program:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002000000402a1101000001010203010902270001010080fa0904000003ffffff00070581024000000705820240000007050302"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000001000)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001000)={0x84, &(0x7f0000000000), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000001000)={0x84, &(0x7f0000000000), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x40, 0x21, 0x1}})
[ 93.206966][ T5283] Bluetooth: hci0: command tx timeout
[ 93.232288][ T9] cfg80211: failed to load regulatory.db
[ 93.549961][ T1924] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 93.703596][ T1924] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64
[ 93.707619][ T1924] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64
[ 93.712139][ T1924] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0
[ 93.716028][ T1924] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0
[ 93.723915][ T1924] usb 5-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice= 1.00
[ 93.727776][ T1924] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 93.732000][ T1924] usb 5-1: Product: syz
[ 93.733940][ T1924] usb 5-1: Manufacturer: syz
[ 93.736079][ T1924] usb 5-1: SerialNumber: syz
[ 93.748948][ T5325] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[ 93.756580][ T5325] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[ 94.771744][ T1924] redrat3 5-1:1.0: Firmware rev:
[ 94.974072][ T1924] redrat3 5-1:1.0: Failed to read timeout from hardware
[ 95.030010][ T1924] rc_core: IR keymap rc-hauppauge not found
[ 95.032622][ T1924] Registered IR keymap rc-empty
[ 95.041775][ T1924] rc rc0: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/rc/rc0
[ 95.048157][ T1924] input: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/rc/rc0/input5
[ 95.220992][ T5283] Bluetooth: hci0: command tx timeout
[ 95.438007][ T1924] redrat3 5-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0
[ 95.449590][ T1924] redrat3 5-1:1.0: redrat3_enable_detector: detector status: -5, should be 1
[ 95.463948][ T1924] redrat3 5-1:1.0: probe with driver redrat3 failed with error -5
[ 95.481040][ T1924] usb 5-1: USB disconnect, device number 2
[ 95.502828][ T4697] ==================================================================
[ 95.505642][ T4697] BUG: KASAN: slab-use-after-free in string+0x216/0x2d0
[ 95.508073][ T4697] Read of size 1 at addr ffff88801fda7758 by task udevd/4697
[ 95.510866][ T4697]
[ 95.511823][ T4697] CPU: 0 UID: 0 PID: 4697 Comm: udevd Not tainted syzkaller #0 PREEMPT(full)
[ 95.511837][ T4697] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.511843][ T4697] Call Trace:
[ 95.511849][ T4697]
[ 95.511854][ T4697] dump_stack_lvl+0xe8/0x150
[ 95.511874][ T4697] print_address_description+0x55/0x1e0
[ 95.511888][ T4697] ? string+0x216/0x2d0
[ 95.511894][ T4697] print_report+0x58/0x70
[ 95.511905][ T4697] kasan_report+0x117/0x150
[ 95.511915][ T4697] ? string+0x216/0x2d0
[ 95.511922][ T4697] string+0x216/0x2d0
[ 95.511929][ T4697] vsnprintf+0x74a/0xef0
[ 95.511937][ T4697] add_uevent_var+0x1ce/0x460
[ 95.511945][ T4697] ? __pfx___mutex_lock+0x10/0x10
[ 95.511955][ T4697] ? __pfx_add_uevent_var+0x10/0x10
[ 95.511963][ T4697] rc_dev_uevent+0x164/0x1a0
[ 95.511973][ T4697] dev_uevent+0x537/0x870
[ 95.512020][ T4697] ? __pfx_dev_uevent+0x10/0x10
[ 95.512029][ T4697] ? __kmalloc_cache_noprof+0x32d/0x660
[ 95.512038][ T4697] ? __kmalloc_cache_noprof+0x150/0x660
[ 95.512048][ T4697] ? uevent_show+0x15c/0x310
[ 95.512062][ T4697] uevent_show+0x1a0/0x310
[ 95.512076][ T4697] dev_attr_show+0x58/0xc0
[ 95.512088][ T4697] ? __pfx_dev_attr_show+0x10/0x10
[ 95.512101][ T4697] sysfs_kf_seq_show+0x331/0x490
[ 95.512115][ T4697] seq_read_iter+0x463/0xca0
[ 95.512129][ T4697] vfs_read+0x595/0xa80
[ 95.512146][ T4697] ? __pfx_vfs_read+0x10/0x10
[ 95.512160][ T4697] ? do_sys_openat2+0x14e/0x200
[ 95.512173][ T4697] ksys_read+0x150/0x270
[ 95.512183][ T4697] ? __pfx_ksys_read+0x10/0x10
[ 95.512194][ T4697] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.512202][ T4697] do_syscall_64+0x174/0x580
[ 95.512210][ T4697] ? trace_irq_disable+0x3b/0x140
[ 95.512220][ T4697] ? clear_bhb_loop+0x40/0x90
[ 95.512227][ T4697] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.512234][ T4697] RIP: 0033:0x7f6b78aa7407
[ 95.512242][ T4697] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[ 95.512248][ T4697] RSP: 002b:00007ffe653110d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[ 95.512257][ T4697] RAX: ffffffffffffffda RBX: 00007f6b791f7880 RCX: 00007f6b78aa7407
[ 95.512262][ T4697] RDX: 0000000000001000 RSI: 000055fbc3d04df0 RDI: 000000000000000c
[ 95.512266][ T4697] RBP: 00007f6b78befff0 R08: 0000000000000000 R09: 0000000000000000
[ 95.512271][ T4697] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
[ 95.512275][ T4697] R13: 00007f6b78befea0 R14: 0000000000000000 R15: 000055fbc3cbba70
[ 95.512282][ T4697]
[ 95.512284][ T4697]
[ 95.609545][ T4697] Allocated by task 1924:
[ 95.611469][ T4697] kasan_save_track+0x3e/0x80
[ 95.613589][ T4697] __kasan_kmalloc+0x93/0xb0
[ 95.615626][ T4697] __kmalloc_cache_noprof+0x32d/0x660
[ 95.617878][ T4697] redrat3_dev_probe+0x477/0x2570
[ 95.619960][ T4697] usb_probe_interface+0x653/0xc60
[ 95.622054][ T4697] really_probe+0x254/0xae0
[ 95.623910][ T4697] __driver_probe_device+0x1e8/0x360
[ 95.626064][ T4697] driver_probe_device+0x4f/0x240
[ 95.628130][ T4697] __device_attach_driver+0x270/0x410
[ 95.630164][ T4697] bus_for_each_drv+0x258/0x2f0
[ 95.632149][ T4697] __device_attach+0x2c4/0x450
[ 95.634074][ T4697] device_initial_probe+0xa1/0xd0
[ 95.636101][ T4697] bus_probe_device+0x12a/0x220
[ 95.638095][ T4697] device_add+0x7d7/0xb80
[ 95.639914][ T4697] usb_set_configuration+0x1ad8/0x2180
[ 95.642325][ T4697] usb_generic_driver_probe+0x8d/0x150
[ 95.644534][ T4697] usb_probe_device+0x1c3/0x3b0
[ 95.646467][ T4697] really_probe+0x254/0xae0
[ 95.648404][ T4697] __driver_probe_device+0x1e8/0x360
[ 95.650580][ T4697] driver_probe_device+0x4f/0x240
[ 95.652662][ T4697] __device_attach_driver+0x270/0x410
[ 95.654994][ T4697] bus_for_each_drv+0x258/0x2f0
[ 95.657133][ T4697] __device_attach+0x2c4/0x450
[ 95.659137][ T4697] device_initial_probe+0xa1/0xd0
[ 95.661284][ T4697] bus_probe_device+0x12a/0x220
[ 95.663284][ T4697] device_add+0x7d7/0xb80
[ 95.665141][ T4697] usb_new_device+0x99d/0x1620
[ 95.667541][ T4697] hub_event+0x28e8/0x4d30
[ 95.669409][ T4697] process_scheduled_works+0xa8e/0x14e0
[ 95.671865][ T4697] worker_thread+0xa47/0xfb0
[ 95.673790][ T4697] kthread+0x388/0x470
[ 95.675474][ T4697] ret_from_fork+0x514/0xb70
[ 95.677374][ T4697] ret_from_fork_asm+0x1a/0x30
[ 95.679270][ T4697]
[ 95.680189][ T4697] Freed by task 1924:
[ 95.681758][ T4697] kasan_save_track+0x3e/0x80
[ 95.683743][ T4697] kasan_save_free_info+0x40/0x50
[ 95.685829][ T4697] __kasan_slab_free+0x5c/0x80
[ 95.687939][ T4697] kfree+0x1c5/0x640
[ 95.689528][ T4697] redrat3_dev_probe+0x1bf4/0x2570
[ 95.691618][ T4697] usb_probe_interface+0x653/0xc60
[ 95.693482][ T4697] really_probe+0x254/0xae0
[ 95.695223][ T4697] __driver_probe_device+0x1e8/0x360
[ 95.697135][ T4697] driver_probe_device+0x4f/0x240
[ 95.699000][ T4697] __device_attach_driver+0x270/0x410
[ 95.701082][ T4697] bus_for_each_drv+0x258/0x2f0
[ 95.702873][ T4697] __device_attach+0x2c4/0x450
[ 95.704657][ T4697] device_initial_probe+0xa1/0xd0
[ 95.706535][ T4697] bus_probe_device+0x12a/0x220
[ 95.708362][ T4697] device_add+0x7d7/0xb80
[ 95.709939][ T4697] usb_set_configuration+0x1ad8/0x2180
[ 95.712294][ T4697] usb_generic_driver_probe+0x8d/0x150
[ 95.714522][ T4697] usb_probe_device+0x1c3/0x3b0
[ 95.716568][ T4697] really_probe+0x254/0xae0
[ 95.718583][ T4697] __driver_probe_device+0x1e8/0x360
[ 95.720842][ T4697] driver_probe_device+0x4f/0x240
[ 95.722929][ T4697] __device_attach_driver+0x270/0x410
[ 95.725192][ T4697] bus_for_each_drv+0x258/0x2f0
[ 95.727225][ T4697] __device_attach+0x2c4/0x450
[ 95.729067][ T4697] device_initial_probe+0xa1/0xd0
[ 95.731097][ T4697] bus_probe_device+0x12a/0x220
[ 95.733046][ T4697] device_add+0x7d7/0xb80
[ 95.734764][ T4697] usb_new_device+0x99d/0x1620
[ 95.736605][ T4697] hub_event+0x28e8/0x4d30
[ 95.738395][ T4697] process_scheduled_works+0xa8e/0x14e0
[ 95.740521][ T4697] worker_thread+0xa47/0xfb0
[ 95.742225][ T4697] kthread+0x388/0x470
[ 95.743875][ T4697] ret_from_fork+0x514/0xb70
[ 95.745743][ T4697] ret_from_fork_asm+0x1a/0x30
[ 95.747574][ T4697]
[ 95.748599][ T4697] The buggy address belongs to the object at ffff88801fda7000
[ 95.748599][ T4697] which belongs to the cache kmalloc-2k of size 2048
[ 95.754250][ T4697] The buggy address is located 1880 bytes inside of
[ 95.754250][ T4697] freed 2048-byte region [ffff88801fda7000, ffff88801fda7800)
[ 95.759961][ T4697]
[ 95.761063][ T4697] The buggy address belongs to the physical page:
[ 95.763740][ T4697] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1fda0
[ 95.767457][ T4697] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 95.770885][ T4697] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 95.773961][ T4697] page_type: f5(slab)
[ 95.775764][ T4697] raw: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122
[ 95.779466][ T4697] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[ 95.782756][ T4697] head: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122
[ 95.785765][ T4697] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[ 95.788801][ T4697] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 95.791764][ T4697] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 95.794784][ T4697] page dumped because: kasan: bad access detected
[ 95.797159][ T4697] page_owner tracks the page as allocated
[ 95.799126][ T4697] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 9, tgid 9 (kworker/0:0), ts 93752601357, free_ts 91204945044
[ 95.806398][ T4697] post_alloc_hook+0x1f9/0x250
[ 95.808315][ T4697] get_page_from_freelist+0x21fa/0x2270
[ 95.810631][ T4697] __alloc_frozen_pages_noprof+0x18d/0x380
[ 95.812718][ T4697] allocate_slab+0x79/0x5e0
[ 95.814517][ T4697] refill_objects+0x2d5/0x350
[ 95.816410][ T4697] __pcs_replace_empty_main+0x2bf/0x6b0
[ 95.818506][ T4697] __kmalloc_node_track_caller_noprof+0x557/0x730
[ 95.820922][ T4697] __alloc_skb+0x2bd/0x7a0
[ 95.822571][ T4697] mld_newpack+0x165/0xcb0
[ 95.824192][ T4697] add_grec+0x119f/0x19d0
[ 95.825723][ T4697] mld_send_initial_cr+0x288/0x550
[ 95.827633][ T4697] mld_dad_work+0x3d/0x480
[ 95.829199][ T4697] process_scheduled_works+0xa8e/0x14e0
[ 95.831219][ T4697] worker_thread+0xa47/0xfb0
[ 95.832916][ T4697] kthread+0x388/0x470
[ 95.834459][ T4697] ret_from_fork+0x514/0xb70
[ 95.836230][ T4697] page last free pid 75 tgid 75 stack trace:
[ 95.838418][ T4697] free_unref_folios+0xd84/0x14a0
[ 95.840419][ T4697] shrink_folio_list+0x2b7d/0x5330
[ 95.842347][ T4697] evict_folios+0x3821/0x49e0
[ 95.844136][ T4697] try_to_shrink_lruvec+0xb4f/0xed0
[ 95.846228][ T4697] shrink_one+0x233/0x730
[ 95.847827][ T4697] shrink_node+0x3303/0x3b60
[ 95.849730][ T4697] kswapd+0x17b6/0x31c0
[ 95.851435][ T4697] kthread+0x388/0x470
[ 95.852963][ T4697] ret_from_fork+0x514/0xb70
[ 95.854706][ T4697] ret_from_fork_asm+0x1a/0x30
[ 95.856516][ T4697]
[ 95.857430][ T4697] Memory state around the buggy address:
[ 95.859504][ T4697] ffff88801fda7600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 95.862439][ T4697] ffff88801fda7680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 95.865477][ T4697] >ffff88801fda7700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 95.868473][ T4697] ^
[ 95.870871][ T4697] ffff88801fda7780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 95.873649][ T4697] ffff88801fda7800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 95.876454][ T4697] ==================================================================
[ 95.903458][ T4697] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 95.906232][ T4697] CPU: 0 UID: 0 PID: 4697 Comm: udevd Not tainted syzkaller #0 PREEMPT(full)
[ 95.909313][ T4697] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.913191][ T4697] Call Trace:
[ 95.914559][ T4697]
[ 95.915677][ T4697] vpanic+0x56c/0xa60
[ 95.917184][ T4697] ? __pfx_vpanic+0x10/0x10
[ 95.919023][ T4697] ? __pfx___schedule+0x10/0x10
[ 95.921497][ T4697] panic+0xc5/0xd0
[ 95.923132][ T4697] ? __pfx_panic+0x10/0x10
[ 95.925010][ T4697] ? preempt_schedule_thunk+0x16/0x40
[ 95.927353][ T4697] ? string+0x216/0x2d0
[ 95.929061][ T4697] check_panic_on_warn+0x89/0xb0
[ 95.931427][ T4697] ? string+0x216/0x2d0
[ 95.933128][ T4697] end_report+0x73/0x170
[ 95.934964][ T4697] ? string+0x216/0x2d0
[ 95.936700][ T4697] kasan_report+0x128/0x150
[ 95.938593][ T4697] ? string+0x216/0x2d0
[ 95.940706][ T4697] string+0x216/0x2d0
[ 95.942385][ T4697] vsnprintf+0x74a/0xef0
[ 95.944125][ T4697] add_uevent_var+0x1ce/0x460
[ 95.946070][ T4697] ? __pfx___mutex_lock+0x10/0x10
[ 95.948156][ T4697] ? __pfx_add_uevent_var+0x10/0x10
[ 95.950308][ T4697] rc_dev_uevent+0x164/0x1a0
[ 95.952242][ T4697] dev_uevent+0x537/0x870
[ 95.954001][ T4697] ? __pfx_dev_uevent+0x10/0x10
[ 95.955985][ T4697] ? __kmalloc_cache_noprof+0x32d/0x660
[ 95.958270][ T4697] ? __kmalloc_cache_noprof+0x150/0x660
[ 95.960498][ T4697] ? uevent_show+0x15c/0x310
[ 95.962396][ T4697] uevent_show+0x1a0/0x310
[ 95.964243][ T4697] dev_attr_show+0x58/0xc0
[ 95.966104][ T4697] ? __pfx_dev_attr_show+0x10/0x10
[ 95.968448][ T4697] sysfs_kf_seq_show+0x331/0x490
[ 95.970589][ T4697] seq_read_iter+0x463/0xca0
[ 95.972635][ T4697] vfs_read+0x595/0xa80
[ 95.974571][ T4697] ? __pfx_vfs_read+0x10/0x10
[ 95.976738][ T4697] ? do_sys_openat2+0x14e/0x200
[ 95.978776][ T4697] ksys_read+0x150/0x270
[ 95.980648][ T4697] ? __pfx_ksys_read+0x10/0x10
[ 95.982763][ T4697] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.985225][ T4697] do_syscall_64+0x174/0x580
[ 95.987532][ T4697] ? trace_irq_disable+0x3b/0x140
[ 95.990055][ T4697] ? clear_bhb_loop+0x40/0x90
[ 95.992023][ T4697] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.994340][ T4697] RIP: 0033:0x7f6b78aa7407
[ 95.996249][ T4697] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[ 96.003861][ T4697] RSP: 002b:00007ffe653110d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[ 96.007286][ T4697] RAX: ffffffffffffffda RBX: 00007f6b791f7880 RCX: 00007f6b78aa7407
[ 96.010596][ T4697] RDX: 0000000000001000 RSI: 000055fbc3d04df0 RDI: 000000000000000c
[ 96.013990][ T4697] RBP: 00007f6b78befff0 R08: 0000000000000000 R09: 0000000000000000
[ 96.017329][ T4697] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
[ 96.020875][ T4697] R13: 00007f6b78befea0 R14: 0000000000000000 R15: 000055fbc3cbba70
[ 96.024301][ T4697]
[ 96.025989][ T4697] Kernel Offset: disabled
[ 96.027765][ T4697] Rebooting in 86400 seconds..