hid-generic 0000:0000:0000.0013: unknown main item tag 0x0
hid-generic 0000:0000:0000.0013: unknown main item tag 0x0
hid-generic 0000:0000:0000.0013: unknown main item tag 0x0
hid-generic 0000:0000:0000.0013: unknown main item tag 0x0
==================================================================
BUG: KASAN: use-after-free in __write_once_size include/linux/compiler.h:247 [inline]
BUG: KASAN: use-after-free in __hlist_del include/linux/list.h:632 [inline]
BUG: KASAN: use-after-free in hlist_del_rcu include/linux/rculist.h:340 [inline]
BUG: KASAN: use-after-free in nf_nat_cleanup_conntrack+0x1ca/0x1e0 net/netfilter/nf_nat_core.c:691
Write of size 8 at addr ffff8801c1b760f8 by task kworker/0:0/4

CPU: 0 PID: 4 Comm: kworker/0:0 Not tainted 4.4.174+ #17
Workqueue: events uhid_device_add_worker
 0000000000000000 dc1a975669efef1d ffff8801db607a10 ffffffff81aad1a1
 0000000000000001 ffffea000706dd80 ffff8801c1b760f8 0000000000000008
 ffffffff82361100 ffff8801db607a48 ffffffff81490120 0000000000000001
Call Trace:
 <IRQ>  [<ffffffff81aad1a1>] __dump_stack lib/dump_stack.c:15 [inline]
 <IRQ>  [<ffffffff81aad1a1>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
 [<ffffffff81490120>] print_address_description+0x6f/0x21b mm/kasan/report.c:252
 [<ffffffff81490358>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff81490358>] kasan_report mm/kasan/report.c:408 [inline]
 [<ffffffff81490358>] kasan_report.cold+0x8c/0x2be mm/kasan/report.c:393
 [<ffffffff81484f77>] __asan_report_store8_noabort+0x17/0x20 mm/kasan/report.c:434
 [<ffffffff823612ca>] __write_once_size include/linux/compiler.h:247 [inline]
 [<ffffffff823612ca>] __hlist_del include/linux/list.h:632 [inline]
 [<ffffffff823612ca>] hlist_del_rcu include/linux/rculist.h:340 [inline]
 [<ffffffff823612ca>] nf_nat_cleanup_conntrack+0x1ca/0x1e0 net/netfilter/nf_nat_core.c:691
 [<ffffffff8232d7b0>] __nf_ct_ext_destroy+0x140/0x2a0 net/netfilter/nf_conntrack_extend.c:40
 [<ffffffff8230e217>] nf_ct_ext_destroy include/net/netfilter/nf_conntrack_extend.h:80 [inline]
 [<ffffffff8230e217>] nf_conntrack_free+0x77/0x120 net/netfilter/nf_conntrack_core.c:904
 [<ffffffff823116f0>] destroy_conntrack+0x270/0x380 net/netfilter/nf_conntrack_core.c:365
 [<ffffffff822f6cd9>] nf_conntrack_destroy+0x99/0x1a0 net/netfilter/core.c:389
 [<ffffffff821eff3a>] nf_conntrack_put include/linux/skbuff.h:3377 [inline]
 [<ffffffff821eff3a>] skb_release_head_state+0x15a/0x210 net/core/skbuff.c:649
 [<ffffffff821fd0e6>] skb_release_all+0x16/0x60 net/core/skbuff.c:659
 [<ffffffff821fd257>] __kfree_skb net/core/skbuff.c:675 [inline]
 [<ffffffff821fd257>] kfree_skb+0xf7/0x400 net/core/skbuff.c:696
 [<ffffffff823b8e9a>] inet_frag_rbtree_purge+0xaa/0xf0 net/ipv4/ip_fragment.c:761
 [<ffffffff824e152f>] inet_frag_destroy+0x21f/0x2c0 net/ipv4/inet_fragment.c:156
 [<ffffffff823b8f14>] inet_frag_put include/net/inet_frag.h:124 [inline]
 [<ffffffff823b8f14>] ipq_put+0x34/0x40 net/ipv4/ip_fragment.c:164
 [<ffffffff823b954d>] ip_expire+0x14d/0x880 net/ipv4/ip_fragment.c:265
 [<ffffffff812582dd>] call_timer_fn+0x18d/0x850 kernel/time/timer.c:1185
 [<ffffffff81258ebf>] __run_timers kernel/time/timer.c:1261 [inline]
 [<ffffffff81258ebf>] run_timer_softirq+0x51f/0xb70 kernel/time/timer.c:1444
 [<ffffffff8271bb16>] __do_softirq+0x226/0xa3f kernel/softirq.c:273
 [<ffffffff810e1a8a>] invoke_softirq kernel/softirq.c:350 [inline]
 [<ffffffff810e1a8a>] irq_exit+0x10a/0x150 kernel/softirq.c:391
 [<ffffffff8271b24e>] exiting_irq arch/x86/include/asm/apic.h:652 [inline]
 [<ffffffff8271b24e>] smp_apic_timer_interrupt+0x7e/0xb0 arch/x86/kernel/apic/apic.c:926
 [<ffffffff8271a59d>] apic_timer_interrupt+0x9d/0xb0 arch/x86/entry/entry_64.S:768
 <EOI>  [<ffffffff8121fe56>] ? console_unlock kernel/printk/printk.c:2337 [inline]
 <EOI>  [<ffffffff8121fe56>] ? console_unlock+0x656/0xa10 kernel/printk/printk.c:2242
 [<ffffffff812205c2>] vprintk_emit+0x3b2/0x820 kernel/printk/printk.c:1837
 [<ffffffff81cfa2b2>] dev_vprintk_emit+0x222/0x670 drivers/base/core.c:2205
 [<ffffffff81cfa7bb>] dev_printk_emit+0xbb/0xf0 drivers/base/core.c:2216
 [<ffffffff81cfaa77>] __dev_printk+0x107/0x270 drivers/base/core.c:2228
 [<ffffffff81cfb0f8>] dev_err+0xd8/0x110 drivers/base/core.c:2271
 [<ffffffff8203eba3>] hid_parser_main+0x593/0x9a0 drivers/hid/hid-core.c:555
 [<ffffffff8203c26a>] hid_open_report+0x34a/0x6a0 drivers/hid/hid-core.c:1010
 [<ffffffff820403d5>] hid_device_probe+0x255/0x4c0 drivers/hid/hid-core.c:2183
 [<ffffffff81d060e5>] really_probe drivers/base/dd.c:310 [inline]
 [<ffffffff81d060e5>] driver_probe_device+0x205/0x680 drivers/base/dd.c:423
 [<ffffffff81d068c2>] __device_attach_driver+0x1e2/0x240 drivers/base/dd.c:508
 [<ffffffff81d000cf>] bus_for_each_drv+0x16f/0x200 drivers/base/bus.c:467
 [<ffffffff81d05d8d>] __device_attach+0x21d/0x320 drivers/base/dd.c:565
 [<ffffffff81d069bb>] device_initial_probe+0x1b/0x20 drivers/base/dd.c:612
 [<ffffffff81d03ab7>] bus_probe_device+0x1e7/0x290 drivers/base/bus.c:561
 [<ffffffff81cfd034>] device_add+0xa44/0x1490 drivers/base/core.c:1142
 [<ffffffff820443db>] hid_add_device drivers/hid/hid-core.c:2656 [inline]
 [<ffffffff820443db>] hid_add_device+0x33b/0x990 drivers/hid/hid-core.c:2607
 [<ffffffff8205b9ff>] uhid_device_add_worker+0x3f/0x150 drivers/hid/uhid.c:68
 [<ffffffff81122c25>] process_one_work+0x825/0x1720 kernel/workqueue.c:2064
 [<ffffffff81124004>] worker_thread+0x4e4/0xf50 kernel/workqueue.c:2196
 [<ffffffff811342c3>] kthread+0x273/0x310 kernel/kthread.c:211
 [<ffffffff82718fc5>] ret_from_fork+0x55/0x80 arch/x86/entry/entry_64.S:537

The buggy address belongs to the page:
page:ffffea000706dd80 count:0 mapcount:0 mapping:          (null) index:0x0
flags: 0x4000000000000000()
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801c1b75f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8801c1b76000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8801c1b76080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                                ^
 ffff8801c1b76100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8801c1b76180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================