==================================================================
BUG: KASAN: slab-out-of-bounds in mcp2221_raw_event+0x1070/0x10a0 drivers/hid/hid-mcp2221.c:948
Read of size 1 at addr ffff88811da47fff by task kworker/1:9/20921
CPU: 1 UID: 0 PID: 20921 Comm: kworker/1:9 Not tainted syzkaller #0 PREEMPT(voluntary)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xcd/0x630 mm/kasan/report.c:482
kasan_report+0xe0/0x110 mm/kasan/report.c:595
mcp2221_raw_event+0x1070/0x10a0 drivers/hid/hid-mcp2221.c:948
__hid_input_report.constprop.0+0x314/0x450 drivers/hid/hid-core.c:2130
hid_irq_in+0x35e/0x870 drivers/hid/usbhid/hid-core.c:286
__usb_hcd_giveback_urb+0x38b/0x610 drivers/usb/core/hcd.c:1661
usb_hcd_giveback_urb+0x39b/0x450 drivers/usb/core/hcd.c:1745
dummy_timer+0x1809/0x3a00 drivers/usb/gadget/udc/dummy_hcd.c:1995
__run_hrtimer kernel/time/hrtimer.c:1761 [inline]
__hrtimer_run_queues+0x1ff/0xad0 kernel/time/hrtimer.c:1825
hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1842
handle_softirqs+0x208/0x8d0 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xfa/0x160 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1050
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:console_flush_all+0x9a2/0xc60 kernel/printk/printk.c:3227
Code: 00 e8 62 85 28 00 9c 5b 81 e3 00 02 00 00 31 ff 48 89 de e8 c0 a5 20 00 48 85 db 0f 85 55 01 00 00 e8 42 aa 20 00 fb 4c 89 e0 <48> c1 e8 03 42 80 3c 38 00 0f 84 11 ff ff ff 4c 89 e7 e8 77 dc 7e
RSP: 0018:ffffc9000177f428 EFLAGS: 00000287
RAX: ffffffff897db958 RBX: 0000000000000000 RCX: ffffc90015573000
RDX: 0000000000100000 RSI: ffffffff815d50ae RDI: 0000000000000007
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff897db958
R13: ffffffff897db900 R14: ffffc9000177f4b8 R15: dffffc0000000000
__console_flush_and_unlock kernel/printk/printk.c:3285 [inline]
console_unlock+0xd8/0x210 kernel/printk/printk.c:3325
vprintk_emit+0x418/0x6d0 kernel/printk/printk.c:2450
dev_vprintk_emit drivers/base/core.c:4914 [inline]
dev_printk_emit+0xfa/0x140 drivers/base/core.c:4925
__dev_printk+0xf5/0x270 drivers/base/core.c:4937
_dev_info+0xe4/0x120 drivers/base/core.c:4983
show_string drivers/usb/core/hub.c:2400 [inline]
show_string drivers/usb/core/hub.c:2396 [inline]
announce_device drivers/usb/core/hub.c:2418 [inline]
usb_new_device+0x8fc/0x1a60 drivers/usb/core/hub.c:2675
hub_port_connect drivers/usb/core/hub.c:5566 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5706 [inline]
port_event drivers/usb/core/hub.c:5870 [inline]
hub_event+0x2fce/0x5060 drivers/usb/core/hub.c:5952
process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3236
process_scheduled_works kernel/workqueue.c:3319 [inline]
worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400
kthread+0x3c5/0x780 kernel/kthread.c:463
ret_from_fork+0x56d/0x700 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Allocated by task 5213:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:330 [inline]
__kasan_slab_alloc+0x6e/0x70 mm/kasan/common.c:356
kasan_slab_alloc include/linux/kasan.h:250 [inline]
slab_post_alloc_hook mm/slub.c:4191 [inline]
slab_alloc_node mm/slub.c:4240 [inline]
kmem_cache_alloc_noprof+0x14f/0x3b0 mm/slub.c:4247
alloc_empty_file+0x55/0x1e0 fs/file_table.c:237
path_openat+0xda/0x2cb0 fs/namei.c:4032
do_filp_open+0x20b/0x470 fs/namei.c:4073
do_sys_openat2+0x11b/0x1d0 fs/open.c:1435
do_sys_open fs/open.c:1450 [inline]
__do_sys_openat fs/open.c:1466 [inline]
__se_sys_openat fs/open.c:1461 [inline]
__x64_sys_openat+0x174/0x210 fs/open.c:1461
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x4d0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 2852:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:243 [inline]
__kasan_slab_free+0x3e/0x50 mm/kasan/common.c:275
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2422 [inline]
slab_free_after_rcu_debug+0xc9/0x2a0 mm/slub.c:4745
rcu_do_batch kernel/rcu/tree.c:2605 [inline]
rcu_core+0x79c/0x1530 kernel/rcu/tree.c:2861
handle_softirqs+0x208/0x8d0 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xfa/0x160 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0x43/0xb0 arch/x86/kernel/apic/apic.c:1050
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
Last potentially related work creation:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_record_aux_stack+0x8c/0xa0 mm/kasan/generic.c:548
slab_free_hook mm/slub.c:2383 [inline]
slab_free mm/slub.c:4695 [inline]
kmem_cache_free+0x13b/0x470 mm/slub.c:4797
file_free fs/file_table.c:79 [inline]
__fput+0x68d/0xb70 fs/file_table.c:481
fput_close_sync+0x118/0x210 fs/file_table.c:573
__do_sys_close fs/open.c:1587 [inline]
__se_sys_close fs/open.c:1572 [inline]
__x64_sys_close+0x8b/0x120 fs/open.c:1572
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x4d0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff88811da47dc0
which belongs to the cache filp of size 360
The buggy address is located 215 bytes to the right of
allocated 360-byte region [ffff88811da47dc0, ffff88811da47f28)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11da46
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff888133377901
anon flags: 0x200000000000040(head|node=0|zone=2)
page_type: f5(slab)
raw: 0200000000000040 ffff8881012a13c0 0000000000000000 dead000000000001
raw: 0000000000000000 0000000000120012 00000000f5000000 ffff888133377901
head: 0200000000000040 ffff8881012a13c0 0000000000000000 dead000000000001
head: 0000000000000000 0000000000120012 00000000f5000000 ffff888133377901
head: 0200000000000001 ffffea0004769181 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 2855, tgid 2855 (udevd), ts 20060785801, free_ts 0
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1c0/0x230 mm/page_alloc.c:1851
prep_new_page mm/page_alloc.c:1859 [inline]
get_page_from_freelist+0xf98/0x2ce0 mm/page_alloc.c:3858
__alloc_frozen_pages_noprof+0x259/0x21e0 mm/page_alloc.c:5148
alloc_pages_mpol+0xe4/0x410 mm/mempolicy.c:2416
alloc_slab_page mm/slub.c:2492 [inline]
allocate_slab mm/slub.c:2660 [inline]
new_slab+0x247/0x330 mm/slub.c:2714
___slab_alloc+0xc55/0x1620 mm/slub.c:3901
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3992
__slab_alloc_node mm/slub.c:4067 [inline]
slab_alloc_node mm/slub.c:4228 [inline]
kmem_cache_alloc_noprof+0x1f9/0x3b0 mm/slub.c:4247
alloc_empty_file+0x55/0x1e0 fs/file_table.c:237
path_openat+0xda/0x2cb0 fs/namei.c:4032
do_filp_open+0x20b/0x470 fs/namei.c:4073
do_sys_openat2+0x11b/0x1d0 fs/open.c:1435
do_sys_open fs/open.c:1450 [inline]
__do_sys_openat fs/open.c:1466 [inline]
__se_sys_openat fs/open.c:1461 [inline]
__x64_sys_openat+0x174/0x210 fs/open.c:1461
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x4d0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page_owner free stack trace missing
Memory state around the buggy address:
ffff88811da47e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88811da47f00: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc
>ffff88811da47f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88811da48000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88811da48080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess), 1 bytes skipped:
0: e8 62 85 28 00 call 0x288567
5: 9c pushf
6: 5b pop %rbx
7: 81 e3 00 02 00 00 and $0x200,%ebx
d: 31 ff xor %edi,%edi
f: 48 89 de mov %rbx,%rsi
12: e8 c0 a5 20 00 call 0x20a5d7
17: 48 85 db test %rbx,%rbx
1a: 0f 85 55 01 00 00 jne 0x175
20: e8 42 aa 20 00 call 0x20aa67
25: fb sti
26: 4c 89 e0 mov %r12,%rax
* 29: 48 c1 e8 03 shr $0x3,%rax <-- trapping instruction
2d: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1)
32: 0f 84 11 ff ff ff je 0xffffff49
38: 4c 89 e7 mov %r12,%rdi
3b: e8 .byte 0xe8
3c: 77 dc ja 0x1a
3e: 7e .byte 0x7e