program:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
[ 93.520452][ T5278] Bluetooth: hci0: command tx timeout
[ 93.539374][ T936] cfg80211: failed to load regulatory.db
[ 93.873646][ T807] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 94.035830][ T807] usb 5-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice= 1.00
[ 94.037699][ T807] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64
[ 94.037713][ T807] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64
[ 94.037728][ T807] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64
[ 94.039696][ T807] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 94.039712][ T807] usb 5-1: Product: syz
[ 94.039720][ T807] usb 5-1: Manufacturer: syz
[ 94.086029][ T5313] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[ 94.086242][ T5313] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[ 94.086419][ T5313] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[ 94.599789][ T807] redrat3 5-1:1.0: Problem fetching firmware ID
[ 94.622297][ T807] redrat3 5-1:1.0: Failed to read timeout from hardware
[ 94.704730][ T807] rc_core: IR keymap rc-hauppauge not found
[ 94.704776][ T807] Registered IR keymap rc-empty
[ 94.711175][ T807] rc rc0: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/rc/rc0
[ 94.730474][ T807] input: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/rc/rc0/input5
[ 94.752964][ T807] redrat3 5-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0
[ 94.758000][ T807] redrat3 5-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0
[ 94.758022][ T807] redrat3 5-1:1.0: redrat3_enable_detector: detector status: -5, should be 1
[ 94.786477][ T807] redrat3 5-1:1.0: probe with driver redrat3 failed with error -5
[ 94.788502][ T5316] ==================================================================
[ 94.788522][ T5316] BUG: KASAN: slab-use-after-free in string+0x216/0x2d0
[ 94.788668][ T5316] Read of size 1 at addr ffff88804251c758 by task udevd/5316
[ 94.788686][ T5316]
[ 94.788705][ T5316] CPU: 0 UID: 0 PID: 5316 Comm: udevd Not tainted syzkaller #0 PREEMPT(full)
[ 94.788733][ T5316] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.788740][ T5316] Call Trace:
[ 94.788753][ T5316]
[ 94.788765][ T5316] dump_stack_lvl+0xe8/0x150
[ 94.788807][ T5316] print_address_description+0x55/0x1e0
[ 94.788823][ T5316] ? string+0x216/0x2d0
[ 94.788836][ T5316] print_report+0x58/0x70
[ 94.788849][ T5316] kasan_report+0x117/0x150
[ 94.788879][ T5316] ? string+0x216/0x2d0
[ 94.788894][ T5316] string+0x216/0x2d0
[ 94.788909][ T5316] vsnprintf+0x74a/0xef0
[ 94.788932][ T5316] add_uevent_var+0x1ce/0x460
[ 94.788951][ T5316] ? __pfx_add_uevent_var+0x10/0x10
[ 94.788967][ T5316] input_dev_uevent+0x119/0x6e0
[ 94.789001][ T5316] dev_uevent+0x537/0x870
[ 94.789081][ T5316] ? __pfx_dev_uevent+0x10/0x10
[ 94.789096][ T5316] ? __kasan_kmalloc+0x93/0xb0
[ 94.789107][ T5316] ? __kmalloc_cache_noprof+0x321/0x600
[ 94.789123][ T5316] ? __kmalloc_cache_noprof+0x14d/0x600
[ 94.789137][ T5316] ? uevent_show+0x15c/0x310
[ 94.789151][ T5316] uevent_show+0x1a0/0x310
[ 94.789164][ T5316] dev_attr_show+0x58/0xc0
[ 94.789177][ T5316] ? __pfx_dev_attr_show+0x10/0x10
[ 94.789189][ T5316] sysfs_kf_seq_show+0x331/0x490
[ 94.789206][ T5316] seq_read_iter+0x463/0xca0
[ 94.789220][ T5316] vfs_read+0x595/0xa80
[ 94.789237][ T5316] ? __pfx_vfs_read+0x10/0x10
[ 94.789251][ T5316] ? do_sys_openat2+0x14e/0x200
[ 94.789266][ T5316] ksys_read+0x150/0x270
[ 94.789280][ T5316] ? __pfx_ksys_read+0x10/0x10
[ 94.789296][ T5316] do_syscall_64+0x166/0x520
[ 94.789307][ T5316] ? trace_irq_disable+0x3b/0x140
[ 94.789327][ T5316] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.789338][ T5316] ? clear_bhb_loop+0x70/0xc0
[ 94.789351][ T5316] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.789361][ T5316] RIP: 0033:0x7f9889ea7407
[ 94.789371][ T5316] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[ 94.789391][ T5316] RSP: 002b:00007ffdb0f158d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[ 94.789405][ T5316] RAX: ffffffffffffffda RBX: 00007f988a5d1880 RCX: 00007f9889ea7407
[ 94.789412][ T5316] RDX: 0000000000001000 RSI: 00005576dfdd5ce0 RDI: 0000000000000008
[ 94.789419][ T5316] RBP: 00007f9889fefff0 R08: 0000000000000000 R09: 0000000000000000
[ 94.789426][ T5316] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
[ 94.789433][ T5316] R13: 00007f9889fefea0 R14: 0000000000000000 R15: 00005576dfdc5c90
[ 94.789444][ T5316]
[ 94.789448][ T5316]
[ 94.789451][ T5316] Allocated by task 807:
[ 94.789471][ T5316] kasan_save_track+0x3e/0x80
[ 94.789487][ T5316] __kasan_kmalloc+0x93/0xb0
[ 94.789496][ T5316] __kmalloc_cache_noprof+0x321/0x600
[ 94.789509][ T5316] redrat3_dev_probe+0x477/0x2570
[ 94.789523][ T5316] usb_probe_interface+0x788/0xe50
[ 94.789544][ T5316] really_probe+0x254/0xae0
[ 94.789554][ T5316] __driver_probe_device+0x1e8/0x360
[ 94.789563][ T5316] driver_probe_device+0x4f/0x240
[ 94.789572][ T5316] __device_attach_driver+0x270/0x410
[ 94.789583][ T5316] bus_for_each_drv+0x258/0x2f0
[ 94.789595][ T5316] __device_attach+0x2c4/0x450
[ 94.789604][ T5316] device_initial_probe+0xa1/0xd0
[ 94.789612][ T5316] bus_probe_device+0x12a/0x220
[ 94.789624][ T5316] device_add+0x7d7/0xb80
[ 94.789638][ T5316] usb_set_configuration+0x1ad8/0x2180
[ 94.789649][ T5316] usb_generic_driver_probe+0x8d/0x150
[ 94.789663][ T5316] usb_probe_device+0x1c3/0x3b0
[ 94.789673][ T5316] really_probe+0x254/0xae0
[ 94.789682][ T5316] __driver_probe_device+0x1e8/0x360
[ 94.789692][ T5316] driver_probe_device+0x4f/0x240
[ 94.789701][ T5316] __device_attach_driver+0x270/0x410
[ 94.789711][ T5316] bus_for_each_drv+0x258/0x2f0
[ 94.789722][ T5316] __device_attach+0x2c4/0x450
[ 94.789731][ T5316] device_initial_probe+0xa1/0xd0
[ 94.789740][ T5316] bus_probe_device+0x12a/0x220
[ 94.789751][ T5316] device_add+0x7d7/0xb80
[ 94.789764][ T5316] usb_new_device+0x9aa/0x1690
[ 94.789778][ T5316] hub_event+0x28e8/0x4d30
[ 94.789787][ T5316] process_scheduled_works+0xc3d/0x1630
[ 94.789800][ T5316] worker_thread+0xa47/0xfb0
[ 94.789812][ T5316] kthread+0x38b/0x480
[ 94.789821][ T5316] ret_from_fork+0x514/0xb70
[ 94.789831][ T5316] ret_from_fork_asm+0x1a/0x30
[ 94.789846][ T5316]
[ 94.789848][ T5316] Freed by task 807:
[ 94.789853][ T5316] kasan_save_track+0x3e/0x80
[ 94.789867][ T5316] kasan_save_free_info+0x40/0x50
[ 94.789879][ T5316] __kasan_slab_free+0x5c/0x80
[ 94.789887][ T5316] kfree+0x1c5/0x650
[ 94.789899][ T5316] redrat3_dev_probe+0x1bf4/0x2570
[ 94.789911][ T5316] usb_probe_interface+0x788/0xe50
[ 94.789928][ T5316] really_probe+0x254/0xae0
[ 94.789938][ T5316] __driver_probe_device+0x1e8/0x360
[ 94.789946][ T5316] driver_probe_device+0x4f/0x240
[ 94.789956][ T5316] __device_attach_driver+0x270/0x410
[ 94.789966][ T5316] bus_for_each_drv+0x258/0x2f0
[ 94.789978][ T5316] __device_attach+0x2c4/0x450
[ 94.789987][ T5316] device_initial_probe+0xa1/0xd0
[ 94.789996][ T5316] bus_probe_device+0x12a/0x220
[ 94.790008][ T5316] device_add+0x7d7/0xb80
[ 94.790021][ T5316] usb_set_configuration+0x1ad8/0x2180
[ 94.790031][ T5316] usb_generic_driver_probe+0x8d/0x150
[ 94.790040][ T5316] usb_probe_device+0x1c3/0x3b0
[ 94.790050][ T5316] really_probe+0x254/0xae0
[ 94.790060][ T5316] __driver_probe_device+0x1e8/0x360
[ 94.790069][ T5316] driver_probe_device+0x4f/0x240
[ 94.790079][ T5316] __device_attach_driver+0x270/0x410
[ 94.790089][ T5316] bus_for_each_drv+0x258/0x2f0
[ 94.790101][ T5316] __device_attach+0x2c4/0x450
[ 94.790109][ T5316] device_initial_probe+0xa1/0xd0
[ 94.790118][ T5316] bus_probe_device+0x12a/0x220
[ 94.790129][ T5316] device_add+0x7d7/0xb80
[ 94.790143][ T5316] usb_new_device+0x9aa/0x1690
[ 94.790155][ T5316] hub_event+0x28e8/0x4d30
[ 94.790165][ T5316] process_scheduled_works+0xc3d/0x1630
[ 94.790177][ T5316] worker_thread+0xa47/0xfb0
[ 94.790190][ T5316] kthread+0x38b/0x480
[ 94.790198][ T5316] ret_from_fork+0x514/0xb70
[ 94.790206][ T5316] ret_from_fork_asm+0x1a/0x30
[ 94.790220][ T5316]
[ 94.790223][ T5316] The buggy address belongs to the object at ffff88804251c000
[ 94.790223][ T5316] which belongs to the cache kmalloc-2k of size 2048
[ 94.790232][ T5316] The buggy address is located 1880 bytes inside of
[ 94.790232][ T5316] freed 2048-byte region [ffff88804251c000, ffff88804251c800)
[ 94.790244][ T5316]
[ 94.790246][ T5316] The buggy address belongs to the physical page:
[ 94.790253][ T5316] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x42518
[ 94.790271][ T5316] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 94.790280][ T5316] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff)
[ 94.790291][ T5316] page_type: f5(slab)
[ 94.790301][ T5316] raw: 04fff00000000040 ffff88801b042000 dead000000000100 dead000000000122
[ 94.790309][ T5316] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 94.790319][ T5316] head: 04fff00000000040 ffff88801b042000 dead000000000100 dead000000000122
[ 94.790328][ T5316] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 94.790337][ T5316] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 94.790345][ T5316] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 94.790350][ T5316] page dumped because: kasan: bad access detected
[ 94.790355][ T5316] page_owner tracks the page as allocated
[ 94.790359][ T5316] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 10, tgid 10 (kworker/0:1), ts 94013840665
[ 94.790377][ T5316] post_alloc_hook+0x1f9/0x250
[ 94.790389][ T5316] get_page_from_freelist+0x2209/0x2280
[ 94.790404][ T5316] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 94.790418][ T5316] allocate_slab+0x7d/0x620
[ 94.790429][ T5316] refill_objects+0x2d5/0x350
[ 94.790440][ T5316] __pcs_replace_empty_main+0x2c8/0x6c0
[ 94.790451][ T5316] __kmalloc_node_track_caller_noprof+0x548/0x720
[ 94.790465][ T5316] __alloc_skb+0x2c1/0x7a0
[ 94.790487][ T5316] mld_newpack+0x165/0xcb0
[ 94.790506][ T5316] add_grec+0x119f/0x19d0
[ 94.790515][ T5316] mld_send_initial_cr+0x288/0x550
[ 94.790524][ T5316] mld_dad_work+0x3d/0x480
[ 94.790532][ T5316] process_scheduled_works+0xc3d/0x1630
[ 94.790544][ T5316] worker_thread+0xa47/0xfb0
[ 94.790557][ T5316] kthread+0x38b/0x480
[ 94.790565][ T5316] ret_from_fork+0x514/0xb70
[ 94.790574][ T5316] page last free pid 936 tgid 936 ts 93661838932 stack trace:
[ 94.790581][ T5316] __free_frozen_pages+0xc93/0xd90
[ 94.790594][ T5316] __slab_free+0x274/0x2c0
[ 94.790607][ T5316] qlist_free_all+0x99/0x100
[ 94.790620][ T5316] kasan_quarantine_reduce+0x148/0x160
[ 94.790634][ T5316] __kasan_slab_alloc+0x22/0x80
[ 94.790642][ T5316] kmem_cache_alloc_node_noprof+0x354/0x610
[ 94.790655][ T5316] __alloc_skb+0x1db/0x7a0
[ 94.790663][ T5316] mld_newpack+0x165/0xcb0
[ 94.790673][ T5316] add_grec+0x119f/0x19d0
[ 94.790682][ T5316] mld_send_initial_cr+0x288/0x550
[ 94.790691][ T5316] mld_dad_work+0x3d/0x480
[ 94.790699][ T5316] process_scheduled_works+0xc3d/0x1630
[ 94.790711][ T5316] worker_thread+0xa47/0xfb0
[ 94.790724][ T5316] kthread+0x38b/0x480
[ 94.790732][ T5316] ret_from_fork+0x514/0xb70
[ 94.790740][ T5316] ret_from_fork_asm+0x1a/0x30
[ 94.790755][ T5316]
[ 94.790757][ T5316] Memory state around the buggy address:
[ 94.790763][ T5316] ffff88804251c600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 94.790771][ T5316] ffff88804251c680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 94.790778][ T5316] >ffff88804251c700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 94.790783][ T5316] ^
[ 94.790789][ T5316] ffff88804251c780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 94.790795][ T5316] ffff88804251c800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.790800][ T5316] ==================================================================
[ 95.229881][ T5316] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 95.256704][ T5316] CPU: 0 UID: 0 PID: 5316 Comm: udevd Not tainted syzkaller #0 PREEMPT(full)
[ 95.260557][ T5316] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.264915][ T5316] Call Trace:
[ 95.266376][ T5316]
[ 95.267712][ T5316] vpanic+0x56d/0xa60
[ 95.269474][ T5316] ? rcu_is_watching+0x16/0xb0
[ 95.271562][ T5316] ? __pfx_vpanic+0x10/0x10
[ 95.273665][ T5316] ? __pfx___schedule+0x10/0x10
[ 95.275698][ T5316] panic+0xc5/0xd0
[ 95.277304][ T5316] ? __pfx_panic+0x10/0x10
[ 95.279276][ T5316] ? preempt_schedule_thunk+0x16/0x40
[ 95.281724][ T5316] ? string+0x216/0x2d0
[ 95.283348][ T5316] check_panic_on_warn+0x89/0xb0
[ 95.285165][ T5316] ? string+0x216/0x2d0
[ 95.286666][ T5316] end_report+0x73/0x170
[ 95.288499][ T5316] ? string+0x216/0x2d0
[ 95.290689][ T5316] kasan_report+0x128/0x150
[ 95.293007][ T5316] ? string+0x216/0x2d0
[ 95.294872][ T5316] string+0x216/0x2d0
[ 95.296659][ T5316] vsnprintf+0x74a/0xef0
[ 95.298564][ T5316] add_uevent_var+0x1ce/0x460
[ 95.300602][ T5316] ? __pfx_add_uevent_var+0x10/0x10
[ 95.302854][ T5316] input_dev_uevent+0x119/0x6e0
[ 95.305066][ T5316] dev_uevent+0x537/0x870
[ 95.306957][ T5316] ? __pfx_dev_uevent+0x10/0x10
[ 95.308990][ T5316] ? __kasan_kmalloc+0x93/0xb0
[ 95.310710][ T5316] ? __kmalloc_cache_noprof+0x321/0x600
[ 95.312907][ T5316] ? __kmalloc_cache_noprof+0x14d/0x600
[ 95.315067][ T5316] ? uevent_show+0x15c/0x310
[ 95.317104][ T5316] uevent_show+0x1a0/0x310
[ 95.319029][ T5316] dev_attr_show+0x58/0xc0
[ 95.320965][ T5316] ? __pfx_dev_attr_show+0x10/0x10
[ 95.323198][ T5316] sysfs_kf_seq_show+0x331/0x490
[ 95.325461][ T5316] seq_read_iter+0x463/0xca0
[ 95.327558][ T5316] vfs_read+0x595/0xa80
[ 95.329485][ T5316] ? __pfx_vfs_read+0x10/0x10
[ 95.331634][ T5316] ? do_sys_openat2+0x14e/0x200
[ 95.333841][ T5316] ksys_read+0x150/0x270
[ 95.335757][ T5316] ? __pfx_ksys_read+0x10/0x10
[ 95.337868][ T5316] do_syscall_64+0x166/0x520
[ 95.339984][ T5316] ? trace_irq_disable+0x3b/0x140
[ 95.342274][ T5316] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.345016][ T5316] ? clear_bhb_loop+0x70/0xc0
[ 95.347137][ T5316] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.349830][ T5316] RIP: 0033:0x7f9889ea7407
[ 95.351859][ T5316] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[ 95.360465][ T5316] RSP: 002b:00007ffdb0f158d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[ 95.364255][ T5316] RAX: ffffffffffffffda RBX: 00007f988a5d1880 RCX: 00007f9889ea7407
[ 95.367800][ T5316] RDX: 0000000000001000 RSI: 00005576dfdd5ce0 RDI: 0000000000000008
[ 95.371373][ T5316] RBP: 00007f9889fefff0 R08: 0000000000000000 R09: 0000000000000000
[ 95.375003][ T5316] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
[ 95.378466][ T5316] R13: 00007f9889fefea0 R14: 0000000000000000 R15: 00005576dfdc5c90
[ 95.382052][ T5316]
[ 95.383926][ T5316] Kernel Offset: disabled
[ 95.385892][ T5316] Rebooting in 86400 seconds..