==================================================================
BUG: KASAN: slab-out-of-bounds in mcp2221_raw_event+0x101c/0x1090 drivers/hid/hid-mcp2221.c:964
Read of size 1 at addr ffff88810a36bfff by task kworker/1:12/28055
CPU: 1 UID: 0 PID: 28055 Comm: kworker/1:12 Not tainted syzkaller #0 PREEMPT(lazy)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x13d/0x4b0 mm/kasan/report.c:482
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
mcp2221_raw_event+0x101c/0x1090 drivers/hid/hid-mcp2221.c:964
__hid_input_report.constprop.0+0x319/0x470 drivers/hid/hid-core.c:2168
hid_irq_in+0x55d/0x710 drivers/hid/usbhid/hid-core.c:287
__usb_hcd_giveback_urb+0x38d/0x610 drivers/usb/core/hcd.c:1657
usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
dummy_timer+0xda1/0x36c0 drivers/usb/gadget/udc/dummy_hcd.c:2005
__run_hrtimer kernel/time/hrtimer.c:2032 [inline]
__hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2096
hrtimer_run_softirq+0x17d/0x2c0 kernel/time/hrtimer.c:2113
handle_softirqs+0x1dd/0x990 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x160/0x210 kernel/softirq.c:735
irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:console_flush_one_record+0xac3/0xe50 kernel/printk/printk.c:3270
Code: 00 e8 01 81 29 00 9c 5d 81 e5 00 02 00 00 31 ff 48 89 ee e8 6f 38 21 00 48 85 ed 0f 85 d7 01 00 00 e8 c1 3d 21 00 fb 4c 89 e8 <48> c1 e8 03 42 80 3c 38 00 0f 85 64 03 00 00 48 8b 0c 24 48 8b 6b
RSP: 0018:ffffc90001b26fb0 EFLAGS: 00000283
RAX: ffffffff89ca3e98 RBX: ffffffff89ca3e40 RCX: ffffc9000fbef000
RDX: 0000000000100000 RSI: ffffffff8192c2bf RDI: ffff888115555a00
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 000000000005ec7f
R13: ffffffff89ca3e98 R14: ffffc90001b27030 R15: dffffc0000000000
console_flush_all kernel/printk/printk.c:3343 [inline]
__console_flush_and_unlock kernel/printk/printk.c:3373 [inline]
console_unlock+0x103/0x260 kernel/printk/printk.c:3413
vprintk_emit+0x407/0x6b0 kernel/printk/printk.c:2479
dev_vprintk_emit+0x391/0x3e0 drivers/base/core.c:4996
dev_printk_emit+0xd2/0x10d drivers/base/core.c:5007
__dev_printk+0xcb/0x100 drivers/base/core.c:5019
_dev_err+0xef/0x127 drivers/base/core.c:5062
usb_generic_driver_probe.cold+0x1d/0x3f drivers/usb/core/generic.c:252
usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:628 [inline]
really_probe+0x241/0xa60 drivers/base/dd.c:706
__driver_probe_device+0x20e/0x450 drivers/base/dd.c:868
driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
__device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026
bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
__device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098
device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x64/0x160 drivers/base/bus.c:620
device_add+0x121d/0x1970 drivers/base/core.c:3772
usb_new_device.cold+0x685/0x115c drivers/usb/core/hub.c:2695
hub_port_connect drivers/usb/core/hub.c:5567 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x314d/0x4af0 drivers/usb/core/hub.c:5953
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Allocated by task 5184:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
unpoison_slab_object mm/kasan/common.c:340 [inline]
__kasan_slab_alloc+0x6e/0x70 mm/kasan/common.c:366
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4612 [inline]
slab_alloc_node mm/slub.c:4945 [inline]
kmem_cache_alloc_noprof+0x2e2/0x640 mm/slub.c:4959
alloc_empty_file+0x5b/0x1c0 fs/file_table.c:262
path_openat+0xe7/0x4280 fs/namei.c:4849
do_file_open+0x20e/0x430 fs/namei.c:4892
do_sys_openat2+0x10f/0x1e0 fs/open.c:1368
do_sys_open fs/open.c:1374 [inline]
__do_sys_openat fs/open.c:1390 [inline]
__se_sys_openat fs/open.c:1385 [inline]
__x64_sys_openat+0x12d/0x210 fs/open.c:1385
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x10b/0x7f0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 2857:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x43/0x70 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2705 [inline]
slab_free_after_rcu_debug+0xa2/0x100 mm/slub.c:6467
rcu_do_batch kernel/rcu/tree.c:2645 [inline]
rcu_core+0x5a2/0x10d0 kernel/rcu/tree.c:2897
handle_softirqs+0x1dd/0x990 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x160/0x210 kernel/softirq.c:735
irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
Last potentially related work creation:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_record_aux_stack+0x8c/0xa0 mm/kasan/generic.c:556
slab_free_hook mm/slub.c:2666 [inline]
slab_free mm/slub.c:6405 [inline]
kmem_cache_free+0x408/0x650 mm/slub.c:6532
file_free fs/file_table.c:104 [inline]
__fput+0x68d/0xb50 fs/file_table.c:525
fput_close_sync+0x118/0x250 fs/file_table.c:617
__do_sys_close fs/open.c:1511 [inline]
__se_sys_close fs/open.c:1496 [inline]
__x64_sys_close+0x8b/0x120 fs/open.c:1496
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x10b/0x7f0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff88810a36bdc0
which belongs to the cache filp of size 352
The buggy address is located 223 bytes to the right of
allocated 352-byte region [ffff88810a36bdc0, ffff88810a36bf20)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10a36a
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff888124f5ca01
flags: 0x200000000000040(head|node=0|zone=2)
page_type: f5(slab)
raw: 0200000000000040 ffff8881012eb640 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800120012 00000000f5000000 ffff888124f5ca01
head: 0200000000000040 ffff8881012eb640 dead000000000100 dead000000000122
head: 0000000000000000 0000000800120012 00000000f5000000 ffff888124f5ca01
head: 0200000000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3465, tgid 3465 (kworker/u8:7), ts 62349075866, free_ts 56080091119
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0xf25/0x3400 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x28f/0x2b90 mm/page_alloc.c:5304
alloc_slab_page mm/slub.c:3294 [inline]
allocate_slab mm/slub.c:3408 [inline]
new_slab+0xa2/0x670 mm/slub.c:3454
refill_objects+0xe3/0x410 mm/slub.c:7338
refill_sheaf mm/slub.c:2832 [inline]
__pcs_replace_empty_main+0x376/0x680 mm/slub.c:4703
alloc_from_pcs mm/slub.c:4801 [inline]
slab_alloc_node mm/slub.c:4933 [inline]
kmem_cache_alloc_noprof+0x4de/0x640 mm/slub.c:4959
alloc_empty_file+0x5b/0x1c0 fs/file_table.c:262
path_openat+0xe7/0x4280 fs/namei.c:4849
do_file_open+0x20e/0x430 fs/namei.c:4892
do_open_execat+0xd1/0x2f0 fs/exec.c:785
alloc_bprm+0x2d/0x960 fs/exec.c:1431
class_bprm_constructor fs/exec.c:1496 [inline]
kernel_execve+0x8f/0x3a0 fs/exec.c:1889
call_usermodehelper_exec_async+0x239/0x4b0 kernel/umh.c:109
ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
page last free pid 2975 tgid 2975 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0x716/0xf50 mm/page_alloc.c:2950
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x4e/0x70 mm/kasan/common.c:350
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4612 [inline]
slab_alloc_node mm/slub.c:4945 [inline]
__kmalloc_cache_noprof+0x2f9/0x670 mm/slub.c:5511
_kmalloc_noprof include/linux/slab.h:969 [inline]
call_modprobe kernel/module/kmod.c:84 [inline]
__request_module+0x2b7/0x6a0 kernel/module/kmod.c:173
dev_load+0x204/0x240 net/core/dev_ioctl.c:676
dev_ioctl+0x493/0x10e0 net/core/dev_ioctl.c:741
sock_do_ioctl+0x1a0/0x280 net/socket.c:1314
sock_ioctl+0x465/0x690 net/socket.c:1421
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x10b/0x7f0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff88810a36be80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88810a36bf00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88810a36bf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88810a36c000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88810a36c080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess):
0: 00 e8 add %ch,%al
2: 01 81 29 00 9c 5d add %eax,0x5d9c0029(%rcx)
8: 81 e5 00 02 00 00 and $0x200,%ebp
e: 31 ff xor %edi,%edi
10: 48 89 ee mov %rbp,%rsi
13: e8 6f 38 21 00 call 0x213887
18: 48 85 ed test %rbp,%rbp
1b: 0f 85 d7 01 00 00 jne 0x1f8
21: e8 c1 3d 21 00 call 0x213de7
26: fb sti
27: 4c 89 e8 mov %r13,%rax
* 2a: 48 c1 e8 03 shr $0x3,%rax <-- trapping instruction
2e: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1)
33: 0f 85 64 03 00 00 jne 0x39d
39: 48 8b 0c 24 mov (%rsp),%rcx
3d: 48 rex.W
3e: 8b .byte 0x8b
3f: 6b .byte 0x6b