program: socketpair(0x1, 0x1, 0x0, &(0x7f0000000100)={0x0, 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, &(0x7f0000000180)) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/usb/drivers/usbip-host/match_busid\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='add 1-1\x00', 0x8) write(r1, &(0x7f0000000240)='add 2-1\x00', 0x8) close(r1) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/usb/drivers/usb/unbind\x00', 0x1, 0x0) write(r2, &(0x7f00000002c0)='1-1\x00', 0x4) write(r2, &(0x7f0000000340)='2-1\x00', 0x4) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/bus/usb/drivers/usbip-host/bind\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='1-1\x00', 0x4) write(r3, &(0x7f0000000400)='2-1\x00', 0x4) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/bus/usb/devices/1-1/usbip_sockfd\x00', 0x1, 0x0) write(r4, &(0x7f0000000480)='3\x00', 0x2) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/bus/usb/devices/2-1/usbip_sockfd\x00', 0x1, 0x0) write(r5, &(0x7f0000000500)='3\x00', 0x2) close(r5) nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0) write(r0, &(0x7f0000000540)="00000001000000010001000200"/48, 0x30) write(r0, &(0x7f0000000580)="00000002000000030001000200000000000000000000000100"/48, 0x30) write(r0, &(0x7f00000005c0)="00000001000000050001000200"/48, 0x30) nanosleep(&(0x7f0000000300)={0x1}, 0x0) [ 105.303303][ T5290] Bluetooth: hci0: command tx timeout [ 105.622240][ T5313] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 105.772371][ T5313] usb 5-1: Using ep0 maxpacket: 8 [ 105.779321][ T5313] usb 5-1: config 0 has an invalid interface number: 143 but max is 0 [ 105.783272][ T5313] usb 5-1: config 0 has no interface number 0 [ 105.785888][ T5313] usb 5-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 105.790044][ T5313] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 105.800267][ T5313] usb 5-1: config 0 descriptor?? [ 105.923880][ T5313] viperboard 5-1:0.143: version 0.00 found at bus 005 address 002 [ 105.964142][ T5313] viperboard-i2c viperboard-i2c.3.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 105.970285][ T5313] viperboard-i2c viperboard-i2c.3.auto: probe with driver viperboard-i2c failed with error -5 [ 106.179847][ T5325] usbip-host 1-1: usbip-host: register new device (bus 1 dev 2) [ 106.202985][ T5325] usbip-host 1-1: stub up [ 106.275627][ C0] usbip-host 1-1: endpoint 0 is stalled [ 106.281268][ T5328] ================================================================== [ 106.284695][ T5328] BUG: KASAN: slab-use-after-free in stub_rx_loop+0x2965/0x2ee0 [ 106.287854][ T5328] Read of size 4 at addr ffff88801faa4db0 by task stub_rx/5328 [ 106.290881][ T5328] [ 106.291891][ T5328] CPU: 0 UID: 0 PID: 5328 Comm: stub_rx Not tainted syzkaller #0 PREEMPT(full) [ 106.291905][ T5328] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 106.291912][ T5328] Call Trace: [ 106.291918][ T5328] [ 106.291923][ T5328] dump_stack_lvl+0xe8/0x150 [ 106.291942][ T5328] print_address_description+0x55/0x1e0 [ 106.291957][ T5328] ? stub_rx_loop+0x2965/0x2ee0 [ 106.291968][ T5328] print_report+0x58/0x70 [ 106.291980][ T5328] kasan_report+0x117/0x150 [ 106.291994][ T5328] ? stub_rx_loop+0x2965/0x2ee0 [ 106.292007][ T5328] stub_rx_loop+0x2965/0x2ee0 [ 106.292047][ T5328] ? __pfx_stub_rx_loop+0x10/0x10 [ 106.292058][ T5328] ? __kthread_parkme+0x196/0x1f0 [ 106.292066][ T5328] kthread+0x388/0x470 [ 106.292075][ T5328] ? __pfx_stub_rx_loop+0x10/0x10 [ 106.292087][ T5328] ? __pfx_kthread+0x10/0x10 [ 106.292096][ T5328] ret_from_fork+0x514/0xb70 [ 106.292110][ T5328] ? __pfx_ret_from_fork+0x10/0x10 [ 106.292123][ T5328] ? __switch_to+0xc89/0x1420 [ 106.292135][ T5328] ? __pfx_kthread+0x10/0x10 [ 106.292148][ T5328] ret_from_fork_asm+0x1a/0x30 [ 106.292161][ T5328] [ 106.292165][ T5328] [ 106.339523][ T5328] Allocated by task 5328: [ 106.341309][ T5328] kasan_save_track+0x3e/0x80 [ 106.343292][ T5328] __kasan_slab_alloc+0x6c/0x80 [ 106.345395][ T5328] kmem_cache_alloc_noprof+0x2a0/0x5f0 [ 106.347723][ T5328] stub_rx_loop+0xad9/0x2ee0 [ 106.349673][ T5328] kthread+0x388/0x470 [ 106.351256][ T5328] ret_from_fork+0x514/0xb70 [ 106.353106][ T5328] ret_from_fork_asm+0x1a/0x30 [ 106.354984][ T5328] [ 106.356004][ T5328] Freed by task 5329: [ 106.357601][ T5328] kasan_save_track+0x3e/0x80 [ 106.359405][ T5328] kasan_save_free_info+0x40/0x50 [ 106.361428][ T5328] __kasan_slab_free+0x5c/0x80 [ 106.363320][ T5328] kmem_cache_free+0x182/0x650 [ 106.365353][ T5328] stub_tx_loop+0x1b16/0x2800 [ 106.367436][ T5328] kthread+0x388/0x470 [ 106.369107][ T5328] ret_from_fork+0x514/0xb70 [ 106.371074][ T5328] ret_from_fork_asm+0x1a/0x30 [ 106.373101][ T5328] [ 106.374146][ T5328] The buggy address belongs to the object at ffff88801faa4d80 [ 106.374146][ T5328] which belongs to the cache stub_priv of size 64 [ 106.379798][ T5328] The buggy address is located 48 bytes inside of [ 106.379798][ T5328] freed 64-byte region [ffff88801faa4d80, ffff88801faa4dc0) [ 106.385144][ T5328] [ 106.386171][ T5328] The buggy address belongs to the physical page: [ 106.388860][ T5328] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88801faa4e00 pfn:0x1faa4 [ 106.393017][ T5328] flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff) [ 106.396274][ T5328] page_type: f5(slab) [ 106.397956][ T5328] raw: 00fff00000000200 ffff888033f933c0 ffff888032d00c48 ffff888032d00c48 [ 106.401381][ T5328] raw: ffff88801faa4e00 000000080020001c 00000000f5000000 0000000000000000 [ 106.404867][ T5328] page dumped because: kasan: bad access detected [ 106.407587][ T5328] page_owner tracks the page as allocated [ 106.409961][ T5328] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5328, tgid 5328 (stub_rx), ts 106274200390, free_ts 106188681443 [ 106.417909][ T5328] post_alloc_hook+0x1f9/0x250 [ 106.419706][ T5328] get_page_from_freelist+0x21fa/0x2270 [ 106.422082][ T5328] __alloc_frozen_pages_noprof+0x18d/0x380 [ 106.424599][ T5328] allocate_slab+0x79/0x5e0 [ 106.426535][ T5328] refill_objects+0x2d5/0x350 [ 106.428592][ T5328] __pcs_replace_empty_main+0x2bf/0x6b0 [ 106.430971][ T5328] kmem_cache_alloc_noprof+0x382/0x5f0 [ 106.433321][ T5328] stub_rx_loop+0xad9/0x2ee0 [ 106.435698][ T5328] kthread+0x388/0x470 [ 106.437394][ T5328] ret_from_fork+0x514/0xb70 [ 106.439293][ T5328] ret_from_fork_asm+0x1a/0x30 [ 106.441290][ T5328] page last free pid 75 tgid 75 stack trace: [ 106.443767][ T5328] free_unref_folios+0xd84/0x14a0 [ 106.445783][ T5328] shrink_folio_list+0x4b16/0x5330 [ 106.448045][ T5328] evict_folios+0x3821/0x4b40 [ 106.450118][ T5328] try_to_shrink_lruvec+0xb4f/0xed0 [ 106.452297][ T5328] shrink_one+0x233/0x730 [ 106.454058][ T5328] shrink_node+0x3303/0x3b60 [ 106.455847][ T5328] kswapd+0x17b6/0x31c0 [ 106.457561][ T5328] kthread+0x388/0x470 [ 106.459248][ T5328] ret_from_fork+0x514/0xb70 [ 106.461145][ T5328] ret_from_fork_asm+0x1a/0x30 [ 106.463072][ T5328] [ 106.464133][ T5328] Memory state around the buggy address: [ 106.466466][ T5328] ffff88801faa4c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 106.469707][ T5328] ffff88801faa4d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 106.472846][ T5328] >ffff88801faa4d80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 106.476103][ T5328] ^ [ 106.478428][ T5328] ffff88801faa4e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 106.481693][ T5328] ffff88801faa4e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 106.485028][ T5328] ================================================================== [ 106.506741][ T5328] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 106.509694][ T5328] CPU: 0 UID: 0 PID: 5328 Comm: stub_rx Not tainted syzkaller #0 PREEMPT(full) [ 106.513186][ T5328] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 106.517355][ T5328] Call Trace: [ 106.518776][ T5328] [ 106.520080][ T5328] vpanic+0x56c/0xa60 [ 106.521764][ T5328] ? __pfx_vpanic+0x10/0x10 [ 106.523716][ T5328] panic+0xc5/0xd0 [ 106.525329][ T5328] ? __pfx_panic+0x10/0x10 [ 106.527229][ T5328] ? preempt_schedule_thunk+0x16/0x40 [ 106.529555][ T5328] ? stub_rx_loop+0x2965/0x2ee0 [ 106.531606][ T5328] ? preempt_schedule_thunk+0x16/0x40 [ 106.533907][ T5328] ? stub_rx_loop+0x2965/0x2ee0 [ 106.535952][ T5328] check_panic_on_warn+0x89/0xb0 [ 106.538022][ T5328] ? stub_rx_loop+0x2965/0x2ee0 [ 106.540187][ T5328] end_report+0x73/0x170 [ 106.542042][ T5328] ? stub_rx_loop+0x2965/0x2ee0 [ 106.544176][ T5328] kasan_report+0x128/0x150 [ 106.546136][ T5328] ? stub_rx_loop+0x2965/0x2ee0 [ 106.548207][ T5328] stub_rx_loop+0x2965/0x2ee0 [ 106.550187][ T5328] ? __pfx_stub_rx_loop+0x10/0x10 [ 106.552261][ T5328] ? __kthread_parkme+0x196/0x1f0 [ 106.554406][ T5328] kthread+0x388/0x470 [ 106.556151][ T5328] ? __pfx_stub_rx_loop+0x10/0x10 [ 106.558307][ T5328] ? __pfx_kthread+0x10/0x10 [ 106.560323][ T5328] ret_from_fork+0x514/0xb70 [ 106.562266][ T5328] ? __pfx_ret_from_fork+0x10/0x10 [ 106.564507][ T5328] ? __switch_to+0xc89/0x1420 [ 106.566559][ T5328] ? __pfx_kthread+0x10/0x10 [ 106.568492][ T5328] ret_from_fork_asm+0x1a/0x30 [ 106.570357][ T5328] [ 106.571903][ T5328] Kernel Offset: disabled [ 106.573627][ T5328] Rebooting in 86400 seconds..