xpad 1-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19
xpad 1-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19
==================================================================
BUG: KASAN: slab-use-after-free in debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline]
BUG: KASAN: slab-use-after-free in do_raw_spin_lock+0x28b/0x2f0 kernel/locking/spinlock_debug.c:115
Read of size 4 at addr ffff88806baa885c by task swapper/1/0
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xba/0x230 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline]
do_raw_spin_lock+0x28b/0x2f0 kernel/locking/spinlock_debug.c:115
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock_irqsave+0x4c/0x60 kernel/locking/spinlock.c:162
__wake_up_common_lock+0x2f/0x1f0 kernel/sched/wait.c:124
__usb_hcd_giveback_urb+0x3b0/0x540 drivers/usb/core/hcd.c:1660
dummy_timer+0xbbd/0x4650 drivers/usb/gadget/udc/dummy_hcd.c:2005
__run_hrtimer kernel/time/hrtimer.c:1785 [inline]
__hrtimer_run_queues+0x53a/0xcc0 kernel/time/hrtimer.c:1849
hrtimer_run_softirq+0x182/0x5a0 kernel/time/hrtimer.c:1866
handle_softirqs+0x22a/0x870 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:63
Code: 1e 6b 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d a3 22 19 00 fb f4 fc e9 02 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90
RSP: 0018:ffffc90000197e20 EFLAGS: 00000242
RAX: 000000000070e9cd RBX: ffffffff819aac7a RCX: 0000000080000001
RDX: 0000000000000001 RSI: ffffffff8defcc34 RDI: ffffffff8c27d880
RBP: ffffc90000197f10 R08: ffff8880b873399b R09: 1ffff110170e6733
R10: dffffc0000000000 R11: ffffed10170e6734 R12: 0000000000000001
R13: 1ffff11003b58000 R14: 0000000000000001 R15: 1ffff11003b58000
arch_safe_halt arch/x86/kernel/process.c:766 [inline]
default_idle+0x9/0x20 arch/x86/kernel/process.c:767
default_idle_call+0x72/0xb0 kernel/sched/idle.c:122
cpuidle_idle_call kernel/sched/idle.c:199 [inline]
do_idle+0x36a/0x5f0 kernel/sched/idle.c:352
cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:451
start_secondary+0x101/0x110 arch/x86/kernel/smpboot.c:312
common_startup_64+0x13e/0x147
Allocated by task 5914:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__kmalloc_cache_noprof+0x31c/0x660 mm/slub.c:5380
kmalloc_noprof include/linux/slab.h:950 [inline]
kzalloc_noprof include/linux/slab.h:1188 [inline]
xpad_probe+0x428/0x1fc0 drivers/input/joystick/xpad.c:2085
usb_probe_interface+0x668/0xc90 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:721
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:863
driver_probe_device+0x4f/0x240 drivers/base/dd.c:893
__device_attach_driver+0x279/0x430 drivers/base/dd.c:1021
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1093
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1148
bus_probe_device+0x12a/0x220 drivers/base/bus.c:613
device_add+0x7b6/0xb70 drivers/base/core.c:3690
usb_set_configuration+0x1a87/0x2110 drivers/usb/core/message.c:2266
usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
usb_probe_device+0x1c4/0x3b0 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:721
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:863
driver_probe_device+0x4f/0x240 drivers/base/dd.c:893
__device_attach_driver+0x279/0x430 drivers/base/dd.c:1021
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1093
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1148
bus_probe_device+0x12a/0x220 drivers/base/bus.c:613
device_add+0x7b6/0xb70 drivers/base/core.c:3690
usb_new_device+0xa08/0x16f0 drivers/usb/core/hub.c:2695
hub_port_connect drivers/usb/core/hub.c:5567 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x2a1c/0x4f30 drivers/usb/core/hub.c:5953
process_one_work kernel/workqueue.c:3288 [inline]
process_scheduled_works+0xb6e/0x18c0 kernel/workqueue.c:3371
worker_thread+0xa53/0xfc0 kernel/workqueue.c:3452
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Freed by task 980:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2685 [inline]
slab_free mm/slub.c:6165 [inline]
kfree+0x1c1/0x630 mm/slub.c:6483
xpad_disconnect+0x350/0x480 drivers/input/joystick/xpad.c:2269
usb_unbind_interface+0x26e/0x910 drivers/usb/core/driver.c:458
device_remove drivers/base/dd.c:633 [inline]
__device_release_driver drivers/base/dd.c:1344 [inline]
device_release_driver_internal+0x4d9/0x870 drivers/base/dd.c:1367
bus_remove_device+0x455/0x570 drivers/base/bus.c:657
device_del+0x527/0x8f0 drivers/base/core.c:3879
usb_disable_device+0x3d4/0x8d0 drivers/usb/core/message.c:1476
usb_disconnect+0x32f/0x990 drivers/usb/core/hub.c:2345
hub_port_connect drivers/usb/core/hub.c:5407 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x1cc9/0x4f30 drivers/usb/core/hub.c:5953
process_one_work kernel/workqueue.c:3288 [inline]
process_scheduled_works+0xb6e/0x18c0 kernel/workqueue.c:3371
worker_thread+0xa53/0xfc0 kernel/workqueue.c:3452
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
The buggy address belongs to the object at ffff88806baa8800
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 92 bytes inside of
freed 1024-byte region [ffff88806baa8800, ffff88806baa8c00)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806baad000 pfn:0x6baa8
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000240 ffff88813fea7dc0 ffffea00007dbe10 ffffea000097be10
raw: ffff88806baad000 000000080010000d 00000000f5000000 0000000000000000
head: 00fff00000000240 ffff88813fea7dc0 ffffea00007dbe10 ffffea000097be10
head: ffff88806baad000 000000080010000d 00000000f5000000 0000000000000000
head: 00fff00000000003 ffffea0001aeaa01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5847, tgid 5847 (syz-executor), ts 86290423441, free_ts 78083357419
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x231/0x280 mm/page_alloc.c:1889
prep_new_page mm/page_alloc.c:1897 [inline]
get_page_from_freelist+0x24dc/0x2580 mm/page_alloc.c:3962
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5250
alloc_slab_page mm/slub.c:3292 [inline]
allocate_slab+0x77/0x660 mm/slub.c:3481
new_slab mm/slub.c:3539 [inline]
refill_objects+0x331/0x3c0 mm/slub.c:7175
refill_sheaf mm/slub.c:2812 [inline]
__pcs_replace_empty_main+0x2e6/0x730 mm/slub.c:4615
alloc_from_pcs mm/slub.c:4717 [inline]
slab_alloc_node mm/slub.c:4851 [inline]
__do_kmalloc_node mm/slub.c:5259 [inline]
__kmalloc_noprof+0x474/0x760 mm/slub.c:5272
kmalloc_noprof include/linux/slab.h:954 [inline]
kzalloc_noprof include/linux/slab.h:1188 [inline]
ip6t_alloc_initial_table+0x6b/0x6d0 net/ipv6/netfilter/ip6_tables.c:40
ip6table_security_table_init+0x1b/0x70 net/ipv6/netfilter/ip6table_security.c:42
xt_find_table_lock+0x30c/0x3e0 net/netfilter/x_tables.c:1283
xt_request_find_table_lock+0x26/0x100 net/netfilter/x_tables.c:1308
get_info net/ipv6/netfilter/ip6_tables.c:979 [inline]
do_ip6t_get_ctl+0x716/0x1230 net/ipv6/netfilter/ip6_tables.c:1668
nf_getsockopt+0x26e/0x290 net/netfilter/nf_sockopt.c:116
ipv6_getsockopt+0x1fd/0x2b0 net/ipv6/ipv6_sockglue.c:1473
do_sock_getsockopt+0x2d3/0x3f0 net/socket.c:2448
__sys_getsockopt net/socket.c:2477 [inline]
__do_sys_getsockopt net/socket.c:2484 [inline]
__se_sys_getsockopt net/socket.c:2481 [inline]
__x64_sys_getsockopt+0x1a4/0x240 net/socket.c:2481
page last free pid 5810 tgid 5810 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1433 [inline]
free_unref_folios+0xed5/0x16d0 mm/page_alloc.c:3040
folios_put_refs+0x789/0x8d0 mm/swap.c:1002
free_pages_and_swap_cache+0x2e7/0x5b0 mm/swap_state.c:423
__tlb_batch_free_encoded_pages mm/mmu_gather.c:138 [inline]
tlb_batch_pages_flush mm/mmu_gather.c:151 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:398 [inline]
tlb_flush_mmu+0x6d3/0xa30 mm/mmu_gather.c:405
tlb_finish_mmu+0xf9/0x230 mm/mmu_gather.c:530
unmap_region+0x2a5/0x330 mm/vma.c:488
vms_clear_ptes mm/vma.c:1284 [inline]
vms_complete_munmap_vmas+0x493/0xc60 mm/vma.c:1326
do_vmi_align_munmap+0x3b7/0x4b0 mm/vma.c:1585
do_vmi_munmap+0x252/0x2d0 mm/vma.c:1633
__vm_munmap+0x22c/0x3d0 mm/vma.c:3261
__do_sys_munmap mm/mmap.c:1078 [inline]
__se_sys_munmap mm/mmap.c:1075 [inline]
__x64_sys_munmap+0x60/0x70 mm/mmap.c:1075
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff88806baa8700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88806baa8780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88806baa8800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88806baa8880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88806baa8900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 6b 02 c3 imul $0xffffffc3,(%rdx),%eax
3: cc int3
4: cc int3
5: cc int3
6: cc int3
7: cc int3
8: cc int3
9: cc int3
a: 90 nop
b: 90 nop
c: 90 nop
d: 90 nop
e: 90 nop
f: 90 nop
10: 90 nop
11: 90 nop
12: 90 nop
13: 90 nop
14: 90 nop
15: 90 nop
16: 90 nop
17: 90 nop
18: 90 nop
19: 90 nop
1a: f3 0f 1e fa endbr64
1e: 66 90 xchg %ax,%ax
20: 0f 00 2d a3 22 19 00 verw 0x1922a3(%rip) # 0x1922ca
27: fb sti
28: f4 hlt
* 29: e9 fc e9 02 00 jmp 0x2ea2a <-- trapping instruction
2e: cc int3
2f: cc int3
30: cc int3
31: cc int3
32: cc int3
33: cc int3
34: cc int3
35: cc int3
36: cc int3
37: cc int3
38: cc int3
39: cc int3
3a: 90 nop
3b: 90 nop
3c: 90 nop
3d: 90 nop
3e: 90 nop