=========
==================================================================
BUG: KASAN: slab-out-of-bounds in pn533_acr122_is_rx_frame_valid drivers/nfc/pn533/usb.c:325 [inline]
BUG: KASAN: slab-out-of-bounds in pn533_acr122_is_rx_frame_valid+0x132/0x150 drivers/nfc/pn533/usb.c:315
Read of size 1 at addr ffff88811a73a60e by task rcu_preempt/16
CPU: 0 UID: 0 PID: 16 Comm: rcu_preempt Not tainted syzkaller #0 PREEMPT(lazy)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x13d/0x4b0 mm/kasan/report.c:482
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
pn533_acr122_is_rx_frame_valid drivers/nfc/pn533/usb.c:325 [inline]
pn533_acr122_is_rx_frame_valid+0x132/0x150 drivers/nfc/pn533/usb.c:315
pn533_recv_frame+0x1b7/0x6d0 drivers/nfc/pn533/pn533.c:2203
__usb_hcd_giveback_urb+0x38e/0x610 drivers/usb/core/hcd.c:1657
usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
dummy_timer+0xdb2/0x3700 drivers/usb/gadget/udc/dummy_hcd.c:2019
__run_hrtimer kernel/time/hrtimer.c:2067 [inline]
__hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2124
hrtimer_run_softirq+0x1ca/0x360 kernel/time/hrtimer.c:2141
handle_softirqs+0x1d9/0x9b0 kernel/softirq.c:645
__do_softirq kernel/softirq.c:679 [inline]
invoke_softirq kernel/softirq.c:519 [inline]
__irq_exit_rcu+0x168/0x210 kernel/softirq.c:758
irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:220 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:229
Code: 90 f3 0f 1e fa 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 5a e8 05 fa 48 89 df e8 e2 3e 06 fa e8 ed 5f 32 fa fb bf 01 00 00 00 72 94 f8 f9 65 48 83 3d e1 ff 98 05 00 74 06 5b e9 11 4c 00 00
RSP: 0018:ffffc9000010fcd0 EFLAGS: 00000202
RAX: 00000000001fa2ef RBX: ffffffff898f03c0 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffffffff89329f40 RDI: 0000000000000001
RBP: ffffffff898f0408 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffffffff898f0400
R13: ffffffff8b15b984 R14: dffffc0000000000 R15: ffffffff898f03c0
rcu_gp_cleanup+0x276/0xd40 kernel/rcu/tree.c:2244
rcu_gp_kthread+0x18b/0x220 kernel/rcu/tree.c:2334
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x69f/0xc90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Allocated by task 5081:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5414 [inline]
__kmalloc_flags_noprof+0x346/0x890 mm/slub.c:5602
_kmalloc_flags_noprof mm/slab.h:55 [inline]
__alloc_empty_sheaf mm/slub.c:2822 [inline]
alloc_empty_sheaf mm/slub.c:2842 [inline]
__kfree_rcu_sheaf+0x44e/0x870 mm/slub.c:6151
kfree_rcu_sheaf mm/slab_common.c:1688 [inline]
kvfree_call_rcu+0x1c0/0x4f0 mm/slab_common.c:2037
ma_free_rcu lib/maple_tree.c:173 [inline]
ma_free_rcu+0x40/0x60 lib/maple_tree.c:170
mas_free lib/maple_tree.c:1150 [inline]
mas_replace_node lib/maple_tree.c:1668 [inline]
mas_wr_node_store+0xeea/0x15a0 lib/maple_tree.c:3276
mas_wr_store_entry+0xcd8/0x1d50 lib/maple_tree.c:3606
mas_store_prealloc+0x6e7/0x10a0 lib/maple_tree.c:5031
vma_iter_store_new mm/vma.h:711 [inline]
vma_complete+0x9d8/0xf50 mm/vma.c:403
__split_vma+0x13d0/0x1db0 mm/vma.c:613
vms_gather_munmap_vmas+0x1d2/0x1670 mm/vma.c:1507
do_vmi_align_munmap+0x287/0x5f0 mm/vma.c:1675
do_vmi_munmap+0x1f8/0x3e0 mm/vma.c:1732
__vm_munmap+0x196/0x380 mm/vma.c:3390
elf_map fs/binfmt_elf.c:395 [inline]
elf_load+0x54f/0x720 fs/binfmt_elf.c:420
load_elf_binary+0xf3b/0x50a0 fs/binfmt_elf.c:1188
search_binary_handler fs/exec.c:1759 [inline]
exec_binprm fs/exec.c:1791 [inline]
bprm_execve fs/exec.c:1847 [inline]
bprm_execve+0x8cb/0x17e0 fs/exec.c:1823
kernel_execve+0x31e/0x3a0 fs/exec.c:1991
call_usermodehelper_exec_async+0x239/0x4b0 kernel/umh.c:107
ret_from_fork+0x69f/0xc90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Last potentially related work creation:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_record_aux_stack+0x8c/0xa0 mm/kasan/generic.c:556
__call_rcu_common.constprop.0+0xa5/0x9b0 kernel/rcu/tree.c:3181
__kfree_rcu_sheaf+0x36f/0x870 mm/slub.c:6203
kfree_rcu_sheaf mm/slab_common.c:1688 [inline]
kvfree_call_rcu+0x1c0/0x4f0 mm/slab_common.c:2037
ma_free_rcu lib/maple_tree.c:173 [inline]
ma_free_rcu+0x40/0x60 lib/maple_tree.c:170
mas_free lib/maple_tree.c:1150 [inline]
mas_replace_node lib/maple_tree.c:1668 [inline]
mas_wr_node_store+0xeea/0x15a0 lib/maple_tree.c:3276
mas_wr_store_entry+0xcd8/0x1d50 lib/maple_tree.c:3606
mas_store_prealloc+0x6e7/0x10a0 lib/maple_tree.c:5031
vma_iter_store_new mm/vma.h:711 [inline]
vma_complete+0x9d8/0xf50 mm/vma.c:403
__split_vma+0xb0a/0x1db0 mm/vma.c:613
split_vma mm/vma.c:643 [inline]
vma_modify+0x1252/0x2610 mm/vma.c:1779
vma_modify_flags+0x25d/0x3e0 mm/vma.c:1799
mprotect_fixup+0x27a/0xe00 mm/mprotect.c:824
do_mprotect_pkey+0xa51/0xdd0 mm/mprotect.c:1002
__do_sys_mprotect mm/mprotect.c:1023 [inline]
__se_sys_mprotect mm/mprotect.c:1020 [inline]
__x64_sys_mprotect+0x78/0xc0 mm/mprotect.c:1020
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x119/0x710 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Second to last potentially related work creation:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_record_aux_stack+0x8c/0xa0 mm/kasan/generic.c:556
__call_rcu_common.constprop.0+0xa5/0x9b0 kernel/rcu/tree.c:3181
__kfree_rcu_sheaf+0x36f/0x870 mm/slub.c:6203
kfree_rcu_sheaf mm/slab_common.c:1688 [inline]
kvfree_call_rcu+0x1c0/0x4f0 mm/slab_common.c:2037
ma_free_rcu lib/maple_tree.c:173 [inline]
ma_free_rcu+0x40/0x60 lib/maple_tree.c:170
mas_free lib/maple_tree.c:1150 [inline]
mas_replace_node lib/maple_tree.c:1668 [inline]
mas_wr_node_store+0xeea/0x15a0 lib/maple_tree.c:3276
mas_wr_store_entry+0xcd8/0x1d50 lib/maple_tree.c:3606
mas_store_prealloc+0x6e7/0x10a0 lib/maple_tree.c:5031
vma_iter_store_new mm/vma.h:711 [inline]
vma_complete+0x9d8/0xf50 mm/vma.c:403
__split_vma+0xb0a/0x1db0 mm/vma.c:613
vms_gather_munmap_vmas+0x3a5/0x1670 mm/vma.c:1528
__mmap_setup mm/vma.c:2538 [inline]
__mmap_region+0x4c9/0x3150 mm/vma.c:2861
mmap_region+0x3db/0x6d0 mm/vma.c:2964
do_mmap+0x12b6/0x1c10 mm/mmap.c:573
vm_mmap_pgoff+0x1f0/0x390 mm/util.c:581
ksys_mmap_pgoff+0x3cb/0x610 mm/mmap.c:619
__do_sys_mmap arch/x86/kernel/sys_x86_64.c:89 [inline]
__se_sys_mmap arch/x86/kernel/sys_x86_64.c:82 [inline]
__x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:82
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x119/0x710 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff88811a73a400
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 238 bytes to the right of
allocated 288-byte region [ffff88811a73a400, ffff88811a73a520)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11a738
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x200000000000040(head|node=0|zone=2)
page_type: f5(slab)
raw: 0200000000000040 ffff888100041c80 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 0200000000000040 ffff888100041c80 dead000000000100 dead000000000122
head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 0200000000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 2862, tgid 2862 (udevadm), ts 17309668234
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871
prep_new_page mm/page_alloc.c:1879 [inline]
get_page_from_freelist+0xf4b/0x3440 mm/page_alloc.c:3943
__alloc_frozen_pages_noprof+0x2d7/0x2f70 mm/page_alloc.c:5436
alloc_slab_page mm/slub.c:3347 [inline]
allocate_slab mm/slub.c:3462 [inline]
new_slab+0xa9/0x6e0 mm/slub.c:3513
refill_objects+0xe3/0x410 mm/slub.c:7410
refill_sheaf mm/slub.c:2885 [inline]
__pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4774
alloc_from_pcs mm/slub.c:4850 [inline]
slab_alloc_node mm/slub.c:4984 [inline]
__kmalloc_cache_noprof+0x4a1/0x680 mm/slub.c:5559
_kmalloc_noprof include/linux/slab.h:991 [inline]
_kzalloc_noprof include/linux/slab.h:1312 [inline]
kernfs_fop_open+0x23d/0xd50 fs/kernfs/file.c:634
do_dentry_open+0x68b/0x14b0 fs/open.c:996
vfs_open+0x82/0x3f0 fs/open.c:1101
do_open fs/namei.c:4837 [inline]
path_openat+0x19fa/0x2440 fs/namei.c:5000
do_file_open+0x20e/0x430 fs/namei.c:5029
do_sys_openat2+0x10f/0x1e0 fs/open.c:1417
do_sys_open fs/open.c:1423 [inline]
__do_sys_openat fs/open.c:1439 [inline]
__se_sys_openat fs/open.c:1434 [inline]
__x64_sys_openat+0x12d/0x210 fs/open.c:1434
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x119/0x710 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page_owner free stack trace missing
Memory state around the buggy address:
ffff88811a73a500: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc
ffff88811a73a580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88811a73a600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88811a73a680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88811a73a700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
----------------
Code disassembly (best guess):
0: 90 nop
1: f3 0f 1e fa endbr64
5: 53 push %rbx
6: 48 8b 74 24 08 mov 0x8(%rsp),%rsi
b: 48 89 fb mov %rdi,%rbx
e: 48 83 c7 18 add $0x18,%rdi
12: e8 5a e8 05 fa call 0xfa05e871
17: 48 89 df mov %rbx,%rdi
1a: e8 e2 3e 06 fa call 0xfa063f01
1f: e8 ed 5f 32 fa call 0xfa326011
24: fb sti
25: bf 01 00 00 00 mov $0x1,%edi
* 2a: e8 72 94 f8 f9 call 0xf9f894a1 <-- trapping instruction
2f: 65 48 83 3d e1 ff 98 cmpq $0x0,%gs:0x598ffe1(%rip) # 0x5990019
36: 05 00
38: 74 06 je 0x40
3a: 5b pop %rbx
3b: e9 11 4c 00 00 jmp 0x4c51