==================================================================
BUG: KASAN: use-after-free in mcp2221_raw_event+0x103c/0x10a0 drivers/hid/hid-mcp2221.c:948
Read of size 1 at addr ffff888142f8ffff by task kworker/1:1/14766

CPU: 1 UID: 0 PID: 14766 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: events_power_efficient gc_worker
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x156/0x4c9 mm/kasan/report.c:482
 kasan_report+0xdf/0x1a0 mm/kasan/report.c:595
 mcp2221_raw_event+0x103c/0x10a0 drivers/hid/hid-mcp2221.c:948
 __hid_input_report.constprop.0+0x314/0x460 drivers/hid/hid-core.c:2139
 hid_irq_in+0x52e/0x6b0 drivers/hid/usbhid/hid-core.c:286
 __usb_hcd_giveback_urb+0x38d/0x610 drivers/usb/core/hcd.c:1657
 usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
 dummy_timer+0xd85/0x3670 drivers/usb/gadget/udc/dummy_hcd.c:1995
 __run_hrtimer kernel/time/hrtimer.c:1777 [inline]
 __hrtimer_run_queues+0x516/0x990 kernel/time/hrtimer.c:1841
 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1858
 handle_softirqs+0x1dd/0x8f0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xed/0x150 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1056
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:lock_is_held_type+0xf5/0x140 kernel/locking/lockdep.c:5945
Code: ff ff ff ff 65 0f c1 15 41 14 78 05 83 fa 01 8b 44 24 04 75 2d 9c 5a 80 e6 02 75 47 41 f7 c5 00 02 00 00 74 01 fb 48 83 c4 08 <5b> 5d 41 5c 41 5d 41 5e 41 5f e9 0c da 02 00 e9 07 da 02 00 31 c0
RSP: 0018:ffffc900179a7a40 EFLAGS: 00000292
RAX: 0000000000000000 RBX: ffffffff894da2e0 RCX: 0000000000000001
RDX: 0000000000000046 RSI: ffffffff88dcb9c1 RDI: ffffffff878e97a0
RBP: ffff888112dcd7c0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 00000000ffffffff
R13: 0000000000000246 R14: ffff888112dce2b8 R15: 0000000000000002
 lock_is_held include/linux/lockdep.h:249 [inline]
 __might_resched+0x29f/0x330 kernel/sched/core.c:8791
 gc_worker+0x966/0x1630 net/netfilter/nf_conntrack_core.c:1618
 process_one_work+0x9c2/0x1840 kernel/workqueue.c:3257
 process_scheduled_works kernel/workqueue.c:3340 [inline]
 worker_thread+0x5da/0xe40 kernel/workqueue.c:3421
 kthread+0x3b3/0x730 kernel/kthread.c:463
 ret_from_fork+0x6c3/0xa20 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x142f8f
flags: 0x200000000000000(node=0|zone=2)
raw: 0200000000000000 dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xcc0(GFP_KERNEL), pid 5915, tgid 5915 (kworker/1:6), ts 1875841720354, free_ts 2096933188780
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1e1/0x250 mm/page_alloc.c:1884
 prep_new_page mm/page_alloc.c:1892 [inline]
 get_page_from_freelist+0xd57/0x3b20 mm/page_alloc.c:3945
 __alloc_frozen_pages_noprof+0x269/0x2230 mm/page_alloc.c:5240
 __alloc_pages_noprof mm/page_alloc.c:5274 [inline]
 alloc_pages_bulk_noprof+0x73f/0x12c0 mm/page_alloc.c:5194
 ___alloc_pages_bulk mm/kasan/shadow.c:345 [inline]
 __kasan_populate_vmalloc_do mm/kasan/shadow.c:370 [inline]
 __kasan_populate_vmalloc+0xf0/0x210 mm/kasan/shadow.c:424
 kasan_populate_vmalloc include/linux/kasan.h:580 [inline]
 alloc_vmap_area+0x935/0x2a00 mm/vmalloc.c:2124
 __get_vm_area_node+0x1ca/0x330 mm/vmalloc.c:3219
 __vmalloc_node_range_noprof+0x213/0x1530 mm/vmalloc.c:4011
 __vmalloc_node_noprof+0xad/0xf0 mm/vmalloc.c:4111
 hid_open_report+0x2a0/0x770 drivers/hid/hid-core.c:1312
 hid_parse include/linux/hid.h:1165 [inline]
 steelseries_srws1_probe drivers/hid/hid-steelseries.c:264 [inline]
 steelseries_probe+0x2f7/0xf40 drivers/hid/hid-steelseries.c:539
 __hid_device_probe drivers/hid/hid-core.c:2775 [inline]
 hid_device_probe+0x50e/0x800 drivers/hid/hid-core.c:2812
 call_driver_probe drivers/base/dd.c:581 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:659
 __driver_probe_device+0x1de/0x400 drivers/base/dd.c:801
 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:831
 __device_attach_driver+0x1df/0x340 drivers/base/dd.c:959
page last free pid 13683 tgid 13683 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1433 [inline]
 __free_frozen_pages+0x7d1/0x1010 mm/page_alloc.c:2973
 kasan_depopulate_vmalloc_pte+0x5d/0x80 mm/kasan/shadow.c:484
 apply_to_pte_range mm/memory.c:3182 [inline]
 apply_to_pmd_range mm/memory.c:3226 [inline]
 apply_to_pud_range mm/memory.c:3262 [inline]
 apply_to_p4d_range mm/memory.c:3298 [inline]
 __apply_to_page_range+0xb1d/0x1520 mm/memory.c:3334
 __kasan_release_vmalloc+0xd7/0xe0 mm/kasan/shadow.c:602
 kasan_release_vmalloc include/linux/kasan.h:593 [inline]
 kasan_release_vmalloc_node mm/vmalloc.c:2282 [inline]
 purge_vmap_node+0x1c6/0xaa0 mm/vmalloc.c:2299
 __purge_vmap_area_lazy+0x8e5/0xbc0 mm/vmalloc.c:2389
 drain_vmap_area_work+0x27/0x40 mm/vmalloc.c:2423
 process_one_work+0x9c2/0x1840 kernel/workqueue.c:3257
 process_scheduled_works kernel/workqueue.c:3340 [inline]
 worker_thread+0x5da/0xe40 kernel/workqueue.c:3421
 kthread+0x3b3/0x730 kernel/kthread.c:463
 ret_from_fork+0x6c3/0xa20 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

Memory state around the buggy address:
 ffff888142f8fe80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888142f8ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888142f8ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                                ^
 ffff888142f90000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888142f90080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess), 3 bytes skipped:
   0:	ff 65 0f             	jmp    *0xf(%rbp)
   3:	c1 15 41 14 78 05 83 	rcll   $0x83,0x5781441(%rip)        # 0x578144b
   a:	fa                   	cli
   b:	01 8b 44 24 04 75    	add    %ecx,0x75042444(%rbx)
  11:	2d 9c 5a 80 e6       	sub    $0xe6805a9c,%eax
  16:	02 75 47             	add    0x47(%rbp),%dh
  19:	41 f7 c5 00 02 00 00 	test   $0x200,%r13d
  20:	74 01                	je     0x23
  22:	fb                   	sti
  23:	48 83 c4 08          	add    $0x8,%rsp
* 27:	5b                   	pop    %rbx <-- trapping instruction
  28:	5d                   	pop    %rbp
  29:	41 5c                	pop    %r12
  2b:	41 5d                	pop    %r13
  2d:	41 5e                	pop    %r14
  2f:	41 5f                	pop    %r15
  31:	e9 0c da 02 00       	jmp    0x2da42
  36:	e9 07 da 02 00       	jmp    0x2da42
  3b:	31 c0                	xor    %eax,%eax