program: syz_open_dev$evdev(&(0x7f00000000c0), 0x2000000003, 0x903d41) syz_usb_connect(0x3, 0x63, &(0x7f0000000740)={{0x12, 0x1, 0x310, 0x78, 0xe8, 0x72, 0x20, 0x1f71, 0x3306, 0x2ac0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x51, 0x2, 0x3, 0x1, 0x80, 0x5, "", [{{0x9, 0x4, 0xdf, 0x0, 0x0, 0x46, 0x35, 0x34, 0xf}}, {{0x9, 0x4, 0x19, 0x6, 0x5, 0xfb, 0xdc, 0x42, 0x0, [], [{{0x9, 0x5, 0x80, 0x10, 0x200, 0x6, 0x6, 0x4, [@generic={0x9, 0x4, "df9b52d017dc73"}]}}, {{0x9, 0x5, 0xd, 0x0, 0x200, 0xaf, 0x2, 0x83}}, {{0x9, 0x5, 0x8b, 0x0, 0x20, 0x1, 0x8, 0x8}}, {{0x9, 0x5, 0x8, 0x0, 0x200, 0x8, 0x1b, 0x6}}, {{0x9, 0x5, 0xe, 0x1, 0x200, 0x3, 0x9, 0x40}}]}}]}}]}}, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="1201410130f56920ac05190272f00102030109021b00010000100009045507010349020009058203"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000340)=ANY=[@ANYBLOB='\x00N\b'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x40, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_open_dev$evdev(&(0x7f0000000000), 0x2, 0x0) r1 = syz_usb_connect(0x2, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="03010000ac0fce405d0500904431000000010902120001000080040904"], 0x0) syz_usb_disconnect(r1) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000cc0)=ANY=[], 0x0) syz_usb_control_io$cdc_ecm(r2, &(0x7f0000000440)={0x14, &(0x7f0000000380)={0x0, 0x30, 0x2, {0x2, 0x7}}, &(0x7f0000000400)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000680)={0x1c, &(0x7f0000000480)={0x0, 0x1, 0xa3, "af63d59b864db2ae6716d5f9099892104325f3df6f0cb95267a65a44343f2d66af5bfad8556c29e3c3e9c83e4e90ff5c91a53fc240e842a4401df8967f65464913181287ad1950afa4eee53a7bc619d3011c55a8ed279dafb7d5e632736b620988e58aec4cad6cdddd0b0fd09f23ce7962e49769ec768e2d0091a1563c6534e38c0817998cafb23d40ad4f1af0af95bd2a2b6a304e913a24a93761931a7974d59d71c7"}, &(0x7f0000000540)={0x0, 0xa, 0x1, 0x5}, &(0x7f0000000640)={0x0, 0x8, 0x1, 0x3}}) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$uac1(r2, 0x0, &(0x7f0000001480)={0x44, &(0x7f0000001180)=ANY=[@ANYBLOB="000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) r3 = syz_open_dev$evdev(&(0x7f0000000040), 0x8000000000000000, 0x400000) ioctl$EVIOCGPHYS(r3, 0x80404507, &(0x7f0000000240)=""/236) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, &(0x7f0000001540)={0x34, &(0x7f0000001300)=ANY=[@ANYBLOB="0007ebffffff"], 0x0, 0x0, 0x0, 0x0, 0x0}) [ 102.726650][ T5285] Bluetooth: hci0: command tx timeout [ 103.119559][ T10] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 103.269913][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 103.273051][ T10] usb 5-1: unable to get BOS descriptor or descriptor too short [ 103.273081][ T10] usb 5-1: New USB device found, idVendor=1f71, idProduct=3306, bcdDevice=2a.c0 [ 103.274764][ T10] usb 5-1: config 3 has an invalid interface number: 223 but max is 1 [ 103.274777][ T10] usb 5-1: config 3 has an invalid interface number: 25 but max is 1 [ 103.274784][ T10] usb 5-1: config 3 has an invalid interface number: 223 but max is 1 [ 103.274792][ T10] usb 5-1: config 3 has no interface number 0 [ 103.274800][ T10] usb 5-1: config 3 has no interface number 1 [ 103.274828][ T10] usb 5-1: config 3 interface 25 altsetting 6 has an invalid descriptor for endpoint zero, skipping [ 103.274839][ T10] usb 5-1: config 3 interface 25 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 103.274852][ T10] usb 5-1: too many endpoints for config 3 interface 223 altsetting 155: 82, using maximum allowed: 30 [ 103.274865][ T10] usb 5-1: config 3 interface 223 altsetting 155 endpoint 0xD has invalid maxpacket 512, setting to 64 [ 103.274874][ T10] usb 5-1: config 3 interface 223 altsetting 155 endpoint 0x8 has invalid maxpacket 512, setting to 64 [ 103.274883][ T10] usb 5-1: config 3 interface 223 altsetting 155 has 4 endpoint descriptors, different from the interface descriptor's value: 82 [ 103.274891][ T10] usb 5-1: config 3 interface 223 has no altsetting 1 [ 103.274897][ T10] usb 5-1: config 3 interface 25 has no altsetting 0 [ 103.276876][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 103.276886][ T10] usb 5-1: Product: syz [ 103.276890][ T10] usb 5-1: Manufacturer: syz [ 103.276895][ T10] usb 5-1: SerialNumber: syz [ 103.595234][ T5326] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 103.598374][ T5326] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 103.620624][ T5326] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 103.621737][ T5326] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 103.833692][ T5326] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 103.835648][ T5326] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 104.126227][ T10] usbtv 5-1:3.223: Fushicai USBTV007 Audio-Video Grabber [ 104.150608][ T10] usb 5-1: USB disconnect, device number 2 [ 104.187832][ T10] [ 104.189024][ T10] ========================= [ 104.191116][ T10] WARNING: held lock freed! [ 104.193069][ T10] syzkaller #0 Not tainted [ 104.194888][ T10] ------------------------- [ 104.196444][ T10] kworker/0:1/10 is freeing memory ffff88801f994000-ffff88801f9947ff, with a lock still held there! [ 104.200421][ T10] ffff88801f9941a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880 [ 104.203908][ T10] locks held by kworker/0:1/10: 5, last CPU#0: [ 104.206017][ T10] #0: ffff88801f767540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 104.209872][ T10] #1: ffffc9000023fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 104.213896][ T10] #2: ffff88801f6421d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 [ 104.216960][ T10] #3: ffff88803fccc1d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xfc/0x9a0 [ 104.220044][ T10] #4: ffff88801f9941a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880 [ 104.223604][ T10] [ 104.223604][ T10] stack backtrace: [ 104.225635][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full) [ 104.228589][ T10] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 104.232445][ T10] Workqueue: usb_hub_wq hub_event [ 104.234740][ T10] Call Trace: [ 104.236211][ T10] [ 104.237489][ T10] dump_stack_lvl+0xe8/0x150 [ 104.239616][ T10] debug_check_no_locks_freed+0x149/0x170 [ 104.242572][ T10] kfree+0x12b/0x650 [ 104.244627][ T10] ? device_release+0xc4/0x1f0 [ 104.247006][ T10] ? __pfx_usb_release_interface+0x10/0x10 [ 104.249843][ T10] device_release+0xc4/0x1f0 [ 104.252197][ T10] kobject_put+0x222/0x550 [ 104.254581][ T10] v4l2_device_disconnect+0x79/0xd0 [ 104.256908][ T10] usbtv_video_free+0x25/0x30 [ 104.259091][ T10] usbtv_disconnect+0x5c/0xa0 [ 104.261666][ T10] usb_unbind_interface+0x295/0x9f0 [ 104.264541][ T10] ? kernfs_remove_by_name_ns+0x101/0x140 [ 104.267293][ T10] ? kernfs_remove_by_name_ns+0x101/0x140 [ 104.269936][ T10] ? __pfx_usb_unbind_interface+0x10/0x10 [ 104.272515][ T10] device_release_driver_internal+0x4f5/0x880 [ 104.275384][ T10] bus_remove_device+0x444/0x560 [ 104.277627][ T10] ? __pfx_bus_remove_device+0x10/0x10 [ 104.280083][ T10] ? kernfs_remove_by_name_ns+0x101/0x140 [ 104.282661][ T10] device_del+0x524/0x8f0 [ 104.284603][ T10] ? __pfx_device_del+0x10/0x10 [ 104.286718][ T10] ? __pfx___mutex_lock+0x10/0x10 [ 104.289016][ T10] usb_disable_device+0x3d4/0x8d0 [ 104.291238][ T10] usb_disconnect+0x346/0x9a0 [ 104.293283][ T10] hub_event+0x1bbb/0x4d30 [ 104.295307][ T10] ? do_raw_spin_unlock+0x4d/0x200 [ 104.297281][ T10] ? register_lock_class+0x31/0x2e0 [ 104.299127][ T10] ? __pfx_hub_event+0x10/0x10 [ 104.300757][ T10] ? rcu_is_watching+0x16/0xb0 [ 104.302539][ T10] ? process_scheduled_works+0x97a/0x1630 [ 104.304632][ T10] process_scheduled_works+0xc3d/0x1630 [ 104.306650][ T10] ? __pfx_process_scheduled_works+0x10/0x10 [ 104.308885][ T10] ? assign_work+0x3cf/0x5d0 [ 104.310598][ T10] worker_thread+0xa47/0xfb0 [ 104.312306][ T10] kthread+0x38b/0x480 [ 104.313775][ T10] ? __pfx_worker_thread+0x10/0x10 [ 104.315619][ T10] ? __pfx_kthread+0x10/0x10 [ 104.317317][ T10] ret_from_fork+0x514/0xb70 [ 104.319166][ T10] ? __pfx_ret_from_fork+0x10/0x10 [ 104.321199][ T10] ? __switch_to+0xc89/0x1420 [ 104.323163][ T10] ? __pfx_kthread+0x10/0x10 [ 104.325068][ T10] ret_from_fork_asm+0x1a/0x30 [ 104.327159][ T10] [ 104.332340][ T10] ================================================================== [ 104.332350][ T10] BUG: KASAN: slab-use-after-free in usb_unbind_interface+0x2c2/0x9f0 [ 104.332368][ T10] Read of size 8 at addr ffff88801f994008 by task kworker/0:1/10 [ 104.332376][ T10] [ 104.332382][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full) [ 104.332390][ T10] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 104.332396][ T10] Workqueue: usb_hub_wq hub_event [ 104.332405][ T10] Call Trace: [ 104.332408][ T10] [ 104.332411][ T10] dump_stack_lvl+0xe8/0x150 [ 104.332423][ T10] print_address_description+0x55/0x1e0 [ 104.332433][ T10] ? usb_unbind_interface+0x2c2/0x9f0 [ 104.332440][ T10] print_report+0x58/0x70 [ 104.332448][ T10] kasan_report+0x117/0x150 [ 104.332456][ T10] ? usb_unbind_interface+0x2c2/0x9f0 [ 104.332465][ T10] usb_unbind_interface+0x2c2/0x9f0 [ 104.332472][ T10] ? kernfs_remove_by_name_ns+0x101/0x140 [ 104.332480][ T10] ? kernfs_remove_by_name_ns+0x101/0x140 [ 104.332486][ T10] ? __pfx_usb_unbind_interface+0x10/0x10 [ 104.332493][ T10] device_release_driver_internal+0x4f5/0x880 [ 104.332504][ T10] bus_remove_device+0x444/0x560 [ 104.332513][ T10] ? __pfx_bus_remove_device+0x10/0x10 [ 104.332522][ T10] ? kernfs_remove_by_name_ns+0x101/0x140 [ 104.332529][ T10] device_del+0x524/0x8f0 [ 104.332536][ T10] ? __pfx_device_del+0x10/0x10 [ 104.332546][ T10] ? __pfx___mutex_lock+0x10/0x10 [ 104.332555][ T10] usb_disable_device+0x3d4/0x8d0 [ 104.332563][ T10] usb_disconnect+0x346/0x9a0 [ 104.332575][ T10] hub_event+0x1bbb/0x4d30 [ 104.332581][ T10] ? do_raw_spin_unlock+0x4d/0x200 [ 104.332592][ T10] ? register_lock_class+0x31/0x2e0 [ 104.332604][ T10] ? __pfx_hub_event+0x10/0x10 [ 104.332616][ T10] ? rcu_is_watching+0x16/0xb0 [ 104.332628][ T10] ? process_scheduled_works+0x97a/0x1630 [ 104.332642][ T10] process_scheduled_works+0xc3d/0x1630 [ 104.332654][ T10] ? __pfx_process_scheduled_works+0x10/0x10 [ 104.332664][ T10] ? assign_work+0x3cf/0x5d0 [ 104.332672][ T10] worker_thread+0xa47/0xfb0 [ 104.332684][ T10] kthread+0x38b/0x480 [ 104.332691][ T10] ? __pfx_worker_thread+0x10/0x10 [ 104.332699][ T10] ? __pfx_kthread+0x10/0x10 [ 104.332705][ T10] ret_from_fork+0x514/0xb70 [ 104.332712][ T10] ? __pfx_ret_from_fork+0x10/0x10 [ 104.332718][ T10] ? __switch_to+0xc89/0x1420 [ 104.332728][ T10] ? __pfx_kthread+0x10/0x10 [ 104.332734][ T10] ret_from_fork_asm+0x1a/0x30 [ 104.332746][ T10] [ 104.332748][ T10] [ 104.332750][ T10] Allocated by task 10: [ 104.332753][ T10] kasan_save_track+0x3e/0x80 [ 104.332762][ T10] __kasan_kmalloc+0x93/0xb0 [ 104.332768][ T10] __kmalloc_cache_noprof+0x321/0x600 [ 104.332777][ T10] usb_set_configuration+0x3cc/0x2180 [ 104.332783][ T10] usb_generic_driver_probe+0x8d/0x150 [ 104.332790][ T10] usb_probe_device+0x1c3/0x3b0 [ 104.332796][ T10] really_probe+0x254/0xae0 [ 104.332802][ T10] __driver_probe_device+0x1e8/0x360 [ 104.332808][ T10] driver_probe_device+0x4f/0x240 [ 104.332814][ T10] __device_attach_driver+0x270/0x410 [ 104.332820][ T10] bus_for_each_drv+0x258/0x2f0 [ 104.332827][ T10] __device_attach+0x2c4/0x450 [ 104.332833][ T10] device_initial_probe+0xa1/0xd0 [ 104.332838][ T10] bus_probe_device+0x12a/0x220 [ 104.332845][ T10] device_add+0x7d7/0xb80 [ 104.332854][ T10] usb_new_device+0x9aa/0x1690 [ 104.332866][ T10] hub_event+0x28e8/0x4d30 [ 104.332875][ T10] process_scheduled_works+0xc3d/0x1630 [ 104.332886][ T10] worker_thread+0xa47/0xfb0 [ 104.332897][ T10] kthread+0x38b/0x480 [ 104.332902][ T10] ret_from_fork+0x514/0xb70 [ 104.332907][ T10] ret_from_fork_asm+0x1a/0x30 [ 104.332916][ T10] [ 104.332933][ T10] Freed by task 10: [ 104.332937][ T10] kasan_save_track+0x3e/0x80 [ 104.332947][ T10] kasan_save_free_info+0x40/0x50 [ 104.332955][ T10] __kasan_slab_free+0x5c/0x80 [ 104.332960][ T10] kfree+0x1c5/0x650 [ 104.332967][ T10] device_release+0xc4/0x1f0 [ 104.332974][ T10] kobject_put+0x222/0x550 [ 104.332982][ T10] v4l2_device_disconnect+0x79/0xd0 [ 104.332990][ T10] usbtv_video_free+0x25/0x30 [ 104.333003][ T10] usbtv_disconnect+0x5c/0xa0 [ 104.333009][ T10] usb_unbind_interface+0x295/0x9f0 [ 104.333015][ T10] device_release_driver_internal+0x4f5/0x880 [ 104.333022][ T10] bus_remove_device+0x444/0x560 [ 104.333029][ T10] device_del+0x524/0x8f0 [ 104.333034][ T10] usb_disable_device+0x3d4/0x8d0 [ 104.333040][ T10] usb_disconnect+0x346/0x9a0 [ 104.333048][ T10] hub_event+0x1bbb/0x4d30 [ 104.333053][ T10] process_scheduled_works+0xc3d/0x1630 [ 104.333061][ T10] worker_thread+0xa47/0xfb0 [ 104.333069][ T10] kthread+0x38b/0x480 [ 104.333074][ T10] ret_from_fork+0x514/0xb70 [ 104.333079][ T10] ret_from_fork_asm+0x1a/0x30 [ 104.333088][ T10] [ 104.333090][ T10] The buggy address belongs to the object at ffff88801f994000 [ 104.333090][ T10] which belongs to the cache kmalloc-2k of size 2048 [ 104.333095][ T10] The buggy address is located 8 bytes inside of [ 104.333095][ T10] freed 2048-byte region [ffff88801f994000, ffff88801f994800) [ 104.333102][ T10] [ 104.333104][ T10] The buggy address belongs to the physical page: [ 104.333109][ T10] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1f990 [ 104.333120][ T10] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 104.333128][ T10] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 104.333138][ T10] page_type: f5(slab) [ 104.333148][ T10] raw: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122 [ 104.333154][ T10] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 104.333160][ T10] head: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122 [ 104.333165][ T10] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 104.333170][ T10] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 104.333176][ T10] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 104.333179][ T10] page dumped because: kasan: bad access detected [ 104.333182][ T10] page_owner tracks the page as allocated [ 104.333185][ T10] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4685, tgid 4685 (klogd), ts 98509229605 [ 104.333196][ T10] post_alloc_hook+0x1f9/0x250 [ 104.333205][ T10] get_page_from_freelist+0x2209/0x2280 [ 104.333214][ T10] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 104.333223][ T10] allocate_slab+0x7d/0x620 [ 104.333229][ T10] refill_objects+0x2d5/0x350 [ 104.333236][ T10] __pcs_replace_empty_main+0x2c8/0x6c0 [ 104.333242][ T10] __kmalloc_cache_noprof+0x39b/0x600 [ 104.333250][ T10] syslog_print+0x103/0x610 [ 104.333257][ T10] do_syslog+0x583/0x7d0 [ 104.333264][ T10] __x64_sys_syslog+0x7c/0x90 [ 104.333270][ T10] do_syscall_64+0x166/0x520 [ 104.333278][ T10] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.333285][ T10] page last free pid 4709 tgid 4709 ts 38026647490 stack trace: [ 104.333294][ T10] __free_frozen_pages+0xc93/0xd90 [ 104.333302][ T10] __slab_free+0x274/0x2c0 [ 104.333310][ T10] qlist_free_all+0x99/0x100 [ 104.333319][ T10] kasan_quarantine_reduce+0x148/0x160 [ 104.333327][ T10] __kasan_slab_alloc+0x22/0x80 [ 104.333333][ T10] kmem_cache_alloc_noprof+0x2b9/0x600 [ 104.333341][ T10] do_getname+0x2e/0x250 [ 104.333347][ T10] vfs_fstatat+0x45/0x170 [ 104.333353][ T10] __x64_sys_newfstatat+0x151/0x200 [ 104.333359][ T10] do_syscall_64+0x166/0x520 [ 104.333366][ T10] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.333372][ T10] [ 104.333373][ T10] Memory state around the buggy address: [ 104.333377][ T10] ffff88801f993f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 104.333381][ T10] ffff88801f993f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 104.333386][ T10] >ffff88801f994000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 104.333389][ T10] ^ [ 104.333392][ T10] ffff88801f994080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 104.333396][ T10] ffff88801f994100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 104.333400][ T10] ================================================================== [ 104.333455][ T10] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 104.626316][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full) [ 104.629876][ T10] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 104.633653][ T10] Workqueue: usb_hub_wq hub_event [ 104.635490][ T10] Call Trace: [ 104.636911][ T10] [ 104.638085][ T10] vpanic+0x56d/0xa60 [ 104.639647][ T10] ? rcu_is_watching+0x16/0xb0 [ 104.641515][ T10] ? __pfx_vpanic+0x10/0x10 [ 104.643295][ T10] ? __pfx___schedule+0x10/0x10 [ 104.645094][ T10] panic+0xc5/0xd0 [ 104.646545][ T10] ? __pfx_panic+0x10/0x10 [ 104.648092][ T10] ? preempt_schedule_thunk+0x16/0x40 [ 104.649968][ T10] ? usb_unbind_interface+0x2c2/0x9f0 [ 104.652019][ T10] check_panic_on_warn+0x89/0xb0 [ 104.653892][ T10] ? usb_unbind_interface+0x2c2/0x9f0 [ 104.655917][ T10] end_report+0x73/0x170 [ 104.657404][ T10] ? usb_unbind_interface+0x2c2/0x9f0 [ 104.659272][ T10] kasan_report+0x128/0x150 [ 104.660803][ T10] ? usb_unbind_interface+0x2c2/0x9f0 [ 104.662619][ T10] usb_unbind_interface+0x2c2/0x9f0 [ 104.664588][ T10] ? kernfs_remove_by_name_ns+0x101/0x140 [ 104.666646][ T10] ? kernfs_remove_by_name_ns+0x101/0x140 [ 104.668641][ T10] ? __pfx_usb_unbind_interface+0x10/0x10 [ 104.670732][ T10] device_release_driver_internal+0x4f5/0x880 [ 104.672990][ T10] bus_remove_device+0x444/0x560 [ 104.674768][ T10] ? __pfx_bus_remove_device+0x10/0x10 [ 104.676756][ T10] ? kernfs_remove_by_name_ns+0x101/0x140 [ 104.678952][ T10] device_del+0x524/0x8f0 [ 104.680611][ T10] ? __pfx_device_del+0x10/0x10 [ 104.682731][ T10] ? __pfx___mutex_lock+0x10/0x10 [ 104.684842][ T10] usb_disable_device+0x3d4/0x8d0 [ 104.686728][ T10] usb_disconnect+0x346/0x9a0 [ 104.688744][ T10] hub_event+0x1bbb/0x4d30 [ 104.691609][ T10] ? do_raw_spin_unlock+0x4d/0x200 [ 104.693971][ T10] ? register_lock_class+0x31/0x2e0 [ 104.696264][ T10] ? __pfx_hub_event+0x10/0x10 [ 104.699135][ T10] ? rcu_is_watching+0x16/0xb0 [ 104.701184][ T10] ? process_scheduled_works+0x97a/0x1630 [ 104.703653][ T10] process_scheduled_works+0xc3d/0x1630 [ 104.706162][ T10] ? __pfx_process_scheduled_works+0x10/0x10 [ 104.708882][ T10] ? assign_work+0x3cf/0x5d0 [ 104.710973][ T10] worker_thread+0xa47/0xfb0 [ 104.713037][ T10] kthread+0x38b/0x480 [ 104.714829][ T10] ? __pfx_worker_thread+0x10/0x10 [ 104.717092][ T10] ? __pfx_kthread+0x10/0x10 [ 104.719125][ T10] ret_from_fork+0x514/0xb70 [ 104.721093][ T10] ? __pfx_ret_from_fork+0x10/0x10 [ 104.723288][ T10] ? __switch_to+0xc89/0x1420 [ 104.725326][ T10] ? __pfx_kthread+0x10/0x10 [ 104.727362][ T10] ret_from_fork_asm+0x1a/0x30 [ 104.729525][ T10] [ 104.731367][ T10] Kernel Offset: disabled [ 104.733281][ T10] Rebooting in 86400 seconds..