==================================================================
BUG: KASAN: slab-out-of-bounds in mcp2221_raw_event+0xfcd/0x1190 drivers/hid/hid-mcp2221.c:944
Read of size 1 at addr ffff888031f67fff by task kworker/0:1/10
CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.16.0-rc4-next-20250630-syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: usb_hub_wq hub_event
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:408 [inline]
print_report+0xd2/0x2b0 mm/kasan/report.c:521
kasan_report+0x118/0x150 mm/kasan/report.c:634
mcp2221_raw_event+0xfcd/0x1190 drivers/hid/hid-mcp2221.c:944
__hid_input_report drivers/hid/hid-core.c:2117 [inline]
hid_input_report+0x40a/0x520 drivers/hid/hid-core.c:2144
hid_irq_in+0x47e/0x6d0 drivers/hid/usbhid/hid-core.c:286
__usb_hcd_giveback_urb+0x41a/0x690 drivers/usb/core/hcd.c:1650
dummy_timer+0x862/0x4550 drivers/usb/gadget/udc/dummy_hcd.c:1995
__run_hrtimer kernel/time/hrtimer.c:1761 [inline]
__hrtimer_run_queues+0x52c/0xc60 kernel/time/hrtimer.c:1825
hrtimer_run_softirq+0x187/0x2b0 kernel/time/hrtimer.c:1842
handle_softirqs+0x286/0x870 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1050
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:finish_task_switch+0x26b/0x950 kernel/sched/core.c:5181
Code: 0f 84 3c 01 00 00 48 85 db 0f 85 63 01 00 00 0f 1f 44 00 00 4c 8b 75 d0 4c 89 e7 e8 8f c7 e7 09 e8 3a 0e 36 00 fb 4c 8b 65 c0 <49> 8d bc 24 18 16 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 28 84 c0
RSP: 0018:ffffc900000f5b58 EFLAGS: 00000282
RAX: 0933d4ae8b401900 RBX: 0000000000000000 RCX: 0933d4ae8b401900
RDX: 0000000000000007 RSI: ffffffff8da68861 RDI: ffffffff8be4a9c0
RBP: ffffc900000f5bb0 R08: ffffffff8fc29737 R09: 1ffffffff1f852e6
R10: dffffc0000000000 R11: fffffbfff1f852e7 R12: ffff88801d291e00
R13: dffffc0000000000 R14: ffff88807d805a00 R15: ffff8880b863ab18
context_switch kernel/sched/core.c:5316 [inline]
__schedule+0x16fd/0x4d00 kernel/sched/core.c:6696
preempt_schedule_irq+0xb5/0x150 kernel/sched/core.c:7019
irqentry_exit+0x6f/0x90 kernel/entry/common.c:307
asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:707
RIP: 0010:lock_acquire+0x175/0x360 kernel/locking/lockdep.c:5875
Code: 00 00 00 00 9c 8f 44 24 30 f7 44 24 30 00 02 00 00 0f 85 cd 00 00 00 f7 44 24 08 00 02 00 00 74 01 fb 65 48 8b 05 4b d7 25 11 <48> 3b 44 24 58 0f 85 f2 00 00 00 48 83 c4 60 5b 41 5c 41 5d 41 5e
RSP: 0018:ffffc900000f5f58 EFLAGS: 00000206
RAX: 0933d4ae8b401900 RBX: 0000000000000000 RCX: 0933d4ae8b401900
RDX: 0000000000000000 RSI: ffffffff8dc588fc RDI: ffffffff8be4a9c0
RBP: ffffffff8172dc65 R08: 0000000000000000 R09: ffffffff8172dc65
R10: ffffc900000f6118 R11: ffffffff81acb300 R12: 0000000000000002
R13: ffffffff8e33bee0 R14: 0000000000000000 R15: 0000000000000246
rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
rcu_read_lock include/linux/rcupdate.h:841 [inline]
class_rcu_constructor include/linux/rcupdate.h:1155 [inline]
unwind_next_frame+0xc2/0x2390 arch/x86/kernel/unwind_orc.c:479
arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__do_kmalloc_node mm/slub.c:4365 [inline]
__kmalloc_noprof+0x27a/0x4f0 mm/slub.c:4377
kmalloc_noprof include/linux/slab.h:909 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]
kobject_get_path+0xc5/0x2d0 lib/kobject.c:161
kobject_uevent_env+0x292/0x8c0 lib/kobject_uevent.c:545
device_add+0x557/0xb50 drivers/base/core.c:3672
cdev_device_add+0x1d6/0x390 fs/char_dev.c:556
i2cdev_attach_adapter+0x2ed/0x4e0 drivers/i2c/i2c-dev.c:691
notifier_call_chain+0x1b3/0x3e0 kernel/notifier.c:85
blocking_notifier_call_chain+0x6a/0x90 kernel/notifier.c:380
bus_notify+0x143/0x180 drivers/base/bus.c:1001
device_add+0x54d/0xb50 drivers/base/core.c:3671
i2c_register_adapter+0x4e3/0x10d0 drivers/i2c/i2c-core-base.c:1570
devm_i2c_add_adapter+0x1b/0x80 drivers/i2c/i2c-core-base.c:1842
mcp2221_probe+0x404/0x880 drivers/hid/hid-mcp2221.c:1285
__hid_device_probe drivers/hid/hid-core.c:2727 [inline]
hid_device_probe+0x39d/0x710 drivers/hid/hid-core.c:2764
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x26d/0x9a0 drivers/base/dd.c:657
__driver_probe_device+0x18c/0x2f0 drivers/base/dd.c:799
driver_probe_device+0x4f/0x430 drivers/base/dd.c:829
__device_attach_driver+0x2ce/0x530 drivers/base/dd.c:957
bus_for_each_drv+0x24e/0x2e0 drivers/base/bus.c:462
__device_attach+0x2b8/0x400 drivers/base/dd.c:1029
bus_probe_device+0x185/0x260 drivers/base/bus.c:537
device_add+0x7b6/0xb50 drivers/base/core.c:3691
hid_add_device+0x398/0x540 drivers/hid/hid-core.c:2910
usbhid_probe+0xe13/0x12a0 drivers/hid/usbhid/hid-core.c:1435
usb_probe_interface+0x634/0xbf0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x26d/0x9a0 drivers/base/dd.c:657
__driver_probe_device+0x18c/0x2f0 drivers/base/dd.c:799
driver_probe_device+0x4f/0x430 drivers/base/dd.c:829
__device_attach_driver+0x2ce/0x530 drivers/base/dd.c:957
bus_for_each_drv+0x24e/0x2e0 drivers/base/bus.c:462
__device_attach+0x2b8/0x400 drivers/base/dd.c:1029
bus_probe_device+0x185/0x260 drivers/base/bus.c:537
device_add+0x7b6/0xb50 drivers/base/core.c:3691
usb_set_configuration+0x1a87/0x20e0 drivers/usb/core/message.c:2210
usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
usb_probe_device+0x1c4/0x390 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x26d/0x9a0 drivers/base/dd.c:657
__driver_probe_device+0x18c/0x2f0 drivers/base/dd.c:799
driver_probe_device+0x4f/0x430 drivers/base/dd.c:829
__device_attach_driver+0x2ce/0x530 drivers/base/dd.c:957
bus_for_each_drv+0x24e/0x2e0 drivers/base/bus.c:462
__device_attach+0x2b8/0x400 drivers/base/dd.c:1029
bus_probe_device+0x185/0x260 drivers/base/bus.c:537
device_add+0x7b6/0xb50 drivers/base/core.c:3691
usb_new_device+0xa39/0x16f0 drivers/usb/core/hub.c:2699
hub_port_connect drivers/usb/core/hub.c:5571 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5711 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x2941/0x4a00 drivers/usb/core/hub.c:5953
process_one_work kernel/workqueue.c:3239 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3322
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3403
kthread+0x70e/0x8a0 kernel/kthread.c:463
ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Allocated by task 25703:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:319 [inline]
__kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:345
kasan_slab_alloc include/linux/kasan.h:250 [inline]
slab_post_alloc_hook mm/slub.c:4180 [inline]
slab_alloc_node mm/slub.c:4229 [inline]
kmem_cache_alloc_noprof+0x1c1/0x3c0 mm/slub.c:4236
sigqueue_alloc kernel/signal.c:455 [inline]
__send_signal_locked+0x22a/0xeb0 kernel/signal.c:1087
force_sig_info_to_task+0x30c/0x590 kernel/signal.c:1320
force_sig_fault_to_task kernel/signal.c:1699 [inline]
force_sig_fault+0xdc/0x130 kernel/signal.c:1704
__bad_area_nosemaphore+0x3b3/0x780 arch/x86/mm/fault.c:823
bad_area_access_error+0x155/0x270 arch/x86/mm/fault.c:-1
handle_page_fault arch/x86/mm/fault.c:1476 [inline]
exc_page_fault+0x76/0xf0 arch/x86/mm/fault.c:1532
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
Freed by task 25703:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x62/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2417 [inline]
slab_free mm/slub.c:4680 [inline]
kmem_cache_free+0x18f/0x400 mm/slub.c:4782
__sigqueue_free kernel/signal.c:475 [inline]
dequeue_synchronous_signal kernel/signal.c:706 [inline]
get_signal+0xa4c/0x1340 kernel/signal.c:2912
arch_do_signal_or_restart+0x9a/0x750 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline]
irqentry_exit_to_user_mode+0x81/0x120 kernel/entry/common.c:184
exc_page_fault+0x9f/0xf0 arch/x86/mm/fault.c:1535
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
The buggy address belongs to the object at ffff888031f67f50
which belongs to the cache sigqueue of size 80
The buggy address is located 95 bytes to the right of
allocated 80-byte region [ffff888031f67f50, ffff888031f67fa0)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x31f67
memcg:ffff8880649ffc01
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000000 ffff88814042e3c0 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000240024 00000000f5000000 ffff8880649ffc01
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x152820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 25703, tgid 25703 (syz.6.6563), ts 1435465637596, free_ts 1435454352307
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1848
prep_new_page mm/page_alloc.c:1856 [inline]
get_page_from_freelist+0x21e4/0x22c0 mm/page_alloc.c:3855
__alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5145
alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2419
alloc_slab_page mm/slub.c:2487 [inline]
allocate_slab+0x8a/0x370 mm/slub.c:2655
new_slab mm/slub.c:2709 [inline]
___slab_alloc+0xbeb/0x1410 mm/slub.c:3891
__slab_alloc mm/slub.c:3981 [inline]
__slab_alloc_node mm/slub.c:4056 [inline]
slab_alloc_node mm/slub.c:4217 [inline]
kmem_cache_alloc_noprof+0x283/0x3c0 mm/slub.c:4236
sigqueue_alloc kernel/signal.c:455 [inline]
__send_signal_locked+0x22a/0xeb0 kernel/signal.c:1087
force_sig_info_to_task+0x30c/0x590 kernel/signal.c:1320
force_sig_fault_to_task kernel/signal.c:1699 [inline]
force_sig_fault+0xdc/0x130 kernel/signal.c:1704
__bad_area_nosemaphore+0x3b3/0x780 arch/x86/mm/fault.c:823
bad_area_access_error+0x155/0x270 arch/x86/mm/fault.c:-1
handle_page_fault arch/x86/mm/fault.c:1476 [inline]
exc_page_fault+0x76/0xf0 arch/x86/mm/fault.c:1532
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
page last free pid 25707 tgid 25707 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1392 [inline]
__free_frozen_pages+0xb80/0xd80 mm/page_alloc.c:2892
tlb_batch_list_free mm/mmu_gather.c:159 [inline]
tlb_finish_mmu+0x112/0x1d0 mm/mmu_gather.c:500
exit_mmap+0x44c/0xb50 mm/mmap.c:1297
__mmput+0x118/0x420 kernel/fork.c:1120
exit_mm+0x1da/0x2c0 kernel/exit.c:581
do_exit+0x648/0x2300 kernel/exit.c:947
do_group_exit+0x21c/0x2d0 kernel/exit.c:1100
__do_sys_exit_group kernel/exit.c:1111 [inline]
__se_sys_exit_group kernel/exit.c:1109 [inline]
__x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1109
x64_sys_call+0x21ba/0x21c0 arch/x86/include/generated/asm/syscalls_64.h:232
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888031f67e80: fb fb fb fb fb fb fb fb fc fc fc fc fa fb fb fb
ffff888031f67f00: fb fb fb fb fb fb fc fc fc fc fa fb fb fb fb fb
>ffff888031f67f80: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff888031f68000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888031f68080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess):
0: 0f 84 3c 01 00 00 je 0x142
6: 48 85 db test %rbx,%rbx
9: 0f 85 63 01 00 00 jne 0x172
f: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
14: 4c 8b 75 d0 mov -0x30(%rbp),%r14
18: 4c 89 e7 mov %r12,%rdi
1b: e8 8f c7 e7 09 call 0x9e7c7af
20: e8 3a 0e 36 00 call 0x360e5f
25: fb sti
26: 4c 8b 65 c0 mov -0x40(%rbp),%r12
* 2a: 49 8d bc 24 18 16 00 lea 0x1618(%r12),%rdi <-- trapping instruction
31: 00
32: 48 89 f8 mov %rdi,%rax
35: 48 c1 e8 03 shr $0x3,%rax
39: 42 0f b6 04 28 movzbl (%rax,%r13,1),%eax
3e: 84 c0 test %al,%al