==================================================================
BUG: KASAN: slab-use-after-free in find_endpoint drivers/usb/gadget/udc/dummy_hcd.c:1618 [inline]
BUG: KASAN: slab-use-after-free in dummy_timer+0xcf6/0x4cf0 drivers/usb/gadget/udc/dummy_hcd.c:1890
Read of size 1 at addr ffff88805602acda by task kworker/1:3/5686
CPU: 1 UID: 0 PID: 5686 Comm: kworker/1:3 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
find_endpoint drivers/usb/gadget/udc/dummy_hcd.c:1618 [inline]
dummy_timer+0xcf6/0x4cf0 drivers/usb/gadget/udc/dummy_hcd.c:1890
__run_hrtimer kernel/time/hrtimer.c:2068 [inline]
__hrtimer_run_queues+0x3bc/0xa10 kernel/time/hrtimer.c:2125
hrtimer_run_softirq+0x1e3/0x2e0 kernel/time/hrtimer.c:2142
handle_softirqs+0x226/0x860 kernel/softirq.c:645
__do_softirq kernel/softirq.c:679 [inline]
invoke_softirq kernel/softirq.c:519 [inline]
__irq_exit_rcu+0xcb/0x220 kernel/softirq.c:767
irq_exit_rcu+0x9/0x30 kernel/softirq.c:784
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:26 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:109 [inline]
RIP: 0010:arch_local_irq_save arch/x86/include/asm/irqflags.h:127 [inline]
RIP: 0010:lock_acquire+0xb7/0x350 kernel/locking/lockdep.c:5904
Code: b7 53 16 12 85 c0 0f 85 d5 00 00 00 65 48 8b 2d f7 0d 16 12 83 bd a4 0b 00 00 00 0f 85 c0 00 00 00 48 89 5c 24 08 4c 89 fb 9c <41> 5f fa 48 c7 c7 5a 13 5a 8e e8 8a a0 4a 0a 65 ff 05 7b 53 16 12
RSP: 0018:ffffc9000445e2a0 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 8000000000000001
RDX: 0000000000000000 RSI: ffffffff8178112c RDI: 1ffffffff1deb94c
RBP: ffff888023743e80 R08: 0000000000000000 R09: 0000000000000000
R10: ffffc9000445e438 R11: ffffffff81b29dd0 R12: ffffffff8ef5ca60
R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000000
rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
rcu_read_lock include/linux/rcupdate.h:849 [inline]
class_rcu_constructor include/linux/rcupdate.h:1216 [inline]
unwind_next_frame+0xac/0x2550 arch/x86/kernel/unwind_orc.c:495
arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5414 [inline]
__kmalloc_node_track_caller_noprof+0x4b4/0x720 mm/slub.c:5545
__kmemdup_nul mm/util.c:64 [inline]
kstrdup+0x42/0x100 mm/util.c:84
__kernfs_new_node+0xa9/0x980 fs/kernfs/dir.c:661
kernfs_new_node fs/kernfs/dir.c:751 [inline]
kernfs_create_dir_ns+0xfe/0x230 fs/kernfs/dir.c:1120
sysfs_create_dir_ns+0x12f/0x2a0 fs/sysfs/dir.c:59
create_dir lib/kobject.c:73 [inline]
kobject_add_internal+0x622/0xcd0 lib/kobject.c:240
kobject_add_varg lib/kobject.c:374 [inline]
kobject_add+0x163/0x240 lib/kobject.c:426
device_add+0x3fa/0xb80 drivers/base/core.c:3699
usb_serial_probe+0x26e0/0x2e50 drivers/usb/serial/usb-serial.c:1147
usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x254/0xae0 drivers/base/dd.c:706
__driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
__device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c4/0x450 drivers/base/dd.c:1098
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x12a/0x220 drivers/base/bus.c:620
device_add+0x7d7/0xb80 drivers/base/core.c:3776
usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268
usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x254/0xae0 drivers/base/dd.c:706
__driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
__device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c4/0x450 drivers/base/dd.c:1098
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x12a/0x220 drivers/base/bus.c:620
device_add+0x7d7/0xb80 drivers/base/core.c:3776
usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2708
hub_port_connect drivers/usb/core/hub.c:5580 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5720 [inline]
port_event drivers/usb/core/hub.c:5884 [inline]
hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5966
process_one_work kernel/workqueue.c:3396 [inline]
process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
kthread+0x38b/0x480 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Allocated by task 14039:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5414 [inline]
__kmalloc_noprof+0x36b/0x720 mm/slub.c:5439
_kmalloc_noprof include/linux/slab.h:995 [inline]
io_cache_alloc_new+0x40/0x100 io_uring/alloc_cache.c:40
io_cache_alloc io_uring/alloc_cache.h:61 [inline]
io_uring_alloc_async_data+0x1b6/0x2e0 io_uring/io_uring.h:356
io_msg_alloc_async io_uring/net.c:191 [inline]
io_send_zc_prep+0x3f7/0x9e0 io_uring/net.c:1398
io_init_req io_uring/io_uring.c:1833 [inline]
io_submit_sqe io_uring/io_uring.c:1880 [inline]
io_submit_sqes+0xbde/0x2310 io_uring/io_uring.c:2048
__do_sys_io_uring_enter io_uring/io_uring.c:2637 [inline]
__se_sys_io_uring_enter+0x35b/0x1bb0 io_uring/io_uring.c:2586
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 14039:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2748 [inline]
slab_free mm/slub.c:6499 [inline]
kfree+0x1c5/0x650 mm/slub.c:6792
io_clean_op+0x298/0x330 io_uring/io_uring.c:328
io_free_batch_list io_uring/io_uring.c:1116 [inline]
__io_submit_flush_completions+0xea3/0x10d0 io_uring/io_uring.c:1154
io_submit_flush_completions io_uring/io_uring.h:253 [inline]
io_submit_state_end io_uring/io_uring.c:1939 [inline]
io_submit_sqes+0x1cec/0x2310 io_uring/io_uring.c:2063
__do_sys_io_uring_enter io_uring/io_uring.c:2637 [inline]
__se_sys_io_uring_enter+0x35b/0x1bb0 io_uring/io_uring.c:2586
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff88805602ac00
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 218 bytes inside of
freed 512-byte region [ffff88805602ac00, ffff88805602ae00)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88805602bc00 pfn:0x56028
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000240 ffff88813ff15c80 ffffea00016c0310 ffffea0001d2ed10
raw: ffff88805602bc00 0000000000100008 00000000f5000000 0000000000000000
head: 00fff00000000240 ffff88813ff15c80 ffffea00016c0310 ffffea0001d2ed10
head: ffff88805602bc00 0000000000100008 00000000f5000000 0000000000000000
head: 00fff00000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 7198, tgid 7197 (syz.3.476), ts 171879784582
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1871
prep_new_page mm/page_alloc.c:1879 [inline]
get_page_from_freelist+0x2209/0x2280 mm/page_alloc.c:3943
__alloc_frozen_pages_noprof+0x217/0x5a0 mm/page_alloc.c:5436
alloc_slab_page mm/slub.c:3347 [inline]
allocate_slab+0x7d/0x620 mm/slub.c:3462
new_slab mm/slub.c:3513 [inline]
refill_objects+0x2d5/0x350 mm/slub.c:7410
refill_sheaf mm/slub.c:2885 [inline]
__pcs_replace_empty_main+0x2c8/0x6c0 mm/slub.c:4774
alloc_from_pcs mm/slub.c:4850 [inline]
slab_alloc_node mm/slub.c:4984 [inline]
__kmalloc_cache_noprof+0x39b/0x600 mm/slub.c:5559
_kmalloc_noprof include/linux/slab.h:991 [inline]
snd_mixer_oss_build_test+0x7a/0x380 sound/core/oss/mixer_oss.c:893
snd_mixer_oss_build_test_all sound/core/oss/mixer_oss.c:973 [inline]
snd_mixer_oss_build_input+0x527/0x1370 sound/core/oss/mixer_oss.c:1017
snd_mixer_oss_build sound/core/oss/mixer_oss.c:1276 [inline]
snd_mixer_oss_notify_handler+0x93f/0x1050 sound/core/oss/mixer_oss.c:1344
snd_card_register+0x589/0x720 sound/core/init.c:935
f_midi2_create_card drivers/usb/gadget/function/f_midi2.c:1616 [inline]
f_midi2_bind+0x1562/0x2c40 drivers/usb/gadget/function/f_midi2.c:1948
usb_add_function+0x2e1/0x9f0 drivers/usb/gadget/composite.c:333
configfs_composite_bind+0xde0/0x1410 drivers/usb/gadget/configfs.c:1802
gadget_bind_driver+0x2ca/0x9e0 drivers/usb/gadget/udc/core.c:1662
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x254/0xae0 drivers/base/dd.c:706
page last free pid 7198 tgid 7197 ts 171831681546 stack trace:
reset_page_owner include/linux/page_owner.h:26 [inline]
__free_pages_prepare mm/page_alloc.c:1418 [inline]
__free_frozen_pages+0xc93/0xd90 mm/page_alloc.c:2962
__slab_free+0x274/0x2c0 mm/slub.c:5815
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4683 [inline]
slab_alloc_node mm/slub.c:4996 [inline]
__do_kmalloc_node mm/slub.c:5413 [inline]
__kmalloc_noprof+0x307/0x720 mm/slub.c:5439
_kmalloc_noprof include/linux/slab.h:995 [inline]
_kzalloc_noprof include/linux/slab.h:1312 [inline]
snd_seq_device_new+0x8f/0x330 sound/core/seq_device.c:240
snd_ump_dev_register+0x6a/0x140 sound/core/ump.c:224
snd_rawmidi_dev_register+0x369/0xec0 sound/core/rawmidi.c:1984
__snd_device_register sound/core/device.c:149 [inline]
snd_device_register_all+0xd3/0x1b0 sound/core/device.c:197
snd_card_register+0x1d3/0x720 sound/core/init.c:905
f_midi2_create_card drivers/usb/gadget/function/f_midi2.c:1616 [inline]
f_midi2_bind+0x1562/0x2c40 drivers/usb/gadget/function/f_midi2.c:1948
usb_add_function+0x2e1/0x9f0 drivers/usb/gadget/composite.c:333
configfs_composite_bind+0xde0/0x1410 drivers/usb/gadget/configfs.c:1802
gadget_bind_driver+0x2ca/0x9e0 drivers/usb/gadget/udc/core.c:1662
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x254/0xae0 drivers/base/dd.c:706
Memory state around the buggy address:
ffff88805602ab80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88805602ac00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88805602ac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88805602ad00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88805602ad80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess), 3 bytes skipped:
0: 12 85 c0 0f 85 d5 adc -0x2a7af040(%rbp),%al
6: 00 00 add %al,(%rax)
8: 00 65 48 add %ah,0x48(%rbp)
b: 8b 2d f7 0d 16 12 mov 0x12160df7(%rip),%ebp # 0x12160e08
11: 83 bd a4 0b 00 00 00 cmpl $0x0,0xba4(%rbp)
18: 0f 85 c0 00 00 00 jne 0xde
1e: 48 89 5c 24 08 mov %rbx,0x8(%rsp)
23: 4c 89 fb mov %r15,%rbx
26: 9c pushf
* 27: 41 5f pop %r15 <-- trapping instruction
29: fa cli
2a: 48 c7 c7 5a 13 5a 8e mov $0xffffffff8e5a135a,%rdi
31: e8 8a a0 4a 0a call 0xa4aa0c0
36: 65 ff 05 7b 53 16 12 incl %gs:0x1216537b(%rip) # 0x121653b8