==================================================================
BUG: KASAN: use-after-free in pn533_acr122_is_rx_frame_valid drivers/nfc/pn533/usb.c:325 [inline]
BUG: KASAN: use-after-free in pn533_acr122_is_rx_frame_valid+0x132/0x150 drivers/nfc/pn533/usb.c:315
Read of size 1 at addr ffff8881d13d3732 by task udevd/5324
CPU: 1 UID: 0 PID: 5324 Comm: udevd Not tainted syzkaller #0 PREEMPT(lazy)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x13d/0x4b0 mm/kasan/report.c:482
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
pn533_acr122_is_rx_frame_valid drivers/nfc/pn533/usb.c:325 [inline]
pn533_acr122_is_rx_frame_valid+0x132/0x150 drivers/nfc/pn533/usb.c:315
pn533_recv_frame+0x1b7/0x6d0 drivers/nfc/pn533/pn533.c:2203
__usb_hcd_giveback_urb+0x38e/0x610 drivers/usb/core/hcd.c:1657
usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
dummy_timer+0xdb2/0x3700 drivers/usb/gadget/udc/dummy_hcd.c:2019
__run_hrtimer kernel/time/hrtimer.c:2067 [inline]
__hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2124
hrtimer_run_softirq+0x1ca/0x360 kernel/time/hrtimer.c:2141
handle_softirqs+0x1d9/0x9b0 kernel/softirq.c:645
__do_softirq kernel/softirq.c:679 [inline]
invoke_softirq kernel/softirq.c:519 [inline]
__irq_exit_rcu+0x168/0x210 kernel/softirq.c:758
irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x70 kernel/kcov.c:206
Code: 06 50 5d 00 48 89 df 5b e9 5d ef 61 00 be 03 00 00 00 5b e9 42 0e 28 01 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 65 48 8b 05 6c e7 6e 0b 48 8b 34 24 65 48 8b 15 50 e7
RSP: 0018:ffffc90002e0f698 EFLAGS: 00000282
RAX: 0000000000002e30 RBX: 0000000000000001 RCX: 0000000000000000
RDX: ffff88812130bc80 RSI: ffffffff81f6c6d0 RDI: ffff88812130bc80
RBP: ffff88811b27dc5e R08: 0000000000000007 R09: 0000000000000001
R10: 0000000000000003 R11: 0000000000000001 R12: ffff88811e5c8fd6
R13: ffff88812130bc80 R14: ffff88811e5c8fd0 R15: ffff88811b3d3318
copy_from_kernel_nofault mm/maccess.c:45 [inline]
copy_from_kernel_nofault+0x12a/0x250 mm/maccess.c:29
prepend_copy+0x28/0x80 fs/d_path.c:50
prepend fs/d_path.c:76 [inline]
prepend_name fs/d_path.c:101 [inline]
__dentry_path+0x21b/0x880 fs/d_path.c:348
dentry_path_raw+0xcd/0x120 fs/d_path.c:369
selinux_genfs_get_sid security/selinux/hooks.c:1345 [inline]
inode_doinit_with_dentry+0x7d8/0x1340 security/selinux/hooks.c:1565
selinux_d_instantiate+0x26/0x40 security/selinux/hooks.c:6685
security_d_instantiate+0x62/0xc0 security/security.c:3703
d_splice_alias_ops+0xd7/0x15b0 fs/dcache.c:3249
kernfs_iop_lookup+0x23f/0x2d0 fs/kernfs/dir.c:1288
__lookup_slow+0x155/0x320 fs/namei.c:1919
lookup_slow+0x50/0x70 fs/namei.c:1936
walk_component fs/namei.c:2282 [inline]
lookup_last fs/namei.c:2789 [inline]
path_lookupat+0x5e8/0xc40 fs/namei.c:2813
filename_lookup+0x202/0x590 fs/namei.c:2842
vfs_statx+0xff/0x3f0 fs/stat.c:353
vfs_fstatat+0x77/0xe0 fs/stat.c:373
__do_sys_newfstatat+0x9d/0x120 fs/stat.c:538
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x119/0x710 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7db0d7cb0a
Code: 48 8b 15 f1 f2 0d 00 f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 41 89 ca b8 06 01 00 00 0f 05 <3d> 00 f0 ff ff 77 07 31 c0 c3 0f 1f 40 00 48 8b 15 b9 f2 0d 00 f7
RSP: 002b:00007ffc0bbf8318 EFLAGS: 00000202 ORIG_RAX: 0000000000000106
RAX: ffffffffffffffda RBX: 0000561de7da5851 RCX: 00007f7db0d7cb0a
RDX: 00007ffc0bbf8320 RSI: 00007ffc0bbf83b0 RDI: 00000000ffffff9c
RBP: 0000561de7d924a0 R08: 0000561de7da5851 R09: 0000000000000000
R10: 0000000000000100 R11: 0000000000000202 R12: 0000561de7d92590
R13: 00007ffc0bbf83b0 R14: 0000561ddce98ca4 R15: 0000561ddce98bcc
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1d13d3
flags: 0x200000000000000(node=0|zone=2)
raw: 0200000000000000 ffffea000744f4c8 ffffea000744f4c8 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)
Memory state around the buggy address:
ffff8881d13d3600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff8881d13d3680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8881d13d3700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff8881d13d3780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff8881d13d3800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
----------------
Code disassembly (best guess), 4 bytes skipped:
0: 48 89 df mov %rbx,%rdi
3: 5b pop %rbx
4: e9 5d ef 61 00 jmp 0x61ef66
9: be 03 00 00 00 mov $0x3,%esi
e: 5b pop %rbx
f: e9 42 0e 28 01 jmp 0x1280e56
14: 66 90 xchg %ax,%ax
16: 90 nop
17: 90 nop
18: 90 nop
19: 90 nop
1a: 90 nop
1b: 90 nop
1c: 90 nop
1d: 90 nop
1e: 90 nop
1f: 90 nop
20: 90 nop
21: 90 nop
22: 90 nop
23: 90 nop
24: 90 nop
25: 90 nop
* 26: f3 0f 1e fa endbr64 <-- trapping instruction
2a: 65 48 8b 05 6c e7 6e mov %gs:0xb6ee76c(%rip),%rax # 0xb6ee79e
31: 0b
32: 48 8b 34 24 mov (%rsp),%rsi
36: 65 gs
37: 48 rex.W
38: 8b .byte 0x8b
39: 15 .byte 0x15
3a: 50 push %rax
3b: e7 .byte 0xe7