program: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) syz_mount_image$udf(&(0x7f0000000000), &(0x7f0000000180)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x82, &(0x7f0000000700)=ANY=[@ANYBLOB='iocharset=default,noadinicb,gid=forget,gid=ignore,nostrict,gid=', @ANYRESDEC=0x0, @ANYBLOB="2c616e63686f723d30303030000088be0900303030303030303030312c7569643d666f726765742c00215e8c2e42462f3ab5e1f7c0527abbb422be9178aa60681964adb069ae876c4a599d560075ac47c0de1a9bb9146af6433efdcdac853a8e8f16d6bad90ecce0a1fab46f48331e6b3c325c08df3c334e4da28067a30b3b1dc64bf692c712fc273bc1702008f563765c6f3e67d97e1369973c2a87f0ecca7320819863179fb85e394a8cf1d62c70d8306633b6958ebf998a0685bc5cdd1f97291328743add4c867115fae1082f8faf482e15eb939968"], 0xfd, 0xc34, &(0x7f0000001080)="$eJzs3U9sHNd9B/DfGy5F0m4rJk5Uu42LTVukMmO5sqSYilW4q5pmG0CWiVDMLQBX5EpdmFoSJNXIbtowvfTQQ4Ci6CEnAq1RIEUDoymKHtnWBZKLD4VPPREtbARFD2wRIKeAxcy+FVf/LMkkJcr+fGzqOzv73sx7M+MZWdCbFwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAxO+8cvb48+lhtwIAeJDOT3/1+AnPfwD4RLng//8BAAAAAAAAAAAAAOCgS1HEE5Fi6fxWmq0+dw2fa3euXpuZmLx9tZFU1Ryoypc/w8+fOHnqSy+Mn+7lh9ffa0/Fa9MXztZfXryytNxaWWnN12c67bnF+dY9b2G39W82Vh2A+pXXr85furRSP/HcyRu+vjb6wdDjR0bPjD9z7Ole2ZmJycnpvjK1wY+891vcaYTHoSjiWKR49vs/Ts2IKGL3x+Iu185+G6k6MVZ1YmZisurIQrvZWS2/nOodiCKi3lep0TtGD+Bc7EojYq1sftngsbJ700vN5ebFhVZ9qrm82l5tL3amUre1ZX/qUcTpFLEeEZtDt25uMIqoRYrvHt5KFyNioHccvlgNDL5zO4p97OM9KNtZH4xYLx6Bc3aADUURr0aKn7xTxFx5zPJPfCHi1TL/MeKtMl+KSOWFcSri/eo6GnnILWcv1KKIPyvP/5mtNF/dD3r3lXNfq3+lc2mxr2zvvvLIPx8epAN+bxqOIprVHX8rffTf7AAAAAAAAAAAAAAAAACw10aiiKcixSv//gfVuOKoxqUfPjP+u6M/3z9m/Mm7bKcs+1xErBX3Nib3UB5CPJWmUnrIY4k/yYajiD/K4/++/bAbAwAAAAAAAAAAAAAAAAAA8IlWxHuR4sV3j6b16J9TvN25XL/QvLjQnRW2N/dvb8707e3t7XrqZiPnbM61nOs5N3Ju5owi18/ZyDmbcy3nes6NnJs5YyDXz9nIOZtzLed6zo2cmzmjluvnbOSczbmWcz3nRs7NnHFA5u4FAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPg4KaKIn0WK73xjK0WKiEbEbHRzY6hXBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4mIZSET+IFPXfa1xfV4uIVP3bdbT85VQ0DpX56WiMl/lSNM7mbFZZa3z7IbSf3RlMRfwoUgwNv339hOfzP9j9dP0yiLe+ufPpl2rdHOh9OfrB0ONHDp8Zn/yVJ++0nG7XgLFz7c7Va/WZicnJ6b7Vtbz3T/etG837Lfam60TEyhtvvt5cWGgtW/hkLNS6C7XY0y2PROztBvduodZdyPereOjtucNC42A0Y2chqnv/be/ZfGyUz//3I8VvvvsfvQd+7/n/c91P15/w8dM/3nn+v3jzhvbp+f9E37oX8+9GBmsRw6tXlgaPRAyvvPHmsfaV5uXW5Vbn1PHjXx4f//LJ44OHIoYvtRdafUu7PlQAAAAAAAAAAAAAAAAAD1Yq4rcjRfNHW6keEdeq8VqjZ8afOfb0QAxU461uGLf12vSFs/WXF68sLbdWVlrz9ZlOe25xvnWvuxuuhnvNTEzuS2fuamSf2z8y/PLi0hvL7cu/v3rb7x8bPntxZXW5OXf7r2MkiohG/5qxqsEzE5NVoxfazU5VdWqPBmYOpiL+M1LMnaqnz+d1efxfGe8N9pXtH/+/1re+Wt6n8X+fumk/KRXx00jxG3/+ZHy+audjccsxy+X+OlKMnf5cLheHynK9NnTfK9AdGViW/d9I8fc/u7Fsr+9P7JR9/v6O7sFXnv/DkeIHf/q9+NW87sb3P+yM/+w//4/dvKF9Ov+f6Vv32A3vK9h118nn/1ikeOmJt+PX8roPe/9HEdvb29+KOJoLX38/xz6d/8/2rRuN7n5/fe+6DwAAAAAAAAAA8MgaTEX8TaR4erKWXsjr7uXv/83fvKF9+vtfv9i3bv4BzVe064MKAAAAAAfEYCrivUhxefXt62Oo+8Z/3zj+87d25l6fSDd9W/053y9U7w3Yyz//6zea9zu7+24DAAAAAAAAAAAAAAAAAADAgZJSES/k+dRn7zKf+kakeOW/n83l0pGyXG8e+NHq1+Hzi51jZxcWFueaq82LC6369FJzrlXW/Uyk2Pqrz+W6RTW/em+++e4c78PbvbnYlyPF5N/2ynbnYu/NTd6dD7w7F3tZ9lOR4r/+7sayvXmsP7tT9kRZ9i8jxdf/6fZlj+yUPVmW/V6k+OHX672yj5Vle+9H7b6TdLgWC63n5hYXbnkVKgAAAAAAAAAAAAAAAAAAANyvwVTEn0SK/7myHmt52H+e/783A3+tV/atb/bN93+Ta9U8/6PV/P93Wv4o8/+P7llPAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg0ZGiiDcjxdL5rbQxVH7uGj7X7ly9NjMxeftqI6mqOVCVL3+Gnz9x8tSXXhg/3csPr7/XnorXpi+crb+8eGVpubWy0pqvz3Tac4vzrXvewm7r7xy6rrHqANSvvH51/tKllfqJ507e8PW10Q+GHj8yemb8mWNP98rOTExOTveVqQ3ex97vq3E7DkURfxEpnv3+j9M/D0UUsftjcZdrZ7+NVJ0YqzoxMzFZdWSh3eysll9O9Q5EEVHvq9ToHaMHcC52pRGxVja/bPBY2b3ppeZy8+JCqz7VXF5tr7YXO1Op29qyP/Uo4nSKWI+IzaFbNzcYRbweKb57eCv9y1DEQO84fPH89FePn7hzO4p97OM9KNtZH4xYLx6Bc3aADUUR/xApfvLO0fjXoYhadH/iCxGv9hd8KSKVF8apiPdvcx3xaKpFEf9Xnv8zW+mdofJ+0LuvnPta/SudS4t9ZXv3lYP0fNi+/2txZA92e+8O+L1pOIr4YXXH30r/5r9rAAAAAAAAAAAAAAAAgAOkiF+OFC++ezRV44Ovjyludy7XLzQvLnSH9fXG/tUj/rDM7e3t7XrqZiPnbM61nOs5N3Ju5owi18/ZyDmbcy3nes6NnJs5YyDXz9nIOZtzLed6zo2cmzmjVsX29va3uvVruX7OtZzrtYiirJ8/b+aMAzJ2DwAAAAAAAAAAAAAAAAAA+Hgpqn9SfOcbW6maS7URMRvd3DAf6Mfe/wcAAP//3sf+xA==") r1 = memfd_create(&(0x7f0000000000)='\xf3e\t\x9f\x918\xc0y\x01c\x1fnux\x00sV\ad\xb0l \xfd\xd7\x8e\x7f\x89\xb8\xc5;~\x04\x03~K\xfbP\x84=\xfa\x81\f\x1et\x10\x0e\xcf^9\xbe\\', 0x0) pwrite64(r1, &(0x7f0000000280)='/', 0x1, 0x0) (async) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r1, 0x0) (async) symlink(&(0x7f0000001000)='./file0\x00', &(0x7f00000000c0)='./file0\x00') stat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000100)) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000240)={0x44, r3, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x5e24}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}]}]}, 0x44}}, 0x0) (async) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r4, 0xc0502100, &(0x7f0000000740)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r4, 0xc0182101, &(0x7f00000000c0)={r5}) (async) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000180)={r5, 0x0, r2, 0x13c, 0x80000}) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) (async) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x20, r7, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x48050}, 0x0) (async) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) write(r8, &(0x7f0000000300)='vhci_hcd.0\x00', 0xb) (async) sendmsg$IPSET_CMD_TYPE(r0, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x68, 0xd, 0x6, 0x201, 0x0, 0x0, {0xa, 0x0, 0x1}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x7}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:mac\x00'}]}, 0x68}, 0x1, 0x0, 0x0, 0x40}, 0x10) (async) ioctl$SNDCTL_SEQ_PANIC(r8, 0x5111) (async) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)={0x48, 0x2, 0x6, 0x801, 0xe4340000, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}]}, 0x48}}, 0x0) [ 93.441973][ T4653] Bluetooth: hci0: command tx timeout [ 93.387753][ T5332] loop0: detected capacity change from 0 to 2048 [ 93.435967][ T5332] UDF-fs: error (device loop0): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d [ 93.443011][ T4653] Bluetooth: hci0: command tx timeout [ 93.471078][ T5332] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 93.580472][ T5331] vhci_hcd vhci_hcd.0: remove, state 4 [ 93.583871][ T5331] usb usb7: USB disconnect, device number 1 [ 93.636142][ T30] vhci_hcd vhci_hcd.0: stop threads [ 93.639529][ T5331] vhci_hcd vhci_hcd.0: USB bus 7 deregistered [ 93.642872][ T30] vhci_hcd vhci_hcd.0: release socket [ 93.646671][ T30] vhci_hcd vhci_hcd.0: disconnect device [ 93.653665][ T30] vhci_hcd vhci_hcd.0: stop threads [ 93.657488][ T5331] vhci_hcd vhci_hcd.0: remove, state 4 [ 93.659921][ T5331] usb usb6: USB disconnect, device number 1 [ 93.664387][ T30] ================================================================== [ 93.667682][ T30] BUG: KASAN: slab-use-after-free in vhci_shutdown_connection+0x1d4/0x650 [ 93.671118][ T30] Read of size 8 at addr ffff888034d14780 by task kworker/u4:2/30 [ 93.674320][ T30] [ 93.675357][ T30] CPU: 0 UID: 0 PID: 30 Comm: kworker/u4:2 Not tainted syzkaller #0 PREEMPT(full) [ 93.675368][ T30] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.675374][ T30] Workqueue: usbip_event event_handler [ 93.675385][ T30] Call Trace: [ 93.675390][ T30] [ 93.675394][ T30] dump_stack_lvl+0xe8/0x150 [ 93.675405][ T30] print_address_description+0x55/0x1e0 [ 93.675415][ T30] ? vhci_shutdown_connection+0x1d4/0x650 [ 93.675422][ T30] print_report+0x58/0x70 [ 93.675430][ T30] kasan_report+0x117/0x150 [ 93.675439][ T30] ? vhci_shutdown_connection+0x1d4/0x650 [ 93.675448][ T30] vhci_shutdown_connection+0x1d4/0x650 [ 93.675458][ T30] event_handler+0x2a4/0x4b0 [ 93.675468][ T30] ? process_scheduled_works+0xa20/0x14e0 [ 93.675479][ T30] process_scheduled_works+0xa8e/0x14e0 [ 93.675495][ T30] ? __pfx_process_scheduled_works+0x10/0x10 [ 93.675509][ T30] ? assign_work+0x3cf/0x5d0 [ 93.675521][ T30] worker_thread+0xa47/0xfb0 [ 93.675539][ T30] kthread+0x388/0x470 [ 93.675555][ T30] ? __pfx_worker_thread+0x10/0x10 [ 93.675563][ T30] ? __pfx_kthread+0x10/0x10 [ 93.675572][ T30] ret_from_fork+0x514/0xb70 [ 93.675582][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 93.675591][ T30] ? __switch_to+0xc89/0x1420 [ 93.675599][ T30] ? __pfx_kthread+0x10/0x10 [ 93.675608][ T30] ret_from_fork_asm+0x1a/0x30 [ 93.675616][ T30] [ 93.675619][ T30] [ 93.732068][ T30] Allocated by task 1: [ 93.733779][ T30] kasan_save_track+0x3e/0x80 [ 93.735771][ T30] __kasan_kmalloc+0x93/0xb0 [ 93.737616][ T30] __kmalloc_noprof+0x375/0x720 [ 93.739595][ T30] __usb_create_hcd+0x67/0x900 [ 93.741674][ T30] vhci_hcd_probe+0x1e6/0x3e0 [ 93.743615][ T30] platform_probe+0xf9/0x190 [ 93.745565][ T30] really_probe+0x254/0xae0 [ 93.747347][ T30] __driver_probe_device+0x1e8/0x360 [ 93.749468][ T30] driver_probe_device+0x4f/0x240 [ 93.751429][ T30] __device_attach_driver+0x270/0x410 [ 93.753512][ T30] bus_for_each_drv+0x258/0x2f0 [ 93.755490][ T30] __device_attach+0x2c4/0x450 [ 93.757349][ T30] device_initial_probe+0xa1/0xd0 [ 93.759314][ T30] bus_probe_device+0x12a/0x220 [ 93.761316][ T30] device_add+0x7d7/0xb80 [ 93.763102][ T30] platform_device_add+0x4bd/0x860 [ 93.765106][ T30] platform_device_register_full+0x62d/0x710 [ 93.767551][ T30] vhci_hcd_init+0x227/0x360 [ 93.769418][ T30] do_one_initcall+0x250/0x870 [ 93.771294][ T30] do_initcall_level+0x10a/0x1a0 [ 93.773323][ T30] do_initcalls+0x59/0xa0 [ 93.775144][ T30] kernel_init_freeable+0x29d/0x3e0 [ 93.777176][ T30] kernel_init+0x1d/0x1d0 [ 93.778938][ T30] ret_from_fork+0x514/0xb70 [ 93.780895][ T30] ret_from_fork_asm+0x1a/0x30 [ 93.782871][ T30] [ 93.783851][ T30] Freed by task 5331: [ 93.785598][ T30] kasan_save_track+0x3e/0x80 [ 93.787575][ T30] kasan_save_free_info+0x40/0x50 [ 93.789674][ T30] __kasan_slab_free+0x5c/0x80 [ 93.791616][ T30] kfree+0x1c5/0x640 [ 93.793203][ T30] vhci_hcd_remove+0x9e/0x110 [ 93.795132][ T30] device_release_driver_internal+0x48b/0x880 [ 93.797559][ T30] unbind_store+0x1a1/0x1d0 [ 93.799318][ T30] kernfs_fop_write_iter+0x3a4/0x540 [ 93.801508][ T30] vfs_write+0x612/0xba0 [ 93.803249][ T30] ksys_write+0x150/0x270 [ 93.805040][ T30] do_syscall_64+0x174/0x580 [ 93.806900][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.809285][ T30] [ 93.810309][ T30] Last potentially related work creation: [ 93.812568][ T30] kasan_save_stack+0x3e/0x60 [ 93.814489][ T30] kasan_record_aux_stack+0xbd/0xd0 [ 93.816619][ T30] insert_work+0x3d/0x330 [ 93.818409][ T30] __queue_work+0xcd8/0x10a0 [ 93.820317][ T30] queue_work_on+0x106/0x1d0 [ 93.822197][ T30] unlink1+0x344/0x3e0 [ 93.823815][ T30] usb_hcd_unlink_urb+0xe6/0x1e0 [ 93.825842][ T30] usb_kill_urb+0x10b/0x2f0 [ 93.827718][ T30] hub_quiesce+0x211/0x330 [ 93.829481][ T30] hub_suspend+0x904/0xad0 [ 93.831315][ T30] usb_suspend_both+0x285/0x1040 [ 93.833320][ T30] usb_runtime_suspend+0x58/0x110 [ 93.835407][ T30] __rpm_callback+0x2c7/0x950 [ 93.837337][ T30] rpm_suspend+0x8a0/0x17b0 [ 93.840227][ T30] __pm_runtime_suspend+0x12f/0x1a0 [ 93.842641][ T30] usb_new_device+0xadf/0x1620 [ 93.844615][ T30] register_root_hub+0x250/0x5c0 [ 93.846517][ T30] usb_add_hcd+0xac7/0xf80 [ 93.848167][ T30] vhci_hcd_probe+0x1fa/0x3e0 [ 93.850148][ T30] platform_probe+0xf9/0x190 [ 93.852018][ T30] really_probe+0x254/0xae0 [ 93.854091][ T30] __driver_probe_device+0x1e8/0x360 [ 93.856683][ T30] driver_probe_device+0x4f/0x240 [ 93.858681][ T30] __device_attach_driver+0x270/0x410 [ 93.860889][ T30] bus_for_each_drv+0x258/0x2f0 [ 93.862822][ T30] __device_attach+0x2c4/0x450 [ 93.864735][ T30] device_initial_probe+0xa1/0xd0 [ 93.866784][ T30] bus_probe_device+0x12a/0x220 [ 93.868796][ T30] device_add+0x7d7/0xb80 [ 93.870663][ T30] platform_device_add+0x4bd/0x860 [ 93.872747][ T30] platform_device_register_full+0x62d/0x710 [ 93.875173][ T30] vhci_hcd_init+0x227/0x360 [ 93.877125][ T30] do_one_initcall+0x250/0x870 [ 93.878925][ T30] do_initcall_level+0x10a/0x1a0 [ 93.881011][ T30] do_initcalls+0x59/0xa0 [ 93.882865][ T30] kernel_init_freeable+0x29d/0x3e0 [ 93.885046][ T30] kernel_init+0x1d/0x1d0 [ 93.886900][ T30] ret_from_fork+0x514/0xb70 [ 93.888860][ T30] ret_from_fork_asm+0x1a/0x30 [ 93.890864][ T30] [ 93.891896][ T30] Second to last potentially related work creation: [ 93.894592][ T30] kasan_save_stack+0x3e/0x60 [ 93.896553][ T30] kasan_record_aux_stack+0xbd/0xd0 [ 93.898686][ T30] insert_work+0x3d/0x330 [ 93.900441][ T30] __queue_work+0xcd8/0x10a0 [ 93.902258][ T30] queue_work_on+0x106/0x1d0 [ 93.904109][ T30] usb_hcd_submit_urb+0xa3b/0x1b60 [ 93.906168][ T30] usb_start_wait_urb+0x13f/0x5b0 [ 93.908158][ T30] usb_control_msg+0x234/0x3e0 [ 93.910060][ T30] hub_suspend+0x891/0xad0 [ 93.911895][ T30] usb_suspend_both+0x285/0x1040 [ 93.913922][ T30] usb_runtime_suspend+0x58/0x110 [ 93.915690][ T30] __rpm_callback+0x2c7/0x950 [ 93.917461][ T30] rpm_suspend+0x8a0/0x17b0 [ 93.919287][ T30] __pm_runtime_suspend+0x12f/0x1a0 [ 93.921441][ T30] usb_new_device+0xadf/0x1620 [ 93.923268][ T30] register_root_hub+0x250/0x5c0 [ 93.925305][ T30] usb_add_hcd+0xac7/0xf80 [ 93.927190][ T30] vhci_hcd_probe+0x1fa/0x3e0 [ 93.929156][ T30] platform_probe+0xf9/0x190 [ 93.931185][ T30] really_probe+0x254/0xae0 [ 93.933096][ T30] __driver_probe_device+0x1e8/0x360 [ 93.935236][ T30] driver_probe_device+0x4f/0x240 [ 93.937281][ T30] __device_attach_driver+0x270/0x410 [ 93.939423][ T30] bus_for_each_drv+0x258/0x2f0 [ 93.941336][ T30] __device_attach+0x2c4/0x450 [ 93.943205][ T30] device_initial_probe+0xa1/0xd0 [ 93.945152][ T30] bus_probe_device+0x12a/0x220 [ 93.947094][ T30] device_add+0x7d7/0xb80 [ 93.948761][ T30] platform_device_add+0x4bd/0x860 [ 93.950800][ T30] platform_device_register_full+0x62d/0x710 [ 93.952983][ T30] vhci_hcd_init+0x227/0x360 [ 93.954680][ T30] do_one_initcall+0x250/0x870 [ 93.956551][ T30] do_initcall_level+0x10a/0x1a0 [ 93.958441][ T30] do_initcalls+0x59/0xa0 [ 93.960176][ T30] kernel_init_freeable+0x29d/0x3e0 [ 93.962247][ T30] kernel_init+0x1d/0x1d0 [ 93.963966][ T30] ret_from_fork+0x514/0xb70 [ 93.965838][ T30] ret_from_fork_asm+0x1a/0x30 [ 93.967708][ T30] [ 93.968705][ T30] The buggy address belongs to the object at ffff888034d14000 [ 93.968705][ T30] which belongs to the cache kmalloc-8k of size 8192 [ 93.974034][ T30] The buggy address is located 1920 bytes inside of [ 93.974034][ T30] freed 8192-byte region [ffff888034d14000, ffff888034d16000) [ 93.979406][ T30] [ 93.980310][ T30] The buggy address belongs to the physical page: [ 93.982895][ T30] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34d10 [ 93.986249][ T30] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 93.989817][ T30] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 93.992889][ T30] page_type: f5(slab) [ 93.994650][ T30] raw: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 93.997927][ T30] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 94.001627][ T30] head: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 94.005259][ T30] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 94.008759][ T30] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 94.012745][ T30] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 94.017602][ T30] page dumped because: kasan: bad access detected [ 94.021141][ T30] page_owner tracks the page as allocated [ 94.023783][ T30] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 16129777114, free_ts 16095372787 [ 94.031993][ T30] post_alloc_hook+0x1f9/0x250 [ 94.034009][ T30] get_page_from_freelist+0x21fa/0x2270 [ 94.036263][ T30] __alloc_frozen_pages_noprof+0x18d/0x380 [ 94.038639][ T30] allocate_slab+0x79/0x5e0 [ 94.040564][ T30] refill_objects+0x2d5/0x350 [ 94.042534][ T30] __pcs_replace_empty_main+0x2bf/0x6b0 [ 94.044878][ T30] __kmalloc_noprof+0x485/0x720 [ 94.046981][ T30] __usb_create_hcd+0x67/0x900 [ 94.049009][ T30] vhci_hcd_probe+0x1e6/0x3e0 [ 94.050948][ T30] platform_probe+0xf9/0x190 [ 94.052937][ T30] really_probe+0x254/0xae0 [ 94.055273][ T30] __driver_probe_device+0x1e8/0x360 [ 94.057532][ T30] driver_probe_device+0x4f/0x240 [ 94.059676][ T30] __device_attach_driver+0x270/0x410 [ 94.061899][ T30] bus_for_each_drv+0x258/0x2f0 [ 94.063905][ T30] __device_attach+0x2c4/0x450 [ 94.065956][ T30] page last free pid 804 tgid 804 stack trace: [ 94.068519][ T30] __free_frozen_pages+0xc1e/0xd10 [ 94.070683][ T30] rcu_core+0x78b/0x10a0 [ 94.072430][ T30] handle_softirqs+0x225/0x840 [ 94.074443][ T30] __irq_exit_rcu+0xca/0x220 [ 94.076332][ T30] irq_exit_rcu+0x9/0x30 [ 94.078132][ T30] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 94.080547][ T30] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 94.082985][ T30] [ 94.084015][ T30] Memory state around the buggy address: [ 94.086294][ T30] ffff888034d14680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.089420][ T30] ffff888034d14700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.092630][ T30] >ffff888034d14780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.095851][ T30] ^ [ 94.097488][ T30] ffff888034d14800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.100560][ T30] ffff888034d14880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.103788][ T30] ================================================================== [ 94.143763][ T5331] vhci_hcd vhci_hcd.0: USB bus 6 deregistered