==================================================================
BUG: KASAN: use-after-free in mcp2221_raw_event+0x1070/0x10a0 drivers/hid/hid-mcp2221.c:948
Read of size 1 at addr ffff88812bc67fff by task rcu_preempt/15

CPU: 0 UID: 0 PID: 15 Comm: rcu_preempt Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xcd/0x630 mm/kasan/report.c:482
 kasan_report+0xe0/0x110 mm/kasan/report.c:595
 mcp2221_raw_event+0x1070/0x10a0 drivers/hid/hid-mcp2221.c:948
 __hid_input_report.constprop.0+0x314/0x450 drivers/hid/hid-core.c:2139
 hid_irq_in+0x35e/0x870 drivers/hid/usbhid/hid-core.c:286
 __usb_hcd_giveback_urb+0x38b/0x610 drivers/usb/core/hcd.c:1661
 usb_hcd_giveback_urb+0x39b/0x450 drivers/usb/core/hcd.c:1745
 dummy_timer+0x1809/0x3a00 drivers/usb/gadget/udc/dummy_hcd.c:1995
 __run_hrtimer kernel/time/hrtimer.c:1777 [inline]
 __hrtimer_run_queues+0x202/0xad0 kernel/time/hrtimer.c:1841
 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1858
 handle_softirqs+0x208/0x8d0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xfa/0x160 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
 sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1052
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:finish_task_switch.isra.0+0x1e9/0x9e0 kernel/sched/core.c:5193
Code: 0f 85 5f 07 00 00 8b 0d 79 c4 51 09 85 c9 0f 85 b9 02 00 00 48 89 df e8 c5 dc f7 05 e8 40 10 37 00 fb 65 48 8b 1d 1f cc 48 0b <48> 8d bb 50 15 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1
RSP: 0018:ffffc900000ff9f0 EFLAGS: 00000202
RAX: 000000000050245d RBX: ffff8881016fba00 RCX: ffffffff8186432f
RDX: 0000000000000000 RSI: ffffffff88c88a08 RDI: ffffffff878979c0
RBP: ffffc900000ffa30 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff8aa0ebd7 R11: 0000000000000001 R12: ffff88812e408000
R13: 0000000000000000 R14: ffff8881f5838918 R15: ffff8881f5839418
 context_switch kernel/sched/core.c:5328 [inline]
 __schedule+0x1304/0x3b80 kernel/sched/core.c:6929
 __schedule_loop kernel/sched/core.c:7011 [inline]
 schedule+0xe7/0x3a0 kernel/sched/core.c:7026
 schedule_timeout+0x123/0x290 kernel/time/sleep_timeout.c:99
 rcu_gp_fqs_loop+0x1ea/0xaf0 kernel/rcu/tree.c:2083
 rcu_gp_kthread+0x26d/0x380 kernel/rcu/tree.c:2285
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x56d/0x700 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12bc67
flags: 0x200000000000000(node=0|zone=2)
raw: 0200000000000000 dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xcc0(GFP_KERNEL), pid 3651, tgid 3651 (syz-executor), ts 3551219706133, free_ts 3612501871840
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1c0/0x230 mm/page_alloc.c:1850
 prep_new_page mm/page_alloc.c:1858 [inline]
 get_page_from_freelist+0x1003/0x2dc0 mm/page_alloc.c:3884
 __alloc_frozen_pages_noprof+0x259/0x21f0 mm/page_alloc.c:5183
 __alloc_pages_noprof mm/page_alloc.c:5217 [inline]
 alloc_pages_bulk_noprof+0x697/0x1160 mm/page_alloc.c:5137
 ___alloc_pages_bulk mm/kasan/shadow.c:345 [inline]
 __kasan_populate_vmalloc mm/kasan/shadow.c:370 [inline]
 kasan_populate_vmalloc+0x112/0x2d0 mm/kasan/shadow.c:435
 alloc_vmap_area+0x960/0x29e0 mm/vmalloc.c:2098
 __get_vm_area_node+0x1ca/0x330 mm/vmalloc.c:3193
 __vmalloc_node_range_noprof+0x271/0x1480 mm/vmalloc.c:3857
 vmalloc_user_noprof+0x9e/0xe0 mm/vmalloc.c:4050
 kcov_ioctl+0x4c/0x730 kernel/kcov.c:716
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl fs/ioctl.c:583 [inline]
 __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4d0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 32668 tgid 32668 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1394 [inline]
 __free_frozen_pages+0x78f/0x1000 mm/page_alloc.c:2906
 kasan_depopulate_vmalloc_pte+0x5b/0x80 mm/kasan/shadow.c:495
 apply_to_pte_range mm/memory.c:3142 [inline]
 apply_to_pmd_range mm/memory.c:3186 [inline]
 apply_to_pud_range mm/memory.c:3222 [inline]
 apply_to_p4d_range mm/memory.c:3258 [inline]
 __apply_to_page_range+0xac1/0x13f0 mm/memory.c:3294
 kasan_release_vmalloc+0xd1/0xe0 mm/kasan/shadow.c:616
 kasan_release_vmalloc_node mm/vmalloc.c:2255 [inline]
 purge_vmap_node+0x1c4/0xa30 mm/vmalloc.c:2272
 __purge_vmap_area_lazy+0xa06/0xc60 mm/vmalloc.c:2362
 drain_vmap_area_work+0x27/0x40 mm/vmalloc.c:2396
 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3263
 process_scheduled_works kernel/workqueue.c:3346 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3427
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x56d/0x700 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Memory state around the buggy address:
 ffff88812bc67e80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88812bc67f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88812bc67f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                                ^
 ffff88812bc68000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88812bc68080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess):
   0:	0f 85 5f 07 00 00    	jne    0x765
   6:	8b 0d 79 c4 51 09    	mov    0x951c479(%rip),%ecx        # 0x951c485
   c:	85 c9                	test   %ecx,%ecx
   e:	0f 85 b9 02 00 00    	jne    0x2cd
  14:	48 89 df             	mov    %rbx,%rdi
  17:	e8 c5 dc f7 05       	call   0x5f7dce1
  1c:	e8 40 10 37 00       	call   0x371061
  21:	fb                   	sti
  22:	65 48 8b 1d 1f cc 48 	mov    %gs:0xb48cc1f(%rip),%rbx        # 0xb48cc49
  29:	0b
* 2a:	48 8d bb 50 15 00 00 	lea    0x1550(%rbx),%rdi <-- trapping instruction
  31:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  38:	fc ff df
  3b:	48 89 fa             	mov    %rdi,%rdx
  3e:	48                   	rex.W
  3f:	c1                   	.byte 0xc1