hid-picolcd 0003:04D8:C002.0034: offset (1) exceeds report_count (1) ================================================================== BUG: KASAN: slab-out-of-bounds in hid_dump_input+0xcb/0xd0 drivers/hid/hid-debug.c:3132 Read of size 4 at addr ffff8880534d3ec0 by task kworker/0:5/23752 CPU: 0 UID: 0 PID: 23752 Comm: kworker/0:5 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: events fb_deferred_io_work Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description+0x55/0x1e0 mm/kasan/report.c:378 print_report+0x58/0x70 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 hid_dump_input+0xcb/0xd0 drivers/hid/hid-debug.c:3132 hid_set_field+0xd3/0x440 drivers/hid/hid-core.c:1936 picolcd_fb_send_tile drivers/hid/hid-picolcd_fb.c:112 [inline] picolcd_fb_update drivers/hid/hid-picolcd_fb.c:268 [inline] picolcd_fb_deferred_io+0x6d5/0x1880 drivers/hid/hid-picolcd_fb.c:403 fb_deferred_io_work+0x1cf/0x310 drivers/video/fbdev/core/fb_defio.c:405 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 19314: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5334 [inline] __kvmalloc_node_noprof+0x53f/0x860 mm/slub.c:6905 hid_register_field drivers/hid/hid-core.c:133 [inline] hid_add_field+0x70a/0x1840 drivers/hid/hid-core.c:340 hid_parser_main+0x2e1/0xd50 drivers/hid/hid-core.c:-1 hid_parse_collections drivers/hid/hid-core.c:1291 [inline] hid_open_report+0x884/0xf00 drivers/hid/hid-core.c:1384 hid_parse include/linux/hid.h:1206 [inline] picolcd_probe+0x177/0x16c0 drivers/hid/hid-picolcd_core.c:547 __hid_device_probe drivers/hid/hid-core.c:2829 [inline] hid_device_probe+0x42c/0x7c0 drivers/hid/hid-core.c:2866 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3772 hid_add_device+0x272/0x3e0 drivers/hid/hid-core.c:3010 usbhid_probe+0x9d4/0xde0 drivers/hid/usbhid/hid-core.c:1452 usb_probe_interface+0x653/0xc60 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3772 usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:291 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3772 usb_new_device+0x99d/0x1620 drivers/usb/core/hub.c:2695 hub_port_connect drivers/usb/core/hub.c:5567 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5953 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the object at ffff8880534d3e00 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 16 bytes to the right of allocated 176-byte region [ffff8880534d3e00, ffff8880534d3eb0) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x534d3 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000000 ffff88813fe3e3c0 dead000000000100 dead000000000122 raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 14629, tgid 14628 (syz.1.2227), ts 832520770587, free_ts 811604935802 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304 alloc_slab_page mm/slub.c:3266 [inline] allocate_slab+0x79/0x5e0 mm/slub.c:3380 new_slab mm/slub.c:3426 [inline] refill_objects+0x2d5/0x350 mm/slub.c:7310 refill_sheaf mm/slub.c:2804 [inline] __pcs_replace_empty_main+0x2bf/0x6b0 mm/slub.c:4675 alloc_from_pcs mm/slub.c:4773 [inline] slab_alloc_node mm/slub.c:4905 [inline] __do_kmalloc_node mm/slub.c:5333 [inline] __kmalloc_noprof+0x485/0x720 mm/slub.c:5359 _kmalloc_noprof include/linux/slab.h:992 [inline] _kzalloc_noprof include/linux/slab.h:1309 [inline] hash_netportnet6_resize+0xd4b/0x2020 net/netfilter/ipset/ip_set_hash_gen.h:739 call_ad+0x439/0xb50 net/netfilter/ipset/ip_set_core.c:1764 ip_set_ad+0x824/0x9d0 net/netfilter/ipset/ip_set_core.c:1848 nfnetlink_rcv_msg+0xcc2/0x12b0 net/netfilter/nfnetlink.c:300 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 nfnetlink_rcv+0x2b9/0x28c0 net/netfilter/nfnetlink.c:667 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7bb/0x940 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:775 page last free pid 42 tgid 42 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0xc1e/0xd10 mm/page_alloc.c:2950 kasan_depopulate_vmalloc_pte+0x6d/0x90 mm/kasan/shadow.c:484 apply_to_pte_range mm/memory.c:3338 [inline] apply_to_pmd_range mm/memory.c:3382 [inline] apply_to_pud_range mm/memory.c:3418 [inline] apply_to_p4d_range mm/memory.c:3454 [inline] __apply_to_page_range+0xbd8/0x1420 mm/memory.c:3490 __kasan_release_vmalloc+0xa2/0xd0 mm/kasan/shadow.c:602 kasan_release_vmalloc include/linux/kasan.h:593 [inline] kasan_release_vmalloc_node mm/vmalloc.c:2284 [inline] purge_vmap_node+0x220/0x960 mm/vmalloc.c:2306 __purge_vmap_area_lazy+0x783/0xb40 mm/vmalloc.c:2396 drain_vmap_area_work+0x27/0x40 mm/vmalloc.c:2430 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Memory state around the buggy address: ffff8880534d3d80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff8880534d3e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8880534d3e80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc ^ ffff8880534d3f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880534d3f80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc ==================================================================