TITLE: KASAN: use-after-free Write in iowarrior_disconnect

[   72.512165][   T17] ==================================================================
[   72.520532][   T17] BUG: KASAN: use-after-free in usb_kill_urb+0x18f/0x2c0
[   72.527601][   T17] Write of size 4 at addr ffff8881d586ca14 by task kworker/1:0/17
[   72.535386][   T17]
[   72.537703][   T17] CPU: 1 PID: 17 Comm: kworker/1:0 Not tainted 5.3.0-rc5+ #28
[   72.545140][   T17] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   72.555187][   T17] Workqueue: usb_hub_wq hub_event
[   72.560191][   T17] Call Trace:
[   72.563470][   T17]  dump_stack+0xca/0x13e
[   72.567758][   T17]  ? usb_kill_urb+0x18f/0x2c0
[   72.572512][   T17]  ? usb_kill_urb+0x18f/0x2c0
[   72.577185][   T17]  print_address_description+0x6a/0x32c
[   72.582980][   T17]  ? usb_kill_urb+0x18f/0x2c0
[   72.587638][   T17]  ? usb_kill_urb+0x18f/0x2c0
[   72.592301][   T17]  __kasan_report.cold+0x1a/0x33
[   72.597239][   T17]  ? mark_held_locks+0x21/0xe0
[   72.601990][   T17]  ? usb_kill_urb+0x18f/0x2c0
[   72.606646][   T17]  kasan_report+0xe/0x12
[   72.610887][   T17]  check_memory_region+0x128/0x190
[   72.615983][   T17]  usb_kill_urb+0x18f/0x2c0
[   72.620467][   T17]  ? usb_poison_anchored_urbs+0x150/0x150
[   72.626178][   T17]  ? __mutex_unlock_slowpath+0x2d6/0x670
[   72.631802][   T17]  ? wait_for_completion+0x3c0/0x3c0
[   72.637112][   T17]  ? finish_wait+0x260/0x260
[   72.641698][   T17]  iowarrior_disconnect+0x176/0x2c0
[   72.646913][   T17]  usb_unbind_interface+0x1bd/0x8a0
[   72.652102][   T17]  ? usb_autoresume_device+0x60/0x60
[   72.657387][   T17]  device_release_driver_internal+0x42f/0x500
[   72.663467][   T17]  bus_remove_device+0x2dc/0x4a0
[   72.668431][   T17]  device_del+0x420/0xb10
[   72.672845][   T17]  ? __device_links_no_driver+0x240/0x240
[   72.678549][   T17]  ? usb_remove_ep_devs+0x3e/0x80
[   72.683643][   T17]  ? remove_intf_ep_devs+0x13f/0x1d0
[   72.688928][   T17]  usb_disable_device+0x211/0x690
[   72.693942][   T17]  usb_disconnect+0x284/0x8d0
[   72.698616][   T17]  hub_event+0x1454/0x3640
[   72.703025][   T17]  ? find_held_lock+0x2d/0x110
[   72.707860][   T17]  ? mark_held_locks+0xe0/0xe0
[   72.712603][   T17]  ? hub_port_debounce+0x260/0x260
[   72.717694][   T17]  process_one_work+0x92b/0x1530
[   72.722622][   T17]  ? pwq_dec_nr_in_flight+0x310/0x310
[   72.728008][   T17]  ? do_raw_spin_lock+0x11a/0x280
[   72.733032][   T17]  worker_thread+0x96/0xe20
[   72.737535][   T17]  ? process_one_work+0x1530/0x1530
[   72.742723][   T17]  kthread+0x318/0x420
[   72.746810][   T17]  ? kthread_create_on_node+0xf0/0xf0
[   72.752171][   T17]  ret_from_fork+0x24/0x30
[   72.756563][   T17]
[   72.758870][   T17] Allocated by task 2767:
[   72.763177][   T17]  save_stack+0x1b/0x80
[   72.767331][   T17]  __kasan_kmalloc.constprop.0+0xbf/0xd0
[   72.772977][   T17]  usb_alloc_urb+0x65/0xb0
[   72.777397][   T17]  iowarrior_probe+0x4b2/0x10b2
[   72.782256][   T17]  usb_probe_interface+0x305/0x7a0
[   72.787367][   T17]  really_probe+0x281/0x6d0
[   72.791854][   T17]  driver_probe_device+0x101/0x1b0
[   72.797034][   T17]  __device_attach_driver+0x1c2/0x220
[   72.802403][   T17]  bus_for_each_drv+0x162/0x1e0
[   72.807251][   T17]  __device_attach+0x217/0x360
[   72.812004][   T17]  bus_probe_device+0x1e4/0x290
[   72.816832][   T17]  device_add+0xae6/0x16f0
[   72.821232][   T17]  usb_set_configuration+0xdf6/0x1670
[   72.826587][   T17]  generic_probe+0x9d/0xd5
[   72.830981][   T17]  usb_probe_device+0x99/0x100
[   72.835726][   T17]  really_probe+0x281/0x6d0
[   72.840470][   T17]  driver_probe_device+0x101/0x1b0
[   72.845562][   T17]  __device_attach_driver+0x1c2/0x220
[   72.850914][   T17]  bus_for_each_drv+0x162/0x1e0
[   72.855746][   T17]  __device_attach+0x217/0x360
[   72.860613][   T17]  bus_probe_device+0x1e4/0x290
[   72.865443][   T17]  device_add+0xae6/0x16f0
[   72.869843][   T17]  usb_new_device.cold+0x6a4/0xe79
[   72.874936][   T17]  hub_event+0x1b5c/0x3640
[   72.879365][   T17]  process_one_work+0x92b/0x1530
[   72.884282][   T17]  worker_thread+0x96/0xe20
[   72.888780][   T17]  kthread+0x318/0x420
[   72.892827][   T17]  ret_from_fork+0x24/0x30
[   72.897220][   T17]
[   72.899527][   T17] Freed by task 0:
[   72.903585][   T17]  save_stack+0x1b/0x80
[   72.907811][   T17]  __kasan_slab_free+0x130/0x180
[   72.912736][   T17]  kfree+0xe4/0x2f0
[   72.916530][   T17]  usb_free_urb.part.0+0x7a/0xc0
[   72.921444][   T17]  usb_free_urb+0x1b/0x30
[   72.925752][   T17]  usb_hcd_giveback_urb+0x368/0x420
[   72.930927][   T17]  dummy_timer+0x120f/0x2fa2
[   72.935496][   T17]  call_timer_fn+0x179/0x650
[   72.940065][   T17]  run_timer_softirq+0x5cc/0x14b0
[   72.945073][   T17]  __do_softirq+0x221/0x912
[   72.949548][   T17]
[   72.951876][   T17] The buggy address belongs to the object at ffff8881d586ca00
[   72.951876][   T17]  which belongs to the cache kmalloc-192 of size 192
[   72.965914][   T17] The buggy address is located 20 bytes inside of
[   72.965914][   T17]  192-byte region [ffff8881d586ca00, ffff8881d586cac0)
[   72.979174][   T17] The buggy address belongs to the page:
[   72.984790][   T17] page:ffffea0007561b00 refcount:1 mapcount:0 mapping:ffff8881da002a00 index:0x0
[   72.993874][   T17] flags: 0x200000000000200(slab)
[   72.998796][   T17] raw: 0200000000000200 dead000000000100 dead000000000122 ffff8881da002a00
[   73.007359][   T17] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
[   73.015922][   T17] page dumped because: kasan: bad access detected
[   73.022310][   T17]
[   73.024614][   T17] Memory state around the buggy address:
[   73.030227][   T17]  ffff8881d586c900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   73.038271][   T17]  ffff8881d586c980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   73.046312][   T17] >ffff8881d586ca00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   73.054353][   T17]                          ^
[   73.058919][   T17]  ffff8881d586ca80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   73.067044][   T17]  ffff8881d586cb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   73.075087][   T17] ==================================================================