================================================================== BUG: KASAN: slab-use-after-free in __intf_to_usbdev include/linux/usb.h:752 [inline] BUG: KASAN: slab-use-after-free in uea_upload_pre_firmware+0x8d/0x640 drivers/usb/atm/ueagle-atm.c:598 Read of size 8 at addr ffff88801aff60b8 by task kworker/0:5/5720 CPU: 0 UID: 0 PID: 5720 Comm: kworker/0:5 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 Workqueue: events request_firmware_work_func Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description+0x55/0x1e0 mm/kasan/report.c:378 print_report+0x58/0x70 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 __intf_to_usbdev include/linux/usb.h:752 [inline] uea_upload_pre_firmware+0x8d/0x640 drivers/usb/atm/ueagle-atm.c:598 request_firmware_work_func+0xf7/0x2d0 drivers/base/firmware_loader/main.c:1164 process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379 process_scheduled_works kernel/workqueue.c:3462 [inline] worker_thread+0xb05/0x10d0 kernel/workqueue.c:3543 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 16: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5339 [inline] __kmalloc_node_track_caller_noprof+0x566/0x7b0 mm/slub.c:5468 kmalloc_reserve net/core/skbuff.c:637 [inline] __alloc_skb+0x2bd/0x7a0 net/core/skbuff.c:715 alloc_skb include/linux/skbuff.h:1384 [inline] alloc_skb_with_frags+0xc6/0x760 net/core/skbuff.c:6769 sock_alloc_send_pskb+0x884/0x9a0 net/core/sock.c:3010 sock_alloc_send_skb include/net/sock.h:1907 [inline] __ip6_append_data+0x2de9/0x40c0 net/ipv6/ip6_output.c:1691 ip6_append_data+0x108/0x280 net/ipv6/ip6_output.c:1887 icmp6_send+0x138a/0x1b50 net/ipv6/icmp.c:818 icmpv6_send include/linux/icmpv6.h:24 [inline] ip6_link_failure+0x3b/0x4c0 net/ipv6/route.c:2869 dst_link_failure include/net/dst.h:456 [inline] ndisc_error_report+0x118/0x160 net/ipv6/ndisc.c:733 neigh_invalidate+0x243/0x470 net/core/neighbour.c:1077 neigh_timer_handler+0xc0d/0x12c0 net/core/neighbour.c:1169 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x67b/0x9b0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405 handle_softirqs+0x1d9/0x6c0 kernel/softirq.c:626 __do_softirq kernel/softirq.c:660 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1155 smpboot_thread_fn+0x57c/0xa80 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 16: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2706 [inline] slab_free mm/slub.c:6374 [inline] kfree+0x1c5/0x6c0 mm/slub.c:6689 skb_kfree_head net/core/skbuff.c:1077 [inline] skb_free_head net/core/skbuff.c:1089 [inline] skb_release_data+0x85e/0xab0 net/core/skbuff.c:1116 skb_release_all net/core/skbuff.c:1191 [inline] __kfree_skb+0x5d/0x210 net/core/skbuff.c:1205 kfree_skb_reason include/linux/skbuff.h:1323 [inline] icmpv6_rcv+0x161f/0x1f40 net/ipv6/icmp.c:-1 ip6_protocol_deliver_rcu+0xe8c/0x1680 net/ipv6/ip6_input.c:479 ip6_input_finish+0x191/0x370 net/ipv6/ip6_input.c:534 NF_HOOK+0x336/0x3c0 include/linux/netfilter.h:325 ip6_input+0x16a/0x270 net/ipv6/ip6_input.c:545 NF_HOOK+0x336/0x3c0 include/linux/netfilter.h:325 __netif_receive_skb_one_core net/core/dev.c:6216 [inline] __netif_receive_skb net/core/dev.c:6329 [inline] process_backlog+0x3bf/0xc50 net/core/dev.c:6680 __napi_poll+0xae/0x550 net/core/dev.c:7739 napi_poll net/core/dev.c:7802 [inline] net_rx_action+0x621/0xd70 net/core/dev.c:7959 handle_softirqs+0x1d9/0x6c0 kernel/softirq.c:626 __do_softirq kernel/softirq.c:660 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1155 smpboot_thread_fn+0x57c/0xa80 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the object at ffff88801aff6000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 184 bytes inside of freed 2048-byte region [ffff88801aff6000, ffff88801aff6800) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88801aff2000 pfn:0x1aff0 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x80000000000240(workingset|head|node=0|zone=1) page_type: f5(slab) raw: 0080000000000240 ffff88813fe3a000 ffffea0000a2e810 ffffea0001752810 raw: ffff88801aff2000 0000000800080007 00000000f5000000 0000000000000000 head: 0080000000000240 ffff88813fe3a000 ffffea0000a2e810 ffffea0001752810 head: ffff88801aff2000 0000000800080007 00000000f5000000 0000000000000000 head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 3691351491 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1862 prep_new_page mm/page_alloc.c:1870 [inline] get_page_from_freelist+0x264c/0x26c0 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x222/0x5b0 mm/page_alloc.c:5385 alloc_slab_page mm/slub.c:3295 [inline] allocate_slab+0x7c/0x5e0 mm/slub.c:3410 new_slab mm/slub.c:3456 [inline] refill_objects+0x2d8/0x350 mm/slub.c:7307 refill_sheaf mm/slub.c:2833 [inline] __pcs_replace_empty_main+0x330/0x690 mm/slub.c:4699 alloc_from_pcs mm/slub.c:4775 [inline] slab_alloc_node mm/slub.c:4909 [inline] __kmalloc_cache_noprof+0x467/0x670 mm/slub.c:5482 _kmalloc_noprof include/linux/slab.h:969 [inline] _kzalloc_noprof include/linux/slab.h:1290 [inline] acpi_ds_create_walk_state+0x96/0x270 drivers/acpi/acpica/dswstate.c:518 acpi_ds_call_control_method+0x31b/0x9f0 drivers/acpi/acpica/dsmethod.c:511 acpi_ps_parse_aml+0x621/0x1020 drivers/acpi/acpica/psparse.c:517 acpi_ps_execute_method+0x89d/0xa70 drivers/acpi/acpica/psxface.c:190 acpi_ns_evaluate+0xd05/0x1320 drivers/acpi/acpica/nseval.c:205 acpi_evaluate_object+0x657/0xd70 drivers/acpi/acpica/nsxfeval.c:354 acpi_evaluate_integer+0x112/0x320 drivers/acpi/utils.c:260 acpi_bus_get_status_handle drivers/acpi/bus.c:82 [inline] acpi_bus_get_status+0x150/0x3c0 drivers/acpi/bus.c:111 acpi_bus_attach+0x1d5/0xb80 drivers/acpi/scan.c:2346 page_owner free stack trace missing Memory state around the buggy address: ffff88801aff5f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88801aff6000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88801aff6080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88801aff6100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88801aff6180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================