ci starts bisection 2023-08-20 22:44:20.510086887 +0000 UTC m=+207025.227448862 bisecting cause commit starting from 7271b2a530428b879443b274c191b34536a4ea11 building syzkaller on d216d8a03b50bef82eac746d227230835f061640 ensuring issue is reproducible on original commit 7271b2a530428b879443b274c191b34536a4ea11 testing commit 7271b2a530428b879443b274c191b34536a4ea11 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: c1e9834c844bf7d5720769c55d03058c031477314946a167da687803c43f8bdc all runs: crashed: KASAN: slab-use-after-free Read in input_dev_uevent representative crash: KASAN: slab-use-after-free Read in input_dev_uevent, types: [KASAN] check whether we can drop unnecessary instrumentation disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed testing commit 7271b2a530428b879443b274c191b34536a4ea11 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 0dbeff544e09c21b916f329630a2b4eaf6e383bb41340b7e3748e64d998c5d4a all runs: crashed: KASAN: slab-use-after-free Read in input_dev_uevent representative crash: KASAN: slab-use-after-free Read in input_dev_uevent, types: [KASAN] the bug reproduces without the instrumentation disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed kconfig minimization: base=3883 full=7688 leaves diff=2018 split chunks (needed=false): <2018> split chunk #0 of len 2018 into 5 parts testing without sub-chunk 1/5 disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed testing commit 7271b2a530428b879443b274c191b34536a4ea11 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 4076d570f9a90ed458861a8b615186cfb5a5aa480095f1f930f1470069333b4c all runs: crashed: KASAN: slab-use-after-free Read in input_dev_uevent representative crash: KASAN: slab-use-after-free Read in input_dev_uevent, types: [KASAN] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [BUG LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed testing commit 7271b2a530428b879443b274c191b34536a4ea11 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 5323d648da409e8f838e2207716210f640e68e577d27a2d4fce1d43a10ddfb2d all runs: OK false negative chance: 0.000 testing without sub-chunk 3/5 disabling configs for [LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG], they are not needed testing commit 7271b2a530428b879443b274c191b34536a4ea11 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: ea8aed081a69e15f8dff2f6a74cb088c2f1a660affd075594de09b2682ba39fe all runs: crashed: KASAN: slab-use-after-free Read in input_dev_uevent representative crash: KASAN: slab-use-after-free Read in input_dev_uevent, types: [KASAN] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG], they are not needed testing commit 7271b2a530428b879443b274c191b34536a4ea11 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 280f07968c8d04efe219663d6633fdb530c39b40df45c876d3120f74bc05a544 all runs: crashed: KASAN: slab-use-after-free Read in input_dev_uevent representative crash: KASAN: slab-use-after-free Read in input_dev_uevent, types: [KASAN] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed testing commit 7271b2a530428b879443b274c191b34536a4ea11 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 9fdeec39e500730b091325a9f51bc1a5ada139ac8c09d85bc8c27decd5c0349c all runs: OK false negative chance: 0.000 minimized to 806 configs; suspects: [6LOWPAN ARCH_ENABLE_MEMORY_HOTREMOVE ASUS_WMI ATM BCMA BLK_DEV_ZONED BPF_SYSCALL CARDBUS CFG80211 CFG80211_WEXT CMA COMMON_CLK CONTIG_ALLOC CRYPTO_842 CRYPTO_LZ4 CRYPTO_LZ4HC CRYPTO_LZO CRYPTO_ZSTD DAX DLM DM_VERITY DM_VERITY_FEC DM_WRITECACHE DM_ZONED DRAGONRISE_FF DRM DRM_BOCHS DRM_BRIDGE DRM_BUDDY DRM_CIRRUS_QEMU DRM_DEBUG_MM DRM_DISPLAY_DP_HELPER DRM_DISPLAY_HDCP_HELPER DRM_DISPLAY_HDMI_HELPER DRM_DISPLAY_HELPER DRM_DP_AUX_BUS DRM_DP_AUX_CHARDEV DRM_FBDEV_EMULATION DRM_GEM_SHMEM_HELPER DRM_I915 DRM_I915_CAPTURE_ERROR DRM_I915_COMPRESS_ERROR DRM_I915_USERPTR DRM_KMS_HELPER DRM_MIPI_DSI DRM_PANEL DRM_PANEL_BRIDGE DRM_PANEL_EDP DRM_PANEL_ORIENTATION_QUIRKS DRM_SIMPLEDRM DRM_TTM DRM_TTM_HELPER DRM_UDL DRM_VGEM DRM_VIRTIO_GPU DRM_VIRTIO_GPU_KMS DRM_VKMS DRM_VMWGFX DRM_VRAM_HELPER DUMMY DVB_AF9013 DVB_AF9033 DVB_AS102 DVB_AS102_FE DVB_B2C2_FLEXCOP DVB_B2C2_FLEXCOP_USB DVB_CORE DVB_DIB3000MB DVB_DIB3000MC DVB_EC100 DVB_GP8PSK_FE DVB_RTL2830 DVB_RTL2832 DVB_RTL2832_SDR DVB_TEST_DRIVERS DVB_TTUSB_BUDGET DVB_TTUSB_DEC DVB_USB DVB_USB_A800 DVB_USB_AF9005 DVB_USB_AF9005_REMOTE DVB_USB_AF9015 DVB_USB_AF9035 DVB_USB_ANYSEE DVB_USB_AU6610 DVB_USB_AZ6007 DVB_USB_AZ6027 DVB_USB_CE6230 DVB_USB_CINERGY_T2 DVB_USB_CXUSB DVB_USB_DIB0700 DVB_USB_DIB3000MC DVB_USB_DIBUSB_MB DVB_USB_DIBUSB_MC DVB_USB_DIGITV DVB_USB_DTT200U DVB_USB_DTV5100 DVB_USB_DVBSKY DVB_USB_DW2102 DVB_USB_EC168 DVB_USB_GL861 DVB_USB_GP8PSK DVB_USB_LME2510 DVB_USB_M920X DVB_USB_MXL111SF DVB_USB_NOVA_T_USB2 DVB_USB_OPERA1 DVB_USB_PCTV452E DVB_USB_RTL28XXU DVB_USB_TECHNISAT_USB2 DVB_USB_TTUSB2 DVB_USB_UMT_010 DVB_USB_V2 DVB_USB_VP702X DVB_USB_VP7045 DVB_USB_ZD1301 DVB_VIDTV DVB_ZL10353 ECRYPT_FS ECRYPT_FS_MESSAGING EDAC EEPROM_93CX6 EFS_FS ENCRYPTED_KEYS EQUALIZER EROFS_FS EROFS_FS_POSIX_ACL EROFS_FS_SECURITY EROFS_FS_XATTR EROFS_FS_ZIP EVM EVM_ADD_XATTRS EVM_ATTR_FSUUID EXFAT_FS EXPORTFS_BLOCK_OPS EXT3_FS EXT3_FS_POSIX_ACL EXT3_FS_SECURITY EXTCON EXTCON_INTEL_CHT_WC F2FS_CHECK_FS F2FS_FAULT_INJECTION F2FS_FS F2FS_FS_COMPRESSION F2FS_FS_LZ4 F2FS_FS_LZ4HC F2FS_FS_LZO F2FS_FS_LZORLE F2FS_FS_POSIX_ACL F2FS_FS_SECURITY F2FS_FS_XATTR F2FS_FS_ZSTD F2FS_STAT_FS FANOTIFY FANOTIFY_ACCESS_PERMISSIONS FB FB_CFB_COPYAREA FB_CFB_FILLRECT FB_CFB_IMAGEBLIT FB_CORE FB_DEFERRED_IO FB_DEVICE FB_IOMEM_HELPERS FB_NOTIFY FB_SYSMEM_HELPERS FB_SYSMEM_HELPERS_DEFERRED FB_SYS_COPYAREA FB_SYS_FILLRECT FB_SYS_FOPS FB_SYS_IMAGEBLIT FB_TILEBLITTING FB_VESA FB_VGA16 FB_VIRTUAL FDDI FIREWIRE FIREWIRE_NET FIREWIRE_OHCI FIREWIRE_SBP2 FONT_8x16 FONT_8x8 FONT_SUPPORT FRAMEBUFFER_CONSOLE FRAMEBUFFER_CONSOLE_DETECT_PRIMARY FRAMEBUFFER_CONSOLE_ROTATION FS_DAX FS_DAX_PMD FS_ENCRYPTION FS_ENCRYPTION_ALGS FS_VERITY FS_VERITY_BUILTIN_SIGNATURES FTL FUSE_DAX FUSE_FS FW_LOADER_COMPRESS FW_LOADER_PAGED_BUF FW_LOADER_SYSFS FW_LOADER_USER_HELPER FW_LOADER_USER_HELPER_FALLBACK GACT_PROB GARP GENERIC_PHY GET_FREE_REGION GFS2_FS GFS2_FS_LOCKING_DLM GOOGLE_COREBOOT_TABLE GOOGLE_FIRMWARE GOOGLE_MEMCONSOLE GOOGLE_MEMCONSOLE_COREBOOT GOOGLE_VPD GPIOLIB GPIOLIB_IRQCHIP GPIO_ACPI GPIO_DLN2 GPIO_VIPERBOARD GREENASIA_FF GREYBUS GREYBUS_BRIDGED_PHY GREYBUS_ES2 GREYBUS_HID GREYBUS_USB GTP GUEST_PERF_EVENTS GVE HAVE_ARCH_NODE_DEV_GROUP HAVE_ARCH_USERFAULTFD_MINOR HAVE_ARCH_USERFAULTFD_WP HAVE_BOOTMEM_INFO_NODE HAVE_CLK_PREPARE HAVE_KVM_CPU_RELAX_INTERCEPT HAVE_KVM_DIRTY_RING HAVE_KVM_DIRTY_RING_ACQ_REL HAVE_KVM_DIRTY_RING_TSO HAVE_KVM_EVENTFD HAVE_KVM_IRQCHIP HAVE_KVM_IRQFD HAVE_KVM_IRQ_BYPASS HAVE_KVM_IRQ_ROUTING HAVE_KVM_MSI HAVE_KVM_NO_POLL HAVE_KVM_PFNCACHE HAVE_KVM_PM_NOTIFIER HAVE_SCHED_AVG_IRQ HDLC HDLC_CISCO HDLC_FR HDLC_PPP HDLC_RAW HDLC_RAW_ETH HDLC_X25 HDMI HFSPLUS_FS HFS_FS HID_ACCUTOUCH HID_ACRUX HID_ACRUX_FF HID_ALPS HID_APPLEIR HID_ASUS HID_AUREAL HID_BATTERY_STRENGTH HID_BETOP_FF HID_CMEDIA HID_CORSAIR HID_CP2112 HID_DRAGONRISE HID_ELECOM HID_ELO HID_EMS_FF HID_GEMBIRD HID_GFRM HID_GREENASIA HID_GT683R HID_HOLTEK HID_ICADE HID_KEYTOUCH HID_KYE HID_LCPOWER HID_LED HID_LENOVO HID_LOGITECH_DJ HID_LOGITECH_HIDPP HID_MAGICMOUSE HID_MAYFLASH HID_MULTITOUCH HID_NTI HID_ORTEK HID_PENMOUNT HID_PICOLCD HID_PICOLCD_BACKLIGHT HID_PICOLCD_CIR HID_PICOLCD_FB HID_PICOLCD_LCD HID_PICOLCD_LEDS HID_PLANTRONICS HID_PRIMAX HID_PRODIKEYS HID_RETRODE HID_RMI HID_ROCCAT HID_SAITEK HID_SENSOR_ACCEL_3D HID_SENSOR_ALS HID_SENSOR_CUSTOM_SENSOR HID_SENSOR_DEVICE_ROTATION HID_SENSOR_GYRO_3D HID_SENSOR_HUB HID_SENSOR_HUMIDITY HID_SENSOR_IIO_COMMON HID_SENSOR_IIO_TRIGGER HID_SENSOR_INCLINOMETER_3D HID_SENSOR_MAGNETOMETER_3D HID_SENSOR_PRESS HID_SENSOR_PROX HID_SENSOR_TEMP HID_SPEEDLINK HID_STEELSERIES HID_THINGM HID_TIVO HID_TWINHAN HID_UCLOGIC HID_UDRAW_PS3 HID_WACOM HID_WALTOP HID_WIIMOTE HID_XINMO HID_ZEROPLUS HID_ZYDACRON HMM_MIRROR HOLTEK_FF HOTPLUG_PCI_PCIE HPET_MMAP HPET_MMAP_DEFAULT HPFS_FS I2C_ALGOBIT I2C_CHARDEV I2C_DESIGNWARE_CORE I2C_DESIGNWARE_PLATFORM I2C_DIOLAN_U2C I2C_DLN2 I2C_MUX I2C_MUX_REG I2C_ROBOTFUZZ_OSIF I2C_SI4713 I2C_SLAVE I2C_SLAVE_EEPROM I2C_TINY_USB I2C_VIPERBOARD IEEE802154 IEEE802154_6LOWPAN IEEE802154_ATUSB IEEE802154_DRIVERS IEEE802154_HWSIM IEEE802154_NL802154_EXPERIMENTAL IEEE802154_SOCKET IFB IIO IIO_BUFFER IIO_KFIFO_BUF IIO_TRIGGER IIO_TRIGGERED_BUFFER IKCONFIG IKCONFIG_PROC IMA IMA_APPRAISE IMA_APPRAISE_MODSIG IMA_DEFAULT_HASH_SHA256 IMA_LSM_RULES IMA_MEASURE_ASYMMETRIC_KEYS IMA_NG_TEMPLATE IMA_QUEUE_EARLY_BOOT_KEYS IMA_READ_POLICY IMA_WRITE_POLICY INET6_ESPINTCP INET6_ESP_OFFLOAD INET6_IPCOMP INET6_TUNNEL INET6_XFRM_TUNNEL INET_AH INET_DCCP_DIAG INET_DIAG INET_DIAG_DESTROY INET_ESP INET_ESPINTCP INET_ESP_OFFLOAD INET_IPCOMP INET_MPTCP_DIAG INET_RAW_DIAG INET_SCTP_DIAG INET_TCP_DIAG INET_UDP_DIAG INET_XFRM_TUNNEL INFINIBAND INFINIBAND_ADDR_TRANS INFINIBAND_ADDR_TRANS_CONFIGFS INFINIBAND_IPOIB INFINIBAND_IPOIB_CM INFINIBAND_IPOIB_DEBUG INFINIBAND_ISER INFINIBAND_ON_DEMAND_PAGING INFINIBAND_RTRS INFINIBAND_SRP INFINIBAND_USER_ACCESS INFINIBAND_USER_MAD INFINIBAND_USER_MEM INPUT_ATI_REMOTE2 INPUT_CM109 INPUT_IMS_PCU INPUT_JOYDEV INPUT_KEYSPAN_REMOTE INPUT_LEDS INPUT_MOUSEDEV INPUT_MOUSEDEV_PSAUX INPUT_POWERMATE INPUT_UINPUT INPUT_YEALINK INTEGRITY INTEGRITY_ASYMMETRIC_KEYS INTEGRITY_AUDIT INTEGRITY_SIGNATURE INTEGRITY_TRUSTED_KEYRING INTEL_IDMA64 INTEL_IOATDMA INTEL_IOMMU_DEFAULT_ON INTEL_IOMMU_SVM INTEL_ISH_HID INTEL_SOC_PMIC_CHTWC INTERVAL_TREE INTERVAL_TREE_SPAN_ITER IOMMUFD IOMMUFD_TEST IOMMU_SVA IP6_NF_MATCH_AH IP6_NF_MATCH_EUI64 IP6_NF_MATCH_FRAG IP6_NF_MATCH_HL IP6_NF_MATCH_MH IP6_NF_MATCH_OPTS IP6_NF_MATCH_RPFILTER IP6_NF_MATCH_RT IP6_NF_MATCH_SRH IP6_NF_NAT IP6_NF_RAW IP6_NF_SECURITY IP6_NF_TARGET_HL IP6_NF_TARGET_MASQUERADE IP6_NF_TARGET_NPT IP6_NF_TARGET_SYNPROXY IPV6_FOU IPV6_FOU_TUNNEL IPV6_GRE IPV6_ILA IPV6_MIP6 IPV6_MROUTE IPV6_MROUTE_MULTIPLE_TABLES IPV6_MULTIPLE_TABLES IPV6_OPTIMISTIC_DAD IPV6_PIMSM_V2 IPV6_ROUTER_PREF IPV6_ROUTE_INFO IPV6_RPL_LWTUNNEL IPV6_SEG6_BPF IPV6_SEG6_HMAC IPV6_SEG6_LWTUNNEL IPV6_SIT_6RD IPV6_SUBTREES IPV6_TUNNEL IPV6_VTI IPVLAN IPVLAN_L3S IPVTAP IP_DCCP IP_DCCP_CCID3 IP_DCCP_TFRC_LIB IP_FIB_TRIE_STATS IP_MROUTE_MULTIPLE_TABLES IP_NF_ARPFILTER IP_NF_ARPTABLES IP_NF_ARP_MANGLE IP_NF_MATCH_AH IP_NF_MATCH_ECN IP_NF_MATCH_RPFILTER IP_NF_MATCH_TTL IP_NF_RAW IP_NF_SECURITY IP_NF_TARGET_ECN IP_NF_TARGET_NETMAP IP_NF_TARGET_REDIRECT IP_NF_TARGET_SYNPROXY IP_NF_TARGET_TTL IP_ROUTE_CLASSID IP_SCTP IP_SET IP_SET_BITMAP_IP IP_SET_BITMAP_IPMAC IP_SET_BITMAP_PORT IP_SET_HASH_IP IP_SET_HASH_IPMAC IP_SET_HASH_IPMARK IP_SET_HASH_IPPORT IP_SET_HASH_IPPORTIP IP_SET_HASH_IPPORTNET IP_SET_HASH_MAC IP_SET_HASH_NET IP_SET_HASH_NETIFACE IP_SET_HASH_NETNET IP_SET_HASH_NETPORT IP_SET_HASH_NETPORTNET IP_SET_LIST_SET IP_VS IP_VS_DH IP_VS_FO IP_VS_FTP IP_VS_IPV6 IP_VS_LBLC IP_VS_LBLCR IP_VS_PROTO_TCP IRQ_REMAP IRQ_TIME_ACCOUNTING KVM KVM_INTEL LAPB LCD_CLASS_DEVICE LIBNVDIMM MAC802154 MEDIA_ANALOG_TV_SUPPORT MEDIA_CAMERA_SUPPORT MEDIA_CEC_SUPPORT MEDIA_CONTROLLER MEDIA_DIGITAL_TV_SUPPORT MEDIA_RADIO_SUPPORT MEDIA_SDR_SUPPORT MEDIA_SUPPORT MEDIA_TEST_SUPPORT MEDIA_USB_SUPPORT MEMORY_HOTPLUG MEMORY_HOTREMOVE MFD_DLN2 MFD_VIPERBOARD MPTCP MTD NETFILTER_ADVANCED NET_ACT_GACT NET_ACT_MIRRED NET_IPGRE_DEMUX NFT_FWD_NETDEV NF_TABLES NF_TABLES_NETDEV PARPORT PCCARD PCMCIA PHONET RADIO_ADAPTERS RADIO_SI470X RADIO_SI4713 RAS RC_CORE RFKILL SND SOUND SPI SSB STAGING TAP TARGET_CORE TRANSPARENT_HUGEPAGE TUN USB_AMD5536UDC USB_ATM USB_CONFIGFS USB_CONFIGFS_F_MIDI USB_CONFIGFS_F_PRINTER USB_CONFIGFS_F_TCM USB_CONFIGFS_F_UAC1 USB_CONFIGFS_F_UAC1_LEGACY USB_CONFIGFS_F_UAC2 USB_CONFIGFS_F_UVC USB_CONFIGFS_MASS_STORAGE USB_CONFIGFS_NCM USB_CONFIGFS_OBEX USB_CONFIGFS_PHONET USB_CONFIGFS_RNDIS USB_CONFIGFS_SERIAL USB_CXACRU USB_CYPRESS_CY7C63 USB_CYTHERM USB_DSBR USB_DUMMY_HCD USB_DWC2 USB_DWC2_HOST USB_DWC2_PCI USB_DWC3 USB_DWC3_GADGET USB_DWC3_OF_SIMPLE USB_DWC3_PCI USB_DWC3_ULPI USB_DYNAMIC_MINORS USB_EG20T USB_EHCI_HCD_PLATFORM USB_EHCI_ROOT_HUB_TT USB_EHSET_TEST_FIXTURE USB_EMI26 USB_EMI62 USB_EPSON2888 USB_EZUSB_FX2 USB_FEW_INIT_RETRIES USB_F_ACM USB_F_ECM USB_F_EEM USB_F_FS USB_F_HID USB_F_MASS_STORAGE USB_F_MIDI USB_F_NCM USB_F_OBEX USB_F_PHONET USB_F_PRINTER USB_F_RNDIS USB_F_SERIAL USB_F_SS_LB USB_F_SUBSET USB_F_TCM USB_F_UAC1 USB_F_UAC1_LEGACY USB_F_UAC2 USB_F_UVC USB_GADGET USB_GADGETFS USB_GADGET_DEBUG_FILES USB_GADGET_DEBUG_FS USB_GL860 USB_GOKU USB_GPIO_VBUS USB_GR_UDC USB_GSPCA USB_GSPCA_BENQ USB_GSPCA_CONEX USB_GSPCA_CPIA1 USB_GSPCA_DTCS033 USB_GSPCA_ETOMS USB_GSPCA_FINEPIX USB_GSPCA_JEILINJ USB_GSPCA_JL2005BCD USB_GSPCA_KINECT USB_GSPCA_KONICA USB_GSPCA_MARS USB_GSPCA_MR97310A USB_GSPCA_NW80X USB_GSPCA_OV519 USB_GSPCA_OV534 USB_GSPCA_OV534_9 USB_GSPCA_PAC207 USB_GSPCA_PAC7302 USB_GSPCA_PAC7311 USB_GSPCA_SE401 USB_GSPCA_SN9C2028 USB_GSPCA_SN9C20X USB_GSPCA_SONIXB USB_GSPCA_SONIXJ USB_GSPCA_SPCA1528 USB_GSPCA_SPCA500 USB_GSPCA_SPCA501 USB_GSPCA_SPCA505 USB_GSPCA_SPCA506 USB_GSPCA_SPCA508 USB_GSPCA_SPCA561 USB_GSPCA_SQ905 USB_GSPCA_SQ905C USB_GSPCA_SQ930X USB_GSPCA_STK014 USB_GSPCA_STK1135 USB_GSPCA_STV0680 USB_GSPCA_SUNPLUS USB_GSPCA_T613 USB_GSPCA_TOPRO USB_GSPCA_TOUPTEK USB_GSPCA_TV8532 USB_GSPCA_VC032X USB_GSPCA_VICAM USB_GSPCA_XIRLINK_CIT USB_GSPCA_ZC3XX USB_HACKRF USB_HCD_BCMA USB_HCD_SSB USB_HSIC_USB3503 USB_HSIC_USB4604 USB_HSO USB_HUB_USB251XB USB_IDMOUSE USB_IOWARRIOR USB_IPHETH USB_ISIGHTFW USB_ISP116X_HCD USB_ISP1301 USB_ISP1760 USB_ISP1760_DUAL_ROLE USB_ISP1760_HCD USB_ISP1761_UDC USB_KAWETH USB_KC2190 USB_KEENE USB_LAN78XX USB_LCD USB_LD USB_LEDS_TRIGGER_USBPORT USB_LED_TRIG USB_LEGOTOWER USB_LIBCOMPOSITE USB_LINK_LAYER_TEST USB_M5602 USB_MA901 USB_MAX3421_HCD USB_MDC800 USB_MICROTEK USB_MR800 USB_MSI2500 USB_MUSB_DUAL_ROLE USB_MUSB_HDRC USB_MV_U3D USB_MV_UDC USB_NET2272 USB_NET2272_DMA USB_NET2280 USB_NET_AX88179_178A USB_NET_AX8817X USB_NET_CDCETHER USB_NET_CDC_EEM USB_NET_CDC_MBIM USB_NET_CDC_NCM USB_NET_CDC_SUBSET USB_NET_CDC_SUBSET_ENABLE USB_NET_CH9200 USB_NET_CX82310_ETH USB_NET_DM9601 USB_NET_GL620A USB_NET_HUAWEI_CDC_NCM USB_NET_INT51X1 USB_NET_KALMIA USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_QMI_WWAN USB_NET_RNDIS_HOST USB_NET_RNDIS_WLAN USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_OXU210HP_HCD USB_PEGASUS USB_PULSE8_CEC USB_PWC USB_PWC_INPUT_EVDEV USB_PXA27X USB_R8A66597 USB_R8A66597_HCD USB_RAINSHADOW_CEC USB_RAREMONO USB_RAW_GADGET USB_RTL8150 USB_RTL8152 USB_RTL8153_ECM USB_S2255 USB_SERIAL USB_SERIAL_AIRCABLE USB_SERIAL_ARK3116 USB_SERIAL_BELKIN USB_SERIAL_CH341 USB_SERIAL_CONSOLE USB_SERIAL_CP210X USB_SERIAL_CYBERJACK USB_SERIAL_CYPRESS_M8 USB_SERIAL_DEBUG USB_SERIAL_DIGI_ACCELEPORT USB_SERIAL_EDGEPORT USB_SERIAL_EDGEPORT_TI USB_SERIAL_EMPEG USB_SERIAL_F81232 USB_SERIAL_F8153X USB_SERIAL_FTDI_SIO USB_SERIAL_GARMIN USB_SERIAL_GENERIC USB_SERIAL_IPAQ USB_SERIAL_IPW USB_SERIAL_IR USB_SERIAL_IUU USB_SERIAL_KEYSPAN USB_SERIAL_KEYSPAN_PDA USB_SERIAL_KLSI USB_SERIAL_KOBIL_SCT USB_SERIAL_MCT_U232 USB_SERIAL_METRO USB_SERIAL_MOS7715_PARPORT USB_SERIAL_MOS7720 USB_SERIAL_MOS7840 USB_SERIAL_MXUPORT USB_SERIAL_NAVMAN USB_SERIAL_OMNINET USB_SERIAL_OPTICON USB_SERIAL_OPTION USB_SERIAL_OTI6858 USB_SERIAL_PL2303 USB_SERIAL_QCAUX USB_SERIAL_QT2 USB_SERIAL_QUALCOMM USB_SERIAL_SAFE USB_SERIAL_SIERRAWIRELESS USB_SERIAL_SIMPLE USB_SERIAL_SPCP8X5 USB_SERIAL_SSU100 USB_SERIAL_SYMBOL USB_SERIAL_TI USB_SERIAL_UPD78F0730 USB_SERIAL_VISOR USB_SERIAL_WHITEHEAT USB_SERIAL_WISHBONE USB_SERIAL_WWAN USB_SERIAL_XR USB_SERIAL_XSENS_MT USB_SEVSEG USB_SI470X USB_SI4713 USB_SIERRA_NET USB_SISUSBVGA USB_SL811_CS USB_SL811_HCD USB_SL811_HCD_ISO USB_SNP_CORE USB_SPEEDTOUCH USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_ENE_UB6250 USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_STV06XX USB_TEST USB_TMC USB_TRANCEVIBRATOR USB_UAS USB_UEAGLEATM USB_ULPI_BUS USB_USBNET USB_USS720 USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_VIDEO_CLASS USB_VIDEO_CLASS_INPUT_EVDEV USB_VL600 USB_WDM USB_XHCI_DBGCAP USB_XHCI_PLATFORM USB_XUSBATM USB_YUREX USERFAULTFD USERIO USERMODE_DRIVER USER_RETURN_NOTIFIER UVC_COMMON U_SERIAL_CONSOLE V4L2_ASYNC V4L2_FWNODE V4L2_MEM2MEM_DEV V4L_TEST_DRIVERS VALIDATE_FS_PARSER VDPA VDPA_SIM VDPA_SIM_BLOCK VDPA_SIM_NET VDPA_USER VETH VFIO VFIO_GROUP VFIO_PCI VFIO_PCI_CORE VFIO_PCI_INTX VFIO_PCI_MMAP VFIO_VIRQFD VGASTATE VHOST VHOST_CROSS_ENDIAN_LEGACY VHOST_IOTLB VHOST_NET VHOST_RING VHOST_TASK VHOST_VDPA VHOST_VSOCK VIDEOBUF2_CORE VIDEOBUF2_DMA_CONTIG VIDEOBUF2_DMA_SG VIDEOBUF2_MEMOPS VIDEOBUF2_V4L2 VIDEOBUF2_VMALLOC VIDEOMODE_HELPERS VIDEO_AU0828 VIDEO_AU0828_RC VIDEO_AU0828_V4L2 VIDEO_CAMERA_SENSOR VIDEO_CMDLINE VIDEO_CS53L32A VIDEO_CX231XX VIDEO_CX231XX_ALSA VIDEO_CX231XX_DVB VIDEO_CX231XX_RC VIDEO_CX2341X VIDEO_CX25840 VIDEO_DEV VIDEO_EM28XX VIDEO_EM28XX_ALSA VIDEO_EM28XX_DVB VIDEO_EM28XX_RC VIDEO_EM28XX_V4L2 VIDEO_GO7007 VIDEO_GO7007_LOADER VIDEO_GO7007_USB VIDEO_GO7007_USB_S2250_BOARD VIDEO_HDPVR VIDEO_MSP3400 VIDEO_NOMODESET VIDEO_PVRUSB2 VIDEO_PVRUSB2_DVB VIDEO_PVRUSB2_SYSFS VIDEO_SAA711X VIDEO_STK1160 VIDEO_TUNER VIDEO_TVEEPROM VIDEO_USBTV VIDEO_V4L2_I2C VIDEO_V4L2_SUBDEV_API VIDEO_V4L2_TPG VIDEO_VICODEC VIDEO_VIM2M VIDEO_VIMC VIDEO_VIVID VIDEO_VIVID_CEC VIDEO_WM8775 VIPERBOARD_ADC VIRTIO_BALLOON VIRTIO_DMA_SHARED_BUFFER VIRTIO_FS VIRTIO_MEM VIRTIO_MMIO VIRTIO_MMIO_CMDLINE_DEVICES VIRTIO_PMEM VIRTIO_VDPA VIRTIO_VSOCKETS VIRTIO_VSOCKETS_COMMON VIRT_WIFI VLAN_8021Q VLAN_8021Q_GVRP VLAN_8021Q_MVRP VMAP_PFN VMWARE_VMCI VMXNET3 VP_VDPA VSOCKETS VSOCKETS_DIAG VSOCKETS_LOOPBACK VSOCKMON VT_HW_CONSOLE_BINDING VXFS_FS WAN WANT_DEV_COREDUMP WEXT_CORE WEXT_PRIV WEXT_PROC WIREGUARD WIRELESS WIRELESS_EXT WLAN WLAN_VENDOR_ADMTEK WLAN_VENDOR_PURELIFI WLAN_VENDOR_SILABS X86_SGX X86_SGX_KVM X86_USER_SHADOW_STACK X86_X2APIC X86_X32_ABI XARRAY_MULTI XDP_SOCKETS XDP_SOCKETS_DIAG XFRM_ESPINTCP XFRM_INTERFACE XFRM_IPCOMP XFRM_MIGRATE XFRM_OFFLOAD XFRM_STATISTICS XFRM_SUB_POLICY XFRM_USER_COMPAT XFS_FS XFS_POSIX_ACL XFS_QUOTA XFS_RT XOR_BLOCKS YENTA YENTA_ENE_TUNE YENTA_O2 YENTA_RICOH YENTA_TI YENTA_TOSHIBA ZBUD ZEROPLUS_FF ZLIB_DEFLATE ZONEFS_FS ZONE_DEVICE ZPOOL ZRAM ZRAM_DEF_COMP_LZORLE ZSMALLOC ZSTD_COMPRESS ZSWAP ZSWAP_COMPRESSOR_DEFAULT_LZO ZSWAP_DEFAULT_ON ZSWAP_ZPOOL_DEFAULT_ZBUD] disabling configs for [BUG LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed testing release v6.4 testing commit 6995e2de6891c724bfeb2db33d7b87775f913ad1 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: c5c7bb44192314f8d9e2e70923c411dfdc7907ef052e600c24be8d9c290a1f94 all runs: OK false negative chance: 0.000 # git bisect start 7271b2a530428b879443b274c191b34536a4ea11 6995e2de6891c724bfeb2db33d7b87775f913ad1 Bisecting: 12712 revisions left to test after this (roughly 14 steps) [b3bd86a0496565272ee1fc003b4b75ddb2f6427f] Merge tag 'block-6.5-2023-07-14' of git://git.kernel.dk/linux testing commit b3bd86a0496565272ee1fc003b4b75ddb2f6427f gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 8ccbb38d248f4959dfbaec7277b2dd813b81784268d35755ea844f4f29834355 all runs: OK false negative chance: 0.000 # git bisect good b3bd86a0496565272ee1fc003b4b75ddb2f6427f Bisecting: 6891 revisions left to test after this (roughly 13 steps) [32008f57554218b009d0bef616154d1718c7750b] Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git testing commit 32008f57554218b009d0bef616154d1718c7750b gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: d4a14cfa174ee03115de9a04a3fd6f41ee4b8a7ccd47653705debe49a003b408 all runs: OK false negative chance: 0.000 # git bisect good 32008f57554218b009d0bef616154d1718c7750b Bisecting: 3606 revisions left to test after this (roughly 12 steps) [cff66d4464ce465f1d961bd3cdfc07bf6a1f6133] next-20230817/sound testing commit cff66d4464ce465f1d961bd3cdfc07bf6a1f6133 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: eced22fb1ea84f8d903eee39d3d9a8f606f8d5a3be3af23f7c35ec50ead28acc all runs: OK false negative chance: 0.000 # git bisect good cff66d4464ce465f1d961bd3cdfc07bf6a1f6133 Bisecting: 1734 revisions left to test after this (roughly 11 steps) [74fe8b7e80d38edfb843edf4f24c74a55239dfe2] Merge branch 'next' of https://github.com/kvm-x86/linux.git testing commit 74fe8b7e80d38edfb843edf4f24c74a55239dfe2 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 4e5d966195c3ab2ede6bf17b137a16e914d77bfc9a562765179267b5575cfe88 all runs: OK false negative chance: 0.000 # git bisect good 74fe8b7e80d38edfb843edf4f24c74a55239dfe2 Bisecting: 838 revisions left to test after this (roughly 10 steps) [f02a7f02c4e762642defa81471802e7f930013f9] Merge branch 'staging-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git testing commit f02a7f02c4e762642defa81471802e7f930013f9 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: eef242e5316e304a2179eccb07e4f0be7ef15be020bfa1369d2e7afd84b5508b all runs: crashed: KASAN: slab-use-after-free Read in input_dev_uevent representative crash: KASAN: slab-use-after-free Read in input_dev_uevent, types: [KASAN] # git bisect bad f02a7f02c4e762642defa81471802e7f930013f9 Bisecting: 434 revisions left to test after this (roughly 9 steps) [784b251870c94ec17e8bdedc0a4c98f4cf37895e] Merge branch 'tty-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git testing commit 784b251870c94ec17e8bdedc0a4c98f4cf37895e gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 3d49593363c031adb179d865bc841d7d13744d11fbca169da52055cd08dcfcd2 all runs: crashed: KASAN: slab-use-after-free Read in input_dev_uevent representative crash: KASAN: slab-use-after-free Read in input_dev_uevent, types: [KASAN] # git bisect bad 784b251870c94ec17e8bdedc0a4c98f4cf37895e Bisecting: 269 revisions left to test after this (roughly 8 steps) [f8d56ebe2ab98550473ec3385a6bb293d0803f92] Merge branch 'driver-core-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core.git testing commit f8d56ebe2ab98550473ec3385a6bb293d0803f92 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 267869972325805e565c0942ef3eee3f017f4bbbbf5d3c2b9c5de25e8039a54d all runs: crashed: KASAN: slab-use-after-free Read in input_dev_uevent representative crash: KASAN: slab-use-after-free Read in input_dev_uevent, types: [KASAN] # git bisect bad f8d56ebe2ab98550473ec3385a6bb293d0803f92 Bisecting: 114 revisions left to test after this (roughly 7 steps) [65c6ea33e7f63799090158866cdcfdfe8d63ce16] Merge remote-tracking branch 'pdx86/platform-drivers-x86-simatic-ipc' into review-hans testing commit 65c6ea33e7f63799090158866cdcfdfe8d63ce16 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 8e33fde1397de9c553e6a54e6842bd1d487dead05e884f70912d438eb5814c37 all runs: OK false negative chance: 0.000 # git bisect good 65c6ea33e7f63799090158866cdcfdfe8d63ce16 Bisecting: 61 revisions left to test after this (roughly 6 steps) [826a34729a4f16124da199aba41091dfb6c07589] Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi.git testing commit 826a34729a4f16124da199aba41091dfb6c07589 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 100973b075c313a3e490ae12b9790c5c3f4e7314a08145c62c264e0a60a6fc90 all runs: OK false negative chance: 0.000 # git bisect good 826a34729a4f16124da199aba41091dfb6c07589 Bisecting: 28 revisions left to test after this (roughly 5 steps) [733e80251afa0fd9a87dd6ca08a07f817a585089] Merge branch 'for-next' of git://github.com/cminyard/linux-ipmi.git testing commit 733e80251afa0fd9a87dd6ca08a07f817a585089 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: fac7e395915030a3bfaa19882ea6d60401ea9ceebe8e1fb5a7ff468013b466dd all runs: OK false negative chance: 0.000 # git bisect good 733e80251afa0fd9a87dd6ca08a07f817a585089 Bisecting: 14 revisions left to test after this (roughly 4 steps) [7630ea17f4e273ea68ec4ff88d6c71503a68f120] x86/resctrl: make pseudo_lock_class a static const structure testing commit 7630ea17f4e273ea68ec4ff88d6c71503a68f120 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: c1a6500be81fd2b2e025ed0abdf2bd4f9266b9a6a45e13c08962899b01bbc7f6 all runs: OK false negative chance: 0.000 # git bisect good 7630ea17f4e273ea68ec4ff88d6c71503a68f120 Bisecting: 7 revisions left to test after this (roughly 3 steps) [6e160d29f6549a1b05c7ba4add49526e50f23335] docs: stable-kernel-rules: fine-tune various details testing commit 6e160d29f6549a1b05c7ba4add49526e50f23335 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: b2782e0fa7751955e58c322df4974390214dbc30f5bedc61bc3570383959b63b all runs: OK false negative chance: 0.000 # git bisect good 6e160d29f6549a1b05c7ba4add49526e50f23335 Bisecting: 3 revisions left to test after this (roughly 2 steps) [b4cc44301b9d35e9420cebecc31fb3964e53499a] drivers: base: Add basic devm tests for platform devices testing commit b4cc44301b9d35e9420cebecc31fb3964e53499a gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: dc43cedb6b0fb9225d257400c73a4026d24ce63ea85c679b0509cad9240d51da all runs: OK false negative chance: 0.000 # git bisect good b4cc44301b9d35e9420cebecc31fb3964e53499a Bisecting: 1 revision left to test after this (roughly 1 step) [f71b144e3e7a490d9140045680b7025382fb33b5] drivers: base: test: Add missing MODULE_* macros for platform devices tests testing commit f71b144e3e7a490d9140045680b7025382fb33b5 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 59bec7af62880cc78c2058ff3bb00d7fa735e3dbae7da1859f877f4a0d56ce5c all runs: crashed: KASAN: slab-use-after-free Read in input_dev_uevent representative crash: KASAN: slab-use-after-free Read in input_dev_uevent, types: [KASAN] # git bisect bad f71b144e3e7a490d9140045680b7025382fb33b5 Bisecting: 0 revisions left to test after this (roughly 0 steps) [699fb50d99039a50e7494de644f96c889279aca3] drivers: base: Free devm resources when unregistering a device testing commit 699fb50d99039a50e7494de644f96c889279aca3 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: b00e05597c1fc7c45f4c1ee1c782d67101329c5a62d9ba66578c334984b728a3 all runs: crashed: KASAN: slab-use-after-free Read in input_dev_uevent representative crash: KASAN: slab-use-after-free Read in input_dev_uevent, types: [KASAN] # git bisect bad 699fb50d99039a50e7494de644f96c889279aca3 699fb50d99039a50e7494de644f96c889279aca3 is the first bad commit commit 699fb50d99039a50e7494de644f96c889279aca3 Author: David Gow Date: Thu Jul 20 14:45:09 2023 +0200 drivers: base: Free devm resources when unregistering a device In the current code, devres_release_all() only gets called if the device has a bus and has been probed. This leads to issues when using bus-less or driver-less devices where the device might never get freed if a managed resource holds a reference to the device. This is happening in the DRM framework for example. We should thus call devres_release_all() in the device_del() function to make sure that the device-managed actions are properly executed when the device is unregistered, even if it has neither a bus nor a driver. This is effectively the same change than commit 2f8d16a996da ("devres: release resources on device_del()") that got reverted by commit a525a3ddeaca ("driver core: free devres in device_release") over memory leaks concerns. This patch effectively combines the two commits mentioned above to release the resources both on device_del() and device_release() and get the best of both worlds. Fixes: a525a3ddeaca ("driver core: free devres in device_release") Signed-off-by: David Gow Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20230720-kunit-devm-inconsistencies-test-v3-3-6aa7e074f373@kernel.org Signed-off-by: Greg Kroah-Hartman drivers/base/core.c | 11 +++++++++++ drivers/base/test/platform-device-test.c | 2 -- drivers/base/test/root-device-test.c | 2 -- 3 files changed, 11 insertions(+), 4 deletions(-) accumulated error probability: 0.00 culprit signature: b00e05597c1fc7c45f4c1ee1c782d67101329c5a62d9ba66578c334984b728a3 parent signature: dc43cedb6b0fb9225d257400c73a4026d24ce63ea85c679b0509cad9240d51da revisions tested: 23, total time: 6h18m3.322494602s (build: 3h32m26.237889883s, test: 2h30m3.250038185s) first bad commit: 699fb50d99039a50e7494de644f96c889279aca3 drivers: base: Free devm resources when unregistering a device recipients (to): ["davidgow@google.com" "gregkh@linuxfoundation.org" "mripard@kernel.org"] recipients (cc): [] crash: KASAN: slab-use-after-free Read in input_dev_uevent input: HID 5543:0047 Dial as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:5543:0047.0001/input/input7 uclogic 0003:5543:0047.0001: input,hidraw0: USB HID v0.00 Keypad [HID 5543:0047] on usb-dummy_hcd.0-1/input0 usb 1-1: USB disconnect, device number 2 ================================================================== BUG: KASAN: slab-use-after-free in string_nocheck lib/vsprintf.c:644 [inline] BUG: KASAN: slab-use-after-free in string+0x2a5/0x330 lib/vsprintf.c:726 Read of size 1 at addr ffff88811848c6a8 by task kworker/0:3/3037 CPU: 0 PID: 3037 Comm: kworker/0:3 Not tainted 6.5.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x3d/0x60 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:364 [inline] print_report+0xc4/0x620 mm/kasan/report.c:475 kasan_report+0xda/0x110 mm/kasan/report.c:588 string_nocheck lib/vsprintf.c:644 [inline] string+0x2a5/0x330 lib/vsprintf.c:726 vsnprintf+0xa01/0x15c0 lib/vsprintf.c:2817 add_uevent_var+0x150/0x2c0 lib/kobject_uevent.c:665 input_dev_uevent+0x145/0x710 drivers/input/input.c:1691 dev_uevent+0x28e/0x6c0 drivers/base/core.c:2599 kobject_uevent_env+0x52c/0x1410 lib/kobject_uevent.c:557 device_del+0x5c1/0x9a0 drivers/base/core.c:3832 input_unregister_device+0x7f/0xb0 drivers/input/input.c:2440 hidinput_disconnect+0x13f/0x3d0 drivers/hid/hid-input.c:2369 hid_disconnect+0xe8/0x150 drivers/hid/hid-core.c:2273 hid_hw_stop+0xe/0x70 drivers/hid/hid-core.c:2322 uclogic_remove+0x42/0x90 drivers/hid/hid-uclogic-core.c:485 hid_device_remove+0xbc/0x220 drivers/hid/hid-core.c:2682 __device_release_driver drivers/base/dd.c:1272 [inline] device_release_driver_internal+0x370/0x530 drivers/base/dd.c:1295 bus_remove_device+0x1ed/0x3e0 drivers/base/bus.c:574 device_del+0x3de/0x9a0 drivers/base/core.c:3814 hid_remove_device drivers/hid/hid-core.c:2859 [inline] hid_destroy_device+0xbe/0x130 drivers/hid/hid-core.c:2879 usbhid_disconnect+0x92/0xc0 drivers/hid/usbhid/hid-core.c:1456 usb_unbind_interface+0x17d/0x7b0 drivers/usb/core/driver.c:458 __device_release_driver drivers/base/dd.c:1272 [inline] device_release_driver_internal+0x370/0x530 drivers/base/dd.c:1295 bus_remove_device+0x1ed/0x3e0 drivers/base/bus.c:574 device_del+0x3de/0x9a0 drivers/base/core.c:3814 usb_disable_device+0x290/0x680 drivers/usb/core/message.c:1420 usb_disconnect+0x272/0x880 drivers/usb/core/hub.c:2253 hub_port_connect drivers/usb/core/hub.c:5261 [inline] hub_port_connect_change drivers/usb/core/hub.c:5566 [inline] port_event drivers/usb/core/hub.c:5726 [inline] hub_event+0x1894/0x45e0 drivers/usb/core/hub.c:5808 process_one_work+0x922/0x1370 kernel/workqueue.c:2597 process_scheduled_works kernel/workqueue.c:2664 [inline] worker_thread+0x58d/0xe40 kernel/workqueue.c:2750 kthread+0x278/0x330 kernel/kthread.c:389 ret_from_fork+0x2c/0x70 arch/x86/kernel/process.c:145 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 Allocated by task 3037: kasan_save_stack+0x33/0x50 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:374 [inline] __kasan_kmalloc+0xa2/0xb0 mm/kasan/common.c:383 kasan_kmalloc include/linux/kasan.h:196 [inline] __do_kmalloc_node mm/slab_common.c:985 [inline] __kmalloc_node_track_caller+0x5e/0x160 mm/slab_common.c:1005 alloc_dr drivers/base/devres.c:119 [inline] devm_kmalloc+0x75/0x1e0 drivers/base/devres.c:829 devm_kzalloc include/linux/device.h:314 [inline] uclogic_input_configured+0x1c8/0x5f0 drivers/hid/hid-uclogic-core.c:151 hidinput_connect+0x14fc/0x25a0 drivers/hid/hid-input.c:2327 hid_connect+0xfe4/0x1520 drivers/hid/hid-core.c:2187 hid_hw_start drivers/hid/hid-core.c:2302 [inline] hid_hw_start+0x75/0xf0 drivers/hid/hid-core.c:2293 uclogic_probe+0x1cb/0x2d0 drivers/hid/hid-uclogic-core.c:221 __hid_device_probe drivers/hid/hid-core.c:2626 [inline] hid_device_probe+0x272/0x3d0 drivers/hid/hid-core.c:2663 call_driver_probe drivers/base/dd.c:579 [inline] really_probe+0x1bf/0xb20 drivers/base/dd.c:658 __driver_probe_device+0x187/0x440 drivers/base/dd.c:800 driver_probe_device+0x45/0x110 drivers/base/dd.c:830 __device_attach_driver+0x152/0x260 drivers/base/dd.c:958 bus_for_each_drv+0x110/0x190 drivers/base/bus.c:457 __device_attach+0x194/0x3a0 drivers/base/dd.c:1030 bus_probe_device+0x12b/0x170 drivers/base/bus.c:532 device_add+0xee3/0x1720 drivers/base/core.c:3625 hid_add_device+0x307/0x900 drivers/hid/hid-core.c:2809 usbhid_probe+0xab8/0x1080 drivers/hid/usbhid/hid-core.c:1429 usb_probe_interface+0x279/0x820 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:579 [inline] really_probe+0x1bf/0xb20 drivers/base/dd.c:658 __driver_probe_device+0x187/0x440 drivers/base/dd.c:800 driver_probe_device+0x45/0x110 drivers/base/dd.c:830 __device_attach_driver+0x152/0x260 drivers/base/dd.c:958 bus_for_each_drv+0x110/0x190 drivers/base/bus.c:457 __device_attach+0x194/0x3a0 drivers/base/dd.c:1030 bus_probe_device+0x12b/0x170 drivers/base/bus.c:532 device_add+0xee3/0x1720 drivers/base/core.c:3625 usb_set_configuration+0xdc1/0x1830 drivers/usb/core/message.c:2211 usb_generic_driver_probe+0x84/0xd0 drivers/usb/core/generic.c:238 usb_probe_device+0x9f/0x240 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:579 [inline] really_probe+0x1bf/0xb20 drivers/base/dd.c:658 __driver_probe_device+0x187/0x440 drivers/base/dd.c:800 driver_probe_device+0x45/0x110 drivers/base/dd.c:830 __device_attach_driver+0x152/0x260 drivers/base/dd.c:958 bus_for_each_drv+0x110/0x190 drivers/base/bus.c:457 __device_attach+0x194/0x3a0 drivers/base/dd.c:1030 bus_probe_device+0x12b/0x170 drivers/base/bus.c:532 device_add+0xee3/0x1720 drivers/base/core.c:3625 usb_new_device+0xc70/0x17b0 drivers/usb/core/hub.c:2590 hub_port_connect drivers/usb/core/hub.c:5422 [inline] hub_port_connect_change drivers/usb/core/hub.c:5566 [inline] port_event drivers/usb/core/hub.c:5726 [inline] hub_event+0x26da/0x45e0 drivers/usb/core/hub.c:5808 process_one_work+0x922/0x1370 kernel/workqueue.c:2597 worker_thread+0xfb/0xe40 kernel/workqueue.c:2748 kthread+0x278/0x330 kernel/kthread.c:389 ret_from_fork+0x2c/0x70 arch/x86/kernel/process.c:145 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 Freed by task 3037: kasan_save_stack+0x33/0x50 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:522 ____kasan_slab_free mm/kasan/common.c:236 [inline] ____kasan_slab_free+0x15e/0x1b0 mm/kasan/common.c:200 kasan_slab_free include/linux/kasan.h:162 [inline] slab_free_hook mm/slub.c:1792 [inline] slab_free_freelist_hook+0x10b/0x1e0 mm/slub.c:1818 slab_free mm/slub.c:3801 [inline] __kmem_cache_free+0xba/0x340 mm/slub.c:3814 release_nodes drivers/base/devres.c:506 [inline] devres_release_all+0x172/0x210 drivers/base/devres.c:535 device_del+0x5a7/0x9a0 drivers/base/core.c:3829 input_unregister_device+0x7f/0xb0 drivers/input/input.c:2440 hidinput_disconnect+0x13f/0x3d0 drivers/hid/hid-input.c:2369 hid_disconnect+0xe8/0x150 drivers/hid/hid-core.c:2273 hid_hw_stop+0xe/0x70 drivers/hid/hid-core.c:2322 uclogic_remove+0x42/0x90 drivers/hid/hid-uclogic-core.c:485 hid_device_remove+0xbc/0x220 drivers/hid/hid-core.c:2682 __device_release_driver drivers/base/dd.c:1272 [inline] device_release_driver_internal+0x370/0x530 drivers/base/dd.c:1295 bus_remove_device+0x1ed/0x3e0 drivers/base/bus.c:574 device_del+0x3de/0x9a0 drivers/base/core.c:3814 hid_remove_device drivers/hid/hid-core.c:2859 [inline] hid_destroy_device+0xbe/0x130 drivers/hid/hid-core.c:2879 usbhid_disconnect+0x92/0xc0 drivers/hid/usbhid/hid-core.c:1456 usb_unbind_interface+0x17d/0x7b0 drivers/usb/core/driver.c:458 __device_release_driver drivers/base/dd.c:1272 [inline] device_release_driver_internal+0x370/0x530 drivers/base/dd.c:1295 bus_remove_device+0x1ed/0x3e0 drivers/base/bus.c:574 device_del+0x3de/0x9a0 drivers/base/core.c:3814 usb_disable_device+0x290/0x680 drivers/usb/core/message.c:1420 usb_disconnect+0x272/0x880 drivers/usb/core/hub.c:2253 hub_port_connect drivers/usb/core/hub.c:5261 [inline] hub_port_connect_change drivers/usb/core/hub.c:5566 [inline] port_event drivers/usb/core/hub.c:5726 [inline] hub_event+0x1894/0x45e0 drivers/usb/core/hub.c:5808 process_one_work+0x922/0x1370 kernel/workqueue.c:2597 process_scheduled_works kernel/workqueue.c:2664 [inline] worker_thread+0x58d/0xe40 kernel/workqueue.c:2750 kthread+0x278/0x330 kernel/kthread.c:389 ret_from_fork+0x2c/0x70 arch/x86/kernel/process.c:145 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 The buggy address belongs to the object at ffff88811848c680 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 40 bytes inside of freed 64-byte region [ffff88811848c680, ffff88811848c6c0) The buggy address belongs to the physical page: page:ffffea0004612300 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11848c flags: 0x100000000000200(slab|node=0|zone=2) page_type: 0xffffffff() raw: 0100000000000200 ffff888100041640 dead000000000100 dead000000000122 raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY), pid 2572, tgid 2572 (start-stop-daem), ts 7819185710, free_ts 7815662957 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x281/0x2f0 mm/page_alloc.c:1570 prep_new_page mm/page_alloc.c:1577 [inline] get_page_from_freelist+0xfcb/0x31e0 mm/page_alloc.c:3221 __alloc_pages+0x1d0/0x470 mm/page_alloc.c:4477 alloc_slab_page mm/slub.c:1862 [inline] allocate_slab+0x24e/0x360 mm/slub.c:2009 new_slab mm/slub.c:2062 [inline] ___slab_alloc+0x7a7/0x1000 mm/slub.c:3215 __slab_alloc.constprop.0+0x4d/0x90 mm/slub.c:3314 __slab_alloc_node mm/slub.c:3367 [inline] slab_alloc_node mm/slub.c:3460 [inline] __kmem_cache_alloc_node+0x143/0x390 mm/slub.c:3509 __do_kmalloc_node mm/slab_common.c:984 [inline] __kmalloc+0x4c/0x160 mm/slab_common.c:998 kmalloc include/linux/slab.h:586 [inline] kzalloc include/linux/slab.h:703 [inline] tomoyo_commit_ok+0x1a/0x60 security/tomoyo/memory.c:76 tomoyo_update_domain+0x514/0x7c0 security/tomoyo/domain.c:139 tomoyo_update_path_acl security/tomoyo/file.c:398 [inline] tomoyo_write_file+0x375/0x570 security/tomoyo/file.c:1022 tomoyo_write_domain2+0xdd/0x150 security/tomoyo/common.c:1143 tomoyo_add_entry security/tomoyo/common.c:2033 [inline] tomoyo_supervisor+0x417/0xc40 security/tomoyo/common.c:2094 tomoyo_audit_path_log security/tomoyo/file.c:168 [inline] tomoyo_path_permission security/tomoyo/file.c:587 [inline] tomoyo_path_permission+0x23d/0x330 security/tomoyo/file.c:573 tomoyo_check_open_permission+0x287/0x2b0 security/tomoyo/file.c:777 security_file_open+0x4f/0x80 security/security.c:2797 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1161 [inline] free_unref_page_prepare+0x5ac/0xcf0 mm/page_alloc.c:2348 free_unref_page_list+0xe6/0xaa0 mm/page_alloc.c:2489 release_pages+0x25c/0x10c0 mm/swap.c:1042 tlb_batch_pages_flush+0x79/0x140 mm/mmu_gather.c:97 tlb_flush_mmu_free mm/mmu_gather.c:292 [inline] tlb_flush_mmu mm/mmu_gather.c:299 [inline] tlb_finish_mmu+0x114/0x6c0 mm/mmu_gather.c:391 exit_mmap+0x26a/0x730 mm/mmap.c:3215 __mmput+0xb7/0x3e0 kernel/fork.c:1348 exec_mmap fs/exec.c:1036 [inline] begin_new_exec+0xe05/0x2900 fs/exec.c:1295 load_elf_binary+0x659/0x4500 fs/binfmt_elf.c:1001 search_binary_handler fs/exec.c:1738 [inline] exec_binprm fs/exec.c:1780 [inline] bprm_execve fs/exec.c:1855 [inline] bprm_execve+0x686/0x1430 fs/exec.c:1811 do_execveat_common.isra.0+0x4bc/0x690 fs/exec.c:1963 do_execve fs/exec.c:2037 [inline] __do_sys_execve fs/exec.c:2113 [inline] __se_sys_execve fs/exec.c:2108 [inline] __x64_sys_execve+0x87/0xb0 fs/exec.c:2108 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Memory state around the buggy address: ffff88811848c580: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff88811848c600: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc >ffff88811848c680: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ffff88811848c700: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff88811848c780: 00 00 00 00 00 00 07 fc fc fc fc fc fc fc fc fc ==================================================================