==================================================================
BUG: KASAN: use-after-free in mcp2221_raw_event+0x1070/0x10a0 drivers/hid/hid-mcp2221.c:948
Read of size 1 at addr ffff888132f9bfff by task kworker/1:4/5355

CPU: 1 UID: 0 PID: 5355 Comm: kworker/1:4 Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Workqueue: events legacy_dvb_usb_read_remote_control
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xcd/0x630 mm/kasan/report.c:482
 kasan_report+0xe0/0x110 mm/kasan/report.c:595
 mcp2221_raw_event+0x1070/0x10a0 drivers/hid/hid-mcp2221.c:948
 __hid_input_report.constprop.0+0x311/0x450 drivers/hid/hid-core.c:2139
 hid_irq_in+0x35e/0x870 drivers/hid/usbhid/hid-core.c:286
 __usb_hcd_giveback_urb+0x38b/0x610 drivers/usb/core/hcd.c:1661
 usb_hcd_giveback_urb+0x39b/0x450 drivers/usb/core/hcd.c:1745
 dummy_timer+0x1809/0x3a00 drivers/usb/gadget/udc/dummy_hcd.c:1995
 __run_hrtimer kernel/time/hrtimer.c:1777 [inline]
 __hrtimer_run_queues+0x1ff/0xad0 kernel/time/hrtimer.c:1841
 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1858
 handle_softirqs+0x205/0x8d0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xfa/0x160 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
 sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1052
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:console_flush_all+0x9a2/0xc60 kernel/printk/printk.c:3200
Code: 00 e8 12 b1 28 00 9c 5b 81 e3 00 02 00 00 31 ff 48 89 de e8 70 b6 20 00 48 85 db 0f 85 55 01 00 00 e8 f2 ba 20 00 fb 4c 89 e0 <48> c1 e8 03 42 80 3c 38 00 0f 84 11 ff ff ff 4c 89 e7 e8 67 ed 80
RSP: 0018:ffffc900023bf818 EFLAGS: 00000293
RAX: ffffffff897fd0f8 RBX: 0000000000000000 RCX: ffffffff815d9a60
RDX: ffff888133ea8000 RSI: ffffffff815d9a6e RDI: 0000000000000007
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff897fd0f8
R13: ffffffff897fd0a0 R14: ffffc900023bf8a8 R15: dffffc0000000000
 __console_flush_and_unlock kernel/printk/printk.c:3258 [inline]
 console_unlock+0xd8/0x210 kernel/printk/printk.c:3298
 vprintk_emit+0x3d7/0x680 kernel/printk/printk.c:2423
 _printk+0xc7/0x100 kernel/printk/printk.c:2448
 m920x_read drivers/media/usb/dvb-usb/m920x.c:40 [inline]
 m920x_rc_query+0x496/0x770 drivers/media/usb/dvb-usb/m920x.c:193
 legacy_dvb_usb_read_remote_control+0x10c/0x4f0 drivers/media/usb/dvb-usb/dvb-usb-remote.c:123
 process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3263
 process_scheduled_works kernel/workqueue.c:3346 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3427
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x56a/0x700 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x132f9b
flags: 0x200000000000000(node=0|zone=2)
raw: 0200000000000000 0000000000000000 00000000ffffffff 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 19024, tgid 19024 (modprobe), ts 1715718865744, free_ts 1789247318022
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1c0/0x230 mm/page_alloc.c:1850
 prep_new_page mm/page_alloc.c:1858 [inline]
 get_page_from_freelist+0x1003/0x2dc0 mm/page_alloc.c:3884
 __alloc_frozen_pages_noprof+0x259/0x21f0 mm/page_alloc.c:5183
 alloc_pages_mpol+0xe4/0x410 mm/mempolicy.c:2416
 alloc_slab_page mm/slub.c:3031 [inline]
 allocate_slab mm/slub.c:3204 [inline]
 new_slab+0x24a/0x360 mm/slub.c:3258
 ___slab_alloc+0xd73/0x1a70 mm/slub.c:4628
 __kmem_cache_alloc_bulk+0x1fb/0x6d0 mm/slub.c:7338
 refill_sheaf mm/slub.c:2609 [inline]
 kmem_cache_prefill_sheaf+0x1c3/0x420 mm/slub.c:5373
 mt_get_sheaf lib/maple_tree.c:187 [inline]
 mas_alloc_nodes lib/maple_tree.c:1138 [inline]
 mas_preallocate+0xb00/0x11f0 lib/maple_tree.c:5192
 vma_iter_prealloc mm/vma.h:442 [inline]
 __split_vma+0x34a/0x1040 mm/vma.c:528
 split_vma mm/vma.c:598 [inline]
 vma_modify+0xadb/0x21a0 mm/vma.c:1631
 vma_modify_flags+0x1b0/0x250 mm/vma.c:1649
 mprotect_fixup+0x1df/0xb40 mm/mprotect.c:816
 do_mprotect_pkey+0x9bc/0xd40 mm/mprotect.c:990
 __do_sys_mprotect mm/mprotect.c:1011 [inline]
 __se_sys_mprotect mm/mprotect.c:1008 [inline]
 __x64_sys_mprotect+0x78/0xc0 mm/mprotect.c:1008
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4d0 arch/x86/entry/syscall_64.c:94
page last free pid 5530 tgid 5530 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1394 [inline]
 __free_frozen_pages+0x78f/0x1000 mm/page_alloc.c:2906
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x4d/0x120 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x195/0x1e0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x4e/0x70 mm/kasan/common.c:352
 kasan_slab_alloc include/linux/kasan.h:252 [inline]
 slab_post_alloc_hook mm/slub.c:4947 [inline]
 slab_alloc_node mm/slub.c:5246 [inline]
 kmem_cache_alloc_noprof+0x260/0x6c0 mm/slub.c:5253
 getname_flags.part.0+0x4c/0x550 fs/namei.c:146
 getname_flags+0x93/0xf0 include/linux/audit.h:345
 getname include/linux/fs.h:2922 [inline]
 do_sys_openat2+0xb8/0x1d0 fs/open.c:1431
 do_sys_open fs/open.c:1452 [inline]
 __do_sys_openat fs/open.c:1468 [inline]
 __se_sys_openat fs/open.c:1463 [inline]
 __x64_sys_openat+0x174/0x210 fs/open.c:1463
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4d0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff888132f9be80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888132f9bf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888132f9bf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                                ^
 ffff888132f9c000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888132f9c080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess):
   0:	00 e8                	add    %ch,%al
   2:	12 b1 28 00 9c 5b    	adc    0x5b9c0028(%rcx),%dh
   8:	81 e3 00 02 00 00    	and    $0x200,%ebx
   e:	31 ff                	xor    %edi,%edi
  10:	48 89 de             	mov    %rbx,%rsi
  13:	e8 70 b6 20 00       	call   0x20b688
  18:	48 85 db             	test   %rbx,%rbx
  1b:	0f 85 55 01 00 00    	jne    0x176
  21:	e8 f2 ba 20 00       	call   0x20bb18
  26:	fb                   	sti
  27:	4c 89 e0             	mov    %r12,%rax
* 2a:	48 c1 e8 03          	shr    $0x3,%rax <-- trapping instruction
  2e:	42 80 3c 38 00       	cmpb   $0x0,(%rax,%r15,1)
  33:	0f 84 11 ff ff ff    	je     0xffffff4a
  39:	4c 89 e7             	mov    %r12,%rdi
  3c:	e8                   	.byte 0xe8
  3d:	67 ed                	addr32 in (%dx),%eax
  3f:	80                   	.byte 0x80