==================================================================
BUG: KASAN: slab-out-of-bounds in mcp2221_raw_event+0x103c/0x10a0 drivers/hid/hid-mcp2221.c:957
Read of size 1 at addr ffff888066997fff by task dhcpcd/5879
CPU: 0 UID: 0 PID: 5879 Comm: dhcpcd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x13d/0x4b0 mm/kasan/report.c:482
kasan_report+0xdf/0x1d0 mm/kasan/report.c:595
mcp2221_raw_event+0x103c/0x10a0 drivers/hid/hid-mcp2221.c:957
__hid_input_report.constprop.0+0x314/0x460 drivers/hid/hid-core.c:2147
hid_irq_in+0x52e/0x6b0 drivers/hid/usbhid/hid-core.c:286
__usb_hcd_giveback_urb+0x38d/0x610 drivers/usb/core/hcd.c:1657
usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
dummy_timer+0xda1/0x36c0 drivers/usb/gadget/udc/dummy_hcd.c:2005
__run_hrtimer kernel/time/hrtimer.c:1930 [inline]
__hrtimer_run_queues+0x470/0xa00 kernel/time/hrtimer.c:1994
hrtimer_run_softirq+0x17d/0x2c0 kernel/time/hrtimer.c:2011
handle_softirqs+0x1ea/0xa00 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x162/0x210 kernel/softirq.c:735
irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1061
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:finish_task_switch.isra.0+0x2d3/0x1010 kernel/sched/core.c:5245
Code: 2f 0a 00 00 41 c7 87 e0 0d 00 00 00 00 00 00 0f 1f 44 00 00 49 8d 7f 48 e8 3a 1c b8 09 e8 55 95 3b 00 fb 48 8d bb b0 16 00 00 <48> b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 04 02 84
RSP: 0018:ffffc9000519eee0 EFLAGS: 00000202
RAX: 0000000000000c19 RBX: ffff888027f42500 RCX: 0000000000000080
RDX: 0000000000000000 RSI: ffffffff8df21135 RDI: ffff888027f43bb0
RBP: ffffc9000519ef38 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888036f50000
R13: 0000000000000000 R14: ffffffff90d7e1e4 R15: ffff8880b843b240
context_switch kernel/sched/core.c:5391 [inline]
__schedule+0x129d/0x67a0 kernel/sched/core.c:7189
preempt_schedule_irq+0x50/0x90 kernel/sched/core.c:7513
irqentry_exit_to_kernel_mode_preempt include/linux/irq-entry-common.h:476 [inline]
irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:547 [inline]
irqentry_exit+0x205/0x7e0 kernel/entry/common.c:164
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:lock_acquire+0x5e/0x370 kernel/locking/lockdep.c:5872
Code: 05 7b 5a 26 12 83 f8 07 0f 87 d9 02 00 00 48 0f a3 05 86 28 f3 0e 0f 82 a4 02 00 00 8b 35 0e 5c f3 0e 85 f6 0f 85 bf 00 00 00 <48> 8b 44 24 30 65 48 2b 05 1d 5a 26 12 0f 85 ed 02 00 00 48 83 c4
RSP: 0018:ffffc9000519f1c0 EFLAGS: 00000206
RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffffffff8defbc27 RDI: ffffffff8c1c3800
RBP: ffffffff8e7e54e0 R08: 00000000dacd92cc R09: 0000000000000007
R10: 0000000000000200 R11: 0000000000000000 R12: 0000000000000002
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
rcu_read_lock include/linux/rcupdate.h:838 [inline]
class_rcu_constructor include/linux/rcupdate.h:1181 [inline]
unwind_next_frame+0xd1/0x2090 arch/x86/kernel/unwind_orc.c:495
arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_record_aux_stack+0xa7/0xc0 mm/kasan/generic.c:556
__call_rcu_common.constprop.0+0xa5/0x9b0 kernel/rcu/tree.c:3131
slab_free_hook mm/slub.c:2653 [inline]
slab_free mm/slub.c:6250 [inline]
kmem_cache_free+0x44a/0x6c0 mm/slub.c:6377
anon_vma_free mm/rmap.c:137 [inline]
__put_anon_vma+0x114/0x3a0 mm/rmap.c:2915
put_anon_vma mm/internal.h:216 [inline]
unlink_anon_vmas+0x5f3/0x8e0 mm/rmap.c:536
free_pgtables+0x2e7/0xd80 mm/memory.c:414
unmap_region+0x2d1/0x3b0 mm/vma.c:490
vms_clear_ptes mm/vma.c:1303 [inline]
vms_complete_munmap_vmas+0xa4b/0xdd0 mm/vma.c:1345
do_vmi_align_munmap+0x44f/0x5f0 mm/vma.c:1604
do_vmi_munmap+0x1f8/0x3e0 mm/vma.c:1652
__vm_munmap+0x196/0x390 mm/vma.c:3285
__do_sys_munmap mm/mmap.c:1079 [inline]
__se_sys_munmap mm/mmap.c:1076 [inline]
__x64_sys_munmap+0x59/0x80 mm/mmap.c:1076
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1cea6a22e7
Code: 00 00 00 b8 0a 00 00 00 0f 05 48 3d 01 f0 ff ff 73 01 c3 48 8d 0d c9 3f 01 00 f7 d8 89 01 48 83 c8 ff c3 b8 0b 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8d 0d a9 3f 01 00 f7 d8 89 01 48 83
RSP: 002b:00007ffea3950fd8 EFLAGS: 00000206 ORIG_RAX: 000000000000000b
RAX: ffffffffffffffda RBX: 00005652571583f0 RCX: 00007f1cea6a22e7
RDX: 0000000000000002 RSI: 0000000000061018 RDI: 00007f1cea3d2000
RBP: 00007ffea39510e0 R08: 0000000000000030 R09: 0000565257158fa0
R10: 00007ffea3950f10 R11: 0000000000000206 R12: 00007ffea3951028
R13: 00007f1cea6b5000 R14: 00005652571583f0 R15: 0000000000000000
Allocated by task 5609:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
unpoison_slab_object mm/kasan/common.c:340 [inline]
__kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:366
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4569 [inline]
slab_alloc_node mm/slub.c:4898 [inline]
kmem_cache_alloc_node_noprof+0x25a/0x6f0 mm/slub.c:4950
kmalloc_reserve+0x148/0x350 net/core/skbuff.c:613
__alloc_skb+0x185/0x710 net/core/skbuff.c:713
napi_alloc_skb+0x42e/0x820 net/core/skbuff.c:853
page_to_skb+0x187/0x1390 drivers/net/virtio_net.c:884
receive_mergeable drivers/net/virtio_net.c:2411 [inline]
receive_buf+0x8e6/0x4830 drivers/net/virtio_net.c:2575
virtnet_receive_packets drivers/net/virtio_net.c:2900 [inline]
virtnet_receive drivers/net/virtio_net.c:2924 [inline]
virtnet_poll+0x1681/0x3a00 drivers/net/virtio_net.c:3013
__napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7730
napi_poll net/core/dev.c:7793 [inline]
net_rx_action+0xa40/0xf20 net/core/dev.c:7950
handle_softirqs+0x1ea/0xa00 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x162/0x210 kernel/softirq.c:735
irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
common_interrupt+0xbe/0xe0 arch/x86/kernel/irq.c:326
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:688
Freed by task 5609:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2689 [inline]
slab_free mm/slub.c:6250 [inline]
kfree+0x223/0x6c0 mm/slub.c:6565
skb_kfree_head net/core/skbuff.c:1075 [inline]
skb_free_head+0xb9/0x160 net/core/skbuff.c:1087
skb_release_data+0x6c5/0x8e0 net/core/skbuff.c:1114
skb_release_all net/core/skbuff.c:1189 [inline]
__kfree_skb+0x4f/0x70 net/core/skbuff.c:1203
tcp_data_queue+0x1964/0x4f80 net/ipv4/tcp_input.c:5585
tcp_rcv_established+0xb37/0x3910 net/ipv4/tcp_input.c:6656
tcp_v4_do_rcv+0xbb6/0x1260 net/ipv4/tcp_ipv4.c:1851
tcp_v4_rcv+0x2e83/0x4810 net/ipv4/tcp_ipv4.c:2244
ip_protocol_deliver_rcu+0xba/0x4d0 net/ipv4/ip_input.c:207
ip_local_deliver_finish+0x3f2/0x6e0 net/ipv4/ip_input.c:241
NF_HOOK include/linux/netfilter.h:318 [inline]
NF_HOOK include/linux/netfilter.h:312 [inline]
ip_local_deliver+0x19a/0x1f0 net/ipv4/ip_input.c:262
dst_input include/net/dst.h:480 [inline]
ip_sublist_rcv_finish net/ipv4/ip_input.c:623 [inline]
ip_list_rcv_finish+0xa14/0xce0 net/ipv4/ip_input.c:675
ip_sublist_rcv net/ipv4/ip_input.c:683 [inline]
ip_list_rcv+0x338/0x450 net/ipv4/ip_input.c:717
__netif_receive_skb_list_ptype net/core/dev.c:6245 [inline]
__netif_receive_skb_list_core+0x74c/0x940 net/core/dev.c:6292
__netif_receive_skb_list net/core/dev.c:6344 [inline]
netif_receive_skb_list_internal+0x722/0xd40 net/core/dev.c:6435
gro_normal_list include/net/gro.h:523 [inline]
gro_normal_list include/net/gro.h:519 [inline]
gro_flush_normal include/net/gro.h:531 [inline]
napi_complete_done+0x221/0x940 net/core/dev.c:6803
virtqueue_napi_complete drivers/net/virtio_net.c:740 [inline]
virtnet_poll+0x1b08/0x3a00 drivers/net/virtio_net.c:3021
__napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7730
napi_poll net/core/dev.c:7793 [inline]
net_rx_action+0xa40/0xf20 net/core/dev.c:7950
handle_softirqs+0x1ea/0xa00 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x162/0x210 kernel/softirq.c:735
irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
common_interrupt+0xbe/0xe0 arch/x86/kernel/irq.c:326
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:688
The buggy address belongs to the object at ffff888066997a80
which belongs to the cache skbuff_small_head of size 704
The buggy address is located 703 bytes to the right of
allocated 704-byte region [ffff888066997a80, ffff888066997d40)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x66994
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff888140abd640 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800130013 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff888140abd640 dead000000000100 dead000000000122
head: 0000000000000000 0000000800130013 00000000f5000000 0000000000000000
head: 00fff00000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 0, tgid 0 (swapper/0), ts 61914453045, free_ts 18123098334
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x153/0x170 mm/page_alloc.c:1858
prep_new_page mm/page_alloc.c:1866 [inline]
get_page_from_freelist+0x11a6/0x33b0 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x27c/0x2bc0 mm/page_alloc.c:5226
alloc_slab_page mm/slub.c:3278 [inline]
allocate_slab mm/slub.c:3467 [inline]
new_slab+0xa6/0x6c0 mm/slub.c:3525
refill_objects+0x277/0x420 mm/slub.c:7255
refill_sheaf mm/slub.c:2816 [inline]
__pcs_replace_empty_main+0x375/0x650 mm/slub.c:4651
alloc_from_pcs mm/slub.c:4749 [inline]
slab_alloc_node mm/slub.c:4883 [inline]
kmem_cache_alloc_node_noprof+0x569/0x6f0 mm/slub.c:4950
kmalloc_reserve+0x148/0x350 net/core/skbuff.c:613
__alloc_skb+0x185/0x710 net/core/skbuff.c:713
napi_alloc_skb+0x42e/0x820 net/core/skbuff.c:853
page_to_skb+0x187/0x1390 drivers/net/virtio_net.c:884
receive_mergeable drivers/net/virtio_net.c:2411 [inline]
receive_buf+0x8e6/0x4830 drivers/net/virtio_net.c:2575
virtnet_receive_packets drivers/net/virtio_net.c:2900 [inline]
virtnet_receive drivers/net/virtio_net.c:2924 [inline]
virtnet_poll+0x1681/0x3a00 drivers/net/virtio_net.c:3013
__napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7730
napi_poll net/core/dev.c:7793 [inline]
net_rx_action+0xa40/0xf20 net/core/dev.c:7950
handle_softirqs+0x1ea/0xa00 kernel/softirq.c:622
page last free pid 1 tgid 1 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1402 [inline]
__free_frozen_pages+0x747/0x1040 mm/page_alloc.c:2943
__free_pages mm/page_alloc.c:5345 [inline]
free_contig_range+0xda/0x140 mm/page_alloc.c:7313
debug_vm_pgtable_free_huge_page mm/debug_vm_pgtable.c:980 [inline]
destroy_args+0xa8/0x7a0 mm/debug_vm_pgtable.c:993
debug_vm_pgtable+0x1d69/0x3490 mm/debug_vm_pgtable.c:1368
do_one_initcall+0x121/0x750 init/main.c:1392
do_initcall_level init/main.c:1454 [inline]
do_initcalls init/main.c:1470 [inline]
do_basic_setup init/main.c:1490 [inline]
kernel_init_freeable+0x6ea/0x7b0 init/main.c:1703
kernel_init+0x1f/0x1e0 init/main.c:1593
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Memory state around the buggy address:
ffff888066997e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888066997f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888066997f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff888066998000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888066998080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 0a 00 or (%rax),%al
2: 00 41 c7 add %al,-0x39(%rcx)
5: 87 e0 xchg %esp,%eax
7: 0d 00 00 00 00 or $0x0,%eax
c: 00 00 add %al,(%rax)
e: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
13: 49 8d 7f 48 lea 0x48(%r15),%rdi
17: e8 3a 1c b8 09 call 0x9b81c56
1c: e8 55 95 3b 00 call 0x3b9576
21: fb sti
22: 48 8d bb b0 16 00 00 lea 0x16b0(%rbx),%rdi
* 29: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax <-- trapping instruction
30: fc ff df
33: 48 89 fa mov %rdi,%rdx
36: 48 c1 ea 03 shr $0x3,%rdx
3a: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax
3e: 84 .byte 0x84