hid-picolcd 0003:04D8:C002.0011: offset (1) exceeds report_count (1)
==================================================================
BUG: KASAN: slab-out-of-bounds in hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
Read of size 4 at addr ffff888074beb3c0 by task kworker/1:1/11317
CPU: 1 UID: 0 PID: 11317 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Workqueue: events fb_deferred_io_work
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x13d/0x4b0 mm/kasan/report.c:482
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
hid_set_field+0xeb/0x2e0 drivers/hid/hid-core.c:1936
picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:112 [inline]
picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
picolcd_fb_deferred_io+0x46b/0x1310 drivers/hid/hid-picolcd_fb.c:403
hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
hid_set_field+0xeb/0x2e0 drivers/hid/hid-core.c:1936
picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:130 [inline]
picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
picolcd_fb_deferred_io+0x6ba/0x1310 drivers/hid/hid-picolcd_fb.c:403
fb_deferred_io_work+0x1bc/0x4a0 drivers/video/fbdev/core/fb_defio.c:405
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
hid_set_field+0xeb/0x2e0 drivers/hid/hid-core.c:1936
picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:130 [inline]
picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
picolcd_fb_deferred_io+0x6ba/0x1310 drivers/hid/hid-picolcd_fb.c:403
fb_deferred_io_work+0x1bc/0x4a0 drivers/video/fbdev/core/fb_defio.c:405
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Allocated by task 6390:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5334 [inline]
__kmalloc_flags_noprof+0x371/0x8b0 mm/slub.c:5528
_kmalloc_flags_noprof mm/slab.h:39 [inline]
alloc_slab_obj_exts+0x5a/0x160 mm/slub.c:2149
__memcg_slab_post_alloc_hook+0x3d4/0x1160 mm/memcontrol.c:3587
memcg_slab_post_alloc_hook mm/slub.c:2447 [inline]
slab_post_alloc_hook mm/slub.c:4603 [inline]
slab_alloc_node mm/slub.c:4917 [inline]
kmem_cache_alloc_lru_noprof+0x583/0x6a0 mm/slub.c:4950
__d_alloc+0x35/0xa50 fs/dcache.c:1902
d_alloc_pseudo+0x1c/0xc0 fs/dcache.c:2033
alloc_path_pseudo fs/file_table.c:407 [inline]
alloc_file_pseudo+0x118/0x290 fs/file_table.c:423
__anon_inode_getfile+0xe8/0x280 fs/anon_inodes.c:164
__anon_inode_getfd+0x5c/0xe0 fs/anon_inodes.c:281
fscontext_create_fd fs/fsopen.c:96 [inline]
__do_sys_fsopen fs/fsopen.c:153 [inline]
__se_sys_fsopen fs/fsopen.c:120 [inline]
__x64_sys_fsopen+0x190/0x220 fs/fsopen.c:120
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
hid_set_field+0xeb/0x2e0 drivers/hid/hid-core.c:1936
picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:130 [inline]
picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
picolcd_fb_deferred_io+0x6ba/0x1310 drivers/hid/hid-picolcd_fb.c:403
fb_deferred_io_work+0x1bc/0x4a0 drivers/video/fbdev/core/fb_defio.c:405
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Allocated by task 6390:
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
hid_set_field+0xeb/0x2e0 drivers/hid/hid-core.c:1936
picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:130 [inline]
picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
picolcd_fb_deferred_io+0x6ba/0x1310 drivers/hid/hid-picolcd_fb.c:403
fb_deferred_io_work+0x1bc/0x4a0 drivers/video/fbdev/core/fb_defio.c:405
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
hid_set_field+0xeb/0x2e0 drivers/hid/hid-core.c:1936
picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:130 [inline]
picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
picolcd_fb_deferred_io+0x6ba/0x1310 drivers/hid/hid-picolcd_fb.c:403
fb_deferred_io_work+0x1bc/0x4a0 drivers/video/fbdev/core/fb_defio.c:405
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
hid_set_field+0xeb/0x2e0 drivers/hid/hid-core.c:1936
picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:130 [inline]
picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
picolcd_fb_deferred_io+0x6ba/0x1310 drivers/hid/hid-picolcd_fb.c:403
fb_deferred_io_work+0x1bc/0x4a0 drivers/video/fbdev/core/fb_defio.c:405
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
hid_set_field+0xeb/0x2e0 drivers/hid/hid-core.c:1936
picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:130 [inline]
picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
picolcd_fb_deferred_io+0x6ba/0x1310 drivers/hid/hid-picolcd_fb.c:403
fb_deferred_io_work+0x1bc/0x4a0 drivers/video/fbdev/core/fb_defio.c:405
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
hid_set_field+0xeb/0x2e0 drivers/hid/hid-core.c:1936
picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:130 [inline]
picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
picolcd_fb_deferred_io+0x6ba/0x1310 drivers/hid/hid-picolcd_fb.c:403
fb_deferred_io_work+0x1bc/0x4a0 drivers/video/fbdev/core/fb_defio.c:405
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
hid_set_field+0xeb/0x2e0 drivers/hid/hid-core.c:1936
picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:130 [inline]
picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
picolcd_fb_deferred_io+0x6ba/0x1310 drivers/hid/hid-picolcd_fb.c:403
fb_deferred_io_work+0x1bc/0x4a0 drivers/video/fbdev/core/fb_defio.c:405
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
hid_set_field+0xeb/0x2e0 drivers/hid/hid-core.c:1936
picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:130 [inline]
picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
picolcd_fb_deferred_io+0x6ba/0x1310 drivers/hid/hid-picolcd_fb.c:403
fb_deferred_io_work+0x1bc/0x4a0 drivers/video/fbdev/core/fb_defio.c:405
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
hid_set_field+0xeb/0x2e0 drivers/hid/hid-core.c:1936
picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:130 [inline]
picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
picolcd_fb_deferred_io+0x6ba/0x1310 drivers/hid/hid-picolcd_fb.c:403
fb_deferred_io_work+0x1bc/0x4a0 drivers/video/fbdev/core/fb_defio.c:405
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
hid_set_field+0xeb/0x2e0 drivers/hid/hid-core.c:1936
picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:130 [inline]
picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
picolcd_fb_deferred_io+0x6ba/0x1310 drivers/hid/hid-picolcd_fb.c:403
fb_deferred_io_work+0x1bc/0x4a0 drivers/video/fbdev/core/fb_defio.c:405
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
hid_set_field+0xeb/0x2e0 drivers/hid/hid-core.c:1936
picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:130 [inline]
picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
picolcd_fb_deferred_io+0x6ba/0x1310 drivers/hid/hid-picolcd_fb.c:403
fb_deferred_io_work+0x1bc/0x4a0 drivers/video/fbdev/core/fb_defio.c:405
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
hid_set_field+0xeb/0x2e0 drivers/hid/hid-core.c:1936
picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:130 [inline]
picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
picolcd_fb_deferred_io+0x6ba/0x1310 drivers/hid/hid-picolcd_fb.c:403
fb_deferred_io_work+0x1bc/0x4a0 drivers/video/fbdev/core/fb_defio.c:405
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
hid_set_field+0xeb/0x2e0 drivers/hid/hid-core.c:1936
picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:130 [inline]
picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
picolcd_fb_deferred_io+0x6ba/0x1310 drivers/hid/hid-picolcd_fb.c:403
fb_deferred_io_work+0x1bc/0x4a0 drivers/video/fbdev/core/fb_defio.c:405
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
hid_set_field+0xeb/0x2e0 drivers/hid/hid-core.c:1936
picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:130 [inline]
picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
picolcd_fb_deferred_io+0x6ba/0x1310 drivers/hid/hid-picolcd_fb.c:403
fb_deferred_io_work+0x1bc/0x4a0 drivers/video/fbdev/core/fb_defio.c:405
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
hid_set_field+0xeb/0x2e0 drivers/hid/hid-core.c:1936
picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:130 [inline]
picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
picolcd_fb_deferred_io+0x6ba/0x1310 drivers/hid/hid-picolcd_fb.c:403
fb_deferred_io_work+0x1bc/0x4a0 drivers/video/fbdev/core/fb_defio.c:405
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
hid_set_field+0xeb/0x2e0 drivers/hid/hid-core.c:1936
picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:130 [inline]
picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
picolcd_fb_deferred_io+0x6ba/0x1310 drivers/hid/hid-picolcd_fb.c:403
fb_deferred_io_work+0x1bc/0x4a0 drivers/video/fbdev/core/fb_defio.c:405
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
hid_set_field+0xeb/0x2e0 drivers/hid/hid-core.c:1936
picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:130 [inline]
picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
picolcd_fb_deferred_io+0x6ba/0x1310 drivers/hid/hid-picolcd_fb.c:403
fb_deferred_io_work+0x1bc/0x4a0 drivers/video/fbdev/core/fb_defio.c:405
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
hid_set_field+0xeb/0x2e0 drivers/hid/hid-core.c:1936
picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:130 [inline]
picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
picolcd_fb_deferred_io+0x6ba/0x1310 drivers/hid/hid-picolcd_fb.c:403
fb_deferred_io_work+0x1bc/0x4a0 drivers/video/fbdev/core/fb_defio.c:405
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Allocated by task 6390:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
hid_set_field+0xeb/0x2e0 drivers/hid/hid-core.c:1936
picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:130 [inline]
picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
picolcd_fb_deferred_io+0x6ba/0x1310 drivers/hid/hid-picolcd_fb.c:403
fb_deferred_io_work+0x1bc/0x4a0 drivers/video/fbdev/core/fb_defio.c:405
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
hid_set_field+0xeb/0x2e0 drivers/hid/hid-core.c:1936
picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:130 [inline]
picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
picolcd_fb_deferred_io+0x6ba/0x1310 drivers/hid/hid-picolcd_fb.c:403
fb_deferred_io_work+0x1bc/0x4a0 drivers/video/fbdev/core/fb_defio.c:405
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
hid_set_field+0xeb/0x2e0 drivers/hid/hid-core.c:1936
picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:130 [inline]
picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
picolcd_fb_deferred_io+0x6ba/0x1310 drivers/hid/hid-picolcd_fb.c:403
fb_deferred_io_work+0x1bc/0x4a0 drivers/video/fbdev/core/fb_defio.c:405
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
hid_set_field+0xeb/0x2e0 drivers/hid/hid-core.c:1936
picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:130 [inline]
picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
picolcd_fb_deferred_io+0x6ba/0x1310 drivers/hid/hid-picolcd_fb.c:403
fb_deferred_io_work+0x1bc/0x4a0 drivers/video/fbdev/core/fb_defio.c:405
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
hid_set_field+0xeb/0x2e0 drivers/hid/hid-core.c:1936
picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:130 [inline]
picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
picolcd_fb_deferred_io+0x6ba/0x1310 drivers/hid/hid-picolcd_fb.c:403
fb_deferred_io_work+0x1bc/0x4a0 drivers/video/fbdev/core/fb_defio.c:405
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
hid_set_field+0xeb/0x2e0 drivers/hid/hid-core.c:1936
picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:130 [inline]
picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
picolcd_fb_deferred_io+0x6ba/0x1310 drivers/hid/hid-picolcd_fb.c:403
fb_deferred_io_work+0x1bc/0x4a0 drivers/video/fbdev/core/fb_defio.c:405
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
hid_set_field+0xeb/0x2e0 drivers/hid/hid-core.c:1936
picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:130 [inline]
picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
picolcd_fb_deferred_io+0x6ba/0x1310 drivers/hid/hid-picolcd_fb.c:403
fb_deferred_io_work+0x1bc/0x4a0 drivers/video/fbdev/core/fb_defio.c:405
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
hid_set_field+0xeb/0x2e0 drivers/hid/hid-core.c:1936
picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:130 [inline]
picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
picolcd_fb_deferred_io+0x6ba/0x1310 drivers/hid/hid-picolcd_fb.c:403
fb_deferred_io_work+0x1bc/0x4a0 drivers/video/fbdev/core/fb_defio.c:405
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
hid_set_field+0xeb/0x2e0 drivers/hid/hid-core.c:1936
picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:130 [inline]
picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
picolcd_fb_deferred_io+0x6ba/0x1310 drivers/hid/hid-picolcd_fb.c:403
fb_deferred_io_work+0x1bc/0x4a0 drivers/video/fbdev/core/fb_defio.c:405
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
hid_set_field+0xeb/0x2e0 drivers/hid/hid-core.c:1936
picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:130 [inline]
picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline]
picolcd_fb_deferred_io+0x6ba/0x1310 drivers/hid/hid-picolcd_fb.c:403
fb_deferred_io_work+0x1bc/0x4a0 drivers/video/fbdev/core/fb_defio.c:405
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
hid-picolcd 0003:04D8:C002.0011: offset (23) exceeds report_count (1)
hid-picolcd 0003:04D8:C002.0011: offset (24) exceeds report_count (1)
hid-picolcd 0003:04D8:C002.0011: offset (25) exceeds report_count (1)
hid-picolcd 0003:04D8:C002.0011: offset (26) exceeds report_count (1)
hid-picolcd 0003:04D8:C002.0011: offset (27) exceeds report_count (1)
hid-picolcd 0003:04D8:C002.0011: offset (28) exceeds report_count (1)
==================================================================
BUG: KASAN: slab-out-of-bounds in hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
Read of size 4 at addr ffff888074beb6b4 by task kworker/1:1/11317
CPU: 1 UID: 0 PID: 11317 Comm: kworker/1:1 Tainted: G B syzkaller #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Workqueue: events fb_deferred_io_work
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x13d/0x4b0 mm/kasan/report.c:482
ffff888074beb500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888074beb580: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff888074beb600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888074beb680: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
==================================================================
hid-picolcd 0003:04D8:C002.0011: offset (22) exceeds report_count (1)
hid-picolcd 0003:04D8:C002.0011: offset (23) exceeds report_count (1)
hid-picolcd 0003:04D8:C002.0011: offset (24) exceeds report_count (1)
hid-picolcd 0003:04D8:C002.0011: offset (25) exceeds report_count (1)
hid-picolcd 0003:04D8:C002.0011: offset (26) exceeds report_count (1)
hid-picolcd 0003:04D8:C002.0011: offset (27) exceeds report_count (1)
hid-picolcd 0003:04D8:C002.0011: offset (28) exceeds report_count (1)
==================================================================
BUG: KASAN: slab-out-of-bounds in hid_dump_input+0xba/0xc0 drivers/hid/hid-debug.c:3132
ffff888074beb500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888074beb580: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff888074beb600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888074beb680: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
==================================================================
hid-picolcd 0003:04D8:C002.0011: offset (22) exceeds report_count (1)
hid-picolcd 0003:04D8:C002.0011: offset (23) exceeds report_count (1)
hid-picolcd 0003:04D8:C002.0011: offset (24) exceeds report_count (1)
hid-picolcd 0003:04D8:C002.0011: offset (25) exceeds report_count (1)
hid-picolcd 0003:04D8:C002.0011: offset (26) exceeds report_count (1)
hid-picolcd 0003:04D8:C002.0011: offset (27) exceeds report_count (1)
hid-picolcd 0003:04D8:C002.0011: offset (28) exceeds report_count (1)
==================================================================