program:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, 0x0}], 0x1, 0x2, 0x0, 0x0)
r3 = syz_open_dev$cec(&(0x7f0000000000), 0xffffffffffffffff, 0x0)
ioctl$CEC_DQEVENT(r3, 0xc0506107, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000003880)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000038c0)=@newlink={0x3c, 0x10, 0x801, 0xfffffffd, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, [@IFLA_GROUP={0x8}, @IFLA_AF_SPEC={0x14, 0x1a, 0x0, 0x1, [@AF_INET={0x10, 0x2, 0x0, 0x1, {0xc, 0x1, 0x0, 0x1, [{0x8, 0x1, 0x0, 0x0, 0x1}]}}]}]}, 0x3c}}, 0x0)
r5 = socket$inet_sctp(0x2, 0x1, 0x84)
ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000340)={'team_slave_1\x00', &(0x7f0000000200)=@ethtool_gstrings={0x1b, 0x6}})
r6 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r6}, &(0x7f0000bbdffc))
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
getsockopt$inet_mreqsrc(r5, 0x0, 0x26, &(0x7f00000001c0)={@dev, @multicast2, @initdev}, &(0x7f0000000240)=0xc)
write(r7, &(0x7f0000000300)='vhci_hcd.0\x00', 0xb)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
ioctl$CEC_DQEVENT(r3, 0xc0506107, &(0x7f0000000080)={0x0, 0x0, 0x0, @lost_msgs})
gettid()
ioctl$IOC_PR_PREEMPT(r3, 0x40046109, &(0x7f0000000040)={0xd0, 0x10000002, 0x80000})
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000180)={0x1, 0x0, [{0x48a, 0x0, 0x9}]})
[ 92.859629][ T4652] Bluetooth: hci0: command tx timeout
[ 92.883366][ T9] cfg80211: failed to load regulatory.db
[ 93.127031][ T5331] vhci_hcd vhci_hcd.0: remove, state 4
[ 93.134050][ T5331] usb usb7: USB disconnect, device number 1
[ 93.259532][ T5331] vhci_hcd vhci_hcd.0: USB bus 7 deregistered
[ 93.262208][ T182] vhci_hcd vhci_hcd.0: stop threads
[ 93.272137][ T182] vhci_hcd vhci_hcd.0: release socket
[ 93.290537][ T182] vhci_hcd vhci_hcd.0: disconnect device
[ 93.299984][ T5331] vhci_hcd vhci_hcd.0: remove, state 4
[ 93.306957][ T182] ==================================================================
[ 93.310177][ T182] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0x40/0x60
[ 93.313425][ T182] Read of size 1 at addr ffff8880349fc478 by task kworker/u4:6/182
[ 93.316272][ T182]
[ 93.317125][ T182] CPU: 0 UID: 0 PID: 182 Comm: kworker/u4:6 Not tainted syzkaller #0 PREEMPT(full)
[ 93.317139][ T182] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 93.317147][ T182] Workqueue: usbip_event event_handler
[ 93.317164][ T182] Call Trace:
[ 93.317172][ T182]
[ 93.317177][ T182] dump_stack_lvl+0xe8/0x150
[ 93.317190][ T182] print_address_description+0x55/0x1e0
[ 93.317204][ T182] ? _raw_spin_lock_irqsave+0x40/0x60
[ 93.317214][ T182] print_report+0x58/0x70
[ 93.317226][ T182] kasan_report+0x117/0x150
[ 93.317239][ T182] ? _raw_spin_lock_irqsave+0x40/0x60
[ 93.317249][ T182] ? event_handler+0x2b0/0x4b0
[ 93.317257][ T182] __kasan_check_byte+0x2a/0x40
[ 93.317270][ T182] lock_acquire+0x84/0x350
[ 93.317284][ T182] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 93.317294][ T182] ? rcu_is_watching+0x15/0xb0
[ 93.317311][ T182] _raw_spin_lock_irqsave+0x40/0x60
[ 93.317318][ T182] ? event_handler+0x2b0/0x4b0
[ 93.317324][ T182] event_handler+0x2b0/0x4b0
[ 93.317331][ T182] ? process_scheduled_works+0xa20/0x14e0
[ 93.317338][ T182] process_scheduled_works+0xa8e/0x14e0
[ 93.317349][ T182] ? __pfx_process_scheduled_works+0x10/0x10
[ 93.317361][ T182] ? assign_work+0x3cf/0x5d0
[ 93.317372][ T182] worker_thread+0xa47/0xfb0
[ 93.317389][ T182] kthread+0x388/0x470
[ 93.317403][ T182] ? __pfx_worker_thread+0x10/0x10
[ 93.317414][ T182] ? __pfx_kthread+0x10/0x10
[ 93.317428][ T182] ret_from_fork+0x514/0xb70
[ 93.317443][ T182] ? __pfx_ret_from_fork+0x10/0x10
[ 93.317456][ T182] ? __switch_to+0xc89/0x1420
[ 93.317469][ T182] ? __pfx_kthread+0x10/0x10
[ 93.317483][ T182] ret_from_fork_asm+0x1a/0x30
[ 93.317496][ T182]
[ 93.317500][ T182]
[ 93.389523][ T182] Allocated by task 1:
[ 93.391344][ T182] kasan_save_track+0x3e/0x80
[ 93.393423][ T182] __kasan_kmalloc+0x93/0xb0
[ 93.395505][ T182] __kmalloc_noprof+0x375/0x720
[ 93.397610][ T182] __usb_create_hcd+0x67/0x900
[ 93.400166][ T182] vhci_hcd_probe+0x1e6/0x3e0
[ 93.402701][ T182] platform_probe+0xf9/0x190
[ 93.404773][ T182] really_probe+0x254/0xae0
[ 93.406948][ T182] __driver_probe_device+0x1e8/0x360
[ 93.409271][ T182] driver_probe_device+0x4f/0x240
[ 93.411520][ T182] __device_attach_driver+0x270/0x410
[ 93.413866][ T182] bus_for_each_drv+0x258/0x2f0
[ 93.415975][ T182] __device_attach+0x2c4/0x450
[ 93.418055][ T182] device_initial_probe+0xa1/0xd0
[ 93.420281][ T182] bus_probe_device+0x12a/0x220
[ 93.422473][ T182] device_add+0x7d7/0xb80
[ 93.424346][ T182] platform_device_add+0x4bd/0x860
[ 93.426581][ T182] platform_device_register_full+0x62d/0x710
[ 93.429258][ T182] vhci_hcd_init+0x227/0x360
[ 93.433637][ T182] do_one_initcall+0x250/0x870
[ 93.435771][ T182] do_initcall_level+0x10a/0x1a0
[ 93.437762][ T182] do_initcalls+0x59/0xa0
[ 93.439550][ T182] kernel_init_freeable+0x29d/0x3e0
[ 93.441592][ T182] kernel_init+0x1d/0x1d0
[ 93.443281][ T182] ret_from_fork+0x514/0xb70
[ 93.445124][ T182] ret_from_fork_asm+0x1a/0x30
[ 93.447036][ T182]
[ 93.448128][ T182] Freed by task 5331:
[ 93.449511][ T182] kasan_save_track+0x3e/0x80
[ 93.451171][ T182] kasan_save_free_info+0x40/0x50
[ 93.452961][ T182] __kasan_slab_free+0x5c/0x80
[ 93.454639][ T182] kfree+0x1c5/0x640
[ 93.456014][ T182] vhci_hcd_remove+0x9e/0x110
[ 93.457568][ T182] device_release_driver_internal+0x48b/0x880
[ 93.459537][ T182] unbind_store+0x1a1/0x1d0
[ 93.461181][ T182] kernfs_fop_write_iter+0x3a4/0x540
[ 93.463248][ T182] vfs_write+0x612/0xba0
[ 93.465080][ T182] ksys_write+0x150/0x270
[ 93.466849][ T182] do_syscall_64+0x174/0x580
[ 93.468837][ T182] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.471421][ T182]
[ 93.472482][ T182] Last potentially related work creation:
[ 93.474916][ T182] kasan_save_stack+0x3e/0x60
[ 93.476928][ T182] kasan_record_aux_stack+0xbd/0xd0
[ 93.479079][ T182] insert_work+0x3d/0x330
[ 93.480964][ T182] __queue_work+0xcd8/0x10a0
[ 93.482869][ T182] queue_work_on+0x106/0x1d0
[ 93.484848][ T182] unlink1+0x344/0x3e0
[ 93.486485][ T182] usb_hcd_unlink_urb+0xe6/0x1e0
[ 93.488642][ T182] usb_kill_urb+0x10b/0x2f0
[ 93.490585][ T182] hub_quiesce+0x211/0x330
[ 93.492546][ T182] hub_suspend+0x904/0xad0
[ 93.494488][ T182] usb_suspend_both+0x285/0x1040
[ 93.496613][ T182] usb_runtime_suspend+0x58/0x110
[ 93.498809][ T182] __rpm_callback+0x2c7/0x950
[ 93.500724][ T182] rpm_suspend+0x8a0/0x17b0
[ 93.502597][ T182] __pm_runtime_suspend+0x12f/0x1a0
[ 93.504657][ T182] usb_runtime_idle+0x76/0x90
[ 93.506543][ T182] rpm_idle+0x5b4/0x980
[ 93.508204][ T182] pm_runtime_work+0x11e/0x1b0
[ 93.510148][ T182] process_scheduled_works+0xa8e/0x14e0
[ 93.512414][ T182] worker_thread+0xa47/0xfb0
[ 93.514341][ T182] kthread+0x388/0x470
[ 93.516114][ T182] ret_from_fork+0x514/0xb70
[ 93.518089][ T182] ret_from_fork_asm+0x1a/0x30
[ 93.520036][ T182]
[ 93.521031][ T182] Second to last potentially related work creation:
[ 93.523849][ T182] kasan_save_stack+0x3e/0x60
[ 93.525848][ T182] kasan_record_aux_stack+0xbd/0xd0
[ 93.528084][ T182] insert_work+0x3d/0x330
[ 93.530028][ T182] __queue_work+0xcd8/0x10a0
[ 93.532181][ T182] queue_work_on+0x106/0x1d0
[ 93.534228][ T182] usb_hcd_submit_urb+0xa3b/0x1b60
[ 93.536521][ T182] usb_start_wait_urb+0x13f/0x5b0
[ 93.538509][ T182] usb_control_msg+0x234/0x3e0
[ 93.540474][ T182] hub_suspend+0x891/0xad0
[ 93.542396][ T182] usb_suspend_both+0x285/0x1040
[ 93.544464][ T182] usb_runtime_suspend+0x58/0x110
[ 93.546633][ T182] __rpm_callback+0x2c7/0x950
[ 93.548680][ T182] rpm_suspend+0x8a0/0x17b0
[ 93.550674][ T182] __pm_runtime_suspend+0x12f/0x1a0
[ 93.552987][ T182] usb_runtime_idle+0x76/0x90
[ 93.555090][ T182] rpm_idle+0x5b4/0x980
[ 93.556889][ T182] pm_runtime_work+0x11e/0x1b0
[ 93.558999][ T182] process_scheduled_works+0xa8e/0x14e0
[ 93.561325][ T182] worker_thread+0xa47/0xfb0
[ 93.563245][ T182] kthread+0x388/0x470
[ 93.565010][ T182] ret_from_fork+0x514/0xb70
[ 93.566973][ T182] ret_from_fork_asm+0x1a/0x30
[ 93.568989][ T182]
[ 93.570048][ T182] The buggy address belongs to the object at ffff8880349fc000
[ 93.570048][ T182] which belongs to the cache kmalloc-8k of size 8192
[ 93.575927][ T182] The buggy address is located 1144 bytes inside of
[ 93.575927][ T182] freed 8192-byte region [ffff8880349fc000, ffff8880349fe000)
[ 93.581705][ T182]
[ 93.582788][ T182] The buggy address belongs to the physical page:
[ 93.585417][ T182] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x349f8
[ 93.589150][ T182] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 93.592742][ T182] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff)
[ 93.596014][ T182] page_type: f5(slab)
[ 93.597788][ T182] raw: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000
[ 93.601514][ T182] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
[ 93.605124][ T182] head: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000
[ 93.608812][ T182] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
[ 93.612514][ T182] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 93.616135][ T182] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 93.619632][ T182] page dumped because: kasan: bad access detected
[ 93.622210][ T182] page_owner tracks the page as allocated
[ 93.624473][ T182] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 16853434710, free_ts 16771574533
[ 93.632472][ T182] post_alloc_hook+0x1f9/0x250
[ 93.634570][ T182] get_page_from_freelist+0x21fa/0x2270
[ 93.636922][ T182] __alloc_frozen_pages_noprof+0x18d/0x380
[ 93.639439][ T182] allocate_slab+0x79/0x5e0
[ 93.641451][ T182] refill_objects+0x2d5/0x350
[ 93.643506][ T182] __pcs_replace_empty_main+0x2bf/0x6b0
[ 93.645913][ T182] __kmalloc_noprof+0x485/0x720
[ 93.648044][ T182] __usb_create_hcd+0x67/0x900
[ 93.650097][ T182] vhci_hcd_probe+0x1e6/0x3e0
[ 93.652151][ T182] platform_probe+0xf9/0x190
[ 93.654183][ T182] really_probe+0x254/0xae0
[ 93.656076][ T182] __driver_probe_device+0x1e8/0x360
[ 93.658329][ T182] driver_probe_device+0x4f/0x240
[ 93.660378][ T182] __device_attach_driver+0x270/0x410
[ 93.662633][ T182] bus_for_each_drv+0x258/0x2f0
[ 93.664721][ T182] __device_attach+0x2c4/0x450
[ 93.666717][ T182] page last free pid 0 tgid 0 stack trace:
[ 93.669202][ T182] __free_frozen_pages+0xc1e/0xd10
[ 93.671492][ T182] rcu_core+0x78b/0x10a0
[ 93.673386][ T182] handle_softirqs+0x225/0x840
[ 93.675423][ T182] __irq_exit_rcu+0xca/0x220
[ 93.677360][ T182] irq_exit_rcu+0x9/0x30
[ 93.679150][ T182] sysvec_apic_timer_interrupt+0xa6/0xc0
[ 93.681588][ T182] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 93.684181][ T182]
[ 93.685280][ T182] Memory state around the buggy address:
[ 93.687690][ T182] ffff8880349fc300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 93.691283][ T182] ffff8880349fc380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 93.694786][ T182] >ffff8880349fc400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 93.698106][ T182] ^
[ 93.701501][ T182] ffff8880349fc480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 93.704905][ T182] ffff8880349fc500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 93.708478][ T182] ==================================================================
[ 93.712005][ T182] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 93.715164][ T182] CPU: 0 UID: 0 PID: 182 Comm: kworker/u4:6 Not tainted syzkaller #0 PREEMPT(full)
[ 93.719053][ T182] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 93.723211][ T182] Workqueue: usbip_event event_handler
[ 93.725553][ T182] Call Trace:
[ 93.726998][ T182]
[ 93.728251][ T182] vpanic+0x56c/0xa60
[ 93.729867][ T182] ? __pfx_vpanic+0x10/0x10
[ 93.731782][ T182] panic+0xc5/0xd0
[ 93.733370][ T182] ? __pfx_panic+0x10/0x10
[ 93.735086][ T182] ? _raw_spin_lock_irqsave+0x40/0x60
[ 93.737369][ T182] ? rcu_is_watching+0x15/0xb0
[ 93.739403][ T182] ? _raw_spin_lock_irqsave+0x40/0x60
[ 93.741691][ T182] ? _raw_spin_lock_irqsave+0x40/0x60
[ 93.743858][ T182] check_panic_on_warn+0x89/0xb0
[ 93.745849][ T182] ? _raw_spin_lock_irqsave+0x40/0x60
[ 93.748094][ T182] end_report+0x73/0x170
[ 93.749924][ T182] ? _raw_spin_lock_irqsave+0x40/0x60
[ 93.752192][ T182] kasan_report+0x128/0x150
[ 93.754196][ T182] ? _raw_spin_lock_irqsave+0x40/0x60
[ 93.756403][ T182] ? event_handler+0x2b0/0x4b0
[ 93.758500][ T182] __kasan_check_byte+0x2a/0x40
[ 93.760607][ T182] lock_acquire+0x84/0x350
[ 93.762585][ T182] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 93.764941][ T182] ? rcu_is_watching+0x15/0xb0
[ 93.767068][ T182] _raw_spin_lock_irqsave+0x40/0x60
[ 93.769359][ T182] ? event_handler+0x2b0/0x4b0
[ 93.771573][ T182] event_handler+0x2b0/0x4b0
[ 93.773602][ T182] ? process_scheduled_works+0xa20/0x14e0
[ 93.776079][ T182] process_scheduled_works+0xa8e/0x14e0
[ 93.778493][ T182] ? __pfx_process_scheduled_works+0x10/0x10
[ 93.781065][ T182] ? assign_work+0x3cf/0x5d0
[ 93.783101][ T182] worker_thread+0xa47/0xfb0
[ 93.785122][ T182] kthread+0x388/0x470
[ 93.786860][ T182] ? __pfx_worker_thread+0x10/0x10
[ 93.789012][ T182] ? __pfx_kthread+0x10/0x10
[ 93.791087][ T182] ret_from_fork+0x514/0xb70
[ 93.793102][ T182] ? __pfx_ret_from_fork+0x10/0x10
[ 93.795382][ T182] ? __switch_to+0xc89/0x1420
[ 93.797487][ T182] ? __pfx_kthread+0x10/0x10
[ 93.799556][ T182] ret_from_fork_asm+0x1a/0x30
[ 93.801723][ T182]
[ 93.803559][ T182] Kernel Offset: disabled
[ 93.805361][ T182] Rebooting in 86400 seconds..