==================================================================
BUG: KASAN: slab-out-of-bounds in mcp2221_raw_event+0xf94/0x1030 drivers/hid/hid-mcp2221.c:852
Read of size 1 at addr ffff88811fdfbfff by task syz.0.2700/14510
CPU: 0 UID: 0 PID: 14510 Comm: syz.0.2700 Not tainted 6.15.0-rc4-syzkaller-00104-g588d032e9e56 #0 PREEMPT(voluntary)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:408 [inline]
print_report+0xc3/0x670 mm/kasan/report.c:521
kasan_report+0xe0/0x110 mm/kasan/report.c:634
mcp2221_raw_event+0xf94/0x1030 drivers/hid/hid-mcp2221.c:852
__hid_input_report.constprop.0+0x311/0x450 drivers/hid/hid-core.c:2117
hid_irq_in+0x35e/0x870 drivers/hid/usbhid/hid-core.c:286
__usb_hcd_giveback_urb+0x38a/0x6e0 drivers/usb/core/hcd.c:1650
usb_hcd_giveback_urb+0x39b/0x450 drivers/usb/core/hcd.c:1734
dummy_timer+0x180e/0x3a20 drivers/usb/gadget/udc/dummy_hcd.c:1994
__run_hrtimer kernel/time/hrtimer.c:1761 [inline]
__hrtimer_run_queues+0x1ff/0xad0 kernel/time/hrtimer.c:1825
hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1842
handle_softirqs+0x205/0x8d0 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xfa/0x160 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:deref_stack_reg arch/x86/kernel/unwind_orc.c:406 [inline]
RIP: 0010:unwind_next_frame+0xb85/0x20a0 arch/x86/kernel/unwind_orc.c:585
Code: 76 f8 ba 08 00 00 00 4d 8d 7d 34 4c 89 ef 4c 89 44 24 28 48 89 4c 24 20 48 89 74 24 18 e8 73 f2 ff ff 84 c0 0f 84 fd f7 ff ff <48> 8b 7c 24 18 e8 51 ea ff ff 48 89 ee 48 8b 4c 24 20 48 ba 00 00
RSP: 0018:ffffc900022a79a8 EFLAGS: 00000202
RAX: 0000000000000001 RBX: 0000000000000001 RCX: ffffc900022a8000
RDX: ffffc900022a7d01 RSI: ffffc900022a7d60 RDI: ffffc900022a7a18
RBP: ffffc900022a7a60 R08: ffffffff8adf4e7e R09: 0000000000000000
R10: 0000000000000000 R11: 000000000000d7ff R12: ffffc900022a7a68
R13: ffffc900022a7a18 R14: ffffc900022a7d68 R15: ffffc900022a7a4c
arch_stack_walk+0x94/0x100 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x37/0x50 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2398 [inline]
slab_free mm/slub.c:4656 [inline]
kfree+0x286/0x470 mm/slub.c:4855
raw_ioctl_ep_write drivers/usb/gadget/legacy/raw_gadget.c:1153 [inline]
raw_ioctl+0xab6/0x2c30 drivers/usb/gadget/legacy/raw_gadget.c:1324
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl fs/ioctl.c:892 [inline]
__x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7efde11ae56b
Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
RSP: 002b:00007efddf815f70 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007efde11ae56b
RDX: 00007efddf815ff0 RSI: 0000000040085507 RDI: 0000000000000003
RBP: 0000000000000003 R08: 00007efde1500320 R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000246 R12: 0000200000000040
R13: 0000000000000000 R14: 00007efde13d5fa0 R15: 00007ffe5dd41e28
Allocated by task 2842:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:319 [inline]
__kasan_slab_alloc+0x6e/0x70 mm/kasan/common.c:345
kasan_slab_alloc include/linux/kasan.h:250 [inline]
slab_post_alloc_hook mm/slub.c:4161 [inline]
slab_alloc_node mm/slub.c:4210 [inline]
kmem_cache_alloc_node_noprof+0x14d/0x3a0 mm/slub.c:4262
kmalloc_reserve+0x18b/0x2c0 net/core/skbuff.c:577
__alloc_skb+0x166/0x380 net/core/skbuff.c:668
alloc_skb include/linux/skbuff.h:1340 [inline]
netlink_alloc_large_skb+0x69/0x130 net/netlink/af_netlink.c:1187
netlink_sendmsg+0x6a1/0xdd0 net/netlink/af_netlink.c:1858
sock_sendmsg_nosec net/socket.c:712 [inline]
__sock_sendmsg net/socket.c:727 [inline]
____sys_sendmsg+0xa95/0xc70 net/socket.c:2566
___sys_sendmsg+0x134/0x1d0 net/socket.c:2620
__sys_sendmsg+0x16d/0x220 net/socket.c:2652
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 9967:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x37/0x50 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2398 [inline]
slab_free mm/slub.c:4656 [inline]
kmem_cache_free+0x2a3/0x470 mm/slub.c:4758
skb_kfree_head net/core/skbuff.c:1056 [inline]
skb_kfree_head net/core/skbuff.c:1053 [inline]
skb_free_head+0x18a/0x1d0 net/core/skbuff.c:1070
skb_release_data+0x7a5/0x960 net/core/skbuff.c:1097
skb_release_all net/core/skbuff.c:1162 [inline]
__kfree_skb net/core/skbuff.c:1176 [inline]
consume_skb net/core/skbuff.c:1408 [inline]
consume_skb+0xbf/0x100 net/core/skbuff.c:1402
netlink_recvmsg+0x537/0xe00 net/netlink/af_netlink.c:1961
sock_recvmsg_nosec net/socket.c:1017 [inline]
sock_recvmsg+0x1f6/0x250 net/socket.c:1039
____sys_recvmsg+0x218/0x6b0 net/socket.c:2786
___sys_recvmsg+0x114/0x1a0 net/socket.c:2828
__sys_recvmsg+0x16a/0x220 net/socket.c:2861
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff88811fdfba80
which belongs to the cache skbuff_small_head of size 704
The buggy address is located 703 bytes to the right of
allocated 704-byte region [ffff88811fdfba80, ffff88811fdfbd40)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11fdf8
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x200000000000040(head|node=0|zone=2)
page_type: f5(slab)
raw: 0200000000000040 ffff888102aebb40 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000130013 00000000f5000000 0000000000000000
head: 0200000000000040 ffff888102aebb40 dead000000000122 0000000000000000
head: 0000000000000000 0000000000130013 00000000f5000000 0000000000000000
head: 0200000000000002 ffffea00047f7e01 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 2842, tgid 2842 (udevd), ts 1385575014834, free_ts 1383627997788
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x181/0x1b0 mm/page_alloc.c:1718
prep_new_page mm/page_alloc.c:1726 [inline]
get_page_from_freelist+0xfec/0x2d90 mm/page_alloc.c:3688
__alloc_frozen_pages_noprof+0x25c/0x2160 mm/page_alloc.c:4970
alloc_pages_mpol+0xe4/0x410 mm/mempolicy.c:2301
alloc_slab_page mm/slub.c:2468 [inline]
allocate_slab mm/slub.c:2632 [inline]
new_slab+0x244/0x340 mm/slub.c:2686
___slab_alloc+0xda5/0x1940 mm/slub.c:3872
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3962
__slab_alloc_node mm/slub.c:4037 [inline]
slab_alloc_node mm/slub.c:4198 [inline]
kmem_cache_alloc_node_noprof+0x1f6/0x3a0 mm/slub.c:4262
kmalloc_reserve+0x18b/0x2c0 net/core/skbuff.c:577
__alloc_skb+0x166/0x380 net/core/skbuff.c:668
alloc_skb include/linux/skbuff.h:1340 [inline]
netlink_alloc_large_skb+0x69/0x130 net/netlink/af_netlink.c:1187
netlink_sendmsg+0x6a1/0xdd0 net/netlink/af_netlink.c:1858
sock_sendmsg_nosec net/socket.c:712 [inline]
__sock_sendmsg net/socket.c:727 [inline]
____sys_sendmsg+0xa95/0xc70 net/socket.c:2566
___sys_sendmsg+0x134/0x1d0 net/socket.c:2620
__sys_sendmsg+0x16d/0x220 net/socket.c:2652
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
page last free pid 5439 tgid 5439 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1262 [inline]
__free_frozen_pages+0x66c/0xe70 mm/page_alloc.c:2725
stack_depot_save_flags+0x354/0xa50 lib/stackdepot.c:678
kasan_save_stack+0x42/0x60 mm/kasan/common.c:48
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__do_kmalloc_node mm/slub.c:4341 [inline]
__kmalloc_noprof+0x213/0x4d0 mm/slub.c:4353
kmalloc_noprof include/linux/slab.h:909 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]
kobject_get_path+0xd2/0x2a0 lib/kobject.c:161
kobject_uevent_env+0x289/0x1870 lib/kobject_uevent.c:545
device_add+0x10dd/0x1a70 drivers/base/core.c:3673
device_create_groups_vargs+0x1f8/0x270 drivers/base/core.c:4374
device_create+0xed/0x130 drivers/base/core.c:4413
roccat_connect+0x1cc/0x520 drivers/hid/hid-roccat.c:324
arvo_init_specials drivers/hid/hid-roccat-arvo.c:315 [inline]
arvo_probe drivers/hid/hid-roccat-arvo.c:365 [inline]
arvo_probe+0x28b/0x4c0 drivers/hid/hid-roccat-arvo.c:345
__hid_device_probe drivers/hid/hid-core.c:2717 [inline]
hid_device_probe+0x354/0x710 drivers/hid/hid-core.c:2754
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x23e/0xa90 drivers/base/dd.c:657
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
Memory state around the buggy address:
ffff88811fdfbe80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88811fdfbf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88811fdfbf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88811fdfc000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88811fdfc080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess):
0: 76 f8 jbe 0xfffffffa
2: ba 08 00 00 00 mov $0x8,%edx
7: 4d 8d 7d 34 lea 0x34(%r13),%r15
b: 4c 89 ef mov %r13,%rdi
e: 4c 89 44 24 28 mov %r8,0x28(%rsp)
13: 48 89 4c 24 20 mov %rcx,0x20(%rsp)
18: 48 89 74 24 18 mov %rsi,0x18(%rsp)
1d: e8 73 f2 ff ff call 0xfffff295
22: 84 c0 test %al,%al
24: 0f 84 fd f7 ff ff je 0xfffff827
* 2a: 48 8b 7c 24 18 mov 0x18(%rsp),%rdi <-- trapping instruction
2f: e8 51 ea ff ff call 0xffffea85
34: 48 89 ee mov %rbp,%rsi
37: 48 8b 4c 24 20 mov 0x20(%rsp),%rcx
3c: 48 rex.W
3d: ba .byte 0xba