==================================================================
BUG: KASAN: use-after-free in mcp2221_raw_event+0x10b0/0x12a0 drivers/hid/hid-mcp2221.c:964
Read of size 1 at addr ffff8880473f7fff by task syz.7.5621/27245

CPU: 0 UID: 0 PID: 27245 Comm: syz.7.5621 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 mcp2221_raw_event+0x10b0/0x12a0 drivers/hid/hid-mcp2221.c:964
 __hid_input_report+0x428/0x590 drivers/hid/hid-core.c:2161
 hid_irq_in+0x495/0x710 drivers/hid/usbhid/hid-core.c:286
 __usb_hcd_giveback_urb+0x376/0x540 drivers/usb/core/hcd.c:1655
 dummy_timer+0xbc0/0x4650 drivers/usb/gadget/udc/dummy_hcd.c:2005
 __run_hrtimer kernel/time/hrtimer.c:1930 [inline]
 __hrtimer_run_queues+0x3c0/0xa20 kernel/time/hrtimer.c:1994
 hrtimer_run_softirq+0x17a/0x240 kernel/time/hrtimer.c:2011
 handle_softirqs+0x22a/0x840 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xca/0x220 kernel/softirq.c:735
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1061
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:finish_task_switch+0x427/0xbe0 kernel/sched/core.c:5245
Code: 41 c7 84 24 e0 0d 00 00 00 00 00 00 e9 27 06 00 00 49 83 c4 48 4c 89 e7 e8 46 2a 15 0a e8 a1 fd 38 00 fb 49 8d bd c8 16 00 00 <48> 89 f8 48 c1 e8 03 42 0f b6 04 38 84 c0 0f 85 7b 03 00 00 41 80
RSP: 0018:ffffc90005106e90 EFLAGS: 00000202
RAX: 00000000000009e3 RBX: 1ffff110170c778c RCX: 0000000080000001
RDX: 0000000000000006 RSI: ffffffff8dfa4398 RDI: ffff88802a3cb5c8
RBP: ffffc90005106ef0 R08: ffffffff90302af7 R09: 1ffffffff206055e
R10: dffffc0000000000 R11: fffffbfff206055f R12: ffff8880b863aec8
R13: ffff88802a3c9f00 R14: ffff88801def3e00 R15: dffffc0000000000
 context_switch kernel/sched/core.c:5391 [inline]
 __schedule+0x1829/0x5740 kernel/sched/core.c:7189
 preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7513
 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline]
 irqentry_exit+0x14f/0x8b0 kernel/entry/common.c:164
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:orc_find arch/x86/kernel/unwind_orc.c:228 [inline]
RIP: 0010:unwind_next_frame+0x214/0x2550 arch/x86/kernel/unwind_orc.c:510
Code: ef 08 8b 15 5e 49 af 0c 8d 42 ff 44 39 f8 0f 86 73 04 00 00 44 89 f8 4c 8d 2c 85 a0 58 70 91 4c 89 e8 48 c1 e8 03 0f b6 04 28 <84> c0 48 89 eb 0f 85 85 1d 00 00 45 8b 6d 00 44 89 f8 ff c0 48 8d
RSP: 0018:ffffc90005107238 EFLAGS: 00000a06
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000080000000
RDX: 00000000000aab3e RSI: ffffffff8c28b8c0 RDI: ffffffff8c28b880
RBP: dffffc0000000000 R08: ffffffff8176e256 R09: ffffffff8e95cc20
R10: ffffc90005107368 R11: fffff52000a20e79 R12: ffffffff81770cd6
R13: ffffffff917234d0 R14: ffffc90005107368 R15: 000000000000770c
 __unwind_start+0x5b8/0x760 arch/x86/kernel/unwind_orc.c:787
 unwind_start arch/x86/include/asm/unwind.h:64 [inline]
 arch_stack_walk+0xe3/0x150 arch/x86/kernel/stacktrace.c:24
 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x31c/0x660 mm/slub.c:5420
 kmalloc_noprof include/linux/slab.h:950 [inline]
 slab_free_hook mm/slub.c:2641 [inline]
 slab_free mm/slub.c:6251 [inline]
 kmem_cache_free+0x156/0x650 mm/slub.c:6378
 tear_down_vmas+0x312/0x520 mm/mmap.c:1262
 exit_mmap+0x4b6/0x9e0 mm/mmap.c:1320
 __mmput+0x118/0x430 kernel/fork.c:1178
 exit_mm+0x1f6/0x2d0 kernel/exit.c:582
 do_exit+0x6a2/0x22c0 kernel/exit.c:964
 do_group_exit+0x21b/0x2d0 kernel/exit.c:1119
 get_signal+0x1284/0x1330 kernel/signal.c:3037
 arch_do_signal_or_restart+0xbc/0x840 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
 exit_to_user_mode_loop+0xa9/0x680 kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
 do_syscall_64+0x353/0x580 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff79bf9ce59
Code: Unable to access opcode bytes at 0x7ff79bf9ce2f.
RSP: 002b:00007ff79cef4028 EFLAGS: 00000246 ORIG_RAX: 000000000000010e
RAX: fffffffffffffdfe RBX: 00007ff79c215fa0 RCX: 00007ff79bf9ce59
RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000040
RBP: 00007ff79c032d6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000200000000180 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ff79c216038 R14: 00007ff79c215fa0 R15: 00007ff79c33fa48
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x2000001d0 pfn:0x473f7
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000100 dead000000000122 0000000000000000
raw: 00000002000001d0 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x140dc2(GFP_HIGHUSER|__GFP_ZERO|__GFP_COMP), pid 12505, tgid 12502 (syz.4.1744), ts 501955818489, free_ts 504110775166
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x22d/0x280 mm/page_alloc.c:1853
 prep_new_page mm/page_alloc.c:1861 [inline]
 get_page_from_freelist+0x2593/0x2610 mm/page_alloc.c:3941
 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5221
 alloc_pages_mpol+0x235/0x490 mm/mempolicy.c:2490
 folio_alloc_mpol_noprof+0x39/0x160 mm/mempolicy.c:2509
 vma_alloc_folio_noprof+0xe1/0x1e0 mm/mempolicy.c:2544
 folio_prealloc mm/memory.c:-1 [inline]
 alloc_anon_folio mm/memory.c:5298 [inline]
 do_anonymous_page mm/memory.c:5392 [inline]
 do_pte_missing+0x159d/0x33f0 mm/memory.c:4564
 handle_pte_fault mm/memory.c:6427 [inline]
 __handle_mm_fault mm/memory.c:6565 [inline]
 handle_mm_fault+0x1bf2/0x3170 mm/memory.c:6734
 faultin_page mm/gup.c:1126 [inline]
 __get_user_pages+0x167f/0x2730 mm/gup.c:1428
 __get_user_pages_locked mm/gup.c:1692 [inline]
 __gup_longterm_locked+0x3db/0x1630 mm/gup.c:2481
 pin_user_pages+0x9d/0xd0 mm/gup.c:3383
 xdp_umem_pin_pages+0x11b/0x340 net/xdp/xdp_umem.c:106
 xdp_umem_reg net/xdp/xdp_umem.c:232 [inline]
 xdp_umem_create+0x631/0x8b0 net/xdp/xdp_umem.c:265
 xsk_setsockopt+0x860/0x990 net/xdp/xsk.c:1654
 do_sock_setsockopt+0x17c/0x1b0 net/socket.c:2381
 __sys_setsockopt net/socket.c:2406 [inline]
 __do_sys_setsockopt net/socket.c:2412 [inline]
 __se_sys_setsockopt net/socket.c:2409 [inline]
 __x64_sys_setsockopt+0x13d/0x1b0 net/socket.c:2409
page last free pid 12502 tgid 12502 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1397 [inline]
 free_unref_folios+0xd9f/0x14c0 mm/page_alloc.c:2999
 folios_put_refs+0x9ff/0xb40 mm/swap.c:1008
 free_pages_and_swap_cache+0x2b9/0x490 mm/swap_state.c:401
 __tlb_batch_free_encoded_pages mm/mmu_gather.c:138 [inline]
 tlb_batch_pages_flush mm/mmu_gather.c:151 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:417 [inline]
 tlb_flush_mmu+0x6d3/0xa30 mm/mmu_gather.c:424
 zap_pte_range mm/memory.c:1973 [inline]
 zap_pmd_range mm/memory.c:2020 [inline]
 zap_pud_range mm/memory.c:2048 [inline]
 zap_p4d_range mm/memory.c:2069 [inline]
 __zap_vma_range+0x3de2/0x4b70 mm/memory.c:2109
 unmap_vmas+0x3ac/0x570 mm/memory.c:2178
 exit_mmap+0x280/0x9e0 mm/mmap.c:1300
 __mmput+0x118/0x430 kernel/fork.c:1178
 exit_mm+0x1f6/0x2d0 kernel/exit.c:582
 do_exit+0x6a2/0x22c0 kernel/exit.c:964
 do_group_exit+0x21b/0x2d0 kernel/exit.c:1119
 __do_sys_exit_group kernel/exit.c:1130 [inline]
 __se_sys_exit_group kernel/exit.c:1128 [inline]
 __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1128
 x64_sys_call+0x221a/0x2240 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff8880473f7e80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8880473f7f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8880473f7f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                                ^
 ffff8880473f8000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8880473f8080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess):
   0:	41 c7 84 24 e0 0d 00 	movl   $0x0,0xde0(%r12)
   7:	00 00 00 00 00
   c:	e9 27 06 00 00       	jmp    0x638
  11:	49 83 c4 48          	add    $0x48,%r12
  15:	4c 89 e7             	mov    %r12,%rdi
  18:	e8 46 2a 15 0a       	call   0xa152a63
  1d:	e8 a1 fd 38 00       	call   0x38fdc3
  22:	fb                   	sti
  23:	49 8d bd c8 16 00 00 	lea    0x16c8(%r13),%rdi
* 2a:	48 89 f8             	mov    %rdi,%rax <-- trapping instruction
  2d:	48 c1 e8 03          	shr    $0x3,%rax
  31:	42 0f b6 04 38       	movzbl (%rax,%r15,1),%eax
  36:	84 c0                	test   %al,%al
  38:	0f 85 7b 03 00 00    	jne    0x3b9
  3e:	41                   	rex.B
  3f:	80                   	.byte 0x80