program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = geteuid()
mount$nfs(&(0x7f0000000040)='sysfs\x00', &(0x7f0000000080)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', &(0x7f00000000c0), 0x1000008, &(0x7f0000000140)={[{'-'}, {'\x00'}, {'sysfs\x00'}, {'\xb2%#^:}D'}, {'^!\xc1}'}], [{@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@audit}, {@smackfshat={'smackfshat', 0x3d, 'sysfs\x00'}}, {@smackfshat={'smackfshat', 0x3d, '*'}}, {@permit_directio}, {@uid_gt={'uid>', r0}}]})
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='vhci_hcd.0\x00', 0xb)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) (async)
geteuid() (async)
mount$nfs(&(0x7f0000000040)='sysfs\x00', &(0x7f0000000080)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', &(0x7f00000000c0), 0x1000008, &(0x7f0000000140)={[{'-'}, {'\x00'}, {'sysfs\x00'}, {'\xb2%#^:}D'}, {'^!\xc1}'}], [{@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@audit}, {@smackfshat={'smackfshat', 0x3d, 'sysfs\x00'}}, {@smackfshat={'smackfshat', 0x3d, '*'}}, {@permit_directio}, {@uid_gt={'uid>', r0}}]}) (async)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) (async)
write(r1, &(0x7f0000000300)='vhci_hcd.0\x00', 0xb) (async)

[   78.797005][ T5285] Bluetooth: hci0: command tx timeout
[   78.928382][ T5322] nfs: Unknown parameter '-'
[   78.935098][ T5322] vhci_hcd vhci_hcd.0: remove, state 4
[   78.937803][ T5322] usb usb7: USB disconnect, device number 1
[   78.999502][ T1162] vhci_hcd vhci_hcd.0: stop threads
[   79.002372][ T1162] vhci_hcd vhci_hcd.0: release socket
[   79.005279][ T1162] vhci_hcd vhci_hcd.0: disconnect device
[   79.017502][ T5322] vhci_hcd vhci_hcd.0: USB bus 7 deregistered
[   79.021966][ T1162] vhci_hcd vhci_hcd.0: stop threads
[   79.026840][ T1162] vhci_hcd vhci_hcd.0: release socket
[   79.034804][ T1162] vhci_hcd vhci_hcd.0: disconnect device
[   79.043850][ T1162] vhci_hcd vhci_hcd.0: stop threads
[   79.050910][ T5322] vhci_hcd vhci_hcd.0: remove, state 4
[   79.053788][ T1162] ==================================================================
[   79.057913][ T1162] BUG: KASAN: slab-use-after-free in vhci_shutdown_connection+0x1d4/0x650
[   79.062104][ T1162] Read of size 8 at addr ffff8880348c49d0 by task kworker/u4:9/1162
[   79.065432][ T1162] 
[   79.066591][ T1162] CPU: 0 UID: 0 PID: 1162 Comm: kworker/u4:9 Not tainted syzkaller #0 PREEMPT(full) 
[   79.066604][ T1162] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   79.066610][ T1162] Workqueue: usbip_event event_handler
[   79.066625][ T1162] Call Trace:
[   79.066632][ T1162]  <TASK>
[   79.066636][ T1162]  dump_stack_lvl+0xe8/0x150
[   79.066650][ T1162]  print_address_description+0x55/0x1e0
[   79.066662][ T1162]  ? vhci_shutdown_connection+0x1d4/0x650
[   79.066671][ T1162]  print_report+0x58/0x70
[   79.066685][ T1162]  kasan_report+0x117/0x150
[   79.066702][ T1162]  ? vhci_shutdown_connection+0x1d4/0x650
[   79.066718][ T1162]  vhci_shutdown_connection+0x1d4/0x650
[   79.066734][ T1162]  event_handler+0x2a4/0x4b0
[   79.066747][ T1162]  ? process_scheduled_works+0xa20/0x14e0
[   79.066762][ T1162]  process_scheduled_works+0xa8e/0x14e0
[   79.066781][ T1162]  ? __pfx_process_scheduled_works+0x10/0x10
[   79.066797][ T1162]  ? assign_work+0x3cf/0x5d0
[   79.066812][ T1162]  worker_thread+0xa47/0xfb0
[   79.066830][ T1162]  ? __kthread_parkme+0x71/0x1f0
[   79.066849][ T1162]  kthread+0x388/0x470
[   79.066864][ T1162]  ? __pfx_worker_thread+0x10/0x10
[   79.066877][ T1162]  ? __pfx_kthread+0x10/0x10
[   79.066892][ T1162]  ret_from_fork+0x514/0xb70
[   79.066911][ T1162]  ? __pfx_ret_from_fork+0x10/0x10
[   79.066926][ T1162]  ? __switch_to+0xc89/0x1420
[   79.066941][ T1162]  ? __pfx_kthread+0x10/0x10
[   79.066958][ T1162]  ret_from_fork_asm+0x1a/0x30
[   79.066974][ T1162]  </TASK>
[   79.066979][ T1162] 
[   79.137253][ T1162] Allocated by task 1:
[   79.139210][ T1162]  kasan_save_track+0x3e/0x80
[   79.141524][ T1162]  __kasan_kmalloc+0x93/0xb0
[   79.143943][ T1162]  __kmalloc_noprof+0x375/0x720
[   79.146381][ T1162]  __usb_create_hcd+0x67/0x900
[   79.148657][ T1162]  vhci_hcd_probe+0x1e6/0x3e0
[   79.150912][ T1162]  platform_probe+0xf9/0x190
[   79.153166][ T1162]  really_probe+0x254/0xae0
[   79.155249][ T1162]  __driver_probe_device+0x1e8/0x360
[   79.157872][ T1162]  driver_probe_device+0x4f/0x240
[   79.160352][ T1162]  __device_attach_driver+0x270/0x410
[   79.163127][ T1162]  bus_for_each_drv+0x258/0x2f0
[   79.165489][ T1162]  __device_attach+0x2c4/0x450
[   79.167773][ T1162]  device_initial_probe+0xa1/0xd0
[   79.170234][ T1162]  bus_probe_device+0x12a/0x220
[   79.172768][ T1162]  device_add+0x7d7/0xb80
[   79.174938][ T1162]  platform_device_add+0x4bd/0x860
[   79.177242][ T1162]  platform_device_register_full+0x62d/0x710
[   79.180077][ T1162]  vhci_hcd_init+0x227/0x360
[   79.182711][ T1162]  do_one_initcall+0x250/0x870
[   79.185243][ T1162]  do_initcall_level+0x10a/0x1a0
[   79.187626][ T1162]  do_initcalls+0x59/0xa0
[   79.189719][ T1162]  kernel_init_freeable+0x29d/0x3e0
[   79.192279][ T1162]  kernel_init+0x1d/0x1d0
[   79.194545][ T1162]  ret_from_fork+0x514/0xb70
[   79.196961][ T1162]  ret_from_fork_asm+0x1a/0x30
[   79.199107][ T1162] 
[   79.200127][ T1162] Freed by task 5322:
[   79.201864][ T1162]  kasan_save_track+0x3e/0x80
[   79.204212][ T1162]  kasan_save_free_info+0x40/0x50
[   79.206939][ T1162]  __kasan_slab_free+0x5c/0x80
[   79.209279][ T1162]  kfree+0x1c5/0x640
[   79.210999][ T1162]  vhci_hcd_remove+0x9e/0x110
[   79.212979][ T1162]  device_release_driver_internal+0x48b/0x880
[   79.215858][ T1162]  unbind_store+0x1a1/0x1d0
[   79.218608][ T1162]  kernfs_fop_write_iter+0x3a4/0x540
[   79.221347][ T1162]  vfs_write+0x612/0xba0
[   79.223330][ T1162]  ksys_write+0x150/0x270
[   79.225572][ T1162]  do_syscall_64+0x174/0x580
[   79.227675][ T1162]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   79.230503][ T1162] 
[   79.231850][ T1162] Last potentially related work creation:
[   79.234702][ T1162]  kasan_save_stack+0x3e/0x60
[   79.236762][ T1162]  kasan_record_aux_stack+0xbd/0xd0
[   79.238997][ T1162]  insert_work+0x3d/0x330
[   79.241011][ T1162]  __queue_work+0xcd8/0x10a0
[   79.243302][ T1162]  queue_work_on+0x106/0x1d0
[   79.245937][ T1162]  unlink1+0x344/0x3e0
[   79.247990][ T1162]  usb_hcd_unlink_urb+0xe6/0x1e0
[   79.250340][ T1162]  usb_kill_urb+0x10b/0x2f0
[   79.252274][ T1162]  hub_quiesce+0x211/0x330
[   79.254289][ T1162]  hub_suspend+0x904/0xad0
[   79.256963][ T1162]  usb_suspend_both+0x285/0x1040
[   79.259966][ T1162]  usb_runtime_suspend+0x58/0x110
[   79.262440][ T1162]  __rpm_callback+0x2c7/0x950
[   79.264621][ T1162]  rpm_suspend+0x8a0/0x17b0
[   79.266703][ T1162]  __pm_runtime_suspend+0x12f/0x1a0
[   79.269079][ T1162]  usb_new_device+0xadf/0x1620
[   79.271304][ T1162]  register_root_hub+0x250/0x5c0
[   79.274083][ T1162]  usb_add_hcd+0xac7/0xf80
[   79.276763][ T1162]  vhci_hcd_probe+0x1fa/0x3e0
[   79.278950][ T1162]  platform_probe+0xf9/0x190
[   79.281039][ T1162]  really_probe+0x254/0xae0
[   79.283042][ T1162]  __driver_probe_device+0x1e8/0x360
[   79.285579][ T1162]  driver_probe_device+0x4f/0x240
[   79.288193][ T1162]  __device_attach_driver+0x270/0x410
[   79.290869][ T1162]  bus_for_each_drv+0x258/0x2f0
[   79.292921][ T1162]  __device_attach+0x2c4/0x450
[   79.294990][ T1162]  device_initial_probe+0xa1/0xd0
[   79.297418][ T1162]  bus_probe_device+0x12a/0x220
[   79.300473][ T1162]  device_add+0x7d7/0xb80
[   79.302989][ T1162]  platform_device_add+0x4bd/0x860
[   79.305225][ T1162]  platform_device_register_full+0x62d/0x710
[   79.307741][ T1162]  vhci_hcd_init+0x227/0x360
[   79.309873][ T1162]  do_one_initcall+0x250/0x870
[   79.312242][ T1162]  do_initcall_level+0x10a/0x1a0
[   79.314877][ T1162]  do_initcalls+0x59/0xa0
[   79.316852][ T1162]  kernel_init_freeable+0x29d/0x3e0
[   79.319104][ T1162]  kernel_init+0x1d/0x1d0
[   79.320988][ T1162]  ret_from_fork+0x514/0xb70
[   79.323327][ T1162]  ret_from_fork_asm+0x1a/0x30
[   79.325903][ T1162] 
[   79.327108][ T1162] Second to last potentially related work creation:
[   79.330056][ T1162]  kasan_save_stack+0x3e/0x60
[   79.332060][ T1162]  kasan_record_aux_stack+0xbd/0xd0
[   79.334541][ T1162]  insert_work+0x3d/0x330
[   79.337382][ T1162]  __queue_work+0xcd8/0x10a0
[   79.340072][ T1162]  queue_work_on+0x106/0x1d0
[   79.342120][ T1162]  usb_hcd_submit_urb+0xa3b/0x1b60
[   79.344265][ T1162]  usb_start_wait_urb+0x13f/0x5b0
[   79.346437][ T1162]  usb_control_msg+0x234/0x3e0
[   79.348640][ T1162]  hub_suspend+0x891/0xad0
[   79.351024][ T1162]  usb_suspend_both+0x285/0x1040
[   79.353531][ T1162]  usb_runtime_suspend+0x58/0x110
[   79.356001][ T1162]  __rpm_callback+0x2c7/0x950
[   79.357915][ T1162]  rpm_suspend+0x8a0/0x17b0
[   79.359763][ T1162]  __pm_runtime_suspend+0x12f/0x1a0
[   79.361948][ T1162]  usb_new_device+0xadf/0x1620
[   79.364599][ T1162]  register_root_hub+0x250/0x5c0
[   79.367500][ T1162]  usb_add_hcd+0xac7/0xf80
[   79.369640][ T1162]  vhci_hcd_probe+0x1fa/0x3e0
[   79.371684][ T1162]  platform_probe+0xf9/0x190
[   79.373823][ T1162]  really_probe+0x254/0xae0
[   79.376338][ T1162]  __driver_probe_device+0x1e8/0x360
[   79.379140][ T1162]  driver_probe_device+0x4f/0x240
[   79.381511][ T1162]  __device_attach_driver+0x270/0x410
[   79.383782][ T1162]  bus_for_each_drv+0x258/0x2f0
[   79.385909][ T1162]  __device_attach+0x2c4/0x450
[   79.388496][ T1162]  device_initial_probe+0xa1/0xd0
[   79.391673][ T1162]  bus_probe_device+0x12a/0x220
[   79.394157][ T1162]  device_add+0x7d7/0xb80
[   79.396175][ T1162]  platform_device_add+0x4bd/0x860
[   79.398444][ T1162]  platform_device_register_full+0x62d/0x710
[   79.401257][ T1162]  vhci_hcd_init+0x227/0x360
[   79.403676][ T1162]  do_one_initcall+0x250/0x870
[   79.406266][ T1162]  do_initcall_level+0x10a/0x1a0
[   79.408722][ T1162]  do_initcalls+0x59/0xa0
[   79.410712][ T1162]  kernel_init_freeable+0x29d/0x3e0
[   79.413095][ T1162]  kernel_init+0x1d/0x1d0
[   79.415297][ T1162]  ret_from_fork+0x514/0xb70
[   79.417906][ T1162]  ret_from_fork_asm+0x1a/0x30
[   79.420268][ T1162] 
[   79.421362][ T1162] The buggy address belongs to the object at ffff8880348c4000
[   79.421362][ T1162]  which belongs to the cache kmalloc-8k of size 8192
[   79.427447][ T1162] The buggy address is located 2512 bytes inside of
[   79.427447][ T1162]  freed 8192-byte region [ffff8880348c4000, ffff8880348c6000)
[   79.434241][ T1162] 
[   79.435308][ T1162] The buggy address belongs to the physical page:
[   79.438449][ T1162] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x348c0
[   79.443163][ T1162] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   79.447134][ T1162] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff)
[   79.451053][ T1162] page_type: f5(slab)
[   79.453287][ T1162] raw: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000
[   79.457433][ T1162] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
[   79.461652][ T1162] head: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000
[   79.466301][ T1162] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
[   79.470802][ T1162] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[   79.474637][ T1162] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[   79.478608][ T1162] page dumped because: kasan: bad access detected
[   79.482196][ T1162] page_owner tracks the page as allocated
[   79.485587][ T1162] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 13868210385, free_ts 13805244503
[   79.497125][ T1162]  post_alloc_hook+0x1f9/0x250
[   79.499776][ T1162]  get_page_from_freelist+0x21fa/0x2270
[   79.502260][ T1162]  __alloc_frozen_pages_noprof+0x18d/0x380
[   79.504885][ T1162]  allocate_slab+0x79/0x5e0
[   79.506951][ T1162]  refill_objects+0x2d5/0x350
[   79.509311][ T1162]  __pcs_replace_empty_main+0x2bf/0x6b0
[   79.512405][ T1162]  __kmalloc_noprof+0x485/0x720
[   79.515178][ T1162]  __usb_create_hcd+0x67/0x900
[   79.517440][ T1162]  vhci_hcd_probe+0x1e6/0x3e0
[   79.519590][ T1162]  platform_probe+0xf9/0x190
[   79.521583][ T1162]  really_probe+0x254/0xae0
[   79.523585][ T1162]  __driver_probe_device+0x1e8/0x360
[   79.526141][ T1162]  driver_probe_device+0x4f/0x240
[   79.528937][ T1162]  __device_attach_driver+0x270/0x410
[   79.531999][ T1162]  bus_for_each_drv+0x258/0x2f0
[   79.534669][ T1162]  __device_attach+0x2c4/0x450
[   79.536845][ T1162] page last free pid 802 tgid 802 stack trace:
[   79.539603][ T1162]  free_pages_prepare+0x960/0xa60
[   79.541791][ T1162]  __free_contig_range_common+0x174/0x340
[   79.544186][ T1162]  free_pages_bulk+0x48/0x120
[   79.546313][ T1162]  vfree+0x224/0x4a0
[   79.548228][ T1162]  delayed_vfree_work+0x55/0x80
[   79.551241][ T1162]  process_scheduled_works+0xa8e/0x14e0
[   79.554429][ T1162]  worker_thread+0xa47/0xfb0
[   79.556500][ T1162]  kthread+0x388/0x470
[   79.558246][ T1162]  ret_from_fork+0x514/0xb70
[   79.560240][ T1162]  ret_from_fork_asm+0x1a/0x30
[   79.562338][ T1162] 
[   79.563376][ T1162] Memory state around the buggy address:
[   79.566110][ T1162]  ffff8880348c4880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   79.570652][ T1162]  ffff8880348c4900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   79.574251][ T1162] >ffff8880348c4980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   79.577693][ T1162]                                                  ^
[   79.580866][ T1162]  ffff8880348c4a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   79.584819][ T1162]  ffff8880348c4a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   79.588284][ T1162] ==================================================================
[   79.592828][ T5322] usb usb6: USB disconnect, device number 1
[   79.631171][ T5322] vhci_hcd vhci_hcd.0: USB bus 6 deregistered