==================================================================
BUG: KASAN: use-after-free in pn533_acr122_is_rx_frame_valid+0x151/0x160 drivers/nfc/pn533/usb.c:325
Read of size 1 at addr ffff8881568f1795 by task kworker/u8:39/8738

CPU: 1 UID: 0 PID: 8738 Comm: kworker/u8:39 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: netns cleanup_net
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 pn533_acr122_is_rx_frame_valid+0x151/0x160 drivers/nfc/pn533/usb.c:325
 pn533_recv_frame+0x1c0/0x6d0 drivers/nfc/pn533/pn533.c:2203
 __usb_hcd_giveback_urb+0x378/0x540 drivers/usb/core/hcd.c:1657
 dummy_timer+0xa91/0x4cf0 drivers/usb/gadget/udc/dummy_hcd.c:2019
 __run_hrtimer kernel/time/hrtimer.c:2067 [inline]
 __hrtimer_run_queues+0x3bc/0xa10 kernel/time/hrtimer.c:2124
 hrtimer_run_softirq+0x1e3/0x2e0 kernel/time/hrtimer.c:2141
 handle_softirqs+0x226/0x860 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__kfree_rcu_sheaf+0x11f/0x6c0 mm/slub.c:6177
Code: 08 0f 83 08 04 00 00 89 ea 83 e2 01 4a 8b 04 ed d0 87 74 8e 4a 8d 34 20 4e 8b 6c 20 48 4d 85 ed 0f 84 c7 00 00 00 41 8b 45 18 <8d> 48 01 41 89 4d 18 4d 89 7c c5 20 41 3b 4e 2c 0f 83 34 01 00 00
RSP: 0018:ffffc90004f87458 EFLAGS: 00000286
RAX: 0000000000000018 RBX: ffffffff822c3a81 RCX: 8000000000000002
RDX: 0000000000000000 RSI: ffff8880b8740ab8 RDI: ffffffff8c6d9a20
RBP: 0000000000000000 R08: ffffffff822c3a81 R09: 0000000000000000
R10: dffffc0000000000 R11: fffff520009f0e90 R12: ffffffff9396eab8
R13: ffff88801eefc200 R14: ffff88801b049dc0 R15: ffff88805675eb00
 kfree_rcu_sheaf mm/slab_common.c:1688 [inline]
 kvfree_call_rcu+0xa1/0x430 mm/slab_common.c:2037
 drop_sysctl_table+0x389/0x550 fs/proc/proc_sysctl.c:1520
 unregister_sysctl_table+0x41/0x60 fs/proc/proc_sysctl.c:1541
 mpls_dev_sysctl_unregister+0x8b/0xc0 net/mpls/af_mpls.c:1477
 mpls_dev_notify+0xb52/0xd30 net/mpls/af_mpls.c:1695
 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline]
 call_netdevice_notifiers net/core/dev.c:2327 [inline]
 unregister_netdevice_many_notify+0x17f9/0x2140 net/core/dev.c:12518
 ops_exit_rtnl_list net/core/net_namespace.c:188 [inline]
 ops_undo_list+0x391/0x8d0 net/core/net_namespace.c:249
 cleanup_net+0x572/0x810 net/core/net_namespace.c:706
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1568f1
flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff)
raw: 057ff00000000000 ffffea00055a3c48 ffffea00055a3c48 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)

Memory state around the buggy address:
 ffff8881568f1680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8881568f1700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8881568f1780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                         ^
 ffff8881568f1800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8881568f1880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
----------------
Code disassembly (best guess):
   0:	08 0f                	or     %cl,(%rdi)
   2:	83 08 04             	orl    $0x4,(%rax)
   5:	00 00                	add    %al,(%rax)
   7:	89 ea                	mov    %ebp,%edx
   9:	83 e2 01             	and    $0x1,%edx
   c:	4a 8b 04 ed d0 87 74 	mov    -0x718b7830(,%r13,8),%rax
  13:	8e
  14:	4a 8d 34 20          	lea    (%rax,%r12,1),%rsi
  18:	4e 8b 6c 20 48       	mov    0x48(%rax,%r12,1),%r13
  1d:	4d 85 ed             	test   %r13,%r13
  20:	0f 84 c7 00 00 00    	je     0xed
  26:	41 8b 45 18          	mov    0x18(%r13),%eax
* 2a:	8d 48 01             	lea    0x1(%rax),%ecx <-- trapping instruction
  2d:	41 89 4d 18          	mov    %ecx,0x18(%r13)
  31:	4d 89 7c c5 20       	mov    %r15,0x20(%r13,%rax,8)
  36:	41 3b 4e 2c          	cmp    0x2c(%r14),%ecx
  3a:	0f 83 34 01 00 00    	jae    0x174