syzbot

xpad 2-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19
xpad 2-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19
==================================================================
BUG: KASAN: use-after-free in debug_spin_lock_before kernel/locking/spinlock_debug.c:85 [inline]
BUG: KASAN: use-after-free in do_raw_spin_lock+0x283/0x2f0 kernel/locking/spinlock_debug.c:114
Read of size 4 at addr ffff88805668005c by task syz.3.3332/14514

CPU: 0 PID: 14514 Comm: syz.3.3332 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:316 [inline]
 print_report+0xa8/0x210 mm/kasan/report.c:420
 kasan_report+0x10b/0x140 mm/kasan/report.c:524
 debug_spin_lock_before kernel/locking/spinlock_debug.c:85 [inline]
 do_raw_spin_lock+0x283/0x2f0 kernel/locking/spinlock_debug.c:114
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:111 [inline]
 _raw_spin_lock_irqsave+0xbc/0x100 kernel/locking/spinlock.c:162
 __wake_up_common_lock kernel/sched/wait.c:137 [inline]
 __wake_up+0x107/0x1a0 kernel/sched/wait.c:160
 __usb_hcd_giveback_urb+0x396/0x520 drivers/usb/core/hcd.c:1678
 dummy_timer+0x8d0/0x3330 drivers/usb/gadget/udc/dummy_hcd.c:2004
 __run_hrtimer kernel/time/hrtimer.c:1747 [inline]
 __hrtimer_run_queues+0x54a/0xd50 kernel/time/hrtimer.c:1811
 hrtimer_run_softirq+0x183/0x2a0 kernel/time/hrtimer.c:1828
 handle_softirqs+0x2a1/0x930 kernel/softirq.c:596
 __do_softirq kernel/softirq.c:630 [inline]
 invoke_softirq kernel/softirq.c:470 [inline]
 __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:preempt_count_add+0x66/0x190 kernel/sched/core.c:5714
Code: a9 7e 48 c7 c0 40 01 c0 96 48 c1 e8 03 42 0f b6 04 38 84 c0 0f 85 e6 00 00 00 83 3d 83 16 67 15 00 75 11 65 8b 05 82 84 a9 7e <0f> b6 c0 3d f5 00 00 00 73 58 65 8b 05 71 84 a9 7e 25 ff ff ff 7f
RSP: 0018:ffffc9000b486db0 EFLAGS: 00000246
RAX: 0000000080000002 RBX: ffffc9000b486ea8 RCX: ffffffff96c00103
RDX: dffffc0000000000 RSI: ffffffff816f4030 RDI: 0000000000000001
RBP: ffffc9000b486ef0 R08: ffffc9000b486f70 R09: 000000000000000e
R10: dffffc0000000000 R11: fffff52001690de1 R12: ffffffff816f4030
R13: ffffc9000b487ed0 R14: dffffc0000000000 R15: dffffc0000000000
 unwind_next_frame+0xaf/0x20b0 arch/x86/kernel/unwind_orc.c:433
 arch_stack_walk+0x10c/0x140 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0xa6/0xf0 kernel/stacktrace.c:122
 save_stack+0x121/0x230 mm/page_owner.c:127
 __set_page_owner+0x19/0x60 mm/page_owner.c:190
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x173/0x1a0 mm/page_alloc.c:2559
 prep_new_page mm/page_alloc.c:2566 [inline]
 get_page_from_freelist+0x1a1e/0x1ab0 mm/page_alloc.c:4357
 __alloc_pages+0x1ec/0x4f0 mm/page_alloc.c:5657
 __get_free_pages+0x8/0x30 mm/page_alloc.c:5707
 tlb_next_batch mm/mmu_gather.c:32 [inline]
 __tlb_remove_page_size+0x1f2/0x3f0 mm/mmu_gather.c:98
 __tlb_remove_page include/asm-generic/tlb.h:460 [inline]
 zap_pte_range mm/memory.c:1454 [inline]
 zap_pmd_range mm/memory.c:1572 [inline]
 zap_pud_range mm/memory.c:1601 [inline]
 zap_p4d_range mm/memory.c:1622 [inline]
 unmap_page_range+0x125d/0x2500 mm/memory.c:1643
 unmap_vmas+0x260/0x390 mm/memory.c:1728
 exit_mmap+0x20d/0x960 mm/mmap.c:3250
 __mmput+0x118/0x3c0 kernel/fork.c:1205
 exit_mm+0x1fe/0x2d0 kernel/exit.c:565
 do_exit+0x905/0x2480 kernel/exit.c:867
 do_group_exit+0x217/0x2d0 kernel/exit.c:1022
 get_signal+0x1272/0x1350 kernel/signal.c:2871
 arch_do_signal_or_restart+0xc4/0x1350 arch/x86/kernel/signal.c:871
 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
 syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:303
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7ff14359cdd9
Code: Unable to access opcode bytes at 0x7ff14359cdaf.
RSP: 002b:00007ff1444750e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007ff143815fa8 RCX: 00007ff14359cdd9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007ff143815fa8
RBP: 00007ff143815fa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ff143816038 R14: 00007fff6a66f8b0 R15: 00007fff6a66f998
 </TASK>

Allocated by task 5606:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
 ____kasan_kmalloc mm/kasan/common.c:375 [inline]
 __kasan_kmalloc+0x8e/0xa0 mm/kasan/common.c:384
 kmalloc include/linux/slab.h:563 [inline]
 kzalloc include/linux/slab.h:699 [inline]
 xpad_probe+0x41d/0x1d30 drivers/input/joystick/xpad.c:1971
 usb_probe_interface+0x5c5/0xb20 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x2aa/0xc70 drivers/base/dd.c:639
 __driver_probe_device+0x18c/0x330 drivers/base/dd.c:785
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:815
 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:943
 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
 __device_attach+0x2a8/0x480 drivers/base/dd.c:1015
 bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489
 device_add+0xa00/0xfb0 drivers/base/core.c:3697
 usb_set_configuration+0x1991/0x1fd0 drivers/usb/core/message.c:2223
 usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
 usb_probe_device+0x139/0x270 drivers/usb/core/driver.c:293
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x2aa/0xc70 drivers/base/dd.c:639
 __driver_probe_device+0x18c/0x330 drivers/base/dd.c:785
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:815
 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:943
 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
 __device_attach+0x2a8/0x480 drivers/base/dd.c:1015
 bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489
 device_add+0xa00/0xfb0 drivers/base/core.c:3697
 usb_new_device+0xd66/0x1650 drivers/usb/core/hub.c:2659
 hub_port_connect drivers/usb/core/hub.c:5517 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5657 [inline]
 port_event drivers/usb/core/hub.c:5817 [inline]
 hub_event+0x2dcf/0x5560 drivers/usb/core/hub.c:5899
 process_one_work+0x8a2/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaa2/0x1270 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

Freed by task 4891:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
 kasan_save_free_info+0x2d/0x50 mm/kasan/generic.c:516
 ____kasan_slab_free+0x126/0x1e0 mm/kasan/common.c:237
 kasan_slab_free include/linux/kasan.h:177 [inline]
 slab_free_hook mm/slub.c:1729 [inline]
 slab_free_freelist_hook+0x131/0x1a0 mm/slub.c:1755
 slab_free mm/slub.c:3687 [inline]
 __kmem_cache_free+0xb6/0x1f0 mm/slub.c:3700
 xpad_disconnect+0x34c/0x470 drivers/input/joystick/xpad.c:2152
 usb_unbind_interface+0x1ee/0x860 drivers/usb/core/driver.c:458
 device_remove drivers/base/dd.c:550 [inline]
 __device_release_driver drivers/base/dd.c:1260 [inline]
 device_release_driver_internal+0x522/0x850 drivers/base/dd.c:1286
 bus_remove_device+0x2e2/0x400 drivers/base/bus.c:531
 device_del+0x6af/0xaf0 drivers/base/core.c:3885
 usb_disable_device+0x3e2/0x890 drivers/usb/core/message.c:1472
 usb_disconnect+0x348/0x8a0 drivers/usb/core/hub.c:2314
 hub_port_connect drivers/usb/core/hub.c:5361 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5657 [inline]
 port_event drivers/usb/core/hub.c:5817 [inline]
 hub_event+0x1e50/0x5560 drivers/usb/core/hub.c:5899
 process_one_work+0x8a2/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaa2/0x1270 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

Last potentially related work creation:
 kasan_save_stack+0x3a/0x60 mm/kasan/common.c:46
 __kasan_record_aux_stack+0xb2/0xc0 mm/kasan/generic.c:486
 insert_work+0x54/0x3c0 kernel/workqueue.c:1361
 __queue_work+0xba3/0xfb0 kernel/workqueue.c:1520
 queue_work_on+0x124/0x1f0 kernel/workqueue.c:1548
 req_bio_endio block/blk-mq.c:782 [inline]
 blk_update_request+0x593/0xe30 block/blk-mq.c:927
 blk_mq_end_request+0x3a/0x70 block/blk-mq.c:1052
 blk_flush_complete_seq+0x5ad/0xc30 block/blk-flush.c:210
 flush_end_io+0x726/0xa50 block/blk-flush.c:268
 __blk_mq_end_request+0x475/0x550 block/blk-mq.c:1042
 blk_complete_reqs block/blk-mq.c:1132 [inline]
 blk_done_softirq+0x100/0x150 block/blk-mq.c:1137
 handle_softirqs+0x2a1/0x930 kernel/softirq.c:596
 run_ksoftirqd+0xa4/0x100 kernel/softirq.c:968
 smpboot_thread_fn+0x64a/0xa40 kernel/smpboot.c:164
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

The buggy address belongs to the object at ffff888056680000
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 92 bytes inside of
 1024-byte region [ffff888056680000, ffff888056680400)

The buggy address belongs to the physical page:
page:ffffea000159a000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x56680
head:ffffea000159a000 order:3 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 0000000000000000 dead000000000001 ffff888017441dc0
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4269, tgid 4269 (syz-executor), ts 84676521465, free_ts 24485344256
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x173/0x1a0 mm/page_alloc.c:2559
 prep_new_page mm/page_alloc.c:2566 [inline]
 get_page_from_freelist+0x1a1e/0x1ab0 mm/page_alloc.c:4357
 __alloc_pages+0x1ec/0x4f0 mm/page_alloc.c:5657
 alloc_slab_page+0x5d/0x160 mm/slub.c:1799
 allocate_slab mm/slub.c:1944 [inline]
 new_slab+0x87/0x2c0 mm/slub.c:1997
 ___slab_alloc+0xbc6/0x1240 mm/slub.c:3154
 __slab_alloc mm/slub.c:3240 [inline]
 slab_alloc_node mm/slub.c:3325 [inline]
 __kmem_cache_alloc_node+0x1a0/0x260 mm/slub.c:3398
 __do_kmalloc_node mm/slab_common.c:935 [inline]
 __kmalloc_node_track_caller+0x9e/0x230 mm/slab_common.c:956
 kmalloc_reserve net/core/skbuff.c:446 [inline]
 __alloc_skb+0x22a/0x7e0 net/core/skbuff.c:515
 alloc_skb include/linux/skbuff.h:1303 [inline]
 nlmsg_new include/net/netlink.h:998 [inline]
 inet6_rt_notify+0xb0/0x240 net/ipv6/route.c:6238
 fib6_add_rt2node net/ipv6/ip6_fib.c:1261 [inline]
 fib6_add+0x1db0/0x3d10 net/ipv6/ip6_fib.c:1490
 __ip6_ins_rt net/ipv6/route.c:1346 [inline]
 ip6_route_add+0x86/0x130 net/ipv6/route.c:3893
 addrconf_prefix_route net/ipv6/addrconf.c:2442 [inline]
 addrconf_add_linklocal+0x449/0x6d0 net/ipv6/addrconf.c:3259
 addrconf_addr_gen+0x55e/0x6a0 net/ipv6/addrconf.c:3388
 addrconf_init_auto_addrs+0x752/0xaf0 net/ipv6/addrconf.c:-1
 addrconf_notify+0xaca/0xf40 net/ipv6/addrconf.c:3685
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1486 [inline]
 free_pcp_prepare mm/page_alloc.c:1536 [inline]
 free_unref_page_prepare+0x8b4/0x9a0 mm/page_alloc.c:3413
 free_unref_page+0x2e/0x3f0 mm/page_alloc.c:3508
 free_contig_range+0x9d/0x150 mm/page_alloc.c:9625
 destroy_args+0xf0/0xa0a mm/debug_vm_pgtable.c:1031
 debug_vm_pgtable+0x33c/0x38e mm/debug_vm_pgtable.c:1359
 do_one_initcall+0x26a/0x840 init/main.c:1310
 do_initcall_level+0x137/0x1e4 init/main.c:1383
 do_initcalls+0x4b/0x8a init/main.c:1399
 kernel_init_freeable+0x415/0x5be init/main.c:1638
 kernel_init+0x19/0x1b0 init/main.c:1526
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

Memory state around the buggy address:
 ffff88805667ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88805667ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888056680000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                    ^
 ffff888056680080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888056680100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
   0:	a9 7e 48 c7 c0       	test   $0xc0c7487e,%eax
   5:	40 01 c0             	rex add %eax,%eax
   8:	96                   	xchg   %eax,%esi
   9:	48 c1 e8 03          	shr    $0x3,%rax
   d:	42 0f b6 04 38       	movzbl (%rax,%r15,1),%eax
  12:	84 c0                	test   %al,%al
  14:	0f 85 e6 00 00 00    	jne    0x100
  1a:	83 3d 83 16 67 15 00 	cmpl   $0x0,0x15671683(%rip)        # 0x156716a4
  21:	75 11                	jne    0x34
  23:	65 8b 05 82 84 a9 7e 	mov    %gs:0x7ea98482(%rip),%eax        # 0x7ea984ac
* 2a:	0f b6 c0             	movzbl %al,%eax <-- trapping instruction
  2d:	3d f5 00 00 00       	cmp    $0xf5,%eax
  32:	73 58                	jae    0x8c
  34:	65 8b 05 71 84 a9 7e 	mov    %gs:0x7ea98471(%rip),%eax        # 0x7ea984ac
  3b:	25 ff ff ff 7f       	and    $0x7fffffff,%eax