==================================================================
BUG: KASAN: use-after-free in find_endpoint+0x2a3/0x2c0 drivers/usb/gadget/udc/dummy_hcd.c:1618
Read of size 1 at addr ffff88805dcb14e8 by task swapper/2/0

CPU: 2 UID: 0 PID: 0 Comm: swapper/2 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
 find_endpoint+0x2a3/0x2c0 drivers/usb/gadget/udc/dummy_hcd.c:1618
 dummy_timer+0x500/0x3700 drivers/usb/gadget/udc/dummy_hcd.c:1890
 __run_hrtimer kernel/time/hrtimer.c:2067 [inline]
 __hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2124
 hrtimer_run_softirq+0x1ca/0x360 kernel/time/hrtimer.c:2141
 handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0x194/0x210 kernel/softirq.c:767
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:784
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64
Code: 08 aa 02 e9 03 4d 03 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d 23 01 2e 00 fb f4 <c3> cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90
RSP: 0000:ffffc9000047fe00 EFLAGS: 00000206
RAX: 00000000000a14bd RBX: ffff88801cbf4b00 RCX: ffffffff8bbda115
RDX: 0000000000000001 RSI: ffffffff8e3b3f5f RDI: ffffffff8c603680
RBP: ffffed100397e960 R08: 0000000000000001 R09: ffffed100568678d
R10: ffff88802b433c6b R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: 1ffff9200008ffc4 R15: dffffc0000000000
 arch_safe_halt arch/x86/include/asm/paravirt.h:62 [inline]
 default_idle+0x9/0x10 arch/x86/kernel/process.c:768
 default_idle_call+0x6c/0xb0 kernel/sched/idle.c:122
 cpuidle_idle_call kernel/sched/idle.c:199 [inline]
 do_idle+0x3ae/0x5b0 kernel/sched/idle.c:355
 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:454
 start_secondary+0x21d/0x2d0 arch/x86/kernel/smpboot.c:312
 common_startup_64+0x13e/0x158
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffffffffffffffff pfn:0x5dcb1
flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
raw: 04fff00000000000 0000000000000000 00000000ffffffff 0000000000000000
raw: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6107, tgid 6106 (syz.2.61), ts 61808468768, free_ts 63878836459
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859
 prep_new_page mm/page_alloc.c:1867 [inline]
 get_page_from_freelist+0xf46/0x3500 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304
 alloc_slab_page mm/slub.c:3266 [inline]
 allocate_slab mm/slub.c:3380 [inline]
 new_slab+0xa2/0x660 mm/slub.c:3426
 refill_objects+0xe3/0x410 mm/slub.c:7310
 refill_sheaf mm/slub.c:2804 [inline]
 __pcs_replace_empty_main+0x372/0x680 mm/slub.c:4675
 alloc_from_pcs mm/slub.c:4773 [inline]
 slab_alloc_node mm/slub.c:4905 [inline]
 __do_kmalloc_node mm/slub.c:5333 [inline]
 __kmalloc_noprof+0x66b/0x820 mm/slub.c:5359
 _kmalloc_noprof include/linux/slab.h:992 [inline]
 _kzalloc_noprof include/linux/slab.h:1309 [inline]
 fuse_folios_alloc fs/fuse/fuse_i.h:876 [inline]
 fuse_io_alloc+0x92/0x150 fs/fuse/file.c:725
 fuse_direct_io+0x18ff/0x2560 fs/fuse/file.c:1741
 fuse_direct_IO+0xc57/0xfd0 fs/fuse/file.c:2784
 generic_file_direct_write+0x198/0x410 mm/filemap.c:4298
 fuse_cache_write_iter fs/fuse/file.c:1517 [inline]
 fuse_file_write_iter+0x773/0x960 fs/fuse/file.c:1862
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x6af/0x1050 fs/read_write.c:687
 ksys_write+0x1f8/0x250 fs/read_write.c:739
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline]
 __do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291
 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316
page last free pid 6115 tgid 6113 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1406 [inline]
 __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
 __kasan_kmalloc+0x8a/0xb0 mm/kasan/common.c:406
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x2e7/0x6b0 mm/slub.c:5489
 _kmalloc_noprof include/linux/slab.h:988 [inline]
 usb_control_msg+0xbc/0x4b0 drivers/usb/core/message.c:157
 get_port_status drivers/usb/core/hub.c:607 [inline]
 hub_ext_port_status+0x152/0x600 drivers/usb/core/hub.c:624
 usb_hub_port_status drivers/usb/core/hub.c:674 [inline]
 wait_for_connected drivers/usb/core/hub.c:3761 [inline]
 usb_port_resume+0xbfc/0x1940 drivers/usb/core/hub.c:3867
 usb_generic_driver_resume+0x41/0xa0 drivers/usb/core/generic.c:317
 usb_resume_device drivers/usb/core/driver.c:1304 [inline]
 usb_resume_both+0x3e0/0x7f0 drivers/usb/core/driver.c:1555
 __rpm_callback+0xc8/0x620 drivers/base/power/runtime.c:406
 rpm_callback+0x11f/0x150 drivers/base/power/runtime.c:460
 rpm_resume+0xd13/0x1320 drivers/base/power/runtime.c:939
 rpm_resume+0x721/0x1320 drivers/base/power/runtime.c:917
 __pm_runtime_resume+0xb6/0x170 drivers/base/power/runtime.c:1197
 pm_runtime_get_active include/linux/pm_runtime.h:520 [inline]
 pm_runtime_resume_and_get include/linux/pm_runtime.h:539 [inline]
 usb_autopm_get_interface+0x20/0xe0 drivers/usb/core/driver.c:1867

Memory state around the buggy address:
 ffff88805dcb1380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88805dcb1400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88805dcb1480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                          ^
 ffff88805dcb1500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88805dcb1580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
----------------
Code disassembly (best guess):
   0:	08 aa 02 e9 03 4d    	or     %ch,0x4d03e902(%rdx)
   6:	03 00                	add    (%rax),%eax
   8:	0f 1f 00             	nopl   (%rax)
   b:	90                   	nop
   c:	90                   	nop
   d:	90                   	nop
   e:	90                   	nop
   f:	90                   	nop
  10:	90                   	nop
  11:	90                   	nop
  12:	90                   	nop
  13:	90                   	nop
  14:	90                   	nop
  15:	90                   	nop
  16:	90                   	nop
  17:	90                   	nop
  18:	90                   	nop
  19:	90                   	nop
  1a:	90                   	nop
  1b:	f3 0f 1e fa          	endbr64
  1f:	eb 07                	jmp    0x28
  21:	0f 00 2d 23 01 2e 00 	verw   0x2e0123(%rip)        # 0x2e014b
  28:	fb                   	sti
  29:	f4                   	hlt
* 2a:	c3                   	ret <-- trapping instruction
  2b:	cc                   	int3
  2c:	cc                   	int3
  2d:	cc                   	int3
  2e:	cc                   	int3
  2f:	66 2e 0f 1f 84 00 00 	cs nopw 0x0(%rax,%rax,1)
  36:	00 00 00
  39:	66 90                	xchg   %ax,%ax
  3b:	90                   	nop
  3c:	90                   	nop
  3d:	90                   	nop
  3e:	90                   	nop
  3f:	90                   	nop