==================================================================
BUG: KASAN: use-after-free in mcp2221_raw_event+0x1070/0x10a0 drivers/hid/hid-mcp2221.c:948
Read of size 1 at addr ffff888152883fff by task kworker/1:7/26682

CPU: 1 UID: 0 PID: 26682 Comm: kworker/1:7 Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: events legacy_dvb_usb_read_remote_control
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xcd/0x630 mm/kasan/report.c:482
 kasan_report+0xe0/0x110 mm/kasan/report.c:595
 mcp2221_raw_event+0x1070/0x10a0 drivers/hid/hid-mcp2221.c:948
 __hid_input_report.constprop.0+0x314/0x470 drivers/hid/hid-core.c:2139
 hid_irq_in+0x35e/0x870 drivers/hid/usbhid/hid-core.c:286
 __usb_hcd_giveback_urb+0x38b/0x610 drivers/usb/core/hcd.c:1661
 usb_hcd_giveback_urb+0x39b/0x450 drivers/usb/core/hcd.c:1745
 dummy_timer+0x1809/0x3ad0 drivers/usb/gadget/udc/dummy_hcd.c:1995
 __run_hrtimer kernel/time/hrtimer.c:1777 [inline]
 __hrtimer_run_queues+0x202/0xc40 kernel/time/hrtimer.c:1841
 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1858
 handle_softirqs+0x208/0x940 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xfa/0x160 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1056
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:console_flush_one_record+0x995/0xc60 kernel/printk/printk.c:3216
Code: 00 e8 8f 65 29 00 9c 5d 81 e5 00 02 00 00 31 ff 48 89 ee e8 8d 49 21 00 48 85 ed 0f 85 8e 01 00 00 e8 af 4e 21 00 fb 4c 89 e8 <48> c1 e8 03 42 80 3c 38 00 0f 84 b4 fe ff ff 4c 89 ef e8 74 1b 83
RSP: 0018:ffffc900075377d8 EFLAGS: 00000293
RAX: ffffffff89816558 RBX: 0000000000000001 RCX: ffffffff815e9df3
RDX: ffff888115f4ba80 RSI: ffffffff815e9e01 RDI: 0000000000000007
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: ffff888115f4c528 R12: 0000000000000001
R13: ffffffff89816558 R14: ffffffff89816500 R15: dffffc0000000000
 console_flush_all kernel/printk/printk.c:3289 [inline]
 __console_flush_and_unlock kernel/printk/printk.c:3319 [inline]
 console_unlock+0xef/0x240 kernel/printk/printk.c:3359
 vprintk_emit+0x407/0x6b0 kernel/printk/printk.c:2426
 _printk+0xc7/0x100 kernel/printk/printk.c:2451
 legacy_dvb_usb_read_remote_control+0x40b/0x4f0 drivers/media/usb/dvb-usb/dvb-usb-remote.c:124
 process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257
 process_scheduled_works kernel/workqueue.c:3340 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x74f/0xa30 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x152883
flags: 0x200000000000000(node=0|zone=2)
page_type: f0(buddy)
raw: 0200000000000000 ffffea000541e448 ffffea00043ec448 0000000000000000
raw: 0000000000000000 0000000000000000 00000000f0000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xcc0(GFP_KERNEL), pid 38, tgid 38 (kworker/1:1), ts 3455756236384, free_ts 3567288961807
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1af/0x220 mm/page_alloc.c:1846
 prep_new_page mm/page_alloc.c:1854 [inline]
 get_page_from_freelist+0x1058/0x3cb0 mm/page_alloc.c:3915
 __alloc_frozen_pages_noprof+0x259/0x21c0 mm/page_alloc.c:5210
 __alloc_pages_noprof mm/page_alloc.c:5244 [inline]
 alloc_pages_bulk_noprof+0x6f5/0x1160 mm/page_alloc.c:5164
 ___alloc_pages_bulk mm/kasan/shadow.c:345 [inline]
 __kasan_populate_vmalloc_do mm/kasan/shadow.c:370 [inline]
 __kasan_populate_vmalloc+0xfb/0x220 mm/kasan/shadow.c:424
 kasan_populate_vmalloc include/linux/kasan.h:579 [inline]
 alloc_vmap_area+0x98d/0x2a50 mm/vmalloc.c:2124
 __get_vm_area_node+0x1ca/0x330 mm/vmalloc.c:3219
 __vmalloc_node_range_noprof+0x247/0x16b0 mm/vmalloc.c:4011
 __vmalloc_node_noprof+0xad/0xf0 mm/vmalloc.c:4111
 __vmalloc_noprof+0xa3/0x120 mm/vmalloc.c:4127
 __vmalloc_array_noprof mm/util.c:633 [inline]
 vmalloc_array_noprof+0x43/0x70 mm/util.c:644
 dvb_dmx_init+0x134/0xb40 drivers/media/dvb-core/dvb_demux.c:1253
 dvb_usb_adapter_dvb_init+0x54d/0x9f0 drivers/media/usb/dvb-usb/dvb-usb-dvb.c:184
 dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:86 [inline]
 dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:186 [inline]
 dvb_usb_device_init+0x159f/0x2060 drivers/media/usb/dvb-usb/dvb-usb-init.c:310
 gp8psk_usb_probe+0x51/0xe0 drivers/media/usb/dvb-usb/gp8psk.c:304
 usb_probe_interface+0x303/0xa80 drivers/usb/core/driver.c:396
page last free pid 26837 tgid 26837 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1395 [inline]
 __free_frozen_pages+0x795/0x1010 mm/page_alloc.c:2943
 kasan_depopulate_vmalloc_pte+0x5b/0x80 mm/kasan/shadow.c:484
 apply_to_pte_range mm/memory.c:3182 [inline]
 apply_to_pmd_range mm/memory.c:3226 [inline]
 apply_to_pud_range mm/memory.c:3262 [inline]
 apply_to_p4d_range mm/memory.c:3298 [inline]
 __apply_to_page_range+0xac1/0x13f0 mm/memory.c:3334
 __kasan_release_vmalloc+0xd1/0xe0 mm/kasan/shadow.c:602
 kasan_release_vmalloc include/linux/kasan.h:592 [inline]
 kasan_release_vmalloc_node mm/vmalloc.c:2282 [inline]
 purge_vmap_node+0x1ba/0xad0 mm/vmalloc.c:2299
 __purge_vmap_area_lazy+0x9d2/0xc00 mm/vmalloc.c:2389
 drain_vmap_area_work+0x27/0x40 mm/vmalloc.c:2423
 process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257
 process_scheduled_works kernel/workqueue.c:3340 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x74f/0xa30 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

Memory state around the buggy address:
 ffff888152883e80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888152883f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888152883f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                                ^
 ffff888152884000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888152884080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	e8 8f 65 29 00       	call   0x296594
   5:	9c                   	pushf
   6:	5d                   	pop    %rbp
   7:	81 e5 00 02 00 00    	and    $0x200,%ebp
   d:	31 ff                	xor    %edi,%edi
   f:	48 89 ee             	mov    %rbp,%rsi
  12:	e8 8d 49 21 00       	call   0x2149a4
  17:	48 85 ed             	test   %rbp,%rbp
  1a:	0f 85 8e 01 00 00    	jne    0x1ae
  20:	e8 af 4e 21 00       	call   0x214ed4
  25:	fb                   	sti
  26:	4c 89 e8             	mov    %r13,%rax
* 29:	48 c1 e8 03          	shr    $0x3,%rax <-- trapping instruction
  2d:	42 80 3c 38 00       	cmpb   $0x0,(%rax,%r15,1)
  32:	0f 84 b4 fe ff ff    	je     0xfffffeec
  38:	4c 89 ef             	mov    %r13,%rdi
  3b:	e8                   	.byte 0xe8
  3c:	74 1b                	je     0x59
  3e:	83                   	.byte 0x83