================================================================== BUG: KASAN: use-after-free in __list_del_entry_valid+0xe0/0xf0 lib/list_debug.c:51 Read of size 8 at addr ffff8880778398b0 by task syz-executor.1/9744 CPU: 0 PID: 9744 Comm: syz-executor.1 Not tainted 5.18.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0xeb/0x467 mm/kasan/report.c:313 print_report mm/kasan/report.c:429 [inline] kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491 __list_del_entry_valid+0xe0/0xf0 lib/list_debug.c:51 __list_del_entry include/linux/list.h:134 [inline] list_del include/linux/list.h:148 [inline] hidraw_release+0xd5/0x370 drivers/hid/hidraw.c:353 __fput+0x277/0x9d0 fs/file_table.c:317 task_work_run+0xdd/0x1a0 kernel/task_work.c:164 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:169 [inline] exit_to_user_mode_prepare+0x23c/0x250 kernel/entry/common.c:201 __syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline] syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:294 do_syscall_64+0x42/0x80 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fd3ef63bc8b Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44 RSP: 002b:00007ffd3e9bc190 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00007fd3ef63bc8b RDX: ffffffffffffffb8 RSI: ffffffffffffffff RDI: 0000000000000004 RBP: 00007fd3ef79d960 R08: 0000000000000000 R09: 00007fd3ef7a04e0 R10: 00007ffd3e9bc290 R11: 0000000000000293 R12: 0000000000090878 R13: 00007ffd3e9bc290 R14: 00007fd3ef79bf60 R15: 0000000000000032 Allocated by task 9538: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:436 [inline] ____kasan_kmalloc mm/kasan/common.c:515 [inline] ____kasan_kmalloc mm/kasan/common.c:474 [inline] __kasan_kmalloc+0xa6/0xd0 mm/kasan/common.c:524 kasan_kmalloc include/linux/kasan.h:234 [inline] kmem_cache_alloc_trace+0x1ea/0x4a0 mm/slab.c:3583 kmalloc include/linux/slab.h:581 [inline] kzalloc include/linux/slab.h:714 [inline] hidraw_connect+0x4b/0x440 drivers/hid/hidraw.c:543 hid_connect+0x10b4/0x17c0 drivers/hid/hid-core.c:2172 hid_hw_start drivers/hid/hid-core.c:2273 [inline] hid_hw_start+0xa2/0x130 drivers/hid/hid-core.c:2264 wacom_parse_and_register+0x2e81/0x57f0 drivers/hid/wacom_sys.c:2402 wacom_probe+0x98f/0xd10 drivers/hid/wacom_sys.c:2792 hid_device_probe+0x2bd/0x3f0 drivers/hid/hid-core.c:2594 call_driver_probe drivers/base/dd.c:541 [inline] really_probe+0x23e/0xb20 drivers/base/dd.c:620 __driver_probe_device+0x338/0x4d0 drivers/base/dd.c:751 driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:781 __device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:898 bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427 __device_attach+0x228/0x4a0 drivers/base/dd.c:969 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487 device_add+0xb83/0x1e20 drivers/base/core.c:3405 hid_add_device+0x344/0x9d0 drivers/hid/hid-core.c:2744 usbhid_probe+0xb6a/0x1070 drivers/hid/usbhid/hid-core.c:1424 usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:541 [inline] really_probe+0x23e/0xb20 drivers/base/dd.c:620 __driver_probe_device+0x338/0x4d0 drivers/base/dd.c:751 driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:781 __device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:898 bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427 __device_attach+0x228/0x4a0 drivers/base/dd.c:969 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487 device_add+0xb83/0x1e20 drivers/base/core.c:3405 usb_set_configuration+0x101e/0x1900 drivers/usb/core/message.c:2170 usb_generic_driver_probe+0xba/0x100 drivers/usb/core/generic.c:238 usb_probe_device+0xd9/0x2c0 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:541 [inline] really_probe+0x23e/0xb20 drivers/base/dd.c:620 __driver_probe_device+0x338/0x4d0 drivers/base/dd.c:751 driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:781 __device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:898 bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427 __device_attach+0x228/0x4a0 drivers/base/dd.c:969 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487 device_add+0xb83/0x1e20 drivers/base/core.c:3405 usb_new_device.cold+0x641/0x1091 drivers/usb/core/hub.c:2566 hub_port_connect drivers/usb/core/hub.c:5363 [inline] hub_port_connect_change drivers/usb/core/hub.c:5507 [inline] port_event drivers/usb/core/hub.c:5665 [inline] hub_event+0x25c6/0x4680 drivers/usb/core/hub.c:5747 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 Freed by task 3315: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track+0x21/0x30 mm/kasan/common.c:45 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370 ____kasan_slab_free mm/kasan/common.c:366 [inline] ____kasan_slab_free+0x13d/0x180 mm/kasan/common.c:328 kasan_slab_free include/linux/kasan.h:200 [inline] __cache_free mm/slab.c:3439 [inline] kfree+0x113/0x310 mm/slab.c:3810 drop_ref+0x28f/0x390 drivers/hid/hidraw.c:335 hidraw_disconnect+0x48/0x60 drivers/hid/hidraw.c:599 hid_disconnect+0x130/0x1a0 drivers/hid/hid-core.c:2250 hid_hw_stop+0x12/0x70 drivers/hid/hid-core.c:2293 wacom_remove+0x88/0x3a0 drivers/hid/wacom_sys.c:2817 hid_device_remove+0xbf/0x200 drivers/hid/hid-core.c:2623 device_remove+0xc8/0x170 drivers/base/dd.c:529 __device_release_driver drivers/base/dd.c:1199 [inline] device_release_driver_internal+0x4a3/0x680 drivers/base/dd.c:1222 bus_remove_device+0x2eb/0x5a0 drivers/base/bus.c:529 device_del+0x4f3/0xc80 drivers/base/core.c:3592 hid_remove_device drivers/hid/hid-core.c:2792 [inline] hid_destroy_device+0xe1/0x150 drivers/hid/hid-core.c:2811 usbhid_disconnect+0x9f/0xe0 drivers/hid/usbhid/hid-core.c:1451 usb_unbind_interface+0x1d8/0x8e0 drivers/usb/core/driver.c:458 device_remove drivers/base/dd.c:531 [inline] device_remove+0x11f/0x170 drivers/base/dd.c:523 __device_release_driver drivers/base/dd.c:1199 [inline] device_release_driver_internal+0x4a3/0x680 drivers/base/dd.c:1222 bus_remove_device+0x2eb/0x5a0 drivers/base/bus.c:529 device_del+0x4f3/0xc80 drivers/base/core.c:3592 usb_disable_device+0x35b/0x7b0 drivers/usb/core/message.c:1419 usb_disconnect.cold+0x278/0x6ec drivers/usb/core/hub.c:2228 hub_port_connect drivers/usb/core/hub.c:5207 [inline] hub_port_connect_change drivers/usb/core/hub.c:5507 [inline] port_event drivers/usb/core/hub.c:5665 [inline] hub_event+0x1e74/0x4680 drivers/usb/core/hub.c:5747 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 The buggy address belongs to the object at ffff888077839800 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 176 bytes inside of 192-byte region [ffff888077839800, ffff8880778398c0) The buggy address belongs to the physical page: page:ffffea0001de0e40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x77839 flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000200 ffffea0001d94c48 ffffea0001ce5e88 ffff888010c40000 raw: 0000000000000000 ffff888077839000 0000000100000010 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x342040(__GFP_IO|__GFP_NOWARN|__GFP_COMP|__GFP_HARDWALL|__GFP_THISNODE), pid 9734, tgid 9732 (syz-executor.2), ts 588120569490, free_ts 588119605559 prep_new_page mm/page_alloc.c:2441 [inline] get_page_from_freelist+0xba2/0x3df0 mm/page_alloc.c:4182 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5408 __alloc_pages_node include/linux/gfp.h:587 [inline] kmem_getpages mm/slab.c:1378 [inline] cache_grow_begin+0x75/0x350 mm/slab.c:2584 cache_alloc_refill+0x27f/0x380 mm/slab.c:2957 ____cache_alloc mm/slab.c:3040 [inline] ____cache_alloc mm/slab.c:3023 [inline] __do_cache_alloc mm/slab.c:3267 [inline] slab_alloc mm/slab.c:3309 [inline] __do_kmalloc mm/slab.c:3708 [inline] __kmalloc+0x3b3/0x4d0 mm/slab.c:3719 kmalloc_array+0x42/0x70 include/linux/slab.h:621 kcalloc include/linux/slab.h:652 [inline] ext4_find_extent+0x973/0xce0 fs/ext4/extents.c:905 ext4_ext_map_blocks+0x1e2/0x5f60 fs/ext4/extents.c:4097 ext4_map_blocks+0x653/0x18a0 fs/ext4/inode.c:636 ext4_iomap_alloc fs/ext4/inode.c:3379 [inline] ext4_iomap_begin+0x439/0x780 fs/ext4/inode.c:3429 iomap_iter+0x454/0x1110 fs/iomap/iter.c:74 __iomap_dio_rw+0x6b2/0x1ae0 fs/iomap/direct-io.c:590 iomap_dio_rw+0x38/0x90 fs/iomap/direct-io.c:681 ext4_dio_write_iter fs/ext4/file.c:566 [inline] ext4_file_write_iter+0xe4d/0x1510 fs/ext4/file.c:677 call_write_iter include/linux/fs.h:2050 [inline] do_iter_readv_writev+0x3d1/0x640 fs/read_write.c:726 do_iter_write+0x182/0x700 fs/read_write.c:852 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1356 [inline] free_pcp_prepare+0x549/0xd20 mm/page_alloc.c:1406 free_unref_page_prepare mm/page_alloc.c:3328 [inline] free_unref_page+0x19/0x690 mm/page_alloc.c:3423 __vunmap+0x8e8/0xe10 mm/vmalloc.c:2675 __vfree+0x3c/0xd0 mm/vmalloc.c:2723 vfree+0x5a/0x90 mm/vmalloc.c:2754 hid_open_report+0x478/0x650 drivers/hid/hid-core.c:1289 hid_parse include/linux/hid.h:1100 [inline] wacom_probe+0x96b/0xd10 drivers/hid/wacom_sys.c:2786 hid_device_probe+0x2bd/0x3f0 drivers/hid/hid-core.c:2594 call_driver_probe drivers/base/dd.c:541 [inline] really_probe+0x23e/0xb20 drivers/base/dd.c:620 __driver_probe_device+0x338/0x4d0 drivers/base/dd.c:751 driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:781 __device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:898 bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427 __device_attach+0x228/0x4a0 drivers/base/dd.c:969 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487 device_add+0xb83/0x1e20 drivers/base/core.c:3405 Memory state around the buggy address: ffff888077839780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff888077839800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888077839880: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ffff888077839900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888077839980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ==================================================================