program: socketpair(0x1, 0x1, 0x0, &(0x7f0000000100)={0x0, 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, &(0x7f0000000180)) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/usb/drivers/usbip-host/match_busid\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='add 1-1\x00', 0x8) write(r1, &(0x7f0000000240)='add 2-1\x00', 0x8) close(r1) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/usb/drivers/usb/unbind\x00', 0x1, 0x0) write(r2, &(0x7f00000002c0)='1-1\x00', 0x4) write(r2, &(0x7f0000000340)='2-1\x00', 0x4) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/bus/usb/drivers/usbip-host/bind\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='1-1\x00', 0x4) write(r3, &(0x7f0000000400)='2-1\x00', 0x4) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/bus/usb/devices/1-1/usbip_sockfd\x00', 0x1, 0x0) write(r4, &(0x7f0000000480)='3\x00', 0x2) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/bus/usb/devices/2-1/usbip_sockfd\x00', 0x1, 0x0) write(r5, &(0x7f0000000500)='3\x00', 0x2) close(r5) nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0) write(r0, &(0x7f0000000540)="00000001000000010001000200"/48, 0x30) [ 151.289998][ T5299] Bluetooth: hci0: command tx timeout [ 151.630039][ T110] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 151.780079][ T110] usb 5-1: Using ep0 maxpacket: 8 [ 151.785639][ T110] usb 5-1: config 0 has an invalid interface number: 143 but max is 0 [ 151.789016][ T110] usb 5-1: config 0 has no interface number 0 [ 151.792044][ T110] usb 5-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 151.796007][ T110] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 151.814927][ T110] usb 5-1: config 0 descriptor?? [ 151.940917][ T110] viperboard 5-1:0.143: version 0.00 found at bus 005 address 002 [ 152.006842][ T110] viperboard-i2c viperboard-i2c.3.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 152.024010][ T110] viperboard-i2c viperboard-i2c.3.auto: probe with driver viperboard-i2c failed with error -5 [ 152.220314][ T5337] usbip-host 1-1: usbip-host: register new device (bus 1 dev 2) [ 152.245167][ T5334] usbip-host 1-1: stub up [ 152.315245][ C0] usbip-host 1-1: endpoint 0 is stalled [ 152.326230][ T5338] ================================================================== [ 152.329725][ T5338] BUG: KASAN: slab-use-after-free in stub_rx_loop+0x2965/0x2ee0 [ 152.332952][ T5338] Read of size 4 at addr ffff88801f6dddb0 by task stub_rx/5338 [ 152.336268][ T5338] [ 152.337451][ T5338] CPU: 0 UID: 0 PID: 5338 Comm: stub_rx Not tainted syzkaller #0 PREEMPT(full) [ 152.337465][ T5338] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 152.337471][ T5338] Call Trace: [ 152.337478][ T5338] [ 152.337483][ T5338] dump_stack_lvl+0xe8/0x150 [ 152.337500][ T5338] print_address_description+0x55/0x1e0 [ 152.337515][ T5338] ? stub_rx_loop+0x2965/0x2ee0 [ 152.337526][ T5338] print_report+0x58/0x70 [ 152.337539][ T5338] kasan_report+0x117/0x150 [ 152.337553][ T5338] ? stub_rx_loop+0x2965/0x2ee0 [ 152.337565][ T5338] stub_rx_loop+0x2965/0x2ee0 [ 152.337582][ T5338] ? __pfx_stub_rx_loop+0x10/0x10 [ 152.337594][ T5338] ? __kthread_parkme+0x196/0x1f0 [ 152.337609][ T5338] kthread+0x388/0x470 [ 152.337624][ T5338] ? __pfx_stub_rx_loop+0x10/0x10 [ 152.337633][ T5338] ? __pfx_kthread+0x10/0x10 [ 152.337647][ T5338] ret_from_fork+0x514/0xb70 [ 152.337662][ T5338] ? __pfx_ret_from_fork+0x10/0x10 [ 152.337677][ T5338] ? __switch_to+0xc89/0x1420 [ 152.337689][ T5338] ? __pfx_kthread+0x10/0x10 [ 152.337702][ T5338] ret_from_fork_asm+0x1a/0x30 [ 152.337716][ T5338] [ 152.337721][ T5338] [ 152.384689][ T5338] Allocated by task 5338: [ 152.386485][ T5338] kasan_save_track+0x3e/0x80 [ 152.388433][ T5338] __kasan_slab_alloc+0x6c/0x80 [ 152.390524][ T5338] kmem_cache_alloc_noprof+0x2a0/0x5f0 [ 152.392867][ T5338] stub_rx_loop+0xad9/0x2ee0 [ 152.394809][ T5338] kthread+0x388/0x470 [ 152.396560][ T5338] ret_from_fork+0x514/0xb70 [ 152.398518][ T5338] ret_from_fork_asm+0x1a/0x30 [ 152.400584][ T5338] [ 152.401574][ T5338] Freed by task 5339: [ 152.403201][ T5338] kasan_save_track+0x3e/0x80 [ 152.405260][ T5338] kasan_save_free_info+0x40/0x50 [ 152.407471][ T5338] __kasan_slab_free+0x5c/0x80 [ 152.409488][ T5338] kmem_cache_free+0x182/0x650 [ 152.411384][ T5338] stub_tx_loop+0x1b16/0x2800 [ 152.413314][ T5338] kthread+0x388/0x470 [ 152.414896][ T5338] ret_from_fork+0x514/0xb70 [ 152.416778][ T5338] ret_from_fork_asm+0x1a/0x30 [ 152.418891][ T5338] [ 152.419970][ T5338] The buggy address belongs to the object at ffff88801f6ddd80 [ 152.419970][ T5338] which belongs to the cache stub_priv of size 64 [ 152.425650][ T5338] The buggy address is located 48 bytes inside of [ 152.425650][ T5338] freed 64-byte region [ffff88801f6ddd80, ffff88801f6dddc0) [ 152.431387][ T5338] [ 152.432471][ T5338] The buggy address belongs to the physical page: [ 152.435218][ T5338] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88801f6dde00 pfn:0x1f6dd [ 152.439171][ T5338] flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff) [ 152.442069][ T5338] page_type: f5(slab) [ 152.443777][ T5338] raw: 00fff00000000200 ffff888032b12b40 ffff888037baa048 ffff888037baa048 [ 152.447158][ T5338] raw: ffff88801f6dde00 000000080020001c 00000000f5000000 0000000000000000 [ 152.450349][ T5338] page dumped because: kasan: bad access detected [ 152.452885][ T5338] page_owner tracks the page as allocated [ 152.455151][ T5338] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5338, tgid 5338 (stub_rx), ts 152313975776, free_ts 151952724749 [ 152.463288][ T5338] post_alloc_hook+0x1f9/0x250 [ 152.465462][ T5338] get_page_from_freelist+0x21fa/0x2270 [ 152.467819][ T5338] __alloc_frozen_pages_noprof+0x18d/0x380 [ 152.470238][ T5338] allocate_slab+0x79/0x5e0 [ 152.472207][ T5338] refill_objects+0x2d5/0x350 [ 152.474270][ T5338] __pcs_replace_empty_main+0x2bf/0x6b0 [ 152.476667][ T5338] kmem_cache_alloc_noprof+0x382/0x5f0 [ 152.479021][ T5338] stub_rx_loop+0xad9/0x2ee0 [ 152.481067][ T5338] kthread+0x388/0x470 [ 152.482819][ T5338] ret_from_fork+0x514/0xb70 [ 152.484812][ T5338] ret_from_fork_asm+0x1a/0x30 [ 152.486886][ T5338] page last free pid 901 tgid 901 stack trace: [ 152.489537][ T5338] __free_frozen_pages+0xc1e/0xd10 [ 152.491685][ T5338] __slab_free+0x274/0x2c0 [ 152.493634][ T5338] qlist_free_all+0x99/0x100 [ 152.495577][ T5338] kasan_quarantine_reduce+0x148/0x160 [ 152.498025][ T5338] __kasan_slab_alloc+0x22/0x80 [ 152.500110][ T5338] kmem_cache_alloc_node_noprof+0x355/0x610 [ 152.502534][ T5338] __alloc_skb+0x1d7/0x7a0 [ 152.504411][ T5338] mld_newpack+0x165/0xcb0 [ 152.506377][ T5338] add_grec+0x119f/0x19d0 [ 152.508527][ T5338] mld_send_initial_cr+0x288/0x550 [ 152.510772][ T5338] mld_dad_work+0x3d/0x480 [ 152.512683][ T5338] process_scheduled_works+0xa8e/0x14e0 [ 152.514830][ T5338] worker_thread+0xa47/0xfb0 [ 152.516732][ T5338] kthread+0x388/0x470 [ 152.518533][ T5338] ret_from_fork+0x514/0xb70 [ 152.520647][ T5338] ret_from_fork_asm+0x1a/0x30 [ 152.522636][ T5338] [ 152.523615][ T5338] Memory state around the buggy address: [ 152.525852][ T5338] ffff88801f6ddc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 152.528950][ T5338] ffff88801f6ddd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 152.532141][ T5338] >ffff88801f6ddd80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 152.535198][ T5338] ^ [ 152.537310][ T5338] ffff88801f6dde00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 152.540385][ T5338] ffff88801f6dde80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 152.543464][ T5338] ================================================================== [ 152.553132][ T110] usb 5-1: USB disconnect, device number 2 [ 152.651704][ T5338] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 152.654677][ T5338] CPU: 0 UID: 0 PID: 5338 Comm: stub_rx Not tainted syzkaller #0 PREEMPT(full) [ 152.658176][ T5338] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 152.662218][ T5338] Call Trace: [ 152.663588][ T5338] [ 152.664826][ T5338] vpanic+0x56c/0xa60 [ 152.666496][ T5338] ? __pfx_vpanic+0x10/0x10 [ 152.668448][ T5338] panic+0xc5/0xd0 [ 152.670023][ T5338] ? __pfx_panic+0x10/0x10 [ 152.671961][ T5338] ? preempt_schedule_thunk+0x16/0x40 [ 152.674223][ T5338] ? stub_rx_loop+0x2965/0x2ee0 [ 152.676302][ T5338] ? preempt_schedule_thunk+0x16/0x40 [ 152.678539][ T5338] ? stub_rx_loop+0x2965/0x2ee0 [ 152.680704][ T5338] check_panic_on_warn+0x89/0xb0 [ 152.682711][ T5338] ? stub_rx_loop+0x2965/0x2ee0 [ 152.684740][ T5338] end_report+0x73/0x170 [ 152.686523][ T5338] ? stub_rx_loop+0x2965/0x2ee0 [ 152.688582][ T5338] kasan_report+0x128/0x150 [ 152.690528][ T5338] ? stub_rx_loop+0x2965/0x2ee0 [ 152.692471][ T5338] stub_rx_loop+0x2965/0x2ee0 [ 152.694445][ T5338] ? __pfx_stub_rx_loop+0x10/0x10 [ 152.696403][ T5338] ? __kthread_parkme+0x196/0x1f0 [ 152.698522][ T5338] kthread+0x388/0x470 [ 152.700187][ T5338] ? __pfx_stub_rx_loop+0x10/0x10 [ 152.702271][ T5338] ? __pfx_kthread+0x10/0x10 [ 152.704145][ T5338] ret_from_fork+0x514/0xb70 [ 152.706149][ T5338] ? __pfx_ret_from_fork+0x10/0x10 [ 152.708409][ T5338] ? __switch_to+0xc89/0x1420 [ 152.710358][ T5338] ? __pfx_kthread+0x10/0x10 [ 152.712408][ T5338] ret_from_fork_asm+0x1a/0x30 [ 152.714462][ T5338] [ 152.716156][ T5338] Kernel Offset: disabled [ 152.717861][ T5338] Rebooting in 86400 seconds..