==================================================================
BUG: KASAN: slab-out-of-bounds in mcp2221_raw_event+0x110d/0x1140 drivers/hid/hid-mcp2221.c:975
Read of size 1 at addr ffff8881340a3fff by task kworker/0:7/13070

CPU: 0 UID: 0 PID: 13070 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
 mcp2221_raw_event+0x110d/0x1140 drivers/hid/hid-mcp2221.c:975
 __hid_input_report.constprop.0+0x319/0x470 drivers/hid/hid-core.c:2175
 hid_irq_in+0x55d/0x710 drivers/hid/usbhid/hid-core.c:287
 __usb_hcd_giveback_urb+0x38e/0x610 drivers/usb/core/hcd.c:1657
 usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
 dummy_timer+0xdaf/0x3820 drivers/usb/gadget/udc/dummy_hcd.c:2023
 __run_hrtimer kernel/time/hrtimer.c:2074 [inline]
 __hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2131
 hrtimer_run_softirq+0x1ca/0x360 kernel/time/hrtimer.c:2148
 handle_softirqs+0x1d9/0x9b0 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0x168/0x210 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:lock_acquire+0x5e/0x380 kernel/locking/lockdep.c:5947
Code: 05 8f 9c 93 0b 83 f8 07 0f 87 da 00 00 00 48 0f a3 05 1e 0c 85 09 0f 82 c9 02 00 00 8b 35 be 19 85 09 85 f6 0f 85 c7 00 00 00 <48> 8b 44 24 30 65 48 2b 05 2d 9c 93 0b 0f 85 09 03 00 00 48 83 c4
RSP: 0018:ffffc90016f9f678 EFLAGS: 00000206
RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000200
RDX: 0000000000000000 RSI: ffffffff892bd9fe RDI: ffffffff87d2bd80
RBP: ffffffff898e6f20 R08: 0000000092f0998d R09: 0000000000000007
R10: 0000000000000200 R11: 0000000000000001 R12: 0000000000000002
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 rcu_read_lock include/linux/rcupdate.h:849 [inline]
 class_rcu_constructor include/linux/rcupdate.h:1216 [inline]
 kernfs_root+0x34/0x2a0 fs/kernfs/kernfs-internal.h:76
 kernfs_root_is_locked fs/kernfs/kernfs-internal.h:110 [inline]
 kernfs_rcu_name fs/kernfs/kernfs-internal.h:120 [inline]
 kernfs_name_compare fs/kernfs/dir.c:360 [inline]
 kernfs_name_compare fs/kernfs/dir.c:346 [inline]
 kernfs_find_ns+0x361/0x700 fs/kernfs/dir.c:908
 kernfs_remove_by_name_ns+0x5f/0x120 fs/kernfs/dir.c:1794
 kernfs_remove_by_name include/linux/kernfs.h:644 [inline]
 remove_files+0x96/0x1c0 fs/sysfs/group.c:28
 sysfs_remove_group+0x8b/0x1b0 fs/sysfs/group.c:328
 sysfs_remove_groups fs/sysfs/group.c:352 [inline]
 sysfs_remove_groups+0x60/0xb0 fs/sysfs/group.c:344
 device_remove_groups drivers/base/core.c:2918 [inline]
 device_remove_attrs+0x192/0x290 drivers/base/core.c:3048
 device_del+0x36e/0x9b0 drivers/base/core.c:3964
 usb_disconnect+0x5b5/0x9a0 drivers/usb/core/hub.c:2386
 hub_port_connect drivers/usb/core/hub.c:5425 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5725 [inline]
 port_event drivers/usb/core/hub.c:5889 [inline]
 hub_event+0x1d46/0x4510 drivers/usb/core/hub.c:5971
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396
 process_scheduled_works kernel/workqueue.c:3479 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x69f/0xc90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 2854:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 unpoison_slab_object mm/kasan/common.c:351 [inline]
 __kasan_mempool_unpoison_object+0x86/0x150 mm/kasan/common.c:575
 kasan_mempool_unpoison_object include/linux/kasan.h:391 [inline]
 napi_skb_cache_get+0x32c/0x9a0 net/core/skbuff.c:306
 __alloc_skb+0x5ca/0x710 net/core/skbuff.c:698
 alloc_skb include/linux/skbuff.h:1384 [inline]
 alloc_skb_with_frags+0xdd/0x760 net/core/skbuff.c:6799
 sock_alloc_send_pskb+0x801/0x980 net/core/sock.c:3022
 unix_dgram_sendmsg+0x3c7/0x1810 net/unix/af_unix.c:2144
 sock_sendmsg_nosec net/socket.c:800 [inline]
 __sock_sendmsg net/socket.c:815 [inline]
 __sys_sendto+0x48b/0x4e0 net/socket.c:2281
 __do_sys_sendto net/socket.c:2288 [inline]
 __se_sys_sendto net/socket.c:2284 [inline]
 __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2284
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x119/0x710 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 2847:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:264 [inline]
 __kasan_slab_free+0x43/0x70 mm/kasan/common.c:296
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2748 [inline]
 slab_free mm/slub.c:6509 [inline]
 kmem_cache_free+0x108/0x650 mm/slub.c:6636
 kfree_skbmem+0x19a/0x210 net/core/skbuff.c:1145
 __kfree_skb net/core/skbuff.c:1212 [inline]
 consume_skb net/core/skbuff.c:1448 [inline]
 consume_skb+0xd1/0x110 net/core/skbuff.c:1442
 __unix_dgram_recvmsg+0x754/0xc30 net/unix/af_unix.c:2672
 unix_dgram_recvmsg+0xcd/0x100 net/unix/af_unix.c:2689
 sock_recvmsg_nosec net/socket.c:1151 [inline]
 sock_recvmsg+0x1d5/0x220 net/socket.c:1173
 sock_read_iter+0x2b0/0x3a0 net/socket.c:1242
 new_sync_read fs/read_write.c:493 [inline]
 vfs_read+0x960/0xb40 fs/read_write.c:574
 ksys_read+0x1f8/0x250 fs/read_write.c:716
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x119/0x710 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff8881340a3dc0
 which belongs to the cache skbuff_head_cache of size 240
The buggy address is located 335 bytes to the right of
 allocated 240-byte region [ffff8881340a3dc0, ffff8881340a3eb0)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1340a3
flags: 0x200000000000000(node=0|zone=2)
page_type: f5(slab)
raw: 0200000000000000 ffff8881026e0a00 dead000000000100 dead000000000122
raw: 0000000000000000 00000002000c000c 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 2865, tgid 2865 (udevd), ts 190927345933
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871
 prep_new_page mm/page_alloc.c:1879 [inline]
 get_page_from_freelist+0xf4b/0x3440 mm/page_alloc.c:3943
 __alloc_frozen_pages_noprof+0x2d7/0x2f70 mm/page_alloc.c:5436
 alloc_slab_page mm/slub.c:3347 [inline]
 allocate_slab mm/slub.c:3462 [inline]
 new_slab+0xa9/0x6e0 mm/slub.c:3513
 refill_objects+0xe3/0x410 mm/slub.c:7418
 refill_sheaf mm/slub.c:2885 [inline]
 __pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4774
 alloc_from_pcs mm/slub.c:4850 [inline]
 slab_alloc_node mm/slub.c:4984 [inline]
 kmem_cache_alloc_node_noprof+0x49f/0x690 mm/slub.c:5068
 __alloc_skb+0x140/0x710 net/core/skbuff.c:704
 alloc_skb include/linux/skbuff.h:1384 [inline]
 netlink_alloc_large_skb+0x69/0x150 net/netlink/af_netlink.c:1204
 netlink_sendmsg+0x680/0xda0 net/netlink/af_netlink.c:1894
 sock_sendmsg_nosec net/socket.c:800 [inline]
 __sock_sendmsg net/socket.c:815 [inline]
 ____sys_sendmsg+0xa4d/0xbe0 net/socket.c:2713
 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2767
 __sys_sendmsg+0x160/0x210 net/socket.c:2799
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x119/0x710 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 121 tgid 121 ts 190859061209 stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 __free_pages_prepare mm/page_alloc.c:1418 [inline]
 __free_frozen_pages+0x714/0xfc0 mm/page_alloc.c:2962
 __pagetable_free include/linux/mm.h:3804 [inline]
 pagetable_free include/linux/mm.h:3828 [inline]
 pagetable_dtor_free include/linux/mm.h:3927 [inline]
 __tlb_remove_table include/asm-generic/tlb.h:221 [inline]
 __tlb_remove_table_free mm/mmu_gather.c:228 [inline]
 tlb_remove_table_rcu+0x2cf/0x380 mm/mmu_gather.c:291
 rcu_do_batch kernel/rcu/tree.c:2650 [inline]
 rcu_core+0x5f0/0x1260 kernel/rcu/tree.c:2919
 handle_softirqs+0x1d9/0x9b0 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0x168/0x210 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674

Memory state around the buggy address:
 ffff8881340a3e80: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
 ffff8881340a3f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8881340a3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                                                                ^
 ffff8881340a4000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8881340a4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess):
   0:	05 8f 9c 93 0b       	add    $0xb939c8f,%eax
   5:	83 f8 07             	cmp    $0x7,%eax
   8:	0f 87 da 00 00 00    	ja     0xe8
   e:	48 0f a3 05 1e 0c 85 	bt     %rax,0x9850c1e(%rip)        # 0x9850c34
  15:	09
  16:	0f 82 c9 02 00 00    	jb     0x2e5
  1c:	8b 35 be 19 85 09    	mov    0x98519be(%rip),%esi        # 0x98519e0
  22:	85 f6                	test   %esi,%esi
  24:	0f 85 c7 00 00 00    	jne    0xf1
* 2a:	48 8b 44 24 30       	mov    0x30(%rsp),%rax <-- trapping instruction
  2f:	65 48 2b 05 2d 9c 93 	sub    %gs:0xb939c2d(%rip),%rax        # 0xb939c64
  36:	0b
  37:	0f 85 09 03 00 00    	jne    0x346
  3d:	48                   	rex.W
  3e:	83                   	.byte 0x83
  3f:	c4                   	.byte 0xc4