usb 5-1: [ueagle-atm] pre-firmware device, uploading firmware
usb 5-1: [ueagle-atm] loading firmware ueagle-atm/adi930.fw
usb 5-1: USB disconnect, device number 7
==================================================================
BUG: KASAN: slab-out-of-bounds in __mutex_lock_common+0x118/0x2400 kernel/locking/mutex.c:575
Read of size 8 at addr ffff8880205fa468 by task kworker/0:15/4679

CPU: 0 PID: 4679 Comm: kworker/0:15 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
 print_address_description+0x60/0x2d0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:434 [inline]
 kasan_report+0xdf/0x130 mm/kasan/report.c:451
 __mutex_lock_common+0x118/0x2400 kernel/locking/mutex.c:575
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 usbatm_usb_disconnect+0x70/0x5d0 drivers/usb/atm/usbatm.c:1218
 uea_disconnect+0x1f8/0x2f0 drivers/usb/atm/ueagle-atm.c:2649
 usb_unbind_interface+0x203/0x870 drivers/usb/core/driver.c:458
 __device_release_driver drivers/base/dd.c:1249 [inline]
 device_release_driver_internal+0x487/0x710 drivers/base/dd.c:1282
 bus_remove_device+0x2dd/0x400 drivers/base/bus.c:531
 device_del+0x63f/0xa80 drivers/base/core.c:3615
 usb_disable_device+0x3e7/0x8a0 drivers/usb/core/message.c:1472
 usb_disconnect+0x33c/0x8a0 drivers/usb/core/hub.c:2287
 hub_port_connect drivers/usb/core/hub.c:5341 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5637 [inline]
 port_event drivers/usb/core/hub.c:5799 [inline]
 hub_event+0x1d64/0x5260 drivers/usb/core/hub.c:5881
 process_one_work+0x867/0xff0 kernel/workqueue.c:2310
 process_scheduled_works kernel/workqueue.c:2373 [inline]
 worker_thread+0xd93/0x12a0 kernel/workqueue.c:2459
 kthread+0x42e/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>

Allocated by task 4187:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:434 [inline]
 ____kasan_kmalloc mm/kasan/common.c:513 [inline]
 __kasan_kmalloc+0xaf/0xe0 mm/kasan/common.c:522
 kmalloc_array_node include/linux/slab.h:700 [inline]
 kcalloc_node include/linux/slab.h:705 [inline]
 memcg_alloc_page_obj_cgroups+0x7d/0x120 mm/memcontrol.c:2839
 memcg_slab_post_alloc_hook mm/slab.h:313 [inline]
 slab_post_alloc_hook+0xba/0x380 mm/slab.h:526
 slab_alloc_node mm/slub.c:3225 [inline]
 slab_alloc mm/slub.c:3233 [inline]
 kmem_cache_alloc+0x15d/0x280 mm/slub.c:3238
 kmem_cache_zalloc include/linux/slab.h:728 [inline]
 __alloc_file+0x25/0x240 fs/file_table.c:132
 alloc_empty_file+0x90/0x180 fs/file_table.c:181
 alloc_file+0x5c/0x510 fs/file_table.c:223
 alloc_file_pseudo+0x180/0x200 fs/file_table.c:263
 sock_alloc_file+0xb3/0x240 net/socket.c:464
 sock_map_fd net/socket.c:488 [inline]
 __sys_socket+0x11d/0x170 net/socket.c:1598
 __do_sys_socket net/socket.c:1603 [inline]
 __se_sys_socket net/socket.c:1601 [inline]
 __x64_sys_socket+0x76/0x80 net/socket.c:1601
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

The buggy address belongs to the object at ffff8880205fa400
 which belongs to the cache kmalloc-96 of size 96
The buggy address is located 8 bytes to the right of
 96-byte region [ffff8880205fa400, ffff8880205fa460)
The buggy address belongs to the page:
page:ffffea0000817e80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x205fa
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffffea0000849e00 0000000300000003 ffff888016c41780
raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY), pid 3566, ts 32082815197, free_ts 30057650824
 prep_new_page mm/page_alloc.c:2426 [inline]
 get_page_from_freelist+0x24f6/0x2670 mm/page_alloc.c:4192
 __alloc_pages+0x1ee/0x480 mm/page_alloc.c:5501
 alloc_slab_page mm/slub.c:1780 [inline]
 allocate_slab mm/slub.c:1917 [inline]
 new_slab+0xc0/0x4b0 mm/slub.c:1980
 ___slab_alloc+0x807/0xdd0 mm/slub.c:3013
 __slab_alloc mm/slub.c:3100 [inline]
 slab_alloc_node mm/slub.c:3191 [inline]
 slab_alloc mm/slub.c:3233 [inline]
 __kmalloc+0x11d/0x340 mm/slub.c:4408
 kmalloc include/linux/slab.h:612 [inline]
 kzalloc include/linux/slab.h:738 [inline]
 tomoyo_encode2 security/tomoyo/realpath.c:45 [inline]
 tomoyo_encode+0x28a/0x550 security/tomoyo/realpath.c:80
 tomoyo_realpath_from_path+0x5a2/0x5e0 security/tomoyo/realpath.c:288
 tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
 tomoyo_check_open_permission+0x1eb/0x410 security/tomoyo/file.c:771
 security_file_open+0x5e/0xa0 security/security.c:1669
 do_dentry_open+0x321/0xf90 fs/open.c:813
 do_open fs/namei.c:3616 [inline]
 path_openat+0x2718/0x2fb0 fs/namei.c:3750
 do_filp_open+0x1df/0x400 fs/namei.c:3777
 do_sys_openat2+0x14b/0x500 fs/open.c:1255
 do_sys_open fs/open.c:1271 [inline]
 __do_sys_openat fs/open.c:1287 [inline]
 __se_sys_openat fs/open.c:1282 [inline]
 __x64_sys_openat+0x135/0x160 fs/open.c:1282
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1340 [inline]
 free_pcp_prepare mm/page_alloc.c:1391 [inline]
 free_unref_page_prepare+0x637/0x6c0 mm/page_alloc.c:3317
 free_unref_page+0x8f/0x2a0 mm/page_alloc.c:3396
 free_slab mm/slub.c:2020 [inline]
 discard_slab mm/slub.c:2026 [inline]
 __unfreeze_partials+0x188/0x1e0 mm/slub.c:2512
 put_cpu_partial+0x12d/0x190 mm/slub.c:2592
 qlist_free_all+0x35/0x90 mm/kasan/quarantine.c:176
 kasan_quarantine_reduce+0x150/0x160 mm/kasan/quarantine.c:283
 __kasan_slab_alloc+0x2f/0xc0 mm/kasan/common.c:444
 kasan_slab_alloc include/linux/kasan.h:254 [inline]
 slab_post_alloc_hook+0x4c/0x380 mm/slab.h:519
 slab_alloc_node mm/slub.c:3225 [inline]
 slab_alloc mm/slub.c:3233 [inline]
 kmem_cache_alloc+0x15d/0x280 mm/slub.c:3238
 getname_flags+0xb7/0x4f0 fs/namei.c:138
 do_sys_openat2+0xdd/0x500 fs/open.c:1249
 do_sys_open fs/open.c:1271 [inline]
 __do_sys_openat fs/open.c:1287 [inline]
 __se_sys_openat fs/open.c:1282 [inline]
 __x64_sys_openat+0x135/0x160 fs/open.c:1282
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

Memory state around the buggy address:
 ffff8880205fa300: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
 ffff8880205fa380: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc
>ffff8880205fa400: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
 ffff8880205fa480: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
 ffff8880205fa500: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc