xpad 4-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19
xpad 4-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19
==================================================================
BUG: KASAN: slab-use-after-free in debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline]
BUG: KASAN: slab-use-after-free in do_raw_spin_lock+0x299/0x370 kernel/locking/spinlock_debug.c:115
Read of size 4 at addr ffff88805ee5785c by task syz-executor.0/7581
CPU: 0 PID: 7581 Comm: syz-executor.0 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline]
do_raw_spin_lock+0x299/0x370 kernel/locking/spinlock_debug.c:115
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:111 [inline]
_raw_spin_lock_irqsave+0xe1/0x120 kernel/locking/spinlock.c:162
__wake_up_common_lock+0x25/0x1e0 kernel/sched/wait.c:105
__usb_hcd_giveback_urb+0x3ac/0x530 drivers/usb/core/hcd.c:1653
dummy_timer+0x8aa/0x3220 drivers/usb/gadget/udc/dummy_hcd.c:1987
call_timer_fn+0x180/0x600 kernel/time/timer.c:1792
expire_timers kernel/time/timer.c:1843 [inline]
__run_timers kernel/time/timer.c:2408 [inline]
__run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2419
run_timer_base kernel/time/timer.c:2428 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2438
__do_softirq+0x2be/0x943 kernel/softirq.c:554
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633
irq_exit_rcu+0x9/0x30 kernel/softirq.c:645
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:pfn_valid+0x1c/0x440 include/linux/mmzone.h:2010
Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 55 41 57 41 56 41 55 41 54 53 49 89 fd e8 ae e3 90 ff 48 bf 00 00 00 00 00 00 10 00 <4c> 89 ee e8 7c e8 90 ff 4c 89 e8 48 c1 e8 34 75 27 48 bf ff ff ff
RSP: 0018:ffffc900041a7340 EFLAGS: 00000293
RAX: ffffffff820411a2 RBX: 000000000006e409 RCX: ffff88801febbc00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0010000000000000
RBP: ffffc900041a7650 R08: ffffffff8203f720 R09: 1ffffd4000372040
R10: dffffc0000000000 R11: fffff94000372041 R12: ffff88804467df00
R13: 000000000006e409 R14: 0000000000000001 R15: dffffc0000000000
page_table_check_clear+0x21/0x730 mm/page_table_check.c:68
zap_pte_range mm/memory.c:1452 [inline]
zap_pmd_range mm/memory.c:1597 [inline]
zap_pud_range mm/memory.c:1626 [inline]
zap_p4d_range mm/memory.c:1647 [inline]
unmap_page_range+0x1f7a/0x3610 mm/memory.c:1668
unmap_vmas+0x3cc/0x5f0 mm/memory.c:1758
exit_mmap+0x2c6/0xd40 mm/mmap.c:3287
__mmput+0x115/0x3c0 kernel/fork.c:1345
exit_mm+0x220/0x310 kernel/exit.c:569
do_exit+0x99e/0x27e0 kernel/exit.c:865
do_group_exit+0x207/0x2c0 kernel/exit.c:1027
get_signal+0x176e/0x1850 kernel/signal.c:2907
arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop kernel/entry/common.c:105 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:201 [inline]
syscall_exit_to_user_mode+0xc9/0x360 kernel/entry/common.c:212
do_syscall_64+0x10a/0x240 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x6d/0x75
RIP: 0033:0x7f9ed907dda9
Code: Unable to access opcode bytes at 0x7f9ed907dd7f.
RSP: 002b:00007f9ed83ff178 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f9ed91abf88 RCX: 00007f9ed907dda9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f9ed91abf88
RBP: 00007f9ed91abf80 R08: 00007f9ed83ff6c0 R09: 00007f9ed83ff6c0
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f9ed91abf8c
R13: 000000000000000b R14: 00007ffdc93b1420 R15: 00007ffdc93b1508
Allocated by task 5143:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387
kasan_kmalloc include/linux/kasan.h:211 [inline]
kmalloc_trace+0x1db/0x360 mm/slub.c:3997
kmalloc include/linux/slab.h:628 [inline]
kzalloc include/linux/slab.h:749 [inline]
xpad_probe+0x3c8/0x1b90 drivers/input/joystick/xpad.c:2013
usb_probe_interface+0x5cd/0xb00 drivers/usb/core/driver.c:399
really_probe+0x2a0/0xc50 drivers/base/dd.c:658
__driver_probe_device+0x1a2/0x3e0 drivers/base/dd.c:800
driver_probe_device+0x50/0x430 drivers/base/dd.c:830
__device_attach_driver+0x2d6/0x530 drivers/base/dd.c:958
bus_for_each_drv+0x250/0x2e0 drivers/base/bus.c:457
__device_attach+0x333/0x520 drivers/base/dd.c:1030
bus_probe_device+0x189/0x260 drivers/base/bus.c:532
device_add+0x8ff/0xca0 drivers/base/core.c:3639
usb_set_configuration+0x1976/0x1fb0 drivers/usb/core/message.c:2207
usb_generic_driver_probe+0x88/0x140 drivers/usb/core/generic.c:254
usb_probe_device+0x140/0x2d0 drivers/usb/core/driver.c:294
really_probe+0x2a0/0xc50 drivers/base/dd.c:658
__driver_probe_device+0x1a2/0x3e0 drivers/base/dd.c:800
driver_probe_device+0x50/0x430 drivers/base/dd.c:830
__device_attach_driver+0x2d6/0x530 drivers/base/dd.c:958
bus_for_each_drv+0x250/0x2e0 drivers/base/bus.c:457
__device_attach+0x333/0x520 drivers/base/dd.c:1030
bus_probe_device+0x189/0x260 drivers/base/bus.c:532
device_add+0x8ff/0xca0 drivers/base/core.c:3639
usb_new_device+0x104a/0x19a0 drivers/usb/core/hub.c:2614
hub_port_connect drivers/usb/core/hub.c:5483 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5623 [inline]
port_event drivers/usb/core/hub.c:5783 [inline]
hub_event+0x2d13/0x50f0 drivers/usb/core/hub.c:5865
process_one_work kernel/workqueue.c:3254 [inline]
process_scheduled_works+0xa02/0x1770 kernel/workqueue.c:3335
worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
kthread+0x2f2/0x390 kernel/kthread.c:388
ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
Freed by task 780:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
poison_slab_object+0xa6/0xe0 mm/kasan/common.c:240
__kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2106 [inline]
slab_free mm/slub.c:4280 [inline]
kfree+0x14a/0x380 mm/slub.c:4390
xpad_disconnect+0x359/0x490 drivers/input/joystick/xpad.c:2194
usb_unbind_interface+0x1d6/0x850 drivers/usb/core/driver.c:461
device_remove drivers/base/dd.c:569 [inline]
__device_release_driver drivers/base/dd.c:1272 [inline]
device_release_driver_internal+0x505/0x7c0 drivers/base/dd.c:1295
bus_remove_device+0x34f/0x420 drivers/base/bus.c:574
device_del+0x581/0xa30 drivers/base/core.c:3828
usb_disable_device+0x3bf/0x850 drivers/usb/core/message.c:1416
usb_disconnect+0x340/0x950 drivers/usb/core/hub.c:2267
hub_port_connect drivers/usb/core/hub.c:5323 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5623 [inline]
port_event drivers/usb/core/hub.c:5783 [inline]
hub_event+0x1e62/0x50f0 drivers/usb/core/hub.c:5865
process_one_work kernel/workqueue.c:3254 [inline]
process_scheduled_works+0xa02/0x1770 kernel/workqueue.c:3335
worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
kthread+0x2f2/0x390 kernel/kthread.c:388
ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
The buggy address belongs to the object at ffff88805ee57800
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 92 bytes inside of
freed 1024-byte region [ffff88805ee57800, ffff88805ee57c00)
The buggy address belongs to the physical page:
page:ffffea00017b9400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5ee50
head:ffffea00017b9400 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff888014c41dc0 ffffea0001f27e00 dead000000000002
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5088, tgid 5088 (syz-executor.5), ts 79960183079, free_ts 22912978532
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533
prep_new_page mm/page_alloc.c:1540 [inline]
get_page_from_freelist+0x33ea/0x3580 mm/page_alloc.c:3311
__alloc_pages+0x256/0x680 mm/page_alloc.c:4569
__alloc_pages_node include/linux/gfp.h:238 [inline]
alloc_pages_node include/linux/gfp.h:261 [inline]
alloc_slab_page+0x5f/0x160 mm/slub.c:2175
allocate_slab mm/slub.c:2338 [inline]
new_slab+0x84/0x2f0 mm/slub.c:2391
___slab_alloc+0xc73/0x1260 mm/slub.c:3525
__slab_alloc mm/slub.c:3610 [inline]
__slab_alloc_node mm/slub.c:3663 [inline]
slab_alloc_node mm/slub.c:3835 [inline]
__do_kmalloc_node mm/slub.c:3965 [inline]
__kmalloc_node+0x2db/0x4e0 mm/slub.c:3973
kmalloc_node include/linux/slab.h:648 [inline]
kzalloc_node include/linux/slab.h:760 [inline]
qdisc_alloc+0x95/0x950 net/sched/sch_generic.c:941
qdisc_create_dflt+0x62/0x490 net/sched/sch_generic.c:999
attach_one_default_qdisc net/sched/sch_generic.c:1164 [inline]
netdev_for_each_tx_queue include/linux/netdevice.h:2500 [inline]
attach_default_qdiscs net/sched/sch_generic.c:1182 [inline]
dev_activate+0x3c0/0x1240 net/sched/sch_generic.c:1241
__dev_open+0x352/0x450 net/core/dev.c:1439
__dev_change_flags+0x1e2/0x6f0 net/core/dev.c:8683
dev_change_flags+0x8b/0x1a0 net/core/dev.c:8755
do_setlink+0xccd/0x41f0 net/core/rtnetlink.c:2884
__rtnl_newlink net/core/rtnetlink.c:3680 [inline]
rtnl_newlink+0x180b/0x20a0 net/core/rtnetlink.c:3727
rtnetlink_rcv_msg+0x89d/0x10d0 net/core/rtnetlink.c:6595
page last free pid 1 tgid 1 stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1140 [inline]
free_unref_page_prepare+0x968/0xa90 mm/page_alloc.c:2346
free_unref_page+0x37/0x3f0 mm/page_alloc.c:2486
free_contig_range+0x9e/0x160 mm/page_alloc.c:6547
destroy_args+0x8a/0x890 mm/debug_vm_pgtable.c:1036
debug_vm_pgtable+0x4be/0x550 mm/debug_vm_pgtable.c:1416
do_one_initcall+0x23a/0x830 init/main.c:1241
do_initcall_level+0x157/0x210 init/main.c:1303
do_initcalls+0x3f/0x80 init/main.c:1319
kernel_init_freeable+0x435/0x5d0 init/main.c:1550
kernel_init+0x1d/0x2a0 init/main.c:1439
ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
Memory state around the buggy address:
ffff88805ee57700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88805ee57780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88805ee57800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88805ee57880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88805ee57900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
0: 90 nop
1: 90 nop
2: 90 nop
3: 90 nop
4: 90 nop
5: 90 nop
6: 90 nop
7: 90 nop
8: 90 nop
9: 90 nop
a: 90 nop
b: 90 nop
c: 90 nop
d: 90 nop
e: 55 push %rbp
f: 41 57 push %r15
11: 41 56 push %r14
13: 41 55 push %r13
15: 41 54 push %r12
17: 53 push %rbx
18: 49 89 fd mov %rdi,%r13
1b: e8 ae e3 90 ff call 0xff90e3ce
20: 48 bf 00 00 00 00 00 movabs $0x10000000000000,%rdi
27: 00 10 00
* 2a: 4c 89 ee mov %r13,%rsi <-- trapping instruction
2d: e8 7c e8 90 ff call 0xff90e8ae
32: 4c 89 e8 mov %r13,%rax
35: 48 c1 e8 34 shr $0x34,%rax
39: 75 27 jne 0x62
3b: 48 rex.W
3c: bf .byte 0xbf
3d: ff (bad)
3e: ff (bad)
3f: ff .byte 0xff