==================================================================
BUG: KASAN: slab-out-of-bounds in mcp2221_raw_event+0x106a/0x1240 drivers/hid/hid-mcp2221.c:948
Read of size 1 at addr ffff88803132bfff by task kworker/0:5/5945
CPU: 0 UID: 0 PID: 5945 Comm: kworker/0:5 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Workqueue: usb_hub_wq hub_event
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x240 mm/kasan/report.c:482
kasan_report+0x118/0x150 mm/kasan/report.c:595
mcp2221_raw_event+0x106a/0x1240 drivers/hid/hid-mcp2221.c:948
__hid_input_report drivers/hid/hid-core.c:2130 [inline]
hid_input_report+0x407/0x520 drivers/hid/hid-core.c:2157
hid_irq_in+0x47e/0x6d0 drivers/hid/usbhid/hid-core.c:286
__usb_hcd_giveback_urb+0x376/0x540 drivers/usb/core/hcd.c:1661
dummy_timer+0x862/0x4550 drivers/usb/gadget/udc/dummy_hcd.c:1995
__run_hrtimer kernel/time/hrtimer.c:1761 [inline]
__hrtimer_run_queues+0x529/0xc60 kernel/time/hrtimer.c:1825
hrtimer_run_softirq+0x187/0x2b0 kernel/time/hrtimer.c:1842
handle_softirqs+0x286/0x870 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1052
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:finish_task_switch+0x26b/0x950 kernel/sched/core.c:5228
Code: 0f 84 3c 01 00 00 48 85 db 0f 85 63 01 00 00 0f 1f 44 00 00 4c 8b 75 d0 4c 89 e7 e8 9f eb fa 09 e8 4a 4c 36 00 fb 4c 8b 65 c0 <49> 8d bc 24 58 16 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 28 84 c0
RSP: 0018:ffffc900046bdfd8 EFLAGS: 00000286
RAX: fe6a9eb93e064200 RBX: 0000000000000000 RCX: fe6a9eb93e064200
RDX: 0000000000000006 RSI: ffffffff8dc9b677 RDI: ffffffff8c04eb80
RBP: ffffc900046be030 R08: ffffffff8fe50637 R09: 1ffffffff1fca0c6
R10: dffffc0000000000 R11: fffffbfff1fca0c7 R12: ffff88802dbf3c80
R13: dffffc0000000000 R14: ffff888025fd3c80 R15: ffff8880b863ab58
context_switch kernel/sched/core.c:5363 [inline]
__schedule+0x17a0/0x4cc0 kernel/sched/core.c:6964
preempt_schedule_common+0x83/0xd0 kernel/sched/core.c:7148
preempt_schedule+0xae/0xc0 kernel/sched/core.c:7172
preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
_raw_spin_unlock_irqrestore+0xfd/0x110 kernel/locking/spinlock.c:194
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
__wake_up_common_lock+0x190/0x1f0 kernel/sched/wait.c:127
sock_def_readable+0x1fb/0x550 net/core/sock.c:3551
__netlink_sendskb net/netlink/af_netlink.c:1265 [inline]
netlink_broadcast_deliver net/netlink/af_netlink.c:1401 [inline]
do_one_broadcast net/netlink/af_netlink.c:1490 [inline]
netlink_broadcast_filtered+0xc2b/0x1000 net/netlink/af_netlink.c:1535
netlink_broadcast+0x37/0x50 net/netlink/af_netlink.c:1559
uevent_net_broadcast_untagged lib/kobject_uevent.c:331 [inline]
kobject_uevent_net_broadcast+0x378/0x560 lib/kobject_uevent.c:410
kobject_uevent_env+0x55b/0x8c0 lib/kobject_uevent.c:608
device_add+0x557/0xb50 drivers/base/core.c:3670
i2c_register_adapter+0x4f1/0x10f0 drivers/i2c/i2c-core-base.c:1576
devm_i2c_add_adapter+0x1b/0x80 drivers/i2c/i2c-core-base.c:1848
mcp2221_probe+0x404/0x880 drivers/hid/hid-mcp2221.c:1289
__hid_device_probe drivers/hid/hid-core.c:2740 [inline]
hid_device_probe+0x39d/0x710 drivers/hid/hid-core.c:2777
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x26a/0x9e0 drivers/base/dd.c:659
__driver_probe_device+0x18c/0x2f0 drivers/base/dd.c:801
driver_probe_device+0x4f/0x430 drivers/base/dd.c:831
__device_attach_driver+0x2ce/0x530 drivers/base/dd.c:959
bus_for_each_drv+0x251/0x2e0 drivers/base/bus.c:462
__device_attach+0x2b8/0x400 drivers/base/dd.c:1031
bus_probe_device+0x185/0x260 drivers/base/bus.c:537
device_add+0x7b6/0xb50 drivers/base/core.c:3689
hid_add_device+0x398/0x540 drivers/hid/hid-core.c:2923
usbhid_probe+0xe13/0x12a0 drivers/hid/usbhid/hid-core.c:1435
usb_probe_interface+0x665/0xc30 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x26a/0x9e0 drivers/base/dd.c:659
__driver_probe_device+0x18c/0x2f0 drivers/base/dd.c:801
driver_probe_device+0x4f/0x430 drivers/base/dd.c:831
__device_attach_driver+0x2ce/0x530 drivers/base/dd.c:959
bus_for_each_drv+0x251/0x2e0 drivers/base/bus.c:462
__device_attach+0x2b8/0x400 drivers/base/dd.c:1031
bus_probe_device+0x185/0x260 drivers/base/bus.c:537
device_add+0x7b6/0xb50 drivers/base/core.c:3689
usb_set_configuration+0x1a87/0x20e0 drivers/usb/core/message.c:2210
usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
usb_probe_device+0x1c4/0x390 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x26a/0x9e0 drivers/base/dd.c:659
__driver_probe_device+0x18c/0x2f0 drivers/base/dd.c:801
driver_probe_device+0x4f/0x430 drivers/base/dd.c:831
__device_attach_driver+0x2ce/0x530 drivers/base/dd.c:959
bus_for_each_drv+0x251/0x2e0 drivers/base/bus.c:462
__device_attach+0x2b8/0x400 drivers/base/dd.c:1031
bus_probe_device+0x185/0x260 drivers/base/bus.c:537
device_add+0x7b6/0xb50 drivers/base/core.c:3689
usb_new_device+0xa39/0x16f0 drivers/usb/core/hub.c:2694
hub_port_connect drivers/usb/core/hub.c:5566 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5706 [inline]
port_event drivers/usb/core/hub.c:5870 [inline]
hub_event+0x2958/0x4a20 drivers/usb/core/hub.c:5952
process_one_work kernel/workqueue.c:3263 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x47c/0x820 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803132e000 pfn:0x31328
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f8(unknown)
raw: 00fff00000000040 0000000000000000 dead000000000122 0000000000000000
raw: ffff88803132e000 0000000000000000 00000000f8000000 0000000000000000
head: 00fff00000000040 0000000000000000 dead000000000122 0000000000000000
head: ffff88803132e000 0000000000000000 00000000f8000000 0000000000000000
head: 00fff00000000002 ffffea0000c4ca01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x40dc0(GFP_KERNEL|__GFP_ZERO|__GFP_COMP), pid 7023, tgid 7019 (syz.1.262), ts 158696369894, free_ts 148524567730
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1850
prep_new_page mm/page_alloc.c:1858 [inline]
get_page_from_freelist+0x21e4/0x22c0 mm/page_alloc.c:3863
__alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5153
alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2416
___kmalloc_large_node+0x5f/0x1b0 mm/slub.c:5307
__kmalloc_large_noprof+0x1a/0x90 mm/slub.c:5328
kmalloc_noprof include/linux/slab.h:953 [inline]
kzalloc_noprof include/linux/slab.h:1090 [inline]
tipc_nametbl_init+0x2d/0x160 net/tipc/name_table.c:891
tipc_init_net+0x252/0x330 net/tipc/core.c:80
ops_init+0x35c/0x5c0 net/core/net_namespace.c:136
setup_net+0x10c/0x320 net/core/net_namespace.c:438
copy_net_ns+0x31b/0x4d0 net/core/net_namespace.c:570
create_new_namespaces+0x3f3/0x720 kernel/nsproxy.c:110
copy_namespaces+0x438/0x4b0 kernel/nsproxy.c:175
copy_process+0x1733/0x3c00 kernel/fork.c:2195
kernel_clone+0x21e/0x840 kernel/fork.c:2620
__do_sys_clone kernel/fork.c:2761 [inline]
__se_sys_clone kernel/fork.c:2745 [inline]
__x64_sys_clone+0x18b/0x1e0 kernel/fork.c:2745
page last free pid 6805 tgid 6803 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1394 [inline]
__free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2900
discard_slab mm/slub.c:3262 [inline]
__put_partials+0x146/0x170 mm/slub.c:3727
put_cpu_partial+0x17c/0x250 mm/slub.c:3802
__slab_free+0x2b9/0x390 mm/slub.c:5555
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x97/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:349
kasan_slab_alloc include/linux/kasan.h:250 [inline]
slab_post_alloc_hook mm/slub.c:4710 [inline]
slab_alloc_node mm/slub.c:5008 [inline]
__do_kmalloc_node mm/slub.c:5365 [inline]
__kmalloc_noprof+0x3c3/0x7f0 mm/slub.c:5378
kmalloc_noprof include/linux/slab.h:960 [inline]
kzalloc_noprof include/linux/slab.h:1090 [inline]
ops_init+0x7b/0x5c0 net/core/net_namespace.c:126
setup_net+0x10c/0x320 net/core/net_namespace.c:438
copy_net_ns+0x31b/0x4d0 net/core/net_namespace.c:570
create_new_namespaces+0x3f3/0x720 kernel/nsproxy.c:110
copy_namespaces+0x438/0x4b0 kernel/nsproxy.c:175
copy_process+0x1733/0x3c00 kernel/fork.c:2195
kernel_clone+0x21e/0x840 kernel/fork.c:2620
__do_sys_clone kernel/fork.c:2761 [inline]
__se_sys_clone kernel/fork.c:2745 [inline]
__x64_sys_clone+0x18b/0x1e0 kernel/fork.c:2745
Memory state around the buggy address:
ffff88803132be80: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
ffff88803132bf00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
>ffff88803132bf80: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
^
ffff88803132c000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88803132c080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess):
0: 0f 84 3c 01 00 00 je 0x142
6: 48 85 db test %rbx,%rbx
9: 0f 85 63 01 00 00 jne 0x172
f: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
14: 4c 8b 75 d0 mov -0x30(%rbp),%r14
18: 4c 89 e7 mov %r12,%rdi
1b: e8 9f eb fa 09 call 0x9faebbf
20: e8 4a 4c 36 00 call 0x364c6f
25: fb sti
26: 4c 8b 65 c0 mov -0x40(%rbp),%r12
* 2a: 49 8d bc 24 58 16 00 lea 0x1658(%r12),%rdi <-- trapping instruction
31: 00
32: 48 89 f8 mov %rdi,%rax
35: 48 c1 e8 03 shr $0x3,%rax
39: 42 0f b6 04 28 movzbl (%rax,%r13,1),%eax
3e: 84 c0 test %al,%al