program: socketpair(0x1, 0x1, 0x0, &(0x7f0000000100)={0x0, 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, &(0x7f0000000180)) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/usb/drivers/usbip-host/match_busid\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='add 1-1\x00', 0x8) write(r1, &(0x7f0000000240)='add 2-1\x00', 0x8) close(r1) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/usb/drivers/usb/unbind\x00', 0x1, 0x0) write(r2, &(0x7f00000002c0)='1-1\x00', 0x4) write(r2, &(0x7f0000000340)='2-1\x00', 0x4) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/bus/usb/drivers/usbip-host/bind\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='1-1\x00', 0x4) write(r3, &(0x7f0000000400)='2-1\x00', 0x4) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/bus/usb/devices/1-1/usbip_sockfd\x00', 0x1, 0x0) write(r4, &(0x7f0000000480)='3\x00', 0x2) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/bus/usb/devices/2-1/usbip_sockfd\x00', 0x1, 0x0) write(r5, &(0x7f0000000500)='3\x00', 0x2) close(r5) nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0) write(r0, &(0x7f0000000540)="00000001000000010001000200"/48, 0x30) write(r0, &(0x7f0000000580)="00000002000000030001000200000000000000000000000100"/48, 0x30) [ 75.091536][ T5282] Bluetooth: hci0: command tx timeout [ 75.484236][ T5317] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 75.634319][ T5317] usb 5-1: Using ep0 maxpacket: 8 [ 75.640500][ T5317] usb 5-1: config 0 has an invalid interface number: 143 but max is 0 [ 75.643980][ T5317] usb 5-1: config 0 has no interface number 0 [ 75.646912][ T5317] usb 5-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 75.650900][ T5317] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 75.660973][ T5317] usb 5-1: config 0 descriptor?? [ 75.785713][ T5317] viperboard 5-1:0.143: version 0.00 found at bus 005 address 002 [ 75.861880][ T5317] viperboard-i2c viperboard-i2c.3.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 75.875121][ T5317] viperboard-i2c viperboard-i2c.3.auto: probe with driver viperboard-i2c failed with error -5 [ 75.997912][ T5319] usbip-host 1-1: usbip-host: register new device (bus 1 dev 2) [ 76.018774][ T5319] usbip-host 1-1: stub up [ 76.084816][ C0] usbip-host 1-1: endpoint 0 is stalled [ 76.091334][ T5317] usb 5-1: USB disconnect, device number 2 [ 76.102972][ T5326] ================================================================== [ 76.106380][ T5326] BUG: KASAN: slab-use-after-free in stub_rx_loop+0x2965/0x2ee0 [ 76.109541][ T5326] Read of size 4 at addr ffff8880445a4db0 by task stub_rx/5326 [ 76.112482][ T5326] [ 76.113447][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: stub_rx Not tainted syzkaller #0 PREEMPT(full) [ 76.113457][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 76.113462][ T5326] Call Trace: [ 76.113468][ T5326] [ 76.113473][ T5326] dump_stack_lvl+0xe8/0x150 [ 76.113491][ T5326] print_address_description+0x55/0x1e0 [ 76.113506][ T5326] ? stub_rx_loop+0x2965/0x2ee0 [ 76.113518][ T5326] print_report+0x58/0x70 [ 76.113530][ T5326] kasan_report+0x117/0x150 [ 76.113543][ T5326] ? stub_rx_loop+0x2965/0x2ee0 [ 76.113555][ T5326] stub_rx_loop+0x2965/0x2ee0 [ 76.113573][ T5326] ? __pfx_stub_rx_loop+0x10/0x10 [ 76.113586][ T5326] ? __kthread_parkme+0x196/0x1f0 [ 76.113600][ T5326] kthread+0x388/0x470 [ 76.113611][ T5326] ? __pfx_stub_rx_loop+0x10/0x10 [ 76.113618][ T5326] ? __pfx_kthread+0x10/0x10 [ 76.113626][ T5326] ret_from_fork+0x514/0xb70 [ 76.113636][ T5326] ? __pfx_ret_from_fork+0x10/0x10 [ 76.113644][ T5326] ? __switch_to+0xc89/0x1420 [ 76.113652][ T5326] ? __pfx_kthread+0x10/0x10 [ 76.113684][ T5326] ret_from_fork_asm+0x1a/0x30 [ 76.113693][ T5326] [ 76.113696][ T5326] [ 76.159592][ T5326] Allocated by task 5326: [ 76.161436][ T5326] kasan_save_track+0x3e/0x80 [ 76.163400][ T5326] __kasan_slab_alloc+0x6c/0x80 [ 76.165387][ T5326] kmem_cache_alloc_noprof+0x2a0/0x5f0 [ 76.167631][ T5326] stub_rx_loop+0xad9/0x2ee0 [ 76.169475][ T5326] kthread+0x388/0x470 [ 76.171178][ T5326] ret_from_fork+0x514/0xb70 [ 76.173163][ T5326] ret_from_fork_asm+0x1a/0x30 [ 76.175103][ T5326] [ 76.176115][ T5326] Freed by task 5327: [ 76.177792][ T5326] kasan_save_track+0x3e/0x80 [ 76.179600][ T5326] kasan_save_free_info+0x40/0x50 [ 76.181537][ T5326] __kasan_slab_free+0x5c/0x80 [ 76.183528][ T5326] kmem_cache_free+0x182/0x650 [ 76.185449][ T5326] stub_tx_loop+0x1b16/0x2800 [ 76.187428][ T5326] kthread+0x388/0x470 [ 76.189132][ T5326] ret_from_fork+0x514/0xb70 [ 76.191077][ T5326] ret_from_fork_asm+0x1a/0x30 [ 76.193043][ T5326] [ 76.194099][ T5326] The buggy address belongs to the object at ffff8880445a4d80 [ 76.194099][ T5326] which belongs to the cache stub_priv of size 64 [ 76.199598][ T5326] The buggy address is located 48 bytes inside of [ 76.199598][ T5326] freed 64-byte region [ffff8880445a4d80, ffff8880445a4dc0) [ 76.204974][ T5326] [ 76.206000][ T5326] The buggy address belongs to the physical page: [ 76.208602][ T5326] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880445a4e00 pfn:0x445a4 [ 76.212715][ T5326] flags: 0x4fff00000000200(workingset|node=1|zone=1|lastcpupid=0x7ff) [ 76.216197][ T5326] page_type: f5(slab) [ 76.218031][ T5326] raw: 04fff00000000200 ffff888033fa9140 ffff888037670108 ffff888037670108 [ 76.221900][ T5326] raw: ffff8880445a4e00 000000080020001c 00000000f5000000 0000000000000000 [ 76.225532][ T5326] page dumped because: kasan: bad access detected [ 76.228688][ T5326] page_owner tracks the page as allocated [ 76.230930][ T5326] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5326, tgid 5326 (stub_rx), ts 76083503823, free_ts 76029144117 [ 76.238947][ T5326] post_alloc_hook+0x1f9/0x250 [ 76.240922][ T5326] get_page_from_freelist+0x21fa/0x2270 [ 76.243139][ T5326] __alloc_frozen_pages_noprof+0x18d/0x380 [ 76.245539][ T5326] allocate_slab+0x79/0x5e0 [ 76.247450][ T5326] refill_objects+0x2d5/0x350 [ 76.249484][ T5326] __pcs_replace_empty_main+0x2bf/0x6b0 [ 76.251744][ T5326] kmem_cache_alloc_noprof+0x382/0x5f0 [ 76.253956][ T5326] stub_rx_loop+0xad9/0x2ee0 [ 76.255876][ T5326] kthread+0x388/0x470 [ 76.257628][ T5326] ret_from_fork+0x514/0xb70 [ 76.259522][ T5326] ret_from_fork_asm+0x1a/0x30 [ 76.261500][ T5326] page last free pid 5279 tgid 5279 stack trace: [ 76.264104][ T5326] __free_frozen_pages+0xc1e/0xd10 [ 76.266222][ T5326] __slab_free+0x274/0x2c0 [ 76.268107][ T5326] qlist_free_all+0x99/0x100 [ 76.269978][ T5326] kasan_quarantine_reduce+0x148/0x160 [ 76.272228][ T5326] __kasan_slab_alloc+0x22/0x80 [ 76.274218][ T5326] kmem_cache_alloc_noprof+0x2a0/0x5f0 [ 76.276501][ T5326] do_getname+0x2e/0x250 [ 76.278333][ T5326] vfs_fstatat+0x45/0x170 [ 76.280067][ T5326] __x64_sys_newfstatat+0x151/0x200 [ 76.282228][ T5326] do_syscall_64+0x174/0x580 [ 76.284050][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.286468][ T5326] [ 76.287502][ T5326] Memory state around the buggy address: [ 76.289898][ T5326] ffff8880445a4c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 76.293058][ T5326] ffff8880445a4d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 76.296173][ T5326] >ffff8880445a4d80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 76.299404][ T5326] ^ [ 76.301717][ T5326] ffff8880445a4e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 76.304947][ T5326] ffff8880445a4e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 76.308187][ T5326] ================================================================== [ 76.428260][ T1334] ieee802154 phy0 wpan0: encryption failed: -22 [ 76.431046][ T1334] ieee802154 phy1 wpan1: encryption failed: -22 [ 76.479167][ T5326] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 76.482138][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: stub_rx Not tainted syzkaller #0 PREEMPT(full) [ 76.485909][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 76.490040][ T5326] Call Trace: [ 76.491310][ T5326] [ 76.492365][ T5326] vpanic+0x56c/0xa60 [ 76.493806][ T5326] ? __pfx_vpanic+0x10/0x10 [ 76.495374][ T5326] panic+0xc5/0xd0 [ 76.496764][ T5326] ? __pfx_panic+0x10/0x10 [ 76.498378][ T5326] ? preempt_schedule_thunk+0x16/0x40 [ 76.500395][ T5326] ? stub_rx_loop+0x2965/0x2ee0 [ 76.502318][ T5326] ? preempt_schedule_thunk+0x16/0x40 [ 76.504391][ T5326] ? stub_rx_loop+0x2965/0x2ee0 [ 76.506310][ T5326] check_panic_on_warn+0x89/0xb0 [ 76.508256][ T5326] ? stub_rx_loop+0x2965/0x2ee0 [ 76.510347][ T5326] end_report+0x73/0x170 [ 76.512099][ T5326] ? stub_rx_loop+0x2965/0x2ee0 [ 76.514178][ T5326] kasan_report+0x128/0x150 [ 76.515999][ T5326] ? stub_rx_loop+0x2965/0x2ee0 [ 76.518212][ T5326] stub_rx_loop+0x2965/0x2ee0 [ 76.520185][ T5326] ? __pfx_stub_rx_loop+0x10/0x10 [ 76.522246][ T5326] ? __kthread_parkme+0x196/0x1f0 [ 76.524420][ T5326] kthread+0x388/0x470 [ 76.526154][ T5326] ? __pfx_stub_rx_loop+0x10/0x10 [ 76.528275][ T5326] ? __pfx_kthread+0x10/0x10 [ 76.530226][ T5326] ret_from_fork+0x514/0xb70 [ 76.532199][ T5326] ? __pfx_ret_from_fork+0x10/0x10 [ 76.534366][ T5326] ? __switch_to+0xc89/0x1420 [ 76.536252][ T5326] ? __pfx_kthread+0x10/0x10 [ 76.538202][ T5326] ret_from_fork_asm+0x1a/0x30 [ 76.540313][ T5326] [ 76.542035][ T5326] Kernel Offset: disabled [ 76.543888][ T5326] Rebooting in 86400 seconds..