program:
socket$inet_tcp(0x2, 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev_mnt\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev_mnt\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000407d1e5a2d00000000000109022400010000000009040000010301020009210000000122220009058103"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00222200000096231306e53f"], 0x0}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev_mnt/roccatsavu0\x00', 0x2, 0x0)
r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, 0x0)
close(0x4)
ioctl$DRM_IOCTL_PANTHOR_BO_CREATE(r1, 0xc0186445, 0x0)
[ 147.979455][ T5292] Bluetooth: hci0: command tx timeout
[ 148.334146][ T54] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 148.485676][ T54] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00
[ 148.487673][ T54] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 148.487695][ T54] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[ 148.487719][ T54] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 148.513207][ T54] usb 5-1: config 0 descriptor??
[ 148.938240][ T54] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 148.938282][ T54] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 148.938296][ T54] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 148.938309][ T54] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 148.938322][ T54] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 148.938335][ T54] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 148.938348][ T54] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 148.938360][ T54] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 148.938373][ T54] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 148.938386][ T54] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 148.986146][ T54] savu 0003:1E7D:2D5A.0002: hidraw1: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.0-1/input0
[ 149.176871][ T54] usb 5-1: USB disconnect, device number 2
[ 149.196538][ T54] ==================================================================
[ 149.196547][ T54] BUG: KASAN: slab-use-after-free in roccat_disconnect+0x23d/0x250
[ 149.196640][ T54] Read of size 4 at addr ffff888051221008 by task kworker/0:2/54
[ 149.196650][ T54]
[ 149.196657][ T54] CPU: 0 UID: 0 PID: 54 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full)
[ 149.196669][ T54] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 149.196677][ T54] Workqueue: usb_hub_wq hub_event
[ 149.196701][ T54] Call Trace:
[ 149.196707][ T54]
[ 149.196712][ T54] dump_stack_lvl+0xe8/0x150
[ 149.196728][ T54] print_address_description+0x55/0x1e0
[ 149.196744][ T54] ? roccat_disconnect+0x23d/0x250
[ 149.196753][ T54] print_report+0x58/0x70
[ 149.196766][ T54] kasan_report+0x117/0x150
[ 149.196777][ T54] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 149.196811][ T54] ? roccat_disconnect+0x23d/0x250
[ 149.196823][ T54] roccat_disconnect+0x23d/0x250
[ 149.196833][ T54] savu_remove+0xe9/0x160
[ 149.196847][ T54] ? __pfx_savu_remove+0x10/0x10
[ 149.196857][ T54] hid_device_remove+0xc5/0x1c0
[ 149.196866][ T54] ? __pfx_hid_device_remove+0x10/0x10
[ 149.196874][ T54] device_release_driver_internal+0x48b/0x880
[ 149.196912][ T54] bus_remove_device+0x444/0x560
[ 149.196921][ T54] ? __pfx_bus_remove_device+0x10/0x10
[ 149.196933][ T54] ? kernfs_remove_by_name_ns+0x101/0x140
[ 149.196941][ T54] device_del+0x524/0x8f0
[ 149.196948][ T54] ? __pfx_device_del+0x10/0x10
[ 149.196959][ T54] hid_destroy_device+0x6b/0x1b0
[ 149.196967][ T54] usbhid_disconnect+0x9f/0xc0
[ 149.196976][ T54] usb_unbind_interface+0x295/0x9f0
[ 149.196984][ T54] ? kernfs_remove_by_name_ns+0x101/0x140
[ 149.196991][ T54] ? kernfs_remove_by_name_ns+0x101/0x140
[ 149.196998][ T54] ? __pfx_usb_unbind_interface+0x10/0x10
[ 149.197005][ T54] device_release_driver_internal+0x4f5/0x880
[ 149.197013][ T54] bus_remove_device+0x444/0x560
[ 149.197025][ T54] ? __pfx_bus_remove_device+0x10/0x10
[ 149.197039][ T54] ? kernfs_remove_by_name_ns+0x101/0x140
[ 149.197049][ T54] device_del+0x524/0x8f0
[ 149.197060][ T54] ? __pfx_device_del+0x10/0x10
[ 149.197075][ T54] ? kobject_put+0x516/0x550
[ 149.197090][ T54] usb_disable_device+0x3d4/0x8d0
[ 149.197103][ T54] usb_disconnect+0x346/0x9a0
[ 149.197120][ T54] hub_event+0x1bbb/0x4d30
[ 149.197131][ T54] ? __lock_acquire+0x747/0x2de0
[ 149.197145][ T54] ? register_lock_class+0x31/0x2e0
[ 149.197160][ T54] ? __pfx_hub_event+0x10/0x10
[ 149.197171][ T54] ? rcu_is_watching+0x16/0xb0
[ 149.197183][ T54] ? process_scheduled_works+0x97a/0x1630
[ 149.197197][ T54] process_scheduled_works+0xc3d/0x1630
[ 149.197218][ T54] ? __pfx_process_scheduled_works+0x10/0x10
[ 149.197232][ T54] ? assign_work+0x3cf/0x5d0
[ 149.197246][ T54] worker_thread+0xa47/0xfb0
[ 149.197262][ T54] ? __kthread_parkme+0x71/0x1f0
[ 149.197278][ T54] kthread+0x38b/0x480
[ 149.197289][ T54] ? __pfx_worker_thread+0x10/0x10
[ 149.197302][ T54] ? __pfx_kthread+0x10/0x10
[ 149.197312][ T54] ret_from_fork+0x514/0xb70
[ 149.197323][ T54] ? __pfx_ret_from_fork+0x10/0x10
[ 149.197333][ T54] ? __switch_to+0xc89/0x1420
[ 149.197345][ T54] ? __pfx_kthread+0x10/0x10
[ 149.197352][ T54] ret_from_fork_asm+0x1a/0x30
[ 149.197364][ T54]
[ 149.197366][ T54]
[ 149.197368][ T54] Allocated by task 54:
[ 149.197372][ T54] kasan_save_track+0x3e/0x80
[ 149.197383][ T54] __kasan_kmalloc+0x93/0xb0
[ 149.197391][ T54] __kmalloc_cache_noprof+0x321/0x600
[ 149.197404][ T54] roccat_connect+0x5d/0x4a0
[ 149.197411][ T54] savu_probe+0x18e/0x340
[ 149.197422][ T54] hid_device_probe+0x46a/0x870
[ 149.197439][ T54] really_probe+0x254/0xae0
[ 149.197449][ T54] __driver_probe_device+0x1e8/0x360
[ 149.197458][ T54] driver_probe_device+0x4f/0x240
[ 149.197468][ T54] __device_attach_driver+0x270/0x410
[ 149.197477][ T54] bus_for_each_drv+0x258/0x2f0
[ 149.197485][ T54] __device_attach+0x2c4/0x450
[ 149.197490][ T54] device_initial_probe+0xa1/0xd0
[ 149.197496][ T54] bus_probe_device+0x12a/0x220
[ 149.197504][ T54] device_add+0x7d7/0xb80
[ 149.197512][ T54] hid_add_device+0x272/0x3e0
[ 149.197519][ T54] usbhid_probe+0x9d4/0xde0
[ 149.197526][ T54] usb_probe_interface+0x788/0xe50
[ 149.197533][ T54] really_probe+0x254/0xae0
[ 149.197539][ T54] __driver_probe_device+0x1e8/0x360
[ 149.197544][ T54] driver_probe_device+0x4f/0x240
[ 149.197550][ T54] __device_attach_driver+0x270/0x410
[ 149.197556][ T54] bus_for_each_drv+0x258/0x2f0
[ 149.197564][ T54] __device_attach+0x2c4/0x450
[ 149.197569][ T54] device_initial_probe+0xa1/0xd0
[ 149.197575][ T54] bus_probe_device+0x12a/0x220
[ 149.197582][ T54] device_add+0x7d7/0xb80
[ 149.197591][ T54] usb_set_configuration+0x1ad8/0x2180
[ 149.197597][ T54] usb_generic_driver_probe+0x8d/0x150
[ 149.197606][ T54] usb_probe_device+0x1c3/0x3b0
[ 149.197616][ T54] really_probe+0x254/0xae0
[ 149.197624][ T54] __driver_probe_device+0x1e8/0x360
[ 149.197632][ T54] driver_probe_device+0x4f/0x240
[ 149.197642][ T54] __device_attach_driver+0x270/0x410
[ 149.197651][ T54] bus_for_each_drv+0x258/0x2f0
[ 149.197663][ T54] __device_attach+0x2c4/0x450
[ 149.197672][ T54] device_initial_probe+0xa1/0xd0
[ 149.197680][ T54] bus_probe_device+0x12a/0x220
[ 149.197691][ T54] device_add+0x7d7/0xb80
[ 149.197703][ T54] usb_new_device+0x9aa/0x1690
[ 149.197716][ T54] hub_event+0x28e8/0x4d30
[ 149.197725][ T54] process_scheduled_works+0xc3d/0x1630
[ 149.197737][ T54] worker_thread+0xa47/0xfb0
[ 149.197749][ T54] kthread+0x38b/0x480
[ 149.197757][ T54] ret_from_fork+0x514/0xb70
[ 149.197764][ T54] ret_from_fork_asm+0x1a/0x30
[ 149.197773][ T54]
[ 149.197774][ T54] Freed by task 5326:
[ 149.197778][ T54] kasan_save_track+0x3e/0x80
[ 149.197787][ T54] kasan_save_free_info+0x40/0x50
[ 149.197794][ T54] __kasan_slab_free+0x5c/0x80
[ 149.197800][ T54] kfree+0x1c5/0x650
[ 149.197807][ T54] roccat_release+0x2ad/0x380
[ 149.197812][ T54] __fput+0x418/0xa50
[ 149.197818][ T54] task_work_run+0x1d9/0x270
[ 149.197825][ T54] exit_to_user_mode_loop+0x204/0x770
[ 149.197831][ T54] do_syscall_64+0x328/0x520
[ 149.197838][ T54] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 149.197845][ T54]
[ 149.197846][ T54] The buggy address belongs to the object at ffff888051221000
[ 149.197846][ T54] which belongs to the cache kmalloc-1k of size 1024
[ 149.197852][ T54] The buggy address is located 8 bytes inside of
[ 149.197852][ T54] freed 1024-byte region [ffff888051221000, ffff888051221400)
[ 149.197859][ T54]
[ 149.197861][ T54] The buggy address belongs to the physical page:
[ 149.197866][ T54] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x51220
[ 149.197873][ T54] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 149.197879][ T54] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff)
[ 149.197886][ T54] page_type: f5(slab)
[ 149.197893][ T54] raw: 04fff00000000040 ffff88801b041dc0 dead000000000100 dead000000000122
[ 149.197899][ T54] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 149.197905][ T54] head: 04fff00000000040 ffff88801b041dc0 dead000000000100 dead000000000122
[ 149.197910][ T54] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 149.197916][ T54] head: 04fff00000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff
[ 149.197921][ T54] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[ 149.197926][ T54] page dumped because: kasan: bad access detected
[ 149.197933][ T54] page_owner tracks the page as allocated
[ 149.197936][ T54] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 187, tgid 187 (kworker/u4:6), ts 148932801463
[ 149.197953][ T54] post_alloc_hook+0x1f9/0x250
[ 149.197965][ T54] get_page_from_freelist+0x2209/0x2280
[ 149.197979][ T54] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 149.197993][ T54] allocate_slab+0x7d/0x620
[ 149.198003][ T54] refill_objects+0x2d5/0x350
[ 149.198013][ T54] __pcs_replace_empty_main+0x2c8/0x6c0
[ 149.198023][ T54] __kmalloc_noprof+0x47b/0x720
[ 149.198034][ T54] ieee802_11_parse_elems_full+0x14b/0x2de0
[ 149.198048][ T54] ieee80211_inform_bss+0x163/0x10d0
[ 149.198060][ T54] cfg80211_inform_single_bss_data+0xd9c/0x1be0
[ 149.198074][ T54] cfg80211_inform_bss_data+0x263/0x3cc0
[ 149.198086][ T54] cfg80211_inform_bss_frame_data+0x3c7/0x840
[ 149.198099][ T54] ieee80211_bss_info_update+0x791/0xa50
[ 149.198110][ T54] ieee80211_ibss_rx_queued_mgmt+0x1ce3/0x2c40
[ 149.198122][ T54] ieee80211_iface_work+0x78a/0x1010
[ 149.198133][ T54] cfg80211_wiphy_work+0x29e/0x420
[ 149.198148][ T54] page last free pid 5327 tgid 5326 ts 148921400882 stack trace:
[ 149.198155][ T54] __free_frozen_pages+0xc93/0xd90
[ 149.198167][ T54] __slab_free+0x274/0x2c0
[ 149.198181][ T54] qlist_free_all+0x99/0x100
[ 149.198193][ T54] kasan_quarantine_reduce+0x148/0x160
[ 149.198202][ T54] __kasan_slab_alloc+0x22/0x80
[ 149.198207][ T54] __kmalloc_noprof+0x307/0x720
[ 149.198215][ T54] tomoyo_realpath_from_path+0xef/0x640
[ 149.198223][ T54] tomoyo_path_number_perm+0x246/0x5f0
[ 149.198232][ T54] security_file_ioctl+0xc3/0x2a0
[ 149.198240][ T54] __se_sys_ioctl+0x47/0x170
[ 149.198249][ T54] do_syscall_64+0x166/0x520
[ 149.198256][ T54] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 149.198262][ T54]
[ 149.198263][ T54] Memory state around the buggy address:
[ 149.198267][ T54] ffff888051220f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 149.198272][ T54] ffff888051220f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 149.198276][ T54] >ffff888051221000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 149.198279][ T54] ^
[ 149.198283][ T54] ffff888051221080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 149.198287][ T54] ffff888051221100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 149.198290][ T54] ==================================================================
[ 149.199763][ T54] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 149.614546][ T54] CPU: 0 UID: 0 PID: 54 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full)
[ 149.618524][ T54] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 149.623110][ T54] Workqueue: usb_hub_wq hub_event
[ 149.625388][ T54] Call Trace:
[ 149.626931][ T54]
[ 149.628265][ T54] vpanic+0x56d/0xa60
[ 149.630027][ T54] ? __pfx_vpanic+0x10/0x10
[ 149.632091][ T54] panic+0xc5/0xd0
[ 149.633709][ T54] ? __pfx_panic+0x10/0x10
[ 149.635461][ T54] ? preempt_schedule_thunk+0x16/0x40
[ 149.637386][ T54] ? preempt_schedule_thunk+0x16/0x40
[ 149.639277][ T54] ? roccat_disconnect+0x23d/0x250
[ 149.641137][ T54] check_panic_on_warn+0x89/0xb0
[ 149.642929][ T54] ? roccat_disconnect+0x23d/0x250
[ 149.644811][ T54] end_report+0x73/0x170
[ 149.646251][ T54] ? roccat_disconnect+0x23d/0x250
[ 149.647976][ T54] kasan_report+0x128/0x150
[ 149.649513][ T54] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 149.651692][ T54] ? roccat_disconnect+0x23d/0x250
[ 149.653594][ T54] roccat_disconnect+0x23d/0x250
[ 149.655479][ T54] savu_remove+0xe9/0x160
[ 149.657164][ T54] ? __pfx_savu_remove+0x10/0x10
[ 149.659155][ T54] hid_device_remove+0xc5/0x1c0
[ 149.660991][ T54] ? __pfx_hid_device_remove+0x10/0x10
[ 149.663085][ T54] device_release_driver_internal+0x48b/0x880
[ 149.665588][ T54] bus_remove_device+0x444/0x560
[ 149.667605][ T54] ? __pfx_bus_remove_device+0x10/0x10
[ 149.669713][ T54] ? kernfs_remove_by_name_ns+0x101/0x140
[ 149.671976][ T54] device_del+0x524/0x8f0
[ 149.673784][ T54] ? __pfx_device_del+0x10/0x10
[ 149.675674][ T54] hid_destroy_device+0x6b/0x1b0
[ 149.677541][ T54] usbhid_disconnect+0x9f/0xc0
[ 149.679452][ T54] usb_unbind_interface+0x295/0x9f0
[ 149.681574][ T54] ? kernfs_remove_by_name_ns+0x101/0x140
[ 149.683591][ T54] ? kernfs_remove_by_name_ns+0x101/0x140
[ 149.686116][ T54] ? __pfx_usb_unbind_interface+0x10/0x10
[ 149.688561][ T54] device_release_driver_internal+0x4f5/0x880
[ 149.691194][ T54] bus_remove_device+0x444/0x560
[ 149.693341][ T54] ? __pfx_bus_remove_device+0x10/0x10
[ 149.695716][ T54] ? kernfs_remove_by_name_ns+0x101/0x140
[ 149.698039][ T54] device_del+0x524/0x8f0
[ 149.699971][ T54] ? __pfx_device_del+0x10/0x10
[ 149.702117][ T54] ? kobject_put+0x516/0x550
[ 149.704240][ T54] usb_disable_device+0x3d4/0x8d0
[ 149.706417][ T54] usb_disconnect+0x346/0x9a0
[ 149.708439][ T54] hub_event+0x1bbb/0x4d30
[ 149.710424][ T54] ? __lock_acquire+0x747/0x2de0
[ 149.712613][ T54] ? register_lock_class+0x31/0x2e0
[ 149.714874][ T54] ? __pfx_hub_event+0x10/0x10
[ 149.716955][ T54] ? rcu_is_watching+0x16/0xb0
[ 149.719051][ T54] ? process_scheduled_works+0x97a/0x1630
[ 149.721444][ T54] process_scheduled_works+0xc3d/0x1630
[ 149.723821][ T54] ? __pfx_process_scheduled_works+0x10/0x10
[ 149.726376][ T54] ? assign_work+0x3cf/0x5d0
[ 149.728374][ T54] worker_thread+0xa47/0xfb0
[ 149.730222][ T54] ? __kthread_parkme+0x71/0x1f0
[ 149.732317][ T54] kthread+0x38b/0x480
[ 149.734038][ T54] ? __pfx_worker_thread+0x10/0x10
[ 149.736138][ T54] ? __pfx_kthread+0x10/0x10
[ 149.738078][ T54] ret_from_fork+0x514/0xb70
[ 149.739962][ T54] ? __pfx_ret_from_fork+0x10/0x10
[ 149.742017][ T54] ? __switch_to+0xc89/0x1420
[ 149.744061][ T54] ? __pfx_kthread+0x10/0x10
[ 149.745968][ T54] ret_from_fork_asm+0x1a/0x30
[ 149.747967][ T54]
[ 149.749778][ T54] Kernel Offset: disabled
[ 149.751772][ T54] Rebooting in 86400 seconds..