usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 5-1: Product: syz
usb 5-1: Manufacturer: syz
usb 5-1: SerialNumber: syz
usb 5-1: config 0 descriptor??
==================================================================
BUG: KASAN: slab-out-of-bounds in hex_string+0x439/0x4c0 lib/vsprintf.c:1145
Read of size 1 at addr ffff88802825d85b by task kworker/1:2/3079

CPU: 1 PID: 3079 Comm: kworker/1:2 Not tainted 5.7.0-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
Workqueue: usb_hub_wq hub_event
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x188/0x20d lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0xd3/0x413 mm/kasan/report.c:383
 __kasan_report mm/kasan/report.c:513 [inline]
 kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530
 hex_string+0x439/0x4c0 lib/vsprintf.c:1145
 pointer+0x346/0x7c0 lib/vsprintf.c:2231
 vsnprintf+0x5ac/0x14f0 lib/vsprintf.c:2624
 va_format.isra.0+0x129/0x1b0 lib/vsprintf.c:1660
 pointer+0x534/0x7c0 lib/vsprintf.c:2259
 vsnprintf+0x5ac/0x14f0 lib/vsprintf.c:2624
 vscnprintf+0x29/0x80 lib/vsprintf.c:2723
 vprintk_store+0x40/0x4b0 kernel/printk/printk.c:1953
 vprintk_emit+0x139/0x730 kernel/printk/printk.c:2014
 dev_vprintk_emit+0x4fc/0x541 drivers/base/core.c:3760
 dev_printk_emit+0xba/0xf1 drivers/base/core.c:3771
 __dev_printk+0x1db/0x203 drivers/base/core.c:3783
 _dev_info+0xd7/0x109 drivers/base/core.c:3829
 dlfb_parse_vendor_descriptor drivers/video/fbdev/udlfb.c:1589 [inline]
 dlfb_usb_probe.cold+0x103c/0x1ca3 drivers/video/fbdev/udlfb.c:1672
 usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:374
 really_probe+0x281/0x6d0 drivers/base/dd.c:520
 driver_probe_device+0x104/0x210 drivers/base/dd.c:697
 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:804
 bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:431
 __device_attach+0x21a/0x360 drivers/base/dd.c:870
 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:491
 device_add+0x132d/0x1c10 drivers/base/core.c:2557
 usb_set_configuration+0xec5/0x1740 drivers/usb/core/message.c:2032
 usb_generic_driver_probe+0x9d/0xe0 drivers/usb/core/generic.c:241
 usb_probe_device+0xc6/0x1f0 drivers/usb/core/driver.c:272
 really_probe+0x281/0x6d0 drivers/base/dd.c:520
 driver_probe_device+0x104/0x210 drivers/base/dd.c:697
 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:804
 bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:431
 __device_attach+0x21a/0x360 drivers/base/dd.c:870
 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:491
 device_add+0x132d/0x1c10 drivers/base/core.c:2557
 usb_new_device.cold+0x753/0x103d drivers/usb/core/hub.c:2554
 hub_port_connect drivers/usb/core/hub.c:5208 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5348 [inline]
 port_event drivers/usb/core/hub.c:5494 [inline]
 hub_event+0x1eca/0x38f0 drivers/usb/core/hub.c:5576
 process_one_work+0x965/0x16a0 kernel/workqueue.c:2268
 worker_thread+0x96/0xe20 kernel/workqueue.c:2414
 kthread+0x388/0x470 kernel/kthread.c:268
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:351

Allocated by task 3079:
 save_stack+0x1b/0x40 mm/kasan/common.c:48
 set_track mm/kasan/common.c:56 [inline]
 __kasan_kmalloc mm/kasan/common.c:494 [inline]
 __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:467
 __do_kmalloc mm/slab.c:3656 [inline]
 __kmalloc+0x161/0x7a0 mm/slab.c:3665
 kmalloc include/linux/slab.h:560 [inline]
 usb_get_configuration+0x30e/0x3770 drivers/usb/core/config.c:919
 usb_enumerate_device drivers/usb/core/hub.c:2387 [inline]
 usb_new_device+0x387/0x670 drivers/usb/core/hub.c:2523
 hub_port_connect drivers/usb/core/hub.c:5208 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5348 [inline]
 port_event drivers/usb/core/hub.c:5494 [inline]
 hub_event+0x1eca/0x38f0 drivers/usb/core/hub.c:5576
 process_one_work+0x965/0x16a0 kernel/workqueue.c:2268
 worker_thread+0x96/0xe20 kernel/workqueue.c:2414
 kthread+0x388/0x470 kernel/kthread.c:268
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:351

Freed by task 8555:
 save_stack+0x1b/0x40 mm/kasan/common.c:48
 set_track mm/kasan/common.c:56 [inline]
 kasan_set_free_info mm/kasan/common.c:316 [inline]
 __kasan_slab_free+0xf7/0x140 mm/kasan/common.c:455
 __cache_free mm/slab.c:3426 [inline]
 kfree+0x109/0x2b0 mm/slab.c:3757
 security_cred_free+0xa5/0x100 security/security.c:1604
 put_cred_rcu+0x122/0x4a0 kernel/cred.c:114
 __put_cred+0x1de/0x250 kernel/cred.c:148
 put_cred include/linux/cred.h:287 [inline]
 revert_creds+0x1a8/0x1f0 kernel/cred.c:598
 do_faccessat+0x2cd/0x830 fs/open.c:464
 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
 entry_SYSCALL_64_after_hwframe+0x49/0xb3

The buggy address belongs to the object at ffff88802825d840
 which belongs to the cache kmalloc-32 of size 32
The buggy address is located 27 bytes inside of
 32-byte region [ffff88802825d840, ffff88802825d860)
The buggy address belongs to the page:
page:ffffea0000a09740 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88802825dfc1
flags: 0xfffe0000000200(slab)
raw: 00fffe0000000200 ffffea0000a0d888 ffffea0000a3a308 ffff88802c8001c0
raw: ffff88802825dfc1 ffff88802825d000 000000010000003d 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88802825d700: 00 02 fc fc fc fc fc fc 00 01 fc fc fc fc fc fc
 ffff88802825d780: 00 fc fc fc fc fc fc fc 00 00 fc fc fc fc fc fc
>ffff88802825d800: 00 05 fc fc fc fc fc fc 00 00 00 03 fc fc fc fc
                                                    ^
 ffff88802825d880: 06 fc fc fc fc fc fc fc 00 00 fc fc fc fc fc fc
 ffff88802825d900: 07 fc fc fc fc fc fc fc fb fb fb fb fc fc fc fc
==================================================================