==================================================================
BUG: KASAN: slab-use-after-free in rtl28xxu_i2c_xfer+0xa8c/0xb60 drivers/media/usb/dvb-usb-v2/rtl28xxu.c:184
Read of size 1 at addr ffff8880345b1400 by task kworker/1:4/5743

CPU: 1 UID: 0 PID: 5743 Comm: kworker/1:4 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Workqueue: events rtl2832_i2c_gate_work
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 rtl28xxu_i2c_xfer+0xa8c/0xb60 drivers/media/usb/dvb-usb-v2/rtl28xxu.c:184
 __i2c_transfer+0x7a2/0x1f80 drivers/i2c/i2c-core-base.c:-1
 i2c_transfer+0x1cc/0x2d0 drivers/i2c/i2c-core-base.c:2317
 regmap_i2c_read+0x124/0x1c0 drivers/base/regmap/regmap-i2c.c:191
 _regmap_raw_read+0x5b6/0xa40 drivers/base/regmap/regmap.c:2777
 _regmap_bus_read+0xde/0x170 drivers/base/regmap/regmap.c:2815
 _regmap_read+0x5a4/0x910 drivers/base/regmap/regmap.c:2840
 _regmap_update_bits+0x1d6/0x480 drivers/base/regmap/regmap.c:3265
 regmap_update_bits_base+0xca/0x160 drivers/base/regmap/regmap.c:3314
 regmap_update_bits include/linux/regmap.h:1344 [inline]
 rtl2832_i2c_gate_work+0x76/0x100 drivers/media/dvb-frontends/rtl2832.c:791
 process_one_work+0x9a3/0x1710 kernel/workqueue.c:3312
 process_scheduled_works kernel/workqueue.c:3403 [inline]
 worker_thread+0xba8/0x11e0 kernel/workqueue.c:3489
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 5770:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5303 [inline]
 __kmalloc_noprof+0x3e7/0x7b0 mm/slub.c:5315
 kmalloc_noprof include/linux/slab.h:954 [inline]
 kzalloc_noprof include/linux/slab.h:1188 [inline]
 __regmap_init+0x3029/0x3ad0 drivers/base/regmap/regmap.c:1045
 rtl2832_probe+0x3c4/0x830 drivers/media/dvb-frontends/rtl2832.c:1066
 i2c_device_probe+0x894/0xc00 drivers/i2c/i2c-core-base.c:592
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x267/0xaf0 drivers/base/dd.c:709
 __driver_probe_device+0x1ef/0x380 drivers/base/dd.c:871
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:901
 __device_attach_driver+0x279/0x430 drivers/base/dd.c:1029
 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c8/0x450 drivers/base/dd.c:1101
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1156
 bus_probe_device+0x12d/0x220 drivers/base/bus.c:613
 device_add+0x7e9/0xbb0 drivers/base/core.c:3706
 i2c_new_client_device+0xa1f/0x1160 drivers/i2c/i2c-core-base.c:1019
 rtl2832u_frontend_attach drivers/media/usb/dvb-usb-v2/rtl28xxu.c:953 [inline]
 rtl28xxu_frontend_attach+0x62c/0x1370 drivers/media/usb/dvb-usb-v2/rtl28xxu.c:1083
 dvb_usbv2_adapter_frontend_init drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:643 [inline]
 dvb_usbv2_adapter_init drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:806 [inline]
 dvb_usbv2_init drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:867 [inline]
 dvb_usbv2_probe+0x1706/0x3c20 drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:982
 usb_probe_interface+0x659/0xc70 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x267/0xaf0 drivers/base/dd.c:709
 __driver_probe_device+0x1ef/0x380 drivers/base/dd.c:871
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:901
 __device_attach_driver+0x279/0x430 drivers/base/dd.c:1029
 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c8/0x450 drivers/base/dd.c:1101
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1156
 bus_probe_device+0x12d/0x220 drivers/base/bus.c:613
 device_add+0x7e9/0xbb0 drivers/base/core.c:3706
 usb_set_configuration+0x1a87/0x2110 drivers/usb/core/message.c:2268
 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
 usb_probe_device+0x1c4/0x3b0 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x267/0xaf0 drivers/base/dd.c:709
 __driver_probe_device+0x1ef/0x380 drivers/base/dd.c:871
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:901
 __device_attach_driver+0x279/0x430 drivers/base/dd.c:1029
 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c8/0x450 drivers/base/dd.c:1101
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1156
 bus_probe_device+0x12d/0x220 drivers/base/bus.c:613
 device_add+0x7e9/0xbb0 drivers/base/core.c:3706
 usb_new_device+0x9f8/0x16e0 drivers/usb/core/hub.c:2695
 hub_port_connect drivers/usb/core/hub.c:5567 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
 port_event drivers/usb/core/hub.c:5871 [inline]
 hub_event+0x2a49/0x4f60 drivers/usb/core/hub.c:5953
 process_one_work+0x9a3/0x1710 kernel/workqueue.c:3312
 process_scheduled_works kernel/workqueue.c:3403 [inline]
 worker_thread+0xbee/0x11e0 kernel/workqueue.c:3489
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Freed by task 5770:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2700 [inline]
 slab_free mm/slub.c:6258 [inline]
 kfree+0x1c5/0x6c0 mm/slub.c:6573
 regmap_exit+0x205/0x470 drivers/base/regmap/regmap.c:1468
 rtl2832_remove+0x9b/0x100 drivers/media/dvb-frontends/rtl2832.c:1122
 i2c_device_remove+0x88/0x220 drivers/i2c/i2c-core-base.c:631
 device_remove drivers/base/dd.c:619 [inline]
 __device_release_driver drivers/base/dd.c:1352 [inline]
 device_release_driver_internal+0x46f/0x870 drivers/base/dd.c:1375
 bus_remove_device+0x45a/0x570 drivers/base/bus.c:657
 device_del+0x52b/0x900 drivers/base/core.c:3895
 device_unregister+0x21/0xf0 drivers/base/core.c:3936
 rtl28xxu_frontend_detach+0x168/0x210 drivers/media/usb/dvb-usb-v2/rtl28xxu.c:1105
 dvb_usbv2_adapter_frontend_exit drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:733 [inline]
 dvb_usbv2_adapter_exit drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:830 [inline]
 dvb_usbv2_exit+0x44c/0xb80 drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:844
 dvb_usbv2_probe+0x4c0/0x3c20 drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:994
 usb_probe_interface+0x659/0xc70 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x267/0xaf0 drivers/base/dd.c:709
 __driver_probe_device+0x1ef/0x380 drivers/base/dd.c:871
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:901
 __device_attach_driver+0x279/0x430 drivers/base/dd.c:1029
 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c8/0x450 drivers/base/dd.c:1101
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1156
 bus_probe_device+0x12d/0x220 drivers/base/bus.c:613
 device_add+0x7e9/0xbb0 drivers/base/core.c:3706
 usb_set_configuration+0x1a87/0x2110 drivers/usb/core/message.c:2268
 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
 usb_probe_device+0x1c4/0x3b0 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x267/0xaf0 drivers/base/dd.c:709
 __driver_probe_device+0x1ef/0x380 drivers/base/dd.c:871
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:901
 __device_attach_driver+0x279/0x430 drivers/base/dd.c:1029
 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c8/0x450 drivers/base/dd.c:1101
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1156
 bus_probe_device+0x12d/0x220 drivers/base/bus.c:613
 device_add+0x7e9/0xbb0 drivers/base/core.c:3706
 usb_new_device+0x9f8/0x16e0 drivers/usb/core/hub.c:2695
 hub_port_connect drivers/usb/core/hub.c:5567 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
 port_event drivers/usb/core/hub.c:5871 [inline]
 hub_event+0x2a49/0x4f60 drivers/usb/core/hub.c:5953
 process_one_work+0x9a3/0x1710 kernel/workqueue.c:3312
 process_scheduled_works kernel/workqueue.c:3403 [inline]
 worker_thread+0xbee/0x11e0 kernel/workqueue.c:3489
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

The buggy address belongs to the object at ffff8880345b1400
 which belongs to the cache kmalloc-8 of size 8
The buggy address is located 0 bytes inside of
 freed 8-byte region [ffff8880345b1400, ffff8880345b1408)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x345b1
flags: 0x80000000000000(node=0|zone=1)
page_type: f5(slab)
raw: 0080000000000000 ffff88813fea4500 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800800080 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 19965937895, free_ts 0
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1853
 prep_new_page mm/page_alloc.c:1861 [inline]
 get_page_from_freelist+0x27d6/0x2850 mm/page_alloc.c:3941
 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5249
 alloc_slab_page mm/slub.c:3289 [inline]
 allocate_slab+0x74/0x5e0 mm/slub.c:3404
 new_slab mm/slub.c:3447 [inline]
 refill_objects+0x33c/0x3d0 mm/slub.c:7263
 refill_sheaf mm/slub.c:2827 [inline]
 __pcs_replace_empty_main+0x373/0x720 mm/slub.c:4659
 alloc_from_pcs mm/slub.c:4757 [inline]
 slab_alloc_node mm/slub.c:4891 [inline]
 __kmalloc_cache_noprof+0x44e/0x690 mm/slub.c:5422
 kmalloc_noprof include/linux/slab.h:950 [inline]
 kzalloc_noprof include/linux/slab.h:1188 [inline]
 add_sysfs_param+0x758/0xb80 kernel/params.c:641
 kernel_add_sysfs_param+0x7f/0xe0 kernel/params.c:797
 param_sysfs_builtin+0x199/0x250 kernel/params.c:836
 param_sysfs_builtin_init+0x23/0x30 kernel/params.c:972
 do_one_initcall+0x250/0x870 init/main.c:1392
 do_initcall_level+0x104/0x190 init/main.c:1454
 do_initcalls+0x59/0xa0 init/main.c:1470
 kernel_init_freeable+0x2a6/0x3e0 init/main.c:1703
 kernel_init+0x1d/0x1d0 init/main.c:1593
page_owner free stack trace missing

Memory state around the buggy address:
 ffff8880345b1300: 05 fc fc fc 05 fc fc fc 05 fc fc fc 05 fc fc fc
 ffff8880345b1380: 05 fc fc fc 07 fc fc fc 07 fc fc fc 05 fc fc fc
>ffff8880345b1400: fa fc fc fc fa fc fc fc 00 fc fc fc 06 fc fc fc
                   ^
 ffff8880345b1480: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc
 ffff8880345b1500: fa fc fc fc fa fc fc fc fa fc fc fc 06 fc fc fc
==================================================================