==================================================================
BUG: KASAN: slab-out-of-bounds in mcp2221_raw_event+0x1070/0x10a0 drivers/hid/hid-mcp2221.c:948
Read of size 1 at addr ffff88813232bfff by task kworker/1:0/21298
CPU: 1 UID: 0 PID: 21298 Comm: kworker/1:0 Not tainted syzkaller #0 PREEMPT(voluntary)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Workqueue: events legacy_dvb_usb_read_remote_control
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xcd/0x630 mm/kasan/report.c:482
kasan_report+0xe0/0x110 mm/kasan/report.c:595
mcp2221_raw_event+0x1070/0x10a0 drivers/hid/hid-mcp2221.c:948
__hid_input_report.constprop.0+0x311/0x450 drivers/hid/hid-core.c:2130
hid_irq_in+0x35e/0x870 drivers/hid/usbhid/hid-core.c:286
__usb_hcd_giveback_urb+0x38b/0x610 drivers/usb/core/hcd.c:1661
usb_hcd_giveback_urb+0x39b/0x450 drivers/usb/core/hcd.c:1745
dummy_timer+0x1809/0x3a00 drivers/usb/gadget/udc/dummy_hcd.c:1995
__run_hrtimer kernel/time/hrtimer.c:1761 [inline]
__hrtimer_run_queues+0x1ff/0xad0 kernel/time/hrtimer.c:1825
hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1842
handle_softirqs+0x208/0x8d0 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xfa/0x160 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1050
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:console_flush_all+0x9a2/0xc60 kernel/printk/printk.c:3227
Code: 00 e8 62 85 28 00 9c 5b 81 e3 00 02 00 00 31 ff 48 89 de e8 c0 a5 20 00 48 85 db 0f 85 55 01 00 00 e8 42 aa 20 00 fb 4c 89 e0 <48> c1 e8 03 42 80 3c 38 00 0f 84 11 ff ff ff 4c 89 e7 e8 77 dc 7e
RSP: 0018:ffffc9000185f868 EFLAGS: 00000293
RAX: ffffffff897db958 RBX: 0000000000000000 RCX: ffffffff815d50a0
RDX: ffff88811f430000 RSI: ffffffff815d50ae RDI: 0000000000000007
RBP: 0000000000000001 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff897db958
R13: ffffffff897db900 R14: ffffc9000185f8f8 R15: dffffc0000000000
__console_flush_and_unlock kernel/printk/printk.c:3285 [inline]
console_unlock+0xd8/0x210 kernel/printk/printk.c:3325
vprintk_emit+0x418/0x6d0 kernel/printk/printk.c:2450
_printk+0xc7/0x100 kernel/printk/printk.c:2475
legacy_dvb_usb_read_remote_control+0x40b/0x4f0 drivers/media/usb/dvb-usb/dvb-usb-remote.c:124
process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3236
process_scheduled_works kernel/workqueue.c:3319 [inline]
worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400
kthread+0x3c5/0x780 kernel/kthread.c:463
ret_from_fork+0x56d/0x700 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Allocated by task 2848:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:330 [inline]
__kasan_slab_alloc+0x6e/0x70 mm/kasan/common.c:356
kasan_slab_alloc include/linux/kasan.h:250 [inline]
slab_post_alloc_hook mm/slub.c:4191 [inline]
slab_alloc_node mm/slub.c:4240 [inline]
kmem_cache_alloc_noprof+0x14f/0x3b0 mm/slub.c:4247
alloc_empty_file+0x55/0x1e0 fs/file_table.c:237
path_openat+0xda/0x2cb0 fs/namei.c:4032
do_filp_open+0x20b/0x470 fs/namei.c:4073
do_sys_openat2+0x11b/0x1d0 fs/open.c:1435
do_sys_open fs/open.c:1450 [inline]
__do_sys_openat fs/open.c:1466 [inline]
__se_sys_openat fs/open.c:1461 [inline]
__x64_sys_openat+0x174/0x210 fs/open.c:1461
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x4d0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 22:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:243 [inline]
__kasan_slab_free+0x3e/0x50 mm/kasan/common.c:275
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2422 [inline]
slab_free_after_rcu_debug+0xc9/0x2a0 mm/slub.c:4745
rcu_do_batch kernel/rcu/tree.c:2605 [inline]
rcu_core+0x79c/0x1530 kernel/rcu/tree.c:2861
handle_softirqs+0x208/0x8d0 kernel/softirq.c:579
run_ksoftirqd kernel/softirq.c:968 [inline]
run_ksoftirqd+0x3a/0x60 kernel/softirq.c:960
smpboot_thread_fn+0x3f7/0xae0 kernel/smpboot.c:160
kthread+0x3c5/0x780 kernel/kthread.c:463
ret_from_fork+0x56d/0x700 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Last potentially related work creation:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_record_aux_stack+0x8c/0xa0 mm/kasan/generic.c:548
slab_free_hook mm/slub.c:2383 [inline]
slab_free mm/slub.c:4695 [inline]
kmem_cache_free+0x13b/0x470 mm/slub.c:4797
file_free fs/file_table.c:79 [inline]
__fput+0x68d/0xb70 fs/file_table.c:481
fput_close_sync+0x118/0x210 fs/file_table.c:573
__do_sys_close fs/open.c:1587 [inline]
__se_sys_close fs/open.c:1572 [inline]
__x64_sys_close+0x8b/0x120 fs/open.c:1572
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x4d0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff88813232bdc0
which belongs to the cache filp of size 360
The buggy address is located 215 bytes to the right of
allocated 360-byte region [ffff88813232bdc0, ffff88813232bf28)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13232a
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff888116cd3001
flags: 0x200000000000040(head|node=0|zone=2)
page_type: f5(slab)
raw: 0200000000000040 ffff8881012a13c0 ffffea00047ee100 dead000000000004
raw: 0000000000000000 0000000000120012 00000000f5000000 ffff888116cd3001
head: 0200000000000040 ffff8881012a13c0 ffffea00047ee100 dead000000000004
head: 0000000000000000 0000000000120012 00000000f5000000 ffff888116cd3001
head: 0200000000000001 ffffea0004c8ca81 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 17058, tgid 17058 (kworker/u8:1), ts 1556641085722, free_ts 1520402521179
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1c0/0x230 mm/page_alloc.c:1851
prep_new_page mm/page_alloc.c:1859 [inline]
get_page_from_freelist+0xf98/0x2ce0 mm/page_alloc.c:3858
__alloc_frozen_pages_noprof+0x259/0x21e0 mm/page_alloc.c:5148
alloc_pages_mpol+0xe4/0x410 mm/mempolicy.c:2416
alloc_slab_page mm/slub.c:2492 [inline]
allocate_slab mm/slub.c:2660 [inline]
new_slab+0x247/0x330 mm/slub.c:2714
___slab_alloc+0xc55/0x1620 mm/slub.c:3901
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3992
__slab_alloc_node mm/slub.c:4067 [inline]
slab_alloc_node mm/slub.c:4228 [inline]
kmem_cache_alloc_noprof+0x1f9/0x3b0 mm/slub.c:4247
alloc_empty_file+0x55/0x1e0 fs/file_table.c:237
path_openat+0xda/0x2cb0 fs/namei.c:4032
do_filp_open+0x20b/0x470 fs/namei.c:4073
do_open_execat+0xf9/0x400 fs/exec.c:783
alloc_bprm+0x2d/0x6a0 fs/exec.c:1410
kernel_execve+0xb0/0x3b0 fs/exec.c:1885
call_usermodehelper_exec_async+0x255/0x4c0 kernel/umh.c:109
ret_from_fork+0x56d/0x700 arch/x86/kernel/process.c:148
page last free pid 2965 tgid 2965 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1395 [inline]
__free_frozen_pages+0x78a/0xfd0 mm/page_alloc.c:2895
vfree+0x1fd/0xb50 mm/vmalloc.c:3434
kcov_put kernel/kcov.c:439 [inline]
kcov_put kernel/kcov.c:435 [inline]
kcov_close+0x34/0x60 kernel/kcov.c:535
__fput+0x3ff/0xb70 fs/file_table.c:468
task_work_run+0x14d/0x240 kernel/task_work.c:227
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0x86f/0x2bf0 kernel/exit.c:961
do_group_exit+0xd3/0x2a0 kernel/exit.c:1102
get_signal+0x2673/0x26d0 kernel/signal.c:3034
arch_do_signal_or_restart+0x8f/0x7d0 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop+0x7c/0xe0 kernel/entry/common.c:40
exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
do_syscall_64+0x40f/0x4d0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff88813232be80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88813232bf00: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc
>ffff88813232bf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88813232c000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88813232c080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess), 1 bytes skipped:
0: e8 62 85 28 00 call 0x288567
5: 9c pushf
6: 5b pop %rbx
7: 81 e3 00 02 00 00 and $0x200,%ebx
d: 31 ff xor %edi,%edi
f: 48 89 de mov %rbx,%rsi
12: e8 c0 a5 20 00 call 0x20a5d7
17: 48 85 db test %rbx,%rbx
1a: 0f 85 55 01 00 00 jne 0x175
20: e8 42 aa 20 00 call 0x20aa67
25: fb sti
26: 4c 89 e0 mov %r12,%rax
* 29: 48 c1 e8 03 shr $0x3,%rax <-- trapping instruction
2d: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1)
32: 0f 84 11 ff ff ff je 0xffffff49
38: 4c 89 e7 mov %r12,%rdi
3b: e8 .byte 0xe8
3c: 77 dc ja 0x1a
3e: 7e .byte 0x7e