==================================================================
BUG: KASAN: slab-out-of-bounds in mcp2221_raw_event+0x1062/0x1240 drivers/hid/hid-mcp2221.c:858
Read of size 1 at addr ffff888069ed3fff by task kworker/0:2/43
CPU: 0 PID: 43 Comm: kworker/0:2 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:364 [inline]
print_report+0xa8/0x210 mm/kasan/report.c:468
kasan_report+0x117/0x150 mm/kasan/report.c:581
mcp2221_raw_event+0x1062/0x1240 drivers/hid/hid-mcp2221.c:858
hid_input_report+0x400/0x510 drivers/hid/hid-core.c:2103
hid_irq_in+0x479/0x6d0 drivers/hid/usbhid/hid-core.c:284
__usb_hcd_giveback_urb+0x35f/0x520 drivers/usb/core/hcd.c:1650
dummy_timer+0x8de/0x3320 drivers/usb/gadget/udc/dummy_hcd.c:2003
__run_hrtimer kernel/time/hrtimer.c:1754 [inline]
__hrtimer_run_queues+0x520/0xc40 kernel/time/hrtimer.c:1818
hrtimer_run_softirq+0x187/0x2b0 kernel/time/hrtimer.c:1835
handle_softirqs+0x280/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:call_rcu+0x6da/0x950 kernel/rcu/tree.c:2837
Code: f7 84 24 a0 00 00 00 00 02 00 00 43 c6 44 25 04 f8 75 4f f7 44 24 58 00 02 00 00 74 01 fb 48 c7 84 24 80 00 00 00 0e 36 e0 45 <4b> c7 44 25 00 00 00 00 00 43 c7 44 25 08 00 00 00 00 65 48 8b 04
RSP: 0018:ffffc90000b467a0 EFLAGS: 00000206
RAX: 086dabbe11e7a300 RBX: ffff88805fd311a0 RCX: 086dabbe11e7a300
RDX: dffffc0000000000 RSI: ffffffff8acacbe0 RDI: ffffffff8b1c9c20
RBP: ffffc90000b468d0 R08: ffffffff911cd50f R09: 1ffffffff2239aa1
R10: dffffc0000000000 R11: fffffbfff2239aa2 R12: dffffc0000000000
R13: 1ffff92000168d04 R14: 1ffff110171c7a0d R15: 0000000000000015
kernfs_put+0x1d3/0x360 fs/kernfs/dir.c:578
kernfs_remove_by_name_ns+0xe4/0x150 fs/kernfs/dir.c:1696
kernfs_remove_by_name include/linux/kernfs.h:624 [inline]
sysfs_unmerge_group+0xd4/0x130 fs/sysfs/group.c:372
i2c_register_adapter+0x540/0xfb0 drivers/i2c/i2c-core-base.c:1564
devm_i2c_add_adapter+0x1b/0x80 drivers/i2c/i2c-core-base.c:1842
mcp2221_probe+0x300/0x760 drivers/hid/hid-mcp2221.c:1198
__hid_device_probe drivers/hid/hid-core.c:2652 [inline]
hid_device_probe+0x293/0x5b0 drivers/hid/hid-core.c:2689
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x25b/0xb20 drivers/base/dd.c:718
__driver_probe_device+0x1ef/0x390 drivers/base/dd.c:880
driver_probe_device+0x4f/0x420 drivers/base/dd.c:910
__device_attach_driver+0x2ca/0x510 drivers/base/dd.c:1038
bus_for_each_drv+0x252/0x2e0 drivers/base/bus.c:459
__device_attach+0x2c2/0x420 drivers/base/dd.c:1110
bus_probe_device+0x180/0x260 drivers/base/bus.c:573
device_add+0x88e/0xc50 drivers/base/core.c:3700
hid_add_device+0x38d/0x530 drivers/hid/hid-core.c:2835
usbhid_probe+0xe02/0x1220 drivers/hid/usbhid/hid-core.c:1447
usb_probe_interface+0x5c9/0xb20 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x25b/0xb20 drivers/base/dd.c:718
__driver_probe_device+0x1ef/0x390 drivers/base/dd.c:880
driver_probe_device+0x4f/0x420 drivers/base/dd.c:910
__device_attach_driver+0x2ca/0x510 drivers/base/dd.c:1038
bus_for_each_drv+0x252/0x2e0 drivers/base/bus.c:459
__device_attach+0x2c2/0x420 drivers/base/dd.c:1110
bus_probe_device+0x180/0x260 drivers/base/bus.c:573
device_add+0x88e/0xc50 drivers/base/core.c:3700
usb_set_configuration+0x1a79/0x20c0 drivers/usb/core/message.c:2265
usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:238
usb_probe_device+0x13d/0x270 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x25b/0xb20 drivers/base/dd.c:718
__driver_probe_device+0x1ef/0x390 drivers/base/dd.c:880
driver_probe_device+0x4f/0x420 drivers/base/dd.c:910
__device_attach_driver+0x2ca/0x510 drivers/base/dd.c:1038
bus_for_each_drv+0x252/0x2e0 drivers/base/bus.c:459
__device_attach+0x2c2/0x420 drivers/base/dd.c:1110
bus_probe_device+0x180/0x260 drivers/base/bus.c:573
device_add+0x88e/0xc50 drivers/base/core.c:3700
usb_new_device+0xa3c/0x1660 drivers/usb/core/hub.c:2660
hub_port_connect drivers/usb/core/hub.c:5529 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5669 [inline]
port_event drivers/usb/core/hub.c:5833 [inline]
hub_event+0x29bf/0x49f0 drivers/usb/core/hub.c:5915
process_one_work kernel/workqueue.c:2653 [inline]
process_scheduled_works+0xa5d/0x15d0 kernel/workqueue.c:2730
worker_thread+0xa55/0xfc0 kernel/workqueue.c:2811
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
The buggy address belongs to the physical page:
page:ffffea0001a7b400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x69ed0
head:ffffea0001a7b400 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000040 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x140dc0(GFP_USER|__GFP_COMP|__GFP_ZERO), pid 3480, tgid 3480 (kworker/u4:9), ts 146902404093, free_ts 146886065905
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x1c1/0x200 mm/page_alloc.c:1581
prep_new_page mm/page_alloc.c:1588 [inline]
get_page_from_freelist+0x1951/0x19e0 mm/page_alloc.c:3220
__alloc_pages+0x1f0/0x460 mm/page_alloc.c:4500
__alloc_pages_node include/linux/gfp.h:237 [inline]
alloc_pages_node include/linux/gfp.h:260 [inline]
__kmalloc_large_node+0x8c/0x1e0 mm/slab_common.c:1148
kmalloc_large+0x1b/0x110 mm/slab_common.c:1165
rate_control_alloc_sta net/mac80211/rate.h:43 [inline]
sta_prepare_rate_control net/mac80211/sta_info.c:477 [inline]
__sta_info_alloc+0x1011/0x2740 net/mac80211/sta_info.c:623
ieee80211_ibss_add_sta+0x5f9/0x8d0 net/mac80211/ibss.c:635
ieee80211_update_sta_info net/mac80211/ibss.c:1031 [inline]
ieee80211_rx_bss_info net/mac80211/ibss.c:1122 [inline]
ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1613 [inline]
ieee80211_ibss_rx_queued_mgmt+0x14f4/0x2c80 net/mac80211/ibss.c:1642
ieee80211_iface_process_skb net/mac80211/iface.c:1655 [inline]
ieee80211_iface_work+0x717/0xc70 net/mac80211/iface.c:1709
cfg80211_wiphy_work+0x225/0x260 net/wireless/core.c:437
process_one_work kernel/workqueue.c:2653 [inline]
process_scheduled_works+0xa5d/0x15d0 kernel/workqueue.c:2730
worker_thread+0xa55/0xfc0 kernel/workqueue.c:2811
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1181 [inline]
free_unref_page_prepare+0x7b2/0x8c0 mm/page_alloc.c:2365
free_unref_page+0x32/0x2e0 mm/page_alloc.c:2458
__slab_free+0x35a/0x400 mm/slub.c:3736
qlink_free mm/kasan/quarantine.c:166 [inline]
qlist_free_all+0x75/0xd0 mm/kasan/quarantine.c:185
kasan_quarantine_reduce+0x143/0x160 mm/kasan/quarantine.c:292
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:306
kasan_slab_alloc include/linux/kasan.h:188 [inline]
slab_post_alloc_hook+0x6e/0x4b0 mm/slab.h:767
slab_alloc_node mm/slub.c:3495 [inline]
__kmem_cache_alloc_node+0x13a/0x250 mm/slub.c:3534
kmalloc_trace+0x2a/0xe0 mm/slab_common.c:1098
kmalloc include/linux/slab.h:600 [inline]
kzalloc include/linux/slab.h:721 [inline]
ref_tracker_alloc+0x162/0x4c0 lib/ref_tracker.c:203
__netdev_tracker_alloc include/linux/netdevice.h:4110 [inline]
netdev_tracker_alloc include/linux/netdevice.h:4122 [inline]
netdev_get_by_index+0x79/0xa0 net/core/dev.c:911
fib6_nh_init+0x203/0x1ff0 net/ipv6/route.c:3584
ip6_route_info_create+0x94d/0x1240 net/ipv6/route.c:3854
ip6_route_add+0x28/0x160 net/ipv6/route.c:3898
addrconf_add_mroute net/ipv6/addrconf.c:2522 [inline]
addrconf_add_dev+0x29c/0x3b0 net/ipv6/addrconf.c:2540
addrconf_dev_config net/ipv6/addrconf.c:3469 [inline]
addrconf_init_auto_addrs+0x67e/0xb20 net/ipv6/addrconf.c:3557
Memory state around the buggy address:
ffff888069ed3e80: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
ffff888069ed3f00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
>ffff888069ed3f80: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
^
ffff888069ed4000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888069ed4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess):
0: f7 84 24 a0 00 00 00 testl $0x200,0xa0(%rsp)
7: 00 02 00 00
b: 43 c6 44 25 04 f8 movb $0xf8,0x4(%r13,%r12,1)
11: 75 4f jne 0x62
13: f7 44 24 58 00 02 00 testl $0x200,0x58(%rsp)
1a: 00
1b: 74 01 je 0x1e
1d: fb sti
1e: 48 c7 84 24 80 00 00 movq $0x45e0360e,0x80(%rsp)
25: 00 0e 36 e0 45
* 2a: 4b c7 44 25 00 00 00 movq $0x0,0x0(%r13,%r12,1) <-- trapping instruction
31: 00 00
33: 43 c7 44 25 08 00 00 movl $0x0,0x8(%r13,%r12,1)
3a: 00 00
3c: 65 gs
3d: 48 rex.W
3e: 8b .byte 0x8b
3f: 04 .byte 0x4