program:
r0 = perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400, 0xf6103, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_bp={0x0, 0x8}, 0x40, 0x0, 0x0, 0x0, 0x7, 0x0, 0xffff}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0b000000080000000c0000000000008001000000", @ANYRES32, @ANYBLOB="00003ad599cc", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r1}, 0x38)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r2)
syz_clone(0x40100000, 0x0, 0x0, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r4, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)
syz_mount_image$ext4(&(0x7f0000000440)='ext4\x00', &(0x7f0000000480)='./file1\x00', 0x0, &(0x7f00000004c0), 0x1, 0x434, &(0x7f0000000940)="$eJzs3E+IVVUcB/DfvTOjOY69MaKpCJQSLcJR37PaaosWbVwIQn+Ehnw64tMJ30RpQlogQkS0kAQhpmUE5aJFEUG0iaAWLQoiSagWYVghLdpNvHfvnXnoHahxxqvT5wN33rnnvbnfe7hwOQfu/QXwv7U2IrZFRF9EjEZELe9P8y2OZ1vnd8ca58Y7WxLT0zv/SCKJiGbj3HhxrCT/XJn/2y0Rcdu2JB7tvzq3feTogbFWq3k43980efC5Te0jRzfuPzi2r7mveaix9eF6fetDjUcWbqznR16Jen3bwAcb1p76+tPXv+uc71D+Xe84FlIyR+f2xQir0EBPOym53tx43jz9xidVnwMAcP2l+dy/vzv/r0VfZJO3C+efvlyLlwerPj8AAADg2k1P9+WfAAAAwNKVWPsDAADAElc8B9BsnBsvtuv17MHKByIubY+I4Sy/eL84+7a/+/5w5O+WDixC/r0XFuGg/0H78Wrzv9lVbf7q96rNn/qh2vxn1leb/8tP1eavW1Nt/umJiM+2ZwUQmo3lEdF7/0u7NQ8KyyJieV7TYMUC5a/5fPb+d+yq+186c//ri4hreRHr1NTFk2X9I49FXDoRcXd/WX4yk5/kNR3ma+O3J3aX9a++FDH9TsT66M1/f3w2dbY1d32ITXv3t5qbs7/l+Y2XnqyV9e/4Ihv/YJSPfzj/XV9PnYj5ODO4+6NVJf27RrP8++8rv/539oz/1rw2x/A88tfe1dpR1r/+tSx/zxzj773+q+eRW5j6rf1zWf+HW6/hoADAvKXduU2Sjs6003R0NJvv3R6DaWuiPfng3onnD+3J5kDDMZAWU61sPjKQdPa35HOTYr9+xX4jn0Ocqq3o7o8+O9HaU/XgAQAAYIkbivjxqVc/Hll5xfr/11q2/gcAAABufp31/z1Tb5/ttP8qfToSAAAAuNl11v+XT/7+ZVj/AwAAwJJl/Q8AAABLX7H+H5qj/t+qntp9m/P6w1/VBpYXtf4AAACAG19n/Z9+/8SF9pGjB8ZareZhDQ0NjZlG1XcoAABgoc1O+qs+EwAAAGDxpBeTiOhsG2rrhu5Y8+5I77fLkr+71QGWRcQLZ3e+9eLY5OThLZ3+P2f6J8/k/fV/FXh8ccYBAAAAFIp1erGOBwAAAAAAAAAAAAAAbnzXo5x41WMEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABg4fwTAAD//wB7l14=")
perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x9d, 0x2, 0x0, 0x0, 0x0, 0x0, 0x80214, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x2, @perf_bp={0x0, 0x1}, 0x0, 0xe7, 0x2000, 0x7, 0x6, 0x80000004, 0x2, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x6b142, 0x0)
r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00'}, 0x90)
bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r6, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
write$sndseq(r5, &(0x7f0000002480)=[{0x7, 0x8, 0xab, 0xff, @time={0x44fb, 0x8}, {0x4a, 0x5}, {0x6, 0x1}, @quote={{0x5, 0xf}, 0x367}}], 0x1c)
[ 109.102551][ T4652] Bluetooth: hci0: command tx timeout
[ 109.248247][ T5334] vhci_hcd vhci_hcd.0: remove, state 4
[ 109.275168][ T5334] usb usb7: USB disconnect, device number 1
[ 109.469613][ T5336] loop0: detected capacity change from 0 to 512
[ 109.721701][ T5336] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[ 109.745353][ T5336] ext4 filesystem being mounted at /0/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[ 109.792343][ T175] vhci_hcd vhci_hcd.0: stop threads
[ 109.801803][ T175] vhci_hcd vhci_hcd.0: release socket
[ 109.810429][ T175] vhci_hcd vhci_hcd.0: disconnect device
[ 109.823097][ T175] vhci_hcd vhci_hcd.0: stop threads
[ 109.828996][ T175] vhci_hcd vhci_hcd.0: release socket
[ 109.834878][ T175] vhci_hcd vhci_hcd.0: disconnect device
[ 109.842166][ T175] vhci_hcd vhci_hcd.0: stop threads
[ 109.847176][ T175] vhci_hcd vhci_hcd.0: release socket
[ 109.852554][ T175] vhci_hcd vhci_hcd.0: disconnect device
[ 109.859547][ T175] vhci_hcd vhci_hcd.0: stop threads
[ 109.865295][ T175] vhci_hcd vhci_hcd.0: release socket
[ 109.871599][ T175] vhci_hcd vhci_hcd.0: disconnect device
[ 109.881758][ T175] vhci_hcd vhci_hcd.0: stop threads
[ 109.888758][ T175] vhci_hcd vhci_hcd.0: release socket
[ 109.893883][ T175] vhci_hcd vhci_hcd.0: disconnect device
[ 109.900250][ T175] vhci_hcd vhci_hcd.0: stop threads
[ 109.907155][ T175] vhci_hcd vhci_hcd.0: release socket
[ 109.913100][ T175] vhci_hcd vhci_hcd.0: disconnect device
[ 109.920073][ T175] vhci_hcd vhci_hcd.0: stop threads
[ 109.925386][ T175] vhci_hcd vhci_hcd.0: release socket
[ 109.931144][ T175] vhci_hcd vhci_hcd.0: disconnect device
[ 109.937493][ T175] vhci_hcd vhci_hcd.0: stop threads
[ 109.944993][ T175] vhci_hcd vhci_hcd.0: release socket
[ 109.949806][ T175] vhci_hcd vhci_hcd.0: disconnect device
[ 109.952753][ T5334] vhci_hcd vhci_hcd.0: USB bus 7 deregistered
[ 109.967919][ T5334] vhci_hcd vhci_hcd.0: remove, state 4
[ 109.973552][ T5334] usb usb6: USB disconnect, device number 1
[ 110.024706][ T175] vhci_hcd vhci_hcd.0: stop threads
[ 110.033238][ T175] vhci_hcd vhci_hcd.0: release socket
[ 110.042842][ T175] vhci_hcd vhci_hcd.0: disconnect device
[ 110.047384][ T175] vhci_hcd vhci_hcd.0: stop threads
[ 110.050251][ T175] vhci_hcd vhci_hcd.0: release socket
[ 110.053261][ T175] vhci_hcd vhci_hcd.0: disconnect device
[ 110.059082][ T175] vhci_hcd vhci_hcd.0: stop threads
[ 110.066310][ T175] vhci_hcd vhci_hcd.0: release socket
[ 110.069999][ T5334] vhci_hcd vhci_hcd.0: USB bus 6 deregistered
[ 110.073300][ T175] vhci_hcd vhci_hcd.0: disconnect device
[ 110.081656][ T175] vhci_hcd vhci_hcd.0: stop threads
[ 110.090376][ T175] vhci_hcd vhci_hcd.0: release socket
[ 110.102003][ T175] vhci_hcd vhci_hcd.0: disconnect device
[ 110.109974][ T175] vhci_hcd vhci_hcd.0: stop threads
[ 110.122172][ T175] vhci_hcd vhci_hcd.0: release socket
[ 110.138224][ T175] ==================================================================
[ 110.142649][ T175] BUG: KASAN: slab-use-after-free in vhci_cleanup_unlink_list+0x452/0x460
[ 110.147678][ T175] Read of size 4 at addr ffff888033f28d90 by task kworker/u4:6/175
[ 110.151661][ T175]
[ 110.153104][ T175] CPU: 0 UID: 0 PID: 175 Comm: kworker/u4:6 Not tainted syzkaller #0 PREEMPT(full)
[ 110.153126][ T175] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 110.153136][ T175] Workqueue: usbip_event event_handler
[ 110.153159][ T175] Call Trace:
[ 110.153168][ T175]
[ 110.153176][ T175] dump_stack_lvl+0xe8/0x150
[ 110.153196][ T175] print_address_description+0x55/0x1e0
[ 110.153213][ T175] ? vhci_cleanup_unlink_list+0x452/0x460
[ 110.153228][ T175] print_report+0x58/0x70
[ 110.153244][ T175] kasan_report+0x117/0x150
[ 110.153262][ T175] ? vhci_cleanup_unlink_list+0x452/0x460
[ 110.153278][ T175] vhci_cleanup_unlink_list+0x452/0x460
[ 110.153292][ T175] ? kasan_quarantine_put+0xbb/0x1f0
[ 110.153309][ T175] vhci_shutdown_connection+0x2af/0x650
[ 110.153327][ T175] event_handler+0x2a4/0x4b0
[ 110.153341][ T175] ? process_scheduled_works+0xa20/0x14e0
[ 110.153355][ T175] process_scheduled_works+0xa8e/0x14e0
[ 110.153371][ T175] ? __pfx_process_scheduled_works+0x10/0x10
[ 110.153381][ T175] ? assign_work+0x3cf/0x5d0
[ 110.153391][ T175] worker_thread+0xa47/0xfb0
[ 110.153403][ T175] ? __kthread_parkme+0x71/0x1f0
[ 110.153416][ T175] kthread+0x388/0x470
[ 110.153427][ T175] ? __pfx_worker_thread+0x10/0x10
[ 110.153437][ T175] ? __pfx_kthread+0x10/0x10
[ 110.153448][ T175] ret_from_fork+0x514/0xb70
[ 110.153462][ T175] ? __pfx_ret_from_fork+0x10/0x10
[ 110.153476][ T175] ? __switch_to+0xc89/0x1420
[ 110.153492][ T175] ? __pfx_kthread+0x10/0x10
[ 110.153508][ T175] ret_from_fork_asm+0x1a/0x30
[ 110.153524][ T175]
[ 110.153528][ T175]
[ 110.245442][ T175] Allocated by task 1:
[ 110.247898][ T175] kasan_save_track+0x3e/0x80
[ 110.250576][ T175] __kasan_kmalloc+0x93/0xb0
[ 110.253223][ T175] __kmalloc_noprof+0x375/0x720
[ 110.255999][ T175] __usb_create_hcd+0x67/0x900
[ 110.259503][ T175] vhci_hcd_probe+0x104/0x3e0
[ 110.262775][ T175] platform_probe+0xf9/0x190
[ 110.265418][ T175] really_probe+0x254/0xae0
[ 110.268072][ T175] __driver_probe_device+0x1e8/0x360
[ 110.271192][ T175] driver_probe_device+0x4f/0x240
[ 110.274149][ T175] __device_attach_driver+0x270/0x410
[ 110.277436][ T175] bus_for_each_drv+0x258/0x2f0
[ 110.280281][ T175] __device_attach+0x2c4/0x450
[ 110.282847][ T175] device_initial_probe+0xa1/0xd0
[ 110.285578][ T175] bus_probe_device+0x12a/0x220
[ 110.288430][ T175] device_add+0x7d7/0xb80
[ 110.290760][ T175] platform_device_add+0x4bd/0x860
[ 110.293548][ T175] platform_device_register_full+0x62d/0x710
[ 110.296995][ T175] vhci_hcd_init+0x227/0x360
[ 110.300058][ T175] do_one_initcall+0x250/0x870
[ 110.302694][ T175] do_initcall_level+0x10a/0x1a0
[ 110.305549][ T175] do_initcalls+0x59/0xa0
[ 110.308509][ T175] kernel_init_freeable+0x29d/0x3e0
[ 110.311241][ T175] kernel_init+0x1d/0x1d0
[ 110.313291][ T175] ret_from_fork+0x514/0xb70
[ 110.315728][ T175] ret_from_fork_asm+0x1a/0x30
[ 110.318396][ T175]
[ 110.319818][ T175] Freed by task 5334:
[ 110.322222][ T175] kasan_save_track+0x3e/0x80
[ 110.325093][ T175] kasan_save_free_info+0x40/0x50
[ 110.328247][ T175] __kasan_slab_free+0x5c/0x80
[ 110.331137][ T175] kfree+0x1c5/0x640
[ 110.333646][ T175] vhci_hcd_remove+0xe4/0x110
[ 110.337156][ T175] device_release_driver_internal+0x48b/0x880
[ 110.341766][ T175] unbind_store+0x1a1/0x1d0
[ 110.344288][ T175] kernfs_fop_write_iter+0x3a4/0x540
[ 110.347605][ T175] vfs_write+0x612/0xba0
[ 110.350360][ T175] ksys_write+0x150/0x270
[ 110.352767][ T175] do_syscall_64+0x174/0x580
[ 110.355318][ T175] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 110.359035][ T175]
[ 110.360671][ T175] Last potentially related work creation:
[ 110.363745][ T175] kasan_save_stack+0x3e/0x60
[ 110.366500][ T175] kasan_record_aux_stack+0xbd/0xd0
[ 110.369608][ T175] insert_work+0x3d/0x330
[ 110.372214][ T175] __queue_work+0xcd8/0x10a0
[ 110.374771][ T175] queue_work_on+0x106/0x1d0
[ 110.377700][ T175] unlink1+0x344/0x3e0
[ 110.380546][ T175] usb_hcd_unlink_urb+0xe6/0x1e0
[ 110.383334][ T175] usb_kill_urb+0x10b/0x2f0
[ 110.386023][ T175] hub_quiesce+0x211/0x330
[ 110.388942][ T175] hub_suspend+0x904/0xad0
[ 110.391583][ T175] usb_suspend_both+0x285/0x1040
[ 110.394484][ T175] usb_runtime_suspend+0x58/0x110
[ 110.397493][ T175] __rpm_callback+0x2c7/0x950
[ 110.400793][ T175] rpm_suspend+0x8a0/0x17b0
[ 110.404277][ T175] __pm_runtime_suspend+0x12f/0x1a0
[ 110.407687][ T175] usb_new_device+0xadf/0x1620
[ 110.410597][ T175] register_root_hub+0x250/0x5c0
[ 110.413589][ T175] usb_add_hcd+0xac7/0xf80
[ 110.416120][ T175] vhci_hcd_probe+0x141/0x3e0
[ 110.418905][ T175] platform_probe+0xf9/0x190
[ 110.421582][ T175] really_probe+0x254/0xae0
[ 110.424234][ T175] __driver_probe_device+0x1e8/0x360
[ 110.427216][ T175] driver_probe_device+0x4f/0x240
[ 110.429777][ T175] __device_attach_driver+0x270/0x410
[ 110.432381][ T175] bus_for_each_drv+0x258/0x2f0
[ 110.434672][ T175] __device_attach+0x2c4/0x450
[ 110.436957][ T175] device_initial_probe+0xa1/0xd0
[ 110.439541][ T175] bus_probe_device+0x12a/0x220
[ 110.441709][ T175] device_add+0x7d7/0xb80
[ 110.443669][ T175] platform_device_add+0x4bd/0x860
[ 110.446061][ T175] platform_device_register_full+0x62d/0x710
[ 110.448834][ T175] vhci_hcd_init+0x227/0x360
[ 110.451087][ T175] do_one_initcall+0x250/0x870
[ 110.453387][ T175] do_initcall_level+0x10a/0x1a0
[ 110.455964][ T175] do_initcalls+0x59/0xa0
[ 110.458752][ T175] kernel_init_freeable+0x29d/0x3e0
[ 110.461711][ T175] kernel_init+0x1d/0x1d0
[ 110.463942][ T175] ret_from_fork+0x514/0xb70
[ 110.466264][ T175] ret_from_fork_asm+0x1a/0x30
[ 110.468717][ T175]
[ 110.470005][ T175] Second to last potentially related work creation:
[ 110.473379][ T175] kasan_save_stack+0x3e/0x60
[ 110.475596][ T175] kasan_record_aux_stack+0xbd/0xd0
[ 110.478081][ T175] insert_work+0x3d/0x330
[ 110.480469][ T175] __queue_work+0xcd8/0x10a0
[ 110.482929][ T175] queue_work_on+0x106/0x1d0
[ 110.485243][ T175] usb_hcd_submit_urb+0xa3b/0x1b60
[ 110.487535][ T175] usb_start_wait_urb+0x13f/0x5b0
[ 110.490146][ T175] usb_control_msg+0x234/0x3e0
[ 110.493044][ T175] hub_ext_port_status+0x114/0x810
[ 110.496310][ T175] hub_activate+0x740/0x1b20
[ 110.498758][ T175] process_scheduled_works+0xa8e/0x14e0
[ 110.501250][ T175] worker_thread+0xa47/0xfb0
[ 110.503561][ T175] kthread+0x388/0x470
[ 110.505685][ T175] ret_from_fork+0x514/0xb70
[ 110.507841][ T175] ret_from_fork_asm+0x1a/0x30
[ 110.509799][ T175]
[ 110.511208][ T175] The buggy address belongs to the object at ffff888033f28000
[ 110.511208][ T175] which belongs to the cache kmalloc-8k of size 8192
[ 110.516646][ T175] The buggy address is located 3472 bytes inside of
[ 110.516646][ T175] freed 8192-byte region [ffff888033f28000, ffff888033f2a000)
[ 110.522491][ T175]
[ 110.523547][ T175] The buggy address belongs to the physical page:
[ 110.526374][ T175] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x33f28
[ 110.530182][ T175] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 110.533935][ T175] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff)
[ 110.537709][ T175] page_type: f5(slab)
[ 110.539951][ T175] raw: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000
[ 110.543969][ T175] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
[ 110.547971][ T175] head: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000
[ 110.552117][ T175] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
[ 110.556039][ T175] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 110.559723][ T175] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 110.563381][ T175] page dumped because: kasan: bad access detected
[ 110.566193][ T175] page_owner tracks the page as allocated
[ 110.568937][ T175] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 18424330235, free_ts 18405585290
[ 110.578241][ T175] post_alloc_hook+0x1f9/0x250
[ 110.580810][ T175] get_page_from_freelist+0x21fa/0x2270
[ 110.583419][ T175] __alloc_frozen_pages_noprof+0x18d/0x380
[ 110.586009][ T175] allocate_slab+0x79/0x5e0
[ 110.588053][ T175] refill_objects+0x2d5/0x350
[ 110.590288][ T175] __pcs_replace_empty_main+0x2bf/0x6b0
[ 110.592813][ T175] __kmalloc_noprof+0x485/0x720
[ 110.595056][ T175] acpi_ut_initialize_buffer+0xca/0x170
[ 110.597565][ T175] acpi_rs_create_pci_routing_table+0x1c0/0xd90
[ 110.600771][ T175] acpi_rs_get_prt_method_data+0xdf/0x150
[ 110.603453][ T175] acpi_get_irq_routing_table+0x98/0xe0
[ 110.606032][ T175] acpi_pci_irq_find_prt_entry+0x163/0x1040
[ 110.609137][ T175] acpi_pci_irq_lookup+0x45/0x690
[ 110.611845][ T175] acpi_pci_irq_enable+0x1ee/0x7a0
[ 110.614656][ T175] do_pci_enable_device+0x26f/0x4a0
[ 110.617399][ T175] pci_enable_device_flags+0x5ab/0x700
[ 110.620615][ T175] page last free pid 1367 tgid 1367 stack trace:
[ 110.624245][ T175] free_pages_prepare+0x960/0xa60
[ 110.626559][ T175] __free_contig_range_common+0x174/0x340
[ 110.628848][ T175] free_pages_bulk+0x48/0x120
[ 110.630957][ T175] vfree+0x224/0x4a0
[ 110.632661][ T175] delayed_vfree_work+0x55/0x80
[ 110.634730][ T175] process_scheduled_works+0xa8e/0x14e0
[ 110.636924][ T175] worker_thread+0xa47/0xfb0
[ 110.638911][ T175] kthread+0x388/0x470
[ 110.640663][ T175] ret_from_fork+0x514/0xb70
[ 110.642694][ T175] ret_from_fork_asm+0x1a/0x30
[ 110.644729][ T175]
[ 110.645790][ T175] Memory state around the buggy address:
[ 110.648215][ T175] ffff888033f28c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 110.651477][ T175] ffff888033f28d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 110.654811][ T175] >ffff888033f28d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 110.658034][ T175] ^
[ 110.660025][ T175] ffff888033f28e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 110.663420][ T175] ffff888033f28e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 110.666735][ T175] ==================================================================
[ 110.685440][ T5335] vhci_hcd vhci_hcd.0: USB/IP Virtual Host Controller
[ 110.774122][ T5335] vhci_hcd vhci_hcd.0: new USB bus registered, assigned bus number 6
[ 110.779444][ T5335] vhci_hcd vhci_hcd.0: created sysfs vhci_hcd.0
[ 110.810557][ T5335] usb usb6: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02
[ 110.845456][ T5335] usb usb6: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[ 110.852155][ T5335] usb usb6: Product: USB/IP Virtual Host Controller
[ 110.856385][ T5335] usb usb6: Manufacturer: Linux syzkaller vhci_hcd
[ 110.860053][ T5335] usb usb6: SerialNumber: vhci_hcd.0
[ 110.881325][ T5335] hub 6-0:1.0: USB hub found
[ 110.886374][ T5335] hub 6-0:1.0: 8 ports detected
[ 111.079923][ T5335] vhci_hcd vhci_hcd.0: USB/IP Virtual Host Controller
[ 111.163635][ T4652] Bluetooth: hci0: command tx timeout
[ 111.175389][ T5335] vhci_hcd vhci_hcd.0: new USB bus registered, assigned bus number 7
[ 111.188411][ T5335] usb usb7: We don't know the algorithms for LPM for this host, disabling LPM.
[ 111.212235][ T175] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 111.216645][ T175] CPU: 0 UID: 0 PID: 175 Comm: kworker/u4:6 Not tainted syzkaller #0 PREEMPT(full)
[ 111.222138][ T175] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 111.227454][ T175] Workqueue: usbip_event event_handler
[ 111.230516][ T175] Call Trace:
[ 111.232346][ T175]
[ 111.234172][ T175] vpanic+0x56c/0xa60
[ 111.236470][ T175] ? __pfx_vpanic+0x10/0x10
[ 111.238927][ T175] ? __pfx___schedule+0x10/0x10
[ 111.241828][ T175] panic+0xc5/0xd0
[ 111.243930][ T175] ? __pfx_panic+0x10/0x10
[ 111.246457][ T175] ? preempt_schedule_thunk+0x16/0x40
[ 111.249365][ T175] ? vhci_cleanup_unlink_list+0x452/0x460
[ 111.252764][ T175] check_panic_on_warn+0x89/0xb0
[ 111.255740][ T175] ? vhci_cleanup_unlink_list+0x452/0x460
[ 111.258993][ T175] end_report+0x73/0x170
[ 111.261659][ T175] ? vhci_cleanup_unlink_list+0x452/0x460
[ 111.265071][ T175] kasan_report+0x128/0x150
[ 111.267507][ T175] ? vhci_cleanup_unlink_list+0x452/0x460
[ 111.270674][ T175] vhci_cleanup_unlink_list+0x452/0x460
[ 111.273744][ T175] ? kasan_quarantine_put+0xbb/0x1f0
[ 111.276677][ T175] vhci_shutdown_connection+0x2af/0x650
[ 111.279875][ T175] event_handler+0x2a4/0x4b0
[ 111.282506][ T175] ? process_scheduled_works+0xa20/0x14e0
[ 111.285851][ T175] process_scheduled_works+0xa8e/0x14e0
[ 111.288907][ T175] ? __pfx_process_scheduled_works+0x10/0x10
[ 111.292174][ T175] ? assign_work+0x3cf/0x5d0
[ 111.294946][ T175] worker_thread+0xa47/0xfb0
[ 111.297831][ T175] ? __kthread_parkme+0x71/0x1f0
[ 111.300718][ T175] kthread+0x388/0x470
[ 111.303065][ T175] ? __pfx_worker_thread+0x10/0x10
[ 111.306047][ T175] ? __pfx_kthread+0x10/0x10
[ 111.308500][ T175] ret_from_fork+0x514/0xb70
[ 111.311081][ T175] ? __pfx_ret_from_fork+0x10/0x10
[ 111.313891][ T175] ? __switch_to+0xc89/0x1420
[ 111.316285][ T175] ? __pfx_kthread+0x10/0x10
[ 111.318605][ T175] ret_from_fork_asm+0x1a/0x30
[ 111.321273][ T175]
[ 111.323444][ T175] Kernel Offset: disabled
[ 111.325761][ T175] Rebooting in 86400 seconds..