program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002000000402a1101000001010203010902270001010080fa0904000003ffffff00070581024000000705820240000007050302400000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000001000)={0x84, &(0x7f0000001100)={0xc0, 0xb1, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/lirc0\x00', 0x2, 0x0)
write(r1, &(0x7f0000000400)="0100000002000000", 0x8)
[ 102.320838][ T4648] Bluetooth: hci0: command tx timeout
[ 102.629813][ T5308] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 102.792857][ T5308] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64
[ 102.797113][ T5308] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64
[ 102.801544][ T5308] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64
[ 102.808154][ T5308] usb 5-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice= 1.00
[ 102.812264][ T5308] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 102.815584][ T5308] usb 5-1: Product: syz
[ 102.817352][ T5308] usb 5-1: Manufacturer: syz
[ 102.820264][ T5308] usb 5-1: SerialNumber: syz
[ 102.831603][ T5321] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[ 102.836028][ T5321] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[ 102.840700][ T5321] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[ 104.251616][ T5308] redrat3 5-1:1.0: Problem fetching firmware ID
[ 104.282649][ T5308] redrat3 5-1:1.0: Failed to read timeout from hardware
[ 104.389544][ T44] Bluetooth: hci0: command tx timeout
[ 104.392363][ T5308] rc_core: IR keymap rc-hauppauge not found
[ 104.394906][ T5308] Registered IR keymap rc-empty
[ 104.409352][ T5308] rc rc0: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/rc/rc0
[ 104.416995][ T5308] input: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/rc/rc0/input5
[ 104.433440][ T5308] redrat3 5-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0
[ 104.437670][ T5308] redrat3 5-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0
[ 104.441652][ T5308] redrat3 5-1:1.0: redrat3_enable_detector: detector status: -5, should be 1
[ 104.451848][ T5308] redrat3 5-1:1.0: probe with driver redrat3 failed with error -5
[ 104.471293][ T4698] ==================================================================
[ 104.474515][ T4698] BUG: KASAN: slab-use-after-free in string+0x216/0x2d0
[ 104.477339][ T4698] Read of size 1 at addr ffff888012125758 by task udevd/4698
[ 104.480399][ T4698]
[ 104.481414][ T4698] CPU: 0 UID: 0 PID: 4698 Comm: udevd Not tainted syzkaller #0 PREEMPT(full)
[ 104.481427][ T4698] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 104.481433][ T4698] Call Trace:
[ 104.481440][ T4698]
[ 104.481445][ T4698] dump_stack_lvl+0xe8/0x150
[ 104.481464][ T4698] print_address_description+0x55/0x1e0
[ 104.481479][ T4698] ? string+0x216/0x2d0
[ 104.481489][ T4698] print_report+0x58/0x70
[ 104.481502][ T4698] kasan_report+0x117/0x150
[ 104.481517][ T4698] ? string+0x216/0x2d0
[ 104.481524][ T4698] string+0x216/0x2d0
[ 104.481531][ T4698] vsnprintf+0x74a/0xef0
[ 104.481539][ T4698] add_uevent_var+0x1ce/0x460
[ 104.481547][ T4698] ? __pfx___mutex_lock+0x10/0x10
[ 104.481556][ T4698] ? __pfx_add_uevent_var+0x10/0x10
[ 104.481564][ T4698] rc_dev_uevent+0x164/0x1a0
[ 104.481574][ T4698] dev_uevent+0x537/0x870
[ 104.481619][ T4698] ? __pfx_dev_uevent+0x10/0x10
[ 104.481631][ T4698] ? __kmalloc_cache_noprof+0x32d/0x660
[ 104.481644][ T4698] ? __kmalloc_cache_noprof+0x150/0x660
[ 104.481655][ T4698] ? uevent_show+0x15c/0x310
[ 104.481670][ T4698] uevent_show+0x1a0/0x310
[ 104.481685][ T4698] dev_attr_show+0x58/0xc0
[ 104.481697][ T4698] ? __pfx_dev_attr_show+0x10/0x10
[ 104.481711][ T4698] sysfs_kf_seq_show+0x331/0x490
[ 104.481725][ T4698] seq_read_iter+0x463/0xca0
[ 104.481734][ T4698] vfs_read+0x595/0xa80
[ 104.481745][ T4698] ? __pfx_vfs_read+0x10/0x10
[ 104.481755][ T4698] ? do_sys_openat2+0x14e/0x200
[ 104.481765][ T4698] ksys_read+0x150/0x270
[ 104.481775][ T4698] ? __pfx_ksys_read+0x10/0x10
[ 104.481786][ T4698] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 104.481793][ T4698] do_syscall_64+0x174/0x580
[ 104.481802][ T4698] ? trace_irq_disable+0x3b/0x140
[ 104.481811][ T4698] ? clear_bhb_loop+0x40/0x90
[ 104.481819][ T4698] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 104.481826][ T4698] RIP: 0033:0x7fcc8e4a7407
[ 104.481834][ T4698] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[ 104.481840][ T4698] RSP: 002b:00007ffc48ecd1b0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[ 104.481849][ T4698] RAX: ffffffffffffffda RBX: 00007fcc8ec0c880 RCX: 00007fcc8e4a7407
[ 104.481854][ T4698] RDX: 0000000000001000 RSI: 0000560be5654390 RDI: 000000000000000c
[ 104.481859][ T4698] RBP: 00007fcc8e5efff0 R08: 0000000000000000 R09: 0000000000000000
[ 104.481863][ T4698] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
[ 104.481867][ T4698] R13: 00007fcc8e5efea0 R14: 0000000000000000 R15: 0000560be5656560
[ 104.481874][ T4698]
[ 104.481877][ T4698]
[ 104.583479][ T4698] Allocated by task 5308:
[ 104.585310][ T4698] kasan_save_track+0x3e/0x80
[ 104.587301][ T4698] __kasan_kmalloc+0x93/0xb0
[ 104.589102][ T4698] __kmalloc_cache_noprof+0x32d/0x660
[ 104.591242][ T4698] redrat3_dev_probe+0x477/0x2570
[ 104.593277][ T4698] usb_probe_interface+0x653/0xc60
[ 104.595352][ T4698] really_probe+0x254/0xae0
[ 104.597142][ T4698] __driver_probe_device+0x1e8/0x360
[ 104.599378][ T4698] driver_probe_device+0x4f/0x240
[ 104.601361][ T4698] __device_attach_driver+0x270/0x410
[ 104.603544][ T4698] bus_for_each_drv+0x258/0x2f0
[ 104.605537][ T4698] __device_attach+0x2c4/0x450
[ 104.607492][ T4698] device_initial_probe+0xa1/0xd0
[ 104.609403][ T4698] bus_probe_device+0x12a/0x220
[ 104.611280][ T4698] device_add+0x7d7/0xb80
[ 104.612897][ T4698] usb_set_configuration+0x1ad8/0x2180
[ 104.615032][ T4698] usb_generic_driver_probe+0x8d/0x150
[ 104.617236][ T4698] usb_probe_device+0x1c3/0x3b0
[ 104.619210][ T4698] really_probe+0x254/0xae0
[ 104.620957][ T4698] __driver_probe_device+0x1e8/0x360
[ 104.623001][ T4698] driver_probe_device+0x4f/0x240
[ 104.624962][ T4698] __device_attach_driver+0x270/0x410
[ 104.627074][ T4698] bus_for_each_drv+0x258/0x2f0
[ 104.629036][ T4698] __device_attach+0x2c4/0x450
[ 104.630852][ T4698] device_initial_probe+0xa1/0xd0
[ 104.632729][ T4698] bus_probe_device+0x12a/0x220
[ 104.634802][ T4698] device_add+0x7d7/0xb80
[ 104.636527][ T4698] usb_new_device+0x99d/0x1620
[ 104.638704][ T4698] hub_event+0x28e8/0x4d30
[ 104.640834][ T4698] process_scheduled_works+0xa8e/0x14e0
[ 104.643329][ T4698] worker_thread+0xa47/0xfb0
[ 104.645263][ T4698] kthread+0x388/0x470
[ 104.647057][ T4698] ret_from_fork+0x514/0xb70
[ 104.648922][ T4698] ret_from_fork_asm+0x1a/0x30
[ 104.650758][ T4698]
[ 104.651720][ T4698] Freed by task 5308:
[ 104.653317][ T4698] kasan_save_track+0x3e/0x80
[ 104.655264][ T4698] kasan_save_free_info+0x40/0x50
[ 104.657222][ T4698] __kasan_slab_free+0x5c/0x80
[ 104.659075][ T4698] kfree+0x1c5/0x640
[ 104.660615][ T4698] redrat3_dev_probe+0x1bf4/0x2570
[ 104.662577][ T4698] usb_probe_interface+0x653/0xc60
[ 104.664684][ T4698] really_probe+0x254/0xae0
[ 104.666571][ T4698] __driver_probe_device+0x1e8/0x360
[ 104.668731][ T4698] driver_probe_device+0x4f/0x240
[ 104.670724][ T4698] __device_attach_driver+0x270/0x410
[ 104.672810][ T4698] bus_for_each_drv+0x258/0x2f0
[ 104.674753][ T4698] __device_attach+0x2c4/0x450
[ 104.676735][ T4698] device_initial_probe+0xa1/0xd0
[ 104.678838][ T4698] bus_probe_device+0x12a/0x220
[ 104.680743][ T4698] device_add+0x7d7/0xb80
[ 104.682477][ T4698] usb_set_configuration+0x1ad8/0x2180
[ 104.684734][ T4698] usb_generic_driver_probe+0x8d/0x150
[ 104.686941][ T4698] usb_probe_device+0x1c3/0x3b0
[ 104.688922][ T4698] really_probe+0x254/0xae0
[ 104.690780][ T4698] __driver_probe_device+0x1e8/0x360
[ 104.692790][ T4698] driver_probe_device+0x4f/0x240
[ 104.694939][ T4698] __device_attach_driver+0x270/0x410
[ 104.697144][ T4698] bus_for_each_drv+0x258/0x2f0
[ 104.699164][ T4698] __device_attach+0x2c4/0x450
[ 104.701092][ T4698] device_initial_probe+0xa1/0xd0
[ 104.703064][ T4698] bus_probe_device+0x12a/0x220
[ 104.705028][ T4698] device_add+0x7d7/0xb80
[ 104.706826][ T4698] usb_new_device+0x99d/0x1620
[ 104.708863][ T4698] hub_event+0x28e8/0x4d30
[ 104.710735][ T4698] process_scheduled_works+0xa8e/0x14e0
[ 104.713002][ T4698] worker_thread+0xa47/0xfb0
[ 104.714995][ T4698] kthread+0x388/0x470
[ 104.716662][ T4698] ret_from_fork+0x514/0xb70
[ 104.718582][ T4698] ret_from_fork_asm+0x1a/0x30
[ 104.720470][ T4698]
[ 104.721436][ T4698] The buggy address belongs to the object at ffff888012125000
[ 104.721436][ T4698] which belongs to the cache kmalloc-2k of size 2048
[ 104.727024][ T4698] The buggy address is located 1880 bytes inside of
[ 104.727024][ T4698] freed 2048-byte region [ffff888012125000, ffff888012125800)
[ 104.732498][ T4698]
[ 104.733487][ T4698] The buggy address belongs to the physical page:
[ 104.736030][ T4698] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12120
[ 104.739809][ T4698] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 104.743888][ T4698] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 104.746723][ T4698] page_type: f5(slab)
[ 104.748326][ T4698] raw: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122
[ 104.751785][ T4698] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[ 104.755088][ T4698] head: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122
[ 104.758497][ T4698] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[ 104.761902][ T4698] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 104.765254][ T4698] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 104.768612][ T4698] page dumped because: kasan: bad access detected
[ 104.771139][ T4698] page_owner tracks the page as allocated
[ 104.773366][ T4698] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5284, tgid 5284 (syz-executor), ts 98424965015, free_ts 30159752107
[ 104.781563][ T4698] post_alloc_hook+0x1f9/0x250
[ 104.783543][ T4698] get_page_from_freelist+0x21fa/0x2270
[ 104.785753][ T4698] __alloc_frozen_pages_noprof+0x18d/0x380
[ 104.788005][ T4698] allocate_slab+0x79/0x5e0
[ 104.789740][ T4698] refill_objects+0x2d5/0x350
[ 104.791655][ T4698] __pcs_replace_empty_main+0x2bf/0x6b0
[ 104.793843][ T4698] __kmalloc_cache_noprof+0x3a7/0x660
[ 104.796149][ T4698] rtnl_newlink+0x136/0x1bd0
[ 104.798658][ T4698] rtnetlink_rcv_msg+0x802/0xc00
[ 104.800803][ T4698] netlink_rcv_skb+0x226/0x4a0
[ 104.802845][ T4698] netlink_unicast+0x7bb/0x940
[ 104.804533][ T4698] netlink_sendmsg+0x813/0xb40
[ 104.806435][ T4698] sock_sendmsg_nosec+0x13a/0x180
[ 104.808439][ T4698] __sys_sendto+0x408/0x5a0
[ 104.810294][ T4698] __x64_sys_sendto+0xde/0x100
[ 104.812197][ T4698] do_syscall_64+0x174/0x580
[ 104.814064][ T4698] page last free pid 4707 tgid 4707 stack trace:
[ 104.816649][ T4698] __free_frozen_pages+0xc1e/0xd10
[ 104.818689][ T4698] __slab_free+0x274/0x2c0
[ 104.820501][ T4698] qlist_free_all+0x99/0x100
[ 104.822411][ T4698] kasan_quarantine_reduce+0x148/0x160
[ 104.824763][ T4698] __kasan_slab_alloc+0x22/0x80
[ 104.826713][ T4698] kmem_cache_alloc_noprof+0x2a0/0x5f0
[ 104.828622][ T4698] do_getname+0x2e/0x250
[ 104.830300][ T4698] do_readlinkat+0xc8/0x510
[ 104.832187][ T4698] __x64_sys_readlink+0x7f/0x90
[ 104.834211][ T4698] do_syscall_64+0x174/0x580
[ 104.836053][ T4698] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 104.838314][ T4698]
[ 104.839288][ T4698] Memory state around the buggy address:
[ 104.841638][ T4698] ffff888012125600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 104.844908][ T4698] ffff888012125680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 104.848056][ T4698] >ffff888012125700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 104.851163][ T4698] ^
[ 104.853829][ T4698] ffff888012125780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 104.857157][ T4698] ffff888012125800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 104.860460][ T4698] ==================================================================
[ 104.864653][ T5308] usb 5-1: USB disconnect, device number 2
[ 104.918591][ T4698] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 104.921518][ T4698] CPU: 0 UID: 0 PID: 4698 Comm: udevd Not tainted syzkaller #0 PREEMPT(full)
[ 104.925105][ T4698] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 104.929022][ T4698] Call Trace:
[ 104.930413][ T4698]
[ 104.931623][ T4698] vpanic+0x56c/0xa60
[ 104.933220][ T4698] ? __pfx_vpanic+0x10/0x10
[ 104.935097][ T4698] ? __pfx___schedule+0x10/0x10
[ 104.937062][ T4698] panic+0xc5/0xd0
[ 104.938618][ T4698] ? __pfx_panic+0x10/0x10
[ 104.940444][ T4698] ? preempt_schedule_thunk+0x16/0x40
[ 104.942669][ T4698] ? string+0x216/0x2d0
[ 104.944349][ T4698] check_panic_on_warn+0x89/0xb0
[ 104.946373][ T4698] ? string+0x216/0x2d0
[ 104.948103][ T4698] end_report+0x73/0x170
[ 104.949859][ T4698] ? string+0x216/0x2d0
[ 104.951574][ T4698] kasan_report+0x128/0x150
[ 104.953472][ T4698] ? string+0x216/0x2d0
[ 104.955212][ T4698] string+0x216/0x2d0
[ 104.956887][ T4698] vsnprintf+0x74a/0xef0
[ 104.958661][ T4698] add_uevent_var+0x1ce/0x460
[ 104.960567][ T4698] ? __pfx___mutex_lock+0x10/0x10
[ 104.962670][ T4698] ? __pfx_add_uevent_var+0x10/0x10
[ 104.964771][ T4698] rc_dev_uevent+0x164/0x1a0
[ 104.966715][ T4698] dev_uevent+0x537/0x870
[ 104.968541][ T4698] ? __pfx_dev_uevent+0x10/0x10
[ 104.970615][ T4698] ? __kmalloc_cache_noprof+0x32d/0x660
[ 104.972886][ T4698] ? __kmalloc_cache_noprof+0x150/0x660
[ 104.975202][ T4698] ? uevent_show+0x15c/0x310
[ 104.977134][ T4698] uevent_show+0x1a0/0x310
[ 104.979002][ T4698] dev_attr_show+0x58/0xc0
[ 104.980863][ T4698] ? __pfx_dev_attr_show+0x10/0x10
[ 104.982958][ T4698] sysfs_kf_seq_show+0x331/0x490
[ 104.984997][ T4698] seq_read_iter+0x463/0xca0
[ 104.986927][ T4698] vfs_read+0x595/0xa80
[ 104.988637][ T4698] ? __pfx_vfs_read+0x10/0x10
[ 104.990520][ T4698] ? do_sys_openat2+0x14e/0x200
[ 104.992540][ T4698] ksys_read+0x150/0x270
[ 104.994325][ T4698] ? __pfx_ksys_read+0x10/0x10
[ 104.996299][ T4698] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 104.998812][ T4698] do_syscall_64+0x174/0x580
[ 105.000761][ T4698] ? trace_irq_disable+0x3b/0x140
[ 105.002822][ T4698] ? clear_bhb_loop+0x40/0x90
[ 105.004710][ T4698] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 105.007162][ T4698] RIP: 0033:0x7fcc8e4a7407
[ 105.009017][ T4698] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[ 105.016703][ T4698] RSP: 002b:00007ffc48ecd1b0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[ 105.020171][ T4698] RAX: ffffffffffffffda RBX: 00007fcc8ec0c880 RCX: 00007fcc8e4a7407
[ 105.023343][ T4698] RDX: 0000000000001000 RSI: 0000560be5654390 RDI: 000000000000000c
[ 105.026560][ T4698] RBP: 00007fcc8e5efff0 R08: 0000000000000000 R09: 0000000000000000
[ 105.029822][ T4698] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
[ 105.032990][ T4698] R13: 00007fcc8e5efea0 R14: 0000000000000000 R15: 0000560be5656560
[ 105.036193][ T4698]
[ 105.037880][ T4698] Kernel Offset: disabled
[ 105.039674][ T4698] Rebooting in 86400 seconds..