==================================================================
BUG: KASAN: slab-out-of-bounds in mcp2221_raw_event+0xf94/0x1030 drivers/hid/hid-mcp2221.c:852
Read of size 1 at addr ffff88811de5bfff by task udevd/2838
CPU: 0 UID: 0 PID: 2838 Comm: udevd Not tainted 6.15.0-rc4-syzkaller-00104-g588d032e9e56 #0 PREEMPT(voluntary)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:408 [inline]
print_report+0xc3/0x670 mm/kasan/report.c:521
kasan_report+0xe0/0x110 mm/kasan/report.c:634
mcp2221_raw_event+0xf94/0x1030 drivers/hid/hid-mcp2221.c:852
__hid_input_report.constprop.0+0x311/0x450 drivers/hid/hid-core.c:2117
hid_irq_in+0x35e/0x870 drivers/hid/usbhid/hid-core.c:286
__usb_hcd_giveback_urb+0x38a/0x6e0 drivers/usb/core/hcd.c:1650
usb_hcd_giveback_urb+0x39b/0x450 drivers/usb/core/hcd.c:1734
dummy_timer+0x180e/0x3a20 drivers/usb/gadget/udc/dummy_hcd.c:1994
__run_hrtimer kernel/time/hrtimer.c:1761 [inline]
__hrtimer_run_queues+0x1ff/0xad0 kernel/time/hrtimer.c:1825
hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1842
handle_softirqs+0x205/0x8d0 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xfa/0x160 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:finish_task_switch.isra.0+0x1e9/0x9e0 kernel/sched/core.c:5250
Code: 0f 85 5f 07 00 00 8b 0d 09 ba 2a 09 85 c9 0f 85 b9 02 00 00 48 89 df e8 e5 75 d8 05 e8 70 11 36 00 fb 65 48 8b 1d af ad 17 0b <48> 8d bb 50 15 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1
RSP: 0018:ffffc900019bfa18 EFLAGS: 00000206
RAX: 000000000199d569 RBX: ffff888116bed7c0 RCX: ffffffff818422cf
RDX: 0000000000000000 RSI: ffffffff88ad89d6 RDI: ffffffff876851e0
RBP: ffffc900019bfa58 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff8a78c097 R11: 0000000000000000 R12: ffff888112fc8000
R13: 0000000000000000 R14: ffff8881f5838418 R15: ffff8881f5838f18
context_switch kernel/sched/core.c:5385 [inline]
__schedule+0x1332/0x3b00 kernel/sched/core.c:6767
__schedule_loop kernel/sched/core.c:6845 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:6860
schedule_hrtimeout_range_clock+0x217/0x320 kernel/time/sleep_timeout.c:216
ep_poll fs/eventpoll.c:2115 [inline]
do_epoll_wait+0xbe1/0x1030 fs/eventpoll.c:2531
__do_sys_epoll_wait fs/eventpoll.c:2539 [inline]
__se_sys_epoll_wait fs/eventpoll.c:2534 [inline]
__x64_sys_epoll_wait+0x194/0x290 fs/eventpoll.c:2534
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4267a6a457
Code: 73 01 c3 48 8b 0d d1 d9 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 20 b8 e8 00 00 00 0f 05 <48> 3d 00 f0 ff ff 76 76 48 8b 15 a2 d9 0c 00 f7 d8 64 89 02 48 83
RSP: 002b:00007ffd2fa5be38 EFLAGS: 00000246 ORIG_RAX: 00000000000000e8
RAX: ffffffffffffffda RBX: 00007ffd2fa5bf38 RCX: 00007f4267a6a457
RDX: 0000000000000008 RSI: 00007ffd2fa5bf38 RDI: 000000000000000b
RBP: 000000000000000b R08: 0000000000000007 R09: 8728af7150873bd3
R10: 0000000000000bb8 R11: 0000000000000246 R12: 0000000000000bb8
R13: 0000000200000001 R14: 0000000000000000 R15: 0000000000000000
Allocated by task 21466:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:319 [inline]
__kasan_slab_alloc+0x6e/0x70 mm/kasan/common.c:345
kasan_slab_alloc include/linux/kasan.h:250 [inline]
slab_post_alloc_hook mm/slub.c:4161 [inline]
slab_alloc_node mm/slub.c:4210 [inline]
kmem_cache_alloc_noprof+0x14f/0x3b0 mm/slub.c:4217
mt_alloc_one lib/maple_tree.c:176 [inline]
mas_alloc_nodes+0x18b/0x8b0 lib/maple_tree.c:1249
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1331
mas_preallocate+0x53e/0xcd0 lib/maple_tree.c:5501
vma_iter_prealloc mm/vma.h:409 [inline]
__mmap_new_vma mm/vma.c:2411 [inline]
__mmap_region+0x12e6/0x2620 mm/vma.c:2519
mmap_region+0x1ab/0x3f0 mm/vma.c:2597
do_mmap+0xd8e/0x11b0 mm/mmap.c:561
vm_mmap_pgoff+0x201/0x390 mm/util.c:579
vm_mmap+0x8e/0xc0 mm/util.c:615
elf_map fs/binfmt_elf.c:391 [inline]
elf_load+0x19a/0x890 fs/binfmt_elf.c:414
load_elf_interp fs/binfmt_elf.c:681 [inline]
load_elf_binary+0x354b/0x4ed0 fs/binfmt_elf.c:1240
search_binary_handler fs/exec.c:1778 [inline]
exec_binprm fs/exec.c:1810 [inline]
bprm_execve fs/exec.c:1862 [inline]
bprm_execve+0x8c0/0x1600 fs/exec.c:1838
kernel_execve+0x2ef/0x3b0 fs/exec.c:2028
call_usermodehelper_exec_async+0x255/0x4c0 kernel/umh.c:109
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Freed by task 6375:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x37/0x50 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2398 [inline]
slab_free mm/slub.c:4656 [inline]
kmem_cache_free+0x2a3/0x470 mm/slub.c:4758
rcu_do_batch kernel/rcu/tree.c:2568 [inline]
rcu_core+0x799/0x14e0 kernel/rcu/tree.c:2824
handle_softirqs+0x205/0x8d0 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xfa/0x160 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
Last potentially related work creation:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_record_aux_stack+0x9b/0xb0 mm/kasan/generic.c:548
__call_rcu_common.constprop.0+0x9a/0x9f0 kernel/rcu/tree.c:3082
mas_free lib/maple_tree.c:1313 [inline]
mas_replace_node lib/maple_tree.c:1750 [inline]
mas_wr_node_store+0xdc4/0x1620 lib/maple_tree.c:3863
mas_wr_store_entry+0x1030/0x2550 lib/maple_tree.c:4083
mas_store_prealloc+0x77d/0x1690 lib/maple_tree.c:5475
vma_iter_store_new mm/vma.h:455 [inline]
__mmap_new_vma mm/vma.c:2433 [inline]
__mmap_region+0x17d6/0x2620 mm/vma.c:2519
mmap_region+0x1ab/0x3f0 mm/vma.c:2597
do_mmap+0xd8e/0x11b0 mm/mmap.c:561
vm_mmap_pgoff+0x201/0x390 mm/util.c:579
vm_mmap+0x8e/0xc0 mm/util.c:615
elf_map fs/binfmt_elf.c:391 [inline]
elf_load+0x19a/0x890 fs/binfmt_elf.c:414
load_elf_interp fs/binfmt_elf.c:681 [inline]
load_elf_binary+0x354b/0x4ed0 fs/binfmt_elf.c:1240
search_binary_handler fs/exec.c:1778 [inline]
exec_binprm fs/exec.c:1810 [inline]
bprm_execve fs/exec.c:1862 [inline]
bprm_execve+0x8c0/0x1600 fs/exec.c:1838
kernel_execve+0x2ef/0x3b0 fs/exec.c:2028
call_usermodehelper_exec_async+0x255/0x4c0 kernel/umh.c:109
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
The buggy address belongs to the object at ffff88811de5be00
which belongs to the cache maple_node of size 256
The buggy address is located 255 bytes to the right of
allocated 256-byte region [ffff88811de5be00, ffff88811de5bf00)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11de5a
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x200000000000040(head|node=0|zone=2)
page_type: f5(slab)
raw: 0200000000000040 ffff888100091000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 0200000000000040 ffff888100091000 dead000000000122 0000000000000000
head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 0200000000000001 ffffea0004779681 00000000ffffffff 00000000ffffffff
head: ffff888100000000 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0x52800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP), pid 21465, tgid 21465 (modprobe), ts 2004550314363, free_ts 1840311438006
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x181/0x1b0 mm/page_alloc.c:1718
prep_new_page mm/page_alloc.c:1726 [inline]
get_page_from_freelist+0xfec/0x2d90 mm/page_alloc.c:3688
__alloc_frozen_pages_noprof+0x25c/0x2160 mm/page_alloc.c:4970
alloc_pages_mpol+0xe4/0x410 mm/mempolicy.c:2301
alloc_slab_page mm/slub.c:2468 [inline]
allocate_slab mm/slub.c:2632 [inline]
new_slab+0x244/0x340 mm/slub.c:2686
___slab_alloc+0xda5/0x1940 mm/slub.c:3872
__kmem_cache_alloc_bulk mm/slub.c:5305 [inline]
kmem_cache_alloc_bulk_noprof+0x23b/0xab0 mm/slub.c:5377
mt_alloc_bulk lib/maple_tree.c:181 [inline]
mas_alloc_nodes+0x2f1/0x8b0 lib/maple_tree.c:1271
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1331
mas_node_count lib/maple_tree.c:1345 [inline]
mas_wr_preallocate lib/maple_tree.c:4255 [inline]
mas_store_gfp+0x59a/0xfe0 lib/maple_tree.c:5432
vma_iter_store_gfp mm/vma.h:210 [inline]
do_brk_flags+0x7fd/0x13a0 mm/vma.c:2667
__do_sys_brk+0x6cb/0xa60 mm/mmap.c:197
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5434 tgid 5434 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1262 [inline]
__free_frozen_pages+0x66c/0xe70 mm/page_alloc.c:2725
vfree+0x176/0x960 mm/vmalloc.c:3383
dvb_dmxdev_release+0x20e/0x790 drivers/media/dvb-core/dmxdev.c:1472
dvb_usb_adapter_dvb_exit+0x9d/0x240 drivers/media/usb/dvb-usb/dvb-usb-dvb.c:224
dvb_usb_adapter_exit drivers/media/usb/dvb-usb/dvb-usb-init.c:128 [inline]
dvb_usb_exit drivers/media/usb/dvb-usb/dvb-usb-init.c:143 [inline]
dvb_usb_device_exit+0x26d/0x580 drivers/media/usb/dvb-usb/dvb-usb-init.c:338
usb_unbind_interface+0x1da/0x9a0 drivers/usb/core/driver.c:458
device_remove drivers/base/dd.c:569 [inline]
device_remove+0x122/0x170 drivers/base/dd.c:561
__device_release_driver drivers/base/dd.c:1272 [inline]
device_release_driver_internal+0x44b/0x620 drivers/base/dd.c:1295
bus_remove_device+0x22f/0x420 drivers/base/bus.c:579
device_del+0x396/0x9f0 drivers/base/core.c:3881
usb_disable_device+0x355/0x7d0 drivers/usb/core/message.c:1418
usb_disconnect+0x2e1/0x920 drivers/usb/core/hub.c:2316
hub_port_connect drivers/usb/core/hub.c:5375 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5675 [inline]
port_event drivers/usb/core/hub.c:5835 [inline]
hub_event+0x1aa0/0x5030 drivers/usb/core/hub.c:5917
process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238
process_scheduled_works kernel/workqueue.c:3319 [inline]
worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400
kthread+0x3c2/0x780 kernel/kthread.c:464
Memory state around the buggy address:
ffff88811de5be80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88811de5bf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88811de5bf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88811de5c000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88811de5c080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess):
0: 0f 85 5f 07 00 00 jne 0x765
6: 8b 0d 09 ba 2a 09 mov 0x92aba09(%rip),%ecx # 0x92aba15
c: 85 c9 test %ecx,%ecx
e: 0f 85 b9 02 00 00 jne 0x2cd
14: 48 89 df mov %rbx,%rdi
17: e8 e5 75 d8 05 call 0x5d87601
1c: e8 70 11 36 00 call 0x361191
21: fb sti
22: 65 48 8b 1d af ad 17 mov %gs:0xb17adaf(%rip),%rbx # 0xb17add9
29: 0b
* 2a: 48 8d bb 50 15 00 00 lea 0x1550(%rbx),%rdi <-- trapping instruction
31: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
38: fc ff df
3b: 48 89 fa mov %rdi,%rdx
3e: 48 rex.W
3f: c1 .byte 0xc1