==================================================================
BUG: KASAN: slab-out-of-bounds in mcp2221_raw_event+0x106a/0x1240 drivers/hid/hid-mcp2221.c:957
Read of size 1 at addr ffff88802c11ffff by task kworker/0:1/10
CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
mcp2221_raw_event+0x106a/0x1240 drivers/hid/hid-mcp2221.c:957
__hid_input_report drivers/hid/hid-core.c:2140 [inline]
hid_input_report+0x41d/0x580 drivers/hid/hid-core.c:2167
hid_irq_in+0x47e/0x6d0 drivers/hid/usbhid/hid-core.c:286
__usb_hcd_giveback_urb+0x376/0x540 drivers/usb/core/hcd.c:1657
dummy_timer+0xbc0/0x4650 drivers/usb/gadget/udc/dummy_hcd.c:2005
__run_hrtimer kernel/time/hrtimer.c:1930 [inline]
__hrtimer_run_queues+0x3c0/0xa20 kernel/time/hrtimer.c:1994
hrtimer_run_softirq+0x17a/0x240 kernel/time/hrtimer.c:2011
handle_softirqs+0x22a/0x840 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0xca/0x220 kernel/softirq.c:735
irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1061
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:finish_task_switch+0x427/0xbe0 kernel/sched/core.c:5209
Code: 41 c7 84 24 e0 0d 00 00 00 00 00 00 0f 1f 44 00 00 49 83 c4 48 4c 89 e7 e8 f6 23 1e 0a e8 61 97 38 00 fb 49 8d bd 68 16 00 00 <48> 89 f8 48 c1 e8 03 42 0f b6 04 38 84 c0 0f 85 7b 03 00 00 41 80
RSP: 0018:ffffc900000f5ef0 EFLAGS: 00000206
RAX: 00000000000991dd RBX: 1ffff110170c777c RCX: 0000000080000001
RDX: 0000000000000006 RSI: ffffffff8df3fb49 RDI: ffff88801daed368
RBP: ffffc900000f5f50 R08: ffffffff901240f7 R09: 1ffffffff202481e
R10: dffffc0000000000 R11: fffffbfff202481f R12: ffff8880b863ae48
R13: ffff88801daebd00 R14: ffff888031a9db80 R15: dffffc0000000000
context_switch kernel/sched/core.c:5355 [inline]
__schedule+0x1664/0x5520 kernel/sched/core.c:6964
preempt_schedule_common+0x82/0xd0 kernel/sched/core.c:7149
preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12
__up_write kernel/locking/rwsem.c:1418 [inline]
up_write+0x1d9/0x410 kernel/locking/rwsem.c:1682
kernfs_add_one+0x25d/0x5c0 fs/kernfs/dir.c:842
kernfs_create_dir_ns+0xde/0x130 fs/kernfs/dir.c:1111
sysfs_create_dir_ns+0x12f/0x2a0 fs/sysfs/dir.c:59
create_dir lib/kobject.c:73 [inline]
kobject_add_internal+0x62b/0xd00 lib/kobject.c:240
kobject_add_varg lib/kobject.c:374 [inline]
kobject_add+0x163/0x240 lib/kobject.c:426
class_dir_create_and_add drivers/base/core.c:3235 [inline]
get_device_parent+0x316/0x3a0 drivers/base/core.c:3286
device_add+0x2e1/0xb70 drivers/base/core.c:3616
cdev_device_add+0x1d6/0x390 fs/char_dev.c:553
i2cdev_attach_adapter+0x2ed/0x510 drivers/i2c/i2c-dev.c:690
notifier_call_chain+0x1ad/0x3d0 kernel/notifier.c:85
blocking_notifier_call_chain+0x6a/0x90 kernel/notifier.c:380
bus_notify+0x143/0x180 drivers/base/bus.c:1079
device_add+0x54d/0xb70 drivers/base/core.c:3672
i2c_register_adapter+0x51b/0x1180 drivers/i2c/i2c-core-base.c:1573
devm_i2c_add_adapter+0x1b/0x80 drivers/i2c/i2c-core-base.c:1845
mcp2221_probe+0x3ff/0x890 drivers/hid/hid-mcp2221.c:1299
__hid_device_probe drivers/hid/hid-core.c:2776 [inline]
hid_device_probe+0x416/0x7a0 drivers/hid/hid-core.c:2813
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:721
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:863
driver_probe_device+0x4f/0x240 drivers/base/dd.c:893
__device_attach_driver+0x279/0x430 drivers/base/dd.c:1021
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1093
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1148
bus_probe_device+0x12a/0x220 drivers/base/bus.c:613
device_add+0x7b6/0xb70 drivers/base/core.c:3692
hid_add_device+0x272/0x3e0 drivers/hid/hid-core.c:2957
usbhid_probe+0xe3a/0x12f0 drivers/hid/usbhid/hid-core.c:1450
usb_probe_interface+0x659/0xc70 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:721
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:863
driver_probe_device+0x4f/0x240 drivers/base/dd.c:893
__device_attach_driver+0x279/0x430 drivers/base/dd.c:1021
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1093
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1148
bus_probe_device+0x12a/0x220 drivers/base/bus.c:613
device_add+0x7b6/0xb70 drivers/base/core.c:3692
usb_set_configuration+0x1a87/0x2110 drivers/usb/core/message.c:2268
usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
usb_probe_device+0x1c4/0x3b0 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:721
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:863
driver_probe_device+0x4f/0x240 drivers/base/dd.c:893
__device_attach_driver+0x279/0x430 drivers/base/dd.c:1021
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1093
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1148
bus_probe_device+0x12a/0x220 drivers/base/bus.c:613
device_add+0x7b6/0xb70 drivers/base/core.c:3692
usb_new_device+0xa08/0x16f0 drivers/usb/core/hub.c:2695
hub_port_connect drivers/usb/core/hub.c:5567 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x2a1c/0x4f30 drivers/usb/core/hub.c:5953
process_one_work kernel/workqueue.c:3278 [inline]
process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3361
worker_thread+0xa53/0xfc0 kernel/workqueue.c:3442
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Allocated by task 1:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5292 [inline]
__kmalloc_noprof+0x35c/0x760 mm/slub.c:5304
kmalloc_noprof include/linux/slab.h:954 [inline]
kzalloc_noprof include/linux/slab.h:1188 [inline]
__usb_create_hcd+0x67/0x920 drivers/usb/core/hcd.c:2566
vhci_hcd_probe+0x1e6/0x3e0 drivers/usb/usbip/vhci_hcd.c:1394
platform_probe+0xf9/0x190 drivers/base/platform.c:1418
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:721
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:863
driver_probe_device+0x4f/0x240 drivers/base/dd.c:893
__device_attach_driver+0x279/0x430 drivers/base/dd.c:1021
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1093
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1148
bus_probe_device+0x12a/0x220 drivers/base/bus.c:613
device_add+0x7b6/0xb70 drivers/base/core.c:3692
platform_device_add+0x46a/0x800 drivers/base/platform.c:756
platform_device_register_full+0x548/0x640 drivers/base/platform.c:888
vhci_hcd_init+0x220/0x360 drivers/usb/usbip/vhci_hcd.c:1557
do_one_initcall+0x250/0x870 init/main.c:1384
do_initcall_level+0x104/0x190 init/main.c:1446
do_initcalls+0x59/0xa0 init/main.c:1462
kernel_init_freeable+0x2a6/0x3e0 init/main.c:1694
kernel_init+0x1d/0x1d0 init/main.c:1584
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Last potentially related work creation:
kasan_save_stack+0x3e/0x60 mm/kasan/common.c:57
kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:556
insert_work+0x3d/0x330 kernel/workqueue.c:2202
__queue_work+0xccf/0xfc0 kernel/workqueue.c:2357
queue_work_on+0x106/0x1d0 kernel/workqueue.c:2408
usb_rh_urb_dequeue drivers/usb/core/hcd.c:845 [inline]
unlink1+0x34b/0x3f0 drivers/usb/core/hcd.c:1580
usb_hcd_unlink_urb+0xe6/0x1e0 drivers/usb/core/hcd.c:1617
usb_kill_urb+0x10b/0x2f0 drivers/usb/core/urb.c:716
hub_quiesce+0x21b/0x330 drivers/usb/core/hub.c:1412
hub_suspend+0x7e8/0x9b0 drivers/usb/core/hub.c:4008
usb_suspend_interface drivers/usb/core/driver.c:1323 [inline]
usb_suspend_both+0x31f/0x1310 drivers/usb/core/driver.c:1445
usb_runtime_suspend+0x58/0x110 drivers/usb/core/driver.c:1995
__rpm_callback+0x2d9/0x940 drivers/base/power/runtime.c:406
rpm_callback drivers/base/power/runtime.c:460 [inline]
rpm_suspend+0x874/0x1720 drivers/base/power/runtime.c:698
__pm_runtime_suspend+0x12f/0x1a0 drivers/base/power/runtime.c:1167
pm_runtime_put_sync_autosuspend include/linux/pm_runtime.h:740 [inline]
usb_new_device+0xb46/0x16f0 drivers/usb/core/hub.c:2727
register_root_hub+0x270/0x5f0 drivers/usb/core/hcd.c:990
usb_add_hcd+0xba1/0x10b0 drivers/usb/core/hcd.c:2987
vhci_hcd_probe+0x1fa/0x3e0 drivers/usb/usbip/vhci_hcd.c:1401
platform_probe+0xf9/0x190 drivers/base/platform.c:1418
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:721
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:863
driver_probe_device+0x4f/0x240 drivers/base/dd.c:893
__device_attach_driver+0x279/0x430 drivers/base/dd.c:1021
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1093
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1148
bus_probe_device+0x12a/0x220 drivers/base/bus.c:613
device_add+0x7b6/0xb70 drivers/base/core.c:3692
platform_device_add+0x46a/0x800 drivers/base/platform.c:756
platform_device_register_full+0x548/0x640 drivers/base/platform.c:888
vhci_hcd_init+0x220/0x360 drivers/usb/usbip/vhci_hcd.c:1557
do_one_initcall+0x250/0x870 init/main.c:1384
do_initcall_level+0x104/0x190 init/main.c:1446
do_initcalls+0x59/0xa0 init/main.c:1462
kernel_init_freeable+0x2a6/0x3e0 init/main.c:1694
kernel_init+0x1d/0x1d0 init/main.c:1584
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Second to last potentially related work creation:
kasan_save_stack+0x3e/0x60 mm/kasan/common.c:57
kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:556
insert_work+0x3d/0x330 kernel/workqueue.c:2202
__queue_work+0xccf/0xfc0 kernel/workqueue.c:2357
queue_work_on+0x106/0x1d0 kernel/workqueue.c:2408
rh_call_control drivers/usb/core/hcd.c:707 [inline]
rh_urb_enqueue drivers/usb/core/hcd.c:817 [inline]
usb_hcd_submit_urb+0x11f9/0x1b70 drivers/usb/core/hcd.c:1538
usb_start_wait_urb+0x13f/0x5b0 drivers/usb/core/message.c:62
usb_internal_control_msg drivers/usb/core/message.c:117 [inline]
usb_control_msg+0x234/0x3e0 drivers/usb/core/message.c:167
set_port_feature drivers/usb/core/hub.c:466 [inline]
hub_suspend+0x775/0x9b0 drivers/usb/core/hub.c:3996
usb_suspend_interface drivers/usb/core/driver.c:1323 [inline]
usb_suspend_both+0x31f/0x1310 drivers/usb/core/driver.c:1445
usb_runtime_suspend+0x58/0x110 drivers/usb/core/driver.c:1995
__rpm_callback+0x2d9/0x940 drivers/base/power/runtime.c:406
rpm_callback drivers/base/power/runtime.c:460 [inline]
rpm_suspend+0x874/0x1720 drivers/base/power/runtime.c:698
__pm_runtime_suspend+0x12f/0x1a0 drivers/base/power/runtime.c:1167
pm_runtime_put_sync_autosuspend include/linux/pm_runtime.h:740 [inline]
usb_new_device+0xb46/0x16f0 drivers/usb/core/hub.c:2727
register_root_hub+0x270/0x5f0 drivers/usb/core/hcd.c:990
usb_add_hcd+0xba1/0x10b0 drivers/usb/core/hcd.c:2987
vhci_hcd_probe+0x1fa/0x3e0 drivers/usb/usbip/vhci_hcd.c:1401
platform_probe+0xf9/0x190 drivers/base/platform.c:1418
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:721
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:863
driver_probe_device+0x4f/0x240 drivers/base/dd.c:893
__device_attach_driver+0x279/0x430 drivers/base/dd.c:1021
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1093
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1148
bus_probe_device+0x12a/0x220 drivers/base/bus.c:613
device_add+0x7b6/0xb70 drivers/base/core.c:3692
platform_device_add+0x46a/0x800 drivers/base/platform.c:756
platform_device_register_full+0x548/0x640 drivers/base/platform.c:888
vhci_hcd_init+0x220/0x360 drivers/usb/usbip/vhci_hcd.c:1557
do_one_initcall+0x250/0x870 init/main.c:1384
do_initcall_level+0x104/0x190 init/main.c:1446
do_initcalls+0x59/0xa0 init/main.c:1462
kernel_init_freeable+0x2a6/0x3e0 init/main.c:1694
kernel_init+0x1d/0x1d0 init/main.c:1584
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
The buggy address belongs to the object at ffff88802c11c000
which belongs to the cache kmalloc-8k of size 8192
The buggy address is located 10559 bytes to the right of
allocated 5824-byte region [ffff88802c11c000, ffff88802c11d6c0)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2c118
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88813feac280 dead000000000122 0000000000000000
raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88813feac280 dead000000000122 0000000000000000
head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 12932900911, free_ts 0
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x231/0x280 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x2418/0x24b0 mm/page_alloc.c:3926
__alloc_frozen_pages_noprof+0x233/0x3d0 mm/page_alloc.c:5213
alloc_slab_page mm/slub.c:3278 [inline]
allocate_slab+0x77/0x660 mm/slub.c:3467
new_slab mm/slub.c:3525 [inline]
refill_objects+0x339/0x3d0 mm/slub.c:7247
refill_sheaf mm/slub.c:2816 [inline]
__pcs_replace_empty_main+0x321/0x720 mm/slub.c:4651
alloc_from_pcs mm/slub.c:4749 [inline]
slab_alloc_node mm/slub.c:4883 [inline]
__do_kmalloc_node mm/slub.c:5291 [inline]
__kmalloc_noprof+0x474/0x760 mm/slub.c:5304
kmalloc_noprof include/linux/slab.h:954 [inline]
kzalloc_noprof include/linux/slab.h:1188 [inline]
__usb_create_hcd+0x67/0x920 drivers/usb/core/hcd.c:2566
vhci_hcd_probe+0x1e6/0x3e0 drivers/usb/usbip/vhci_hcd.c:1394
platform_probe+0xf9/0x190 drivers/base/platform.c:1418
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:721
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:863
driver_probe_device+0x4f/0x240 drivers/base/dd.c:893
__device_attach_driver+0x279/0x430 drivers/base/dd.c:1021
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1093
page_owner free stack trace missing
Memory state around the buggy address:
ffff88802c11fe80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88802c11ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88802c11ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88802c120000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88802c120080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess):
0: 41 c7 84 24 e0 0d 00 movl $0x0,0xde0(%r12)
7: 00 00 00 00 00
c: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
11: 49 83 c4 48 add $0x48,%r12
15: 4c 89 e7 mov %r12,%rdi
18: e8 f6 23 1e 0a call 0xa1e2413
1d: e8 61 97 38 00 call 0x389783
22: fb sti
23: 49 8d bd 68 16 00 00 lea 0x1668(%r13),%rdi
* 2a: 48 89 f8 mov %rdi,%rax <-- trapping instruction
2d: 48 c1 e8 03 shr $0x3,%rax
31: 42 0f b6 04 38 movzbl (%rax,%r15,1),%eax
36: 84 c0 test %al,%al
38: 0f 85 7b 03 00 00 jne 0x3b9
3e: 41 rex.B
3f: 80 .byte 0x80