program:
syz_open_dev$evdev(&(0x7f00000000c0), 0x2000000003, 0x903d41)
syz_usb_connect(0x3, 0x63, &(0x7f0000000740)={{0x12, 0x1, 0x310, 0x78, 0xe8, 0x72, 0x20, 0x1f71, 0x3306, 0x2ac0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x51, 0x2, 0x3, 0x1, 0x80, 0x5, "", [{{0x9, 0x4, 0xdf, 0x0, 0x0, 0x46, 0x35, 0x34, 0xf}}, {{0x9, 0x4, 0x19, 0x6, 0x5, 0xfb, 0xdc, 0x42, 0x0, [], [{{0x9, 0x5, 0x80, 0x10, 0x200, 0x6, 0x6, 0x4, [@generic={0x9, 0x4, "df9b52d017dc73"}]}}, {{0x9, 0x5, 0xd, 0x0, 0x200, 0xaf, 0x2, 0x83}}, {{0x9, 0x5, 0x8b, 0x0, 0x20, 0x1, 0x8, 0x8}}, {{0x9, 0x5, 0x8, 0x0, 0x200, 0x8, 0x1b, 0x6}}, {{0x9, 0x5, 0xe, 0x1, 0x200, 0x3, 0x9, 0x40}}]}}]}}]}}, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0})
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="1201410130f56920ac05190272f00102030109021b00010000100009045507010349020009058203"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000340)=ANY=[@ANYBLOB='\x00N\b'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x40, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_open_dev$evdev(&(0x7f0000000000), 0x2, 0x0)
r1 = syz_usb_connect(0x2, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="03010000ac0fce405d0500904431000000010902120001000080040904"], 0x0)
syz_usb_disconnect(r1)
r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000cc0)=ANY=[], 0x0)
syz_usb_control_io$cdc_ecm(r2, &(0x7f0000000440)={0x14, &(0x7f0000000380)={0x0, 0x30, 0x2, {0x2, 0x7}}, &(0x7f0000000400)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000680)={0x1c, &(0x7f0000000480)={0x0, 0x1, 0xa3, "af63d59b864db2ae6716d5f9099892104325f3df6f0cb95267a65a44343f2d66af5bfad8556c29e3c3e9c83e4e90ff5c91a53fc240e842a4401df8967f65464913181287ad1950afa4eee53a7bc619d3011c55a8ed279dafb7d5e632736b620988e58aec4cad6cdddd0b0fd09f23ce7962e49769ec768e2d0091a1563c6534e38c0817998cafb23d40ad4f1af0af95bd2a2b6a304e913a24a93761931a7974d59d71c7"}, &(0x7f0000000540)={0x0, 0xa, 0x1, 0x5}, &(0x7f0000000640)={0x0, 0x8, 0x1, 0x3}})
syz_usb_control_io(r2, 0x0, 0x0)
syz_usb_control_io(r2, 0x0, 0x0)
syz_usb_control_io$uac1(r2, 0x0, &(0x7f0000001480)={0x44, &(0x7f0000001180)=ANY=[@ANYBLOB="000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r2, 0x0, 0x0)
syz_usb_control_io$uac1(r2, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0)
r3 = syz_open_dev$evdev(&(0x7f0000000040), 0x8000000000000000, 0x400000)
ioctl$EVIOCGPHYS(r3, 0x80404507, &(0x7f0000000240)=""/236)
syz_usb_control_io$printer(r2, 0x0, 0x0)
syz_usb_control_io$uac1(r2, 0x0, 0x0)
syz_usb_control_io$printer(r2, 0x0, 0x0)
syz_usb_control_io$uac1(r2, 0x0, 0x0)
[ 102.415336][ T5285] Bluetooth: hci0: command tx timeout
[ 102.736310][ T10] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 102.885616][ T10] usb 5-1: Using ep0 maxpacket: 32
[ 102.891085][ T10] usb 5-1: unable to get BOS descriptor or descriptor too short
[ 102.891131][ T10] usb 5-1: New USB device found, idVendor=1f71, idProduct=3306, bcdDevice=2a.c0
[ 102.892897][ T10] usb 5-1: config 3 has an invalid interface number: 223 but max is 1
[ 102.892910][ T10] usb 5-1: config 3 has an invalid interface number: 25 but max is 1
[ 102.892920][ T10] usb 5-1: config 3 has an invalid interface number: 223 but max is 1
[ 102.892929][ T10] usb 5-1: config 3 has no interface number 0
[ 102.892938][ T10] usb 5-1: config 3 has no interface number 1
[ 102.892998][ T10] usb 5-1: config 3 interface 25 altsetting 6 has an invalid descriptor for endpoint zero, skipping
[ 102.893017][ T10] usb 5-1: config 3 interface 25 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 5
[ 102.893030][ T10] usb 5-1: too many endpoints for config 3 interface 223 altsetting 155: 82, using maximum allowed: 30
[ 102.893052][ T10] usb 5-1: config 3 interface 223 altsetting 155 endpoint 0xD has invalid maxpacket 512, setting to 64
[ 102.893067][ T10] usb 5-1: config 3 interface 223 altsetting 155 endpoint 0x8 has invalid maxpacket 512, setting to 64
[ 102.893080][ T10] usb 5-1: config 3 interface 223 altsetting 155 has 4 endpoint descriptors, different from the interface descriptor's value: 82
[ 102.893092][ T10] usb 5-1: config 3 interface 223 has no altsetting 1
[ 102.893101][ T10] usb 5-1: config 3 interface 25 has no altsetting 0
[ 102.895328][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 102.895341][ T10] usb 5-1: Product: syz
[ 102.895349][ T10] usb 5-1: Manufacturer: syz
[ 102.895356][ T10] usb 5-1: SerialNumber: syz
[ 103.204997][ T5326] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 103.211223][ T5326] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 103.220604][ T5326] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 103.222086][ T5326] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 103.427579][ T5326] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 103.429083][ T5326] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 103.608753][ T10] usbtv 5-1:3.223: Fushicai USBTV007 Audio-Video Grabber
[ 103.621821][ T10] usb 5-1: USB disconnect, device number 2
[ 103.657365][ T10]
[ 103.658292][ T10] =========================
[ 103.659891][ T10] WARNING: held lock freed!
[ 103.661490][ T10] syzkaller #0 Not tainted
[ 103.663041][ T10] -------------------------
[ 103.664515][ T10] kworker/0:1/10 is freeing memory ffff88803ff81000-ffff88803ff817ff, with a lock still held there!
[ 103.668076][ T10] ffff88803ff811a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880
[ 103.671510][ T10] locks held by kworker/0:1/10: 5, last CPU#0:
[ 103.673612][ T10] #0: ffff88801d211140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
[ 103.677471][ T10] #1: ffffc9000023fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
[ 103.681891][ T10] #2: ffff88801fa3b1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30
[ 103.684932][ T10] #3: ffff88803dcbd1d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xfc/0x9a0
[ 103.688452][ T10] #4: ffff88803ff811a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880
[ 103.692408][ T10]
[ 103.692408][ T10] stack backtrace:
[ 103.694603][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full)
[ 103.697886][ T10] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 103.701707][ T10] Workqueue: usb_hub_wq hub_event
[ 103.704469][ T10] Call Trace:
[ 103.705798][ T10]
[ 103.706959][ T10] dump_stack_lvl+0xe8/0x150
[ 103.708722][ T10] debug_check_no_locks_freed+0x149/0x170
[ 103.710909][ T10] kfree+0x12b/0x650
[ 103.712393][ T10] ? device_release+0xc4/0x1f0
[ 103.714183][ T10] ? __pfx_usb_release_interface+0x10/0x10
[ 103.716440][ T10] device_release+0xc4/0x1f0
[ 103.718321][ T10] kobject_put+0x222/0x550
[ 103.720229][ T10] v4l2_device_disconnect+0x79/0xd0
[ 103.722467][ T10] usbtv_video_free+0x25/0x30
[ 103.724542][ T10] usbtv_disconnect+0x5c/0xa0
[ 103.726644][ T10] usb_unbind_interface+0x295/0x9f0
[ 103.728936][ T10] ? kernfs_remove_by_name_ns+0x101/0x140
[ 103.731391][ T10] ? kernfs_remove_by_name_ns+0x101/0x140
[ 103.733803][ T10] ? __pfx_usb_unbind_interface+0x10/0x10
[ 103.736250][ T10] device_release_driver_internal+0x4f5/0x880
[ 103.738879][ T10] bus_remove_device+0x444/0x560
[ 103.741018][ T10] ? __pfx_bus_remove_device+0x10/0x10
[ 103.743323][ T10] ? kernfs_remove_by_name_ns+0x101/0x140
[ 103.745747][ T10] device_del+0x524/0x8f0
[ 103.747699][ T10] ? __pfx_device_del+0x10/0x10
[ 103.749875][ T10] ? __pfx___mutex_lock+0x10/0x10
[ 103.752180][ T10] usb_disable_device+0x3d4/0x8d0
[ 103.754374][ T10] usb_disconnect+0x346/0x9a0
[ 103.756405][ T10] hub_event+0x1bbb/0x4d30
[ 103.758380][ T10] ? do_raw_spin_unlock+0x4d/0x200
[ 103.760657][ T10] ? register_lock_class+0x31/0x2e0
[ 103.762983][ T10] ? __pfx_hub_event+0x10/0x10
[ 103.765126][ T10] ? rcu_is_watching+0x16/0xb0
[ 103.767318][ T10] ? process_scheduled_works+0x97a/0x1630
[ 103.769775][ T10] process_scheduled_works+0xc3d/0x1630
[ 103.772162][ T10] ? __pfx_process_scheduled_works+0x10/0x10
[ 103.774839][ T10] ? assign_work+0x3cf/0x5d0
[ 103.776910][ T10] worker_thread+0xa47/0xfb0
[ 103.778856][ T10] ? __kthread_parkme+0x71/0x1f0
[ 103.781080][ T10] kthread+0x38b/0x480
[ 103.782897][ T10] ? __pfx_worker_thread+0x10/0x10
[ 103.785006][ T10] ? __pfx_kthread+0x10/0x10
[ 103.786842][ T10] ret_from_fork+0x514/0xb70
[ 103.788689][ T10] ? __pfx_ret_from_fork+0x10/0x10
[ 103.790636][ T10] ? __switch_to+0xc89/0x1420
[ 103.792450][ T10] ? __pfx_kthread+0x10/0x10
[ 103.794201][ T10] ret_from_fork_asm+0x1a/0x30
[ 103.796039][ T10]
[ 103.800778][ T10] ==================================================================
[ 103.800785][ T10] BUG: KASAN: slab-use-after-free in usb_unbind_interface+0x2c2/0x9f0
[ 103.800796][ T10] Read of size 8 at addr ffff88803ff81008 by task kworker/0:1/10
[ 103.800802][ T10]
[ 103.800807][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full)
[ 103.800815][ T10] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 103.800820][ T10] Workqueue: usb_hub_wq hub_event
[ 103.800829][ T10] Call Trace:
[ 103.800832][ T10]
[ 103.800835][ T10] dump_stack_lvl+0xe8/0x150
[ 103.800846][ T10] print_address_description+0x55/0x1e0
[ 103.800855][ T10] ? usb_unbind_interface+0x2c2/0x9f0
[ 103.800862][ T10] print_report+0x58/0x70
[ 103.800870][ T10] kasan_report+0x117/0x150
[ 103.800878][ T10] ? usb_unbind_interface+0x2c2/0x9f0
[ 103.800886][ T10] usb_unbind_interface+0x2c2/0x9f0
[ 103.800893][ T10] ? kernfs_remove_by_name_ns+0x101/0x140
[ 103.800901][ T10] ? kernfs_remove_by_name_ns+0x101/0x140
[ 103.800908][ T10] ? __pfx_usb_unbind_interface+0x10/0x10
[ 103.800915][ T10] device_release_driver_internal+0x4f5/0x880
[ 103.800924][ T10] bus_remove_device+0x444/0x560
[ 103.800950][ T10] ? __pfx_bus_remove_device+0x10/0x10
[ 103.800959][ T10] ? kernfs_remove_by_name_ns+0x101/0x140
[ 103.800966][ T10] device_del+0x524/0x8f0
[ 103.800973][ T10] ? __pfx_device_del+0x10/0x10
[ 103.800983][ T10] ? __pfx___mutex_lock+0x10/0x10
[ 103.800993][ T10] usb_disable_device+0x3d4/0x8d0
[ 103.801001][ T10] usb_disconnect+0x346/0x9a0
[ 103.801012][ T10] hub_event+0x1bbb/0x4d30
[ 103.801018][ T10] ? do_raw_spin_unlock+0x4d/0x200
[ 103.801029][ T10] ? register_lock_class+0x31/0x2e0
[ 103.801040][ T10] ? __pfx_hub_event+0x10/0x10
[ 103.801047][ T10] ? rcu_is_watching+0x16/0xb0
[ 103.801058][ T10] ? process_scheduled_works+0x97a/0x1630
[ 103.801067][ T10] process_scheduled_works+0xc3d/0x1630
[ 103.801079][ T10] ? __pfx_process_scheduled_works+0x10/0x10
[ 103.801088][ T10] ? assign_work+0x3cf/0x5d0
[ 103.801097][ T10] worker_thread+0xa47/0xfb0
[ 103.801107][ T10] ? __kthread_parkme+0x71/0x1f0
[ 103.801118][ T10] kthread+0x38b/0x480
[ 103.801124][ T10] ? __pfx_worker_thread+0x10/0x10
[ 103.801132][ T10] ? __pfx_kthread+0x10/0x10
[ 103.801139][ T10] ret_from_fork+0x514/0xb70
[ 103.801146][ T10] ? __pfx_ret_from_fork+0x10/0x10
[ 103.801152][ T10] ? __switch_to+0xc89/0x1420
[ 103.801161][ T10] ? __pfx_kthread+0x10/0x10
[ 103.801168][ T10] ret_from_fork_asm+0x1a/0x30
[ 103.801179][ T10]
[ 103.801182][ T10]
[ 103.801184][ T10] Allocated by task 10:
[ 103.801188][ T10] kasan_save_track+0x3e/0x80
[ 103.801197][ T10] __kasan_kmalloc+0x93/0xb0
[ 103.801203][ T10] __kmalloc_cache_noprof+0x321/0x600
[ 103.801212][ T10] usb_set_configuration+0x3cc/0x2180
[ 103.801218][ T10] usb_generic_driver_probe+0x8d/0x150
[ 103.801225][ T10] usb_probe_device+0x1c3/0x3b0
[ 103.801231][ T10] really_probe+0x254/0xae0
[ 103.801237][ T10] __driver_probe_device+0x1e8/0x360
[ 103.801243][ T10] driver_probe_device+0x4f/0x240
[ 103.801249][ T10] __device_attach_driver+0x270/0x410
[ 103.801255][ T10] bus_for_each_drv+0x258/0x2f0
[ 103.801264][ T10] __device_attach+0x2c4/0x450
[ 103.801272][ T10] device_initial_probe+0xa1/0xd0
[ 103.801279][ T10] bus_probe_device+0x12a/0x220
[ 103.801288][ T10] device_add+0x7d7/0xb80
[ 103.801296][ T10] usb_new_device+0x9aa/0x1690
[ 103.801305][ T10] hub_event+0x28e8/0x4d30
[ 103.801310][ T10] process_scheduled_works+0xc3d/0x1630
[ 103.801318][ T10] worker_thread+0xa47/0xfb0
[ 103.801326][ T10] kthread+0x38b/0x480
[ 103.801331][ T10] ret_from_fork+0x514/0xb70
[ 103.801336][ T10] ret_from_fork_asm+0x1a/0x30
[ 103.801345][ T10]
[ 103.801346][ T10] Freed by task 10:
[ 103.801349][ T10] kasan_save_track+0x3e/0x80
[ 103.801358][ T10] kasan_save_free_info+0x40/0x50
[ 103.801365][ T10] __kasan_slab_free+0x5c/0x80
[ 103.801370][ T10] kfree+0x1c5/0x650
[ 103.801378][ T10] device_release+0xc4/0x1f0
[ 103.801384][ T10] kobject_put+0x222/0x550
[ 103.801392][ T10] v4l2_device_disconnect+0x79/0xd0
[ 103.801400][ T10] usbtv_video_free+0x25/0x30
[ 103.801407][ T10] usbtv_disconnect+0x5c/0xa0
[ 103.801416][ T10] usb_unbind_interface+0x295/0x9f0
[ 103.801425][ T10] device_release_driver_internal+0x4f5/0x880
[ 103.801431][ T10] bus_remove_device+0x444/0x560
[ 103.801438][ T10] device_del+0x524/0x8f0
[ 103.801443][ T10] usb_disable_device+0x3d4/0x8d0
[ 103.801449][ T10] usb_disconnect+0x346/0x9a0
[ 103.801457][ T10] hub_event+0x1bbb/0x4d30
[ 103.801463][ T10] process_scheduled_works+0xc3d/0x1630
[ 103.801470][ T10] worker_thread+0xa47/0xfb0
[ 103.801478][ T10] kthread+0x38b/0x480
[ 103.801483][ T10] ret_from_fork+0x514/0xb70
[ 103.801488][ T10] ret_from_fork_asm+0x1a/0x30
[ 103.801497][ T10]
[ 103.801499][ T10] The buggy address belongs to the object at ffff88803ff81000
[ 103.801499][ T10] which belongs to the cache kmalloc-2k of size 2048
[ 103.801504][ T10] The buggy address is located 8 bytes inside of
[ 103.801504][ T10] freed 2048-byte region [ffff88803ff81000, ffff88803ff81800)
[ 103.801511][ T10]
[ 103.801513][ T10] The buggy address belongs to the physical page:
[ 103.801517][ T10] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803ff86000 pfn:0x3ff80
[ 103.801525][ T10] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 103.801530][ T10] flags: 0x4fff00000000240(workingset|head|node=1|zone=1|lastcpupid=0x7ff)
[ 103.801538][ T10] page_type: f5(slab)
[ 103.801545][ T10] raw: 04fff00000000240 ffff88801b042000 ffffea0000faf810 ffffea0000dca210
[ 103.801550][ T10] raw: ffff88803ff86000 0000000000080006 00000000f5000000 0000000000000000
[ 103.801562][ T10] head: 04fff00000000240 ffff88801b042000 ffffea0000faf810 ffffea0000dca210
[ 103.801567][ T10] head: ffff88803ff86000 0000000000080006 00000000f5000000 0000000000000000
[ 103.801573][ T10] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 103.801578][ T10] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 103.801581][ T10] page dumped because: kasan: bad access detected
[ 103.801584][ T10] page_owner tracks the page as allocated
[ 103.801587][ T10] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2000(__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 10, tgid 10 (kworker/0:1), ts 102998495270
[ 103.801598][ T10] post_alloc_hook+0x1f9/0x250
[ 103.801607][ T10] get_page_from_freelist+0x2209/0x2280
[ 103.801616][ T10] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 103.801625][ T10] allocate_slab+0x7d/0x620
[ 103.801631][ T10] refill_objects+0x2d5/0x350
[ 103.801638][ T10] __pcs_replace_empty_main+0x2c8/0x6c0
[ 103.801644][ T10] __kmalloc_cache_noprof+0x39b/0x600
[ 103.801653][ T10] usb_set_configuration+0x3cc/0x2180
[ 103.801659][ T10] usb_generic_driver_probe+0x8d/0x150
[ 103.801665][ T10] usb_probe_device+0x1c3/0x3b0
[ 103.801671][ T10] really_probe+0x254/0xae0
[ 103.801677][ T10] __driver_probe_device+0x1e8/0x360
[ 103.801683][ T10] driver_probe_device+0x4f/0x240
[ 103.801689][ T10] __device_attach_driver+0x270/0x410
[ 103.801695][ T10] bus_for_each_drv+0x258/0x2f0
[ 103.801703][ T10] __device_attach+0x2c4/0x450
[ 103.801708][ T10] page last free pid 5278 tgid 5278 ts 102993400462 stack trace:
[ 103.801713][ T10] __free_frozen_pages+0xc93/0xd90
[ 103.801723][ T10] __slab_free+0x274/0x2c0
[ 103.801734][ T10] qlist_free_all+0x99/0x100
[ 103.801742][ T10] kasan_quarantine_reduce+0x148/0x160
[ 103.801751][ T10] __kasan_slab_alloc+0x22/0x80
[ 103.801756][ T10] kmem_cache_alloc_lru_noprof+0x2a3/0x5f0
[ 103.801764][ T10] shmem_alloc_inode+0x28/0x40
[ 103.801773][ T10] alloc_inode+0x6a/0x1b0
[ 103.801779][ T10] new_inode+0x1f/0x170
[ 103.801785][ T10] shmem_get_inode+0x3a4/0xfe0
[ 103.801793][ T10] shmem_mknod+0x17d/0x340
[ 103.801801][ T10] lookup_open+0xc0d/0x1a40
[ 103.801809][ T10] path_openat+0x677/0x1d60
[ 103.801817][ T10] do_file_open+0x23e/0x4a0
[ 103.801825][ T10] do_sys_openat2+0x115/0x200
[ 103.801831][ T10] __x64_sys_openat+0x138/0x170
[ 103.801837][ T10]
[ 103.801839][ T10] Memory state around the buggy address:
[ 103.801842][ T10] ffff88803ff80f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 103.801847][ T10] ffff88803ff80f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 103.801851][ T10] >ffff88803ff81000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 103.801854][ T10] ^
[ 103.801857][ T10] ffff88803ff81080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 103.801862][ T10] ffff88803ff81100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 103.801865][ T10] ==================================================================
[ 103.801905][ T10] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 104.127792][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full)
[ 104.131789][ T10] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 104.135528][ T10] Workqueue: usb_hub_wq hub_event
[ 104.137233][ T10] Call Trace:
[ 104.138458][ T10]
[ 104.139513][ T10] vpanic+0x56d/0xa60
[ 104.141089][ T10] ? rcu_is_watching+0x16/0xb0
[ 104.142985][ T10] ? __pfx_vpanic+0x10/0x10
[ 104.144701][ T10] ? __pfx___schedule+0x10/0x10
[ 104.146490][ T10] panic+0xc5/0xd0
[ 104.147998][ T10] ? __pfx_panic+0x10/0x10
[ 104.149668][ T10] ? preempt_schedule_thunk+0x16/0x40
[ 104.151602][ T10] ? usb_unbind_interface+0x2c2/0x9f0
[ 104.153514][ T10] check_panic_on_warn+0x89/0xb0
[ 104.155447][ T10] ? usb_unbind_interface+0x2c2/0x9f0
[ 104.157488][ T10] end_report+0x73/0x170
[ 104.159121][ T10] ? usb_unbind_interface+0x2c2/0x9f0
[ 104.161120][ T10] kasan_report+0x128/0x150
[ 104.162817][ T10] ? usb_unbind_interface+0x2c2/0x9f0
[ 104.164872][ T10] usb_unbind_interface+0x2c2/0x9f0
[ 104.166865][ T10] ? kernfs_remove_by_name_ns+0x101/0x140
[ 104.169063][ T10] ? kernfs_remove_by_name_ns+0x101/0x140
[ 104.171345][ T10] ? __pfx_usb_unbind_interface+0x10/0x10
[ 104.173543][ T10] device_release_driver_internal+0x4f5/0x880
[ 104.175926][ T10] bus_remove_device+0x444/0x560
[ 104.177844][ T10] ? __pfx_bus_remove_device+0x10/0x10
[ 104.179874][ T10] ? kernfs_remove_by_name_ns+0x101/0x140
[ 104.182323][ T10] device_del+0x524/0x8f0
[ 104.184281][ T10] ? __pfx_device_del+0x10/0x10
[ 104.186511][ T10] ? __pfx___mutex_lock+0x10/0x10
[ 104.188796][ T10] usb_disable_device+0x3d4/0x8d0
[ 104.191123][ T10] usb_disconnect+0x346/0x9a0
[ 104.193246][ T10] hub_event+0x1bbb/0x4d30
[ 104.195299][ T10] ? do_raw_spin_unlock+0x4d/0x200
[ 104.197600][ T10] ? register_lock_class+0x31/0x2e0
[ 104.199955][ T10] ? __pfx_hub_event+0x10/0x10
[ 104.201960][ T10] ? rcu_is_watching+0x16/0xb0
[ 104.203955][ T10] ? process_scheduled_works+0x97a/0x1630
[ 104.206340][ T10] process_scheduled_works+0xc3d/0x1630
[ 104.208635][ T10] ? __pfx_process_scheduled_works+0x10/0x10
[ 104.211047][ T10] ? assign_work+0x3cf/0x5d0
[ 104.212947][ T10] worker_thread+0xa47/0xfb0
[ 104.214874][ T10] ? __kthread_parkme+0x71/0x1f0
[ 104.216920][ T10] kthread+0x38b/0x480
[ 104.218626][ T10] ? __pfx_worker_thread+0x10/0x10
[ 104.220703][ T10] ? __pfx_kthread+0x10/0x10
[ 104.222503][ T10] ret_from_fork+0x514/0xb70
[ 104.224351][ T10] ? __pfx_ret_from_fork+0x10/0x10
[ 104.226533][ T10] ? __switch_to+0xc89/0x1420
[ 104.228567][ T10] ? __pfx_kthread+0x10/0x10
[ 104.230542][ T10] ret_from_fork_asm+0x1a/0x30
[ 104.232655][ T10]
[ 104.234438][ T10] Kernel Offset: disabled
[ 104.236293][ T10] Rebooting in 86400 seconds..