xpad 6-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19
xpad 6-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19
==================================================================
BUG: KASAN: slab-use-after-free in register_lock_class+0x101f/0x1230 kernel/locking/lockdep.c:1332
Read of size 1 at addr ffff888000390891 by task syz.3.269/6206

CPU: 1 UID: 0 PID: 6206 Comm: syz.3.269 Not tainted 6.11.0-rc7-syzkaller-00039-g77f587896757 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:93 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0xc3/0x620 mm/kasan/report.c:488
 kasan_report+0xd9/0x110 mm/kasan/report.c:601
 register_lock_class+0x101f/0x1230 kernel/locking/lockdep.c:1332
 __lock_acquire+0x135/0x3cb0 kernel/locking/lockdep.c:5019
 lock_acquire kernel/locking/lockdep.c:5759 [inline]
 lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162
 __wake_up_common_lock kernel/sched/wait.c:105 [inline]
 __wake_up+0x1c/0x60 kernel/sched/wait.c:127
 __usb_unanchor_urb drivers/usb/core/urb.c:156 [inline]
 usb_anchor_resume_wakeups+0xc2/0xe0 drivers/usb/core/urb.c:150
 __usb_hcd_giveback_urb+0x3b7/0x6e0 drivers/usb/core/hcd.c:1653
 usb_hcd_giveback_urb+0x396/0x450 drivers/usb/core/hcd.c:1734
 dummy_timer+0x13c2/0x3500 drivers/usb/gadget/udc/dummy_hcd.c:1987
 __run_hrtimer kernel/time/hrtimer.c:1689 [inline]
 __hrtimer_run_queues+0x20c/0xcc0 kernel/time/hrtimer.c:1753
 hrtimer_interrupt+0x31b/0x800 kernel/time/hrtimer.c:1815
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline]
 __sysvec_apic_timer_interrupt+0x10f/0x450 arch/x86/kernel/apic/apic.c:1049
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1043
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:check_preemption_disabled+0x8/0xe0 lib/smp_processor_id.c:14
Code: fa 74 85 c0 74 04 90 0f 0b 90 e9 53 fc ff ff 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 41 54 55 53 48 83 ec 08 <65> 8b 1d ed a2 fb 74 65 8b 05 e2 a2 fb 74 a9 ff ff ff 7f 74 0f 48
RSP: 0018:ffffc9000e017530 EFLAGS: 00000286
RAX: 0000000000000001 RBX: 000000000004adce RCX: ffffffff81f51274
RDX: 0000000000000001 RSI: ffffffff8bb07fe0 RDI: ffffffff8bb08020
RBP: ffff88803fff9120 R08: 0000000000000007 R09: 000000000007ffff
R10: 0000000000000009 R11: 0000000000000000 R12: ffff88803f180000
R13: 0000000000000000 R14: 0000000000000001 R15: ffffc9000e017a98
 rcu_dynticks_curr_cpu_in_eqs include/linux/context_tracking.h:124 [inline]
 rcu_is_watching+0x12/0xc0 kernel/rcu/tree.c:726
 rcu_read_lock_held_common kernel/rcu/update.c:109 [inline]
 rcu_read_lock_held+0x1e/0x50 kernel/rcu/update.c:349
 lookup_page_ext mm/page_ext.c:254 [inline]
 page_ext_get+0x132/0x310 mm/page_ext.c:526
 page_table_check_clear.part.0+0x32/0x540 mm/page_table_check.c:74
 page_table_check_clear mm/page_table_check.c:70 [inline]
 __page_table_check_pte_clear+0x328/0x580 mm/page_table_check.c:169
 page_table_check_pte_clear include/linux/page_table_check.h:49 [inline]
 ptep_get_and_clear arch/x86/include/asm/pgtable.h:1268 [inline]
 ptep_get_and_clear_full arch/x86/include/asm/pgtable.h:1286 [inline]
 clear_full_ptes include/linux/pgtable.h:715 [inline]
 zap_present_folio_ptes mm/memory.c:1506 [inline]
 zap_present_ptes mm/memory.c:1576 [inline]
 zap_pte_range mm/memory.c:1618 [inline]
 zap_pmd_range mm/memory.c:1736 [inline]
 zap_pud_range mm/memory.c:1765 [inline]
 zap_p4d_range mm/memory.c:1786 [inline]
 unmap_page_range+0x1a87/0x3bf0 mm/memory.c:1807
 unmap_single_vma+0x194/0x2b0 mm/memory.c:1853
 unmap_vmas+0x22f/0x490 mm/memory.c:1897
 exit_mmap+0x1b8/0xb20 mm/mmap.c:3412
 __mmput+0x12a/0x480 kernel/fork.c:1345
 mmput+0x62/0x70 kernel/fork.c:1367
 exit_mm kernel/exit.c:571 [inline]
 do_exit+0x9bf/0x2bb0 kernel/exit.c:869
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1031
 get_signal+0x2658/0x26d0 kernel/signal.c:2917
 arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:310
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
 __do_fast_syscall_32+0x80/0x120 arch/x86/entry/common.c:389
 do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf746e579
Code: Unable to access opcode bytes at 0xf746e54f.
RSP: 002b:00000000f573560c EFLAGS: 00000296 ORIG_RAX: 00000000000000f0
RAX: fffffffffffffe00 RBX: 00000000f7495014 RCX: 0000000000000080
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f7495018
RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>

Allocated by task 1286:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
 kmalloc_noprof include/linux/slab.h:681 [inline]
 kzalloc_noprof include/linux/slab.h:807 [inline]
 xpad_probe+0x27e/0x1e60 drivers/input/joystick/xpad.c:2026
 usb_probe_interface+0x309/0x9d0 drivers/usb/core/driver.c:399
 call_driver_probe drivers/base/dd.c:578 [inline]
 really_probe+0x23e/0xa90 drivers/base/dd.c:657
 __driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
 __device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
 bus_for_each_drv+0x157/0x1e0 drivers/base/bus.c:457
 __device_attach+0x1e8/0x4b0 drivers/base/dd.c:1029
 bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:532
 device_add+0x114b/0x1a70 drivers/base/core.c:3682
 usb_set_configuration+0x10ea/0x1ca0 drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0xb1/0x110 drivers/usb/core/generic.c:254
 usb_probe_device+0xec/0x3e0 drivers/usb/core/driver.c:294
 call_driver_probe drivers/base/dd.c:578 [inline]
 really_probe+0x23e/0xa90 drivers/base/dd.c:657
 __driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
 __device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
 bus_for_each_drv+0x157/0x1e0 drivers/base/bus.c:457
 __device_attach+0x1e8/0x4b0 drivers/base/dd.c:1029
 bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:532
 device_add+0x114b/0x1a70 drivers/base/core.c:3682
 usb_new_device+0xd2c/0x1960 drivers/usb/core/hub.c:2651
 hub_port_connect drivers/usb/core/hub.c:5521 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5661 [inline]
 port_event drivers/usb/core/hub.c:5821 [inline]
 hub_event+0x2d9a/0x4e10 drivers/usb/core/hub.c:5903
 process_one_work+0x958/0x1ad0 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Freed by task 8:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
 poison_slab_object+0xf7/0x160 mm/kasan/common.c:240
 __kasan_slab_free+0x32/0x50 mm/kasan/common.c:256
 kasan_slab_free include/linux/kasan.h:184 [inline]
 slab_free_hook mm/slub.c:2256 [inline]
 slab_free mm/slub.c:4477 [inline]
 kfree+0x12a/0x3b0 mm/slub.c:4598
 xpad_disconnect+0x1cf/0x580 drivers/input/joystick/xpad.c:2207
 usb_unbind_interface+0x1e8/0x970 drivers/usb/core/driver.c:461
 device_remove drivers/base/dd.c:568 [inline]
 device_remove+0x122/0x170 drivers/base/dd.c:560
 __device_release_driver drivers/base/dd.c:1272 [inline]
 device_release_driver_internal+0x44a/0x610 drivers/base/dd.c:1295
 bus_remove_device+0x22f/0x420 drivers/base/bus.c:574
 device_del+0x396/0x9f0 drivers/base/core.c:3871
 usb_disable_device+0x36c/0x7f0 drivers/usb/core/message.c:1418
 usb_disconnect+0x2e1/0x920 drivers/usb/core/hub.c:2304
 hub_port_connect drivers/usb/core/hub.c:5361 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5661 [inline]
 port_event drivers/usb/core/hub.c:5821 [inline]
 hub_event+0x1da5/0x4e10 drivers/usb/core/hub.c:5903
 process_one_work+0x958/0x1ad0 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

The buggy address belongs to the object at ffff888000390800
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 145 bytes inside of
 freed 1024-byte region [ffff888000390800, ffff888000390c00)

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x390
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0x7ff00000000040(head|node=0|zone=0|lastcpupid=0x7ff)
page_type: 0xfdffffff(slab)
raw: 007ff00000000040 ffff88801ac42dc0 0000000000000000 dead000000000001
raw: 0000000000000000 0000000000100010 00000001fdffffff 0000000000000000
head: 007ff00000000040 ffff88801ac42dc0 0000000000000000 dead000000000001
head: 0000000000000000 0000000000100010 00000001fdffffff 0000000000000000
head: 007ff00000000003 ffffea000000e401 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 11, tgid 11 (kworker/u32:0), ts 63428191815, free_ts 63315197131
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1500
 prep_new_page mm/page_alloc.c:1508 [inline]
 get_page_from_freelist+0x1351/0x2e50 mm/page_alloc.c:3446
 __alloc_pages_noprof+0x22b/0x2460 mm/page_alloc.c:4702
 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
 alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
 alloc_slab_page+0x4e/0xf0 mm/slub.c:2325
 allocate_slab mm/slub.c:2488 [inline]
 new_slab+0x84/0x260 mm/slub.c:2541
 ___slab_alloc+0xdac/0x1870 mm/slub.c:3727
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3817
 __slab_alloc_node mm/slub.c:3870 [inline]
 slab_alloc_node mm/slub.c:4029 [inline]
 __do_kmalloc_node mm/slub.c:4161 [inline]
 __kmalloc_node_track_caller_noprof+0x365/0x440 mm/slub.c:4181
 kmalloc_reserve+0xef/0x2c0 net/core/skbuff.c:605
 __alloc_skb+0x164/0x380 net/core/skbuff.c:674
 alloc_skb include/linux/skbuff.h:1320 [inline]
 nlmsg_new include/net/netlink.h:1015 [inline]
 inet6_rt_notify+0xf0/0x2c0 net/ipv6/route.c:6180
 fib6_add_rt2node net/ipv6/ip6_fib.c:1266 [inline]
 fib6_add+0x2524/0x4b50 net/ipv6/ip6_fib.c:1495
 __ip6_ins_rt net/ipv6/route.c:1314 [inline]
 ip6_ins_rt+0xb6/0x110 net/ipv6/route.c:1324
 __ipv6_ifa_notify+0x9de/0xc30 net/ipv6/addrconf.c:6268
 ipv6_ifa_notify net/ipv6/addrconf.c:6307 [inline]
 addrconf_dad_completed+0x19d/0x1060 net/ipv6/addrconf.c:4320
 addrconf_dad_work+0x7fb/0x14d0 net/ipv6/addrconf.c:4268
page last free pid 24 tgid 24 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1101 [inline]
 free_unref_page+0x64a/0xe40 mm/page_alloc.c:2619
 __folio_put+0x31c/0x3e0 mm/swap.c:128
 folio_put include/linux/mm.h:1490 [inline]
 put_page include/linux/mm.h:1562 [inline]
 skb_page_unref include/linux/skbuff_ref.h:44 [inline]
 __skb_frag_unref include/linux/skbuff_ref.h:57 [inline]
 skb_release_data+0x5df/0x980 net/core/skbuff.c:1117
 skb_release_all net/core/skbuff.c:1188 [inline]
 __kfree_skb+0x4f/0x70 net/core/skbuff.c:1202
 tcp_wmem_free_skb include/net/tcp.h:306 [inline]
 tcp_rtx_queue_unlink_and_free include/net/tcp.h:2090 [inline]
 tcp_clean_rtx_queue net/ipv4/tcp_input.c:3409 [inline]
 tcp_ack+0x1eb7/0x5ba0 net/ipv4/tcp_input.c:4005
 tcp_rcv_established+0x60f/0x21c0 net/ipv4/tcp_input.c:6219
 tcp_v4_do_rcv+0x5ca/0xa90 net/ipv4/tcp_ipv4.c:1911
 tcp_v4_rcv+0x33bc/0x43b0 net/ipv4/tcp_ipv4.c:2346
 ip_protocol_deliver_rcu+0xba/0x4c0 net/ipv4/ip_input.c:205
 ip_local_deliver_finish+0x316/0x570 net/ipv4/ip_input.c:233
 NF_HOOK include/linux/netfilter.h:314 [inline]
 NF_HOOK include/linux/netfilter.h:308 [inline]
 ip_local_deliver+0x18e/0x1f0 net/ipv4/ip_input.c:254
 dst_input include/net/dst.h:460 [inline]
 ip_rcv_finish net/ipv4/ip_input.c:449 [inline]
 NF_HOOK include/linux/netfilter.h:314 [inline]
 NF_HOOK include/linux/netfilter.h:308 [inline]
 ip_rcv+0x2c5/0x5d0 net/ipv4/ip_input.c:569
 __netif_receive_skb_one_core+0x199/0x1e0 net/core/dev.c:5661
 __netif_receive_skb+0x1d/0x160 net/core/dev.c:5775
 process_backlog+0x443/0x15f0 net/core/dev.c:6108
 __napi_poll.constprop.0+0xb7/0x550 net/core/dev.c:6772

Memory state around the buggy address:
 ffff888000390780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888000390800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888000390880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                         ^
 ffff888000390900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888000390980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess), 2 bytes skipped:
   0:	85 c0                	test   %eax,%eax
   2:	74 04                	je     0x8
   4:	90                   	nop
   5:	0f 0b                	ud2
   7:	90                   	nop
   8:	e9 53 fc ff ff       	jmp    0xfffffc60
   d:	0f 1f 00             	nopl   (%rax)
  10:	90                   	nop
  11:	90                   	nop
  12:	90                   	nop
  13:	90                   	nop
  14:	90                   	nop
  15:	90                   	nop
  16:	90                   	nop
  17:	90                   	nop
  18:	90                   	nop
  19:	90                   	nop
  1a:	90                   	nop
  1b:	90                   	nop
  1c:	90                   	nop
  1d:	90                   	nop
  1e:	90                   	nop
  1f:	90                   	nop
  20:	41 54                	push   %r12
  22:	55                   	push   %rbp
  23:	53                   	push   %rbx
  24:	48 83 ec 08          	sub    $0x8,%rsp
* 28:	65 8b 1d ed a2 fb 74 	mov    %gs:0x74fba2ed(%rip),%ebx        # 0x74fba31c <-- trapping instruction
  2f:	65 8b 05 e2 a2 fb 74 	mov    %gs:0x74fba2e2(%rip),%eax        # 0x74fba318
  36:	a9 ff ff ff 7f       	test   $0x7fffffff,%eax
  3b:	74 0f                	je     0x4c
  3d:	48                   	rex.W