betop 0003:20BC:5500.0001: unknown main item tag 0x0 betop 0003:20BC:5500.0001: hidraw0: USB HID v0.00 Device [HID 20bc:5500] on usb-dummy_hcd.0-1/input0 ================================================================== BUG: KASAN: slab-out-of-bounds in set_bit include/asm-generic/bitops/instrumented-atomic.h:28 [inline] BUG: KASAN: slab-out-of-bounds in betopff_init drivers/hid/hid-betopff.c:99 [inline] BUG: KASAN: slab-out-of-bounds in betop_probe+0x396/0x570 drivers/hid/hid-betopff.c:134 Write of size 8 at addr ffff8881d01209c0 by task kworker/1:3/158 CPU: 1 PID: 158 Comm: kworker/1:3 Not tainted 5.7.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xef/0x16e lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xd3/0x314 mm/kasan/report.c:382 __kasan_report.cold+0x37/0x92 mm/kasan/report.c:511 kasan_report+0x33/0x50 mm/kasan/common.c:625 check_memory_region_inline mm/kasan/generic.c:187 [inline] check_memory_region+0x173/0x1d0 mm/kasan/generic.c:193 set_bit include/asm-generic/bitops/instrumented-atomic.h:28 [inline] betopff_init drivers/hid/hid-betopff.c:99 [inline] betop_probe+0x396/0x570 drivers/hid/hid-betopff.c:134 hid_device_probe+0x2be/0x3f0 drivers/hid/hid-core.c:2263 really_probe+0x290/0xac0 drivers/base/dd.c:527 driver_probe_device+0x223/0x350 drivers/base/dd.c:701 __device_attach_driver+0x1d1/0x290 drivers/base/dd.c:808 bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:431 __device_attach+0x21a/0x390 drivers/base/dd.c:874 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:491 device_add+0x1367/0x1c20 drivers/base/core.c:2533 hid_add_device drivers/hid/hid-core.c:2419 [inline] hid_add_device+0x33c/0x9a0 drivers/hid/hid-core.c:2368 usbhid_probe+0xa8c/0xfa0 drivers/hid/usbhid/hid-core.c:1386 usb_probe_interface+0x310/0x800 drivers/usb/core/driver.c:374 really_probe+0x290/0xac0 drivers/base/dd.c:527 driver_probe_device+0x223/0x350 drivers/base/dd.c:701 __device_attach_driver+0x1d1/0x290 drivers/base/dd.c:808 bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:431 __device_attach+0x21a/0x390 drivers/base/dd.c:874 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:491 device_add+0x1367/0x1c20 drivers/base/core.c:2533 usb_set_configuration+0xed4/0x1850 drivers/usb/core/message.c:2025 usb_generic_driver_probe+0x9d/0xe0 drivers/usb/core/generic.c:241 usb_probe_device+0xd9/0x230 drivers/usb/core/driver.c:272 really_probe+0x290/0xac0 drivers/base/dd.c:527 driver_probe_device+0x223/0x350 drivers/base/dd.c:701 __device_attach_driver+0x1d1/0x290 drivers/base/dd.c:808 bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:431 __device_attach+0x21a/0x390 drivers/base/dd.c:874 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:491 device_add+0x1367/0x1c20 drivers/base/core.c:2533 usb_new_device.cold+0x540/0xcd0 drivers/usb/core/hub.c:2548 hub_port_connect drivers/usb/core/hub.c:5195 [inline] hub_port_connect_change drivers/usb/core/hub.c:5335 [inline] port_event drivers/usb/core/hub.c:5481 [inline] hub_event+0x21cb/0x4300 drivers/usb/core/hub.c:5563 process_one_work+0x965/0x1630 kernel/workqueue.c:2268 worker_thread+0x96/0xe20 kernel/workqueue.c:2414 kthread+0x326/0x430 kernel/kthread.c:268 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Allocated by task 158: save_stack+0x1b/0x40 mm/kasan/common.c:49 set_track mm/kasan/common.c:57 [inline] __kasan_kmalloc mm/kasan/common.c:495 [inline] __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:468 kmalloc include/linux/slab.h:555 [inline] kzalloc include/linux/slab.h:669 [inline] hidraw_connect+0x4b/0x3f0 drivers/hid/hidraw.c:521 hid_connect+0x5cd/0xbc0 drivers/hid/hid-core.c:1939 hid_hw_start drivers/hid/hid-core.c:2035 [inline] hid_hw_start+0xa2/0x130 drivers/hid/hid-core.c:2026 betop_probe+0xbc/0x570 drivers/hid/hid-betopff.c:128 hid_device_probe+0x2be/0x3f0 drivers/hid/hid-core.c:2263 really_probe+0x290/0xac0 drivers/base/dd.c:527 driver_probe_device+0x223/0x350 drivers/base/dd.c:701 __device_attach_driver+0x1d1/0x290 drivers/base/dd.c:808 bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:431 __device_attach+0x21a/0x390 drivers/base/dd.c:874 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:491 device_add+0x1367/0x1c20 drivers/base/core.c:2533 hid_add_device drivers/hid/hid-core.c:2419 [inline] hid_add_device+0x33c/0x9a0 drivers/hid/hid-core.c:2368 usbhid_probe+0xa8c/0xfa0 drivers/hid/usbhid/hid-core.c:1386 usb_probe_interface+0x310/0x800 drivers/usb/core/driver.c:374 really_probe+0x290/0xac0 drivers/base/dd.c:527 driver_probe_device+0x223/0x350 drivers/base/dd.c:701 __device_attach_driver+0x1d1/0x290 drivers/base/dd.c:808 bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:431 __device_attach+0x21a/0x390 drivers/base/dd.c:874 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:491 device_add+0x1367/0x1c20 drivers/base/core.c:2533 usb_set_configuration+0xed4/0x1850 drivers/usb/core/message.c:2025 usb_generic_driver_probe+0x9d/0xe0 drivers/usb/core/generic.c:241 usb_probe_device+0xd9/0x230 drivers/usb/core/driver.c:272 really_probe+0x290/0xac0 drivers/base/dd.c:527 driver_probe_device+0x223/0x350 drivers/base/dd.c:701 __device_attach_driver+0x1d1/0x290 drivers/base/dd.c:808 bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:431 __device_attach+0x21a/0x390 drivers/base/dd.c:874 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:491 device_add+0x1367/0x1c20 drivers/base/core.c:2533 usb_new_device.cold+0x540/0xcd0 drivers/usb/core/hub.c:2548 hub_port_connect drivers/usb/core/hub.c:5195 [inline] hub_port_connect_change drivers/usb/core/hub.c:5335 [inline] port_event drivers/usb/core/hub.c:5481 [inline] hub_event+0x21cb/0x4300 drivers/usb/core/hub.c:5563 process_one_work+0x965/0x1630 kernel/workqueue.c:2268 worker_thread+0x96/0xe20 kernel/workqueue.c:2414 kthread+0x326/0x430 kernel/kthread.c:268 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Freed by task 9: save_stack+0x1b/0x40 mm/kasan/common.c:49 set_track mm/kasan/common.c:57 [inline] kasan_set_free_info mm/kasan/common.c:317 [inline] __kasan_slab_free+0x117/0x160 mm/kasan/common.c:456 slab_free_hook mm/slub.c:1445 [inline] slab_free_freelist_hook mm/slub.c:1478 [inline] slab_free mm/slub.c:3035 [inline] kfree+0xd5/0x300 mm/slub.c:4003 seccomp_filter_free kernel/seccomp.c:573 [inline] seccomp_filter_free kernel/seccomp.c:569 [inline] __put_seccomp_filter+0xb3/0xf0 kernel/seccomp.c:583 free_task+0x76/0x110 kernel/fork.c:474 __put_task_struct+0x220/0x520 kernel/fork.c:754 put_task_struct include/linux/sched/task.h:126 [inline] delayed_put_task_struct+0x22a/0x370 kernel/exit.c:173 rcu_do_batch kernel/rcu/tree.c:2206 [inline] rcu_core+0x5ae/0x1ba0 kernel/rcu/tree.c:2433 __do_softirq+0x21e/0x9aa kernel/softirq.c:292 The buggy address belongs to the object at ffff8881d0120900 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 0 bytes to the right of 192-byte region [ffff8881d0120900, ffff8881d01209c0) The buggy address belongs to the page: page:ffffea0007404800 refcount:1 mapcount:0 mapping:00000000f1adcf10 index:0x0 flags: 0x200000000000200(slab) raw: 0200000000000200 ffffea000748d080 0000000a0000000a ffff8881da002a00 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881d0120880: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff8881d0120900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8881d0120980: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc ^ ffff8881d0120a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881d0120a80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ==================================================================