program: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000400)="0080002000"/16) syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000500)='\x00'/16) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) [ 95.154308][ T5281] Bluetooth: hci0: command tx timeout [ 95.442160][ T5314] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 95.597757][ T5314] usb 5-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice= 1.00 [ 95.601519][ T5314] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 95.601535][ T5314] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 95.601543][ T5314] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 95.628065][ T5314] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 95.628083][ T5314] usb 5-1: Product: syz [ 95.628091][ T5314] usb 5-1: Manufacturer: syz [ 95.651725][ T5316] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 95.652011][ T5316] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 95.652153][ T5316] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 96.860384][ T5314] redrat3 5-1:1.0: Firmware rev:  [ 97.223248][ T5281] Bluetooth: hci0: command tx timeout [ 97.225706][ T5314] redrat3 5-1:1.0: Failed to read timeout from hardware [ 97.302633][ T5314] rc_core: IR keymap rc-hauppauge not found [ 97.302646][ T5314] Registered IR keymap rc-empty [ 97.315281][ T5314] rc rc0: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/rc/rc0 [ 97.317127][ T5314] input: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/rc/rc0/input5 [ 97.354621][ T5314] redrat3 5-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0 [ 97.355046][ T5314] redrat3 5-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0 [ 97.355076][ T5314] redrat3 5-1:1.0: redrat3_enable_detector: detector status: -5, should be 1 [ 97.391664][ T5314] redrat3 5-1:1.0: probe with driver redrat3 failed with error -5 [ 97.407357][ T5314] usb 5-1: USB disconnect, device number 2 [ 97.410692][ T5276] ================================================================== [ 97.410724][ T5276] BUG: KASAN: slab-use-after-free in string+0x216/0x2d0 [ 97.410856][ T5276] Read of size 1 at addr ffff888037ad6758 by task udevd/5276 [ 97.410864][ T5276] [ 97.410890][ T5276] CPU: 0 UID: 0 PID: 5276 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) [ 97.410906][ T5276] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 97.410917][ T5276] Call Trace: [ 97.410934][ T5276] [ 97.410938][ T5276] dump_stack_lvl+0xe8/0x150 [ 97.410965][ T5276] print_address_description+0x55/0x1e0 [ 97.410977][ T5276] ? string+0x216/0x2d0 [ 97.410986][ T5276] print_report+0x58/0x70 [ 97.410994][ T5276] kasan_report+0x117/0x150 [ 97.411008][ T5276] ? string+0x216/0x2d0 [ 97.411018][ T5276] string+0x216/0x2d0 [ 97.411028][ T5276] vsnprintf+0x74a/0xef0 [ 97.411038][ T5276] vscnprintf+0x41/0x90 [ 97.411048][ T5276] sysfs_emit+0x10e/0x180 [ 97.411058][ T5276] ? __pfx_sysfs_emit+0x10/0x10 [ 97.411066][ T5276] ? sysfs_file_kobj+0x1a/0x230 [ 97.411075][ T5276] input_dev_show_name+0x58/0x70 [ 97.411098][ T5276] dev_attr_show+0x58/0xc0 [ 97.411141][ T5276] ? __pfx_dev_attr_show+0x10/0x10 [ 97.411149][ T5276] sysfs_kf_seq_show+0x331/0x490 [ 97.411159][ T5276] seq_read_iter+0x463/0xca0 [ 97.411169][ T5276] vfs_read+0x595/0xa80 [ 97.411182][ T5276] ? __pfx_vfs_read+0x10/0x10 [ 97.411196][ T5276] ? do_sys_openat2+0x14e/0x200 [ 97.411206][ T5276] ? kmem_cache_free+0x182/0x650 [ 97.411224][ T5276] ksys_read+0x150/0x270 [ 97.411238][ T5276] ? __pfx_ksys_read+0x10/0x10 [ 97.411250][ T5276] do_syscall_64+0x166/0x520 [ 97.411258][ T5276] ? trace_irq_disable+0x3b/0x140 [ 97.411272][ T5276] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.411280][ T5276] ? clear_bhb_loop+0x70/0xc0 [ 97.411288][ T5276] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.411296][ T5276] RIP: 0033:0x7f2207aa7407 [ 97.411303][ T5276] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 97.411310][ T5276] RSP: 002b:00007fff4159d520 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 97.411338][ T5276] RAX: ffffffffffffffda RBX: 00007f22082ac880 RCX: 00007f2207aa7407 [ 97.411346][ T5276] RDX: 0000000000001000 RSI: 00007fff4159da00 RDI: 0000000000000008 [ 97.411353][ T5276] RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000 [ 97.411360][ T5276] R10: 0000000000000000 R11: 0000000000000202 R12: 0000563eb27e2a60 [ 97.411367][ T5276] R13: 00007fff4159d600 R14: 00007fff4159da00 R15: 0000563e9b5d9bcc [ 97.411378][ T5276] [ 97.411380][ T5276] [ 97.411382][ T5276] Allocated by task 5314: [ 97.411395][ T5276] kasan_save_track+0x3e/0x80 [ 97.411406][ T5276] __kasan_kmalloc+0x93/0xb0 [ 97.411411][ T5276] __kmalloc_cache_noprof+0x321/0x600 [ 97.411420][ T5276] redrat3_dev_probe+0x477/0x2570 [ 97.411429][ T5276] usb_probe_interface+0x788/0xe50 [ 97.411444][ T5276] really_probe+0x254/0xae0 [ 97.411451][ T5276] __driver_probe_device+0x1e8/0x360 [ 97.411457][ T5276] driver_probe_device+0x4f/0x240 [ 97.411463][ T5276] __device_attach_driver+0x270/0x410 [ 97.411469][ T5276] bus_for_each_drv+0x258/0x2f0 [ 97.411478][ T5276] __device_attach+0x2c4/0x450 [ 97.411493][ T5276] device_initial_probe+0xa1/0xd0 [ 97.411501][ T5276] bus_probe_device+0x12a/0x220 [ 97.411512][ T5276] device_add+0x7d7/0xb80 [ 97.411532][ T5276] usb_set_configuration+0x1ad8/0x2180 [ 97.411541][ T5276] usb_generic_driver_probe+0x8d/0x150 [ 97.411550][ T5276] usb_probe_device+0x1c3/0x3b0 [ 97.411560][ T5276] really_probe+0x254/0xae0 [ 97.411569][ T5276] __driver_probe_device+0x1e8/0x360 [ 97.411579][ T5276] driver_probe_device+0x4f/0x240 [ 97.411589][ T5276] __device_attach_driver+0x270/0x410 [ 97.411595][ T5276] bus_for_each_drv+0x258/0x2f0 [ 97.411603][ T5276] __device_attach+0x2c4/0x450 [ 97.411611][ T5276] device_initial_probe+0xa1/0xd0 [ 97.411619][ T5276] bus_probe_device+0x12a/0x220 [ 97.411630][ T5276] device_add+0x7d7/0xb80 [ 97.411642][ T5276] usb_new_device+0x9aa/0x1690 [ 97.411656][ T5276] hub_event+0x28e8/0x4d30 [ 97.411665][ T5276] process_scheduled_works+0xc3d/0x1630 [ 97.411679][ T5276] worker_thread+0xa47/0xfb0 [ 97.411692][ T5276] kthread+0x38b/0x480 [ 97.411699][ T5276] ret_from_fork+0x514/0xb70 [ 97.411705][ T5276] ret_from_fork_asm+0x1a/0x30 [ 97.411714][ T5276] [ 97.411716][ T5276] Freed by task 5314: [ 97.411719][ T5276] kasan_save_track+0x3e/0x80 [ 97.411730][ T5276] kasan_save_free_info+0x40/0x50 [ 97.411741][ T5276] __kasan_slab_free+0x5c/0x80 [ 97.411749][ T5276] kfree+0x1c5/0x650 [ 97.411760][ T5276] redrat3_dev_probe+0x1bf4/0x2570 [ 97.411772][ T5276] usb_probe_interface+0x788/0xe50 [ 97.411784][ T5276] really_probe+0x254/0xae0 [ 97.411793][ T5276] __driver_probe_device+0x1e8/0x360 [ 97.411803][ T5276] driver_probe_device+0x4f/0x240 [ 97.411813][ T5276] __device_attach_driver+0x270/0x410 [ 97.411820][ T5276] bus_for_each_drv+0x258/0x2f0 [ 97.411828][ T5276] __device_attach+0x2c4/0x450 [ 97.411833][ T5276] device_initial_probe+0xa1/0xd0 [ 97.411839][ T5276] bus_probe_device+0x12a/0x220 [ 97.411846][ T5276] device_add+0x7d7/0xb80 [ 97.411854][ T5276] usb_set_configuration+0x1ad8/0x2180 [ 97.411861][ T5276] usb_generic_driver_probe+0x8d/0x150 [ 97.411866][ T5276] usb_probe_device+0x1c3/0x3b0 [ 97.411874][ T5276] really_probe+0x254/0xae0 [ 97.411883][ T5276] __driver_probe_device+0x1e8/0x360 [ 97.411891][ T5276] driver_probe_device+0x4f/0x240 [ 97.411900][ T5276] __device_attach_driver+0x270/0x410 [ 97.411910][ T5276] bus_for_each_drv+0x258/0x2f0 [ 97.411921][ T5276] __device_attach+0x2c4/0x450 [ 97.411930][ T5276] device_initial_probe+0xa1/0xd0 [ 97.411939][ T5276] bus_probe_device+0x12a/0x220 [ 97.411951][ T5276] device_add+0x7d7/0xb80 [ 97.411963][ T5276] usb_new_device+0x9aa/0x1690 [ 97.411971][ T5276] hub_event+0x28e8/0x4d30 [ 97.411977][ T5276] process_scheduled_works+0xc3d/0x1630 [ 97.411985][ T5276] worker_thread+0xa47/0xfb0 [ 97.411996][ T5276] kthread+0x38b/0x480 [ 97.412004][ T5276] ret_from_fork+0x514/0xb70 [ 97.412012][ T5276] ret_from_fork_asm+0x1a/0x30 [ 97.412025][ T5276] [ 97.412029][ T5276] The buggy address belongs to the object at ffff888037ad6000 [ 97.412029][ T5276] which belongs to the cache kmalloc-2k of size 2048 [ 97.412038][ T5276] The buggy address is located 1880 bytes inside of [ 97.412038][ T5276] freed 2048-byte region [ffff888037ad6000, ffff888037ad6800) [ 97.412050][ T5276] [ 97.412053][ T5276] The buggy address belongs to the physical page: [ 97.412060][ T5276] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x37ad0 [ 97.412081][ T5276] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 97.412090][ T5276] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 97.412098][ T5276] page_type: f5(slab) [ 97.412105][ T5276] raw: 04fff00000000040 ffff88801b042000 dead000000000100 dead000000000122 [ 97.412111][ T5276] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 97.412117][ T5276] head: 04fff00000000040 ffff88801b042000 dead000000000100 dead000000000122 [ 97.412122][ T5276] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 97.412128][ T5276] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 97.412133][ T5276] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 97.412137][ T5276] page dumped because: kasan: bad access detected [ 97.412140][ T5276] page_owner tracks the page as allocated [ 97.412144][ T5276] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5280, tgid 5280 (syz-executor), ts 93106689496 [ 97.412159][ T5276] post_alloc_hook+0x1f9/0x250 [ 97.412171][ T5276] get_page_from_freelist+0x2209/0x2280 [ 97.412185][ T5276] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 97.412200][ T5276] allocate_slab+0x7d/0x620 [ 97.412211][ T5276] refill_objects+0x2d5/0x350 [ 97.412222][ T5276] __pcs_replace_empty_main+0x2c8/0x6c0 [ 97.412231][ T5276] __kmalloc_cache_noprof+0x39b/0x600 [ 97.412243][ T5276] psi_cgroup_alloc+0x56/0x200 [ 97.412255][ T5276] cgroup_mkdir+0x4b2/0xf90 [ 97.412266][ T5276] kernfs_iop_mkdir+0x213/0x360 [ 97.412275][ T5276] vfs_mkdir+0x40c/0x620 [ 97.412288][ T5276] filename_mkdirat+0x285/0x510 [ 97.412302][ T5276] __se_sys_mkdirat+0x35/0x150 [ 97.412315][ T5276] do_syscall_64+0x166/0x520 [ 97.412325][ T5276] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.412335][ T5276] page last free pid 25 tgid 25 ts 93024964370 stack trace: [ 97.412343][ T5276] __free_frozen_pages+0xc93/0xd90 [ 97.412356][ T5276] __slab_free+0x274/0x2c0 [ 97.412368][ T5276] qlist_free_all+0x99/0x100 [ 97.412377][ T5276] kasan_quarantine_reduce+0x148/0x160 [ 97.412385][ T5276] __kasan_slab_alloc+0x22/0x80 [ 97.412391][ T5276] __kmalloc_noprof+0x307/0x720 [ 97.412399][ T5276] fib6_info_alloc+0x30/0xf0 [ 97.412413][ T5276] ip6_route_info_create+0x149/0x890 [ 97.412420][ T5276] ip6_route_add+0x49/0x1b0 [ 97.412426][ T5276] addrconf_add_mroute+0x2d1/0x370 [ 97.412433][ T5276] addrconf_init_auto_addrs+0x4d7/0xa50 [ 97.412444][ T5276] addrconf_notify+0xb1e/0x1050 [ 97.412453][ T5276] notifier_call_chain+0x1a5/0x3d0 [ 97.412468][ T5276] netif_state_change+0x27d/0x3a0 [ 97.412496][ T5276] __linkwatch_run_queue+0x52a/0x800 [ 97.412510][ T5276] linkwatch_event+0x4c/0x60 [ 97.412523][ T5276] [ 97.412526][ T5276] Memory state around the buggy address: [ 97.412530][ T5276] ffff888037ad6600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 97.412535][ T5276] ffff888037ad6680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 97.412539][ T5276] >ffff888037ad6700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 97.412542][ T5276] ^ [ 97.412546][ T5276] ffff888037ad6780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 97.412550][ T5276] ffff888037ad6800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 97.412554][ T5276] ================================================================== [ 97.713692][ T5276] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 97.858311][ T5276] CPU: 0 UID: 0 PID: 5276 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) [ 97.862117][ T5276] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 97.866337][ T5276] Call Trace: [ 97.867907][ T5276] [ 97.869155][ T5276] vpanic+0x56d/0xa60 [ 97.870879][ T5276] ? __pfx_vpanic+0x10/0x10 [ 97.873043][ T5276] panic+0xc5/0xd0 [ 97.874606][ T5276] ? __pfx_panic+0x10/0x10 [ 97.876540][ T5276] ? preempt_schedule_thunk+0x16/0x40 [ 97.878888][ T5276] ? string+0x216/0x2d0 [ 97.880698][ T5276] ? preempt_schedule_thunk+0x16/0x40 [ 97.883085][ T5276] ? string+0x216/0x2d0 [ 97.884953][ T5276] check_panic_on_warn+0x89/0xb0 [ 97.886939][ T5276] ? string+0x216/0x2d0 [ 97.888663][ T5276] end_report+0x73/0x170 [ 97.890523][ T5276] ? string+0x216/0x2d0 [ 97.892247][ T5276] kasan_report+0x128/0x150 [ 97.894258][ T5276] ? string+0x216/0x2d0 [ 97.896309][ T5276] string+0x216/0x2d0 [ 97.898013][ T5276] vsnprintf+0x74a/0xef0 [ 97.899810][ T5276] vscnprintf+0x41/0x90 [ 97.901623][ T5276] sysfs_emit+0x10e/0x180 [ 97.903495][ T5276] ? __pfx_sysfs_emit+0x10/0x10 [ 97.905493][ T5276] ? sysfs_file_kobj+0x1a/0x230 [ 97.907547][ T5276] input_dev_show_name+0x58/0x70 [ 97.909609][ T5276] dev_attr_show+0x58/0xc0 [ 97.911533][ T5276] ? __pfx_dev_attr_show+0x10/0x10 [ 97.913653][ T5276] sysfs_kf_seq_show+0x331/0x490 [ 97.915777][ T5276] seq_read_iter+0x463/0xca0 [ 97.917712][ T5276] vfs_read+0x595/0xa80 [ 97.919444][ T5276] ? __pfx_vfs_read+0x10/0x10 [ 97.921341][ T5276] ? do_sys_openat2+0x14e/0x200 [ 97.923342][ T5276] ? kmem_cache_free+0x182/0x650 [ 97.925582][ T5276] ksys_read+0x150/0x270 [ 97.927323][ T5276] ? __pfx_ksys_read+0x10/0x10 [ 97.929409][ T5276] do_syscall_64+0x166/0x520 [ 97.931436][ T5276] ? trace_irq_disable+0x3b/0x140 [ 97.933588][ T5276] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.936111][ T5276] ? clear_bhb_loop+0x70/0xc0 [ 97.938088][ T5276] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.940527][ T5276] RIP: 0033:0x7f2207aa7407 [ 97.942274][ T5276] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 97.949952][ T5276] RSP: 002b:00007fff4159d520 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 97.953332][ T5276] RAX: ffffffffffffffda RBX: 00007f22082ac880 RCX: 00007f2207aa7407 [ 97.956419][ T5276] RDX: 0000000000001000 RSI: 00007fff4159da00 RDI: 0000000000000008 [ 97.959447][ T5276] RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000 [ 97.962747][ T5276] R10: 0000000000000000 R11: 0000000000000202 R12: 0000563eb27e2a60 [ 97.966015][ T5276] R13: 00007fff4159d600 R14: 00007fff4159da00 R15: 0000563e9b5d9bcc [ 97.969256][ T5276] [ 97.970962][ T5276] Kernel Offset: disabled [ 97.972782][ T5276] Rebooting in 86400 seconds..