program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='noacl,d!x=never,\x00'], 0x2, 0x1b7, &(0x7f0000000380)="$eJzsmM9rGkEUx7+zu25baaFne7BQoQp13V3b0ktphUKvpfYHuUWSjZisMdE9RC9J/pKQfyTkT0k85eIxh5wmzOzoTkw2CIkI8X0Ob78zPN6+ecp3YEEQxNIyPL882x22mdAvOedc7V+YSY6h5X8o1ztvjr5n2QHwI3cymq4nCk2K3IstowXgtGYiUrtaC5KCev6BMdF/YaCk9H8wOEqvwsA/pQMwrCi9qemOyHecjVYYOGudcF0IVwRPBF+Eqv5+0Z82Ctkf09a9/mCrEYZB94HCQnqO3s/+1BRFf6Oaga9af/rvNZ6Nq83PgwFP6SoY6kp/wbPxbOKRjOsfMuSspL45h/M/IWGHz2dJzgB4zLeLeoOf8zkXFj/V5RXCbrQdc9H9SHHFOb+5Y0/9SRJ/4scM7zV/sjT/qETtnUqvPyi32o1m0Ay2fb/62f3oup/8ijSiOCINCy+kP2W1+pmUXJvZ0ve63l4jirqeWEvlx/Eux7Wl/xkovovXbHJzJcj74DV7Kx5FU61v8ftV6iEIgiAIgiAIgiAIgiAIgiBmIg8mv4KmUfpWyHPO/V8y+zoAAP//enBrcQ==") (async) write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa) (async) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000001c0)=0x1) [ 86.713492][ T5322] vhci_hcd vhci_hcd.0: remove, state 4 [ 86.715984][ T5322] usb usb7: USB disconnect, device number 1 [ 86.724549][ T5321] loop0: detected capacity change from 0 to 16 [ 86.738629][ T5321] erofs: Unknown parameter 'd!x' [ 86.822292][ T4648] Bluetooth: hci0: command tx timeout [ 86.857708][ T87] vhci_hcd vhci_hcd.0: stop threads [ 86.860517][ T87] vhci_hcd vhci_hcd.0: release socket [ 86.864631][ T87] vhci_hcd vhci_hcd.0: disconnect device [ 86.870021][ T87] vhci_hcd vhci_hcd.0: stop threads [ 86.874108][ T5322] vhci_hcd vhci_hcd.0: USB bus 7 deregistered [ 86.881544][ T87] vhci_hcd vhci_hcd.0: release socket [ 86.887488][ T87] vhci_hcd vhci_hcd.0: disconnect device [ 86.896422][ T87] vhci_hcd vhci_hcd.0: stop threads [ 86.903685][ T87] vhci_hcd vhci_hcd.0: release socket [ 86.913031][ T5322] vhci_hcd vhci_hcd.0: remove, state 4 [ 86.915581][ T87] ================================================================== [ 86.918974][ T87] BUG: KASAN: slab-use-after-free in vhci_cleanup_unlink_list+0x452/0x460 [ 86.922380][ T87] Read of size 4 at addr ffff888034bfc8f0 by task kworker/u4:5/87 [ 86.925465][ T87] [ 86.926440][ T87] CPU: 0 UID: 0 PID: 87 Comm: kworker/u4:5 Not tainted syzkaller #0 PREEMPT(full) [ 86.926453][ T87] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.926461][ T87] Workqueue: usbip_event event_handler [ 86.926477][ T87] Call Trace: [ 86.926483][ T87] [ 86.926488][ T87] dump_stack_lvl+0xe8/0x150 [ 86.926505][ T87] print_address_description+0x55/0x1e0 [ 86.926520][ T87] ? vhci_cleanup_unlink_list+0x452/0x460 [ 86.926532][ T87] print_report+0x58/0x70 [ 86.926545][ T87] kasan_report+0x117/0x150 [ 86.926561][ T87] ? vhci_cleanup_unlink_list+0x452/0x460 [ 86.926576][ T87] vhci_cleanup_unlink_list+0x452/0x460 [ 86.926589][ T87] ? kasan_quarantine_put+0xbb/0x1f0 [ 86.926600][ T87] vhci_shutdown_connection+0x2af/0x650 [ 86.926609][ T87] event_handler+0x2a4/0x4b0 [ 86.926616][ T87] ? process_scheduled_works+0xa20/0x14e0 [ 86.926625][ T87] process_scheduled_works+0xa8e/0x14e0 [ 86.926637][ T87] ? __pfx_process_scheduled_works+0x10/0x10 [ 86.926648][ T87] ? assign_work+0x3cf/0x5d0 [ 86.926660][ T87] worker_thread+0xa47/0xfb0 [ 86.926674][ T87] ? __kthread_parkme+0x71/0x1f0 [ 86.926688][ T87] kthread+0x388/0x470 [ 86.926703][ T87] ? __pfx_worker_thread+0x10/0x10 [ 86.926721][ T87] ? __pfx_kthread+0x10/0x10 [ 86.926736][ T87] ret_from_fork+0x514/0xb70 [ 86.926753][ T87] ? __pfx_ret_from_fork+0x10/0x10 [ 86.926766][ T87] ? __switch_to+0xc89/0x1420 [ 86.926775][ T87] ? __pfx_kthread+0x10/0x10 [ 86.926790][ T87] ret_from_fork_asm+0x1a/0x30 [ 86.926802][ T87] [ 86.926806][ T87] [ 86.990705][ T87] Allocated by task 1: [ 86.992430][ T87] kasan_save_track+0x3e/0x80 [ 86.994542][ T87] __kasan_kmalloc+0x93/0xb0 [ 86.996211][ T87] __kmalloc_noprof+0x375/0x720 [ 86.997991][ T87] __usb_create_hcd+0x67/0x900 [ 86.999677][ T87] vhci_hcd_probe+0x1e6/0x3e0 [ 87.001297][ T87] platform_probe+0xf9/0x190 [ 87.002955][ T87] really_probe+0x254/0xae0 [ 87.004593][ T87] __driver_probe_device+0x1e8/0x360 [ 87.006510][ T87] driver_probe_device+0x4f/0x240 [ 87.008555][ T87] __device_attach_driver+0x270/0x410 [ 87.010691][ T87] bus_for_each_drv+0x258/0x2f0 [ 87.012464][ T87] __device_attach+0x2c4/0x450 [ 87.014326][ T87] device_initial_probe+0xa1/0xd0 [ 87.016280][ T87] bus_probe_device+0x12a/0x220 [ 87.018247][ T87] device_add+0x7d7/0xb80 [ 87.020032][ T87] platform_device_add+0x4bd/0x860 [ 87.022114][ T87] platform_device_register_full+0x62d/0x710 [ 87.024470][ T87] vhci_hcd_init+0x227/0x360 [ 87.026392][ T87] do_one_initcall+0x250/0x870 [ 87.028265][ T87] do_initcall_level+0x10a/0x1a0 [ 87.030244][ T87] do_initcalls+0x59/0xa0 [ 87.031916][ T87] kernel_init_freeable+0x29d/0x3e0 [ 87.033729][ T87] kernel_init+0x1d/0x1d0 [ 87.035156][ T87] ret_from_fork+0x514/0xb70 [ 87.037105][ T87] ret_from_fork_asm+0x1a/0x30 [ 87.039127][ T87] [ 87.040145][ T87] Freed by task 5322: [ 87.041829][ T87] kasan_save_track+0x3e/0x80 [ 87.043781][ T87] kasan_save_free_info+0x40/0x50 [ 87.045750][ T87] __kasan_slab_free+0x5c/0x80 [ 87.047750][ T87] kfree+0x1c5/0x640 [ 87.049305][ T87] vhci_hcd_remove+0x9e/0x110 [ 87.051283][ T87] device_release_driver_internal+0x48b/0x880 [ 87.053777][ T87] unbind_store+0x1a1/0x1d0 [ 87.055621][ T87] kernfs_fop_write_iter+0x3a4/0x540 [ 87.057782][ T87] vfs_write+0x612/0xba0 [ 87.059765][ T87] ksys_write+0x150/0x270 [ 87.061602][ T87] do_syscall_64+0x174/0x580 [ 87.063383][ T87] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.065719][ T87] [ 87.066666][ T87] Last potentially related work creation: [ 87.068898][ T87] kasan_save_stack+0x3e/0x60 [ 87.070868][ T87] kasan_record_aux_stack+0xbd/0xd0 [ 87.073067][ T87] insert_work+0x3d/0x330 [ 87.074846][ T87] __queue_work+0xcd8/0x10a0 [ 87.076714][ T87] queue_work_on+0x106/0x1d0 [ 87.078649][ T87] unlink1+0x344/0x3e0 [ 87.080277][ T87] usb_hcd_unlink_urb+0xe6/0x1e0 [ 87.082194][ T87] usb_kill_urb+0x10b/0x2f0 [ 87.084003][ T87] hub_quiesce+0x211/0x330 [ 87.085834][ T87] hub_suspend+0x904/0xad0 [ 87.087678][ T87] usb_suspend_both+0x285/0x1040 [ 87.089870][ T87] usb_runtime_suspend+0x58/0x110 [ 87.091986][ T87] __rpm_callback+0x2c7/0x950 [ 87.093997][ T87] rpm_suspend+0x8a0/0x17b0 [ 87.095973][ T87] __pm_runtime_suspend+0x12f/0x1a0 [ 87.098102][ T87] usb_new_device+0xadf/0x1620 [ 87.100079][ T87] register_root_hub+0x250/0x5c0 [ 87.102094][ T87] usb_add_hcd+0xac7/0xf80 [ 87.103948][ T87] vhci_hcd_probe+0x1fa/0x3e0 [ 87.105919][ T87] platform_probe+0xf9/0x190 [ 87.107806][ T87] really_probe+0x254/0xae0 [ 87.109762][ T87] __driver_probe_device+0x1e8/0x360 [ 87.111952][ T87] driver_probe_device+0x4f/0x240 [ 87.113942][ T87] __device_attach_driver+0x270/0x410 [ 87.115994][ T87] bus_for_each_drv+0x258/0x2f0 [ 87.117936][ T87] __device_attach+0x2c4/0x450 [ 87.119817][ T87] device_initial_probe+0xa1/0xd0 [ 87.121765][ T87] bus_probe_device+0x12a/0x220 [ 87.123713][ T87] device_add+0x7d7/0xb80 [ 87.125437][ T87] platform_device_add+0x4bd/0x860 [ 87.127518][ T87] platform_device_register_full+0x62d/0x710 [ 87.129966][ T87] vhci_hcd_init+0x227/0x360 [ 87.131914][ T87] do_one_initcall+0x250/0x870 [ 87.133863][ T87] do_initcall_level+0x10a/0x1a0 [ 87.135850][ T87] do_initcalls+0x59/0xa0 [ 87.137569][ T87] kernel_init_freeable+0x29d/0x3e0 [ 87.139590][ T87] kernel_init+0x1d/0x1d0 [ 87.141480][ T87] ret_from_fork+0x514/0xb70 [ 87.143377][ T87] ret_from_fork_asm+0x1a/0x30 [ 87.145191][ T87] [ 87.146185][ T87] Second to last potentially related work creation: [ 87.148877][ T87] kasan_save_stack+0x3e/0x60 [ 87.150792][ T87] kasan_record_aux_stack+0xbd/0xd0 [ 87.153183][ T87] insert_work+0x3d/0x330 [ 87.155066][ T87] __queue_work+0xcd8/0x10a0 [ 87.157002][ T87] queue_work_on+0x106/0x1d0 [ 87.159097][ T87] usb_hcd_submit_urb+0xa3b/0x1b60 [ 87.161566][ T87] usb_start_wait_urb+0x13f/0x5b0 [ 87.164014][ T87] usb_control_msg+0x234/0x3e0 [ 87.166246][ T87] hub_suspend+0x891/0xad0 [ 87.168312][ T87] usb_suspend_both+0x285/0x1040 [ 87.170776][ T87] usb_runtime_suspend+0x58/0x110 [ 87.172953][ T87] __rpm_callback+0x2c7/0x950 [ 87.175090][ T87] rpm_suspend+0x8a0/0x17b0 [ 87.177053][ T87] __pm_runtime_suspend+0x12f/0x1a0 [ 87.179315][ T87] usb_new_device+0xadf/0x1620 [ 87.181405][ T87] register_root_hub+0x250/0x5c0 [ 87.183482][ T87] usb_add_hcd+0xac7/0xf80 [ 87.185136][ T87] vhci_hcd_probe+0x1fa/0x3e0 [ 87.187150][ T87] platform_probe+0xf9/0x190 [ 87.189186][ T87] really_probe+0x254/0xae0 [ 87.191094][ T87] __driver_probe_device+0x1e8/0x360 [ 87.193345][ T87] driver_probe_device+0x4f/0x240 [ 87.195583][ T87] __device_attach_driver+0x270/0x410 [ 87.197693][ T87] bus_for_each_drv+0x258/0x2f0 [ 87.199717][ T87] __device_attach+0x2c4/0x450 [ 87.201654][ T87] device_initial_probe+0xa1/0xd0 [ 87.203630][ T87] bus_probe_device+0x12a/0x220 [ 87.205736][ T87] device_add+0x7d7/0xb80 [ 87.207592][ T87] platform_device_add+0x4bd/0x860 [ 87.209789][ T87] platform_device_register_full+0x62d/0x710 [ 87.212081][ T87] vhci_hcd_init+0x227/0x360 [ 87.213984][ T87] do_one_initcall+0x250/0x870 [ 87.215786][ T87] do_initcall_level+0x10a/0x1a0 [ 87.217776][ T87] do_initcalls+0x59/0xa0 [ 87.219558][ T87] kernel_init_freeable+0x29d/0x3e0 [ 87.221615][ T87] kernel_init+0x1d/0x1d0 [ 87.223345][ T87] ret_from_fork+0x514/0xb70 [ 87.225198][ T87] ret_from_fork_asm+0x1a/0x30 [ 87.227144][ T87] [ 87.228122][ T87] The buggy address belongs to the object at ffff888034bfc000 [ 87.228122][ T87] which belongs to the cache kmalloc-8k of size 8192 [ 87.233548][ T87] The buggy address is located 2288 bytes inside of [ 87.233548][ T87] freed 8192-byte region [ffff888034bfc000, ffff888034bfe000) [ 87.239422][ T87] [ 87.240489][ T87] The buggy address belongs to the physical page: [ 87.243256][ T87] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34bf8 [ 87.246994][ T87] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 87.250695][ T87] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 87.253823][ T87] page_type: f5(slab) [ 87.255565][ T87] raw: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 87.259196][ T87] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 87.262787][ T87] head: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 87.266223][ T87] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 87.269794][ T87] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 87.273250][ T87] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 87.276509][ T87] page dumped because: kasan: bad access detected [ 87.279021][ T87] page_owner tracks the page as allocated [ 87.281419][ T87] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 16536060318, free_ts 16473502855 [ 87.289667][ T87] post_alloc_hook+0x1f9/0x250 [ 87.291654][ T87] get_page_from_freelist+0x21fa/0x2270 [ 87.293877][ T87] __alloc_frozen_pages_noprof+0x18d/0x380 [ 87.296300][ T87] allocate_slab+0x79/0x5e0 [ 87.298298][ T87] refill_objects+0x2d5/0x350 [ 87.300311][ T87] __pcs_replace_empty_main+0x2bf/0x6b0 [ 87.302591][ T87] __kmalloc_noprof+0x485/0x720 [ 87.304579][ T87] __usb_create_hcd+0x67/0x900 [ 87.306692][ T87] vhci_hcd_probe+0x1e6/0x3e0 [ 87.308754][ T87] platform_probe+0xf9/0x190 [ 87.310686][ T87] really_probe+0x254/0xae0 [ 87.312406][ T87] __driver_probe_device+0x1e8/0x360 [ 87.314641][ T87] driver_probe_device+0x4f/0x240 [ 87.316797][ T87] __device_attach_driver+0x270/0x410 [ 87.319098][ T87] bus_for_each_drv+0x258/0x2f0 [ 87.321214][ T87] __device_attach+0x2c4/0x450 [ 87.323294][ T87] page last free pid 9 tgid 9 stack trace: [ 87.325763][ T87] free_pages_prepare+0x960/0xa60 [ 87.327926][ T87] __free_contig_range_common+0x174/0x340 [ 87.330347][ T87] free_pages_bulk+0x48/0x120 [ 87.332391][ T87] vfree+0x224/0x4a0 [ 87.334079][ T87] delayed_vfree_work+0x55/0x80 [ 87.335985][ T87] process_scheduled_works+0xa8e/0x14e0 [ 87.338324][ T87] worker_thread+0xa47/0xfb0 [ 87.340258][ T87] kthread+0x388/0x470 [ 87.342001][ T87] ret_from_fork+0x514/0xb70 [ 87.343931][ T87] ret_from_fork_asm+0x1a/0x30 [ 87.345963][ T87] [ 87.346976][ T87] Memory state around the buggy address: [ 87.349298][ T87] ffff888034bfc780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 87.352629][ T87] ffff888034bfc800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 87.356034][ T87] >ffff888034bfc880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 87.359350][ T87] ^ [ 87.362446][ T87] ffff888034bfc900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 87.365940][ T87] ffff888034bfc980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 87.369259][ T87] ================================================================== [ 87.374546][ T5322] usb usb6: USB disconnect, device number 1 [ 87.403022][ T5322] vhci_hcd vhci_hcd.0: USB bus 6 deregistered