==================================================================
BUG: KASAN: slab-out-of-bounds in mcp2221_raw_event+0xf94/0x1030 drivers/hid/hid-mcp2221.c:854
Read of size 1 at addr ffff88803563bfff by task syz.3.1757/12980
CPU: 1 UID: 0 PID: 12980 Comm: syz.3.1757 Not tainted 6.16.0-rc5-syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:408 [inline]
print_report+0xcd/0x680 mm/kasan/report.c:521
kasan_report+0xe0/0x110 mm/kasan/report.c:634
mcp2221_raw_event+0xf94/0x1030 drivers/hid/hid-mcp2221.c:854
__hid_input_report.constprop.0+0x314/0x450 drivers/hid/hid-core.c:2117
hid_irq_in+0x35e/0x870 drivers/hid/usbhid/hid-core.c:286
__usb_hcd_giveback_urb+0x38a/0x6e0 drivers/usb/core/hcd.c:1650
usb_hcd_giveback_urb+0x39b/0x450 drivers/usb/core/hcd.c:1734
dummy_timer+0x180e/0x3a20 drivers/usb/gadget/udc/dummy_hcd.c:1995
__run_hrtimer kernel/time/hrtimer.c:1761 [inline]
__hrtimer_run_queues+0x1ff/0xad0 kernel/time/hrtimer.c:1825
hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1842
handle_softirqs+0x219/0x8e0 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1050
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:finish_task_switch.isra.0+0x22a/0xc10 kernel/sched/core.c:5269
Code: fb 09 00 00 44 8b 05 09 c8 1f 0f 45 85 c0 0f 85 be 01 00 00 4c 89 e7 e8 a4 f6 ff ff e8 0f da 39 00 fb 65 48 8b 1d be a2 46 12 <48> 8d bb 18 16 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1
RSP: 0018:ffffc9001beff6b0 EFLAGS: 00000206
RAX: 000000000000f4bb RBX: ffff88803338c880 RCX: ffffffff81c3b65f
RDX: 0000000000000000 RSI: ffffffff8de3106c RDI: ffffffff8c158660
RBP: ffffc9001beff6f8 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff90a97357 R11: 0000000000000001 R12: ffff8880b853a2c0
R13: ffff888034f78000 R14: 0000000000000001 R15: ffff8880b853b130
context_switch kernel/sched/core.c:5404 [inline]
__schedule+0x1172/0x5de0 kernel/sched/core.c:6790
preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7113
irqentry_exit+0x36/0x90 kernel/entry/common.c:307
asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:707
RIP: 0010:rcu_preempt_read_enter kernel/rcu/tree_plugin.h:391 [inline]
RIP: 0010:__rcu_read_lock+0x68/0xf0 kernel/rcu/tree_plugin.h:414
Code: 00 65 48 8b 2d f1 36 2f 12 48 8d bd 44 04 00 00 8b 9b 44 04 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 83 c3 01 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 61 48
RSP: 0018:ffffc9001beff990 EFLAGS: 00000202
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffc9001beffab0
RDX: 1ffff11006671998 RSI: ffffffff81a7857e RDI: ffff88803338ccc4
RBP: ffff88803338c880 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 00000000000061e3 R12: ffffffff81a781f0
R13: ffffc9001beffa18 R14: 0000000000000000 R15: ffff88803338c880
rcu_read_lock include/linux/rcupdate.h:839 [inline]
class_rcu_constructor include/linux/rcupdate.h:1155 [inline]
unwind_next_frame+0xae/0x20a0 arch/x86/kernel/unwind_orc.c:479
arch_stack_walk+0x94/0x100 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x51/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2381 [inline]
slab_free mm/slub.c:4643 [inline]
kfree+0x2b4/0x4d0 mm/slub.c:4842
raw_ioctl_ep_write drivers/usb/gadget/legacy/raw_gadget.c:1153 [inline]
raw_ioctl+0xab6/0x2c30 drivers/usb/gadget/legacy/raw_gadget.c:1324
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl fs/ioctl.c:893 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f252938e52b
Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
RSP: 002b:00007f252a1fdf70 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f252938e52b
RDX: 00007f252a1fdff0 RSI: 0000000040085507 RDI: 0000000000000003
RBP: 0000000000000003 R08: 00007f25296e0320 R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000246 R12: 00002000000004c0
R13: 0000000000000000 R14: 00007f25295b5fa0 R15: 00007ffe2c352088
Allocated by task 12962:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__do_kmalloc_node mm/slub.c:4328 [inline]
__kmalloc_noprof+0x223/0x510 mm/slub.c:4340
kmalloc_noprof include/linux/slab.h:909 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]
hash_ipport4_resize+0xc09/0x1b10 net/netfilter/ipset/ip_set_hash_gen.h:725
call_ad.constprop.0+0x36a/0x940 net/netfilter/ipset/ip_set_core.c:1757
ip_set_ad.constprop.0.isra.0+0x3ce/0x870 net/netfilter/ipset/ip_set_core.c:1841
nfnetlink_rcv_msg+0x9f9/0x1200 net/netfilter/nfnetlink.c:303
netlink_rcv_skb+0x155/0x420 net/netlink/af_netlink.c:2534
nfnetlink_rcv+0x1b3/0x430 net/netfilter/nfnetlink.c:668
netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
netlink_unicast+0x53a/0x7f0 net/netlink/af_netlink.c:1339
netlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1883
sock_sendmsg_nosec net/socket.c:712 [inline]
__sock_sendmsg net/socket.c:727 [inline]
____sys_sendmsg+0xa95/0xc70 net/socket.c:2566
___sys_sendmsg+0x134/0x1d0 net/socket.c:2620
__sys_sendmsg+0x16d/0x220 net/socket.c:2652
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 9139:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x51/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2381 [inline]
slab_free mm/slub.c:4643 [inline]
kfree+0x2b4/0x4d0 mm/slub.c:4842
kvfree_rcu_list+0x95/0x120 mm/slab_common.c:1553
kfree_rcu_work+0x16f/0x1a0 mm/slab_common.c:1605
process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238
process_scheduled_works kernel/workqueue.c:3321 [inline]
worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
kthread+0x3c5/0x780 kernel/kthread.c:464
ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Last potentially related work creation:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_record_aux_stack+0xa7/0xc0 mm/kasan/generic.c:548
kvfree_call_rcu+0x76/0x470 mm/slab_common.c:1962
hash_ipport4_add+0x176d/0x2a00 net/netfilter/ipset/ip_set_hash_gen.h:992
hash_ipport4_uadt+0x876/0xe10 net/netfilter/ipset/ip_set_hash_ipport.c:199
call_ad.constprop.0+0x16b/0x940 net/netfilter/ipset/ip_set_core.c:1751
ip_set_ad.constprop.0.isra.0+0x3ce/0x870 net/netfilter/ipset/ip_set_core.c:1841
nfnetlink_rcv_msg+0x9f9/0x1200 net/netfilter/nfnetlink.c:303
netlink_rcv_skb+0x155/0x420 net/netlink/af_netlink.c:2534
nfnetlink_rcv+0x1b3/0x430 net/netfilter/nfnetlink.c:668
netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
netlink_unicast+0x53a/0x7f0 net/netlink/af_netlink.c:1339
netlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1883
sock_sendmsg_nosec net/socket.c:712 [inline]
__sock_sendmsg net/socket.c:727 [inline]
____sys_sendmsg+0xa95/0xc70 net/socket.c:2566
___sys_sendmsg+0x134/0x1d0 net/socket.c:2620
__sys_sendmsg+0x16d/0x220 net/socket.c:2652
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff88803563bf80
which belongs to the cache kmalloc-64 of size 64
The buggy address is located 63 bytes to the right of
allocated 64-byte region [ffff88803563bf80, ffff88803563bfc0)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3563b
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000000 ffff88801b8418c0 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 12962, tgid 12961 (syz.0.1752), ts 650232190692, free_ts 552140136561
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1c0/0x230 mm/page_alloc.c:1704
prep_new_page mm/page_alloc.c:1712 [inline]
get_page_from_freelist+0x1321/0x3890 mm/page_alloc.c:3669
__alloc_frozen_pages_noprof+0x261/0x23f0 mm/page_alloc.c:4959
alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2419
alloc_slab_page mm/slub.c:2451 [inline]
allocate_slab mm/slub.c:2619 [inline]
new_slab+0x23b/0x330 mm/slub.c:2673
___slab_alloc+0xd9c/0x1940 mm/slub.c:3859
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3949
__slab_alloc_node mm/slub.c:4024 [inline]
slab_alloc_node mm/slub.c:4185 [inline]
__do_kmalloc_node mm/slub.c:4327 [inline]
__kmalloc_noprof+0x2f2/0x510 mm/slub.c:4340
kmalloc_noprof include/linux/slab.h:909 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]
hash_ipport4_resize+0x102a/0x1b10 net/netfilter/ipset/ip_set_hash_gen.h:707
call_ad.constprop.0+0x36a/0x940 net/netfilter/ipset/ip_set_core.c:1757
ip_set_ad.constprop.0.isra.0+0x3ce/0x870 net/netfilter/ipset/ip_set_core.c:1841
nfnetlink_rcv_msg+0x9f9/0x1200 net/netfilter/nfnetlink.c:303
netlink_rcv_skb+0x155/0x420 net/netlink/af_netlink.c:2534
nfnetlink_rcv+0x1b3/0x430 net/netfilter/nfnetlink.c:668
netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
netlink_unicast+0x53a/0x7f0 net/netlink/af_netlink.c:1339
netlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1883
page last free pid 5835 tgid 5835 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1248 [inline]
__free_frozen_pages+0x7fe/0x1180 mm/page_alloc.c:2706
rcu_do_batch kernel/rcu/tree.c:2576 [inline]
rcu_core+0x79c/0x14e0 kernel/rcu/tree.c:2832
handle_softirqs+0x219/0x8e0 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1050
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
Memory state around the buggy address:
ffff88803563be80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff88803563bf00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff88803563bf80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
^
ffff88803563c000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88803563c080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess), 2 bytes skipped:
0: 00 00 add %al,(%rax)
2: 44 8b 05 09 c8 1f 0f mov 0xf1fc809(%rip),%r8d # 0xf1fc812
9: 45 85 c0 test %r8d,%r8d
c: 0f 85 be 01 00 00 jne 0x1d0
12: 4c 89 e7 mov %r12,%rdi
15: e8 a4 f6 ff ff call 0xfffff6be
1a: e8 0f da 39 00 call 0x39da2e
1f: fb sti
20: 65 48 8b 1d be a2 46 mov %gs:0x1246a2be(%rip),%rbx # 0x1246a2e6
27: 12
* 28: 48 8d bb 18 16 00 00 lea 0x1618(%rbx),%rdi <-- trapping instruction
2f: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
36: fc ff df
39: 48 89 fa mov %rdi,%rdx
3c: 48 rex.W
3d: c1 .byte 0xc1