betop 0003:11C0:5506.0001: hidraw0: USB HID v0.00 Device [HID 11c0:5506] on usb-dummy_hcd.5-1/input0 ================================================================== BUG: KASAN: slab-out-of-bounds in instrument_atomic_write include/linux/instrumented.h:86 [inline] BUG: KASAN: slab-out-of-bounds in set_bit include/asm-generic/bitops/instrumented-atomic.h:28 [inline] BUG: KASAN: slab-out-of-bounds in betopff_init drivers/hid/hid-betopff.c:99 [inline] BUG: KASAN: slab-out-of-bounds in betop_probe+0x2cb/0x580 drivers/hid/hid-betopff.c:134 Write of size 8 at addr ffff8880239b42c0 by task kworker/1:7/10147 CPU: 1 PID: 10147 Comm: kworker/1:7 Not tainted 5.14.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x57/0x7d lib/dump_stack.c:105 print_address_description.constprop.0.cold+0x6c/0x2d6 mm/kasan/report.c:233 __kasan_report mm/kasan/report.c:419 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:436 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189 instrument_atomic_write include/linux/instrumented.h:86 [inline] set_bit include/asm-generic/bitops/instrumented-atomic.h:28 [inline] betopff_init drivers/hid/hid-betopff.c:99 [inline] betop_probe+0x2cb/0x580 drivers/hid/hid-betopff.c:134 hid_device_probe+0x265/0x370 drivers/hid/hid-core.c:2287 call_driver_probe drivers/base/dd.c:517 [inline] really_probe+0x1b9/0xb70 drivers/base/dd.c:595 __driver_probe_device+0x2a6/0x460 drivers/base/dd.c:747 driver_probe_device+0x44/0x110 drivers/base/dd.c:777 __device_attach_driver+0x185/0x250 drivers/base/dd.c:894 bus_for_each_drv+0x11e/0x1a0 drivers/base/bus.c:427 __device_attach+0x1db/0x410 drivers/base/dd.c:965 bus_probe_device+0x19d/0x250 drivers/base/bus.c:487 device_add+0xa2f/0x1e00 drivers/base/core.c:3355 hid_add_device+0x2d5/0x8a0 drivers/hid/hid-core.c:2439 usbhid_probe+0x9e8/0xf00 drivers/hid/usbhid/hid-core.c:1417 usb_probe_interface+0x274/0x6a0 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:517 [inline] really_probe+0x1b9/0xb70 drivers/base/dd.c:595 __driver_probe_device+0x2a6/0x460 drivers/base/dd.c:747 driver_probe_device+0x44/0x110 drivers/base/dd.c:777 __device_attach_driver+0x185/0x250 drivers/base/dd.c:894 bus_for_each_drv+0x11e/0x1a0 drivers/base/bus.c:427 __device_attach+0x1db/0x410 drivers/base/dd.c:965 bus_probe_device+0x19d/0x250 drivers/base/bus.c:487 device_add+0xa2f/0x1e00 drivers/base/core.c:3355 usb_set_configuration+0xc1d/0x1710 drivers/usb/core/message.c:2170 usb_generic_driver_probe+0x74/0xa0 drivers/usb/core/generic.c:238 usb_probe_device+0x95/0x240 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:517 [inline] really_probe+0x1b9/0xb70 drivers/base/dd.c:595 __driver_probe_device+0x2a6/0x460 drivers/base/dd.c:747 driver_probe_device+0x44/0x110 drivers/base/dd.c:777 __device_attach_driver+0x185/0x250 drivers/base/dd.c:894 bus_for_each_drv+0x11e/0x1a0 drivers/base/bus.c:427 __device_attach+0x1db/0x410 drivers/base/dd.c:965 bus_probe_device+0x19d/0x250 drivers/base/bus.c:487 device_add+0xa2f/0x1e00 drivers/base/core.c:3355 usb_new_device.cold+0x5cf/0xedf drivers/usb/core/hub.c:2563 hub_port_connect drivers/usb/core/hub.c:5348 [inline] hub_port_connect_change drivers/usb/core/hub.c:5488 [inline] port_event drivers/usb/core/hub.c:5634 [inline] hub_event+0x10a3/0x36c0 drivers/usb/core/hub.c:5716 process_one_work+0x84c/0x13d0 kernel/workqueue.c:2276 worker_thread+0x598/0x1040 kernel/workqueue.c:2422 kthread+0x38b/0x460 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Allocated by task 10147: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] ____kasan_kmalloc mm/kasan/common.c:513 [inline] ____kasan_kmalloc mm/kasan/common.c:472 [inline] __kasan_kmalloc+0x98/0xc0 mm/kasan/common.c:522 kasan_kmalloc include/linux/kasan.h:264 [inline] kmem_cache_alloc_trace+0x1e4/0x480 mm/slab.c:3575 kmalloc include/linux/slab.h:591 [inline] kzalloc include/linux/slab.h:721 [inline] hidraw_connect+0x46/0x3f0 drivers/hid/hidraw.c:543 hid_connect+0x42e/0x930 drivers/hid/hid-core.c:1960 hid_hw_start drivers/hid/hid-core.c:2059 [inline] hid_hw_start+0x74/0x100 drivers/hid/hid-core.c:2050 betop_probe+0x92/0x580 drivers/hid/hid-betopff.c:128 hid_device_probe+0x265/0x370 drivers/hid/hid-core.c:2287 call_driver_probe drivers/base/dd.c:517 [inline] really_probe+0x1b9/0xb70 drivers/base/dd.c:595 __driver_probe_device+0x2a6/0x460 drivers/base/dd.c:747 driver_probe_device+0x44/0x110 drivers/base/dd.c:777 __device_attach_driver+0x185/0x250 drivers/base/dd.c:894 bus_for_each_drv+0x11e/0x1a0 drivers/base/bus.c:427 __device_attach+0x1db/0x410 drivers/base/dd.c:965 bus_probe_device+0x19d/0x250 drivers/base/bus.c:487 device_add+0xa2f/0x1e00 drivers/base/core.c:3355 hid_add_device+0x2d5/0x8a0 drivers/hid/hid-core.c:2439 usbhid_probe+0x9e8/0xf00 drivers/hid/usbhid/hid-core.c:1417 usb_probe_interface+0x274/0x6a0 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:517 [inline] really_probe+0x1b9/0xb70 drivers/base/dd.c:595 __driver_probe_device+0x2a6/0x460 drivers/base/dd.c:747 driver_probe_device+0x44/0x110 drivers/base/dd.c:777 __device_attach_driver+0x185/0x250 drivers/base/dd.c:894 bus_for_each_drv+0x11e/0x1a0 drivers/base/bus.c:427 __device_attach+0x1db/0x410 drivers/base/dd.c:965 bus_probe_device+0x19d/0x250 drivers/base/bus.c:487 device_add+0xa2f/0x1e00 drivers/base/core.c:3355 usb_set_configuration+0xc1d/0x1710 drivers/usb/core/message.c:2170 usb_generic_driver_probe+0x74/0xa0 drivers/usb/core/generic.c:238 usb_probe_device+0x95/0x240 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:517 [inline] really_probe+0x1b9/0xb70 drivers/base/dd.c:595 __driver_probe_device+0x2a6/0x460 drivers/base/dd.c:747 driver_probe_device+0x44/0x110 drivers/base/dd.c:777 __device_attach_driver+0x185/0x250 drivers/base/dd.c:894 bus_for_each_drv+0x11e/0x1a0 drivers/base/bus.c:427 __device_attach+0x1db/0x410 drivers/base/dd.c:965 bus_probe_device+0x19d/0x250 drivers/base/bus.c:487 device_add+0xa2f/0x1e00 drivers/base/core.c:3355 usb_new_device.cold+0x5cf/0xedf drivers/usb/core/hub.c:2563 hub_port_connect drivers/usb/core/hub.c:5348 [inline] hub_port_connect_change drivers/usb/core/hub.c:5488 [inline] port_event drivers/usb/core/hub.c:5634 [inline] hub_event+0x10a3/0x36c0 drivers/usb/core/hub.c:5716 process_one_work+0x84c/0x13d0 kernel/workqueue.c:2276 worker_thread+0x598/0x1040 kernel/workqueue.c:2422 kthread+0x38b/0x460 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Last potentially related work creation: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38 kasan_record_aux_stack+0xa4/0xd0 mm/kasan/generic.c:348 insert_work+0x42/0x300 kernel/workqueue.c:1332 __queue_work+0x49c/0xc70 kernel/workqueue.c:1498 queue_work_on+0x70/0x80 kernel/workqueue.c:1525 queue_work include/linux/workqueue.h:507 [inline] call_usermodehelper_exec+0x1b8/0x430 kernel/umh.c:435 kobject_uevent_env+0xc61/0x1290 lib/kobject_uevent.c:618 rx_queue_add_kobject net/core/net-sysfs.c:1020 [inline] net_rx_queue_update_kobjects+0xb1/0x3e0 net/core/net-sysfs.c:1060 register_queue_kobjects net/core/net-sysfs.c:1711 [inline] netdev_register_kobject+0x241/0x3c0 net/core/net-sysfs.c:1959 register_netdevice+0xa91/0x1240 net/core/dev.c:10349 register_netdev+0x17/0x30 net/core/dev.c:10473 ip6gre_init_net+0x317/0x500 net/ipv6/ip6_gre.c:1606 ops_init+0x91/0x3c0 net/core/net_namespace.c:140 setup_net+0x3c6/0x920 net/core/net_namespace.c:333 copy_net_ns+0x29c/0x5c0 net/core/net_namespace.c:474 create_new_namespaces+0x35a/0x920 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0x86/0x1a0 kernel/nsproxy.c:226 ksys_unshare+0x309/0x6b0 kernel/fork.c:3002 __do_sys_unshare kernel/fork.c:3076 [inline] __se_sys_unshare kernel/fork.c:3074 [inline] __x64_sys_unshare+0x28/0x40 kernel/fork.c:3074 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Second to last potentially related work creation: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38 kasan_record_aux_stack+0xa4/0xd0 mm/kasan/generic.c:348 insert_work+0x42/0x300 kernel/workqueue.c:1332 __queue_work+0x49c/0xc70 kernel/workqueue.c:1498 queue_work_on+0x70/0x80 kernel/workqueue.c:1525 queue_work include/linux/workqueue.h:507 [inline] call_usermodehelper_exec+0x1b8/0x430 kernel/umh.c:435 kobject_uevent_env+0xc61/0x1290 lib/kobject_uevent.c:618 kobject_synth_uevent+0x484/0x6d0 lib/kobject_uevent.c:208 uevent_store+0x17/0x30 drivers/base/core.c:2372 kernfs_fop_write_iter+0x2c5/0x460 fs/kernfs/file.c:296 call_write_iter include/linux/fs.h:2114 [inline] new_sync_write+0x35d/0x5f0 fs/read_write.c:518 vfs_write+0x5b1/0x880 fs/read_write.c:605 ksys_write+0xf4/0x1d0 fs/read_write.c:658 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae The buggy address belongs to the object at ffff8880239b4200 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 0 bytes to the right of 192-byte region [ffff8880239b4200, ffff8880239b42c0) The buggy address belongs to the page: page:ffffea00008e6d00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x239b4 flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000200 ffffea00008f1a88 ffffea000089a808 ffff88800fc40000 raw: 0000000000000000 ffff8880239b4000 0000000100000010 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2420c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_COMP|__GFP_THISNODE), pid 1, ts 7407429895, free_ts 0 prep_new_page mm/page_alloc.c:2436 [inline] get_page_from_freelist+0xa6f/0x2f50 mm/page_alloc.c:4169 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5391 __alloc_pages_node include/linux/gfp.h:570 [inline] kmem_getpages mm/slab.c:1377 [inline] cache_grow_begin+0x75/0x460 mm/slab.c:2593 cache_alloc_refill+0x27f/0x380 mm/slab.c:2965 ____cache_alloc mm/slab.c:3048 [inline] ____cache_alloc mm/slab.c:3031 [inline] __do_cache_alloc mm/slab.c:3275 [inline] slab_alloc mm/slab.c:3316 [inline] kmem_cache_alloc_trace+0x38c/0x480 mm/slab.c:3573 kmalloc include/linux/slab.h:591 [inline] __usb_create_hcd+0x70e/0xa20 drivers/usb/core/hcd.c:2559 vhci_hcd_probe+0xc9/0x300 drivers/usb/usbip/vhci_hcd.c:1349 platform_probe+0xce/0x180 drivers/base/platform.c:1427 call_driver_probe drivers/base/dd.c:517 [inline] really_probe+0x1b9/0xb70 drivers/base/dd.c:595 __driver_probe_device+0x2a6/0x460 drivers/base/dd.c:747 driver_probe_device+0x44/0x110 drivers/base/dd.c:777 __device_attach_driver+0x185/0x250 drivers/base/dd.c:894 bus_for_each_drv+0x11e/0x1a0 drivers/base/bus.c:427 __device_attach+0x1db/0x410 drivers/base/dd.c:965 bus_probe_device+0x19d/0x250 drivers/base/bus.c:487 device_add+0xa2f/0x1e00 drivers/base/core.c:3355 page_owner free stack trace missing Memory state around the buggy address: ffff8880239b4180: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880239b4200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8880239b4280: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc ^ ffff8880239b4300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880239b4380: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc ==================================================================