betop 0003:11C0:5506.0001: hidraw0: USB HID v0.00 Device [HID 11c0:5506] on usb-dummy_hcd.1-1/input0 ================================================================== BUG: KASAN: slab-out-of-bounds in instrument_atomic_write include/linux/instrumented.h:86 [inline] BUG: KASAN: slab-out-of-bounds in set_bit include/asm-generic/bitops/instrumented-atomic.h:28 [inline] BUG: KASAN: slab-out-of-bounds in betopff_init drivers/hid/hid-betopff.c:99 [inline] BUG: KASAN: slab-out-of-bounds in betop_probe+0x3ee/0x620 drivers/hid/hid-betopff.c:144 Write of size 8 at addr ffff88801d62eac0 by task kworker/1:1/25 CPU: 1 PID: 25 Comm: kworker/1:1 Not tainted 5.14.0-rc5-next-20210813-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x6c/0x2d6 mm/kasan/report.c:256 __kasan_report mm/kasan/report.c:442 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189 instrument_atomic_write include/linux/instrumented.h:86 [inline] set_bit include/asm-generic/bitops/instrumented-atomic.h:28 [inline] betopff_init drivers/hid/hid-betopff.c:99 [inline] betop_probe+0x3ee/0x620 drivers/hid/hid-betopff.c:144 hid_device_probe+0x2bd/0x3f0 drivers/hid/hid-core.c:2287 call_driver_probe drivers/base/dd.c:517 [inline] really_probe+0x245/0xcc0 drivers/base/dd.c:596 __driver_probe_device+0x338/0x4d0 drivers/base/dd.c:751 driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:781 __device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:898 bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427 __device_attach+0x228/0x4a0 drivers/base/dd.c:969 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487 device_add+0xc35/0x21b0 drivers/base/core.c:3359 hid_add_device+0x344/0x9d0 drivers/hid/hid-core.c:2437 usbhid_probe+0xba9/0x10b0 drivers/hid/usbhid/hid-core.c:1428 usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:517 [inline] really_probe+0x245/0xcc0 drivers/base/dd.c:596 __driver_probe_device+0x338/0x4d0 drivers/base/dd.c:751 driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:781 __device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:898 bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427 __device_attach+0x228/0x4a0 drivers/base/dd.c:969 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487 device_add+0xc35/0x21b0 drivers/base/core.c:3359 usb_set_configuration+0x113a/0x1910 drivers/usb/core/message.c:2170 usb_generic_driver_probe+0xba/0x100 drivers/usb/core/generic.c:238 usb_probe_device+0xd9/0x2c0 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:517 [inline] really_probe+0x245/0xcc0 drivers/base/dd.c:596 __driver_probe_device+0x338/0x4d0 drivers/base/dd.c:751 driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:781 __device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:898 bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427 __device_attach+0x228/0x4a0 drivers/base/dd.c:969 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487 device_add+0xc35/0x21b0 drivers/base/core.c:3359 usb_new_device.cold+0x63f/0x108e drivers/usb/core/hub.c:2563 hub_port_connect drivers/usb/core/hub.c:5348 [inline] hub_port_connect_change drivers/usb/core/hub.c:5488 [inline] port_event drivers/usb/core/hub.c:5634 [inline] hub_event+0x2357/0x4330 drivers/usb/core/hub.c:5716 process_one_work+0x98d/0x1630 kernel/workqueue.c:2275 worker_thread+0x658/0x11f0 kernel/workqueue.c:2421 kthread+0x3e5/0x4d0 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Allocated by task 25: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] ____kasan_kmalloc mm/kasan/common.c:513 [inline] ____kasan_kmalloc mm/kasan/common.c:472 [inline] __kasan_kmalloc+0x98/0xc0 mm/kasan/common.c:522 kasan_kmalloc include/linux/kasan.h:264 [inline] kmem_cache_alloc_trace+0x1e4/0x480 mm/slab.c:3575 kmalloc include/linux/slab.h:591 [inline] kzalloc include/linux/slab.h:721 [inline] hidraw_connect+0x4b/0x440 drivers/hid/hidraw.c:543 hid_connect+0x5be/0xbc0 drivers/hid/hid-core.c:1960 hid_hw_start drivers/hid/hid-core.c:2059 [inline] hid_hw_start+0xa2/0x130 drivers/hid/hid-core.c:2050 betop_probe+0x10d/0x620 drivers/hid/hid-betopff.c:138 hid_device_probe+0x2bd/0x3f0 drivers/hid/hid-core.c:2287 call_driver_probe drivers/base/dd.c:517 [inline] really_probe+0x245/0xcc0 drivers/base/dd.c:596 __driver_probe_device+0x338/0x4d0 drivers/base/dd.c:751 driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:781 __device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:898 bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427 __device_attach+0x228/0x4a0 drivers/base/dd.c:969 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487 device_add+0xc35/0x21b0 drivers/base/core.c:3359 hid_add_device+0x344/0x9d0 drivers/hid/hid-core.c:2437 usbhid_probe+0xba9/0x10b0 drivers/hid/usbhid/hid-core.c:1428 usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:517 [inline] really_probe+0x245/0xcc0 drivers/base/dd.c:596 __driver_probe_device+0x338/0x4d0 drivers/base/dd.c:751 driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:781 __device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:898 bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427 __device_attach+0x228/0x4a0 drivers/base/dd.c:969 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487 device_add+0xc35/0x21b0 drivers/base/core.c:3359 usb_set_configuration+0x113a/0x1910 drivers/usb/core/message.c:2170 usb_generic_driver_probe+0xba/0x100 drivers/usb/core/generic.c:238 usb_probe_device+0xd9/0x2c0 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:517 [inline] really_probe+0x245/0xcc0 drivers/base/dd.c:596 __driver_probe_device+0x338/0x4d0 drivers/base/dd.c:751 driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:781 __device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:898 bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427 __device_attach+0x228/0x4a0 drivers/base/dd.c:969 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487 device_add+0xc35/0x21b0 drivers/base/core.c:3359 usb_new_device.cold+0x63f/0x108e drivers/usb/core/hub.c:2563 hub_port_connect drivers/usb/core/hub.c:5348 [inline] hub_port_connect_change drivers/usb/core/hub.c:5488 [inline] port_event drivers/usb/core/hub.c:5634 [inline] hub_event+0x2357/0x4330 drivers/usb/core/hub.c:5716 process_one_work+0x98d/0x1630 kernel/workqueue.c:2275 worker_thread+0x658/0x11f0 kernel/workqueue.c:2421 kthread+0x3e5/0x4d0 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Last potentially related work creation: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38 kasan_record_aux_stack+0xa4/0xd0 mm/kasan/generic.c:348 insert_work+0x48/0x370 kernel/workqueue.c:1332 __queue_work+0x5c1/0xed0 kernel/workqueue.c:1498 queue_work_on+0xee/0x110 kernel/workqueue.c:1525 queue_work include/linux/workqueue.h:507 [inline] call_usermodehelper_exec+0x1f0/0x4c0 kernel/umh.c:435 kobject_uevent_env+0xf8f/0x1650 lib/kobject_uevent.c:618 netdev_queue_add_kobject net/core/net-sysfs.c:1621 [inline] netdev_queue_update_kobjects+0x37a/0x460 net/core/net-sysfs.c:1655 register_queue_kobjects net/core/net-sysfs.c:1716 [inline] netdev_register_kobject+0x35a/0x430 net/core/net-sysfs.c:1959 register_netdevice+0xd33/0x1500 net/core/dev.c:10295 veth_newlink+0x3f5/0xb20 drivers/net/veth.c:1695 __rtnl_newlink+0x106d/0x1750 net/core/rtnetlink.c:3457 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3505 rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5571 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340 netlink_sendmsg+0x86d/0xdb0 net/netlink/af_netlink.c:1929 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:724 __sys_sendto+0x21c/0x320 net/socket.c:2030 __do_sys_sendto net/socket.c:2042 [inline] __se_sys_sendto net/socket.c:2038 [inline] __x64_sys_sendto+0xdd/0x1b0 net/socket.c:2038 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Second to last potentially related work creation: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38 kasan_record_aux_stack+0xa4/0xd0 mm/kasan/generic.c:348 insert_work+0x48/0x370 kernel/workqueue.c:1332 __queue_work+0x5c1/0xed0 kernel/workqueue.c:1498 queue_work_on+0xee/0x110 kernel/workqueue.c:1525 queue_work include/linux/workqueue.h:507 [inline] call_usermodehelper_exec+0x1f0/0x4c0 kernel/umh.c:435 kobject_uevent_env+0xf8f/0x1650 lib/kobject_uevent.c:618 __kobject_del+0x169/0x200 lib/kobject.c:617 kobject_cleanup lib/kobject.c:696 [inline] kobject_release lib/kobject.c:736 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x2b6/0x540 lib/kobject.c:753 netdev_queue_update_kobjects+0x310/0x460 net/core/net-sysfs.c:1670 netif_set_real_num_tx_queues+0x1b6/0x760 net/core/dev.c:2916 veth_init_queues+0xdd/0x190 drivers/net/veth.c:1617 veth_newlink+0x760/0xb20 drivers/net/veth.c:1744 __rtnl_newlink+0x106d/0x1750 net/core/rtnetlink.c:3457 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3505 rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5571 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340 netlink_sendmsg+0x86d/0xdb0 net/netlink/af_netlink.c:1929 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:724 __sys_sendto+0x21c/0x320 net/socket.c:2030 __do_sys_sendto net/socket.c:2042 [inline] __se_sys_sendto net/socket.c:2038 [inline] __x64_sys_sendto+0xdd/0x1b0 net/socket.c:2038 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae The buggy address belongs to the object at ffff88801d62ea00 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 0 bytes to the right of 192-byte region [ffff88801d62ea00, ffff88801d62eac0) The buggy address belongs to the page: page:ffffea0000758b80 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88801d62e900 pfn:0x1d62e flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000200 ffffea000052fdc8 ffffea0000806888 ffff888010c40000 raw: ffff88801d62e900 ffff88801d62e000 000000010000000f 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2420c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_COMP|__GFP_THISNODE), pid 159, ts 8318181658, free_ts 0 prep_new_page mm/page_alloc.c:2424 [inline] get_page_from_freelist+0xa72/0x2f80 mm/page_alloc.c:4151 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5373 __alloc_pages_node include/linux/gfp.h:566 [inline] kmem_getpages mm/slab.c:1377 [inline] cache_grow_begin+0x75/0x460 mm/slab.c:2593 cache_alloc_refill+0x27f/0x380 mm/slab.c:2965 ____cache_alloc mm/slab.c:3048 [inline] ____cache_alloc mm/slab.c:3031 [inline] __do_cache_alloc mm/slab.c:3275 [inline] slab_alloc mm/slab.c:3316 [inline] kmem_cache_alloc_trace+0x38c/0x480 mm/slab.c:3573 kmalloc include/linux/slab.h:591 [inline] blk_stat_alloc_callback+0x54/0x290 block/blk-stat.c:109 blk_mq_init_allocated_queue+0x89/0x13c0 block/blk-mq.c:3272 blk_mq_init_queue_data block/blk-mq.c:3122 [inline] blk_mq_init_queue+0x75/0xd0 block/blk-mq.c:3132 scsi_alloc_sdev+0x814/0xd70 drivers/scsi/scsi_scan.c:272 scsi_probe_and_add_lun+0x200b/0x3590 drivers/scsi/scsi_scan.c:1106 __scsi_scan_target+0x21f/0xdb0 drivers/scsi/scsi_scan.c:1588 scsi_scan_channel drivers/scsi/scsi_scan.c:1676 [inline] scsi_scan_channel+0x148/0x1e0 drivers/scsi/scsi_scan.c:1652 scsi_scan_host_selected+0x2df/0x3b0 drivers/scsi/scsi_scan.c:1705 do_scsi_scan_host+0x1e8/0x260 drivers/scsi/scsi_scan.c:1844 do_scan_async+0x3e/0x500 drivers/scsi/scsi_scan.c:1854 async_run_entry_fn+0x9d/0x550 kernel/async.c:127 page_owner free stack trace missing Memory state around the buggy address: ffff88801d62e980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff88801d62ea00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff88801d62ea80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc ^ ffff88801d62eb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88801d62eb80: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================