================================================================== BUG: KASAN: slab-out-of-bounds in mcp2221_raw_event+0xf94/0x1030 drivers/hid/hid-mcp2221.c:944 Read of size 1 at addr ffff88813492bfff by task kworker/0:4/20305 CPU: 0 UID: 0 PID: 20305 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(voluntary) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 Workqueue: events legacy_dvb_usb_read_remote_control Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcd/0x630 mm/kasan/report.c:482 kasan_report+0xe0/0x110 mm/kasan/report.c:595 mcp2221_raw_event+0xf94/0x1030 drivers/hid/hid-mcp2221.c:944 __hid_input_report.constprop.0+0x314/0x450 drivers/hid/hid-core.c:2130 hid_irq_in+0x35e/0x870 drivers/hid/usbhid/hid-core.c:286 __usb_hcd_giveback_urb+0x38b/0x610 drivers/usb/core/hcd.c:1661 usb_hcd_giveback_urb+0x39b/0x450 drivers/usb/core/hcd.c:1745 dummy_timer+0x1814/0x3a30 drivers/usb/gadget/udc/dummy_hcd.c:1995 __run_hrtimer kernel/time/hrtimer.c:1761 [inline] __hrtimer_run_queues+0x1ff/0xad0 kernel/time/hrtimer.c:1825 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1842 handle_softirqs+0x208/0x8d0 kernel/softirq.c:579 __do_softirq kernel/softirq.c:613 [inline] invoke_softirq kernel/softirq.c:453 [inline] __irq_exit_rcu+0xfa/0x160 kernel/softirq.c:680 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline] sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1050 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:console_flush_all+0x9a2/0xc60 kernel/printk/printk.c:3227 Code: 00 e8 92 86 28 00 9c 5b 81 e3 00 02 00 00 31 ff 48 89 de e8 b0 a6 20 00 48 85 db 0f 85 55 01 00 00 e8 32 ab 20 00 fb 4c 89 e0 <48> c1 e8 03 42 80 3c 38 00 0f 84 11 ff ff ff 4c 89 e7 e8 97 d9 7e RSP: 0018:ffffc90012c97818 EFLAGS: 00000293 RAX: ffffffff897db338 RBX: 0000000000000000 RCX: ffffffff815d4d10 RDX: ffff88811a48d700 RSI: ffffffff815d4d1e RDI: 0000000000000007 RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff897db338 R13: ffffffff897db2e0 R14: ffffc90012c978a8 R15: dffffc0000000000 __console_flush_and_unlock kernel/printk/printk.c:3285 [inline] console_unlock+0xd8/0x210 kernel/printk/printk.c:3325 vprintk_emit+0x418/0x6d0 kernel/printk/printk.c:2450 _printk+0xc7/0x100 kernel/printk/printk.c:2475 m920x_read drivers/media/usb/dvb-usb/m920x.c:40 [inline] m920x_rc_query+0x496/0x770 drivers/media/usb/dvb-usb/m920x.c:193 legacy_dvb_usb_read_remote_control+0x10c/0x4f0 drivers/media/usb/dvb-usb/dvb-usb-remote.c:123 process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3236 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x5b6/0x6c0 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 1412: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:330 [inline] __kasan_slab_alloc+0x6e/0x70 mm/kasan/common.c:356 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4180 [inline] slab_alloc_node mm/slub.c:4229 [inline] kmem_cache_alloc_noprof+0x14f/0x3b0 mm/slub.c:4236 anon_vma_chain_alloc mm/rmap.c:142 [inline] __anon_vma_prepare+0xae/0x5e0 mm/rmap.c:195 __vmf_anon_prepare+0x11c/0x240 mm/memory.c:3506 vmf_anon_prepare mm/internal.h:432 [inline] do_anonymous_page mm/memory.c:5050 [inline] do_pte_missing mm/memory.c:4232 [inline] handle_pte_fault mm/memory.c:6052 [inline] __handle_mm_fault+0x183a/0x3210 mm/memory.c:6195 handle_mm_fault+0x589/0xd10 mm/memory.c:6364 do_user_addr_fault+0x613/0x1240 arch/x86/mm/fault.c:1336 handle_page_fault arch/x86/mm/fault.c:1476 [inline] exc_page_fault+0x5c/0xb0 arch/x86/mm/fault.c:1532 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 Freed by task 1412: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:243 [inline] __kasan_slab_free+0x3e/0x50 mm/kasan/common.c:275 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2417 [inline] slab_free mm/slub.c:4680 [inline] kmem_cache_free+0x2a0/0x470 mm/slub.c:4782 anon_vma_chain_free mm/rmap.c:147 [inline] unlink_anon_vmas+0x458/0x820 mm/rmap.c:447 free_pgtables+0x212/0xc00 mm/memory.c:413 exit_mmap+0x3fb/0xb90 mm/mmap.c:1291 __mmput kernel/fork.c:1130 [inline] mmput+0xdb/0x430 kernel/fork.c:1152 exit_mm kernel/exit.c:582 [inline] do_exit+0x7c7/0x2bf0 kernel/exit.c:949 do_group_exit+0xd3/0x2a0 kernel/exit.c:1102 __do_sys_exit_group kernel/exit.c:1113 [inline] __se_sys_exit_group kernel/exit.c:1111 [inline] __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1111 x64_sys_call+0x14fa/0x1720 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x4b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88813492bf50 which belongs to the cache anon_vma_chain of size 80 The buggy address is located 95 bytes to the right of allocated 80-byte region [ffff88813492bf50, ffff88813492bfa0) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13492b memcg:ffff888147e8bc01 flags: 0x200000000000000(node=0|zone=2) page_type: f5(slab) raw: 0200000000000000 ffff88810129e280 dead000000000100 dead000000000122 raw: 0000000000000000 0000000000240024 00000000f5000000 ffff888147e8bc01 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP), pid 28621, tgid 28621 (syz-executor), ts 2583524204107, free_ts 2582550048597 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1c0/0x230 mm/page_alloc.c:1851 prep_new_page mm/page_alloc.c:1859 [inline] get_page_from_freelist+0xf98/0x2ce0 mm/page_alloc.c:3858 __alloc_frozen_pages_noprof+0x259/0x21e0 mm/page_alloc.c:5148 alloc_pages_mpol+0xe4/0x410 mm/mempolicy.c:2416 alloc_slab_page mm/slub.c:2487 [inline] allocate_slab mm/slub.c:2655 [inline] new_slab+0x247/0x330 mm/slub.c:2709 ___slab_alloc+0xc78/0x1680 mm/slub.c:3891 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3981 __slab_alloc_node mm/slub.c:4056 [inline] slab_alloc_node mm/slub.c:4217 [inline] kmem_cache_alloc_noprof+0x1f9/0x3b0 mm/slub.c:4236 anon_vma_chain_alloc mm/rmap.c:142 [inline] anon_vma_clone+0xd8/0x5c0 mm/rmap.c:288 anon_vma_fork+0x7a/0x620 mm/rmap.c:351 dup_mmap+0x13eb/0x2050 mm/mmap.c:1797 dup_mm kernel/fork.c:1485 [inline] copy_mm kernel/fork.c:1537 [inline] copy_process+0x705a/0x7580 kernel/fork.c:2175 kernel_clone+0xfc/0x930 kernel/fork.c:2605 __do_sys_clone+0xce/0x120 kernel/fork.c:2748 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x4b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 27989 tgid 27989 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1395 [inline] __free_frozen_pages+0x78a/0xfd0 mm/page_alloc.c:2895 vfree+0x1fd/0xb50 mm/vmalloc.c:3434 kcov_put kernel/kcov.c:439 [inline] kcov_put kernel/kcov.c:435 [inline] kcov_close+0x34/0x60 kernel/kcov.c:535 __fput+0x402/0xb70 fs/file_table.c:468 task_work_run+0x14d/0x240 kernel/task_work.c:227 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x86f/0x2bf0 kernel/exit.c:961 do_group_exit+0xd3/0x2a0 kernel/exit.c:1102 get_signal+0x2673/0x26d0 kernel/signal.c:3034 arch_do_signal_or_restart+0x8f/0x7d0 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop+0x7c/0xe0 kernel/entry/common.c:40 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x3e9/0x4b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff88813492be80: fb fb fb fb fb fb fb fb fc fc fc fc fa fb fb fb ffff88813492bf00: fb fb fb fb fb fb fc fc fc fc fa fb fb fb fb fb >ffff88813492bf80: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff88813492c000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88813492c080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== ---------------- Code disassembly (best guess): 0: 00 e8 add %ch,%al 2: 92 xchg %eax,%edx 3: 86 28 xchg %ch,(%rax) 5: 00 9c 5b 81 e3 00 02 add %bl,0x200e381(%rbx,%rbx,2) c: 00 00 add %al,(%rax) e: 31 ff xor %edi,%edi 10: 48 89 de mov %rbx,%rsi 13: e8 b0 a6 20 00 call 0x20a6c8 18: 48 85 db test %rbx,%rbx 1b: 0f 85 55 01 00 00 jne 0x176 21: e8 32 ab 20 00 call 0x20ab58 26: fb sti 27: 4c 89 e0 mov %r12,%rax * 2a: 48 c1 e8 03 shr $0x3,%rax <-- trapping instruction 2e: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1) 33: 0f 84 11 ff ff ff je 0xffffff4a 39: 4c 89 e7 mov %r12,%rdi 3c: e8 .byte 0xe8 3d: 97 xchg %eax,%edi 3e: d9 .byte 0xd9 3f: 7e .byte 0x7e