program:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b40401310000000000010902200001010080fa0904000002ff0000000705810200020007058202000200"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
nanosleep(&(0x7f00000000c0)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/firmware/dvb-usb-dw3101.fw/loading\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/firmware/dvb-usb-dw3101.fw/data\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='A', 0x1)
write(r0, &(0x7f0000000200)='0', 0x1)
nanosleep(&(0x7f0000000240)={0x1}, 0x0)
[ 88.523992][ T1402] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 88.574573][ T4649] Bluetooth: hci0: command tx timeout
[ 88.677045][ T1402] usb 5-1: New USB device found, idVendor=04b4, idProduct=3101, bcdDevice= 0.00
[ 88.680400][ T1402] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 88.710349][ T1402] dvb-usb: found a 'DVBWorld DVB-C 3101 USB2.0' in cold state, will try to load a firmware
[ 88.722439][ T1402] usb 5-1: Direct firmware load for dvb-usb-dw3101.fw failed with error -2
[ 88.726747][ T1402] usb 5-1: Falling back to sysfs fallback for: dvb-usb-dw3101.fw
[ 88.958595][ T1402] dvb-usb: downloading firmware from file 'dvb-usb-dw3101.fw'
[ 88.963305][ T1402] dw2102: start downloading DW210X firmware
[ 89.959881][ T1402] ==================================================================
[ 89.962612][ T1402] BUG: KASAN: slab-out-of-bounds in dw210x_op_rw+0xb6/0x180
[ 89.965120][ T1402] Read of size 64 at addr ffff88804fb04ec0 by task kworker/0:3/1402
[ 89.967768][ T1402]
[ 89.968675][ T1402] CPU: 0 UID: 0 PID: 1402 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(full)
[ 89.968685][ T1402] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 89.968690][ T1402] Workqueue: usb_hub_wq hub_event
[ 89.968747][ T1402] Call Trace:
[ 89.968753][ T1402]
[ 89.968759][ T1402] dump_stack_lvl+0xe8/0x150
[ 89.968776][ T1402] print_address_description+0x55/0x1e0
[ 89.968791][ T1402] ? dw210x_op_rw+0xb6/0x180
[ 89.968802][ T1402] print_report+0x58/0x70
[ 89.968811][ T1402] kasan_report+0x117/0x150
[ 89.968821][ T1402] ? dw210x_op_rw+0xb6/0x180
[ 89.968829][ T1402] kasan_check_range+0x264/0x2c0
[ 89.968838][ T1402] ? dw210x_op_rw+0xb6/0x180
[ 89.968845][ T1402] __asan_memcpy+0x29/0x70
[ 89.968853][ T1402] dw210x_op_rw+0xb6/0x180
[ 89.968861][ T1402] dw2102_load_firmware+0x2b4/0x970
[ 89.968870][ T1402] ? __pfx_dw2102_load_firmware+0x10/0x10
[ 89.968879][ T1402] ? __pfx_dw2102_load_firmware+0x10/0x10
[ 89.968886][ T1402] dvb_usb_download_firmware+0x1c3/0x270
[ 89.968894][ T1402] ? __pfx__printk+0x10/0x10
[ 89.968901][ T1402] ? __pfx_dvb_usb_download_firmware+0x10/0x10
[ 89.968908][ T1402] ? trace_kmalloc+0x2a/0xf0
[ 89.968916][ T1402] ? dvb_usb_device_init+0x148/0x2570
[ 89.968927][ T1402] dvb_usb_device_init+0xddf/0x2570
[ 89.968948][ T1402] ? __pfx_dvb_usb_device_init+0x10/0x10
[ 89.968963][ T1402] ? lockdep_hardirqs_on+0x7a/0x110
[ 89.968976][ T1402] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 89.968988][ T1402] ? __pm_runtime_set_status+0x994/0xc80
[ 89.969001][ T1402] dw2102_probe+0x8a/0x270
[ 89.969012][ T1402] usb_probe_interface+0x653/0xc60
[ 89.969023][ T1402] ? __pfx_usb_probe_interface+0x10/0x10
[ 89.969029][ T1402] really_probe+0x254/0xae0
[ 89.969037][ T1402] __driver_probe_device+0x1e8/0x360
[ 89.969046][ T1402] driver_probe_device+0x4f/0x240
[ 89.969054][ T1402] __device_attach_driver+0x270/0x410
[ 89.969063][ T1402] bus_for_each_drv+0x258/0x2f0
[ 89.969077][ T1402] ? __pfx___device_attach_driver+0x10/0x10
[ 89.969085][ T1402] ? __pfx_bus_for_each_drv+0x10/0x10
[ 89.969095][ T1402] ? lockdep_hardirqs_on+0x7a/0x110
[ 89.969103][ T1402] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 89.969110][ T1402] __device_attach+0x2c4/0x450
[ 89.969118][ T1402] ? __pfx___device_attach+0x10/0x10
[ 89.969125][ T1402] ? do_raw_spin_unlock+0x4d/0x210
[ 89.969133][ T1402] ? _raw_spin_unlock+0x28/0x50
[ 89.969140][ T1402] device_initial_probe+0xa1/0xd0
[ 89.969148][ T1402] bus_probe_device+0x12a/0x220
[ 89.969158][ T1402] device_add+0x7d7/0xb80
[ 89.969165][ T1402] usb_set_configuration+0x1ad8/0x2180
[ 89.969181][ T1402] usb_generic_driver_probe+0x8d/0x150
[ 89.969197][ T1402] usb_probe_device+0x1c3/0x3b0
[ 89.969207][ T1402] ? __pfx_usb_probe_device+0x10/0x10
[ 89.969217][ T1402] really_probe+0x254/0xae0
[ 89.969229][ T1402] __driver_probe_device+0x1e8/0x360
[ 89.969241][ T1402] driver_probe_device+0x4f/0x240
[ 89.969254][ T1402] __device_attach_driver+0x270/0x410
[ 89.969267][ T1402] bus_for_each_drv+0x258/0x2f0
[ 89.969277][ T1402] ? __pfx___device_attach_driver+0x10/0x10
[ 89.969285][ T1402] ? __pfx_bus_for_each_drv+0x10/0x10
[ 89.969295][ T1402] ? lockdep_hardirqs_on+0x7a/0x110
[ 89.969303][ T1402] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 89.969311][ T1402] __device_attach+0x2c4/0x450
[ 89.969318][ T1402] ? __pfx___device_attach+0x10/0x10
[ 89.969325][ T1402] ? do_raw_spin_unlock+0x4d/0x210
[ 89.969333][ T1402] ? _raw_spin_unlock+0x28/0x50
[ 89.969340][ T1402] device_initial_probe+0xa1/0xd0
[ 89.969348][ T1402] bus_probe_device+0x12a/0x220
[ 89.969358][ T1402] device_add+0x7d7/0xb80
[ 89.969364][ T1402] usb_new_device+0x99d/0x1620
[ 89.969374][ T1402] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 89.969383][ T1402] ? __pfx_usb_new_device+0x10/0x10
[ 89.969392][ T1402] ? _raw_spin_unlock_irq+0x23/0x50
[ 89.969405][ T1402] hub_event+0x28e8/0x4d30
[ 89.969415][ T1402] ? do_raw_spin_unlock+0x4d/0x210
[ 89.969429][ T1402] ? __pfx_hub_event+0x10/0x10
[ 89.969439][ T1402] ? process_scheduled_works+0xa20/0x14e0
[ 89.969448][ T1402] ? rcu_is_watching+0x15/0xb0
[ 89.969455][ T1402] ? process_scheduled_works+0xa20/0x14e0
[ 89.969462][ T1402] process_scheduled_works+0xa8e/0x14e0
[ 89.969476][ T1402] ? __pfx_process_scheduled_works+0x10/0x10
[ 89.969488][ T1402] ? assign_work+0x3cf/0x5d0
[ 89.969500][ T1402] worker_thread+0xa47/0xfb0
[ 89.969514][ T1402] ? __kthread_parkme+0x71/0x1f0
[ 89.969530][ T1402] kthread+0x388/0x470
[ 89.969545][ T1402] ? __pfx_worker_thread+0x10/0x10
[ 89.969557][ T1402] ? __pfx_kthread+0x10/0x10
[ 89.969571][ T1402] ret_from_fork+0x514/0xb70
[ 89.969584][ T1402] ? __pfx_ret_from_fork+0x10/0x10
[ 89.969594][ T1402] ? __switch_to+0xc89/0x1420
[ 89.969603][ T1402] ? __pfx_kthread+0x10/0x10
[ 89.969613][ T1402] ret_from_fork_asm+0x1a/0x30
[ 89.969622][ T1402]
[ 89.969624][ T1402]
[ 90.152658][ T1402] Allocated by task 1402:
[ 90.154500][ T1402] kasan_save_track+0x3e/0x80
[ 90.156489][ T1402] __kasan_kmalloc+0x93/0xb0
[ 90.158473][ T1402] __kmalloc_noprof+0x375/0x720
[ 90.160518][ T1402] dw2102_load_firmware+0x175/0x970
[ 90.162710][ T1402] dvb_usb_download_firmware+0x1c3/0x270
[ 90.165010][ T1402] dvb_usb_device_init+0xddf/0x2570
[ 90.167142][ T1402] dw2102_probe+0x8a/0x270
[ 90.169050][ T1402] usb_probe_interface+0x653/0xc60
[ 90.171189][ T1402] really_probe+0x254/0xae0
[ 90.173082][ T1402] __driver_probe_device+0x1e8/0x360
[ 90.175201][ T1402] driver_probe_device+0x4f/0x240
[ 90.177332][ T1402] __device_attach_driver+0x270/0x410
[ 90.179552][ T1402] bus_for_each_drv+0x258/0x2f0
[ 90.181571][ T1402] __device_attach+0x2c4/0x450
[ 90.183589][ T1402] device_initial_probe+0xa1/0xd0
[ 90.185669][ T1402] bus_probe_device+0x12a/0x220
[ 90.187714][ T1402] device_add+0x7d7/0xb80
[ 90.189502][ T1402] usb_set_configuration+0x1ad8/0x2180
[ 90.191735][ T1402] usb_generic_driver_probe+0x8d/0x150
[ 90.193956][ T1402] usb_probe_device+0x1c3/0x3b0
[ 90.195671][ T1402] really_probe+0x254/0xae0
[ 90.197477][ T1402] __driver_probe_device+0x1e8/0x360
[ 90.199708][ T1402] driver_probe_device+0x4f/0x240
[ 90.201829][ T1402] __device_attach_driver+0x270/0x410
[ 90.204103][ T1402] bus_for_each_drv+0x258/0x2f0
[ 90.206121][ T1402] __device_attach+0x2c4/0x450
[ 90.208175][ T1402] device_initial_probe+0xa1/0xd0
[ 90.210222][ T1402] bus_probe_device+0x12a/0x220
[ 90.212222][ T1402] device_add+0x7d7/0xb80
[ 90.214007][ T1402] usb_new_device+0x99d/0x1620
[ 90.215995][ T1402] hub_event+0x28e8/0x4d30
[ 90.217876][ T1402] process_scheduled_works+0xa8e/0x14e0
[ 90.220146][ T1402] worker_thread+0xa47/0xfb0
[ 90.222057][ T1402] kthread+0x388/0x470
[ 90.223819][ T1402] ret_from_fork+0x514/0xb70
[ 90.225781][ T1402] ret_from_fork_asm+0x1a/0x30
[ 90.227783][ T1402]
[ 90.228816][ T1402] The buggy address belongs to the object at ffff88804fb04ec0
[ 90.228816][ T1402] which belongs to the cache kmalloc-8 of size 8
[ 90.234389][ T1402] The buggy address is located 0 bytes inside of
[ 90.234389][ T1402] allocated 1-byte region [ffff88804fb04ec0, ffff88804fb04ec1)
[ 90.239929][ T1402]
[ 90.241006][ T1402] The buggy address belongs to the physical page:
[ 90.243648][ T1402] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4fb04
[ 90.247220][ T1402] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 90.250442][ T1402] page_type: f5(slab)
[ 90.252497][ T1402] raw: 04fff00000000000 ffff88801b041500 dead000000000100 dead000000000122
[ 90.256750][ T1402] raw: 0000000000000000 0000000800800080 00000000f5000000 0000000000000000
[ 90.261053][ T1402] page dumped because: kasan: bad access detected
[ 90.264225][ T1402] page_owner tracks the page as allocated
[ 90.266681][ T1402] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5289, tgid 5289 (syz-executor), ts 85108149082, free_ts 0
[ 90.275771][ T1402] post_alloc_hook+0x1f9/0x250
[ 90.277856][ T1402] get_page_from_freelist+0x21fa/0x2270
[ 90.280593][ T1402] __alloc_frozen_pages_noprof+0x18d/0x380
[ 90.283083][ T1402] allocate_slab+0x79/0x5e0
[ 90.285126][ T1402] refill_objects+0x2d5/0x350
[ 90.287136][ T1402] __pcs_replace_empty_main+0x2bf/0x6b0
[ 90.289434][ T1402] __kmalloc_node_track_caller_noprof+0x557/0x730
[ 90.292367][ T1402] kvasprintf+0xeb/0x1a0
[ 90.294315][ T1402] kobject_set_name_vargs+0x61/0x110
[ 90.296569][ T1402] kobject_init_and_add+0xee/0x1a0
[ 90.298680][ T1402] net_rx_queue_update_kobjects+0x247/0x780
[ 90.301080][ T1402] netdev_register_kobject+0x21f/0x310
[ 90.303329][ T1402] register_netdevice+0x1433/0x1eb0
[ 90.305465][ T1402] veth_newlink+0x676/0xb70
[ 90.307051][ T1402] rtnl_newlink_create+0x310/0xb00
[ 90.308835][ T1402] rtnl_newlink+0x167f/0x1bd0
[ 90.310832][ T1402] page_owner free stack trace missing
[ 90.313022][ T1402]
[ 90.314034][ T1402] Memory state around the buggy address:
[ 90.316296][ T1402] ffff88804fb04d80: 05 fc fc fc 05 fc fc fc 00 fc fc fc 00 fc fc fc
[ 90.319540][ T1402] ffff88804fb04e00: 00 fc fc fc 00 fc fc fc 00 fc fc fc 00 fc fc fc
[ 90.322790][ T1402] >ffff88804fb04e80: fa fc fc fc fa fc fc fc 01 fc fc fc fa fc fc fc
[ 90.326606][ T1402] ^
[ 90.329594][ T1402] ffff88804fb04f00: 00 fc fc fc fa fc fc fc fa fc fc fc 00 fc fc fc
[ 90.333038][ T1402] ffff88804fb04f80: fa fc fc fc 00 fc fc fc fa fc fc fc 00 fc fc fc
[ 90.336245][ T1402] ==================================================================
[ 90.372951][ T1402] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 90.375597][ T1402] CPU: 0 UID: 0 PID: 1402 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(full)
[ 90.379472][ T1402] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 90.383564][ T1402] Workqueue: usb_hub_wq hub_event
[ 90.385631][ T1402] Call Trace:
[ 90.387044][ T1402]
[ 90.388271][ T1402] vpanic+0x56c/0xa60
[ 90.389928][ T1402] ? __pfx_vpanic+0x10/0x10
[ 90.391852][ T1402] panic+0xc5/0xd0
[ 90.393401][ T1402] ? __pfx_panic+0x10/0x10
[ 90.395347][ T1402] ? preempt_schedule_thunk+0x16/0x40
[ 90.397451][ T1402] ? dw210x_op_rw+0xb6/0x180
[ 90.399241][ T1402] ? preempt_schedule_thunk+0x16/0x40
[ 90.401273][ T1402] ? dw210x_op_rw+0xb6/0x180
[ 90.403053][ T1402] check_panic_on_warn+0x89/0xb0
[ 90.405048][ T1402] ? dw210x_op_rw+0xb6/0x180
[ 90.406841][ T1402] end_report+0x73/0x170
[ 90.408339][ T1402] ? dw210x_op_rw+0xb6/0x180
[ 90.409912][ T1402] kasan_report+0x128/0x150
[ 90.411489][ T1402] ? dw210x_op_rw+0xb6/0x180
[ 90.413062][ T1402] kasan_check_range+0x264/0x2c0
[ 90.414743][ T1402] ? dw210x_op_rw+0xb6/0x180
[ 90.416376][ T1402] __asan_memcpy+0x29/0x70
[ 90.417957][ T1402] dw210x_op_rw+0xb6/0x180
[ 90.419468][ T1402] dw2102_load_firmware+0x2b4/0x970
[ 90.421197][ T1402] ? __pfx_dw2102_load_firmware+0x10/0x10
[ 90.423114][ T1402] ? __pfx_dw2102_load_firmware+0x10/0x10
[ 90.425039][ T1402] dvb_usb_download_firmware+0x1c3/0x270
[ 90.427127][ T1402] ? __pfx__printk+0x10/0x10
[ 90.428749][ T1402] ? __pfx_dvb_usb_download_firmware+0x10/0x10
[ 90.430864][ T1402] ? trace_kmalloc+0x2a/0xf0
[ 90.432426][ T1402] ? dvb_usb_device_init+0x148/0x2570
[ 90.434250][ T1402] dvb_usb_device_init+0xddf/0x2570
[ 90.436199][ T1402] ? __pfx_dvb_usb_device_init+0x10/0x10
[ 90.438228][ T1402] ? lockdep_hardirqs_on+0x7a/0x110
[ 90.440175][ T1402] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 90.442298][ T1402] ? __pm_runtime_set_status+0x994/0xc80
[ 90.444328][ T1402] dw2102_probe+0x8a/0x270
[ 90.445906][ T1402] usb_probe_interface+0x653/0xc60
[ 90.447742][ T1402] ? __pfx_usb_probe_interface+0x10/0x10
[ 90.449637][ T1402] really_probe+0x254/0xae0
[ 90.451444][ T1402] __driver_probe_device+0x1e8/0x360
[ 90.453421][ T1402] driver_probe_device+0x4f/0x240
[ 90.455229][ T1402] __device_attach_driver+0x270/0x410
[ 90.457057][ T1402] bus_for_each_drv+0x258/0x2f0
[ 90.458787][ T1402] ? __pfx___device_attach_driver+0x10/0x10
[ 90.460879][ T1402] ? __pfx_bus_for_each_drv+0x10/0x10
[ 90.462828][ T1402] ? lockdep_hardirqs_on+0x7a/0x110
[ 90.464633][ T1402] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 90.466661][ T1402] __device_attach+0x2c4/0x450
[ 90.468376][ T1402] ? __pfx___device_attach+0x10/0x10
[ 90.470290][ T1402] ? do_raw_spin_unlock+0x4d/0x210
[ 90.472272][ T1402] ? _raw_spin_unlock+0x28/0x50
[ 90.474033][ T1402] device_initial_probe+0xa1/0xd0
[ 90.475790][ T1402] bus_probe_device+0x12a/0x220
[ 90.477510][ T1402] device_add+0x7d7/0xb80
[ 90.478976][ T1402] usb_set_configuration+0x1ad8/0x2180
[ 90.480845][ T1402] usb_generic_driver_probe+0x8d/0x150
[ 90.482829][ T1402] usb_probe_device+0x1c3/0x3b0
[ 90.484490][ T1402] ? __pfx_usb_probe_device+0x10/0x10
[ 90.486402][ T1402] really_probe+0x254/0xae0
[ 90.488188][ T1402] __driver_probe_device+0x1e8/0x360
[ 90.490202][ T1402] driver_probe_device+0x4f/0x240
[ 90.492061][ T1402] __device_attach_driver+0x270/0x410
[ 90.493967][ T1402] bus_for_each_drv+0x258/0x2f0
[ 90.495660][ T1402] ? __pfx___device_attach_driver+0x10/0x10
[ 90.497765][ T1402] ? __pfx_bus_for_each_drv+0x10/0x10
[ 90.499603][ T1402] ? lockdep_hardirqs_on+0x7a/0x110
[ 90.501551][ T1402] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 90.503737][ T1402] __device_attach+0x2c4/0x450
[ 90.505514][ T1402] ? __pfx___device_attach+0x10/0x10
[ 90.507393][ T1402] ? do_raw_spin_unlock+0x4d/0x210
[ 90.509180][ T1402] ? _raw_spin_unlock+0x28/0x50
[ 90.510998][ T1402] device_initial_probe+0xa1/0xd0
[ 90.512871][ T1402] bus_probe_device+0x12a/0x220
[ 90.514723][ T1402] device_add+0x7d7/0xb80
[ 90.516357][ T1402] usb_new_device+0x99d/0x1620
[ 90.518207][ T1402] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 90.520663][ T1402] ? __pfx_usb_new_device+0x10/0x10
[ 90.522832][ T1402] ? _raw_spin_unlock_irq+0x23/0x50
[ 90.524998][ T1402] hub_event+0x28e8/0x4d30
[ 90.526915][ T1402] ? do_raw_spin_unlock+0x4d/0x210
[ 90.529145][ T1402] ? __pfx_hub_event+0x10/0x10
[ 90.531080][ T1402] ? process_scheduled_works+0xa20/0x14e0
[ 90.533417][ T1402] ? rcu_is_watching+0x15/0xb0
[ 90.535163][ T1402] ? process_scheduled_works+0xa20/0x14e0
[ 90.537413][ T1402] process_scheduled_works+0xa8e/0x14e0
[ 90.539572][ T1402] ? __pfx_process_scheduled_works+0x10/0x10
[ 90.541841][ T1402] ? assign_work+0x3cf/0x5d0
[ 90.543787][ T1402] worker_thread+0xa47/0xfb0
[ 90.545720][ T1402] ? __kthread_parkme+0x71/0x1f0
[ 90.547764][ T1402] kthread+0x388/0x470
[ 90.549448][ T1402] ? __pfx_worker_thread+0x10/0x10
[ 90.551331][ T1402] ? __pfx_kthread+0x10/0x10
[ 90.553277][ T1402] ret_from_fork+0x514/0xb70
[ 90.555177][ T1402] ? __pfx_ret_from_fork+0x10/0x10
[ 90.557368][ T1402] ? __switch_to+0xc89/0x1420
[ 90.559404][ T1402] ? __pfx_kthread+0x10/0x10
[ 90.561317][ T1402] ret_from_fork_asm+0x1a/0x30
[ 90.563306][ T1402]
[ 90.564981][ T1402] Kernel Offset: disabled
[ 90.566804][ T1402] Rebooting in 86400 seconds..