program: pipe(&(0x7f00000000c0)={0xffffffffffffffff}) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0) removexattr(&(0x7f0000000240)='./file1\x00', &(0x7f0000000280)=@known='system.posix_acl_access\x00') r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) splice(r0, 0x0, r1, 0x0, 0x4ffe6, 0x0) sendmsg$nl_route(r0, 0x0, 0x40) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x0) syz_mount_image$cramfs(&(0x7f0000000080), &(0x7f0000000000)='./file1\x00', 0x210080, &(0x7f00000006c0)=ANY=[@ANYRES16=0x0], 0x1, 0x14a, &(0x7f00000004c0)="$eJzszz9LanEYwPHv8fjneq9ehesF7x0qaOiQiMcjtkVoFAnZgcKlIYI8QaApCuFYQVtDL8ChEprEIRobyloshbDXITQEjcXxCGU0Nf8+y+F8n4cHfnPTHQU/yFhmC/liySiXjezYsp6eXzm/uPxtdhfwo7+RL5bM5ay1f5UAh/m1Q2/Pyjde9+BaIWf+9xKgAMlfsLnlQMXa/Wm2gNlyRnTQlHFo/rWa9kWLDdp/OyR9VjPvvZ7ABGDj/d4zUKmGGvW7pXYrFZ48W5M5SIVG/0jDfcQ41Nz/ap6gTMa4Pe0/s1J9jLTCD5FGvdtppxf1tN6JadpUTI2qaryr37dT8d0j7AueHVj9dM/pBDKwL0FVgnp/3ruWvEDz+EXP+1wB4GnbD9LHCQxPNtaDjtpMwG9DVpAQBEEQBEEQBEEQhG96CwAA//9MKGWM") r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000400)='/sys/power/resume', 0x149a82, 0x0) write$cgroup_int(r4, &(0x7f0000000040)=0x1f00, 0x12) close(0x3) pipe(&(0x7f00000000c0)) (async) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0) (async) removexattr(&(0x7f0000000240)='./file1\x00', &(0x7f0000000280)=@known='system.posix_acl_access\x00') (async) socket$inet_udp(0x2, 0x2, 0x0) (async) close(r1) (async) splice(r0, 0x0, r1, 0x0, 0x4ffe6, 0x0) (async) sendmsg$nl_route(r0, 0x0, 0x40) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) (async) write(r2, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa) (async) openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0) (async) write(r3, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa) (async) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x0) (async) syz_mount_image$cramfs(&(0x7f0000000080), &(0x7f0000000000)='./file1\x00', 0x210080, &(0x7f00000006c0)=ANY=[@ANYRES16=0x0], 0x1, 0x14a, &(0x7f00000004c0)="$eJzszz9LanEYwPHv8fjneq9ehesF7x0qaOiQiMcjtkVoFAnZgcKlIYI8QaApCuFYQVtDL8ChEprEIRobyloshbDXITQEjcXxCGU0Nf8+y+F8n4cHfnPTHQU/yFhmC/liySiXjezYsp6eXzm/uPxtdhfwo7+RL5bM5ay1f5UAh/m1Q2/Pyjde9+BaIWf+9xKgAMlfsLnlQMXa/Wm2gNlyRnTQlHFo/rWa9kWLDdp/OyR9VjPvvZ7ABGDj/d4zUKmGGvW7pXYrFZ48W5M5SIVG/0jDfcQ41Nz/ap6gTMa4Pe0/s1J9jLTCD5FGvdtppxf1tN6JadpUTI2qaryr37dT8d0j7AueHVj9dM/pBDKwL0FVgnp/3ruWvEDz+EXP+1wB4GnbD9LHCQxPNtaDjtpMwG9DVpAQBEEQBEEQBEEQhG96CwAA//9MKGWM") (async) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000400)='/sys/power/resume', 0x149a82, 0x0) (async) write$cgroup_int(r4, &(0x7f0000000040)=0x1f00, 0x12) (async) close(0x3) (async) [ 93.787200][ T5290] Bluetooth: hci0: command tx timeout [ 93.872941][ T5328] vhci_hcd vhci_hcd.0: remove, state 4 [ 93.893562][ T5328] usb usb7: USB disconnect, device number 1 [ 94.056019][ T5330] loop0: detected capacity change from 0 to 8 [ 94.323493][ T5330] MTD: Attempt to mount non-MTD device "/dev/loop0" qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0xb6000) [ 94.421416][ T1029] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1 [ 94.433913][ T1029] ata1: failed to read log page 10h (errno=-5) [ 94.441285][ T1029] ata1.00: exception Emask 0x1 SAct 0x4000 SErr 0x0 action 0x0 [ 94.451865][ T1029] ata1.00: irq_stat 0x41000008 [ 94.457968][ T1029] ata1.00: failed command: WRITE FPDMA QUEUED [ 94.465855][ T1029] ata1.00: cmd 61/b0:70:6e:13:08/05:00:00:00:00/40 tag 14 ncq dma 745472 out [ 94.465855][ T1029] res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error) [ 94.488180][ T1029] ata1.00: status: { DRDY } [ 94.502503][ T1029] ata1.00: error: { ABRT } [ 94.509053][ T1029] ata1.00: configured for UDMA/100 [ 94.516727][ T1029] ata1: EH complete [ 94.538959][ T5287] udevd[5287]: incorrect cramfs checksum on /dev/loop0 [ 94.621964][ T1060] vhci_hcd vhci_hcd.0: stop threads [ 94.632391][ T5328] vhci_hcd vhci_hcd.0: USB bus 7 deregistered [ 94.639790][ T1060] vhci_hcd vhci_hcd.0: release socket [ 94.651912][ T1060] vhci_hcd vhci_hcd.0: disconnect device [ 94.670208][ T1060] vhci_hcd vhci_hcd.0: stop threads [ 94.686006][ T1060] vhci_hcd vhci_hcd.0: release socket [ 94.698283][ T5328] vhci_hcd vhci_hcd.0: remove, state 4 [ 94.702945][ T1060] ================================================================== [ 94.706674][ T1060] BUG: KASAN: slab-use-after-free in vhci_cleanup_unlink_list+0x452/0x460 [ 94.710400][ T1060] Read of size 4 at addr ffff8880349e46a0 by task kworker/u4:8/1060 [ 94.714099][ T1060] [ 94.715173][ T1060] CPU: 0 UID: 0 PID: 1060 Comm: kworker/u4:8 Not tainted syzkaller #0 PREEMPT(full) [ 94.715189][ T1060] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.715197][ T1060] Workqueue: usbip_event event_handler [ 94.715218][ T1060] Call Trace: [ 94.715225][ T1060] [ 94.715231][ T1060] dump_stack_lvl+0xe8/0x150 [ 94.715248][ T1060] print_address_description+0x55/0x1e0 [ 94.715263][ T1060] ? vhci_cleanup_unlink_list+0x452/0x460 [ 94.715276][ T1060] print_report+0x58/0x70 [ 94.715289][ T1060] kasan_report+0x117/0x150 [ 94.715306][ T1060] ? vhci_cleanup_unlink_list+0x452/0x460 [ 94.715322][ T1060] vhci_cleanup_unlink_list+0x452/0x460 [ 94.715335][ T1060] ? kasan_quarantine_put+0xbb/0x1f0 [ 94.715351][ T1060] vhci_shutdown_connection+0x2af/0x650 [ 94.715364][ T1060] event_handler+0x2a4/0x4b0 [ 94.715384][ T1060] ? process_scheduled_works+0xa20/0x14e0 [ 94.715396][ T1060] process_scheduled_works+0xa8e/0x14e0 [ 94.715415][ T1060] ? __pfx_process_scheduled_works+0x10/0x10 [ 94.715428][ T1060] ? assign_work+0x3cf/0x5d0 [ 94.715439][ T1060] worker_thread+0xa47/0xfb0 [ 94.715456][ T1060] ? __kthread_parkme+0x71/0x1f0 [ 94.715470][ T1060] kthread+0x388/0x470 [ 94.715485][ T1060] ? __pfx_worker_thread+0x10/0x10 [ 94.715498][ T1060] ? __pfx_kthread+0x10/0x10 [ 94.715512][ T1060] ret_from_fork+0x514/0xb70 [ 94.715527][ T1060] ? __pfx_ret_from_fork+0x10/0x10 [ 94.715542][ T1060] ? __switch_to+0xc89/0x1420 [ 94.715555][ T1060] ? __pfx_kthread+0x10/0x10 [ 94.715569][ T1060] ret_from_fork_asm+0x1a/0x30 [ 94.715584][ T1060] [ 94.715588][ T1060] [ 94.790337][ T1060] Allocated by task 1: [ 94.792341][ T1060] kasan_save_track+0x3e/0x80 [ 94.794567][ T1060] __kasan_kmalloc+0x93/0xb0 [ 94.797345][ T1060] __kmalloc_noprof+0x375/0x720 [ 94.800605][ T1060] __usb_create_hcd+0x67/0x900 [ 94.803788][ T1060] vhci_hcd_probe+0x1e6/0x3e0 [ 94.806462][ T1060] platform_probe+0xf9/0x190 [ 94.808787][ T1060] really_probe+0x254/0xae0 [ 94.811252][ T1060] __driver_probe_device+0x1e8/0x360 [ 94.814514][ T1060] driver_probe_device+0x4f/0x240 [ 94.817704][ T1060] __device_attach_driver+0x270/0x410 [ 94.820407][ T1060] bus_for_each_drv+0x258/0x2f0 [ 94.822733][ T1060] __device_attach+0x2c4/0x450 [ 94.825304][ T1060] device_initial_probe+0xa1/0xd0 [ 94.828640][ T1060] bus_probe_device+0x12a/0x220 [ 94.831478][ T1060] device_add+0x7d7/0xb80 [ 94.833658][ T1060] platform_device_add+0x4bd/0x860 [ 94.836505][ T1060] platform_device_register_full+0x62d/0x710 [ 94.839904][ T1060] vhci_hcd_init+0x227/0x360 [ 94.842942][ T1060] do_one_initcall+0x250/0x870 [ 94.845568][ T1060] do_initcall_level+0x10a/0x1a0 [ 94.847951][ T1060] do_initcalls+0x59/0xa0 [ 94.850080][ T1060] kernel_init_freeable+0x29d/0x3e0 [ 94.853015][ T1060] kernel_init+0x1d/0x1d0 [ 94.855747][ T1060] ret_from_fork+0x514/0xb70 [ 94.858470][ T1060] ret_from_fork_asm+0x1a/0x30 [ 94.860944][ T1060] [ 94.862217][ T1060] Freed by task 5328: [ 94.864521][ T1060] kasan_save_track+0x3e/0x80 [ 94.867347][ T1060] kasan_save_free_info+0x40/0x50 [ 94.870290][ T1060] __kasan_slab_free+0x5c/0x80 [ 94.872829][ T1060] kfree+0x1c5/0x640 [ 94.874709][ T1060] vhci_hcd_remove+0x9e/0x110 [ 94.877244][ T1060] device_release_driver_internal+0x48b/0x880 [ 94.880835][ T1060] unbind_store+0x1a1/0x1d0 [ 94.883415][ T1060] kernfs_fop_write_iter+0x3a4/0x540 [ 94.886119][ T1060] vfs_write+0x612/0xba0 [ 94.888350][ T1060] ksys_write+0x150/0x270 [ 94.890835][ T1060] do_syscall_64+0x174/0x580 [ 94.893470][ T1060] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.896377][ T1060] [ 94.897437][ T1060] Last potentially related work creation: [ 94.899789][ T1060] kasan_save_stack+0x3e/0x60 [ 94.901898][ T1060] kasan_record_aux_stack+0xbd/0xd0 [ 94.904613][ T1060] insert_work+0x3d/0x330 [ 94.906988][ T1060] __queue_work+0xcd8/0x10a0 [ 94.909409][ T1060] queue_work_on+0x106/0x1d0 [ 94.911522][ T1060] unlink1+0x344/0x3e0 [ 94.913204][ T1060] usb_hcd_unlink_urb+0xe6/0x1e0 [ 94.915268][ T1060] usb_kill_urb+0x10b/0x2f0 [ 94.917490][ T1060] hub_quiesce+0x211/0x330 [ 94.919670][ T1060] hub_suspend+0x904/0xad0 [ 94.922014][ T1060] usb_suspend_both+0x285/0x1040 [ 94.924335][ T1060] usb_runtime_suspend+0x58/0x110 [ 94.926790][ T1060] __rpm_callback+0x2c7/0x950 [ 94.928757][ T1060] rpm_suspend+0x8a0/0x17b0 [ 94.930638][ T1060] __pm_runtime_suspend+0x12f/0x1a0 [ 94.932854][ T1060] usb_runtime_idle+0x76/0x90 [ 94.934966][ T1060] rpm_idle+0x5b4/0x980 [ 94.936859][ T1060] pm_runtime_work+0x11e/0x1b0 [ 94.939161][ T1060] process_scheduled_works+0xa8e/0x14e0 [ 94.941915][ T1060] worker_thread+0xa47/0xfb0 [ 94.944151][ T1060] kthread+0x388/0x470 [ 94.946245][ T1060] ret_from_fork+0x514/0xb70 [ 94.948413][ T1060] ret_from_fork_asm+0x1a/0x30 [ 94.950818][ T1060] [ 94.952094][ T1060] Second to last potentially related work creation: [ 94.955165][ T1060] kasan_save_stack+0x3e/0x60 [ 94.957360][ T1060] kasan_record_aux_stack+0xbd/0xd0 [ 94.959736][ T1060] insert_work+0x3d/0x330 [ 94.961750][ T1060] __queue_work+0xcd8/0x10a0 [ 94.963886][ T1060] queue_work_on+0x106/0x1d0 [ 94.966101][ T1060] usb_hcd_submit_urb+0xa3b/0x1b60 [ 94.968483][ T1060] usb_start_wait_urb+0x13f/0x5b0 [ 94.970810][ T1060] usb_control_msg+0x234/0x3e0 [ 94.972972][ T1060] hub_suspend+0x891/0xad0 [ 94.974867][ T1060] usb_suspend_both+0x285/0x1040 [ 94.977246][ T1060] usb_runtime_suspend+0x58/0x110 [ 94.979794][ T1060] __rpm_callback+0x2c7/0x950 [ 94.982658][ T1060] rpm_suspend+0x8a0/0x17b0 [ 94.984942][ T1060] __pm_runtime_suspend+0x12f/0x1a0 [ 94.987149][ T1060] usb_runtime_idle+0x76/0x90 [ 94.989081][ T1060] rpm_idle+0x5b4/0x980 [ 94.990959][ T1060] pm_runtime_work+0x11e/0x1b0 [ 94.993586][ T1060] process_scheduled_works+0xa8e/0x14e0 [ 94.996704][ T1060] worker_thread+0xa47/0xfb0 [ 94.998898][ T1060] kthread+0x388/0x470 [ 95.000902][ T1060] ret_from_fork+0x514/0xb70 [ 95.003101][ T1060] ret_from_fork_asm+0x1a/0x30 [ 95.005708][ T1060] [ 95.007083][ T1060] The buggy address belongs to the object at ffff8880349e4000 [ 95.007083][ T1060] which belongs to the cache kmalloc-8k of size 8192 [ 95.014273][ T1060] The buggy address is located 1696 bytes inside of [ 95.014273][ T1060] freed 8192-byte region [ffff8880349e4000, ffff8880349e6000) [ 95.021838][ T1060] [ 95.023079][ T1060] The buggy address belongs to the physical page: [ 95.026378][ T1060] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x349e0 [ 95.030521][ T1060] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 95.034920][ T1060] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 95.038737][ T1060] page_type: f5(slab) [ 95.040887][ T1060] raw: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 95.045992][ T1060] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 95.050089][ T1060] head: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 95.054911][ T1060] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 95.059818][ T1060] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 95.064182][ T1060] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 95.068827][ T1060] page dumped because: kasan: bad access detected [ 95.072217][ T1060] page_owner tracks the page as allocated [ 95.075098][ T1060] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 16838769460, free_ts 16758563156 [ 95.085632][ T1060] post_alloc_hook+0x1f9/0x250 [ 95.087944][ T1060] get_page_from_freelist+0x21fa/0x2270 [ 95.090602][ T1060] __alloc_frozen_pages_noprof+0x18d/0x380 [ 95.093569][ T1060] allocate_slab+0x79/0x5e0 [ 95.095737][ T1060] refill_objects+0x2d5/0x350 [ 95.097833][ T1060] __pcs_replace_empty_main+0x2bf/0x6b0 [ 95.100228][ T1060] __kmalloc_noprof+0x485/0x720 [ 95.102304][ T1060] __usb_create_hcd+0x67/0x900 [ 95.104373][ T1060] vhci_hcd_probe+0x1e6/0x3e0 [ 95.106413][ T1060] platform_probe+0xf9/0x190 [ 95.108398][ T1060] really_probe+0x254/0xae0 [ 95.110475][ T1060] __driver_probe_device+0x1e8/0x360 [ 95.112791][ T1060] driver_probe_device+0x4f/0x240 [ 95.115010][ T1060] __device_attach_driver+0x270/0x410 [ 95.117479][ T1060] bus_for_each_drv+0x258/0x2f0 [ 95.119861][ T1060] __device_attach+0x2c4/0x450 [ 95.122232][ T1060] page last free pid 1 tgid 1 stack trace: [ 95.124976][ T1060] __free_frozen_pages+0xc1e/0xd10 [ 95.127323][ T1060] __slab_free+0x274/0x2c0 [ 95.129384][ T1060] qlist_free_all+0x99/0x100 [ 95.131546][ T1060] kasan_quarantine_reduce+0x148/0x160 [ 95.134420][ T1060] __kasan_slab_alloc+0x22/0x80 [ 95.137731][ T1060] __kmalloc_node_track_caller_noprof+0x461/0x730 [ 95.141127][ T1060] kstrdup+0x42/0x100 [ 95.143110][ T1060] __kernfs_new_node+0xa9/0x980 [ 95.145678][ T1060] kernfs_new_node+0xea/0x140 [ 95.148458][ T1060] kernfs_create_link+0xa7/0x200 [ 95.151409][ T1060] sysfs_do_create_link_sd+0x83/0x110 [ 95.154220][ T1060] module_add_driver+0x26e/0x320 [ 95.156763][ T1060] bus_add_driver+0x391/0x670 [ 95.159271][ T1060] driver_register+0x23a/0x320 [ 95.161995][ T1060] vhci_hcd_init+0xea/0x360 [ 95.164355][ T1060] do_one_initcall+0x250/0x870 [ 95.166531][ T1060] [ 95.167588][ T1060] Memory state around the buggy address: [ 95.170117][ T1060] ffff8880349e4580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.173982][ T1060] ffff8880349e4600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.178113][ T1060] >ffff8880349e4680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.181496][ T1060] ^ [ 95.183605][ T1060] ffff8880349e4700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.187578][ T1060] ffff8880349e4780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.191732][ T1060] ================================================================== [ 95.204554][ T5328] usb usb6: USB disconnect, device number 1 [ 95.290857][ T5328] vhci_hcd vhci_hcd.0: USB bus 6 deregistered [ 95.324192][ T5329] vhci_hcd vhci_hcd.0: USB/IP Virtual Host Controller [ 95.429386][ T5329] vhci_hcd vhci_hcd.0: new USB bus registered, assigned bus number 6 [ 95.436372][ T5329] vhci_hcd vhci_hcd.0: created sysfs vhci_hcd.0 [ 95.459660][ T5329] usb usb6: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 95.465406][ T5329] usb usb6: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 95.475067][ T5329] usb usb6: Product: USB/IP Virtual Host Controller [ 95.479837][ T5329] usb usb6: Manufacturer: Linux syzkaller vhci_hcd [ 95.484172][ T5329] usb usb6: SerialNumber: vhci_hcd.0 [ 95.525296][ T5329] hub 6-0:1.0: USB hub found [ 95.542519][ T5329] hub 6-0:1.0: 8 ports detected [ 95.601979][ T5329] vhci_hcd vhci_hcd.0: USB/IP Virtual Host Controller [ 95.608104][ T1060] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 95.611788][ T1060] CPU: 0 UID: 0 PID: 1060 Comm: kworker/u4:8 Not tainted syzkaller #0 PREEMPT(full) [ 95.617011][ T1060] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.622142][ T1060] Workqueue: usbip_event event_handler [ 95.624604][ T1060] Call Trace: [ 95.626159][ T1060] [ 95.627608][ T1060] vpanic+0x56c/0xa60 [ 95.629589][ T1060] ? __pfx_vpanic+0x10/0x10 [ 95.631710][ T1060] ? __pfx___schedule+0x10/0x10 [ 95.633897][ T1060] panic+0xc5/0xd0 [ 95.635524][ T1060] ? __pfx_panic+0x10/0x10 [ 95.637503][ T1060] ? preempt_schedule_thunk+0x16/0x40 [ 95.639842][ T1060] ? vhci_cleanup_unlink_list+0x452/0x460 [ 95.642473][ T1060] check_panic_on_warn+0x89/0xb0 [ 95.644850][ T1060] ? vhci_cleanup_unlink_list+0x452/0x460 [ 95.647751][ T1060] end_report+0x73/0x170 [ 95.649634][ T1060] ? vhci_cleanup_unlink_list+0x452/0x460 [ 95.652118][ T1060] kasan_report+0x128/0x150 [ 95.654344][ T1060] ? vhci_cleanup_unlink_list+0x452/0x460 [ 95.657532][ T1060] vhci_cleanup_unlink_list+0x452/0x460 [ 95.659917][ T1060] ? kasan_quarantine_put+0xbb/0x1f0 [ 95.662056][ T1060] vhci_shutdown_connection+0x2af/0x650 [ 95.664274][ T1060] event_handler+0x2a4/0x4b0 [ 95.666483][ T1060] ? process_scheduled_works+0xa20/0x14e0 [ 95.669849][ T1060] process_scheduled_works+0xa8e/0x14e0 [ 95.672506][ T1060] ? __pfx_process_scheduled_works+0x10/0x10 [ 95.675057][ T1060] ? assign_work+0x3cf/0x5d0 [ 95.677171][ T1060] worker_thread+0xa47/0xfb0 [ 95.679063][ T1060] ? __kthread_parkme+0x71/0x1f0 [ 95.681199][ T1060] kthread+0x388/0x470 [ 95.683159][ T1060] ? __pfx_worker_thread+0x10/0x10 [ 95.686115][ T1060] ? __pfx_kthread+0x10/0x10 [ 95.688923][ T1060] ret_from_fork+0x514/0xb70 [ 95.691333][ T1060] ? __pfx_ret_from_fork+0x10/0x10 [ 95.693495][ T1060] ? __switch_to+0xc89/0x1420 [ 95.695414][ T1060] ? __pfx_kthread+0x10/0x10 [ 95.697331][ T1060] ret_from_fork_asm+0x1a/0x30 [ 95.699059][ T1060] [ 95.700672][ T1060] Kernel Offset: disabled [ 95.702504][ T1060] Rebooting in 86400 seconds..