==================================================================
BUG: KASAN: slab-out-of-bounds in mcp2221_raw_event+0xf98/0x1030 drivers/hid/hid-mcp2221.c:852
Read of size 1 at addr ffff88811a08bfff by task kworker/1:5/5270
CPU: 1 UID: 0 PID: 5270 Comm: kworker/1:5 Not tainted 6.13.0-rc4-syzkaller-00068-gd7123c77dc60 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xc3/0x620 mm/kasan/report.c:489
kasan_report+0xd9/0x110 mm/kasan/report.c:602
mcp2221_raw_event+0xf98/0x1030 drivers/hid/hid-mcp2221.c:852
__hid_input_report.constprop.0+0x312/0x440 drivers/hid/hid-core.c:2111
hid_irq_in+0x35e/0x870 drivers/hid/usbhid/hid-core.c:285
__usb_hcd_giveback_urb+0x389/0x6e0 drivers/usb/core/hcd.c:1650
usb_hcd_giveback_urb+0x396/0x450 drivers/usb/core/hcd.c:1734
dummy_timer+0x17f7/0x3960 drivers/usb/gadget/udc/dummy_hcd.c:1993
__run_hrtimer kernel/time/hrtimer.c:1739 [inline]
__hrtimer_run_queues+0x20a/0xae0 kernel/time/hrtimer.c:1803
hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1820
handle_softirqs+0x206/0x8d0 kernel/softirq.c:561
__do_softirq kernel/softirq.c:595 [inline]
invoke_softirq kernel/softirq.c:435 [inline]
__irq_exit_rcu+0xfa/0x160 kernel/softirq.c:662
irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:console_flush_all+0x9a4/0xc60 kernel/printk/printk.c:3211
Code: 00 e8 b0 d1 27 00 9c 5b 81 e3 00 02 00 00 31 ff 48 89 de e8 ee 3a 20 00 48 85 db 0f 85 55 01 00 00 e8 70 38 20 00 fb 4c 89 e0 <48> c1 e8 03 42 80 3c 38 00 0f 84 11 ff ff ff 4c 89 e7 e8 15 fc 79
RSP: 0018:ffffc900020df4b8 EFLAGS: 00000283
RAX: ffffffff893a9458 RBX: 0000000000000000 RCX: ffffc9001224a000
RDX: 0000000000100000 RSI: ffffffff813b3340 RDI: 0000000000000007
RBP: 0000000000000001 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000008 R12: ffffffff893a9458
R13: ffffffff893a9400 R14: ffffc900020df548 R15: dffffc0000000000
__console_flush_and_unlock kernel/printk/printk.c:3269 [inline]
console_unlock+0xd9/0x210 kernel/printk/printk.c:3309
vprintk_emit+0x424/0x6f0 kernel/printk/printk.c:2432
dev_vprintk_emit drivers/base/core.c:4935 [inline]
dev_printk_emit+0xfb/0x140 drivers/base/core.c:4946
__dev_printk+0xf5/0x270 drivers/base/core.c:4958
_dev_info+0xe5/0x120 drivers/base/core.c:5004
hub_port_init+0xce6/0x3ab0 drivers/usb/core/hub.c:4950
hub_port_connect drivers/usb/core/hub.c:5450 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5661 [inline]
port_event drivers/usb/core/hub.c:5821 [inline]
hub_event+0x2c16/0x4f40 drivers/usb/core/hub.c:5903
process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3229
process_scheduled_works kernel/workqueue.c:3310 [inline]
worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Allocated by task 12929:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:319 [inline]
__kasan_slab_alloc+0x6e/0x70 mm/kasan/common.c:345
kasan_slab_alloc include/linux/kasan.h:250 [inline]
slab_post_alloc_hook mm/slub.c:4119 [inline]
slab_alloc_node mm/slub.c:4168 [inline]
kmem_cache_alloc_noprof+0x154/0x3b0 mm/slub.c:4175
alloc_empty_file+0x73/0x1e0 fs/file_table.c:228
path_openat+0xe1/0x2d60 fs/namei.c:3973
do_filp_open+0x20c/0x470 fs/namei.c:4014
do_sys_openat2+0x17a/0x1e0 fs/open.c:1402
do_sys_open fs/open.c:1417 [inline]
__do_sys_openat fs/open.c:1433 [inline]
__se_sys_openat fs/open.c:1428 [inline]
__x64_sys_openat+0x175/0x210 fs/open.c:1428
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 12929:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:582
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x37/0x50 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2353 [inline]
slab_free_after_rcu_debug+0xd2/0x2b0 mm/slub.c:4663
rcu_do_batch kernel/rcu/tree.c:2567 [inline]
rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823
handle_softirqs+0x206/0x8d0 kernel/softirq.c:561
__do_softirq kernel/softirq.c:595 [inline]
invoke_softirq kernel/softirq.c:435 [inline]
__irq_exit_rcu+0xfa/0x160 kernel/softirq.c:662
irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
Last potentially related work creation:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
__kasan_record_aux_stack+0x9b/0xb0 mm/kasan/generic.c:544
slab_free_hook mm/slub.c:2314 [inline]
slab_free mm/slub.c:4613 [inline]
kmem_cache_free+0x2e6/0x470 mm/slub.c:4715
file_free fs/file_table.c:76 [inline]
__fput+0x686/0xb60 fs/file_table.c:463
__fput_sync+0xa1/0xc0 fs/file_table.c:535
__do_sys_close fs/open.c:1554 [inline]
__se_sys_close fs/open.c:1539 [inline]
__x64_sys_close+0x86/0x100 fs/open.c:1539
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff88811a08bdc0
which belongs to the cache filp of size 360
The buggy address is located 215 bytes to the right of
allocated 360-byte region [ffff88811a08bdc0, ffff88811a08bf28)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11a08a
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff888108aa2f01
anon flags: 0x200000000000040(head|node=0|zone=2)
page_type: f5(slab)
raw: 0200000000000040 ffff888100ae1500 0000000000000000 dead000000000001
raw: 0000000000000000 0000000000120012 00000001f5000000 ffff888108aa2f01
head: 0200000000000040 ffff888100ae1500 0000000000000000 dead000000000001
head: 0000000000000000 0000000000120012 00000001f5000000 ffff888108aa2f01
head: 0200000000000001 ffffea0004682281 ffffffffffffffff 0000000000000000
head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 2845, tgid 2845 (udevadm), ts 14908086905, free_ts 0
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1558
prep_new_page mm/page_alloc.c:1566 [inline]
get_page_from_freelist+0xe76/0x2b90 mm/page_alloc.c:3476
__alloc_pages_noprof+0x21c/0x22a0 mm/page_alloc.c:4753
alloc_pages_mpol_noprof+0xeb/0x400 mm/mempolicy.c:2269
alloc_slab_page mm/slub.c:2423 [inline]
allocate_slab mm/slub.c:2589 [inline]
new_slab+0x2c9/0x410 mm/slub.c:2642
___slab_alloc+0xd1d/0x16e0 mm/slub.c:3830
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3920
__slab_alloc_node mm/slub.c:3995 [inline]
slab_alloc_node mm/slub.c:4156 [inline]
kmem_cache_alloc_noprof+0x1fd/0x3b0 mm/slub.c:4175
alloc_empty_file+0x73/0x1e0 fs/file_table.c:228
path_openat+0xe1/0x2d60 fs/namei.c:3973
do_filp_open+0x20c/0x470 fs/namei.c:4014
do_sys_openat2+0x17a/0x1e0 fs/open.c:1402
do_sys_open fs/open.c:1417 [inline]
__do_sys_openat fs/open.c:1433 [inline]
__se_sys_openat fs/open.c:1428 [inline]
__x64_sys_openat+0x175/0x210 fs/open.c:1428
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page_owner free stack trace missing
Memory state around the buggy address:
ffff88811a08be80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88811a08bf00: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc
>ffff88811a08bf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88811a08c000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88811a08c080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess), 1 bytes skipped:
0: e8 b0 d1 27 00 call 0x27d1b5
5: 9c pushf
6: 5b pop %rbx
7: 81 e3 00 02 00 00 and $0x200,%ebx
d: 31 ff xor %edi,%edi
f: 48 89 de mov %rbx,%rsi
12: e8 ee 3a 20 00 call 0x203b05
17: 48 85 db test %rbx,%rbx
1a: 0f 85 55 01 00 00 jne 0x175
20: e8 70 38 20 00 call 0x203895
25: fb sti
26: 4c 89 e0 mov %r12,%rax
* 29: 48 c1 e8 03 shr $0x3,%rax <-- trapping instruction
2d: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1)
32: 0f 84 11 ff ff ff je 0xffffff49
38: 4c 89 e7 mov %r12,%rdi
3b: e8 .byte 0xe8
3c: 15 .byte 0x15
3d: fc cld
3e: 79 .byte 0x79