==================================================================
BUG: KASAN: use-after-free in mcp2221_raw_event+0xf98/0x1030 drivers/hid/hid-mcp2221.c:852
Read of size 1 at addr ffff888135083fff by task kworker/1:9/7016

CPU: 1 UID: 0 PID: 7016 Comm: kworker/1:9 Not tainted 6.13.0-rc4-syzkaller-00080-gf1a2241778d9 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: events dvb_usb_read_remote_control
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xc3/0x620 mm/kasan/report.c:489
 kasan_report+0xd9/0x110 mm/kasan/report.c:602
 mcp2221_raw_event+0xf98/0x1030 drivers/hid/hid-mcp2221.c:852
 __hid_input_report.constprop.0+0x312/0x440 drivers/hid/hid-core.c:2111
 hid_irq_in+0x35e/0x870 drivers/hid/usbhid/hid-core.c:285
 __usb_hcd_giveback_urb+0x389/0x6e0 drivers/usb/core/hcd.c:1650
 usb_hcd_giveback_urb+0x396/0x450 drivers/usb/core/hcd.c:1734
 dummy_timer+0x17f7/0x3960 drivers/usb/gadget/udc/dummy_hcd.c:1993
 __run_hrtimer kernel/time/hrtimer.c:1739 [inline]
 __hrtimer_run_queues+0x20a/0xae0 kernel/time/hrtimer.c:1803
 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1820
 handle_softirqs+0x206/0x8d0 kernel/softirq.c:561
 __do_softirq kernel/softirq.c:595 [inline]
 invoke_softirq kernel/softirq.c:435 [inline]
 __irq_exit_rcu+0xfa/0x160 kernel/softirq.c:662
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:console_flush_all+0x9a4/0xc60 kernel/printk/printk.c:3211
Code: 00 e8 b0 d1 27 00 9c 5b 81 e3 00 02 00 00 31 ff 48 89 de e8 ee 3a 20 00 48 85 db 0f 85 55 01 00 00 e8 70 38 20 00 fb 4c 89 e0 <48> c1 e8 03 42 80 3c 38 00 0f 84 11 ff ff ff 4c 89 e7 e8 15 fc 79
RSP: 0018:ffffc9001429f908 EFLAGS: 00000293
RAX: ffffffff893a9458 RBX: 0000000000000000 RCX: ffffffff813b3332
RDX: ffff8881324e9d40 RSI: ffffffff813b3340 RDI: 0000000000000007
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000005 R12: ffffffff893a9458
R13: ffffffff893a9400 R14: ffffc9001429f998 R15: dffffc0000000000
 __console_flush_and_unlock kernel/printk/printk.c:3269 [inline]
 console_unlock+0xd9/0x210 kernel/printk/printk.c:3309
 vprintk_emit+0x424/0x6f0 kernel/printk/printk.c:2432
 vprintk+0x7f/0xa0 kernel/printk/printk_safe.c:86
 _printk+0xc8/0x100 kernel/printk/printk.c:2457
 m920x_read drivers/media/usb/dvb-usb/m920x.c:40 [inline]
 m920x_rc_core_query+0x2d7/0x500 drivers/media/usb/dvb-usb/m920x.c:229
 dvb_usb_read_remote_control+0xda/0x1c0 drivers/media/usb/dvb-usb/dvb-usb-remote.c:261
 process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3229
 process_scheduled_works kernel/workqueue.c:3310 [inline]
 worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888135083f00 pfn:0x135083
flags: 0x200000000000000(node=0|zone=2)
page_type: f0(buddy)
raw: 0200000000000000 ffffea00046dc9c8 ffffea00046c8988 0000000000000000
raw: ffff888135083f00 0000000000000000 00000000f0000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x440dc0(GFP_KERNEL_ACCOUNT|__GFP_COMP|__GFP_ZERO), pid 8232, tgid 8232 (syz.3.933), ts 540453955046, free_ts 542368712045
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1558
 prep_new_page mm/page_alloc.c:1566 [inline]
 get_page_from_freelist+0xe76/0x2b90 mm/page_alloc.c:3476
 __alloc_pages_noprof+0x21c/0x22a0 mm/page_alloc.c:4753
 alloc_pages_mpol_noprof+0xeb/0x400 mm/mempolicy.c:2269
 pagetable_alloc_noprof include/linux/mm.h:2899 [inline]
 pmd_alloc_one_noprof include/asm-generic/pgalloc.h:138 [inline]
 __pmd_alloc+0x3f/0x7e0 mm/memory.c:6365
 pmd_alloc include/linux/mm.h:2862 [inline]
 __handle_mm_fault+0xe32/0x3440 mm/memory.c:5904
 handle_mm_fault+0x3fa/0xaa0 mm/memory.c:6112
 do_user_addr_fault+0x613/0x12c0 arch/x86/mm/fault.c:1338
 handle_page_fault arch/x86/mm/fault.c:1481 [inline]
 exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1539
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
page last free pid 8234 tgid 8232 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1127 [inline]
 free_unref_folios+0x927/0x1400 mm/page_alloc.c:2706
 folios_put_refs+0x3c7/0x550 mm/swap.c:962
 free_pages_and_swap_cache+0x36d/0x510 mm/swap_state.c:332
 __tlb_batch_free_encoded_pages+0xf9/0x290 mm/mmu_gather.c:136
 tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:366 [inline]
 tlb_flush_mmu mm/mmu_gather.c:373 [inline]
 tlb_finish_mmu+0x168/0x7b0 mm/mmu_gather.c:465
 exit_mmap+0x3df/0xb20 mm/mmap.c:1681
 __mmput kernel/fork.c:1348 [inline]
 mmput+0xdb/0x430 kernel/fork.c:1370
 exit_mm kernel/exit.c:570 [inline]
 do_exit+0x9ba/0x2ce0 kernel/exit.c:925
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1087
 get_signal+0x24ed/0x26c0 kernel/signal.c:3017
 arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x147/0x260 kernel/entry/common.c:218
 do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff888135083e80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888135083f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888135083f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                                ^
 ffff888135084000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888135084080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	e8 b0 d1 27 00       	call   0x27d1b5
   5:	9c                   	pushf
   6:	5b                   	pop    %rbx
   7:	81 e3 00 02 00 00    	and    $0x200,%ebx
   d:	31 ff                	xor    %edi,%edi
   f:	48 89 de             	mov    %rbx,%rsi
  12:	e8 ee 3a 20 00       	call   0x203b05
  17:	48 85 db             	test   %rbx,%rbx
  1a:	0f 85 55 01 00 00    	jne    0x175
  20:	e8 70 38 20 00       	call   0x203895
  25:	fb                   	sti
  26:	4c 89 e0             	mov    %r12,%rax
* 29:	48 c1 e8 03          	shr    $0x3,%rax <-- trapping instruction
  2d:	42 80 3c 38 00       	cmpb   $0x0,(%rax,%r15,1)
  32:	0f 84 11 ff ff ff    	je     0xffffff49
  38:	4c 89 e7             	mov    %r12,%rdi
  3b:	e8                   	.byte 0xe8
  3c:	15                   	.byte 0x15
  3d:	fc                   	cld
  3e:	79                   	.byte 0x79