program: r0 = gettid() timer_create(0x7, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)=0x0) timer_settime(r1, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000300)='vhci_hcd.0\x00', 0xb) syz_mount_image$ext4(&(0x7f0000000340)='ext4\x00', &(0x7f0000000980)='./file0\x00', 0x8000, &(0x7f0000000040)={[{@dax_inode}, {@nodioread_nolock}]}, 0x1, 0x519, &(0x7f00000009c0)="$eJzs3cFvI1cZAPBvJvE2u5tiFxAqlSgVLcpWsHbS0DZCCMoFTpWA5b6ExImi2HEUO2UTVZCK/wAhgcSJExck/gCkqgfEGVWqBBfEAQECIdjCAQnoII/HJevYSaBJnI1/P+mt35sZz/e9ifw8M56dCWBiPRURL0XEVEQ8GxHlYnpalDjole5yb99/daVbksiyO39JIimm9dfVbU9HxM3ibTMR8ZUvRnw9ORq3vbe/udxo1HeKdq3T3K619/ZvbzSX1+vr9a3FxYUXll5cen5pPiu8p35W+pUffeGzr3/yG7+9+6db3+ym9ZkPRSkG+nGWel0v5duir7uNds4j2BhMFf0pjTsRAABOpbuP//6I+Fi+/1+OqXxvbsDUODIDAAAAzkr2udn4VxKRAQAAAFdWGhGzkaTV4lqA2UjTa8W5gQ/GjbTRanc+sdba3VrtzouoRCld22jU54trhStRSrrtheIa2377uYH2YkQ8FhHfLV/P29WVVmN1zOc+AAAAYFLcHDj+/3s5zesnG/L/BAAAAIDLqzKyAQAAAFwVDvkBAADg6hs8/n99THkAAAAA5+JLL7/cLVn/+derr+ztbrZeub1ab29Wm7sr1ZXWznZ1vdVaz+/Z1zxpfY1Wa/tTsbV7r9aptzu19t7+3WZrd6tzd+OBR2ADAAAAF+ixj77xqyQiDj59PS9R3AcQ4AG/H3cCwFmaGncCwNi4izdMrlK/cm28eQDjk5ww38U7AADw8Jv78NHf//unAkpjzQw4b671AYDJ4/d/mFwlVwDCREsj4n296iOjlhn5+/8vThslyyLeLB+e4vwiAABcrNm8JGm1OA6YjTStViMejUgrUUrWNhr1+eL44Jfl0iPd9kL+zuTEa4YBAAAAAAAAAAAAAAAAAAAAAAAAgJ4sSyIDAAAArrSI9I9Jfjf/iLnyM7OD5weuJf8oxx+Kxg/ufO/ecqezs9Cd/tf8WV7XIqLz/TulfPpzIx8fBgAAAJy15GDkrN5xevG6cKFZAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAB3r7/6kq/XGTcP38+IirD4k/HTP46E6WIuPG3JKYPvS+JiKkziH/wWkQ8Pix+Eu9kWVYpshgW//o5x6/km2Z4/DQibp5BfJhkb3THn5eGff7SeCp/Hf75my7KezV6/EuLyI/n49yw8efRI2trDo3xxFs/qY2M/1rEE9PDx5/++JuMiP/0kbX9M8uyozG+9tX9/VHxsx9GzA39/kkeiFXrNLdr7b392xvN5fX6en1rcXHhhaUXl55fmq+tbTTqxb9DY3znIz9957j+3xgS/ze/7o2/x/X/mVErHfDvt+7d/0CvWhoW/9bTQ79/Z2JE/LT47vt4Ue/On+vXD3r1w5788ZtPHtf/1RHb/6S//61T9v/ZL3/7d6dcFAC4AO29/c3lRqO+c0xl5hTLPIyVn81cijT+x0r2rd5f7rLk8/9Wunur/53S79UlSOxQJbuwWFNxSbr8bmWswxIAAHAOfv7uTv+4MwEAAAAAAAAAAAAAAAAAAIDJdRG3ExuMeTCergIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHOs/AQAA//9GB9/T") syz_mount_image$vfat(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200), 0x1, 0x175, &(0x7f0000000240)="$eJzs279qU1EABvAvNmrVIRmcxOGCi1NI+gQWqSAGBCWDgqDYFqRXChYCOthuLj6Ez9QncewgHGlv6Z+QDg71QvL7Lfng5INzhnvPPRfu+4efdzZ397aH7w6z2umk+yRVjjrp50ZW0jgIALBIjkrJ71JKuX2QO79SSml7RgDAdbP/A8Dysf8DwPKx/wPA8nn95u2L9fF441VVrSb1j+lkOml+m/H17XxKna0M08ufHD8gnGrys+fjjWF1op+f9f5pf386WbncH6WX/vz+qOlXl/s3c/dify293J/fX5vbv5XHjy70B+nl8GN2U2czx93z/vdRVT19OZ7p3zv5HwAAACyCQXVm7vl9MLhqvOn/w/uBmfN1Nw+67a4dAJbV3tdvOx/qeuuLIAjCWWj7zgRct/OLvu2ZAAAAAAAAAAAAAAAAV/kfnxO1vUYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACY9TcAAP//xBqwEw==") chmod(&(0x7f0000000180)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000240)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) [ 92.598131][ T45] Bluetooth: hci0: command tx timeout [ 92.610937][ T1238] cfg80211: failed to load regulatory.db [ 92.679290][ T5318] vhci_hcd vhci_hcd.0: remove, state 4 [ 92.695340][ T5318] usb usb7: USB disconnect, device number 1 [ 92.767708][ T5319] loop0: detected capacity change from 0 to 512 [ 92.826322][ T5319] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 92.911133][ T1050] vhci_hcd vhci_hcd.0: stop threads [ 92.915561][ T5318] vhci_hcd vhci_hcd.0: USB bus 7 deregistered [ 92.919446][ T1050] vhci_hcd vhci_hcd.0: release socket [ 92.926305][ T1050] vhci_hcd vhci_hcd.0: disconnect device [ 92.931300][ T5319] EXT4-fs error (device loop0): ext4_do_update_inode:5742: inode #3: comm syz.0.0: corrupted inode contents [ 92.936747][ T1050] vhci_hcd vhci_hcd.0: stop threads [ 92.939972][ T1050] vhci_hcd vhci_hcd.0: release socket [ 92.944006][ T1050] vhci_hcd vhci_hcd.0: disconnect device [ 92.948691][ T1050] vhci_hcd vhci_hcd.0: stop threads [ 92.956715][ T5318] vhci_hcd vhci_hcd.0: remove, state 4 [ 92.959124][ T1050] ================================================================== [ 92.962456][ T1050] BUG: KASAN: slab-use-after-free in vhci_shutdown_connection+0x1d4/0x650 [ 92.966029][ T1050] Read of size 8 at addr ffff888034a349d0 by task kworker/u4:7/1050 [ 92.969316][ T1050] [ 92.970391][ T1050] CPU: 0 UID: 0 PID: 1050 Comm: kworker/u4:7 Not tainted syzkaller #0 PREEMPT(full) [ 92.970404][ T1050] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 92.970411][ T1050] Workqueue: usbip_event event_handler [ 92.970426][ T1050] Call Trace: [ 92.970432][ T1050] [ 92.970438][ T1050] dump_stack_lvl+0xe8/0x150 [ 92.970453][ T1050] print_address_description+0x55/0x1e0 [ 92.970466][ T1050] ? vhci_shutdown_connection+0x1d4/0x650 [ 92.970477][ T1050] print_report+0x58/0x70 [ 92.970488][ T1050] kasan_report+0x117/0x150 [ 92.970501][ T1050] ? vhci_shutdown_connection+0x1d4/0x650 [ 92.970514][ T1050] vhci_shutdown_connection+0x1d4/0x650 [ 92.970527][ T1050] event_handler+0x2a4/0x4b0 [ 92.970536][ T1050] ? process_scheduled_works+0xa20/0x14e0 [ 92.970547][ T1050] process_scheduled_works+0xa8e/0x14e0 [ 92.970563][ T1050] ? __pfx_process_scheduled_works+0x10/0x10 [ 92.970575][ T1050] ? assign_work+0x3cf/0x5d0 [ 92.970586][ T1050] worker_thread+0xa47/0xfb0 [ 92.970600][ T1050] ? __kthread_parkme+0x71/0x1f0 [ 92.970613][ T1050] kthread+0x388/0x470 [ 92.970625][ T1050] ? __pfx_worker_thread+0x10/0x10 [ 92.970635][ T1050] ? __pfx_kthread+0x10/0x10 [ 92.970647][ T1050] ret_from_fork+0x514/0xb70 [ 92.970663][ T1050] ? __pfx_ret_from_fork+0x10/0x10 [ 92.970675][ T1050] ? __switch_to+0xc89/0x1420 [ 92.970686][ T1050] ? __pfx_kthread+0x10/0x10 [ 92.970699][ T1050] ret_from_fork_asm+0x1a/0x30 [ 92.970716][ T1050] [ 92.970720][ T1050] [ 93.033284][ T1050] Allocated by task 1: [ 93.035015][ T1050] kasan_save_track+0x3e/0x80 [ 93.036957][ T1050] __kasan_kmalloc+0x93/0xb0 [ 93.038955][ T1050] __kmalloc_noprof+0x375/0x720 [ 93.041002][ T1050] __usb_create_hcd+0x67/0x900 [ 93.042952][ T1050] vhci_hcd_probe+0x1e6/0x3e0 [ 93.044848][ T1050] platform_probe+0xf9/0x190 [ 93.046851][ T1050] really_probe+0x254/0xae0 [ 93.048725][ T1050] __driver_probe_device+0x1e8/0x360 [ 93.050937][ T1050] driver_probe_device+0x4f/0x240 [ 93.053082][ T1050] __device_attach_driver+0x270/0x410 [ 93.055450][ T1050] bus_for_each_drv+0x258/0x2f0 [ 93.057658][ T1050] __device_attach+0x2c4/0x450 [ 93.059899][ T1050] device_initial_probe+0xa1/0xd0 [ 93.062053][ T1050] bus_probe_device+0x12a/0x220 [ 93.064344][ T1050] device_add+0x7d7/0xb80 [ 93.066531][ T1050] platform_device_add+0x4bd/0x860 [ 93.068425][ T1050] platform_device_register_full+0x62d/0x710 [ 93.070774][ T1050] vhci_hcd_init+0x227/0x360 [ 93.072635][ T1050] do_one_initcall+0x250/0x870 [ 93.074489][ T1050] do_initcall_level+0x10a/0x1a0 [ 93.076511][ T1050] do_initcalls+0x59/0xa0 [ 93.078159][ T1050] kernel_init_freeable+0x29d/0x3e0 [ 93.080186][ T1050] kernel_init+0x1d/0x1d0 [ 93.081891][ T1050] ret_from_fork+0x514/0xb70 [ 93.083808][ T1050] ret_from_fork_asm+0x1a/0x30 [ 93.085672][ T1050] [ 93.086770][ T1050] Freed by task 5318: [ 93.088453][ T1050] kasan_save_track+0x3e/0x80 [ 93.090365][ T1050] kasan_save_free_info+0x40/0x50 [ 93.092333][ T1050] __kasan_slab_free+0x5c/0x80 [ 93.094118][ T1050] kfree+0x1c5/0x640 [ 93.095648][ T1050] vhci_hcd_remove+0x9e/0x110 [ 93.097641][ T1050] device_release_driver_internal+0x48b/0x880 [ 93.100150][ T1050] unbind_store+0x1a1/0x1d0 [ 93.102122][ T1050] kernfs_fop_write_iter+0x3a4/0x540 [ 93.104350][ T1050] vfs_write+0x612/0xba0 [ 93.106162][ T1050] ksys_write+0x150/0x270 [ 93.108003][ T1050] do_syscall_64+0x174/0x580 [ 93.109880][ T1050] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.112264][ T1050] [ 93.113294][ T1050] Last potentially related work creation: [ 93.115686][ T1050] kasan_save_stack+0x3e/0x60 [ 93.117537][ T1050] kasan_record_aux_stack+0xbd/0xd0 [ 93.119634][ T1050] insert_work+0x3d/0x330 [ 93.121388][ T1050] __queue_work+0xcd8/0x10a0 [ 93.123337][ T1050] queue_work_on+0x106/0x1d0 [ 93.125295][ T1050] unlink1+0x344/0x3e0 [ 93.127034][ T1050] usb_hcd_unlink_urb+0xe6/0x1e0 [ 93.128993][ T1050] usb_kill_urb+0x10b/0x2f0 [ 93.130860][ T1050] hub_quiesce+0x211/0x330 [ 93.132706][ T1050] hub_suspend+0x904/0xad0 [ 93.134619][ T1050] usb_suspend_both+0x285/0x1040 [ 93.136759][ T1050] usb_runtime_suspend+0x58/0x110 [ 93.138891][ T1050] __rpm_callback+0x2c7/0x950 [ 93.140855][ T1050] rpm_suspend+0x8a0/0x17b0 [ 93.142646][ T1050] __pm_runtime_suspend+0x12f/0x1a0 [ 93.144725][ T1050] usb_new_device+0xaee/0x1690 [ 93.146658][ T1050] register_root_hub+0x250/0x5c0 [ 93.148697][ T1050] usb_add_hcd+0xac7/0xf80 [ 93.150529][ T1050] vhci_hcd_probe+0x1fa/0x3e0 [ 93.152607][ T1050] platform_probe+0xf9/0x190 [ 93.154579][ T1050] really_probe+0x254/0xae0 [ 93.156534][ T1050] __driver_probe_device+0x1e8/0x360 [ 93.158800][ T1050] driver_probe_device+0x4f/0x240 [ 93.160893][ T1050] __device_attach_driver+0x270/0x410 [ 93.162943][ T1050] bus_for_each_drv+0x258/0x2f0 [ 93.164665][ T1050] __device_attach+0x2c4/0x450 [ 93.166772][ T1050] device_initial_probe+0xa1/0xd0 [ 93.168984][ T1050] bus_probe_device+0x12a/0x220 [ 93.170913][ T1050] device_add+0x7d7/0xb80 [ 93.172695][ T1050] platform_device_add+0x4bd/0x860 [ 93.174699][ T1050] platform_device_register_full+0x62d/0x710 [ 93.177111][ T1050] vhci_hcd_init+0x227/0x360 [ 93.179017][ T1050] do_one_initcall+0x250/0x870 [ 93.181020][ T1050] do_initcall_level+0x10a/0x1a0 [ 93.182994][ T1050] do_initcalls+0x59/0xa0 [ 93.184564][ T1050] kernel_init_freeable+0x29d/0x3e0 [ 93.186538][ T1050] kernel_init+0x1d/0x1d0 [ 93.188280][ T1050] ret_from_fork+0x514/0xb70 [ 93.190012][ T1050] ret_from_fork_asm+0x1a/0x30 [ 93.191846][ T1050] [ 93.192774][ T1050] Second to last potentially related work creation: [ 93.195618][ T1050] kasan_save_stack+0x3e/0x60 [ 93.197598][ T1050] kasan_record_aux_stack+0xbd/0xd0 [ 93.199498][ T1050] insert_work+0x3d/0x330 [ 93.201078][ T1050] __queue_work+0xcd8/0x10a0 [ 93.202941][ T1050] queue_work_on+0x106/0x1d0 [ 93.204893][ T1050] usb_hcd_submit_urb+0xa3b/0x1b60 [ 93.207235][ T1050] usb_start_wait_urb+0x13f/0x5b0 [ 93.209247][ T1050] usb_control_msg+0x234/0x3e0 [ 93.211206][ T1050] hub_suspend+0x891/0xad0 [ 93.213057][ T1050] usb_suspend_both+0x285/0x1040 [ 93.214979][ T1050] usb_runtime_suspend+0x58/0x110 [ 93.217064][ T1050] __rpm_callback+0x2c7/0x950 [ 93.218968][ T1050] rpm_suspend+0x8a0/0x17b0 [ 93.221014][ T1050] __pm_runtime_suspend+0x12f/0x1a0 [ 93.223652][ T1050] usb_new_device+0xaee/0x1690 [ 93.225796][ T1050] register_root_hub+0x250/0x5c0 [ 93.227970][ T1050] usb_add_hcd+0xac7/0xf80 [ 93.229765][ T1050] vhci_hcd_probe+0x1fa/0x3e0 [ 93.231763][ T1050] platform_probe+0xf9/0x190 [ 93.233590][ T1050] really_probe+0x254/0xae0 [ 93.235479][ T1050] __driver_probe_device+0x1e8/0x360 [ 93.237700][ T1050] driver_probe_device+0x4f/0x240 [ 93.239735][ T1050] __device_attach_driver+0x270/0x410 [ 93.241769][ T1050] bus_for_each_drv+0x258/0x2f0 [ 93.243690][ T1050] __device_attach+0x2c4/0x450 [ 93.245627][ T1050] device_initial_probe+0xa1/0xd0 [ 93.247548][ T1050] bus_probe_device+0x12a/0x220 [ 93.249352][ T1050] device_add+0x7d7/0xb80 [ 93.251001][ T1050] platform_device_add+0x4bd/0x860 [ 93.253000][ T1050] platform_device_register_full+0x62d/0x710 [ 93.255313][ T1050] vhci_hcd_init+0x227/0x360 [ 93.257343][ T1050] do_one_initcall+0x250/0x870 [ 93.259373][ T1050] do_initcall_level+0x10a/0x1a0 [ 93.261495][ T1050] do_initcalls+0x59/0xa0 [ 93.263243][ T1050] kernel_init_freeable+0x29d/0x3e0 [ 93.265360][ T1050] kernel_init+0x1d/0x1d0 [ 93.267236][ T1050] ret_from_fork+0x514/0xb70 [ 93.269077][ T1050] ret_from_fork_asm+0x1a/0x30 [ 93.270998][ T1050] [ 93.271987][ T1050] The buggy address belongs to the object at ffff888034a34000 [ 93.271987][ T1050] which belongs to the cache kmalloc-8k of size 8192 [ 93.277370][ T1050] The buggy address is located 2512 bytes inside of [ 93.277370][ T1050] freed 8192-byte region [ffff888034a34000, ffff888034a36000) [ 93.282930][ T1050] [ 93.283924][ T1050] The buggy address belongs to the physical page: [ 93.286422][ T1050] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34a30 [ 93.290083][ T1050] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 93.293355][ T1050] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 93.296366][ T1050] page_type: f5(slab) [ 93.297990][ T1050] raw: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 93.301436][ T1050] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 93.305368][ T1050] head: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 93.308895][ T1050] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 93.312273][ T1050] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 93.315675][ T1050] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 93.319124][ T1050] page dumped because: kasan: bad access detected [ 93.321633][ T1050] page_owner tracks the page as allocated [ 93.323874][ T1050] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 16616903566, free_ts 16565721397 [ 93.331732][ T1050] post_alloc_hook+0x1f9/0x250 [ 93.333556][ T1050] get_page_from_freelist+0x21fa/0x2270 [ 93.335712][ T1050] __alloc_frozen_pages_noprof+0x18d/0x380 [ 93.337975][ T1050] allocate_slab+0x79/0x5e0 [ 93.339875][ T1050] refill_objects+0x2d5/0x350 [ 93.341798][ T1050] __pcs_replace_empty_main+0x2bf/0x6b0 [ 93.344137][ T1050] __kmalloc_cache_noprof+0x3a7/0x660 [ 93.346333][ T1050] dummy_hcd_init+0x3e2/0xd00 [ 93.348265][ T1050] do_one_initcall+0x250/0x870 [ 93.350135][ T1050] do_initcall_level+0x10a/0x1a0 [ 93.352170][ T1050] do_initcalls+0x59/0xa0 [ 93.353975][ T1050] kernel_init_freeable+0x29d/0x3e0 [ 93.356171][ T1050] kernel_init+0x1d/0x1d0 [ 93.357936][ T1050] ret_from_fork+0x514/0xb70 [ 93.359823][ T1050] ret_from_fork_asm+0x1a/0x30 [ 93.361813][ T1050] page last free pid 1 tgid 1 stack trace: [ 93.364205][ T1050] __free_frozen_pages+0xc1e/0xd10 [ 93.366033][ T1050] __slab_free+0x274/0x2c0 [ 93.367808][ T1050] qlist_free_all+0x99/0x100 [ 93.369643][ T1050] kasan_quarantine_reduce+0x148/0x160 [ 93.371689][ T1050] __kasan_slab_alloc+0x22/0x80 [ 93.373559][ T1050] __kmalloc_cache_noprof+0x2ab/0x660 [ 93.375728][ T1050] bus_add_driver+0x162/0x670 [ 93.377598][ T1050] driver_register+0x23a/0x320 [ 93.379453][ T1050] usb3503_init+0x2f/0x70 [ 93.381060][ T1050] do_one_initcall+0x250/0x870 [ 93.382939][ T1050] do_initcall_level+0x10a/0x1a0 [ 93.384932][ T1050] do_initcalls+0x59/0xa0 [ 93.386637][ T1050] kernel_init_freeable+0x29d/0x3e0 [ 93.388799][ T1050] kernel_init+0x1d/0x1d0 [ 93.390527][ T1050] ret_from_fork+0x514/0xb70 [ 93.392409][ T1050] ret_from_fork_asm+0x1a/0x30 [ 93.394386][ T1050] [ 93.395419][ T1050] Memory state around the buggy address: [ 93.397788][ T1050] ffff888034a34880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 93.400989][ T1050] ffff888034a34900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 93.403976][ T1050] >ffff888034a34980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 93.407107][ T1050] ^ [ 93.409691][ T1050] ffff888034a34a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 93.412767][ T1050] ffff888034a34a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 93.415929][ T1050] ================================================================== [ 93.421599][ T5319] loop0: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 93.422268][ C0] EXT4-fs (loop0): initial error at time 1786894814: ext4_do_update_inode:5742: inode 3 [ 93.430040][ C0] EXT4-fs (loop0): last error at time 1786894814: ext4_do_update_inode:5742: inode 3 [ 93.435183][ T5318] usb usb6: USB disconnect, device number 1 [ 93.476242][ T5318] vhci_hcd vhci_hcd.0: USB bus 6 deregistered [ 93.509053][ T5319] EXT4-fs error (device loop0): ext4_dirty_inode:6639: inode #3: comm syz.0.0: mark_inode_dirty error [ 93.520723][ T5319] loop0: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 93.531736][ T5319] EXT4-fs error (device loop0): ext4_do_update_inode:5742: inode #3: comm syz.0.0: corrupted inode contents [ 93.542816][ T5319] loop0: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 93.543354][ T5319] EXT4-fs error (device loop0): __ext4_ext_dirty:207: inode #3: comm syz.0.0: mark_inode_dirty error [ 93.553889][ T5319] loop0: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 93.554479][ T5319] Quota error (device loop0): write_blk: dquota write failed [ 93.562210][ T5319] Quota error (device loop0): qtree_write_dquot: Error -117 occurred while creating quota [ 93.566357][ T5319] EXT4-fs error (device loop0): ext4_acquire_dquot:7041: comm syz.0.0: Failed to acquire dquot type 0 [ 93.571332][ T5319] loop0: lost filesystem error report for type 5 error -117 [ 93.577869][ T5319] EXT4-fs error (device loop0): ext4_do_update_inode:5742: inode #16: comm syz.0.0: corrupted inode contents [ 93.587969][ T5319] loop0: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 93.590001][ T5319] EXT4-fs error (device loop0): ext4_dirty_inode:6639: inode #16: comm syz.0.0: mark_inode_dirty error [ 93.603669][ T1050] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 93.606723][ T1050] CPU: 0 UID: 0 PID: 1050 Comm: kworker/u4:7 Not tainted syzkaller #0 PREEMPT(full) [ 93.610383][ T1050] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.615170][ T1050] Workqueue: usbip_event event_handler [ 93.617898][ T1050] Call Trace: [ 93.619550][ T1050] [ 93.620915][ T1050] vpanic+0x56c/0xa60 [ 93.622562][ T1050] ? __pfx_vpanic+0x10/0x10 [ 93.624592][ T1050] ? __pfx___schedule+0x10/0x10 [ 93.626609][ T1050] panic+0xc5/0xd0 [ 93.628117][ T1050] ? __pfx_panic+0x10/0x10 [ 93.629988][ T1050] ? preempt_schedule_common+0x82/0xd0 [ 93.632157][ T1050] ? vhci_shutdown_connection+0x1d4/0x650 [ 93.634460][ T1050] check_panic_on_warn+0x89/0xb0 [ 93.636561][ T1050] ? vhci_shutdown_connection+0x1d4/0x650 [ 93.638925][ T1050] end_report+0x73/0x170 [ 93.640717][ T1050] ? vhci_shutdown_connection+0x1d4/0x650 [ 93.643009][ T1050] kasan_report+0x128/0x150 [ 93.644827][ T1050] ? vhci_shutdown_connection+0x1d4/0x650 [ 93.647932][ T1050] vhci_shutdown_connection+0x1d4/0x650 [ 93.650286][ T1050] event_handler+0x2a4/0x4b0 [ 93.652235][ T1050] ? process_scheduled_works+0xa20/0x14e0 [ 93.654636][ T1050] process_scheduled_works+0xa8e/0x14e0 [ 93.656987][ T1050] ? __pfx_process_scheduled_works+0x10/0x10 [ 93.659450][ T1050] ? assign_work+0x3cf/0x5d0 [ 93.661423][ T1050] worker_thread+0xa47/0xfb0 [ 93.663388][ T1050] ? __kthread_parkme+0x71/0x1f0 [ 93.665375][ T1050] kthread+0x388/0x470 [ 93.667097][ T1050] ? __pfx_worker_thread+0x10/0x10 [ 93.669150][ T1050] ? __pfx_kthread+0x10/0x10 [ 93.671070][ T1050] ret_from_fork+0x514/0xb70 [ 93.672939][ T1050] ? __pfx_ret_from_fork+0x10/0x10 [ 93.675200][ T1050] ? __switch_to+0xc89/0x1420 [ 93.677994][ T1050] ? __pfx_kthread+0x10/0x10 [ 93.680658][ T1050] ret_from_fork_asm+0x1a/0x30 [ 93.683261][ T1050] [ 93.685243][ T1050] Kernel Offset: disabled [ 93.687771][ T1050] Rebooting in 86400 seconds..