program: bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x12, 0x4, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4}, [@ldst={0x2, 0x0, 0x3, 0x1, 0x0, 0xfffffffffffffff0, 0xfffffffffffffffc}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x90) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='vhci_hcd.0\x00', 0xb) [ 93.331835][ T5330] vhci_hcd vhci_hcd.0: remove, state 4 [ 93.348082][ T5330] usb usb7: USB disconnect, device number 1 [ 93.521072][ T4653] Bluetooth: hci0: command tx timeout [ 93.546014][ T1372] cfg80211: failed to load regulatory.db [ 93.819686][ T24] vhci_hcd vhci_hcd.0: stop threads [ 93.823381][ T24] vhci_hcd vhci_hcd.0: release socket [ 93.847449][ T24] vhci_hcd vhci_hcd.0: disconnect device [ 93.919456][ T1063] vhci_hcd vhci_hcd.0: stop threads [ 93.946588][ T1063] vhci_hcd vhci_hcd.0: release socket [ 93.963201][ T1063] vhci_hcd vhci_hcd.0: disconnect device [ 93.984951][ T12] vhci_hcd vhci_hcd.0: stop threads [ 94.110430][ T12] vhci_hcd vhci_hcd.0: release socket [ 94.132968][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 94.181807][ T5330] vhci_hcd vhci_hcd.0: USB bus 7 deregistered [ 94.188989][ T24] vhci_hcd vhci_hcd.0: stop threads [ 94.203192][ T24] vhci_hcd vhci_hcd.0: release socket [ 94.220076][ T24] vhci_hcd vhci_hcd.0: disconnect device [ 94.227970][ T24] vhci_hcd vhci_hcd.0: stop threads [ 94.246851][ T24] vhci_hcd vhci_hcd.0: release socket [ 94.249314][ T24] vhci_hcd vhci_hcd.0: disconnect device [ 94.252850][ T24] vhci_hcd vhci_hcd.0: stop threads [ 94.255551][ T24] vhci_hcd vhci_hcd.0: release socket [ 94.272891][ T24] vhci_hcd vhci_hcd.0: disconnect device [ 94.276223][ T24] vhci_hcd vhci_hcd.0: stop threads [ 94.279124][ T24] vhci_hcd vhci_hcd.0: release socket [ 94.281466][ T24] vhci_hcd vhci_hcd.0: disconnect device [ 94.283771][ T24] vhci_hcd vhci_hcd.0: stop threads [ 94.286280][ T24] vhci_hcd vhci_hcd.0: release socket [ 94.303002][ T24] vhci_hcd vhci_hcd.0: disconnect device [ 94.335644][ T5330] vhci_hcd vhci_hcd.0: remove, state 4 [ 94.337971][ T5330] usb usb6: USB disconnect, device number 1 [ 94.379188][ T5330] vhci_hcd vhci_hcd.0: USB bus 6 deregistered [ 94.386963][ T12] vhci_hcd vhci_hcd.0: stop threads [ 94.390132][ T12] vhci_hcd vhci_hcd.0: release socket [ 94.394248][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 94.397509][ T12] vhci_hcd vhci_hcd.0: stop threads [ 94.453313][ T12] ================================================================== [ 94.457343][ T12] BUG: KASAN: slab-use-after-free in vhci_shutdown_connection+0x1d4/0x650 [ 94.476728][ T12] Read of size 8 at addr ffff888034e54780 by task kworker/u4:0/12 [ 94.500297][ T12] [ 94.502282][ T12] CPU: 0 UID: 0 PID: 12 Comm: kworker/u4:0 Not tainted syzkaller #0 PREEMPT(full) [ 94.502305][ T12] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.502316][ T12] Workqueue: usbip_event event_handler [ 94.502342][ T12] Call Trace: [ 94.502354][ T12] [ 94.502362][ T12] dump_stack_lvl+0xe8/0x150 [ 94.502385][ T12] print_address_description+0x55/0x1e0 [ 94.502418][ T12] ? vhci_shutdown_connection+0x1d4/0x650 [ 94.502434][ T12] print_report+0x58/0x70 [ 94.502450][ T12] kasan_report+0x117/0x150 [ 94.502469][ T12] ? vhci_shutdown_connection+0x1d4/0x650 [ 94.502488][ T12] vhci_shutdown_connection+0x1d4/0x650 [ 94.502506][ T12] event_handler+0x2a4/0x4b0 [ 94.502521][ T12] ? process_scheduled_works+0xa20/0x14e0 [ 94.502537][ T12] process_scheduled_works+0xa8e/0x14e0 [ 94.502561][ T12] ? __pfx_process_scheduled_works+0x10/0x10 [ 94.502577][ T12] ? assign_work+0x3cf/0x5d0 [ 94.502593][ T12] worker_thread+0xa47/0xfb0 [ 94.502617][ T12] kthread+0x388/0x470 [ 94.502635][ T12] ? __pfx_worker_thread+0x10/0x10 [ 94.502650][ T12] ? __pfx_kthread+0x10/0x10 [ 94.502669][ T12] ret_from_fork+0x514/0xb70 [ 94.502689][ T12] ? __pfx_ret_from_fork+0x10/0x10 [ 94.502708][ T12] ? __switch_to+0xc89/0x1420 [ 94.502726][ T12] ? __pfx_kthread+0x10/0x10 [ 94.502744][ T12] ret_from_fork_asm+0x1a/0x30 [ 94.502762][ T12] [ 94.502767][ T12] [ 94.751771][ T12] Allocated by task 1: [ 94.754064][ T12] kasan_save_track+0x3e/0x80 [ 94.769672][ T12] __kasan_kmalloc+0x93/0xb0 [ 94.772607][ T12] __kmalloc_noprof+0x375/0x720 [ 94.776556][ T12] __usb_create_hcd+0x67/0x900 [ 94.793247][ T12] vhci_hcd_probe+0x104/0x3e0 [ 94.795905][ T12] platform_probe+0xf9/0x190 [ 94.798738][ T12] really_probe+0x254/0xae0 [ 94.801481][ T12] __driver_probe_device+0x1e8/0x360 [ 94.804220][ T12] driver_probe_device+0x4f/0x240 [ 94.811418][ T12] __device_attach_driver+0x270/0x410 [ 94.828435][ T12] bus_for_each_drv+0x258/0x2f0 [ 94.830954][ T12] __device_attach+0x2c4/0x450 [ 94.833140][ T12] device_initial_probe+0xa1/0xd0 [ 94.835545][ T12] bus_probe_device+0x12a/0x220 [ 94.838516][ T12] device_add+0x7d7/0xb80 [ 94.841028][ T12] platform_device_add+0x4bd/0x860 [ 94.844809][ T12] platform_device_register_full+0x62d/0x710 [ 94.851044][ T12] vhci_hcd_init+0x227/0x360 [ 94.853031][ T12] do_one_initcall+0x250/0x870 [ 94.854938][ T12] do_initcall_level+0x10a/0x1a0 [ 94.868727][ T12] do_initcalls+0x59/0xa0 [ 94.871527][ T12] kernel_init_freeable+0x29d/0x3e0 [ 94.889418][ T12] kernel_init+0x1d/0x1d0 [ 94.896875][ T12] ret_from_fork+0x514/0xb70 [ 94.901651][ T12] ret_from_fork_asm+0x1a/0x30 [ 94.911671][ T12] [ 94.914488][ T12] Freed by task 5330: [ 94.935739][ T12] kasan_save_track+0x3e/0x80 [ 94.942079][ T12] kasan_save_free_info+0x40/0x50 [ 94.952782][ T12] __kasan_slab_free+0x5c/0x80 [ 94.957843][ T12] kfree+0x1c5/0x640 [ 94.986010][ T12] vhci_hcd_remove+0xe4/0x110 [ 94.988336][ T12] device_release_driver_internal+0x48b/0x880 [ 94.991454][ T12] unbind_store+0x1a1/0x1d0 [ 94.993774][ T12] kernfs_fop_write_iter+0x3a4/0x540 [ 94.996387][ T12] vfs_write+0x612/0xba0 [ 94.998487][ T12] ksys_write+0x150/0x270 [ 95.011644][ T12] do_syscall_64+0x174/0x580 [ 95.015168][ T12] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.022736][ T12] [ 95.030505][ T12] Last potentially related work creation: [ 95.034402][ T12] kasan_save_stack+0x3e/0x60 [ 95.040199][ T12] kasan_record_aux_stack+0xbd/0xd0 [ 95.044769][ T12] insert_work+0x3d/0x330 [ 95.047705][ T12] __queue_work+0xcd8/0x10a0 [ 95.051182][ T12] queue_work_on+0x106/0x1d0 [ 95.053965][ T12] unlink1+0x344/0x3e0 [ 95.056032][ T12] usb_hcd_unlink_urb+0xe6/0x1e0 [ 95.058501][ T12] usb_kill_urb+0x10b/0x2f0 [ 95.061707][ T12] hub_quiesce+0x211/0x330 [ 95.064757][ T12] hub_suspend+0x904/0xad0 [ 95.067778][ T12] usb_suspend_both+0x285/0x1040 [ 95.071858][ T12] usb_runtime_suspend+0x58/0x110 [ 95.075474][ T12] __rpm_callback+0x2c7/0x950 [ 95.104631][ T12] rpm_suspend+0x8a0/0x17b0 [ 95.107747][ T12] __pm_runtime_suspend+0x12f/0x1a0 [ 95.111129][ T12] usb_new_device+0xadf/0x1620 [ 95.113564][ T12] register_root_hub+0x250/0x5c0 [ 95.115991][ T12] usb_add_hcd+0xac7/0xf80 [ 95.118261][ T12] vhci_hcd_probe+0x141/0x3e0 [ 95.124843][ T12] platform_probe+0xf9/0x190 [ 95.127514][ T12] really_probe+0x254/0xae0 [ 95.141968][ T12] __driver_probe_device+0x1e8/0x360 [ 95.144705][ T12] driver_probe_device+0x4f/0x240 [ 95.169546][ T12] __device_attach_driver+0x270/0x410 [ 95.172517][ T12] bus_for_each_drv+0x258/0x2f0 [ 95.175324][ T12] __device_attach+0x2c4/0x450 [ 95.191844][ T12] device_initial_probe+0xa1/0xd0 [ 95.195469][ T12] bus_probe_device+0x12a/0x220 [ 95.198453][ T12] device_add+0x7d7/0xb80 [ 95.201948][ T12] platform_device_add+0x4bd/0x860 [ 95.206376][ T12] platform_device_register_full+0x62d/0x710 [ 95.213086][ T12] vhci_hcd_init+0x227/0x360 [ 95.222319][ T12] do_one_initcall+0x250/0x870 [ 95.229110][ T12] do_initcall_level+0x10a/0x1a0 [ 95.231505][ T12] do_initcalls+0x59/0xa0 [ 95.233550][ T12] kernel_init_freeable+0x29d/0x3e0 [ 95.236037][ T12] kernel_init+0x1d/0x1d0 [ 95.238180][ T12] ret_from_fork+0x514/0xb70 [ 95.251721][ T12] ret_from_fork_asm+0x1a/0x30 [ 95.269804][ T12] [ 95.271575][ T12] Second to last potentially related work creation: [ 95.276015][ T12] kasan_save_stack+0x3e/0x60 [ 95.279564][ T12] kasan_record_aux_stack+0xbd/0xd0 [ 95.286679][ T12] insert_work+0x3d/0x330 [ 95.290775][ T12] __queue_work+0xcd8/0x10a0 [ 95.300820][ T12] queue_work_on+0x106/0x1d0 [ 95.304260][ T12] usb_hcd_submit_urb+0xa3b/0x1b60 [ 95.309049][ T12] usb_start_wait_urb+0x13f/0x5b0 [ 95.320852][ T12] usb_control_msg+0x234/0x3e0 [ 95.323137][ T12] hub_ext_port_status+0x114/0x810 [ 95.325872][ T12] hub_activate+0x740/0x1b20 [ 95.328458][ T12] process_scheduled_works+0xa8e/0x14e0 [ 95.342080][ T12] worker_thread+0xa47/0xfb0 [ 95.344968][ T12] kthread+0x388/0x470 [ 95.349146][ T12] ret_from_fork+0x514/0xb70 [ 95.362505][ T12] ret_from_fork_asm+0x1a/0x30 [ 95.366011][ T12] [ 95.367829][ T12] The buggy address belongs to the object at ffff888034e54000 [ 95.367829][ T12] which belongs to the cache kmalloc-8k of size 8192 [ 95.383627][ T12] The buggy address is located 1920 bytes inside of [ 95.383627][ T12] freed 8192-byte region [ffff888034e54000, ffff888034e56000) [ 95.396146][ T12] [ 95.397887][ T12] The buggy address belongs to the physical page: [ 95.411659][ T12] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34e50 [ 95.418004][ T12] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 95.433266][ T12] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 95.437488][ T12] page_type: f5(slab) [ 95.461206][ T12] raw: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 95.465616][ T12] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 95.479904][ T12] head: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 95.484222][ T12] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 95.488274][ T12] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 95.509964][ T12] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 95.514420][ T12] page dumped because: kasan: bad access detected [ 95.517807][ T12] page_owner tracks the page as allocated [ 95.530714][ T12] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 16903604029, free_ts 16890760637 [ 95.543547][ T12] post_alloc_hook+0x1f9/0x250 [ 95.568647][ T12] get_page_from_freelist+0x21fa/0x2270 [ 95.572042][ T12] __alloc_frozen_pages_noprof+0x18d/0x380 [ 95.575521][ T12] allocate_slab+0x79/0x5e0 [ 95.578207][ T12] refill_objects+0x2d5/0x350 [ 95.581155][ T12] __pcs_replace_empty_main+0x2bf/0x6b0 [ 95.602970][ T12] __kmalloc_noprof+0x485/0x720 [ 95.605594][ T12] __usb_create_hcd+0x67/0x900 [ 95.607939][ T12] vhci_hcd_probe+0x104/0x3e0 [ 95.624326][ T12] platform_probe+0xf9/0x190 [ 95.626985][ T12] really_probe+0x254/0xae0 [ 95.631053][ T12] __driver_probe_device+0x1e8/0x360 [ 95.634167][ T12] driver_probe_device+0x4f/0x240 [ 95.636668][ T12] __device_attach_driver+0x270/0x410 [ 95.650374][ T12] bus_for_each_drv+0x258/0x2f0 [ 95.653754][ T12] __device_attach+0x2c4/0x450 [ 95.656771][ T12] page last free pid 1372 tgid 1372 stack trace: [ 95.673141][ T12] free_pages_prepare+0x960/0xa60 [ 95.675453][ T12] __free_contig_range_common+0x174/0x340 [ 95.678159][ T12] free_pages_bulk+0x48/0x120 [ 95.681721][ T12] vfree+0x224/0x4a0 [ 95.685154][ T12] delayed_vfree_work+0x55/0x80 [ 95.689314][ T12] process_scheduled_works+0xa8e/0x14e0 [ 95.696151][ T12] worker_thread+0xa47/0xfb0 [ 95.700193][ T12] kthread+0x388/0x470 [ 95.704660][ T12] ret_from_fork+0x514/0xb70 [ 95.709675][ T12] ret_from_fork_asm+0x1a/0x30 [ 95.714314][ T12] [ 95.715928][ T12] Memory state around the buggy address: [ 95.720646][ T12] ffff888034e54680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.726279][ T12] ffff888034e54700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.730454][ T12] >ffff888034e54780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.734184][ T12] ^ [ 95.736444][ T12] ffff888034e54800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.742059][ T12] ffff888034e54880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.747694][ T12] ==================================================================