==================================================================
BUG: KASAN: use-after-free in mcp2221_raw_event+0x1070/0x10a0 drivers/hid/hid-mcp2221.c:948
Read of size 1 at addr ffff88810cfd3fff by task udevd/2857

CPU: 0 UID: 0 PID: 2857 Comm: udevd Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xcd/0x630 mm/kasan/report.c:482
 kasan_report+0xe0/0x110 mm/kasan/report.c:595
 mcp2221_raw_event+0x1070/0x10a0 drivers/hid/hid-mcp2221.c:948
 __hid_input_report.constprop.0+0x314/0x470 drivers/hid/hid-core.c:2139
 hid_irq_in+0x35e/0x870 drivers/hid/usbhid/hid-core.c:286
 __usb_hcd_giveback_urb+0x38b/0x610 drivers/usb/core/hcd.c:1661
 usb_hcd_giveback_urb+0x39b/0x450 drivers/usb/core/hcd.c:1745
 dummy_timer+0x1809/0x3ad0 drivers/usb/gadget/udc/dummy_hcd.c:1995
 __run_hrtimer kernel/time/hrtimer.c:1777 [inline]
 __hrtimer_run_queues+0x202/0xc40 kernel/time/hrtimer.c:1841
 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1858
 handle_softirqs+0x208/0x940 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xfa/0x160 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1056
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:orc_ip arch/x86/kernel/unwind_orc.c:80 [inline]
RIP: 0010:__orc_find+0x70/0xf0 arch/x86/kernel/unwind_orc.c:102
Code: ec 72 4e 4c 89 e2 48 29 ea 48 89 d6 48 c1 ea 3f 48 c1 fe 02 48 01 f2 48 d1 fa 48 8d 5c 95 00 48 89 da 48 c1 ea 03 0f b6 34 0a <48> 89 da 83 e2 07 83 c2 03 40 38 f2 7c 05 40 84 f6 75 4b 48 63 13
RSP: 0018:ffffc900015cf748 EFLAGS: 00000a07
RAX: ffffffff8b11ad10 RBX: ffffffff8ab95784 RCX: dffffc0000000000
RDX: 1ffffffff1572af0 RSI: 0000000000000000 RDI: ffffffff8ab95784
RBP: ffffffff8ab95784 R08: ffffffff8b11ad16 R09: 0000000084016bb0
R10: 0000000000000002 R11: 000000000000f566 R12: ffffffff8ab95784
R13: ffffffff81f5661f R14: ffffffff8ab95784 R15: ffffffff8ab95784
 orc_find arch/x86/kernel/unwind_orc.c:227 [inline]
 unwind_next_frame+0x2ec/0x20a0 arch/x86/kernel/unwind_orc.c:494
 arch_stack_walk+0x94/0x100 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:56
 kasan_save_track+0x14/0x30 mm/kasan/common.c:77
 poison_kmalloc_redzone mm/kasan/common.c:397 [inline]
 __kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:414
 kasan_kmalloc include/linux/kasan.h:262 [inline]
 __do_kmalloc_node mm/slub.c:5652 [inline]
 __kvmalloc_node_noprof+0x3b0/0xa00 mm/slub.c:7129
 seq_buf_alloc fs/seq_file.c:38 [inline]
 seq_read_iter+0x830/0x12d0 fs/seq_file.c:210
 kernfs_fop_read_iter+0x46c/0x610 fs/kernfs/file.c:297
 new_sync_read fs/read_write.c:491 [inline]
 vfs_read+0x8bf/0xcf0 fs/read_write.c:572
 ksys_read+0x12a/0x250 fs/read_write.c:715
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x570 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f76bac42407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffc24c67030 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f76bab54880 RCX: 00007f76bac42407
RDX: 0000000000001000 RSI: 000056049e1e4150 RDI: 000000000000000c
RBP: 00007f76bad8aff0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
R13: 00007f76bad8aea0 R14: 0000000000000000 R15: 000056049e1f61a0
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88810cfd3f50 pfn:0x10cfd3
flags: 0x200000000000000(node=0|zone=2)
page_type: f0(buddy)
raw: 0200000000000000 ffffea0004793748 ffffea000414f308 0000000000000000
raw: ffff88810cfd3f50 0000000000000000 00000000f0000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xcc0(GFP_KERNEL), pid 5214, tgid 5214 (udevd), ts 524444480385, free_ts 524444503388
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1af/0x220 mm/page_alloc.c:1846
 prep_new_page mm/page_alloc.c:1854 [inline]
 get_page_from_freelist+0x1058/0x3cb0 mm/page_alloc.c:3915
 __alloc_frozen_pages_noprof+0x259/0x21c0 mm/page_alloc.c:5210
 alloc_pages_mpol+0xe4/0x410 mm/mempolicy.c:2486
 alloc_frozen_pages_noprof mm/mempolicy.c:2557 [inline]
 alloc_pages_noprof+0x131/0x390 mm/mempolicy.c:2577
 get_free_pages_noprof+0x10/0xb0 mm/page_alloc.c:5269
 selinux_genfs_get_sid security/selinux/hooks.c:1334 [inline]
 inode_doinit_with_dentry+0x8d5/0x12e0 security/selinux/hooks.c:1557
 selinux_d_instantiate+0x26/0x30 security/selinux/hooks.c:6545
 security_d_instantiate+0x58/0xc0 security/security.c:3601
 d_splice_alias_ops+0x92/0x840 fs/dcache.c:3064
 kernfs_iop_lookup+0x23f/0x2d0 fs/kernfs/dir.c:1254
 lookup_open.isra.0+0x4e2/0x1750 fs/namei.c:4413
 open_last_lookups fs/namei.c:4540 [inline]
 path_openat+0x12bb/0x3140 fs/namei.c:4784
 do_filp_open+0x20b/0x470 fs/namei.c:4814
 do_sys_openat2+0x11f/0x250 fs/open.c:1430
 do_sys_open fs/open.c:1436 [inline]
 __do_sys_openat fs/open.c:1452 [inline]
 __se_sys_openat fs/open.c:1447 [inline]
 __x64_sys_openat+0x174/0x210 fs/open.c:1447
page last free pid 5214 tgid 5214 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1395 [inline]
 __free_frozen_pages+0x795/0x1010 mm/page_alloc.c:2943
 selinux_genfs_get_sid security/selinux/hooks.c:1359 [inline]
 inode_doinit_with_dentry+0xaca/0x12e0 security/selinux/hooks.c:1557
 selinux_d_instantiate+0x26/0x30 security/selinux/hooks.c:6545
 security_d_instantiate+0x58/0xc0 security/security.c:3601
 d_splice_alias_ops+0x92/0x840 fs/dcache.c:3064
 kernfs_iop_lookup+0x23f/0x2d0 fs/kernfs/dir.c:1254
 lookup_open.isra.0+0x4e2/0x1750 fs/namei.c:4413
 open_last_lookups fs/namei.c:4540 [inline]
 path_openat+0x12bb/0x3140 fs/namei.c:4784
 do_filp_open+0x20b/0x470 fs/namei.c:4814
 do_sys_openat2+0x11f/0x250 fs/open.c:1430
 do_sys_open fs/open.c:1436 [inline]
 __do_sys_openat fs/open.c:1452 [inline]
 __se_sys_openat fs/open.c:1447 [inline]
 __x64_sys_openat+0x174/0x210 fs/open.c:1447
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x570 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff88810cfd3e80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88810cfd3f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88810cfd3f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                                ^
 ffff88810cfd4000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88810cfd4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess):
   0:	ec                   	in     (%dx),%al
   1:	72 4e                	jb     0x51
   3:	4c 89 e2             	mov    %r12,%rdx
   6:	48 29 ea             	sub    %rbp,%rdx
   9:	48 89 d6             	mov    %rdx,%rsi
   c:	48 c1 ea 3f          	shr    $0x3f,%rdx
  10:	48 c1 fe 02          	sar    $0x2,%rsi
  14:	48 01 f2             	add    %rsi,%rdx
  17:	48 d1 fa             	sar    %rdx
  1a:	48 8d 5c 95 00       	lea    0x0(%rbp,%rdx,4),%rbx
  1f:	48 89 da             	mov    %rbx,%rdx
  22:	48 c1 ea 03          	shr    $0x3,%rdx
  26:	0f b6 34 0a          	movzbl (%rdx,%rcx,1),%esi
* 2a:	48 89 da             	mov    %rbx,%rdx <-- trapping instruction
  2d:	83 e2 07             	and    $0x7,%edx
  30:	83 c2 03             	add    $0x3,%edx
  33:	40 38 f2             	cmp    %sil,%dl
  36:	7c 05                	jl     0x3d
  38:	40 84 f6             	test   %sil,%sil
  3b:	75 4b                	jne    0x88
  3d:	48 63 13             	movslq (%rbx),%rdx