==================================================================
BUG: KASAN: slab-out-of-bounds in mcp2221_raw_event+0x101c/0x1090 drivers/hid/hid-mcp2221.c:964
Read of size 1 at addr ffff88811420bfff by task syz.5.3459/20351

CPU: 0 UID: 0 PID: 20351 Comm: syz.5.3459 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
 mcp2221_raw_event+0x101c/0x1090 drivers/hid/hid-mcp2221.c:964
 __hid_input_report.constprop.0+0x319/0x470 drivers/hid/hid-core.c:2168
 hid_irq_in+0x55d/0x710 drivers/hid/usbhid/hid-core.c:287
 __usb_hcd_giveback_urb+0x38d/0x610 drivers/usb/core/hcd.c:1657
 usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
 dummy_timer+0xda1/0x36c0 drivers/usb/gadget/udc/dummy_hcd.c:2005
 __run_hrtimer kernel/time/hrtimer.c:2032 [inline]
 __hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2096
 hrtimer_run_softirq+0x17d/0x2c0 kernel/time/hrtimer.c:2113
 handle_softirqs+0x1dd/0x990 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x160/0x210 kernel/softirq.c:735
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__sanitizer_cov_trace_pc+0x3f/0x70 kernel/kcov.c:217
Code: 4a 0b a9 00 01 ff 00 74 1b f6 c4 01 74 07 a9 00 00 ff 00 74 05 c3 cc cc cc cc 8b 82 44 16 00 00 85 c0 74 f1 8b 82 18 16 00 00 <83> f8 02 75 e6 48 8b 8a 20 16 00 00 8b 92 1c 16 00 00 48 8b 01 48
RSP: 0018:ffffc90006777548 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88813351bc00 RSI: ffffffff8209ff1a RDI: ffffc90006777a70
RBP: ffffc90006777a70 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000000 R12: ffffea00050ae180
R13: 0000000000000001 R14: 0000000000000000 R15: 8000000142b86007
 __tlb_remove_folio_pages+0x1a/0x40 mm/mmu_gather.c:210
 zap_present_folio_ptes mm/memory.c:1677 [inline]
 zap_present_ptes mm/memory.c:1730 [inline]
 do_zap_pte_range mm/memory.c:1832 [inline]
 zap_pte_range mm/memory.c:1934 [inline]
 zap_pmd_range mm/memory.c:2020 [inline]
 zap_pud_range mm/memory.c:2048 [inline]
 zap_p4d_range mm/memory.c:2069 [inline]
 __zap_vma_range+0x1165/0x3fd0 mm/memory.c:2109
 unmap_vmas+0x299/0x5f0 mm/memory.c:2178
 exit_mmap+0x1ef/0xa00 mm/mmap.c:1300
 __mmput kernel/fork.c:1187 [inline]
 mmput+0xe0/0x430 kernel/fork.c:1210
 exit_mm kernel/exit.c:615 [inline]
 do_exit+0x833/0x2a50 kernel/exit.c:997
 do_group_exit+0xd5/0x2a0 kernel/exit.c:1152
 get_signal+0x1ec7/0x21e0 kernel/signal.c:3046
 arch_do_signal_or_restart+0x91/0x7e0 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
 exit_to_user_mode_loop+0xd2/0x530 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
 do_syscall_64+0x682/0x7f0 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5853f8db2b
Code: Unable to access opcode bytes at 0x7f5853f8db01.
RSP: 002b:00007f58529a2f50 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: fffffffffffffffc RBX: 0000000000000003 RCX: 00007f5853f8db2b
RDX: 00007f58529a3fe0 RSI: 0000000080085502 RDI: 0000000000000003
RBP: 00007f5854023eaf R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f5854216180 R15: 00007ffe99623028
 </TASK>

Allocated by task 19920:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5362 [inline]
 __kmalloc_flags_noprof+0x341/0x840 mm/slub.c:5554
 _kmalloc_flags_noprof mm/slab.h:38 [inline]
 alloc_slab_obj_exts+0xb2/0x250 mm/slub.c:2181
 account_slab mm/slub.c:3365 [inline]
 allocate_slab mm/slub.c:3439 [inline]
 new_slab+0x494/0x670 mm/slub.c:3454
 refill_objects+0xe3/0x410 mm/slub.c:7338
 refill_sheaf mm/slub.c:2832 [inline]
 __pcs_replace_empty_main+0x376/0x680 mm/slub.c:4703
 alloc_from_pcs mm/slub.c:4801 [inline]
 slab_alloc_node mm/slub.c:4933 [inline]
 kmem_cache_alloc_noprof+0x4de/0x640 mm/slub.c:4959
 anon_vma_chain_alloc mm/rmap.c:142 [inline]
 anon_vma_fork+0x19a/0x6b0 mm/rmap.c:394
 dup_mmap+0x1156/0x1f60 mm/mmap.c:1803
 dup_mm kernel/fork.c:1543 [inline]
 copy_mm kernel/fork.c:1595 [inline]
 copy_process+0x4996/0x7dd0 kernel/fork.c:2289
 kernel_clone+0x176/0x9d0 kernel/fork.c:2748
 __do_sys_clone+0xd9/0x120 kernel/fork.c:2889
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x10b/0x7f0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 15419:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x43/0x70 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2705 [inline]
 slab_free mm/slub.c:6405 [inline]
 kfree+0x20c/0x650 mm/slub.c:6720
 free_slab_obj_exts mm/slub.c:2265 [inline]
 unaccount_slab mm/slub.c:3380 [inline]
 __free_slab+0x13d/0x220 mm/slub.c:3467
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x4e/0x70 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4612 [inline]
 slab_alloc_node mm/slub.c:4945 [inline]
 __do_kmalloc_node mm/slub.c:5361 [inline]
 __kmalloc_noprof+0x2c1/0x7c0 mm/slub.c:5387
 _kmalloc_noprof include/linux/slab.h:973 [inline]
 usb_get_configuration+0x39a/0x4410 drivers/usb/core/config.c:969
 usb_enumerate_device drivers/usb/core/hub.c:2532 [inline]
 usb_new_device+0x580/0x7d0 drivers/usb/core/hub.c:2670
 hub_port_connect drivers/usb/core/hub.c:5572 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5712 [inline]
 port_event drivers/usb/core/hub.c:5876 [inline]
 hub_event+0x314d/0x4af0 drivers/usb/core/hub.c:5958
 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
 process_scheduled_works kernel/workqueue.c:3405 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

The buggy address belongs to the object at ffff88811420bc00
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 511 bytes to the right of
 allocated 512-byte region [ffff88811420bc00, ffff88811420be00)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x114208
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x200000000000040(head|node=0|zone=2)
page_type: f5(slab)
raw: 0200000000000040 ffff888100041c80 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 0200000000000040 ffff888100041c80 dead000000000100 dead000000000122
head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 0200000000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5211, tgid 5211 (udevd), ts 143984738256, free_ts 143878758920
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859
 prep_new_page mm/page_alloc.c:1867 [inline]
 get_page_from_freelist+0xf25/0x3400 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x28f/0x2b90 mm/page_alloc.c:5304
 alloc_slab_page mm/slub.c:3294 [inline]
 allocate_slab mm/slub.c:3408 [inline]
 new_slab+0xa2/0x670 mm/slub.c:3454
 refill_objects+0xe3/0x410 mm/slub.c:7338
 refill_sheaf mm/slub.c:2832 [inline]
 __pcs_replace_empty_main+0x376/0x680 mm/slub.c:4703
 alloc_from_pcs mm/slub.c:4801 [inline]
 slab_alloc_node mm/slub.c:4933 [inline]
 __kmalloc_cache_noprof+0x50e/0x670 mm/slub.c:5511
 _kmalloc_noprof include/linux/slab.h:969 [inline]
 _kzalloc_noprof include/linux/slab.h:1290 [inline]
 kernfs_fop_open+0x23d/0xd50 fs/kernfs/file.c:634
 do_dentry_open+0x68b/0x14b0 fs/open.c:947
 vfs_open+0x82/0x3f0 fs/open.c:1052
 do_open fs/namei.c:4700 [inline]
 path_openat+0x2873/0x4280 fs/namei.c:4863
 do_file_open+0x20e/0x430 fs/namei.c:4892
 do_sys_openat2+0x10f/0x1e0 fs/open.c:1368
 do_sys_open fs/open.c:1374 [inline]
 __do_sys_openat fs/open.c:1390 [inline]
 __se_sys_openat fs/open.c:1385 [inline]
 __x64_sys_openat+0x12d/0x210 fs/open.c:1385
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x10b/0x7f0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5245 tgid 5245 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1406 [inline]
 __free_frozen_pages+0x716/0xf50 mm/page_alloc.c:2950
 stack_depot_save_flags+0x435/0x9d0 lib/stackdepot.c:735
 kasan_save_stack+0x3f/0x50 mm/kasan/common.c:58
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x35e/0x670 mm/slub.c:5515
 _kmalloc_noprof include/linux/slab.h:969 [inline]
 _kzalloc_noprof include/linux/slab.h:1290 [inline]
 kobject_uevent_env+0x263/0x18b0 lib/kobject_uevent.c:543
 device_del+0x605/0x9b0 drivers/base/core.c:3979
 device_unregister+0x1d/0xe0 drivers/base/core.c:4002
 i2c_del_adapter+0x1cc/0x2d0 drivers/i2c/i2c-core-base.c:1839
 dvb_usb_i2c_exit+0x9f/0xf0 drivers/media/usb/dvb-usb/dvb-usb-i2c.c:46
 dvb_usb_exit drivers/media/usb/dvb-usb/dvb-usb-init.c:144 [inline]
 dvb_usb_device_exit+0x313/0x520 drivers/media/usb/dvb-usb/dvb-usb-init.c:338
 usb_unbind_interface+0x1dd/0x9e0 drivers/usb/core/driver.c:461
 device_remove drivers/base/dd.c:618 [inline]
 device_remove+0x12a/0x180 drivers/base/dd.c:610
 __device_release_driver drivers/base/dd.c:1349 [inline]
 device_release_driver_internal+0x44e/0x620 drivers/base/dd.c:1372
 bus_remove_device+0x2bc/0x560 drivers/base/bus.c:664

Memory state around the buggy address:
 ffff88811420be80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88811420bf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88811420bf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                                                                ^
 ffff88811420c000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88811420c080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess):
   0:	4a 0b a9 00 01 ff 00 	rex.WX or 0xff0100(%rcx),%rbp
   7:	74 1b                	je     0x24
   9:	f6 c4 01             	test   $0x1,%ah
   c:	74 07                	je     0x15
   e:	a9 00 00 ff 00       	test   $0xff0000,%eax
  13:	74 05                	je     0x1a
  15:	c3                   	ret
  16:	cc                   	int3
  17:	cc                   	int3
  18:	cc                   	int3
  19:	cc                   	int3
  1a:	8b 82 44 16 00 00    	mov    0x1644(%rdx),%eax
  20:	85 c0                	test   %eax,%eax
  22:	74 f1                	je     0x15
  24:	8b 82 18 16 00 00    	mov    0x1618(%rdx),%eax
* 2a:	83 f8 02             	cmp    $0x2,%eax <-- trapping instruction
  2d:	75 e6                	jne    0x15
  2f:	48 8b 8a 20 16 00 00 	mov    0x1620(%rdx),%rcx
  36:	8b 92 1c 16 00 00    	mov    0x161c(%rdx),%edx
  3c:	48 8b 01             	mov    (%rcx),%rax
  3f:	48                   	rex.W