191246][ T177] vhci_hcd vhci_hcd.0: release socket
[ 104.199592][ T177] vhci_hcd vhci_hcd.0: disconnect device
[ 104.208172][ T177] vhci_hcd vhci_hcd.0: stop threads
[ 104.219054][ T177] vhci_hcd vhci_hcd.0: release socket
[ 104.229944][ T177] vhci_hcd vhci_hcd.0: disconnect device
[ 104.239835][ T5331] Zero length message leads to an empty skb
[ 104.242562][ T177] vhci_hcd vhci_hcd.0: stop threads
[ 104.248600][ T177] vhci_hcd vhci_hcd.0: release socket
[ 104.255221][ T5326] vhci_hcd vhci_hcd.0: USB bus 7 deregistered
[ 104.259683][ T177] vhci_hcd vhci_hcd.0: disconnect device
[ 104.267628][ T177] vhci_hcd vhci_hcd.0: stop threads
[ 104.273968][ T177] vhci_hcd vhci_hcd.0: release socket
[ 104.280961][ T177] vhci_hcd vhci_hcd.0: disconnect device
[ 104.290885][ T5326] vhci_hcd vhci_hcd.0: remove, state 4
[ 104.294976][ T177] ==================================================================
[ 104.297879][ T177] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0x40/0x60
[ 104.301100][ T177] Read of size 1 at addr ffff888034aecb68 by task kworker/u4:6/177
[ 104.304288][ T177]
[ 104.305299][ T177] CPU: 0 UID: 0 PID: 177 Comm: kworker/u4:6 Not tainted syzkaller #0 PREEMPT(full)
[ 104.305312][ T177] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 104.305319][ T177] Workqueue: usbip_event event_handler
[ 104.305336][ T177] Call Trace:
[ 104.305342][ T177]
[ 104.305347][ T177] dump_stack_lvl+0xe8/0x150
[ 104.305364][ T177] print_address_description+0x55/0x1e0
[ 104.305379][ T177] ? _raw_spin_lock_irqsave+0x40/0x60
[ 104.305390][ T177] print_report+0x58/0x70
[ 104.305402][ T177] kasan_report+0x117/0x150
[ 104.305416][ T177] ? _raw_spin_lock_irqsave+0x40/0x60
[ 104.305427][ T177] ? event_handler+0x2b0/0x4b0
[ 104.305436][ T177] __kasan_check_byte+0x2a/0x40
[ 104.305448][ T177] lock_acquire+0x84/0x350
[ 104.305463][ T177] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 104.305474][ T177] ? rcu_is_watching+0x15/0xb0
[ 104.305484][ T177] _raw_spin_lock_irqsave+0x40/0x60
[ 104.305494][ T177] ? event_handler+0x2b0/0x4b0
[ 104.305504][ T177] event_handler+0x2b0/0x4b0
[ 104.305514][ T177] ? process_scheduled_works+0xa20/0x14e0
[ 104.305526][ T177] process_scheduled_works+0xa8e/0x14e0
[ 104.305543][ T177] ? __pfx_process_scheduled_works+0x10/0x10
[ 104.305556][ T177] ? assign_work+0x3cf/0x5d0
[ 104.305568][ T177] worker_thread+0xa47/0xfb0
[ 104.305585][ T177] kthread+0x388/0x470
[ 104.305599][ T177] ? __pfx_worker_thread+0x10/0x10
[ 104.305610][ T177] ? __pfx_kthread+0x10/0x10
[ 104.305623][ T177] ret_from_fork+0x514/0xb70
[ 104.305645][ T177] ? __pfx_ret_from_fork+0x10/0x10
[ 104.305658][ T177] ? __switch_to+0xc89/0x1420
[ 104.305670][ T177] ? __pfx_kthread+0x10/0x10
[ 104.305684][ T177] ret_from_fork_asm+0x1a/0x30
[ 104.305697][ T177]
[ 104.305700][ T177]
[ 104.375272][ T177] Allocated by task 1:
[ 104.376885][ T177] kasan_save_track+0x3e/0x80
[ 104.378633][ T177] __kasan_kmalloc+0x93/0xb0
[ 104.380434][ T177] __kmalloc_noprof+0x375/0x720
[ 104.382309][ T177] __usb_create_hcd+0x67/0x900
[ 104.384479][ T177] vhci_hcd_probe+0x1e6/0x3e0
[ 104.386516][ T177] platform_probe+0xf9/0x190
[ 104.388501][ T177] really_probe+0x254/0xae0
[ 104.390417][ T177] __driver_probe_device+0x1e8/0x360
[ 104.392404][ T177] driver_probe_device+0x4f/0x240
[ 104.394580][ T177] __device_attach_driver+0x270/0x410
[ 104.396884][ T177] bus_for_each_drv+0x258/0x2f0
[ 104.398717][ T177] __device_attach+0x2c4/0x450
[ 104.400556][ T177] device_initial_probe+0xa1/0xd0
[ 104.402653][ T177] bus_probe_device+0x12a/0x220
[ 104.404959][ T177] device_add+0x7d7/0xb80
[ 104.406878][ T177] platform_device_add+0x4bd/0x860
[ 104.409066][ T177] platform_device_register_full+0x62d/0x710
[ 104.411536][ T177] vhci_hcd_init+0x227/0x360
[ 104.413609][ T177] do_one_initcall+0x250/0x870
[ 104.415556][ T177] do_initcall_level+0x10a/0x1a0
[ 104.417623][ T177] do_initcalls+0x59/0xa0
[ 104.419453][ T177] kernel_init_freeable+0x29d/0x3e0
[ 104.421709][ T177] kernel_init+0x1d/0x1d0
[ 104.423604][ T177] ret_from_fork+0x514/0xb70
[ 104.425651][ T177] ret_from_fork_asm+0x1a/0x30
[ 104.427770][ T177]
[ 104.428841][ T177] Freed by task 5326:
[ 104.430695][ T177] kasan_save_track+0x3e/0x80
[ 104.432796][ T177] kasan_save_free_info+0x40/0x50
[ 104.434914][ T177] __kasan_slab_free+0x5c/0x80
[ 104.436975][ T177] kfree+0x1c5/0x640
[ 104.438645][ T177] vhci_hcd_remove+0x9e/0x110
[ 104.440711][ T177] device_release_driver_internal+0x48b/0x880
[ 104.443344][ T177] unbind_store+0x1a1/0x1d0
[ 104.445244][ T177] kernfs_fop_write_iter+0x3a4/0x540
[ 104.447475][ T177] vfs_write+0x612/0xba0
[ 104.449214][ T177] ksys_write+0x150/0x270
[ 104.451063][ T177] do_syscall_64+0x174/0x580
[ 104.453134][ T177] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 104.455579][ T177]
[ 104.456633][ T177] Last potentially related work creation:
[ 104.458945][ T177] kasan_save_stack+0x3e/0x60
[ 104.460869][ T177] kasan_record_aux_stack+0xbd/0xd0
[ 104.462983][ T177] insert_work+0x3d/0x330
[ 104.464895][ T177] __queue_work+0xcd8/0x10a0
[ 104.466852][ T177] queue_work_on+0x106/0x1d0
[ 104.468804][ T177] unlink1+0x344/0x3e0
[ 104.470642][ T177] usb_hcd_unlink_urb+0xe6/0x1e0
[ 104.472785][ T177] usb_kill_urb+0x10b/0x2f0
[ 104.474684][ T177] hub_quiesce+0x211/0x330
[ 104.476583][ T177] hub_suspend+0x904/0xad0
[ 104.478465][ T177] usb_suspend_both+0x285/0x1040
[ 104.480607][ T177] usb_runtime_suspend+0x58/0x110
[ 104.482827][ T177] __rpm_callback+0x2c7/0x950
[ 104.484868][ T177] rpm_suspend+0x8a0/0x17b0
[ 104.486750][ T177] __pm_runtime_suspend+0x12f/0x1a0
[ 104.488922][ T177] usb_new_device+0xadf/0x1620
[ 104.490879][ T177] register_root_hub+0x250/0x5c0
[ 104.492978][ T177] usb_add_hcd+0xac7/0xf80
[ 104.494941][ T177] vhci_hcd_probe+0x1fa/0x3e0
[ 104.496956][ T177] platform_probe+0xf9/0x190
[ 104.498903][ T177] really_probe+0x254/0xae0
[ 104.500897][ T177] __driver_probe_device+0x1e8/0x360
[ 104.502971][ T177] driver_probe_device+0x4f/0x240
[ 104.505378][ T177] __device_attach_driver+0x270/0x410
[ 104.507800][ T177] bus_for_each_drv+0x258/0x2f0
[ 104.509900][ T177] __device_attach+0x2c4/0x450
[ 104.512014][ T177] device_initial_probe+0xa1/0xd0
[ 104.514193][ T177] bus_probe_device+0x12a/0x220
[ 104.516326][ T177] device_add+0x7d7/0xb80
[ 104.518208][ T177] platform_device_add+0x4bd/0x860
[ 104.520409][ T177] platform_device_register_full+0x62d/0x710
[ 104.522992][ T177] vhci_hcd_init+0x227/0x360
[ 104.525006][ T177] do_one_initcall+0x250/0x870
[ 104.527104][ T177] do_initcall_level+0x10a/0x1a0
[ 104.529494][ T177] do_initcalls+0x59/0xa0
[ 104.531832][ T177] kernel_init_freeable+0x29d/0x3e0
[ 104.534472][ T177] kernel_init+0x1d/0x1d0
[ 104.536565][ T177] ret_from_fork+0x514/0xb70
[ 104.538449][ T177] ret_from_fork_asm+0x1a/0x30
[ 104.540309][ T177]
[ 104.541278][ T177] Second to last potentially related work creation:
[ 104.543877][ T177] kasan_save_stack+0x3e/0x60
[ 104.545766][ T177] kasan_record_aux_stack+0xbd/0xd0
[ 104.548055][ T177] insert_work+0x3d/0x330
[ 104.549877][ T177] __queue_work+0xcd8/0x10a0
[ 104.551841][ T177] queue_work_on+0x106/0x1d0
[ 104.553675][ T177] usb_hcd_submit_urb+0xa3b/0x1b60
[ 104.555735][ T177] usb_start_wait_urb+0x13f/0x5b0
[ 104.557724][ T177] usb_control_msg+0x234/0x3e0
[ 104.559736][ T177] hub_suspend+0x891/0xad0
[ 104.561559][ T177] usb_suspend_both+0x285/0x1040
[ 104.563627][ T177] usb_runtime_suspend+0x58/0x110
[ 104.565680][ T177] __rpm_callback+0x2c7/0x950
[ 104.567581][ T177] rpm_suspend+0x8a0/0x17b0
[ 104.569475][ T177] __pm_runtime_suspend+0x12f/0x1a0
[ 104.571588][ T177] usb_new_device+0xadf/0x1620
[ 104.573601][ T177] register_root_hub+0x250/0x5c0
[ 104.575823][ T177] usb_add_hcd+0xac7/0xf80
[ 104.577745][ T177] vhci_hcd_probe+0x1fa/0x3e0
[ 104.579740][ T177] platform_probe+0xf9/0x190
[ 104.581631][ T177] really_probe+0x254/0xae0
[ 104.583578][ T177] __driver_probe_device+0x1e8/0x360
[ 104.585852][ T177] driver_probe_device+0x4f/0x240
[ 104.587962][ T177] __device_attach_driver+0x270/0x410
[ 104.590265][ T177] bus_for_each_drv+0x258/0x2f0
[ 104.592327][ T177] __device_attach+0x2c4/0x450
[ 104.594320][ T177] device_initial_probe+0xa1/0xd0
[ 104.596453][ T177] bus_probe_device+0x12a/0x220
[ 104.598611][ T177] device_add+0x7d7/0xb80
[ 104.600558][ T177] platform_device_add+0x4bd/0x860
[ 104.602675][ T177] platform_device_register_full+0x62d/0x710
[ 104.605181][ T177] vhci_hcd_init+0x227/0x360
[ 104.607203][ T177] do_one_initcall+0x250/0x870
[ 104.609273][ T177] do_initcall_level+0x10a/0x1a0
[ 104.611444][ T177] do_initcalls+0x59/0xa0
[ 104.613339][ T177] kernel_init_freeable+0x29d/0x3e0
[ 104.615441][ T177] kernel_init+0x1d/0x1d0
[ 104.617197][ T177] ret_from_fork+0x514/0xb70
[ 104.619065][ T177] ret_from_fork_asm+0x1a/0x30
[ 104.621098][ T177]
[ 104.622163][ T177] The buggy address belongs to the object at ffff888034aec000
[ 104.622163][ T177] which belongs to the cache kmalloc-8k of size 8192
[ 104.627966][ T177] The buggy address is located 2920 bytes inside of
[ 104.627966][ T177] freed 8192-byte region [ffff888034aec000, ffff888034aee000)
[ 104.634397][ T177]
[ 104.635689][ T177] The buggy address belongs to the physical page:
[ 104.639052][ T177] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34ae8
[ 104.643481][ T177] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 104.647500][ T177] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff)
[ 104.650736][ T177] page_type: f5(slab)
[ 104.652350][ T177] raw: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000
[ 104.656823][ T177] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
[ 104.660388][ T177] head: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000
[ 104.664330][ T177] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
[ 104.667855][ T177] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 104.671229][ T177] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 104.674632][ T177] page dumped because: kasan: bad access detected
[ 104.677277][ T177] page_owner tracks the page as allocated
[ 104.679602][ T177] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 20277244019, free_ts 20176158964
[ 104.688051][ T177] post_alloc_hook+0x1f9/0x250
[ 104.690201][ T177] get_page_from_freelist+0x21fa/0x2270
[ 104.692645][ T177] __alloc_frozen_pages_noprof+0x18d/0x380
[ 104.695235][ T177] allocate_slab+0x79/0x5e0
[ 104.697282][ T177] refill_objects+0x2d5/0x350
[ 104.699390][ T177] __pcs_replace_empty_main+0x2bf/0x6b0
[ 104.701779][ T177] __kmalloc_noprof+0x485/0x720
[ 104.703924][ T177] __usb_create_hcd+0x67/0x900
[ 104.706013][ T177] vhci_hcd_probe+0x1e6/0x3e0
[ 104.708141][ T177] platform_probe+0xf9/0x190
[ 104.710159][ T177] really_probe+0x254/0xae0
[ 104.712168][ T177] __driver_probe_device+0x1e8/0x360
[ 104.714279][ T177] driver_probe_device+0x4f/0x240
[ 104.716509][ T177] __device_attach_driver+0x270/0x410
[ 104.718769][ T177] bus_for_each_drv+0x258/0x2f0
[ 104.720875][ T177] __device_attach+0x2c4/0x450
[ 104.722957][ T177] page last free pid 9 tgid 9 stack trace:
[ 104.725492][ T177] free_pages_prepare+0x960/0xa60
[ 104.727729][ T177] __free_contig_range_common+0x174/0x340
[ 104.730173][ T177] free_pages_bulk+0x48/0x120
[ 104.732167][ T177] vfree+0x224/0x4a0
[ 104.733814][ T177] delayed_vfree_work+0x55/0x80
[ 104.735945][ T177] process_scheduled_works+0xa8e/0x14e0
[ 104.738340][ T177] worker_thread+0xa47/0xfb0
[ 104.740481][ T177] kthread+0x388/0x470
[ 104.742210][ T177] ret_from_fork+0x514/0xb70
[ 104.744460][ T177] ret_from_fork_asm+0x1a/0x30
[ 104.747131][ T177]
[ 104.748247][ T177] Memory state around the buggy address:
[ 104.750587][ T177] ffff888034aeca00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 104.753679][ T177] ffff888034aeca80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 104.756833][ T177] >ffff888034aecb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 104.760001][ T177] ^
[ 104.763121][ T177] ffff888034aecb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 104.766180][ T177] ffff888034aecc00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 104.769182][ T177] ==================================================================
[ 104.772272][ T177] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 104.775121][ T177] CPU: 0 UID: 0 PID: 177 Comm: kworker/u4:6 Not tainted syzkaller #0 PREEMPT(full)
[ 104.778547][ T177] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 104.782495][ T177] Workqueue: usbip_event event_handler
[ 104.784695][ T177] Call Trace:
[ 104.786022][ T177]
[ 104.787223][ T177] vpanic+0x56c/0xa60
[ 104.788884][ T177] ? __pfx_vpanic+0x10/0x10
[ 104.790686][ T177] panic+0xc5/0xd0
[ 104.792211][ T177] ? __pfx_panic+0x10/0x10
[ 104.794190][ T177] ? _raw_spin_lock_irqsave+0x40/0x60
[ 104.796376][ T177] ? rcu_is_watching+0x15/0xb0
[ 104.798276][ T177] ? _raw_spin_lock_irqsave+0x40/0x60
[ 104.800488][ T177] ? _raw_spin_lock_irqsave+0x40/0x60
[ 104.802606][ T177] check_panic_on_warn+0x89/0xb0
[ 104.805591][ T177] ? _raw_spin_lock_irqsave+0x40/0x60
[ 104.807779][ T177] end_report+0x73/0x170
[ 104.809459][ T177] ? _raw_spin_lock_irqsave+0x40/0x60
[ 104.811563][ T177] kasan_report+0x128/0x150
[ 104.813358][ T177] ? _raw_spin_lock_irqsave+0x40/0x60
[ 104.815595][ T177] ? event_handler+0x2b0/0x4b0
[ 104.817487][ T177] __kasan_check_byte+0x2a/0x40
[ 104.819383][ T177] lock_acquire+0x84/0x350
[ 104.821127][ T177] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 104.823311][ T177] ? rcu_is_watching+0x15/0xb0
[ 104.825117][ T177] _raw_spin_lock_irqsave+0x40/0x60
[ 104.827140][ T177] ? event_handler+0x2b0/0x4b0
[ 104.828999][ T177] event_handler+0x2b0/0x4b0
[ 104.830837][ T177] ? process_scheduled_works+0xa20/0x14e0
[ 104.833036][ T177] process_scheduled_works+0xa8e/0x14e0
[ 104.835153][ T177] ? __pfx_process_scheduled_works+0x10/0x10
[ 104.837540][ T177] ? assign_work+0x3cf/0x5d0
[ 104.839372][ T177] worker_thread+0xa47/0xfb0
[ 104.841224][ T177] kthread+0x388/0x470
[ 104.842907][ T177] ? __pfx_worker_thread+0x10/0x10
[ 104.845091][ T177] ? __pfx_kthread+0x10/0x10
[ 104.847041][ T177] ret_from_fork+0x514/0xb70
[ 104.849014][ T177] ? __pfx_ret_from_fork+0x10/0x10
[ 104.850924][ T177] ? __switch_to+0xc89/0x1420
[ 104.852784][ T177] ? __pfx_kthread+0x10/0x10
[ 104.854656][ T177] ret_from_fork_asm+0x1a/0x30
[ 104.856456][ T177]
[ 104.857899][ T177] Kernel Offset: disabled
[ 104.859541][ T177] Rebooting in 86400 seconds..