usb 4-1: received invalid command response:got 60, instead of 4
==================================================================
BUG: KASAN: stack-out-of-bounds in carl9170_cmd_callback drivers/net/wireless/ath/carl9170/rx.c:153 [inline]
BUG: KASAN: stack-out-of-bounds in carl9170_handle_command_response+0x21f/0xc50 drivers/net/wireless/ath/carl9170/rx.c:168
Write of size 60 at addr ffffc900001e7a38 by task syz.3.100/5606
CPU: 1 UID: 0 PID: 5606 Comm: syz.3.100 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x13d/0x4b0 mm/kasan/report.c:482
kasan_report+0xdf/0x1d0 mm/kasan/report.c:595
check_region_inline mm/kasan/generic.c:186 [inline]
kasan_check_range+0x10f/0x1e0 mm/kasan/generic.c:200
__asan_memcpy+0x3c/0x60 mm/kasan/shadow.c:106
carl9170_cmd_callback drivers/net/wireless/ath/carl9170/rx.c:153 [inline]
carl9170_handle_command_response+0x21f/0xc50 drivers/net/wireless/ath/carl9170/rx.c:168
carl9170_usb_rx_irq_complete+0xfc/0x1b0 drivers/net/wireless/ath/carl9170/usb.c:307
__usb_hcd_giveback_urb+0x38d/0x610 drivers/usb/core/hcd.c:1657
usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
dummy_timer+0xda1/0x36c0 drivers/usb/gadget/udc/dummy_hcd.c:2005
__run_hrtimer kernel/time/hrtimer.c:1930 [inline]
__hrtimer_run_queues+0x470/0xa00 kernel/time/hrtimer.c:1994
hrtimer_run_softirq+0x17d/0x2c0 kernel/time/hrtimer.c:2011
handle_softirqs+0x1dd/0x9e0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x160/0x210 kernel/softirq.c:735
irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1061
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:188 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:206
Code: 90 f3 0f 1e fa 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 5a 00 1c fa 48 89 df e8 32 50 1c fa e8 5d 81 47 fa fb bf 01 00 00 00 02 8f 0f fa 65 8b 05 fb 1a 86 05 85 c0 74 06 5b c3 cc cc cc cc
RSP: 0018:ffffc90004487ba0 EFLAGS: 00000202
RAX: 00000000000013e3 RBX: ffffc90004487d20 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff890d1d42 RDI: 0000000000000001
RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffffc90004487d18
R13: 0000000000000001 R14: ffffc90004487d20 R15: ffff8881158d1dc0
do_wait_for_common kernel/sched/completion.c:99 [inline]
__wait_for_common+0x2da/0x4c0 kernel/sched/completion.c:121
wait_for_common kernel/sched/completion.c:132 [inline]
wait_for_completion_interruptible+0x1f/0x40 kernel/sched/completion.c:221
raw_process_ep_io+0x66d/0xc40 drivers/usb/gadget/legacy/raw_gadget.c:1122
raw_ioctl_ep_write drivers/usb/gadget/legacy/raw_gadget.c:1153 [inline]
raw_ioctl+0x25a/0x2b80 drivers/usb/gadget/legacy/raw_gadget.c:1325
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x10b/0x7f0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f43e27fc4ab
Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
RSP: 002b:00007f43e1255f60 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000000000af RCX: 00007f43e27fc4ab
RDX: 00007f43e1255fe0 RSI: 0000000040085507 RDI: 0000000000000003
RBP: 0000000000000003 R08: 00007f43e2ba0320 R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000246 R12: 0000200000000100
R13: 000000000000000c R14: 00007f43e2a75fa0 R15: 00007ffeb2e5b908
The buggy address belongs to a 8-page vmalloc region starting at 0xffffc900001e0000 allocated at kernel_clone+0x12e/0x9c0 kernel/fork.c:2723
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102aa7
flags: 0x200000000000000(node=0|zone=2)
raw: 0200000000000000 ffffea00040aa9c8 ffffea00040aa9c8 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x29c2(GFP_NOWAIT|__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_ZERO), pid 2, tgid 2 (kthreadd), ts 2598134952, free_ts 0
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x153/0x170 mm/page_alloc.c:1858
prep_new_page mm/page_alloc.c:1866 [inline]
get_page_from_freelist+0xf34/0x3a90 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x273/0x28a0 mm/page_alloc.c:5226
__alloc_pages_noprof+0xb/0x110 mm/page_alloc.c:5260
__alloc_pages_node_noprof include/linux/gfp.h:289 [inline]
alloc_pages_node_noprof include/linux/gfp.h:316 [inline]
vm_area_alloc_pages mm/vmalloc.c:3655 [inline]
__vmalloc_area_node mm/vmalloc.c:3878 [inline]
__vmalloc_node_range_noprof+0xe0c/0x1630 mm/vmalloc.c:4064
__vmalloc_node_noprof+0xad/0xf0 mm/vmalloc.c:4124
alloc_thread_stack_node kernel/fork.c:357 [inline]
dup_task_struct kernel/fork.c:926 [inline]
copy_process+0x7fb/0x7d20 kernel/fork.c:2088
kernel_clone+0x12e/0x9c0 kernel/fork.c:2723
kernel_thread+0xdb/0x120 kernel/fork.c:2784
create_kthread kernel/kthread.c:459 [inline]
kthreadd+0x498/0x7a0 kernel/kthread.c:817
ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
page_owner free stack trace missing
Memory state around the buggy address:
ffffc900001e7900: f1 f1 f1 00 00 00 f3 f3 f3 f3 f3 00 00 00 00 00
ffffc900001e7980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc900001e7a00: 00 f1 f1 f1 f1 f1 f1 04 f2 04 f3 f3 f3 00 00 00
^
ffffc900001e7a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffffc900001e7b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess):
0: 90 nop
1: f3 0f 1e fa endbr64
5: 53 push %rbx
6: 48 8b 74 24 08 mov 0x8(%rsp),%rsi
b: 48 89 fb mov %rdi,%rbx
e: 48 83 c7 18 add $0x18,%rdi
12: e8 5a 00 1c fa call 0xfa1c0071
17: 48 89 df mov %rbx,%rdi
1a: e8 32 50 1c fa call 0xfa1c5051
1f: e8 5d 81 47 fa call 0xfa478181
24: fb sti
25: bf 01 00 00 00 mov $0x1,%edi
* 2a: e8 02 8f 0f fa call 0xfa0f8f31 <-- trapping instruction
2f: 65 8b 05 fb 1a 86 05 mov %gs:0x5861afb(%rip),%eax # 0x5861b31
36: 85 c0 test %eax,%eax
38: 74 06 je 0x40
3a: 5b pop %rbx
3b: c3 ret
3c: cc int3
3d: cc int3
3e: cc int3
3f: cc int3