==================================================================
BUG: KASAN: slab-out-of-bounds in mcp2221_raw_event+0x101c/0x1090 drivers/hid/hid-mcp2221.c:964
Read of size 1 at addr ffff888106aaffff by task syz.2.2445/13816
CPU: 1 UID: 0 PID: 13816 Comm: syz.2.2445 Not tainted syzkaller #0 PREEMPT(lazy)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x13d/0x4b0 mm/kasan/report.c:482
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
mcp2221_raw_event+0x101c/0x1090 drivers/hid/hid-mcp2221.c:964
__hid_input_report.constprop.0+0x319/0x470 drivers/hid/hid-core.c:2168
hid_irq_in+0x55d/0x710 drivers/hid/usbhid/hid-core.c:287
__usb_hcd_giveback_urb+0x38d/0x610 drivers/usb/core/hcd.c:1657
usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
dummy_timer+0xdb2/0x36f0 drivers/usb/gadget/udc/dummy_hcd.c:2019
__run_hrtimer kernel/time/hrtimer.c:2032 [inline]
__hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2096
hrtimer_run_softirq+0x17d/0x2c0 kernel/time/hrtimer.c:2113
handle_softirqs+0x1dd/0x990 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x160/0x210 kernel/softirq.c:735
irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:179 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 kernel/locking/spinlock.c:198
Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 56 13 11 fa 48 89 df e8 de 62 11 fa f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 25 f0 03 fa 65 8b 05 6e a2 7f 05 85 c0 74 16 5b
RSP: 0018:ffffc90015f2fc18 EFLAGS: 00000246
RAX: 0000000000000006 RBX: ffffffff94200738 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff890f4061 RDI: ffffffff87b15700
RBP: 0000000000000202 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 1ffff92002be5f8a
R13: ffffc90015f2fd58 R14: 0000000000000000 R15: ffffffff94200738
__debug_object_init+0x2de/0x3d0 lib/debugobjects.c:810
debug_hrtimer_init_on_stack kernel/time/hrtimer.c:480 [inline]
debug_setup_on_stack kernel/time/hrtimer.c:522 [inline]
hrtimer_setup_sleeper_on_stack kernel/time/hrtimer.c:2366 [inline]
hrtimer_nanosleep+0xa0/0x350 kernel/time/hrtimer.c:2443
common_nsleep+0xa1/0xd0 kernel/time/posix-timers.c:1360
__do_sys_clock_nanosleep kernel/time/posix-timers.c:1406 [inline]
__se_sys_clock_nanosleep kernel/time/posix-timers.c:1383 [inline]
__x64_sys_clock_nanosleep+0x336/0x480 kernel/time/posix-timers.c:1383
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x10b/0x7f0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f589e21e90e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007f589ccb5f38 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6
RAX: ffffffffffffffda RBX: 00007f589ccb76c0 RCX: 00007f589e21e90e
RDX: 00007f589ccb5f90 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000140
R13: 0000000000000000 R14: 00007f589e4e5fa0 R15: 00007fff4a17e8a8
Allocated by task 13624:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
unpoison_slab_object mm/kasan/common.c:340 [inline]
__kasan_slab_alloc+0x6e/0x70 mm/kasan/common.c:366
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4584 [inline]
slab_alloc_node mm/slub.c:4917 [inline]
kmem_cache_alloc_noprof+0x2e2/0x640 mm/slub.c:4931
alloc_empty_file+0x5b/0x1c0 fs/file_table.c:262
path_openat+0xe7/0x4280 fs/namei.c:4849
do_file_open+0x20e/0x430 fs/namei.c:4892
do_sys_openat2+0x10f/0x1e0 fs/open.c:1368
do_sys_open fs/open.c:1374 [inline]
__do_sys_openat fs/open.c:1390 [inline]
__se_sys_openat fs/open.c:1385 [inline]
__x64_sys_openat+0x12d/0x210 fs/open.c:1385
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x10b/0x7f0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 13624:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x43/0x70 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2677 [inline]
slab_free_after_rcu_debug+0xa2/0x100 mm/slub.c:6439
rcu_do_batch kernel/rcu/tree.c:2645 [inline]
rcu_core+0x5a2/0x10d0 kernel/rcu/tree.c:2897
handle_softirqs+0x1dd/0x990 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x160/0x210 kernel/softirq.c:735
irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
Last potentially related work creation:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_record_aux_stack+0x8c/0xa0 mm/kasan/generic.c:556
slab_free_hook mm/slub.c:2638 [inline]
slab_free mm/slub.c:6377 [inline]
kmem_cache_free+0x408/0x650 mm/slub.c:6504
file_free fs/file_table.c:104 [inline]
__fput_deferred+0x3e9/0x4a0 fs/file_table.c:567
fput_close+0x118/0x250 fs/file_table.c:629
path_openat+0x1417/0x4280 fs/namei.c:4872
do_file_open+0x20e/0x430 fs/namei.c:4892
do_sys_openat2+0x10f/0x1e0 fs/open.c:1368
do_sys_open fs/open.c:1374 [inline]
__do_sys_openat fs/open.c:1390 [inline]
__se_sys_openat fs/open.c:1385 [inline]
__x64_sys_openat+0x12d/0x210 fs/open.c:1385
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x10b/0x7f0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff888106aafdc0
which belongs to the cache filp of size 352
The buggy address is located 223 bytes to the right of
allocated 352-byte region [ffff888106aafdc0, ffff888106aaff20)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106aae
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff88813471e501
flags: 0x200000000000040(head|node=0|zone=2)
page_type: f5(slab)
raw: 0200000000000040 ffff8881012ec640 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800120012 00000000f5000000 ffff88813471e501
head: 0200000000000040 ffff8881012ec640 dead000000000100 dead000000000122
head: 0000000000000000 0000000800120012 00000000f5000000 ffff88813471e501
head: 0200000000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3246, tgid 3246 (modprobe), ts 60208577032, free_ts 54936141750
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0xf25/0x3400 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x28f/0x2b90 mm/page_alloc.c:5304
alloc_slab_page mm/slub.c:3266 [inline]
allocate_slab mm/slub.c:3380 [inline]
new_slab+0xa2/0x670 mm/slub.c:3426
refill_objects+0xe3/0x410 mm/slub.c:7310
refill_sheaf mm/slub.c:2804 [inline]
__pcs_replace_empty_main+0x376/0x680 mm/slub.c:4675
alloc_from_pcs mm/slub.c:4773 [inline]
slab_alloc_node mm/slub.c:4905 [inline]
kmem_cache_alloc_noprof+0x4de/0x640 mm/slub.c:4931
alloc_empty_file+0x5b/0x1c0 fs/file_table.c:262
path_openat+0xe7/0x4280 fs/namei.c:4849
do_file_open+0x20e/0x430 fs/namei.c:4892
do_sys_openat2+0x10f/0x1e0 fs/open.c:1368
do_sys_open fs/open.c:1374 [inline]
__do_sys_openat fs/open.c:1390 [inline]
__se_sys_openat fs/open.c:1385 [inline]
__x64_sys_openat+0x12d/0x210 fs/open.c:1385
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x10b/0x7f0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 3027 tgid 3027 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0x716/0xf50 mm/page_alloc.c:2950
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x4e/0x70 mm/kasan/common.c:350
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4584 [inline]
slab_alloc_node mm/slub.c:4917 [inline]
kmem_cache_alloc_noprof+0x2e2/0x640 mm/slub.c:4931
vm_area_dup+0x25/0x6e0 mm/vma_init.c:123
__split_vma+0x18c/0xd70 mm/vma.c:516
vms_gather_munmap_vmas+0x3a5/0x1670 mm/vma.c:1448
__mmap_setup mm/vma.c:2439 [inline]
__mmap_region+0x4ae/0x2a70 mm/vma.c:2756
mmap_region+0x35d/0x620 mm/vma.c:2860
do_mmap+0xc53/0x12d0 mm/mmap.c:560
vm_mmap_pgoff+0x201/0x390 mm/util.c:581
ksys_mmap_pgoff+0x3cb/0x610 mm/mmap.c:606
__do_sys_mmap arch/x86/kernel/sys_x86_64.c:89 [inline]
__se_sys_mmap arch/x86/kernel/sys_x86_64.c:82 [inline]
__x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:82
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x10b/0x7f0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888106aafe80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888106aaff00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888106aaff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff888106ab0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888106ab0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess):
0: f5 cmc
1: 53 push %rbx
2: 48 8b 74 24 10 mov 0x10(%rsp),%rsi
7: 48 89 fb mov %rdi,%rbx
a: 48 83 c7 18 add $0x18,%rdi
e: e8 56 13 11 fa call 0xfa111369
13: 48 89 df mov %rbx,%rdi
16: e8 de 62 11 fa call 0xfa1162f9
1b: f7 c5 00 02 00 00 test $0x200,%ebp
21: 75 23 jne 0x46
23: 9c pushf
24: 58 pop %rax
25: f6 c4 02 test $0x2,%ah
28: 75 37 jne 0x61
* 2a: bf 01 00 00 00 mov $0x1,%edi <-- trapping instruction
2f: e8 25 f0 03 fa call 0xfa03f059
34: 65 8b 05 6e a2 7f 05 mov %gs:0x57fa26e(%rip),%eax # 0x57fa2a9
3b: 85 c0 test %eax,%eax
3d: 74 16 je 0x55
3f: 5b pop %rbx