program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='vhci_hcd.0\x00', 0xb) syz_mount_image$ext4(&(0x7f0000000400)='ext2\x00', &(0x7f0000000240)='./file1\x00', 0x18040, &(0x7f0000000000), 0x1, 0x3d0, &(0x7f00000004c0)="$eJzs3M1uG0UcAPD/br5I+mEjcUCFgyUQBAFxHQhQhEThyscFeAArSUuF21SNkWjJoSBOnDggbhz6Ahx4gKpCSEi8Ai+AKlUozQFuQWvvOm4cp7Fix2r6+0mjndkdZ/bv3axm1rsTwGOrEhHnI2IiIhYjopSvT/MUN9spq3d/c2N5a3NjOYnt7U/+SSLJ1xV/K8mXJ/LCfBqRfhfxzM3edtev3/ii3misXsvL1eblq9X16zdevXS5fnH14uqV2pvnarWlxbdqrw8t1p+ef+ncxPvnz/z8V+nO0vT0bLa/J/Nt3XEMSyUqne9kt6VhNzZm0+PeAQAADiTN+/6Trf5/KSZaubZSVDfGunMAAADAUGy/my8BAACAYywx9gcAAIBjrngO4P7mxnKRxvg4wpG7915ElHfebd7qxD8ZT+R1pkb4fmslIq6+kJSyFCN6DxkAoNudrP9zdq/+XxpPd9WbiWj1h2aH3H5lV7m3/5PeHXKTD8j6f+9ExFZP/y8tqpQn8tKpVldxKrlwqbF6NiJOR8R8TM1k5do+bXzw7y8f99uWxf97cup0kbL2s+VOjfTu5MyDn1mpN+uHibnbvW8izkzuFX/S6f8mETF3iDYmvr71dr9tD49/tLZvRby45/Hfmbkn2X9+omrrfKgWZ0Wv/7799aN+7Y87/uz4z+0ffznpnq9pffA2bn/+57P9tnWPfwY5/6eTT1v5Ylz2Vb3ZvFaLmE4+7F2/uPPZolzUz+Kff27v///i+pfkc1qdzK8Bg/r+h99eOUj8WcraL8aCRyGLf2Wg4z945o3bf3zWr/2Hx58d//YcYPP5moNc/w66g4f57gAAAOBRkbbuayTpQiefpgsL7fsdT8Vc2lhbb758Ye3LKyvt+x/lmEqLO12lrvuhtfbP6J3y4q7yaxHxZET8WJptlReW1xor4w4eAAAAHhMn+oz/M38f2VMIAAAAwMiVx70DAAAAwMgZ/wMAAMCxdph5/WRkZI5rZtxXJgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEfb/wEAAP//Wt22ag==") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'hsr0\x00', 0x2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$vfat(&(0x7f0000000400), &(0x7f0000000000)='./file1\x00', 0x2000494, &(0x7f0000000440)=ANY=[@ANYBLOB="6e6f6e756d7461696c2c6e66732c73686f72746e616d653d6c6f7765722c757466383d312c64656275672c696f636861727365743d757466382c73686f72746e616d653d6d697865642c757466383d312c00484516000000000037c015c57600912233eefc80e89be5a1ef2c27ebf5171169dcfa4805d89c7e1f70d73d649ba4afab8b2194a9e8b537ad2ed68f8319883b84237da3bf9213365872b3f3"], 0x1, 0x2ca, &(0x7f0000000500)="$eJzs3E9rE2sUx/HTpk3TlDa5cLlwBfWgG92ENr4ADdKCGFBqU9SFMLUTDRmTMhMqEbHZiFtfR3HpTlBfgN2IG3HrrgiCmy7Ekc6fmrRpzZ+2SdvvB8o8mWd+PKfTaTlTmFm//fJRMe+k8kZFBmMqgyI12RBJbo4CA8F20BtHpV5NLo79+Hz61p271zPZ7PSs6kxm7lJaVSfOvn389NW595Wx+dcTb0ZkLXlv/Xv669p/a/+v/5p7WHCGxdFSuaKGLpTLFWPBMnWx4BRTqjct03BMLZQc026Yz1vlpaWqGqXF8fiSbTqOGqWqFs2qVspasatqPDAKJU2lUjoel5Mi0XTvUAvJ3OrsrJHZddqNdFEVemC02U7bztSaT+ZWD6EmAADQZ/bu//1ef/f+Pzvvbzvq/7WwW/8v0nX//yF6+OfyKKg1fPpL/x9qfoMR27eicKBsO2PEg9/fRvT/AAAAAAAAAAAAAAAAAAAAAAAcBRuum3BdNxFuw6+R4AGP8HOv68TBaPPnH74Q4HIPS8Y+qntwLyZivVjOLef8rT+fyUtBLDFlUhLy07seAv545lp2elI9SXlnrQT5leVcRDavoUxUCluLJcP8gPcYmp8/88+Un9fG/LDE69dPS0L+bb5+umk+KhfO1+VTkpCP96UsliyKfAkuaC//bEr16o3stvzo5nEAAAAAABwLKd2y4/7dm/cOiMnOeT/fxv8Htt1fD8mpVl5RCQAAAAAAuuZUnxQNyzLtDgYjItJF/LgOItIXZWwbXBGRTuLxfii+/UFMRPw92kn821a8pZTbwjFDItLz09LGoNd/mQAAAADstz9NfxuhT88PsCIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE6eVt8HFh6/Yyqc2CNet1zk0L9BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoI/8DgAA///REBf+") mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file7\x00', 0x1c0) syz_mount_image$fuse(0x0, &(0x7f0000000040)='./file7/file0\x00', 0x800020, 0x0, 0x0, 0x0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000080)='./file7/file0\x00', 0x2) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r3) sendmsg$TIPC_CMD_ENABLE_BEARER(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x3ad380, 0x0) close(r5) r6 = socket$unix(0x1, 0x2, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = dup(0xffffffffffffffff) ioctl$PPPIOCGDEBUG(r8, 0x80047441, &(0x7f0000000180)) socket(0x2a, 0x3, 0xed) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x7, 0x6361, 0x5, 0xffffffff, 0x6}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x240080c1}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0x80000, {0x0, 0x0, 0x0, r9, {0x0, 0x6}, {0x2, 0xb}, {0xffe0, 0xb}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0xf, 0x0, 0x4}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x2404c0f1}, 0x4008000) ioctl$SIOCSIFHWADDR(r5, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) ioctl$I2C_FUNCS(r8, 0x705, &(0x7f00000001c0)=0x5) [ 92.822895][ T4650] Bluetooth: hci0: command tx timeout [ 92.856330][ T1380] cfg80211: failed to load regulatory.db [ 92.932015][ T5328] vhci_hcd vhci_hcd.0: remove, state 4 [ 92.954346][ T5328] usb usb7: USB disconnect, device number 1 [ 93.092882][ T5329] loop0: detected capacity change from 0 to 512 [ 93.110268][ T5329] ======================================================= [ 93.110268][ T5329] WARNING: The mand mount option has been deprecated and [ 93.110268][ T5329] and is ignored by this kernel. Remove the mand [ 93.110268][ T5329] option from the mount to silence this warning. [ 93.110268][ T5329] ======================================================= [ 93.266890][ T12] vhci_hcd vhci_hcd.0: stop threads [ 93.269655][ T12] vhci_hcd vhci_hcd.0: release socket [ 93.272047][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 93.290561][ T12] vhci_hcd vhci_hcd.0: stop threads [ 93.298924][ T12] vhci_hcd vhci_hcd.0: release socket [ 93.306036][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 93.316209][ T12] vhci_hcd vhci_hcd.0: stop threads [ 93.320746][ T5329] loop0: detected capacity change from 0 to 128 [ 93.324479][ T12] vhci_hcd vhci_hcd.0: release socket [ 93.329194][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 93.344675][ T12] vhci_hcd vhci_hcd.0: stop threads [ 93.352859][ T5329] FAT-fs (loop0): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 93.360209][ T12] vhci_hcd vhci_hcd.0: release socket [ 93.370305][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 93.382647][ T12] vhci_hcd vhci_hcd.0: stop threads [ 93.395069][ T12] vhci_hcd vhci_hcd.0: release socket [ 93.401294][ T5329] FAT-fs (loop0): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 93.407882][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 93.418486][ T12] vhci_hcd vhci_hcd.0: stop threads [ 93.432657][ T12] vhci_hcd vhci_hcd.0: release socket [ 93.445529][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 93.461856][ T12] vhci_hcd vhci_hcd.0: stop threads [ 93.472725][ T12] vhci_hcd vhci_hcd.0: release socket [ 93.488534][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 93.509454][ T12] vhci_hcd vhci_hcd.0: stop threads [ 93.518700][ T12] vhci_hcd vhci_hcd.0: release socket [ 93.532818][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 93.550666][ T191] FAT-fs (loop0): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 93.555971][ T5328] vhci_hcd vhci_hcd.0: USB bus 7 deregistered [ 93.632208][ T5328] vhci_hcd vhci_hcd.0: remove, state 4 [ 93.665545][ T5328] usb usb6: USB disconnect, device number 1 [ 93.984912][ T12] vhci_hcd vhci_hcd.0: stop threads [ 94.000279][ T12] vhci_hcd vhci_hcd.0: release socket [ 94.020612][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 94.051673][ T5328] vhci_hcd vhci_hcd.0: USB bus 6 deregistered [ 94.054695][ T12] vhci_hcd vhci_hcd.0: stop threads [ 94.068737][ T12] vhci_hcd vhci_hcd.0: release socket [ 94.078292][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 94.090810][ T12] vhci_hcd vhci_hcd.0: stop threads [ 94.108852][ T12] vhci_hcd vhci_hcd.0: release socket [ 94.128189][ T12] ================================================================== [ 94.131674][ T12] BUG: KASAN: slab-use-after-free in vhci_cleanup_unlink_list+0x452/0x460 [ 94.135373][ T12] Read of size 4 at addr ffff8880343988f0 by task kworker/u4:0/12 [ 94.138774][ T12] [ 94.139861][ T12] CPU: 0 UID: 0 PID: 12 Comm: kworker/u4:0 Not tainted syzkaller #0 PREEMPT(full) [ 94.139875][ T12] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.139883][ T12] Workqueue: usbip_event event_handler [ 94.139900][ T12] Call Trace: [ 94.139906][ T12] [ 94.139912][ T12] dump_stack_lvl+0xe8/0x150 [ 94.139929][ T12] print_address_description+0x55/0x1e0 [ 94.139945][ T12] ? vhci_cleanup_unlink_list+0x452/0x460 [ 94.139957][ T12] print_report+0x58/0x70 [ 94.139970][ T12] kasan_report+0x117/0x150 [ 94.139985][ T12] ? vhci_cleanup_unlink_list+0x452/0x460 [ 94.139999][ T12] vhci_cleanup_unlink_list+0x452/0x460 [ 94.140012][ T12] ? kasan_quarantine_put+0xbb/0x1f0 [ 94.140026][ T12] vhci_shutdown_connection+0x2af/0x650 [ 94.140040][ T12] event_handler+0x2a4/0x4b0 [ 94.140050][ T12] ? process_scheduled_works+0xa20/0x14e0 [ 94.140063][ T12] process_scheduled_works+0xa8e/0x14e0 [ 94.140082][ T12] ? __pfx_process_scheduled_works+0x10/0x10 [ 94.140096][ T12] ? assign_work+0x3cf/0x5d0 [ 94.140108][ T12] worker_thread+0xa47/0xfb0 [ 94.140128][ T12] kthread+0x388/0x470 [ 94.140142][ T12] ? __pfx_worker_thread+0x10/0x10 [ 94.140154][ T12] ? __pfx_kthread+0x10/0x10 [ 94.140168][ T12] ret_from_fork+0x514/0xb70 [ 94.140185][ T12] ? __pfx_ret_from_fork+0x10/0x10 [ 94.140199][ T12] ? __switch_to+0xc89/0x1420 [ 94.140213][ T12] ? __pfx_kthread+0x10/0x10 [ 94.140227][ T12] ret_from_fork_asm+0x1a/0x30 [ 94.140242][ T12] [ 94.140246][ T12] [ 94.204164][ T12] Allocated by task 1: [ 94.205864][ T12] kasan_save_track+0x3e/0x80 [ 94.207916][ T12] __kasan_kmalloc+0x93/0xb0 [ 94.209893][ T12] __kmalloc_noprof+0x375/0x720 [ 94.211942][ T12] __usb_create_hcd+0x67/0x900 [ 94.214028][ T12] vhci_hcd_probe+0x104/0x3e0 [ 94.215980][ T12] platform_probe+0xf9/0x190 [ 94.217962][ T12] really_probe+0x254/0xae0 [ 94.219901][ T12] __driver_probe_device+0x1e8/0x360 [ 94.222064][ T12] driver_probe_device+0x4f/0x240 [ 94.224140][ T12] __device_attach_driver+0x270/0x410 [ 94.226386][ T12] bus_for_each_drv+0x258/0x2f0 [ 94.228429][ T12] __device_attach+0x2c4/0x450 [ 94.230460][ T12] device_initial_probe+0xa1/0xd0 [ 94.232658][ T12] bus_probe_device+0x12a/0x220 [ 94.234760][ T12] device_add+0x7d7/0xb80 [ 94.236603][ T12] platform_device_add+0x4bd/0x860 [ 94.238884][ T12] platform_device_register_full+0x62d/0x710 [ 94.241466][ T12] vhci_hcd_init+0x227/0x360 [ 94.243533][ T12] do_one_initcall+0x250/0x870 [ 94.245556][ T12] do_initcall_level+0x10a/0x1a0 [ 94.247647][ T12] do_initcalls+0x59/0xa0 [ 94.249500][ T12] kernel_init_freeable+0x29d/0x3e0 [ 94.251710][ T12] kernel_init+0x1d/0x1d0 [ 94.253585][ T12] ret_from_fork+0x514/0xb70 [ 94.255566][ T12] ret_from_fork_asm+0x1a/0x30 [ 94.257581][ T12] [ 94.258670][ T12] Freed by task 5328: [ 94.260348][ T12] kasan_save_track+0x3e/0x80 [ 94.262347][ T12] kasan_save_free_info+0x40/0x50 [ 94.264446][ T12] __kasan_slab_free+0x5c/0x80 [ 94.266486][ T12] kfree+0x1c5/0x640 [ 94.268169][ T12] vhci_hcd_remove+0xe4/0x110 [ 94.270163][ T12] device_release_driver_internal+0x48b/0x880 [ 94.272593][ T12] unbind_store+0x1a1/0x1d0 [ 94.274536][ T12] kernfs_fop_write_iter+0x3a4/0x540 [ 94.276762][ T12] vfs_write+0x612/0xba0 [ 94.278642][ T12] ksys_write+0x150/0x270 [ 94.280499][ T12] do_syscall_64+0x174/0x580 [ 94.282430][ T12] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.284889][ T12] [ 94.285914][ T12] Last potentially related work creation: [ 94.288298][ T12] kasan_save_stack+0x3e/0x60 [ 94.290365][ T12] kasan_record_aux_stack+0xbd/0xd0 [ 94.292575][ T12] insert_work+0x3d/0x330 [ 94.294407][ T12] __queue_work+0xcd8/0x10a0 [ 94.296358][ T12] queue_work_on+0x106/0x1d0 [ 94.298364][ T12] unlink1+0x344/0x3e0 [ 94.300107][ T12] usb_hcd_unlink_urb+0xe6/0x1e0 [ 94.302228][ T12] usb_kill_urb+0x10b/0x2f0 [ 94.304230][ T12] hub_quiesce+0x211/0x330 [ 94.306226][ T12] hub_suspend+0x904/0xad0 [ 94.308131][ T12] usb_suspend_both+0x285/0x1040 [ 94.310247][ T12] usb_runtime_suspend+0x58/0x110 [ 94.312413][ T12] __rpm_callback+0x2c7/0x950 [ 94.314523][ T12] rpm_suspend+0x8a0/0x17b0 [ 94.316484][ T12] __pm_runtime_suspend+0x12f/0x1a0 [ 94.319323][ T12] usb_new_device+0xadf/0x1620 [ 94.321507][ T12] register_root_hub+0x250/0x5c0 [ 94.323572][ T12] usb_add_hcd+0xac7/0xf80 [ 94.325401][ T12] vhci_hcd_probe+0x141/0x3e0 [ 94.327323][ T12] platform_probe+0xf9/0x190 [ 94.329195][ T12] really_probe+0x254/0xae0 [ 94.331046][ T12] __driver_probe_device+0x1e8/0x360 [ 94.333144][ T12] driver_probe_device+0x4f/0x240 [ 94.335210][ T12] __device_attach_driver+0x270/0x410 [ 94.337338][ T12] bus_for_each_drv+0x258/0x2f0 [ 94.339329][ T12] __device_attach+0x2c4/0x450 [ 94.341364][ T12] device_initial_probe+0xa1/0xd0 [ 94.343589][ T12] bus_probe_device+0x12a/0x220 [ 94.345652][ T12] device_add+0x7d7/0xb80 [ 94.347548][ T12] platform_device_add+0x4bd/0x860 [ 94.349832][ T12] platform_device_register_full+0x62d/0x710 [ 94.352447][ T12] vhci_hcd_init+0x227/0x360 [ 94.354431][ T12] do_one_initcall+0x250/0x870 [ 94.356454][ T12] do_initcall_level+0x10a/0x1a0 [ 94.358670][ T12] do_initcalls+0x59/0xa0 [ 94.360546][ T12] kernel_init_freeable+0x29d/0x3e0 [ 94.362808][ T12] kernel_init+0x1d/0x1d0 [ 94.364639][ T12] ret_from_fork+0x514/0xb70 [ 94.366748][ T12] ret_from_fork_asm+0x1a/0x30 [ 94.368867][ T12] [ 94.370005][ T12] Second to last potentially related work creation: [ 94.372740][ T12] kasan_save_stack+0x3e/0x60 [ 94.374766][ T12] kasan_record_aux_stack+0xbd/0xd0 [ 94.376945][ T12] insert_work+0x3d/0x330 [ 94.378792][ T12] __queue_work+0xcd8/0x10a0 [ 94.380727][ T12] queue_work_on+0x106/0x1d0 [ 94.382668][ T12] usb_hcd_submit_urb+0xa3b/0x1b60 [ 94.384842][ T12] usb_start_wait_urb+0x13f/0x5b0 [ 94.386966][ T12] usb_control_msg+0x234/0x3e0 [ 94.389076][ T12] hub_ext_port_status+0x114/0x810 [ 94.391291][ T12] hub_activate+0x740/0x1b20 [ 94.393255][ T12] process_scheduled_works+0xa8e/0x14e0 [ 94.395617][ T12] worker_thread+0xa47/0xfb0 [ 94.397514][ T12] kthread+0x388/0x470 [ 94.399266][ T12] ret_from_fork+0x514/0xb70 [ 94.401208][ T12] ret_from_fork_asm+0x1a/0x30 [ 94.403262][ T12] [ 94.404311][ T12] The buggy address belongs to the object at ffff888034398000 [ 94.404311][ T12] which belongs to the cache kmalloc-8k of size 8192 [ 94.410187][ T12] The buggy address is located 2288 bytes inside of [ 94.410187][ T12] freed 8192-byte region [ffff888034398000, ffff88803439a000) [ 94.415956][ T12] [ 94.416962][ T12] The buggy address belongs to the physical page: [ 94.419669][ T12] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34398 [ 94.423333][ T12] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 94.426885][ T12] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 94.430247][ T12] page_type: f5(slab) [ 94.432019][ T12] raw: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 94.435851][ T12] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 94.439570][ T12] head: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 94.443230][ T12] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 94.446836][ T12] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 94.450634][ T12] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 94.454254][ T12] page dumped because: kasan: bad access detected [ 94.457076][ T12] page_owner tracks the page as allocated [ 94.459638][ T12] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 15337506955, free_ts 15314764431 [ 94.468247][ T12] post_alloc_hook+0x1f9/0x250 [ 94.470403][ T12] get_page_from_freelist+0x21fa/0x2270 [ 94.472762][ T12] __alloc_frozen_pages_noprof+0x18d/0x380 [ 94.475223][ T12] allocate_slab+0x79/0x5e0 [ 94.477265][ T12] refill_objects+0x2d5/0x350 [ 94.479402][ T12] __pcs_replace_empty_main+0x2bf/0x6b0 [ 94.481789][ T12] __kmalloc_noprof+0x485/0x720 [ 94.483844][ T12] acpi_ut_initialize_buffer+0xca/0x170 [ 94.486279][ T12] acpi_rs_create_pci_routing_table+0x1c0/0xd90 [ 94.488980][ T12] acpi_rs_get_prt_method_data+0xdf/0x150 [ 94.491466][ T12] acpi_get_irq_routing_table+0x98/0xe0 [ 94.493838][ T12] acpi_pci_irq_find_prt_entry+0x163/0x1040 [ 94.496421][ T12] acpi_pci_irq_lookup+0x45/0x690 [ 94.498730][ T12] acpi_pci_irq_enable+0x1ee/0x7a0 [ 94.500912][ T12] do_pci_enable_device+0x26f/0x4a0 [ 94.503176][ T12] pci_enable_device_flags+0x5ab/0x700 [ 94.505494][ T12] page last free pid 9 tgid 9 stack trace: [ 94.508051][ T12] free_pages_prepare+0x960/0xa60 [ 94.510332][ T12] __free_contig_range_common+0x174/0x340 [ 94.512996][ T12] free_pages_bulk+0x48/0x120 [ 94.514948][ T12] vfree+0x224/0x4a0 [ 94.516533][ T12] delayed_vfree_work+0x55/0x80 [ 94.518707][ T12] process_scheduled_works+0xa8e/0x14e0 [ 94.521043][ T12] worker_thread+0xa47/0xfb0 [ 94.523045][ T12] kthread+0x388/0x470 [ 94.524755][ T12] ret_from_fork+0x514/0xb70 [ 94.526663][ T12] ret_from_fork_asm+0x1a/0x30 [ 94.528565][ T12] [ 94.529502][ T12] Memory state around the buggy address: [ 94.531883][ T12] ffff888034398780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.534920][ T12] ffff888034398800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.538202][ T12] >ffff888034398880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.541469][ T12] ^ [ 94.544711][ T12] ffff888034398900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.548081][ T12] ffff888034398980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.551603][ T12] ==================================================================