usb 3-1: emi26_set_reset - 1
==================================================================
BUG: KASAN: vmalloc-out-of-bounds in ihex_next_binrec include/linux/ihex.h:43 [inline]
BUG: KASAN: vmalloc-out-of-bounds in emi26_load_firmware drivers/usb/misc/emi26.c:117 [inline]
BUG: KASAN: vmalloc-out-of-bounds in emi26_probe+0x3e7/0xe30 drivers/usb/misc/emi26.c:232
Read of size 2 at addr ffffc9000323b00c by task kworker/0:9/5820

CPU: 0 UID: 0 PID: 5820 Comm: kworker/0:9 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
 ihex_next_binrec include/linux/ihex.h:43 [inline]
 emi26_load_firmware drivers/usb/misc/emi26.c:117 [inline]
 emi26_probe+0x3e7/0xe30 drivers/usb/misc/emi26.c:232
 usb_probe_interface+0x303/0x8f0 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868
 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026
 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098
 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x64/0x160 drivers/base/bus.c:620
 device_add+0x121d/0x1970 drivers/base/core.c:3772
 usb_set_configuration+0xd97/0x1c60 drivers/usb/core/message.c:2268
 usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250
 usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868
 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026
 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098
 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x64/0x160 drivers/base/bus.c:620
 device_add+0x121d/0x1970 drivers/base/core.c:3772
 usb_new_device.part.0+0xcc2/0x1686 drivers/usb/core/hub.c:2703
 usb_new_device include/linux/workqueue.h:714 [inline]
 hub_port_connect drivers/usb/core/hub.c:5575 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5715 [inline]
 port_event drivers/usb/core/hub.c:5879 [inline]
 hub_event.cold+0x1e3/0xe90 drivers/usb/core/hub.c:5961
 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
 process_scheduled_works kernel/workqueue.c:3405 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

The buggy address belongs to a 1-page vmalloc region starting at 0xffffc9000323b000 allocated at kernel_read_file+0x77e/0x9a0 fs/kernel_read_file.c:80
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88805d893dc0 pfn:0x5d893
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000
raw: ffff88805d893dc0 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2cc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_NOWARN), pid 5820, tgid 5820 (kworker/0:9), ts 793610857411, free_ts 793610829195
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859
 prep_new_page mm/page_alloc.c:1867 [inline]
 get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304
 __alloc_pages_noprof mm/page_alloc.c:5338 [inline]
 alloc_pages_bulk_noprof+0x5de/0x13c0 mm/page_alloc.c:5230
 alloc_pages_bulk_mempolicy_noprof+0x255/0x1270 mm/mempolicy.c:2798
 vm_area_alloc_pages mm/vmalloc.c:3736 [inline]
 __vmalloc_area_node mm/vmalloc.c:3914 [inline]
 __vmalloc_node_range_noprof+0x69d/0x1630 mm/vmalloc.c:4104
 __vmalloc_node_noprof+0xad/0xf0 mm/vmalloc.c:4165
 kernel_read_file+0x77e/0x9a0 fs/kernel_read_file.c:80
 kernel_read_file_from_path_initns+0x1cf/0x260 fs/kernel_read_file.c:168
 fw_get_filesystem_firmware drivers/base/firmware_loader/main.c:549 [inline]
 _request_firmware+0x733/0x13c0 drivers/base/firmware_loader/main.c:873
 request_firmware+0x35/0x50 drivers/base/firmware_loader/main.c:948
 request_ihex_firmware.constprop.0+0x8c/0x250 include/linux/ihex.h:71
 emi26_load_firmware drivers/usb/misc/emi26.c:86 [inline]
 emi26_probe+0x13c/0xe30 drivers/usb/misc/emi26.c:232
 usb_probe_interface+0x303/0x8f0 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868
page last free pid 5820 tgid 5820 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1406 [inline]
 __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950
 __kasan_populate_vmalloc_do mm/kasan/shadow.c:393 [inline]
 __kasan_populate_vmalloc+0x1ea/0x210 mm/kasan/shadow.c:424
 kasan_populate_vmalloc include/linux/kasan.h:580 [inline]
 alloc_vmap_area+0x95d/0x2bb0 mm/vmalloc.c:2145
 __get_vm_area_node+0x1ca/0x330 mm/vmalloc.c:3248
 __vmalloc_node_range_noprof+0x228/0x1630 mm/vmalloc.c:4064
 __vmalloc_node_noprof+0xad/0xf0 mm/vmalloc.c:4165
 kernel_read_file+0x77e/0x9a0 fs/kernel_read_file.c:80
 kernel_read_file_from_path_initns+0x1cf/0x260 fs/kernel_read_file.c:168
 fw_get_filesystem_firmware drivers/base/firmware_loader/main.c:549 [inline]
 _request_firmware+0x733/0x13c0 drivers/base/firmware_loader/main.c:873
 request_firmware+0x35/0x50 drivers/base/firmware_loader/main.c:948
 request_ihex_firmware.constprop.0+0x8c/0x250 include/linux/ihex.h:71
 emi26_load_firmware drivers/usb/misc/emi26.c:86 [inline]
 emi26_probe+0x13c/0xe30 drivers/usb/misc/emi26.c:232
 usb_probe_interface+0x303/0x8f0 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868
 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898

Memory state around the buggy address:
 ffffc9000323af00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffffc9000323af80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
>ffffc9000323b000: 06 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
                      ^
 ffffc9000323b080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffffc9000323b100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
==================================================================