smsusb:smsusb_onresponse: error, urb status -71, 0 bytes
smsusb:smsusb_onresponse: error, urb status -71, 0 bytes
smsusb:smsusb_onresponse: error, urb status -71, 0 bytes
smsusb:smsusb_onresponse: error, urb status -71, 0 bytes
==================================================================
BUG: KASAN: slab-use-after-free in dummy_timer+0x2916/0x31b0 drivers/usb/gadget/udc/dummy_hcd.c:1849
Read of size 4 at addr ffff88801dbba6f4 by task kworker/1:1/28
CPU: 1 PID: 28 Comm: kworker/1:1 Not tainted 6.6.95-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: usb_hub_wq hub_event
Call Trace:
dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:364 [inline]
print_report+0xac/0x230 mm/kasan/report.c:475
kasan_report+0x117/0x150 mm/kasan/report.c:588
dummy_timer+0x2916/0x31b0 drivers/usb/gadget/udc/dummy_hcd.c:1849
__run_hrtimer kernel/time/hrtimer.c:1755 [inline]
__hrtimer_run_queues+0x51e/0xc40 kernel/time/hrtimer.c:1819
hrtimer_run_softirq+0x187/0x2b0 kernel/time/hrtimer.c:1836
handle_softirqs+0x280/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:lock_acquire+0x1f2/0x410 kernel/locking/lockdep.c:5758
Code: 00 9c 8f 84 24 80 00 00 00 f6 84 24 81 00 00 00 02 0f 85 f5 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 3c 00 00 00 00 66 43 c7 44 3c 09 00 00 43 c6 44 3c 0b 00
RSP: 0018:ffffc90000a4e920 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 0000000000000000 RCX: f8985967016e9b00
RDX: 0000000000000000 RSI: ffffffff8aaac440 RDI: ffffffff8afc6ac0
RBP: ffffc90000a4ea38 R08: dffffc0000000000 R09: 1ffffffff21b0aa4
R10: dffffc0000000000 R11: fffffbfff21b0aa5 R12: 1ffff92000149d30
R13: ffffffff8cd2f760 R14: 0000000000000246 R15: dffffc0000000000
rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
rcu_read_lock include/linux/rcupdate.h:786 [inline]
kernfs_should_drain_open_files+0x3c/0x2c0 fs/kernfs/file.c:827
kernfs_drain+0x253/0x660 fs/kernfs/dir.c:494
__kernfs_remove+0x42b/0x840 fs/kernfs/dir.c:1486
kernfs_remove_by_name_ns+0xdc/0x150 fs/kernfs/dir.c:1695
media_device_unregister+0x365/0x400 drivers/media/mc/mc-device.c:831
smsusb_init_device drivers/media/usb/siano/smsusb.c:493 [inline]
smsusb_probe+0x1710/0x1da0 drivers/media/usb/siano/smsusb.c:569
usb_probe_interface+0x5a4/0xb00 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x25b/0xb40 drivers/base/dd.c:658
__driver_probe_device+0x18c/0x330 drivers/base/dd.c:800
driver_probe_device+0x4f/0x420 drivers/base/dd.c:830
__device_attach_driver+0x2ca/0x520 drivers/base/dd.c:958
bus_for_each_drv+0x24b/0x2d0 drivers/base/bus.c:459
__device_attach+0x2b5/0x400 drivers/base/dd.c:1030
bus_probe_device+0x180/0x260 drivers/base/bus.c:534
device_add+0x85b/0xc20 drivers/base/core.c:3683
usb_set_configuration+0x1a79/0x20c0 drivers/usb/core/message.c:2207
usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:238
usb_probe_device+0x13d/0x280 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x25b/0xb40 drivers/base/dd.c:658
__driver_probe_device+0x18c/0x330 drivers/base/dd.c:800
driver_probe_device+0x4f/0x420 drivers/base/dd.c:830
__device_attach_driver+0x2ca/0x520 drivers/base/dd.c:958
bus_for_each_drv+0x24b/0x2d0 drivers/base/bus.c:459
__device_attach+0x2b5/0x400 drivers/base/dd.c:1030
bus_probe_device+0x180/0x260 drivers/base/bus.c:534
device_add+0x85b/0xc20 drivers/base/core.c:3683
usb_new_device+0xa31/0x1630 drivers/usb/core/hub.c:2632
hub_port_connect drivers/usb/core/hub.c:5501 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5641 [inline]
port_event drivers/usb/core/hub.c:5801 [inline]
hub_event+0x2957/0x49c0 drivers/usb/core/hub.c:5883
process_one_work kernel/workqueue.c:2634 [inline]
process_scheduled_works+0xa45/0x15b0 kernel/workqueue.c:2711
worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
Allocated by task 28:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4e/0x70 mm/kasan/common.c:52
____kasan_kmalloc mm/kasan/common.c:374 [inline]
__kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:383
kmalloc include/linux/slab.h:600 [inline]
kzalloc include/linux/slab.h:721 [inline]
smsusb_init_device drivers/media/usb/siano/smsusb.c:397 [inline]
smsusb_probe+0x833/0x1da0 drivers/media/usb/siano/smsusb.c:569
usb_probe_interface+0x5a4/0xb00 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x25b/0xb40 drivers/base/dd.c:658
__driver_probe_device+0x18c/0x330 drivers/base/dd.c:800
driver_probe_device+0x4f/0x420 drivers/base/dd.c:830
__device_attach_driver+0x2ca/0x520 drivers/base/dd.c:958
bus_for_each_drv+0x24b/0x2d0 drivers/base/bus.c:459
__device_attach+0x2b5/0x400 drivers/base/dd.c:1030
bus_probe_device+0x180/0x260 drivers/base/bus.c:534
device_add+0x85b/0xc20 drivers/base/core.c:3683
usb_set_configuration+0x1a79/0x20c0 drivers/usb/core/message.c:2207
usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:238
usb_probe_device+0x13d/0x280 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x25b/0xb40 drivers/base/dd.c:658
__driver_probe_device+0x18c/0x330 drivers/base/dd.c:800
driver_probe_device+0x4f/0x420 drivers/base/dd.c:830
__device_attach_driver+0x2ca/0x520 drivers/base/dd.c:958
bus_for_each_drv+0x24b/0x2d0 drivers/base/bus.c:459
__device_attach+0x2b5/0x400 drivers/base/dd.c:1030
bus_probe_device+0x180/0x260 drivers/base/bus.c:534
device_add+0x85b/0xc20 drivers/base/core.c:3683
usb_new_device+0xa31/0x1630 drivers/usb/core/hub.c:2632
hub_port_connect drivers/usb/core/hub.c:5501 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5641 [inline]
port_event drivers/usb/core/hub.c:5801 [inline]
hub_event+0x2957/0x49c0 drivers/usb/core/hub.c:5883
process_one_work kernel/workqueue.c:2634 [inline]
process_scheduled_works+0xa45/0x15b0 kernel/workqueue.c:2711
worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
Freed by task 28:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4e/0x70 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x50 mm/kasan/generic.c:522
____kasan_slab_free+0x126/0x1e0 mm/kasan/common.c:236
kasan_slab_free include/linux/kasan.h:164 [inline]
slab_free_hook mm/slub.c:1806 [inline]
slab_free_freelist_hook+0x130/0x1b0 mm/slub.c:1832
slab_free mm/slub.c:3816 [inline]
__kmem_cache_free+0xba/0x1f0 mm/slub.c:3829
smsusb_term_device+0x1ac/0x220 drivers/media/usb/siano/smsusb.c:352
smsusb_init_device drivers/media/usb/siano/smsusb.c:491 [inline]
smsusb_probe+0x1708/0x1da0 drivers/media/usb/siano/smsusb.c:569
usb_probe_interface+0x5a4/0xb00 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x25b/0xb40 drivers/base/dd.c:658
__driver_probe_device+0x18c/0x330 drivers/base/dd.c:800
driver_probe_device+0x4f/0x420 drivers/base/dd.c:830
__device_attach_driver+0x2ca/0x520 drivers/base/dd.c:958
bus_for_each_drv+0x24b/0x2d0 drivers/base/bus.c:459
__device_attach+0x2b5/0x400 drivers/base/dd.c:1030
bus_probe_device+0x180/0x260 drivers/base/bus.c:534
device_add+0x85b/0xc20 drivers/base/core.c:3683
usb_set_configuration+0x1a79/0x20c0 drivers/usb/core/message.c:2207
usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:238
usb_probe_device+0x13d/0x280 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x25b/0xb40 drivers/base/dd.c:658
__driver_probe_device+0x18c/0x330 drivers/base/dd.c:800
driver_probe_device+0x4f/0x420 drivers/base/dd.c:830
__device_attach_driver+0x2ca/0x520 drivers/base/dd.c:958
bus_for_each_drv+0x24b/0x2d0 drivers/base/bus.c:459
__device_attach+0x2b5/0x400 drivers/base/dd.c:1030
bus_probe_device+0x180/0x260 drivers/base/bus.c:534
device_add+0x85b/0xc20 drivers/base/core.c:3683
usb_new_device+0xa31/0x1630 drivers/usb/core/hub.c:2632
hub_port_connect drivers/usb/core/hub.c:5501 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5641 [inline]
port_event drivers/usb/core/hub.c:5801 [inline]
hub_event+0x2957/0x49c0 drivers/usb/core/hub.c:5883
process_one_work kernel/workqueue.c:2634 [inline]
process_scheduled_works+0xa45/0x15b0 kernel/workqueue.c:2711
worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
Last potentially related work creation:
kasan_save_stack+0x3e/0x60 mm/kasan/common.c:45
__kasan_record_aux_stack+0xaf/0xc0 mm/kasan/generic.c:492
insert_work+0x3d/0x310 kernel/workqueue.c:1651
__queue_work+0xc39/0x1020 kernel/workqueue.c:1800
queue_work_on+0x121/0x1e0 kernel/workqueue.c:1835
__usb_hcd_giveback_urb+0x35f/0x520 drivers/usb/core/hcd.c:1650
dummy_timer+0x8a3/0x31b0 drivers/usb/gadget/udc/dummy_hcd.c:1993
__run_hrtimer kernel/time/hrtimer.c:1755 [inline]
__hrtimer_run_queues+0x51e/0xc40 kernel/time/hrtimer.c:1819
hrtimer_run_softirq+0x187/0x2b0 kernel/time/hrtimer.c:1836
handle_softirqs+0x280/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
Second to last potentially related work creation:
kasan_save_stack+0x3e/0x60 mm/kasan/common.c:45
__kasan_record_aux_stack+0xaf/0xc0 mm/kasan/generic.c:492
insert_work+0x3d/0x310 kernel/workqueue.c:1651
__queue_work+0xc39/0x1020 kernel/workqueue.c:1800
queue_work_on+0x121/0x1e0 kernel/workqueue.c:1835
__usb_hcd_giveback_urb+0x35f/0x520 drivers/usb/core/hcd.c:1650
dummy_timer+0x8a3/0x31b0 drivers/usb/gadget/udc/dummy_hcd.c:1993
__run_hrtimer kernel/time/hrtimer.c:1755 [inline]
__hrtimer_run_queues+0x51e/0xc40 kernel/time/hrtimer.c:1819
hrtimer_run_softirq+0x187/0x2b0 kernel/time/hrtimer.c:1836
handle_softirqs+0x280/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
The buggy address belongs to the object at ffff88801dbba000
which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 1780 bytes inside of
freed 4096-byte region [ffff88801dbba000, ffff88801dbbb000)
The buggy address belongs to the physical page:
page:ffffea000076ee00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1dbb8
head:ffffea000076ee00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff888017842140 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5146, tgid 5146 (udevd), ts 139338468259, free_ts 139159167136
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x1cd/0x210 mm/page_alloc.c:1554
prep_new_page mm/page_alloc.c:1561 [inline]
get_page_from_freelist+0x195c/0x19f0 mm/page_alloc.c:3191
__alloc_pages+0x1e3/0x460 mm/page_alloc.c:4457
alloc_slab_page+0x5d/0x170 mm/slub.c:1876
allocate_slab mm/slub.c:2023 [inline]
new_slab+0x87/0x2e0 mm/slub.c:2076
___slab_alloc+0xc6d/0x12f0 mm/slub.c:3230
__slab_alloc mm/slub.c:3329 [inline]
__slab_alloc_node mm/slub.c:3382 [inline]
slab_alloc_node mm/slub.c:3475 [inline]
__kmem_cache_alloc_node+0x1a2/0x260 mm/slub.c:3524
__do_kmalloc_node mm/slab_common.c:1006 [inline]
__kmalloc+0xa4/0x240 mm/slab_common.c:1020
kmalloc include/linux/slab.h:604 [inline]
tomoyo_realpath_from_path+0xe3/0x5d0 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_check_open_permission+0x1c3/0x3c0 security/tomoyo/file.c:771
security_file_open+0x62/0xa0 security/security.c:2854
do_dentry_open+0x380/0x1500 fs/open.c:916
do_open fs/namei.c:3632 [inline]
path_openat+0x274b/0x3190 fs/namei.c:3789
do_filp_open+0x1c5/0x3d0 fs/namei.c:3816
do_sys_openat2+0x12c/0x1c0 fs/open.c:1419
do_sys_open fs/open.c:1434 [inline]
__do_sys_openat fs/open.c:1450 [inline]
__se_sys_openat fs/open.c:1445 [inline]
__x64_sys_openat+0x139/0x160 fs/open.c:1445
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1154 [inline]
free_unref_page_prepare+0x7ce/0x8e0 mm/page_alloc.c:2336
free_unref_page+0x32/0x2e0 mm/page_alloc.c:2429
discard_slab mm/slub.c:2122 [inline]
__unfreeze_partials+0x1cf/0x210 mm/slub.c:2662
put_cpu_partial+0x17c/0x250 mm/slub.c:2738
__slab_free+0x31d/0x410 mm/slub.c:3686
qlink_free mm/kasan/quarantine.c:166 [inline]
qlist_free_all+0x75/0xe0 mm/kasan/quarantine.c:185
kasan_quarantine_reduce+0x143/0x160 mm/kasan/quarantine.c:292
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:305
kasan_slab_alloc include/linux/kasan.h:188 [inline]
slab_post_alloc_hook+0x6e/0x4d0 mm/slab.h:767
slab_alloc_node mm/slub.c:3485 [inline]
__kmem_cache_alloc_node+0x13e/0x260 mm/slub.c:3524
kmalloc_trace+0x2a/0xe0 mm/slab_common.c:1098
kmalloc include/linux/slab.h:600 [inline]
usb_control_msg+0x74/0x3e0 drivers/usb/core/message.c:144
get_port_status drivers/usb/core/hub.c:603 [inline]
hub_ext_port_status+0x103/0x6d0 drivers/usb/core/hub.c:620
hub_port_wait_reset drivers/usb/core/hub.c:-1 [inline]
hub_port_reset+0x727/0x1740 drivers/usb/core/hub.c:3028
hub_port_init+0xf7a/0x2760 drivers/usb/core/hub.c:4990
hub_port_connect drivers/usb/core/hub.c:5430 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5641 [inline]
port_event drivers/usb/core/hub.c:5801 [inline]
hub_event+0x2513/0x49c0 drivers/usb/core/hub.c:5883
Memory state around the buggy address:
ffff88801dbba580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88801dbba600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88801dbba680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88801dbba700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88801dbba780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
0: 00 9c 8f 84 24 80 00 add %bl,0x802484(%rdi,%rcx,4)
7: 00 00 add %al,(%rax)
9: f6 84 24 81 00 00 00 testb $0x2,0x81(%rsp)
10: 02
11: 0f 85 f5 00 00 00 jne 0x10c
17: 41 f7 c6 00 02 00 00 test $0x200,%r14d
1e: 74 01 je 0x21
20: fb sti
21: 48 c7 44 24 60 0e 36 movq $0x45e0360e,0x60(%rsp)
28: e0 45
* 2a: 4b c7 04 3c 00 00 00 movq $0x0,(%r12,%r15,1) <-- trapping instruction
31: 00
32: 66 43 c7 44 3c 09 00 movw $0x0,0x9(%r12,%r15,1)
39: 00
3a: 43 c6 44 3c 0b 00 movb $0x0,0xb(%r12,%r15,1)