program:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f00000003c0)=@assoc_value={0x0, 0x68e5}, 0x8)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r0, 0x84, 0x1c, &(0x7f0000000040), &(0x7f0000000080)=0x4)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@updpolicy={0x13c, 0x19, 0x1, 0x70bd2a, 0x0, {{@in6=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x4, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0x0, 0x3}}, [@tmpl={0x84, 0x5, [{{@in=@local, 0x0, 0x3c}, 0x0, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x1ffd}, {{@in=@loopback, 0x0, 0x6c}, 0x0, @in6=@dev={0xfe, 0x80, '\x00', 0x3b}, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x81}]}]}, 0x13c}, 0x1, 0x0, 0x0, 0x40000}, 0x0)
r4 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=@updpolicy={0x188, 0x19, 0xfd3649826d894c67, 0x270bd28, 0x0, {{@in6=@mcast1, @in=@multicast1, 0xffbe, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x7, 0x0, 0x0, 0x100}, {0x0, 0x0, 0xfffffffffffffffe}}, [@tmpl={0xc4, 0x5, [{{@in6=@private2, 0x4d3, 0x2b}, 0xa, @in=@loopback, 0x3507, 0x4, 0x1, 0x6, 0x4, 0x9, 0x1}, {{@in6=@empty, 0x4d5, 0x3c}, 0xa, @in=@remote, 0x3502, 0x0, 0x0, 0xff, 0xe2, 0x5, 0x8}, {{@in=@local, 0x4d5, 0x6c}, 0x2, @in6=@mcast2, 0x0, 0x4, 0x0, 0xcb, 0x8, 0x4, 0x7fffffff}]}, @policy_type={0xa, 0x10, {0x1}}]}, 0x188}}, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000080)={@local, @random="429e82211cf8", @void, {@ipv6={0x86dd, @generic={0xa, 0x6, "7abd6a", 0x0, 0x67, 0x1, @private0, @mcast2}}}}, 0x0)
sendto$inet6(r0, &(0x7f0000000100)='O', 0x1, 0x6000800, &(0x7f0000000240)={0xa, 0x4e22, 0x64000, @loopback, 0x20000000}, 0x1c)
sendto$inet6(r0, &(0x7f0000000380)="a1", 0x34000, 0x0, 0x0, 0x0)
[ 86.619262][ T5289] Bluetooth: hci0: command tx timeout
[ 86.702192][ T5326] vhci_hcd vhci_hcd.0: remove, state 4
[ 86.717520][ T5326] usb usb7: USB disconnect, device number 1
[ 86.853357][ T68] vhci_hcd vhci_hcd.0: stop threads
[ 86.860279][ T68] vhci_hcd vhci_hcd.0: release socket
[ 86.863163][ T68] vhci_hcd vhci_hcd.0: disconnect device
[ 86.868222][ T68] vhci_hcd vhci_hcd.0: stop threads
[ 86.870274][ T68] vhci_hcd vhci_hcd.0: release socket
[ 86.872482][ T68] vhci_hcd vhci_hcd.0: disconnect device
[ 86.875668][ T68] vhci_hcd vhci_hcd.0: stop threads
[ 86.878028][ T68] vhci_hcd vhci_hcd.0: release socket
[ 86.880307][ T68] vhci_hcd vhci_hcd.0: disconnect device
[ 86.883758][ T68] vhci_hcd vhci_hcd.0: stop threads
[ 86.886431][ T68] vhci_hcd vhci_hcd.0: release socket
[ 86.892535][ T68] vhci_hcd vhci_hcd.0: disconnect device
[ 86.900649][ T68] vhci_hcd vhci_hcd.0: stop threads
[ 86.902919][ T5326] vhci_hcd vhci_hcd.0: USB bus 7 deregistered
[ 86.905579][ T68] vhci_hcd vhci_hcd.0: release socket
[ 86.909390][ T68] vhci_hcd vhci_hcd.0: disconnect device
[ 86.913772][ T68] vhci_hcd vhci_hcd.0: stop threads
[ 86.919498][ T68] vhci_hcd vhci_hcd.0: release socket
[ 86.927430][ T5326] vhci_hcd vhci_hcd.0: remove, state 4
[ 86.930029][ T68] ==================================================================
[ 86.933511][ T68] BUG: KASAN: slab-use-after-free in vhci_cleanup_unlink_list+0x452/0x460
[ 86.937099][ T68] Read of size 4 at addr ffff88803499cfe0 by task kworker/u4:4/68
[ 86.940220][ T68]
[ 86.941179][ T68] CPU: 0 UID: 0 PID: 68 Comm: kworker/u4:4 Not tainted syzkaller #0 PREEMPT(full)
[ 86.941189][ T68] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.941194][ T68] Workqueue: usbip_event event_handler
[ 86.941209][ T68] Call Trace:
[ 86.941214][ T68]
[ 86.941218][ T68] dump_stack_lvl+0xe8/0x150
[ 86.941231][ T68] print_address_description+0x55/0x1e0
[ 86.941245][ T68] ? vhci_cleanup_unlink_list+0x452/0x460
[ 86.941256][ T68] print_report+0x58/0x70
[ 86.941267][ T68] kasan_report+0x117/0x150
[ 86.941282][ T68] ? vhci_cleanup_unlink_list+0x452/0x460
[ 86.941296][ T68] vhci_cleanup_unlink_list+0x452/0x460
[ 86.941307][ T68] ? kasan_quarantine_put+0xbb/0x1f0
[ 86.941320][ T68] vhci_shutdown_connection+0x2af/0x650
[ 86.941330][ T68] event_handler+0x2a4/0x4b0
[ 86.941337][ T68] ? process_scheduled_works+0xa20/0x14e0
[ 86.941345][ T68] process_scheduled_works+0xa8e/0x14e0
[ 86.941356][ T68] ? __pfx_process_scheduled_works+0x10/0x10
[ 86.941364][ T68] ? assign_work+0x3cf/0x5d0
[ 86.941371][ T68] worker_thread+0xa47/0xfb0
[ 86.941382][ T68] kthread+0x388/0x470
[ 86.941392][ T68] ? __pfx_worker_thread+0x10/0x10
[ 86.941399][ T68] ? __pfx_kthread+0x10/0x10
[ 86.941407][ T68] ret_from_fork+0x514/0xb70
[ 86.941417][ T68] ? __pfx_ret_from_fork+0x10/0x10
[ 86.941425][ T68] ? __switch_to+0xc89/0x1420
[ 86.941434][ T68] ? __pfx_kthread+0x10/0x10
[ 86.941443][ T68] ret_from_fork_asm+0x1a/0x30
[ 86.941451][ T68]
[ 86.941454][ T68]
[ 87.005299][ T68] Allocated by task 1:
[ 87.007027][ T68] kasan_save_track+0x3e/0x80
[ 87.009043][ T68] __kasan_kmalloc+0x93/0xb0
[ 87.010882][ T68] __kmalloc_noprof+0x375/0x720
[ 87.012962][ T68] __usb_create_hcd+0x67/0x900
[ 87.014909][ T68] vhci_hcd_probe+0x1e6/0x3e0
[ 87.016651][ T68] platform_probe+0xf9/0x190
[ 87.018329][ T68] really_probe+0x254/0xae0
[ 87.020033][ T68] __driver_probe_device+0x1e8/0x360
[ 87.021874][ T68] driver_probe_device+0x4f/0x240
[ 87.024006][ T68] __device_attach_driver+0x270/0x410
[ 87.026032][ T68] bus_for_each_drv+0x258/0x2f0
[ 87.027988][ T68] __device_attach+0x2c4/0x450
[ 87.030094][ T68] device_initial_probe+0xa1/0xd0
[ 87.032069][ T68] bus_probe_device+0x12a/0x220
[ 87.033862][ T68] device_add+0x7d7/0xb80
[ 87.035512][ T68] platform_device_add+0x4bd/0x860
[ 87.037499][ T68] platform_device_register_full+0x62d/0x710
[ 87.039900][ T68] vhci_hcd_init+0x227/0x360
[ 87.041870][ T68] do_one_initcall+0x250/0x870
[ 87.043830][ T68] do_initcall_level+0x10a/0x1a0
[ 87.046100][ T68] do_initcalls+0x59/0xa0
[ 87.047956][ T68] kernel_init_freeable+0x29d/0x3e0
[ 87.050488][ T68] kernel_init+0x1d/0x1d0
[ 87.052836][ T68] ret_from_fork+0x514/0xb70
[ 87.054747][ T68] ret_from_fork_asm+0x1a/0x30
[ 87.057196][ T68]
[ 87.058464][ T68] Freed by task 5326:
[ 87.060544][ T68] kasan_save_track+0x3e/0x80
[ 87.062451][ T68] kasan_save_free_info+0x40/0x50
[ 87.064289][ T68] __kasan_slab_free+0x5c/0x80
[ 87.066068][ T68] kfree+0x1c5/0x640
[ 87.067632][ T68] vhci_hcd_remove+0x9e/0x110
[ 87.069451][ T68] device_release_driver_internal+0x48b/0x880
[ 87.072073][ T68] unbind_store+0x1a1/0x1d0
[ 87.074017][ T68] kernfs_fop_write_iter+0x3a4/0x540
[ 87.076284][ T68] vfs_write+0x612/0xba0
[ 87.078105][ T68] ksys_write+0x150/0x270
[ 87.080045][ T68] do_syscall_64+0x174/0x580
[ 87.081866][ T68] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.083951][ T68]
[ 87.084859][ T68] Last potentially related work creation:
[ 87.087026][ T68] kasan_save_stack+0x3e/0x60
[ 87.089015][ T68] kasan_record_aux_stack+0xbd/0xd0
[ 87.091151][ T68] insert_work+0x3d/0x330
[ 87.093011][ T68] __queue_work+0xcd8/0x10a0
[ 87.095028][ T68] queue_work_on+0x106/0x1d0
[ 87.096904][ T68] unlink1+0x344/0x3e0
[ 87.098636][ T68] usb_hcd_unlink_urb+0xe6/0x1e0
[ 87.100763][ T68] usb_kill_urb+0x10b/0x2f0
[ 87.102657][ T68] hub_quiesce+0x211/0x330
[ 87.104477][ T68] hub_suspend+0x904/0xad0
[ 87.106329][ T68] usb_suspend_both+0x285/0x1040
[ 87.108444][ T68] usb_runtime_suspend+0x58/0x110
[ 87.110553][ T68] __rpm_callback+0x2c7/0x950
[ 87.112562][ T68] rpm_suspend+0x8a0/0x17b0
[ 87.114419][ T68] __pm_runtime_suspend+0x12f/0x1a0
[ 87.116619][ T68] usb_new_device+0xadf/0x1620
[ 87.118782][ T68] register_root_hub+0x250/0x5c0
[ 87.121066][ T68] usb_add_hcd+0xac7/0xf80
[ 87.123128][ T68] vhci_hcd_probe+0x1fa/0x3e0
[ 87.125243][ T68] platform_probe+0xf9/0x190
[ 87.127298][ T68] really_probe+0x254/0xae0
[ 87.129322][ T68] __driver_probe_device+0x1e8/0x360
[ 87.131756][ T68] driver_probe_device+0x4f/0x240
[ 87.134051][ T68] __device_attach_driver+0x270/0x410
[ 87.136469][ T68] bus_for_each_drv+0x258/0x2f0
[ 87.138664][ T68] __device_attach+0x2c4/0x450
[ 87.140935][ T68] device_initial_probe+0xa1/0xd0
[ 87.143222][ T68] bus_probe_device+0x12a/0x220
[ 87.145392][ T68] device_add+0x7d7/0xb80
[ 87.147397][ T68] platform_device_add+0x4bd/0x860
[ 87.149682][ T68] platform_device_register_full+0x62d/0x710
[ 87.152389][ T68] vhci_hcd_init+0x227/0x360
[ 87.154496][ T68] do_one_initcall+0x250/0x870
[ 87.156718][ T68] do_initcall_level+0x10a/0x1a0
[ 87.158944][ T68] do_initcalls+0x59/0xa0
[ 87.160932][ T68] kernel_init_freeable+0x29d/0x3e0
[ 87.163285][ T68] kernel_init+0x1d/0x1d0
[ 87.165255][ T68] ret_from_fork+0x514/0xb70
[ 87.167322][ T68] ret_from_fork_asm+0x1a/0x30
[ 87.169443][ T68]
[ 87.170556][ T68] Second to last potentially related work creation:
[ 87.173461][ T68] kasan_save_stack+0x3e/0x60
[ 87.175360][ T68] kasan_record_aux_stack+0xbd/0xd0
[ 87.177417][ T68] insert_work+0x3d/0x330
[ 87.179143][ T68] __queue_work+0xcd8/0x10a0
[ 87.181041][ T68] queue_work_on+0x106/0x1d0
[ 87.182898][ T68] usb_hcd_submit_urb+0xa3b/0x1b60
[ 87.184763][ T68] usb_start_wait_urb+0x13f/0x5b0
[ 87.186473][ T68] usb_control_msg+0x234/0x3e0
[ 87.188312][ T68] hub_suspend+0x891/0xad0
[ 87.189841][ T68] usb_suspend_both+0x285/0x1040
[ 87.191686][ T68] usb_runtime_suspend+0x58/0x110
[ 87.193534][ T68] __rpm_callback+0x2c7/0x950
[ 87.195306][ T68] rpm_suspend+0x8a0/0x17b0
[ 87.196947][ T68] __pm_runtime_suspend+0x12f/0x1a0
[ 87.198921][ T68] usb_new_device+0xadf/0x1620
[ 87.200920][ T68] register_root_hub+0x250/0x5c0
[ 87.203026][ T68] usb_add_hcd+0xac7/0xf80
[ 87.204986][ T68] vhci_hcd_probe+0x1fa/0x3e0
[ 87.206997][ T68] platform_probe+0xf9/0x190
[ 87.209027][ T68] really_probe+0x254/0xae0
[ 87.210956][ T68] __driver_probe_device+0x1e8/0x360
[ 87.213209][ T68] driver_probe_device+0x4f/0x240
[ 87.215255][ T68] __device_attach_driver+0x270/0x410
[ 87.217306][ T68] bus_for_each_drv+0x258/0x2f0
[ 87.219341][ T68] __device_attach+0x2c4/0x450
[ 87.221368][ T68] device_initial_probe+0xa1/0xd0
[ 87.223508][ T68] bus_probe_device+0x12a/0x220
[ 87.225593][ T68] device_add+0x7d7/0xb80
[ 87.227566][ T68] platform_device_add+0x4bd/0x860
[ 87.229733][ T68] platform_device_register_full+0x62d/0x710
[ 87.232237][ T68] vhci_hcd_init+0x227/0x360
[ 87.234214][ T68] do_one_initcall+0x250/0x870
[ 87.236215][ T68] do_initcall_level+0x10a/0x1a0
[ 87.238266][ T68] do_initcalls+0x59/0xa0
[ 87.239995][ T68] kernel_init_freeable+0x29d/0x3e0
[ 87.242169][ T68] kernel_init+0x1d/0x1d0
[ 87.243955][ T68] ret_from_fork+0x514/0xb70
[ 87.245905][ T68] ret_from_fork_asm+0x1a/0x30
[ 87.247962][ T68]
[ 87.248973][ T68] The buggy address belongs to the object at ffff88803499c000
[ 87.248973][ T68] which belongs to the cache kmalloc-8k of size 8192
[ 87.254739][ T68] The buggy address is located 4064 bytes inside of
[ 87.254739][ T68] freed 8192-byte region [ffff88803499c000, ffff88803499e000)
[ 87.260456][ T68]
[ 87.261491][ T68] The buggy address belongs to the physical page:
[ 87.264140][ T68] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34998
[ 87.267686][ T68] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 87.271225][ T68] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff)
[ 87.274419][ T68] page_type: f5(slab)
[ 87.276074][ T68] raw: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000
[ 87.279400][ T68] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
[ 87.282932][ T68] head: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000
[ 87.286418][ T68] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
[ 87.289960][ T68] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 87.293412][ T68] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 87.296511][ T68] page dumped because: kasan: bad access detected
[ 87.298884][ T68] page_owner tracks the page as allocated
[ 87.301204][ T68] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 16090822238, free_ts 16029037546
[ 87.309459][ T68] post_alloc_hook+0x1f9/0x250
[ 87.311491][ T68] get_page_from_freelist+0x21fa/0x2270
[ 87.313784][ T68] __alloc_frozen_pages_noprof+0x18d/0x380
[ 87.316234][ T68] allocate_slab+0x79/0x5e0
[ 87.318153][ T68] refill_objects+0x2d5/0x350
[ 87.319983][ T68] __pcs_replace_empty_main+0x2bf/0x6b0
[ 87.322212][ T68] __kmalloc_noprof+0x485/0x720
[ 87.324317][ T68] __usb_create_hcd+0x67/0x900
[ 87.326314][ T68] vhci_hcd_probe+0x1e6/0x3e0
[ 87.328374][ T68] platform_probe+0xf9/0x190
[ 87.330455][ T68] really_probe+0x254/0xae0
[ 87.332422][ T68] __driver_probe_device+0x1e8/0x360
[ 87.334729][ T68] driver_probe_device+0x4f/0x240
[ 87.336924][ T68] __device_attach_driver+0x270/0x410
[ 87.339085][ T68] bus_for_each_drv+0x258/0x2f0
[ 87.341062][ T68] __device_attach+0x2c4/0x450
[ 87.343004][ T68] page last free pid 1 tgid 1 stack trace:
[ 87.345162][ T68] __free_frozen_pages+0xc1e/0xd10
[ 87.347293][ T68] __slab_free+0x274/0x2c0
[ 87.348915][ T68] qlist_free_all+0x99/0x100
[ 87.350527][ T68] kasan_quarantine_reduce+0x148/0x160
[ 87.352526][ T68] __kasan_slab_alloc+0x22/0x80
[ 87.354223][ T68] __kmalloc_cache_noprof+0x2ab/0x660
[ 87.356152][ T68] mon_bus_init+0x50/0x2a0
[ 87.357852][ T68] mon_notify+0x10c/0x3f0
[ 87.359655][ T68] notifier_call_chain+0x1a5/0x3d0
[ 87.361699][ T68] blocking_notifier_call_chain+0x6a/0x90
[ 87.363936][ T68] usb_register_bus+0xcf/0x150
[ 87.365576][ T68] usb_add_hcd+0x3e6/0xf80
[ 87.367422][ T68] vhci_hcd_probe+0x141/0x3e0
[ 87.369405][ T68] platform_probe+0xf9/0x190
[ 87.371500][ T68] really_probe+0x254/0xae0
[ 87.373374][ T68] __driver_probe_device+0x1e8/0x360
[ 87.375616][ T68]
[ 87.376641][ T68] Memory state around the buggy address:
[ 87.378928][ T68] ffff88803499ce80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 87.382312][ T68] ffff88803499cf00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 87.385466][ T68] >ffff88803499cf80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 87.388836][ T68] ^
[ 87.391942][ T68] ffff88803499d000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 87.395412][ T68] ffff88803499d080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 87.398752][ T68] ==================================================================
[ 87.403232][ T5326] usb usb6: USB disconnect, device number 1
[ 87.435609][ T5326] vhci_hcd vhci_hcd.0: USB bus 6 deregistered
[ 87.460753][ T5327] vhci_hcd vhci_hcd.0: USB/IP Virtual Host Controller
[ 87.478864][ T5327] vhci_hcd vhci_hcd.0: new USB bus registered, assigned bus number 6
[ 87.485733][ T5327] vhci_hcd vhci_hcd.0: created sysfs vhci_hcd.0
[ 87.497015][ T5327] usb usb6: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02
[ 87.500973][ T5327] usb usb6: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[ 87.505787][ T5327] usb usb6: Product: USB/IP Virtual Host Controller
[ 87.508741][ T5327] usb usb6: Manufacturer: Linux syzkaller vhci_hcd
[ 87.511680][ T5327] usb usb6: SerialNumber: vhci_hcd.0
[ 87.522514][ T5327] hub 6-0:1.0: USB hub found
[ 87.529306][ T5327] hub 6-0:1.0: 8 ports detected
[ 87.559806][ T5327] vhci_hcd vhci_hcd.0: USB/IP Virtual Host Controller
[ 87.569316][ T5327] vhci_hcd vhci_hcd.0: new USB bus registered, assigned bus number 7
[ 87.583104][ T5327] usb usb7: We don't know the algorithms for LPM for this host, disabling LPM.
[ 87.594372][ T5327] usb usb7: New USB device found, idVendor=1d6b, idProduct=0003, bcdDevice= 7.02
[ 87.601649][ T5327] usb usb7: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[ 87.606825][ T5327] usb usb7: Product: USB/IP Virtual Host Controller
[ 87.609702][ T5327] usb usb7: Manufacturer: Linux syzkaller vhci_hcd
[ 87.612406][ T5327] usb usb7: SerialNumber: vhci_hcd.0
[ 87.615442][ T68] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 87.618488][ T68] CPU: 0 UID: 0 PID: 68 Comm: kworker/u4:4 Not tainted syzkaller #0 PREEMPT(full)
[ 87.622421][ T68] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 87.626642][ T68] Workqueue: usbip_event event_handler
[ 87.629046][ T68] Call Trace:
[ 87.630523][ T68]
[ 87.631818][ T68] vpanic+0x56c/0xa60
[ 87.633580][ T68] ? __pfx_vpanic+0x10/0x10
[ 87.635556][ T68] ? __pfx___schedule+0x10/0x10
[ 87.637649][ T68] panic+0xc5/0xd0
[ 87.639305][ T68] ? __pfx_panic+0x10/0x10
[ 87.641289][ T68] ? preempt_schedule_thunk+0x16/0x40
[ 87.643600][ T68] ? vhci_cleanup_unlink_list+0x452/0x460
[ 87.646014][ T68] check_panic_on_warn+0x89/0xb0
[ 87.648154][ T68] ? vhci_cleanup_unlink_list+0x452/0x460
[ 87.650545][ T68] end_report+0x73/0x170
[ 87.652322][ T68] ? vhci_cleanup_unlink_list+0x452/0x460
[ 87.654678][ T68] kasan_report+0x128/0x150
[ 87.656602][ T68] ? vhci_cleanup_unlink_list+0x452/0x460
[ 87.658972][ T68] vhci_cleanup_unlink_list+0x452/0x460
[ 87.661413][ T68] ? kasan_quarantine_put+0xbb/0x1f0
[ 87.663711][ T68] vhci_shutdown_connection+0x2af/0x650
[ 87.666127][ T68] event_handler+0x2a4/0x4b0
[ 87.668156][ T68] ? process_scheduled_works+0xa20/0x14e0
[ 87.670630][ T68] process_scheduled_works+0xa8e/0x14e0
[ 87.673071][ T68] ? __pfx_process_scheduled_works+0x10/0x10
[ 87.675664][ T68] ? assign_work+0x3cf/0x5d0
[ 87.677659][ T68] worker_thread+0xa47/0xfb0
[ 87.679686][ T68] kthread+0x388/0x470
[ 87.681469][ T68] ? __pfx_worker_thread+0x10/0x10
[ 87.683701][ T68] ? __pfx_kthread+0x10/0x10
[ 87.685703][ T68] ret_from_fork+0x514/0xb70
[ 87.687663][ T68] ? __pfx_ret_from_fork+0x10/0x10
[ 87.689912][ T68] ? __switch_to+0xc89/0x1420
[ 87.691918][ T68] ? __pfx_kthread+0x10/0x10
[ 87.693907][ T68] ret_from_fork_asm+0x1a/0x30
[ 87.696046][ T68]
[ 87.697778][ T68] Kernel Offset: disabled
[ 87.699687][ T68] Rebooting in 86400 seconds..