==================================================================
BUG: KASAN: slab-use-after-free in tasklet_action_common+0x103/0x490 kernel/softirq.c:954
Read of size 8 at addr ffff888021fd7158 by task kworker/1:1/9916

CPU: 1 UID: 0 PID: 9916 Comm: kworker/1:1 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 tasklet_action_common+0x103/0x490 kernel/softirq.c:954
 handle_softirqs+0x226/0x860 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:up_write+0xe/0x4a0 kernel/locking/rwsem.c:1686
Code: ff 90 0f 0b 90 e9 fe fe ff ff 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 41 57 41 56 41 55 41 54 53 <48> 83 ec 20 48 89 fb 48 bd 00 00 00 00 00 fc ff df 48 83 c7 68 48
RSP: 0018:ffffc9000544ef90 EFLAGS: 00000246
RAX: ffffffff8279685b RBX: ffff8880293d90f0 RCX: 0000000000100000
RDX: ffffc9001d1aa000 RSI: 000000000000d771 RDI: ffff88801c2d4918
RBP: 0000000000000000 R08: ffffffff8279399c R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed100527b21f R12: dffffc0000000000
R13: ffff88801c2d49a8 R14: ffff88801c2d4918 R15: ffff8880293d90f0
 kernfs_add_one+0xfc/0x6f0 fs/kernfs/dir.c:-1
 __kernfs_create_file+0x22b/0x2e0 fs/kernfs/file.c:1079
 sysfs_add_file_mode_ns+0x237/0x300 fs/sysfs/file.c:316
 sysfs_merge_group+0x183/0x320 fs/sysfs/group.c:382
 dpm_sysfs_add+0xd2/0x270 drivers/base/power/sysfs.c:704
 device_add+0x4ca/0xb80 drivers/base/core.c:3721
 usb_create_ep_devs+0x12c/0x230 drivers/usb/core/endpoint.c:162
 create_intf_ep_devs drivers/usb/core/message.c:1312 [inline]
 usb_set_configuration+0x1c1e/0x2180 drivers/usb/core/message.c:2274
 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3776
 usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2708
 hub_port_connect drivers/usb/core/hub.c:5580 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5720 [inline]
 port_event drivers/usb/core/hub.c:5884 [inline]
 hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5966
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 6146:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:409 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:426
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x321/0x600 mm/slub.c:5563
 _kmalloc_noprof include/linux/slab.h:991 [inline]
 _kzalloc_noprof include/linux/slab.h:1312 [inline]
 ath9k_init_wmi+0x4f/0x2b0 drivers/net/wireless/ath/ath9k/wmi.c:95
 ath9k_htc_probe_device+0x1e5/0x2370 drivers/net/wireless/ath/ath9k/htc_drv_init.c:956
 ath9k_htc_hw_init+0x32/0x70 drivers/net/wireless/ath/ath9k/htc_hst.c:532
 ath9k_hif_usb_firmware_cb+0x214/0x4b0 drivers/net/wireless/ath/ath9k/hif_usb.c:1255
 request_firmware_work_func+0xf7/0x2d0 drivers/base/firmware_loader/main.c:1164
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Freed by task 6146:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:264 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:296
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2748 [inline]
 slab_free mm/slub.c:6508 [inline]
 kfree+0x1c5/0x650 mm/slub.c:6801
 ath9k_htc_probe_device+0x11a9/0x2370 drivers/net/wireless/ath/ath9k/htc_drv_init.c:978
 ath9k_htc_hw_init+0x32/0x70 drivers/net/wireless/ath/ath9k/htc_hst.c:532
 ath9k_hif_usb_firmware_cb+0x214/0x4b0 drivers/net/wireless/ath/ath9k/hif_usb.c:1255
 request_firmware_work_func+0xf7/0x2d0 drivers/base/firmware_loader/main.c:1164
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

The buggy address belongs to the object at ffff888021fd7000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 344 bytes inside of
 freed 2048-byte region [ffff888021fd7000, ffff888021fd7800)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888021fd3000 pfn:0x21fd0
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000240 ffff88801b042000 ffffea0000a37010 ffffea0001f49610
raw: ffff888021fd3000 0000000000080006 00000000f5000000 0000000000000000
head: 00fff00000000240 ffff88801b042000 ffffea0000a37010 ffffea0001f49610
head: ffff888021fd3000 0000000000080006 00000000f5000000 0000000000000000
head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd28c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5629, tgid 5629 (syz-executor), ts 83985572057
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1871
 prep_new_page mm/page_alloc.c:1879 [inline]
 get_page_from_freelist+0x2209/0x2280 mm/page_alloc.c:3943
 __alloc_frozen_pages_noprof+0x217/0x5a0 mm/page_alloc.c:5436
 alloc_slab_page mm/slub.c:3347 [inline]
 allocate_slab+0x7d/0x620 mm/slub.c:3462
 new_slab mm/slub.c:3513 [inline]
 refill_objects+0x2d5/0x350 mm/slub.c:7417
 refill_sheaf mm/slub.c:2885 [inline]
 __pcs_replace_empty_main+0x2c8/0x6c0 mm/slub.c:4774
 alloc_from_pcs mm/slub.c:4850 [inline]
 slab_alloc_node mm/slub.c:4984 [inline]
 __do_kmalloc_node mm/slub.c:5413 [inline]
 __kmalloc_node_track_caller_noprof+0x548/0x720 mm/slub.c:5545
 kmalloc_reserve net/core/skbuff.c:637 [inline]
 pskb_expand_head+0x22c/0x13a0 net/core/skbuff.c:2315
 netlink_trim+0x1b3/0x2c0 net/netlink/af_netlink.c:1319
 netlink_broadcast_filtered+0x6d/0xea0 net/netlink/af_netlink.c:1537
 nlmsg_multicast_filtered include/net/netlink.h:1165 [inline]
 nlmsg_multicast include/net/netlink.h:1184 [inline]
 nlmsg_notify+0xe3/0x1a0 net/netlink/af_netlink.c:2618
 rtnl_notify net/core/rtnetlink.c:994 [inline]
 rtmsg_ifinfo_send net/core/rtnetlink.c:4614 [inline]
 rtmsg_ifinfo_event net/core/rtnetlink.c:4630 [inline]
 rtnetlink_event+0x224/0x270 net/core/rtnetlink.c:7197
 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline]
 call_netdevice_notifiers net/core/dev.c:2327 [inline]
 netif_set_mac_address+0x393/0x4d0 net/core/dev.c:10099
 do_setlink+0x9ad/0x4670 net/core/rtnetlink.c:3223
 rtnl_changelink net/core/rtnetlink.c:3910 [inline]
 __rtnl_newlink net/core/rtnetlink.c:4081 [inline]
 rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4220
page last free pid 50 tgid 50 ts 83941507980 stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 __free_pages_prepare mm/page_alloc.c:1418 [inline]
 __free_frozen_pages+0xc93/0xd90 mm/page_alloc.c:2962
 __slab_free+0x274/0x2c0 mm/slub.c:5823
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:361
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4683 [inline]
 slab_alloc_node mm/slub.c:4996 [inline]
 kmem_cache_alloc_node_noprof+0x354/0x610 mm/slub.c:5068
 __alloc_skb+0x1db/0x7a0 net/core/skbuff.c:704
 alloc_skb include/linux/skbuff.h:1384 [inline]
 nlmsg_new include/net/netlink.h:1055 [inline]
 rtmsg_ifinfo_build_skb+0x7f/0x260 net/core/rtnetlink.c:4585
 rtmsg_ifinfo_event net/core/rtnetlink.c:4627 [inline]
 rtmsg_ifinfo+0x8c/0x1a0 net/core/rtnetlink.c:4636
 netif_state_change+0x297/0x3a0 net/core/dev.c:1627
 __linkwatch_run_queue+0x52a/0x800 net/core/link_watch.c:240
 linkwatch_event+0x4c/0x60 net/core/link_watch.c:314
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158

Memory state around the buggy address:
 ffff888021fd7000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888021fd7080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888021fd7100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                    ^
 ffff888021fd7180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888021fd7200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	90                   	nop
   1:	0f 0b                	ud2
   3:	90                   	nop
   4:	e9 fe fe ff ff       	jmp    0xffffff07
   9:	66 90                	xchg   %ax,%ax
   b:	90                   	nop
   c:	90                   	nop
   d:	90                   	nop
   e:	90                   	nop
   f:	90                   	nop
  10:	90                   	nop
  11:	90                   	nop
  12:	90                   	nop
  13:	90                   	nop
  14:	90                   	nop
  15:	90                   	nop
  16:	90                   	nop
  17:	90                   	nop
  18:	90                   	nop
  19:	90                   	nop
  1a:	90                   	nop
  1b:	f3 0f 1e fa          	endbr64
  1f:	55                   	push   %rbp
  20:	41 57                	push   %r15
  22:	41 56                	push   %r14
  24:	41 55                	push   %r13
  26:	41 54                	push   %r12
  28:	53                   	push   %rbx
* 29:	48 83 ec 20          	sub    $0x20,%rsp <-- trapping instruction
  2d:	48 89 fb             	mov    %rdi,%rbx
  30:	48 bd 00 00 00 00 00 	movabs $0xdffffc0000000000,%rbp
  37:	fc ff df
  3a:	48 83 c7 68          	add    $0x68,%rdi
  3e:	48                   	rex.W