==================================================================
BUG: KASAN: slab-out-of-bounds in mcp2221_raw_event+0x1062/0x1240 drivers/hid/hid-mcp2221.c:856
Read of size 1 at addr ffff8880639abfff by task syz.1.646/9832

CPU: 0 PID: 9832 Comm: syz.1.646 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:364 [inline]
 print_report+0xac/0x220 mm/kasan/report.c:468
 kasan_report+0x117/0x150 mm/kasan/report.c:581
 mcp2221_raw_event+0x1062/0x1240 drivers/hid/hid-mcp2221.c:856
 hid_input_report+0x400/0x520 drivers/hid/hid-core.c:2095
 hid_irq_in+0x479/0x6d0 drivers/hid/usbhid/hid-core.c:284
 __usb_hcd_giveback_urb+0x35f/0x520 drivers/usb/core/hcd.c:1650
 dummy_timer+0x88a/0x3140 drivers/usb/gadget/udc/dummy_hcd.c:1993
 __run_hrtimer kernel/time/hrtimer.c:1750 [inline]
 __hrtimer_run_queues+0x51e/0xc40 kernel/time/hrtimer.c:1814
 hrtimer_run_softirq+0x187/0x2b0 kernel/time/hrtimer.c:1831
 handle_softirqs+0x280/0x820 kernel/softirq.c:578
 __do_softirq kernel/softirq.c:612 [inline]
 invoke_softirq kernel/softirq.c:452 [inline]
 __irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
 sysvec_apic_timer_interrupt+0x56/0xc0 arch/x86/kernel/apic/apic.c:1088
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0033:0x7f0cc9050cb8
Code: 85 ed 74 33 66 0f 1f 44 00 00 48 39 f0 72 1b 4d 8b 07 49 89 c1 49 29 f1 47 0f b6 0c 08 45 84 c9 74 08 45 88 0c 00 49 8b 47 10 <48> 83 c0 01 49 89 47 10 83 e9 01 73 d3 41 81 fe 00 01 00 00 0f 85
RSP: 002b:00007f0cca09d4a0 EFLAGS: 00000246
RAX: 0000000000e7b56f RBX: 00007f0cca09d540 RCX: 00000000000000e6
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 00007f0cca09d5e0
RBP: 0000000000000102 R08: 00007f0cbeff7000 R09: 0000000000000000
R10: 0000000000000000 R11: 00007f0cca09d550 R12: 0000000000000001
R13: 00007f0cc922dc40 R14: 0000000000000000 R15: 00007f0cca09d5e0
 </TASK>

The buggy address belongs to the physical page:
page:ffffea00018e6a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x639a8
head:ffffea00018e6a00 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000040 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x140dc0(GFP_USER|__GFP_COMP|__GFP_ZERO), pid 9704, tgid 9704 (kworker/0:1), ts 616282363944, free_ts 601206826540
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x1cd/0x210 mm/page_alloc.c:1554
 prep_new_page mm/page_alloc.c:1561 [inline]
 get_page_from_freelist+0x195c/0x19f0 mm/page_alloc.c:3191
 __alloc_pages+0x1e3/0x460 mm/page_alloc.c:4457
 __alloc_pages_node include/linux/gfp.h:237 [inline]
 alloc_pages_node include/linux/gfp.h:260 [inline]
 __kmalloc_large_node+0x8c/0x1e0 mm/slab_common.c:1148
 kmalloc_large+0x1b/0x120 mm/slab_common.c:1165
 kmalloc include/linux/slab.h:597 [inline]
 kzalloc include/linux/slab.h:721 [inline]
 usbhid_probe+0xc16/0x1220 drivers/hid/usbhid/hid-core.c:1415
 usb_probe_interface+0x5a4/0xb00 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x25b/0xb40 drivers/base/dd.c:658
 __driver_probe_device+0x18c/0x330 drivers/base/dd.c:800
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:830
 __device_attach_driver+0x2ca/0x520 drivers/base/dd.c:958
 bus_for_each_drv+0x24b/0x2d0 drivers/base/bus.c:459
 __device_attach+0x2b5/0x400 drivers/base/dd.c:1030
 bus_probe_device+0x180/0x260 drivers/base/bus.c:534
 device_add+0x85b/0xc20 drivers/base/core.c:3683
 usb_set_configuration+0x1a79/0x20c0 drivers/usb/core/message.c:2207
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1154 [inline]
 free_unref_page_prepare+0x7ce/0x8e0 mm/page_alloc.c:2336
 free_unref_page+0x32/0x2e0 mm/page_alloc.c:2429
 vfree+0x1a6/0x320 mm/vmalloc.c:2868
 kcov_put kernel/kcov.c:438 [inline]
 kcov_close+0x2b/0x50 kernel/kcov.c:534
 __fput+0x234/0x970 fs/file_table.c:384
 task_work_run+0x1ce/0x250 kernel/task_work.c:239
 exit_task_work include/linux/task_work.h:43 [inline]
 do_exit+0x90b/0x23c0 kernel/exit.c:883
 do_group_exit+0x21b/0x2d0 kernel/exit.c:1024
 __do_sys_exit_group kernel/exit.c:1035 [inline]
 __se_sys_exit_group kernel/exit.c:1033 [inline]
 __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1033
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

Memory state around the buggy address:
 ffff8880639abe80: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
 ffff8880639abf00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
>ffff8880639abf80: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
                                                                ^
 ffff8880639ac000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8880639ac080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================