==================================================================
BUG: KASAN: slab-out-of-bounds in strlen+0x79/0x90 lib/string.c:525
Read of size 1 at addr ffff8881d6569eb8 by task syz-executor.2/7260

CPU: 0 PID: 7260 Comm: syz-executor.2 Not tainted 5.3.0-rc5+ #28
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xca/0x13e lib/dump_stack.c:113
 print_address_description+0x6a/0x32c mm/kasan/report.c:351
 __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
 kasan_report+0xe/0x12 mm/kasan/common.c:612
 strlen+0x79/0x90 lib/string.c:525
 strlen include/linux/string.h:281 [inline]
 hidraw_ioctl+0x62b/0xae0 drivers/hid/hidraw.c:437
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:509 [inline]
 do_vfs_ioctl+0xd2d/0x1330 fs/ioctl.c:696
 ksys_ioctl+0x9b/0xc0 fs/ioctl.c:713
 __do_sys_ioctl fs/ioctl.c:720 [inline]
 __se_sys_ioctl fs/ioctl.c:718 [inline]
 __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:718
 do_syscall_64+0xb7/0x580 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x459879
Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f0fdc155c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000459879
RDX: 0000000020001280 RSI: 0000000080404804 RDI: 0000000000000004
RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f0fdc1566d4
R13: 00000000004c2229 R14: 00000000004d56c8 R15: 00000000ffffffff

Allocated by task 7235:
 save_stack+0x1b/0x80 mm/kasan/common.c:69
 set_track mm/kasan/common.c:77 [inline]
 __kasan_kmalloc mm/kasan/common.c:487 [inline]
 __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460
 slab_post_alloc_hook mm/slab.h:520 [inline]
 slab_alloc_node mm/slub.c:2770 [inline]
 slab_alloc mm/slub.c:2778 [inline]
 kmem_cache_alloc+0xd6/0x2d0 mm/slub.c:2783
 kmem_cache_zalloc include/linux/slab.h:738 [inline]
 __alloc_file+0x21/0x300 fs/file_table.c:101
 alloc_empty_file+0x6d/0x170 fs/file_table.c:151
 path_openat+0xf3/0x3f50 fs/namei.c:3522
 do_filp_open+0x1a1/0x280 fs/namei.c:3563
 do_sys_open+0x3c0/0x580 fs/open.c:1089
 do_syscall_64+0xb7/0x580 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 2743:
 save_stack+0x1b/0x80 mm/kasan/common.c:69
 set_track mm/kasan/common.c:77 [inline]
 __kasan_slab_free+0x130/0x180 mm/kasan/common.c:449
 slab_free_hook mm/slub.c:1423 [inline]
 slab_free_freelist_hook mm/slub.c:1474 [inline]
 slab_free mm/slub.c:3016 [inline]
 kmem_cache_free+0xb9/0x380 mm/slub.c:3032
 __rcu_reclaim kernel/rcu/rcu.h:222 [inline]
 rcu_do_batch kernel/rcu/tree.c:2114 [inline]
 rcu_core+0x699/0x1bc0 kernel/rcu/tree.c:2314
 __do_softirq+0x221/0x912 kernel/softirq.c:292

The buggy address belongs to the object at ffff8881d6569b80
 which belongs to the cache filp of size 456
The buggy address is located 368 bytes to the right of
 456-byte region [ffff8881d6569b80, ffff8881d6569d48)
The buggy address belongs to the page:
page:ffffea0007595a00 refcount:1 mapcount:0 mapping:ffff8881da114780 index:0x0 compound_mapcount: 0
flags: 0x200000000010200(slab|head)
raw: 0200000000010200 dead000000000100 dead000000000122 ffff8881da114780
raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8881d6569d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8881d6569e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8881d6569e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                                        ^
 ffff8881d6569f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8881d6569f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================