usbtmc 4-1:16.0: invalid notification: 73
usbtmc 4-1:16.0: invalid notification: 33
usbtmc 4-1:16.0: invalid notification: 36
usbtmc 4-1:16.0: invalid notification: 8
==================================================================
BUG: KASAN: slab-out-of-bounds in usbtmc_interrupt+0x68d/0x6a0 drivers/usb/class/usbtmc.c:2309
Read of size 1 at addr ffff88810bacc221 by task kworker/0:2/1122
CPU: 0 UID: 0 PID: 1122 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(voluntary)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x156/0x4c9 mm/kasan/report.c:482
kasan_report+0xdf/0x1a0 mm/kasan/report.c:595
usbtmc_interrupt+0x68d/0x6a0 drivers/usb/class/usbtmc.c:2309
__usb_hcd_giveback_urb+0x38d/0x610 drivers/usb/core/hcd.c:1657
usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
dummy_timer+0xd85/0x3670 drivers/usb/gadget/udc/dummy_hcd.c:1995
__run_hrtimer kernel/time/hrtimer.c:1777 [inline]
__hrtimer_run_queues+0x516/0x990 kernel/time/hrtimer.c:1841
hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1858
handle_softirqs+0x1dd/0x8f0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0xed/0x150 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1056
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:rcu_read_lock_held_common kernel/rcu/update.c:109 [inline]
RIP: 0010:rcu_read_lock_held+0x19/0x50 kernel/rcu/update.c:349
Code: 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa e8 97 d5 bd 05 ba 01 00 00 00 85 c0 75 07 89 d0 e9 47 af c0 05 12 f6 00 00 84 c0 74 1a e8 19 37 01 00 84 c0 74 11 be ff ff ff
RSP: 0018:ffffc90001d4efa8 EFLAGS: 00000202
RAX: 0000000000000001 RBX: ffff88811356bf00 RCX: ffffffff8242eea6
RDX: 0000000000000001 RSI: ffffffff8242f029 RDI: ffff88810efa8000
RBP: ffff888112f3d780 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000001
R13: ffff888112f3d780 R14: ffff88811356bf00 R15: dffffc0000000000
kernfs_root+0x20e/0x2a0 fs/kernfs/kernfs-internal.h:76
kernfs_link_sibling+0x518/0x770 fs/kernfs/dir.c:398
kernfs_add_one+0x1e7/0x850 fs/kernfs/dir.c:815
__kernfs_create_file+0x295/0x350 fs/kernfs/file.c:1086
sysfs_add_file_mode_ns+0x207/0x3c0 fs/sysfs/file.c:313
create_files fs/sysfs/group.c:82 [inline]
internal_create_group+0x593/0xf40 fs/sysfs/group.c:189
internal_create_groups+0x9d/0x150 fs/sysfs/group.c:229
device_add_groups drivers/base/core.c:2836 [inline]
device_add_attrs drivers/base/core.c:2911 [inline]
device_add+0x7c8/0x1950 drivers/base/core.c:3643
usb_create_ep_devs+0x160/0x2b0 drivers/usb/core/endpoint.c:170
create_intf_ep_devs.isra.0+0x161/0x200 drivers/usb/core/message.c:1252
usb_set_configuration+0xdb9/0x1c60 drivers/usb/core/message.c:2216
usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250
usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:581 [inline]
really_probe+0x241/0xa60 drivers/base/dd.c:659
__driver_probe_device+0x1de/0x400 drivers/base/dd.c:801
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:831
__device_attach_driver+0x1df/0x340 drivers/base/dd.c:959
bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
__device_attach+0x1e4/0x4d0 drivers/base/dd.c:1031
device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1086
bus_probe_device+0x64/0x160 drivers/base/bus.c:574
device_add+0x11d9/0x1950 drivers/base/core.c:3689
usb_new_device.cold+0x685/0x115c drivers/usb/core/hub.c:2695
hub_port_connect drivers/usb/core/hub.c:5567 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x314d/0x4af0 drivers/usb/core/hub.c:5953
process_one_work+0x9c2/0x1840 kernel/workqueue.c:3257
process_scheduled_works kernel/workqueue.c:3340 [inline]
worker_thread+0x5da/0xe40 kernel/workqueue.c:3421
kthread+0x3b3/0x730 kernel/kthread.c:463
ret_from_fork+0x6c3/0xa20 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
Allocated by task 1122:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5657 [inline]
__kmalloc_noprof+0x33e/0x990 mm/slub.c:5669
kmalloc_noprof include/linux/slab.h:961 [inline]
usbtmc_probe+0xa41/0x1bc0 drivers/usb/class/usbtmc.c:2452
usb_probe_interface+0x303/0x8f0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:581 [inline]
really_probe+0x241/0xa60 drivers/base/dd.c:659
__driver_probe_device+0x1de/0x400 drivers/base/dd.c:801
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:831
__device_attach_driver+0x1df/0x340 drivers/base/dd.c:959
bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
__device_attach+0x1e4/0x4d0 drivers/base/dd.c:1031
device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1086
bus_probe_device+0x64/0x160 drivers/base/bus.c:574
device_add+0x11d9/0x1950 drivers/base/core.c:3689
usb_set_configuration+0xd97/0x1c60 drivers/usb/core/message.c:2210
usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250
usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:581 [inline]
really_probe+0x241/0xa60 drivers/base/dd.c:659
__driver_probe_device+0x1de/0x400 drivers/base/dd.c:801
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:831
__device_attach_driver+0x1df/0x340 drivers/base/dd.c:959
bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
__device_attach+0x1e4/0x4d0 drivers/base/dd.c:1031
device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1086
bus_probe_device+0x64/0x160 drivers/base/bus.c:574
device_add+0x11d9/0x1950 drivers/base/core.c:3689
usb_new_device.cold+0x685/0x115c drivers/usb/core/hub.c:2695
hub_port_connect drivers/usb/core/hub.c:5567 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x314d/0x4af0 drivers/usb/core/hub.c:5953
process_one_work+0x9c2/0x1840 kernel/workqueue.c:3257
process_scheduled_works kernel/workqueue.c:3340 [inline]
worker_thread+0x5da/0xe40 kernel/workqueue.c:3421
kthread+0x3b3/0x730 kernel/kthread.c:463
ret_from_fork+0x6c3/0xa20 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
The buggy address belongs to the object at ffff88810bacc220
which belongs to the cache kmalloc-8 of size 8
The buggy address is located 0 bytes to the right of
allocated 1-byte region [ffff88810bacc220, ffff88810bacc221)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10bacc
anon flags: 0x200000000000000(node=0|zone=2)
page_type: f5(slab)
raw: 0200000000000000 ffff888100041500 0000000000000000 dead000000000001
raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1, tgid 1 (swapper/0), ts 5952480830, free_ts 5709334261
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1e1/0x250 mm/page_alloc.c:1884
prep_new_page mm/page_alloc.c:1892 [inline]
get_page_from_freelist+0xd57/0x3b20 mm/page_alloc.c:3945
__alloc_frozen_pages_noprof+0x269/0x2230 mm/page_alloc.c:5240
alloc_pages_mpol+0xe8/0x410 mm/mempolicy.c:2486
alloc_slab_page mm/slub.c:3075 [inline]
allocate_slab mm/slub.c:3248 [inline]
new_slab+0x2c4/0x440 mm/slub.c:3302
___slab_alloc+0xda3/0x1ca0 mm/slub.c:4656
__slab_alloc.isra.0+0x63/0x110 mm/slub.c:4779
__slab_alloc_node mm/slub.c:4855 [inline]
slab_alloc_node mm/slub.c:5251 [inline]
__do_kmalloc_node mm/slub.c:5656 [inline]
__kmalloc_node_noprof+0x5d6/0x9a0 mm/slub.c:5663
kmalloc_array_node_noprof include/linux/slab.h:1075 [inline]
__blk_mq_realloc_hw_ctxs+0x579/0x820 block/blk-mq.c:4543
blk_mq_realloc_hw_ctxs block/blk-mq.c:4607 [inline]
blk_mq_init_allocated_queue+0x308/0x1400 block/blk-mq.c:4637
blk_mq_alloc_queue+0x1bd/0x290 block/blk-mq.c:4419
__blk_mq_alloc_disk+0x29/0x120 block/blk-mq.c:4462
loop_add+0x498/0xb60 drivers/block/loop.c:2071
loop_init+0x1d3/0x200 drivers/block/loop.c:2310
do_one_initcall+0x11d/0x690 init/main.c:1378
do_initcall_level init/main.c:1440 [inline]
do_initcalls init/main.c:1456 [inline]
do_basic_setup init/main.c:1475 [inline]
kernel_init_freeable+0x6e5/0x790 init/main.c:1688
page last free pid 9 tgid 9 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1433 [inline]
__free_frozen_pages+0x7d1/0x1010 mm/page_alloc.c:2973
vfree.part.0+0x12b/0x9d0 mm/vmalloc.c:3466
vfree mm/vmalloc.c:3443 [inline]
delayed_vfree_work+0x8e/0xd0 mm/vmalloc.c:3385
process_one_work+0x9c2/0x1840 kernel/workqueue.c:3257
process_scheduled_works kernel/workqueue.c:3340 [inline]
worker_thread+0x5da/0xe40 kernel/workqueue.c:3421
kthread+0x3b3/0x730 kernel/kthread.c:463
ret_from_fork+0x6c3/0xa20 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
Memory state around the buggy address:
ffff88810bacc100: 05 fc fc fc 05 fc fc fc 05 fc fc fc 05 fc fc fc
ffff88810bacc180: 05 fc fc fc 05 fc fc fc 05 fc fc fc 00 fc fc fc
>ffff88810bacc200: 00 fc fc fc 01 fc fc fc 00 fc fc fc 00 fc fc fc
^
ffff88810bacc280: 07 fc fc fc 07 fc fc fc 07 fc fc fc 05 fc fc fc
ffff88810bacc300: 07 fc fc fc 02 fc fc fc 02 fc fc fc 05 fc fc fc
==================================================================
----------------
Code disassembly (best guess):
0: 00 90 90 90 90 90 add %dl,-0x6f6f6f70(%rax)
6: 90 nop
7: 90 nop
8: 90 nop
9: 90 nop
a: 90 nop
b: 90 nop
c: 90 nop
d: 90 nop
e: 90 nop
f: 90 nop
10: 90 nop
11: f3 0f 1e fa endbr64
15: e8 97 d5 bd 05 call 0x5bdd5b1
1a: ba 01 00 00 00 mov $0x1,%edx
1f: 85 c0 test %eax,%eax
21: 75 07 jne 0x2a
23: 89 d0 mov %edx,%eax
25: e9 47 af c0 05 jmp 0x5c0af71
* 2a: e8 12 f6 00 00 call 0xf641 <-- trapping instruction
2f: 84 c0 test %al,%al
31: 74 1a je 0x4d
33: e8 19 37 01 00 call 0x13751
38: 84 c0 test %al,%al
3a: 74 11 je 0x4d
3c: be .byte 0xbe
3d: ff (bad)
3e: ff (bad)
3f: ff .byte 0xff