xpad 7-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19
xpad 7-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19
==================================================================
BUG: KASAN: use-after-free in register_lock_class+0x7d9/0x870 kernel/locking/lockdep.c:1331
Read of size 1 at addr ffff88807bf45891 by task kworker/u4:7/4332
CPU: 0 PID: 4332 Comm: kworker/u4:7 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Workqueue: bat_events batadv_nc_worker
Call Trace:
dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
print_address_description mm/kasan/report.c:316 [inline]
print_report+0xa8/0x210 mm/kasan/report.c:420
kasan_report+0x10b/0x140 mm/kasan/report.c:524
register_lock_class+0x7d9/0x870 kernel/locking/lockdep.c:1331
__lock_acquire+0x172/0x7c40 kernel/locking/lockdep.c:4942
lock_acquire+0x1bb/0x4a0 kernel/locking/lockdep.c:5676
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xb0/0x100 kernel/locking/spinlock.c:162
__wake_up_common_lock kernel/sched/wait.c:137 [inline]
__wake_up+0x107/0x1a0 kernel/sched/wait.c:160
__usb_hcd_giveback_urb+0x394/0x520 drivers/usb/core/hcd.c:1676
dummy_timer+0xa21/0x3420 drivers/usb/gadget/udc/dummy_hcd.c:2004
__run_hrtimer kernel/time/hrtimer.c:1751 [inline]
__hrtimer_run_queues+0x522/0xc90 kernel/time/hrtimer.c:1815
hrtimer_run_softirq+0x173/0x290 kernel/time/hrtimer.c:1832
handle_softirqs+0x291/0x910 kernel/softirq.c:596
__do_softirq kernel/softirq.c:630 [inline]
invoke_softirq kernel/softirq.c:470 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:should_resched arch/x86/include/asm/preempt.h:103 [inline]
RIP: 0010:__local_bh_enable_ip+0x13e/0x1c0 kernel/softirq.c:428
Code: 8a e8 b6 f2 e0 08 65 66 8b 05 2e 67 b4 7e 66 85 c0 75 54 bf 01 00 00 00 e8 6f 82 09 00 e8 9a 5d 39 00 fb 65 8b 05 da 33 b3 7e <85> c0 75 05 e8 e9 47 b1 ff 48 c7 04 24 0e 36 e0 45 4b c7 04 37 00
RSP: 0018:ffffc90004167ac0 EFLAGS: 00000282
RAX: 0000000080000000 RBX: 0000000000000201 RCX: 603fcd481effbe00
RDX: dffffc0000000000 RSI: ffffffff8a8c17a0 RDI: ffffffff8adf5de0
RBP: ffffc90004167b40 R08: ffffffff90b0f31f R09: 1ffffffff2161e63
R10: dffffc0000000000 R11: fffffbfff2161e64 R12: ffffffff89f9d925
R13: ffff8880574a1410 R14: dffffc0000000000 R15: 1ffff9200082cf58
spin_unlock_bh include/linux/spinlock.h:396 [inline]
batadv_nc_purge_paths+0x305/0x3a0 net/batman-adv/network-coding.c:471
batadv_nc_worker+0x35f/0x600 net/batman-adv/network-coding.c:722
process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Allocated by task 3600:
kasan_save_stack mm/kasan/common.c:46 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
____kasan_kmalloc mm/kasan/common.c:375 [inline]
__kasan_kmalloc+0x8e/0xa0 mm/kasan/common.c:384
kmalloc include/linux/slab.h:563 [inline]
kzalloc include/linux/slab.h:699 [inline]
xpad_probe+0x437/0x1ed0 drivers/input/joystick/xpad.c:1971
usb_probe_interface+0x5be/0xae0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x24a/0xb40 drivers/base/dd.c:638
__driver_probe_device+0x1f5/0x390 drivers/base/dd.c:804
driver_probe_device+0x4f/0x420 drivers/base/dd.c:834
__device_attach_driver+0x2c6/0x510 drivers/base/dd.c:962
bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
__device_attach+0x2a7/0x480 drivers/base/dd.c:1034
bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489
device_add+0xbcf/0x1050 drivers/base/core.c:3712
usb_set_configuration+0x19d5/0x2030 drivers/usb/core/message.c:2223
usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
usb_probe_device+0x126/0x250 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x24a/0xb40 drivers/base/dd.c:638
__driver_probe_device+0x1f5/0x390 drivers/base/dd.c:804
driver_probe_device+0x4f/0x420 drivers/base/dd.c:834
__device_attach_driver+0x2c6/0x510 drivers/base/dd.c:962
bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
__device_attach+0x2a7/0x480 drivers/base/dd.c:1034
bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489
device_add+0xbcf/0x1050 drivers/base/core.c:3712
usb_new_device+0xa01/0x15e0 drivers/usb/core/hub.c:2659
hub_port_connect drivers/usb/core/hub.c:5517 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5657 [inline]
port_event drivers/usb/core/hub.c:5817 [inline]
hub_event+0x2b2f/0x5200 drivers/usb/core/hub.c:5899
process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Freed by task 4717:
kasan_save_stack mm/kasan/common.c:46 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:516
____kasan_slab_free+0x126/0x1f0 mm/kasan/common.c:237
kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1729 [inline]
slab_free_freelist_hook+0x133/0x1b0 mm/slub.c:1755
slab_free mm/slub.c:3687 [inline]
__kmem_cache_free+0xb6/0x200 mm/slub.c:3700
xpad_disconnect+0x31f/0x440 drivers/input/joystick/xpad.c:2152
usb_unbind_interface+0x203/0x870 drivers/usb/core/driver.c:458
device_remove drivers/base/dd.c:549 [inline]
__device_release_driver drivers/base/dd.c:1279 [inline]
device_release_driver_internal+0x4cf/0x7c0 drivers/base/dd.c:1305
bus_remove_device+0x2dd/0x400 drivers/base/bus.c:531
device_del+0x63f/0xa80 drivers/base/core.c:3900
usb_disable_device+0x3e7/0x8a0 drivers/usb/core/message.c:1472
usb_disconnect+0x33c/0x8a0 drivers/usb/core/hub.c:2314
hub_port_connect drivers/usb/core/hub.c:5361 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5657 [inline]
port_event drivers/usb/core/hub.c:5817 [inline]
hub_event+0x1d27/0x5200 drivers/usb/core/hub.c:5899
process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Last potentially related work creation:
kasan_save_stack+0x3a/0x60 mm/kasan/common.c:46
__kasan_record_aux_stack+0xb2/0xc0 mm/kasan/generic.c:486
insert_work+0x54/0x3c0 kernel/workqueue.c:1361
__queue_work+0xae2/0xee0 kernel/workqueue.c:1520
queue_work_on+0x124/0x1f0 kernel/workqueue.c:1548
queue_work include/linux/workqueue.h:512 [inline]
schedule_work include/linux/workqueue.h:573 [inline]
xpad360w_process_packet drivers/input/joystick/xpad.c:952 [inline]
xpad_irq_in+0xa51/0x23a0 drivers/input/joystick/xpad.c:1163
__usb_hcd_giveback_urb+0x35d/0x520 drivers/usb/core/hcd.c:1673
dummy_timer+0xa21/0x3420 drivers/usb/gadget/udc/dummy_hcd.c:2004
__run_hrtimer kernel/time/hrtimer.c:1751 [inline]
__hrtimer_run_queues+0x522/0xc90 kernel/time/hrtimer.c:1815
hrtimer_run_softirq+0x173/0x290 kernel/time/hrtimer.c:1832
handle_softirqs+0x291/0x910 kernel/softirq.c:596
__do_softirq kernel/softirq.c:630 [inline]
invoke_softirq kernel/softirq.c:470 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
Second to last potentially related work creation:
kasan_save_stack+0x3a/0x60 mm/kasan/common.c:46
__kasan_record_aux_stack+0xb2/0xc0 mm/kasan/generic.c:486
insert_work+0x54/0x3c0 kernel/workqueue.c:1361
__queue_work+0xae2/0xee0 kernel/workqueue.c:1520
queue_work_on+0x124/0x1f0 kernel/workqueue.c:1548
queue_work include/linux/workqueue.h:512 [inline]
schedule_work include/linux/workqueue.h:573 [inline]
xpad360w_process_packet drivers/input/joystick/xpad.c:952 [inline]
xpad_irq_in+0xa51/0x23a0 drivers/input/joystick/xpad.c:1163
__usb_hcd_giveback_urb+0x35d/0x520 drivers/usb/core/hcd.c:1673
dummy_timer+0xa21/0x3420 drivers/usb/gadget/udc/dummy_hcd.c:2004
__run_hrtimer kernel/time/hrtimer.c:1751 [inline]
__hrtimer_run_queues+0x522/0xc90 kernel/time/hrtimer.c:1815
hrtimer_run_softirq+0x173/0x290 kernel/time/hrtimer.c:1832
handle_softirqs+0x291/0x910 kernel/softirq.c:596
__do_softirq kernel/softirq.c:630 [inline]
invoke_softirq kernel/softirq.c:470 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
The buggy address belongs to the object at ffff88807bf45800
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 145 bytes inside of
1024-byte region [ffff88807bf45800, ffff88807bf45c00)
The buggy address belongs to the physical page:
page:ffffea0001efd000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7bf40
head:ffffea0001efd000 order:3 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 ffffea0001dee800 dead000000000002 ffff888017441dc0
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 0, tgid 0 (swapper/0), ts 64591512832, free_ts 62495249829
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x173/0x1a0 mm/page_alloc.c:2560
prep_new_page mm/page_alloc.c:2567 [inline]
get_page_from_freelist+0x206b/0x2180 mm/page_alloc.c:4358
__alloc_pages+0x1ec/0x4f0 mm/page_alloc.c:5658
alloc_slab_page+0x5d/0x180 mm/slub.c:1799
allocate_slab mm/slub.c:1944 [inline]
new_slab+0x87/0x2d0 mm/slub.c:1997
___slab_alloc+0xbc5/0x1240 mm/slub.c:3154
__slab_alloc mm/slub.c:3240 [inline]
slab_alloc_node mm/slub.c:3325 [inline]
__kmem_cache_alloc_node+0x126/0x270 mm/slub.c:3398
__do_kmalloc_node mm/slab_common.c:935 [inline]
__kmalloc+0xa3/0x240 mm/slab_common.c:949
kmalloc include/linux/slab.h:568 [inline]
kzalloc include/linux/slab.h:699 [inline]
neigh_alloc net/core/neighbour.c:495 [inline]
___neigh_create+0x6f4/0x2450 net/core/neighbour.c:649
__neigh_create net/core/neighbour.c:738 [inline]
neigh_create include/net/neighbour.h:346 [inline]
__neigh_lookup include/net/neighbour.h:556 [inline]
neigh_event_ns+0xc8/0x120 net/core/neighbour.c:1519
arp_process+0x1382/0x1860 net/ipv4/arp.c:852
NF_HOOK+0x32d/0x3b0 include/linux/netfilter.h:-1
__netif_receive_skb_list_ptype net/core/dev.c:5667 [inline]
__netif_receive_skb_list_core+0x704/0x770 net/core/dev.c:5710
__netif_receive_skb_list net/core/dev.c:5762 [inline]
netif_receive_skb_list_internal+0x93f/0xca0 net/core/dev.c:5853
gro_normal_list include/net/gro.h:433 [inline]
napi_complete_done+0x37e/0x850 net/core/dev.c:6194
virtqueue_napi_complete drivers/net/virtio_net.c:404 [inline]
virtnet_poll+0x9c3/0x1140 drivers/net/virtio_net.c:1724
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1487 [inline]
free_pcp_prepare mm/page_alloc.c:1537 [inline]
free_unref_page_prepare+0x8e5/0x9e0 mm/page_alloc.c:3414
free_unref_page+0x2e/0x3f0 mm/page_alloc.c:3509
free_slab mm/slub.c:2036 [inline]
discard_slab mm/slub.c:2042 [inline]
__unfreeze_partials+0x188/0x1e0 mm/slub.c:2591
put_cpu_partial+0x17c/0x250 mm/slub.c:2667
qlink_free mm/kasan/quarantine.c:168 [inline]
qlist_free_all+0x76/0xe0 mm/kasan/quarantine.c:187
kasan_quarantine_reduce+0x144/0x160 mm/kasan/quarantine.c:294
__kasan_slab_alloc+0x1e/0x80 mm/kasan/common.c:306
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook+0x4b/0x490 mm/slab.h:737
slab_alloc_node mm/slub.c:3359 [inline]
kmem_cache_alloc_node+0x1ad/0x310 mm/slub.c:3404
__alloc_skb+0xf9/0x7d0 net/core/skbuff.c:505
alloc_skb include/linux/skbuff.h:1303 [inline]
alloc_skb_with_frags+0xa7/0x710 net/core/skbuff.c:6186
sock_alloc_send_pskb+0x87f/0x9a0 net/core/sock.c:2764
unix_dgram_sendmsg+0x5c1/0x16f0 net/unix/af_unix.c:1945
sock_sendmsg_nosec net/socket.c:718 [inline]
__sock_sendmsg net/socket.c:730 [inline]
sock_write_iter+0x2d5/0x3e0 net/socket.c:1144
call_write_iter include/linux/fs.h:2265 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x482/0x9a0 fs/read_write.c:584
ksys_write+0x14d/0x260 fs/read_write.c:637
Memory state around the buggy address:
ffff88807bf45780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88807bf45800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88807bf45880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88807bf45900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88807bf45980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
0: 8a e8 mov %al,%ch
2: b6 f2 mov $0xf2,%dh
4: e0 08 loopne 0xe
6: 65 66 8b 05 2e 67 b4 mov %gs:0x7eb4672e(%rip),%ax # 0x7eb4673c
d: 7e
e: 66 85 c0 test %ax,%ax
11: 75 54 jne 0x67
13: bf 01 00 00 00 mov $0x1,%edi
18: e8 6f 82 09 00 call 0x9828c
1d: e8 9a 5d 39 00 call 0x395dbc
22: fb sti
23: 65 8b 05 da 33 b3 7e mov %gs:0x7eb333da(%rip),%eax # 0x7eb33404
* 2a: 85 c0 test %eax,%eax <-- trapping instruction
2c: 75 05 jne 0x33
2e: e8 e9 47 b1 ff call 0xffb1481c
33: 48 c7 04 24 0e 36 e0 movq $0x45e0360e,(%rsp)
3a: 45
3b: 4b rex.WXB
3c: c7 .byte 0xc7
3d: 04 37 add $0x37,%al