================================================================== BUG: KASAN: slab-out-of-bounds in mcp2221_raw_event+0x1070/0x10a0 drivers/hid/hid-mcp2221.c:948 Read of size 1 at addr ffff888060a13fff by task kauditd/30 CPU: 1 UID: 0 PID: 30 Comm: kauditd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcd/0x630 mm/kasan/report.c:482 kasan_report+0xe0/0x110 mm/kasan/report.c:595 mcp2221_raw_event+0x1070/0x10a0 drivers/hid/hid-mcp2221.c:948 __hid_input_report.constprop.0+0x314/0x450 drivers/hid/hid-core.c:2139 hid_irq_in+0x35e/0x870 drivers/hid/usbhid/hid-core.c:286 __usb_hcd_giveback_urb+0x38b/0x610 drivers/usb/core/hcd.c:1661 usb_hcd_giveback_urb+0x39b/0x450 drivers/usb/core/hcd.c:1745 dummy_timer+0x1809/0x3a00 drivers/usb/gadget/udc/dummy_hcd.c:1995 __run_hrtimer kernel/time/hrtimer.c:1777 [inline] __hrtimer_run_queues+0x202/0xad0 kernel/time/hrtimer.c:1841 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1858 handle_softirqs+0x219/0x8e0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x109/0x170 kernel/softirq.c:723 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1052 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:finish_task_switch.isra.0+0x22a/0xc10 kernel/sched/core.c:5193 Code: fb 09 00 00 44 8b 05 49 31 f8 0e 45 85 c0 0f 85 be 01 00 00 4c 89 e7 e8 a4 f6 ff ff e8 8f d3 3a 00 fb 65 48 8b 1d ee 99 17 12 <48> 8d bb 58 16 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 RSP: 0018:ffffc90000a67b40 EFLAGS: 00000202 RAX: 00000000000b20d5 RBX: ffff88801ea84900 RCX: ffffffff81c4e8af RDX: 0000000000000000 RSI: ffffffff8da2c59c RDI: ffffffff8bf073c0 RBP: ffffc90000a67b88 R08: 0000000000000001 R09: 0000000000000001 R10: ffffffff908216d7 R11: 0000000000000001 R12: ffff8880b853a380 R13: ffff888060c3c900 R14: ffff8880b843a380 R15: ffff8880b853b1b0 context_switch kernel/sched/core.c:5328 [inline] __schedule+0x1198/0x5de0 kernel/sched/core.c:6929 __schedule_loop kernel/sched/core.c:7011 [inline] schedule+0xe7/0x3a0 kernel/sched/core.c:7026 kauditd_thread+0x4d9/0xa70 kernel/audit.c:948 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 19080: kasan_save_stack+0x33/0x60 mm/kasan/common.c:56 kasan_save_track+0x14/0x30 mm/kasan/common.c:77 unpoison_slab_object mm/kasan/common.c:342 [inline] __kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:368 kasan_slab_alloc include/linux/kasan.h:252 [inline] slab_post_alloc_hook mm/slub.c:4978 [inline] slab_alloc_node mm/slub.c:5288 [inline] kmem_cache_alloc_noprof+0x250/0x6e0 mm/slub.c:5295 mt_alloc_one lib/maple_tree.c:174 [inline] mas_alloc_nodes lib/maple_tree.c:1110 [inline] mas_preallocate+0xe6a/0x11f0 lib/maple_tree.c:5194 vma_iter_prealloc mm/vma.h:442 [inline] __split_vma+0x34a/0x1070 mm/vma.c:528 split_vma mm/vma.c:598 [inline] vma_modify+0x16dc/0x2030 mm/vma.c:1623 vma_modify_flags+0x212/0x2d0 mm/vma.c:1649 mprotect_fixup+0x1df/0xb40 mm/mprotect.c:816 do_mprotect_pkey+0x9bc/0xd40 mm/mprotect.c:990 __do_sys_mprotect mm/mprotect.c:1011 [inline] __se_sys_mprotect mm/mprotect.c:1008 [inline] __x64_sys_mprotect+0x78/0xc0 mm/mprotect.c:1008 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff888060a13e00 which belongs to the cache maple_node of size 256 The buggy address is located 255 bytes to the right of allocated 256-byte region [ffff888060a13e00, ffff888060a13f00) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x60a12 head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88813ffb0c80 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88813ffb0c80 dead000000000122 0000000000000000 head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 00fff00000000001 ffffea0001828481 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 19044, tgid 19044 (modprobe), ts 1103808135150, free_ts 977742446474 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1af/0x220 mm/page_alloc.c:1845 prep_new_page mm/page_alloc.c:1853 [inline] get_page_from_freelist+0x10a3/0x3a30 mm/page_alloc.c:3879 __alloc_frozen_pages_noprof+0x25f/0x2470 mm/page_alloc.c:5178 alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2416 alloc_slab_page mm/slub.c:3059 [inline] allocate_slab mm/slub.c:3232 [inline] new_slab+0x24a/0x360 mm/slub.c:3286 ___slab_alloc+0xd79/0x1a50 mm/slub.c:4655 __kmem_cache_alloc_bulk+0x225/0x770 mm/slub.c:7406 refill_sheaf mm/slub.c:2637 [inline] kmem_cache_prefill_sheaf+0x1c3/0x430 mm/slub.c:5419 mt_get_sheaf lib/maple_tree.c:189 [inline] mas_alloc_nodes lib/maple_tree.c:1140 [inline] mas_preallocate+0xb00/0x11f0 lib/maple_tree.c:5194 vma_iter_prealloc mm/vma.h:442 [inline] __mmap_new_vma mm/vma.c:2470 [inline] __mmap_region+0x117f/0x27a0 mm/vma.c:2670 mmap_region+0x1ab/0x3f0 mm/vma.c:2740 do_mmap+0xa3e/0x1210 mm/mmap.c:558 vm_mmap_pgoff+0x29e/0x470 mm/util.c:581 ksys_mmap_pgoff+0x7d/0x5c0 mm/mmap.c:604 __do_sys_mmap arch/x86/kernel/sys_x86_64.c:89 [inline] __se_sys_mmap arch/x86/kernel/sys_x86_64.c:82 [inline] __x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:82 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94 page last free pid 0 tgid 0 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1394 [inline] __free_frozen_pages+0x7df/0x1160 mm/page_alloc.c:2901 pagetable_free include/linux/mm.h:3004 [inline] pagetable_dtor_free include/linux/mm.h:3107 [inline] __tlb_remove_table include/asm-generic/tlb.h:220 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0x121/0x320 mm/mmu_gather.c:290 rcu_do_batch kernel/rcu/tree.c:2605 [inline] rcu_core+0x79c/0x1530 kernel/rcu/tree.c:2861 handle_softirqs+0x219/0x8e0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x109/0x170 kernel/softirq.c:723 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1052 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 Memory state around the buggy address: ffff888060a13e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888060a13f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888060a13f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff888060a14000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888060a14080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== ---------------- Code disassembly (best guess), 2 bytes skipped: 0: 00 00 add %al,(%rax) 2: 44 8b 05 49 31 f8 0e mov 0xef83149(%rip),%r8d # 0xef83152 9: 45 85 c0 test %r8d,%r8d c: 0f 85 be 01 00 00 jne 0x1d0 12: 4c 89 e7 mov %r12,%rdi 15: e8 a4 f6 ff ff call 0xfffff6be 1a: e8 8f d3 3a 00 call 0x3ad3ae 1f: fb sti 20: 65 48 8b 1d ee 99 17 mov %gs:0x121799ee(%rip),%rbx # 0x12179a16 27: 12 * 28: 48 8d bb 58 16 00 00 lea 0x1658(%rbx),%rdi <-- trapping instruction 2f: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 36: fc ff df 39: 48 89 fa mov %rdi,%rdx 3c: 48 rex.W 3d: c1 .byte 0xc1