==================================================================
BUG: KASAN: use-after-free in mcp2221_raw_event+0x1070/0x10a0 drivers/hid/hid-mcp2221.c:948
Read of size 1 at addr ffff888027d73fff by task syz.3.6988/28271
CPU: 0 UID: 0 PID: 28271 Comm: syz.3.6988 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xcd/0x630 mm/kasan/report.c:482
kasan_report+0xe0/0x110 mm/kasan/report.c:595
mcp2221_raw_event+0x1070/0x10a0 drivers/hid/hid-mcp2221.c:948
__hid_input_report.constprop.0+0x314/0x450 drivers/hid/hid-core.c:2139
hid_irq_in+0x35e/0x870 drivers/hid/usbhid/hid-core.c:286
__usb_hcd_giveback_urb+0x38b/0x610 drivers/usb/core/hcd.c:1661
usb_hcd_giveback_urb+0x39b/0x450 drivers/usb/core/hcd.c:1745
dummy_timer+0x1809/0x3a00 drivers/usb/gadget/udc/dummy_hcd.c:1995
__run_hrtimer kernel/time/hrtimer.c:1777 [inline]
__hrtimer_run_queues+0x202/0xad0 kernel/time/hrtimer.c:1841
hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1858
handle_softirqs+0x219/0x8e0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1052
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:preempt_schedule_irq+0x4c/0x90 kernel/sched/core.c:7256
Code: df 55 65 48 8b 2d ac 72 41 08 53 48 89 eb 48 c1 eb 03 48 01 c3 bf 01 00 00 00 e8 4f 66 29 f6 e8 da bb 64 f6 fb bf 01 00 00 00 af 99 ff ff 9c 58 fa f6 c4 02 75 1e bf 01 00 00 00 e8 3d f1 28
RSP: 0000:ffffc9000ad57e58 EFLAGS: 00000206
RAX: 0000000000001d65 RBX: ffffed100b081000 RCX: ffffffff81c4e85f
RDX: 0000000000000000 RSI: ffffffff8da2ae3d RDI: 0000000000000001
RBP: ffff888058408000 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff90824ed7 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
irqentry_exit+0x36/0x90 kernel/entry/common.c:211
asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:exit_to_user_mode_loop kernel/entry/common.c:30 [inline]
RIP: 0010:exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
RIP: 0010:irqentry_exit_to_user_mode+0x15a/0x310 kernel/entry/common.c:73
Code: 85 2e 01 00 00 e8 d6 0f 00 00 65 48 8b 05 c6 a4 42 08 48 8b 18 f7 c3 37 03 00 00 0f 84 f3 fe ff ff e8 fa ed 65 f6 fb f6 c3 30 <75> b9 f6 c7 01 74 be 4c 89 e7 e8 07 2f 93 f6 f6 c3 06 74 b6 4c 89
RSP: 0000:ffffc9000ad57f28 EFLAGS: 00000202
RAX: 0000000000001d63 RBX: 0000000000000010 RCX: ffffffff81c4e85f
RDX: 0000000000000000 RSI: ffffffff8da2ae3d RDI: ffffffff8bf079c0
RBP: ffff888058408000 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff90824ed7 R11: 0000000000000001 R12: ffffc9000ad57f48
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:704
RIP: 0033:0x7fd9eac6f237
Code: 39 f0 72 ef e9 cb fe ff ff 66 2e 0f 1f 84 00 00 00 00 00 48 c7 43 50 04 00 00 00 e9 06 fe ff ff 0f 1f 00 48 8b 0d 41 2e 37 00 <48> 81 ce ff ff ff 3f 31 c0 48 3b 34 c1 74 5b 48 83 c0 01 48 83 f8
RSP: 002b:00007ffd83e28660 EFLAGS: 00000202
RAX: 0000000000000000 RBX: 00007fd9ebb15720 RCX: 000000110c230000
RDX: 0000000000000e6c RSI: ffffffff89278e6c RDI: 000000000000000a
RBP: ffffffff89278e6c R08: 00007fd9eafe6128 R09: 00007fd9eafd2000
R10: 00007fd9ea3fd008 R11: 000000000000000a R12: 000000000000000a
R13: 0000000000000000 R14: ffffffff892785c4 R15: 0000000000000625
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888027d73000 pfn:0x27d73
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 ffffea0002269888 ffffea0000a6b9c8 0000000000000000
raw: ffff888027d73000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2dc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO|__GFP_NOWARN), pid 23282, tgid 23282 (kworker/0:4), ts 2433976265773, free_ts 2433980449874
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1af/0x220 mm/page_alloc.c:1845
prep_new_page mm/page_alloc.c:1853 [inline]
get_page_from_freelist+0x10a3/0x3a30 mm/page_alloc.c:3879
__alloc_frozen_pages_noprof+0x25f/0x2470 mm/page_alloc.c:5178
alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2416
alloc_frozen_pages_noprof mm/mempolicy.c:2487 [inline]
alloc_pages_noprof+0x131/0x390 mm/mempolicy.c:2507
vm_area_alloc_pages mm/vmalloc.c:3647 [inline]
__vmalloc_area_node mm/vmalloc.c:3724 [inline]
__vmalloc_node_range_noprof+0x6f8/0x1480 mm/vmalloc.c:3897
__vmalloc_node_noprof+0xad/0xf0 mm/vmalloc.c:3960
hid_open_report+0x2a0/0x830 drivers/hid/hid-core.c:1312
hid_parse include/linux/hid.h:1164 [inline]
mcp2221_probe+0x4c/0xc50 drivers/hid/hid-mcp2221.c:1230
__hid_device_probe drivers/hid/hid-core.c:2775 [inline]
hid_device_probe+0x5ba/0x8d0 drivers/hid/hid-core.c:2812
call_driver_probe drivers/base/dd.c:581 [inline]
really_probe+0x241/0xa90 drivers/base/dd.c:659
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:801
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:831
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:959
bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:462
__device_attach+0x1e4/0x4b0 drivers/base/dd.c:1031
page last free pid 23282 tgid 23282 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1394 [inline]
__free_frozen_pages+0x7df/0x1160 mm/page_alloc.c:2901
vfree+0x1fd/0xb50 mm/vmalloc.c:3440
hid_open_report+0x6cd/0x830 drivers/hid/hid-core.c:1365
hid_parse include/linux/hid.h:1164 [inline]
mcp2221_probe+0x4c/0xc50 drivers/hid/hid-mcp2221.c:1230
__hid_device_probe drivers/hid/hid-core.c:2775 [inline]
hid_device_probe+0x5ba/0x8d0 drivers/hid/hid-core.c:2812
call_driver_probe drivers/base/dd.c:581 [inline]
really_probe+0x241/0xa90 drivers/base/dd.c:659
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:801
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:831
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:959
bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:462
__device_attach+0x1e4/0x4b0 drivers/base/dd.c:1031
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
device_add+0x1148/0x1aa0 drivers/base/core.c:3689
hid_add_device+0x31b/0x5c0 drivers/hid/hid-core.c:2951
usbhid_probe+0xd38/0x13f0 drivers/hid/usbhid/hid-core.c:1435
usb_probe_interface+0x303/0xa40 drivers/usb/core/driver.c:396
Memory state around the buggy address:
ffff888027d73e80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888027d73f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888027d73f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888027d74000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888027d74080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess):
0: df 55 65 fists 0x65(%rbp)
3: 48 8b 2d ac 72 41 08 mov 0x84172ac(%rip),%rbp # 0x84172b6
a: 53 push %rbx
b: 48 89 eb mov %rbp,%rbx
e: 48 c1 eb 03 shr $0x3,%rbx
12: 48 01 c3 add %rax,%rbx
15: bf 01 00 00 00 mov $0x1,%edi
1a: e8 4f 66 29 f6 call 0xf629666e
1f: e8 da bb 64 f6 call 0xf664bbfe
24: fb sti
25: bf 01 00 00 00 mov $0x1,%edi
* 2a: e8 af 99 ff ff call 0xffff99de <-- trapping instruction
2f: 9c pushf
30: 58 pop %rax
31: fa cli
32: f6 c4 02 test $0x2,%ah
35: 75 1e jne 0x55
37: bf 01 00 00 00 mov $0x1,%edi
3c: e8 .byte 0xe8
3d: 3d .byte 0x3d
3e: f1 int1
3f: 28 .byte 0x28