==================================================================
BUG: KASAN: slab-use-after-free in find_endpoint+0x2a3/0x2c0 drivers/usb/gadget/udc/dummy_hcd.c:1618
Read of size 1 at addr ffff8880690f7152 by task udevd/18843

CPU: 0 UID: 0 PID: 18843 Comm: udevd Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
 find_endpoint+0x2a3/0x2c0 drivers/usb/gadget/udc/dummy_hcd.c:1618
 handle_control_request drivers/usb/gadget/udc/dummy_hcd.c:1761 [inline]
 dummy_timer+0x2709/0x36f0 drivers/usb/gadget/udc/dummy_hcd.c:1942
 __run_hrtimer kernel/time/hrtimer.c:2032 [inline]
 __hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2096
 hrtimer_run_softirq+0x17d/0x2c0 kernel/time/hrtimer.c:2113
 handle_softirqs+0x1ea/0x9b0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x162/0x210 kernel/softirq.c:735
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:check_preemption_disabled+0x0/0xe0 lib/smp_processor_id.c:13
Code: c0 75 0f 65 8b 05 fc 97 ab 08 85 c0 74 04 90 0f 0b 90 e9 53 fc ff ff 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <41> 54 55 53 48 83 ec 08 65 8b 1d d5 55 ab 08 65 f7 05 c6 55 ab 08
RSP: 0000:ffffc9000378f528 EFLAGS: 00000283
RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffffffff84f62a83
RDX: ffff888055bcca80 RSI: ffffffff8c400900 RDI: ffffffff8c400940
RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff88802fe791a0
R13: 0000000000000008 R14: ffffea0001b87a40 R15: ffff8880258955b8
 rcu_is_watching_curr_cpu include/linux/context_tracking.h:128 [inline]
 rcu_is_watching+0x12/0xc0 kernel/rcu/tree.c:752
 rcu_read_unlock_sched include/linux/rcupdate.h:960 [inline]
 pfn_valid+0x427/0x4e0 include/linux/mmzone.h:2280
 bvec_try_merge_page+0x128/0x290 block/bio.c:956
 bio_add_page+0x2d4/0x580 block/bio.c:1063
 bio_add_folio+0x60/0x90 block/bio.c:1107
 ext4_mpage_readpages.isra.0+0xfd2/0x1c40 fs/ext4/readpage.c:366
 ext4_readahead+0x174/0x2c0 fs/ext4/readpage.c:429
 read_pages+0x1b1/0xdf0 mm/readahead.c:174
 page_cache_ra_unbounded+0x5d0/0x990 mm/readahead.c:282
 do_page_cache_ra+0x10f/0x160 mm/readahead.c:348
 page_cache_ra_order+0xc05/0xed0 mm/readahead.c:558
 do_sync_mmap_readahead mm/filemap.c:3428 [inline]
 filemap_fault+0x1943/0x3130 mm/filemap.c:3582
 __do_fault+0x10b/0x440 mm/memory.c:5425
 do_read_fault mm/memory.c:5860 [inline]
 do_fault+0xa99/0x1750 mm/memory.c:5994
 do_pte_missing mm/memory.c:4566 [inline]
 handle_pte_fault mm/memory.c:6379 [inline]
 __handle_mm_fault+0x187d/0x2a00 mm/memory.c:6517
 handle_mm_fault+0x37b/0xa30 mm/memory.c:6686
 do_user_addr_fault+0x5a3/0x12f0 arch/x86/mm/fault.c:1343
 handle_page_fault arch/x86/mm/fault.c:1483 [inline]
 exc_page_fault+0x6f/0xd0 arch/x86/mm/fault.c:1536
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595
RIP: 0033:0x7f321fd815d8
Code: 0f 84 5e fd ff ff 48 89 f8 0f bc c9 f3 a4 c3 0f 1f 00 89 f8 62 a1 fd 00 ef c0 25 ff 0f 00 00 3d e0 0f 00 00 0f 87 28 01 00 00 <62> f1 7d 20 74 07 c5 fb 93 c0 85 c0 74 1a 0f bc c0 c3 66 0f 1f 44
RSP: 002b:00007fff20219a98 EFLAGS: 00010287
RAX: 00000000000009b2 RBX: 00007f321faf69b2 RCX: 0000000000000001
RDX: 0000000000000018 RSI: 00007f321f98af5f RDI: 00007f321faf69b2
RBP: ffffffffffffffff R08: 0000000000000000 R09: 0000000000000000
R10: 00007fff20219b61 R11: 0000000000000000 R12: 00007f321faf69b2
R13: 0000555de261b420 R14: 0000000000000001 R15: 0000555de261ed50
 </TASK>

Allocated by task 5827:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x2e5/0x6c0 mm/slub.c:5489
 _kmalloc_noprof include/linux/slab.h:988 [inline]
 batadv_forw_packet_alloc+0x3a9/0x4d0 net/batman-adv/send.c:506
 batadv_iv_ogm_aggregate_new+0x126/0x4b0 net/batman-adv/bat_iv_ogm.c:584
 batadv_iv_ogm_queue_add net/batman-adv/bat_iv_ogm.c:698 [inline]
 batadv_iv_ogm_schedule_buff+0x95d/0x15e0 net/batman-adv/bat_iv_ogm.c:870
 batadv_iv_ogm_schedule net/batman-adv/bat_iv_ogm.c:918 [inline]
 batadv_iv_ogm_schedule net/batman-adv/bat_iv_ogm.c:911 [inline]
 batadv_iv_send_outstanding_bat_ogm_packet+0x548/0x800 net/batman-adv/bat_iv_ogm.c:1807
 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
 process_scheduled_works kernel/workqueue.c:3405 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Freed by task 5827:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2677 [inline]
 slab_free mm/slub.c:6377 [inline]
 kfree+0x22b/0x6c0 mm/slub.c:6692
 batadv_iv_send_outstanding_bat_ogm_packet+0x275/0x800 net/batman-adv/bat_iv_ogm.c:1813
 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
 process_scheduled_works kernel/workqueue.c:3405 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Last potentially related work creation:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_record_aux_stack+0xa7/0xc0 mm/kasan/generic.c:556
 insert_work+0x36/0x230 kernel/workqueue.c:2226
 __queue_work+0x425/0x12b0 kernel/workqueue.c:2405
 call_timer_fn+0x19a/0x610 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1794 [inline]
 __run_timers+0x570/0xb00 kernel/time/timer.c:2374
 __run_timer_base kernel/time/timer.c:2386 [inline]
 __run_timer_base kernel/time/timer.c:2378 [inline]
 run_timer_base+0x114/0x190 kernel/time/timer.c:2395
 run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2405
 handle_softirqs+0x1ea/0x9b0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x162/0x210 kernel/softirq.c:735
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674

The buggy address belongs to the object at ffff8880690f7000
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 338 bytes inside of
 freed 512-byte region [ffff8880690f7000, ffff8880690f7200)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880690f5400 pfn:0x690f4
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x4fff00000000240(workingset|head|node=1|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 04fff00000000240 ffff88801bc42c80 ffffea0001d5cb10 ffffea00012cde10
raw: ffff8880690f5400 000000080010000c 00000000f5000000 0000000000000000
head: 04fff00000000240 ffff88801bc42c80 ffffea0001d5cb10 ffffea00012cde10
head: ffff8880690f5400 000000080010000c 00000000f5000000 0000000000000000
head: 04fff00000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 13995, tgid 13994 (syz.8.2275), ts 427966041964, free_ts 416351676750
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859
 prep_new_page mm/page_alloc.c:1867 [inline]
 get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304
 alloc_slab_page mm/slub.c:3266 [inline]
 allocate_slab mm/slub.c:3380 [inline]
 new_slab+0xa2/0x640 mm/slub.c:3426
 refill_objects+0xe3/0x410 mm/slub.c:7310
 refill_sheaf mm/slub.c:2804 [inline]
 __pcs_replace_empty_main+0x376/0x680 mm/slub.c:4675
 alloc_from_pcs mm/slub.c:4773 [inline]
 slab_alloc_node mm/slub.c:4905 [inline]
 __do_kmalloc_node mm/slub.c:5333 [inline]
 __kmalloc_noprof+0x66d/0x820 mm/slub.c:5359
 _kmalloc_noprof include/linux/slab.h:992 [inline]
 _kzalloc_noprof include/linux/slab.h:1309 [inline]
 hash_ipportnet6_add+0x261d/0x2e20 net/netfilter/ipset/ip_set_hash_gen.h:978
 hash_ipportnet6_uadt+0xc4e/0x10f0 net/netfilter/ipset/ip_set_hash_ipportnet.c:507
 call_ad.isra.0+0x16e/0x940 net/netfilter/ipset/ip_set_core.c:1758
 ip_set_ad.isra.0+0x3eb/0x8a0 net/netfilter/ipset/ip_set_core.c:1848
 nfnetlink_rcv_msg+0x9d5/0x11e0 net/netfilter/nfnetlink.c:300
 netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2556
 nfnetlink_rcv+0x1b3/0x440 net/netfilter/nfnetlink.c:667
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x585/0x850 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x8b0/0xda0 net/netlink/af_netlink.c:1900
page last free pid 13706 tgid 13706 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1406 [inline]
 __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950
 __folio_put+0x3b4/0x5f0 mm/swap.c:112
 folio_put include/linux/mm.h:2124 [inline]
 put_page include/linux/mm.h:2193 [inline]
 put_netmem include/net/netmem.h:394 [inline]
 skb_page_unref include/linux/skbuff_ref.h:43 [inline]
 __skb_frag_unref include/linux/skbuff_ref.h:56 [inline]
 skb_release_data+0x649/0x8e0 net/core/skbuff.c:1110
 skb_release_all net/core/skbuff.c:1191 [inline]
 kfree_skb_add_bulk net/core/skbuff.c:1265 [inline]
 kfree_skb_list_reason+0x2bd/0x4b0 net/core/skbuff.c:1287
 skb_release_data+0x6b8/0x8e0 net/core/skbuff.c:1114
 skb_release_all net/core/skbuff.c:1191 [inline]
 __kfree_skb net/core/skbuff.c:1205 [inline]
 sk_skb_reason_drop+0x102/0x1b0 net/core/skbuff.c:1244
 kfree_skb_reason include/linux/skbuff.h:1323 [inline]
 kfree_skb include/linux/skbuff.h:1332 [inline]
 kcm_release+0x178/0x740 net/kcm/kcmsock.c:1695
 __sock_release+0xb3/0x260 net/socket.c:710
 sock_close+0x1c/0x30 net/socket.c:1501
 __fput+0x3ff/0xb50 fs/file_table.c:512
 task_work_run+0x150/0x240 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:70 [inline]
 exit_to_user_mode_loop+0x1d8/0x6f0 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
 __do_fast_syscall_32+0x701/0x970 arch/x86/entry/syscall_32.c:310
 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:332
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e

Memory state around the buggy address:
 ffff8880690f7000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880690f7080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880690f7100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                 ^
 ffff8880690f7180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880690f7200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
----------------
Code disassembly (best guess):
   0:	c0 75 0f 65          	shlb   $0x65,0xf(%rbp)
   4:	8b 05 fc 97 ab 08    	mov    0x8ab97fc(%rip),%eax        # 0x8ab9806
   a:	85 c0                	test   %eax,%eax
   c:	74 04                	je     0x12
   e:	90                   	nop
   f:	0f 0b                	ud2
  11:	90                   	nop
  12:	e9 53 fc ff ff       	jmp    0xfffffc6a
  17:	0f 1f 00             	nopl   (%rax)
  1a:	90                   	nop
  1b:	90                   	nop
  1c:	90                   	nop
  1d:	90                   	nop
  1e:	90                   	nop
  1f:	90                   	nop
  20:	90                   	nop
  21:	90                   	nop
  22:	90                   	nop
  23:	90                   	nop
  24:	90                   	nop
  25:	90                   	nop
  26:	90                   	nop
  27:	90                   	nop
  28:	90                   	nop
  29:	90                   	nop
* 2a:	41 54                	push   %r12 <-- trapping instruction
  2c:	55                   	push   %rbp
  2d:	53                   	push   %rbx
  2e:	48 83 ec 08          	sub    $0x8,%rsp
  32:	65 8b 1d d5 55 ab 08 	mov    %gs:0x8ab55d5(%rip),%ebx        # 0x8ab560e
  39:	65                   	gs
  3a:	f7                   	.byte 0xf7
  3b:	05 c6 55 ab 08       	add    $0x8ab55c6,%eax