[v6.1] KASAN: use-after-free Read in hid_device_remove
0 views
Skip to first unread message
syzbot
Apr 18, 2026, 9:50:23 AM (3 days ago) Apr 18
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 7c87defbd336 Linux 6.1.169
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=14a81702580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f0605c5af04d7603
dashboard link: https://syzkaller.appspot.com/bug?extid=8077db9eb146f9e0fb34
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8d71e14f22ca/disk-7c87defb.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/49c26e1231bb/vmlinux-7c87defb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/bac8352e3eab/bzImage-7c87defb.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8077db...@syzkaller.appspotmail.com
usb 3-1: USB disconnect, device number 8
==================================================================
BUG: KASAN: use-after-free in debug_spin_lock_before kernel/locking/spinlock_debug.c:85 [inline]
BUG: KASAN: use-after-free in do_raw_spin_lock+0x283/0x2f0 kernel/locking/spinlock_debug.c:114
Read of size 4 at addr ffff888057cbac1c by task kworker/0:9/4813
CPU: 0 PID: 4813 Comm: kworker/0:9 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
<TASK>
dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
print_address_description mm/kasan/report.c:316 [inline]
print_report+0xa8/0x210 mm/kasan/report.c:420
kasan_report+0x10b/0x140 mm/kasan/report.c:524
debug_spin_lock_before kernel/locking/spinlock_debug.c:85 [inline]
do_raw_spin_lock+0x283/0x2f0 kernel/locking/spinlock_debug.c:114
__mutex_unlock_slowpath+0x36e/0x6c0 kernel/locking/mutex.c:932
hid_disconnect drivers/hid/hid-core.c:2290 [inline]
hid_hw_stop drivers/hid/hid-core.c:2335 [inline]
hid_device_remove+0x17b/0x330 drivers/hid/hid-core.c:2677
device_remove drivers/base/dd.c:548 [inline]
__device_release_driver drivers/base/dd.c:1260 [inline]
device_release_driver_internal+0x4be/0x850 drivers/base/dd.c:1286
bus_remove_device+0x2e2/0x400 drivers/base/bus.c:531
device_del+0x6af/0xaf0 drivers/base/core.c:3885
hid_remove_device drivers/hid/hid-core.c:2847 [inline]
hid_destroy_device+0x66/0x100 drivers/hid/hid-core.c:2866
usbhid_disconnect+0x9b/0xc0 drivers/hid/usbhid/hid-core.c:1469
usb_unbind_interface+0x1ee/0x860 drivers/usb/core/driver.c:458
device_remove drivers/base/dd.c:550 [inline]
__device_release_driver drivers/base/dd.c:1260 [inline]
device_release_driver_internal+0x522/0x850 drivers/base/dd.c:1286
bus_remove_device+0x2e2/0x400 drivers/base/bus.c:531
device_del+0x6af/0xaf0 drivers/base/core.c:3885
usb_disable_device+0x3e2/0x890 drivers/usb/core/message.c:1472
usb_disconnect+0x348/0x8a0 drivers/usb/core/hub.c:2314
hub_port_connect drivers/usb/core/hub.c:5361 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5657 [inline]
port_event drivers/usb/core/hub.c:5817 [inline]
hub_event+0x1e50/0x5560 drivers/usb/core/hub.c:5899
process_one_work+0x8a2/0x1160 kernel/workqueue.c:2292
worker_thread+0xaa2/0x1270 kernel/workqueue.c:2439
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>
Allocated by task 4314:
kasan_save_stack mm/kasan/common.c:46 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
____kasan_kmalloc mm/kasan/common.c:375 [inline]
__kasan_kmalloc+0x8e/0xa0 mm/kasan/common.c:384
kmalloc include/linux/slab.h:563 [inline]
kzalloc include/linux/slab.h:699 [inline]
hiddev_connect+0x94/0x5c0 drivers/hid/usbhid/hiddev.c:893
hid_connect+0x54f/0x1970 drivers/hid/hid-core.c:2207
hid_hw_start+0x99/0x100 drivers/hid/hid-core.c:2315
plantronics_probe+0x2cc/0x380 drivers/hid/hid-plantronics.c:209
hid_device_probe+0x25c/0x350 drivers/hid/hid-core.c:2646
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x2aa/0xc70 drivers/base/dd.c:639
__driver_probe_device+0x18c/0x330 drivers/base/dd.c:785
driver_probe_device+0x4f/0x420 drivers/base/dd.c:815
__device_attach_driver+0x2c6/0x510 drivers/base/dd.c:943
bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
__device_attach+0x2a8/0x480 drivers/base/dd.c:1015
bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489
device_add+0xa00/0xfb0 drivers/base/core.c:3697
hid_add_device+0x389/0x530 drivers/hid/hid-core.c:2798
usbhid_probe+0xc09/0xfe0 drivers/hid/usbhid/hid-core.c:1442
usb_probe_interface+0x5c5/0xb20 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x2aa/0xc70 drivers/base/dd.c:639
__driver_probe_device+0x18c/0x330 drivers/base/dd.c:785
driver_probe_device+0x4f/0x420 drivers/base/dd.c:815
__device_attach_driver+0x2c6/0x510 drivers/base/dd.c:943
bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
__device_attach+0x2a8/0x480 drivers/base/dd.c:1015
bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489
device_add+0xa00/0xfb0 drivers/base/core.c:3697
usb_set_configuration+0x1991/0x1fd0 drivers/usb/core/message.c:2223
usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
usb_probe_device+0x139/0x270 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x2aa/0xc70 drivers/base/dd.c:639
__driver_probe_device+0x18c/0x330 drivers/base/dd.c:785
driver_probe_device+0x4f/0x420 drivers/base/dd.c:815
__device_attach_driver+0x2c6/0x510 drivers/base/dd.c:943
bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
__device_attach+0x2a8/0x480 drivers/base/dd.c:1015
bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489
device_add+0xa00/0xfb0 drivers/base/core.c:3697
usb_new_device+0xd66/0x1650 drivers/usb/core/hub.c:2659
hub_port_connect drivers/usb/core/hub.c:5517 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5657 [inline]
port_event drivers/usb/core/hub.c:5817 [inline]
hub_event+0x2dcf/0x5560 drivers/usb/core/hub.c:5899
process_one_work+0x8a2/0x1160 kernel/workqueue.c:2292
worker_thread+0xaa2/0x1270 kernel/workqueue.c:2439
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Freed by task 11256:
kasan_save_stack mm/kasan/common.c:46 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
kasan_save_free_info+0x2d/0x50 mm/kasan/generic.c:516
____kasan_slab_free+0x126/0x1e0 mm/kasan/common.c:237
kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1729 [inline]
slab_free_freelist_hook+0x131/0x1a0 mm/slub.c:1755
slab_free mm/slub.c:3687 [inline]
__kmem_cache_free+0xb6/0x1f0 mm/slub.c:3700
hiddev_release+0x33e/0x390 drivers/hid/usbhid/hiddev.c:232
__fput+0x22c/0x920 fs/file_table.c:320
task_work_run+0x1d0/0x260 kernel/task_work.c:203
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210
__syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:303
do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x68/0xd2
Last potentially related work creation:
kasan_save_stack+0x3a/0x60 mm/kasan/common.c:46
__kasan_record_aux_stack+0xb2/0xc0 mm/kasan/generic.c:486
call_rcu+0x14f/0x990 kernel/rcu/tree.c:2849
inetdev_destroy net/ipv4/devinet.c:333 [inline]
inetdev_event+0x777/0x1400 net/ipv4/devinet.c:1615
notifier_call_chain kernel/notifier.c:87 [inline]
raw_notifier_call_chain+0xcb/0x160 kernel/notifier.c:455
call_netdevice_notifiers_extack net/core/dev.c:2052 [inline]
call_netdevice_notifiers net/core/dev.c:2066 [inline]
unregister_netdevice_many_notify+0x10ac/0x19c0 net/core/dev.c:11023
ip6_tnl_exit_batch_net+0x5d7/0x620 net/ipv6/ip6_tunnel.c:2302
ops_exit_list net/core/net_namespace.c:177 [inline]
cleanup_net+0x791/0xba0 net/core/net_namespace.c:640
process_one_work+0x8a2/0x1160 kernel/workqueue.c:2292
worker_thread+0xaa2/0x1270 kernel/workqueue.c:2439
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Second to last potentially related work creation:
kasan_save_stack+0x3a/0x60 mm/kasan/common.c:46
__kasan_record_aux_stack+0xb2/0xc0 mm/kasan/generic.c:486
insert_work+0x54/0x3c0 kernel/workqueue.c:1361
__queue_work+0xba3/0xfb0 kernel/workqueue.c:1520
call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701
expire_timers kernel/time/timer.c:1747 [inline]
__run_timers+0x569/0x800 kernel/time/timer.c:2023
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036
handle_softirqs+0x2a1/0x930 kernel/softirq.c:596
__do_softirq kernel/softirq.c:630 [inline]
invoke_softirq kernel/softirq.c:470 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
The buggy address belongs to the object at ffff888057cbac00
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 28 bytes inside of
512-byte region [ffff888057cbac00, ffff888057cbae00)
The buggy address belongs to the physical page:
page:ffffea00015f2e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x57cb8
head:ffffea00015f2e00 order:2 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 0000000000000000 dead000000000001 ffff888017441c80
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4279, tgid 4279 (syz-executor), ts 71811380548, free_ts 21061910654
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x173/0x1a0 mm/page_alloc.c:2559
prep_new_page mm/page_alloc.c:2566 [inline]
get_page_from_freelist+0x1a1e/0x1ab0 mm/page_alloc.c:4357
__alloc_pages+0x1ec/0x4f0 mm/page_alloc.c:5657
alloc_slab_page+0x5d/0x160 mm/slub.c:1799
allocate_slab mm/slub.c:1944 [inline]
new_slab+0x87/0x2c0 mm/slub.c:1997
___slab_alloc+0xbc6/0x1240 mm/slub.c:3154
__slab_alloc mm/slub.c:3240 [inline]
slab_alloc_node mm/slub.c:3325 [inline]
__kmem_cache_alloc_node+0x1a0/0x260 mm/slub.c:3398
__do_kmalloc_node mm/slab_common.c:935 [inline]
__kmalloc_node_track_caller+0x9e/0x230 mm/slab_common.c:956
kmalloc_reserve net/core/skbuff.c:446 [inline]
__alloc_skb+0x22a/0x7e0 net/core/skbuff.c:515
alloc_skb include/linux/skbuff.h:1303 [inline]
netlink_alloc_large_skb net/netlink/af_netlink.c:1182 [inline]
netlink_sendmsg+0x654/0xbd0 net/netlink/af_netlink.c:1847
sock_sendmsg_nosec net/socket.c:718 [inline]
__sock_sendmsg net/socket.c:730 [inline]
__sys_sendto+0x497/0x650 net/socket.c:2152
__do_sys_sendto net/socket.c:2164 [inline]
__se_sys_sendto net/socket.c:2160 [inline]
__x64_sys_sendto+0xda/0xf0 net/socket.c:2160
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1486 [inline]
free_pcp_prepare mm/page_alloc.c:1536 [inline]
free_unref_page_prepare+0x8b4/0x9a0 mm/page_alloc.c:3413
free_unref_page+0x2e/0x3f0 mm/page_alloc.c:3508
free_contig_range+0x9d/0x150 mm/page_alloc.c:9625
destroy_args+0xf0/0xa0a mm/debug_vm_pgtable.c:1031
debug_vm_pgtable+0x33c/0x38e mm/debug_vm_pgtable.c:1359
do_one_initcall+0x26a/0x840 init/main.c:1310
do_initcall_level+0x137/0x1e4 init/main.c:1383
do_initcalls+0x4b/0x8a init/main.c:1399
kernel_init_freeable+0x415/0x5be init/main.c:1638
kernel_init+0x19/0x1b0 init/main.c:1526
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Memory state around the buggy address:
ffff888057cbab00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888057cbab80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888057cbac00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888057cbac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888057cbad00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 7c87defbd336 Linux 6.1.169
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=14a81702580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f0605c5af04d7603
dashboard link: https://syzkaller.appspot.com/bug?extid=8077db9eb146f9e0fb34
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8d71e14f22ca/disk-7c87defb.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/49c26e1231bb/vmlinux-7c87defb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/bac8352e3eab/bzImage-7c87defb.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8077db...@syzkaller.appspotmail.com
usb 3-1: USB disconnect, device number 8
==================================================================
BUG: KASAN: use-after-free in debug_spin_lock_before kernel/locking/spinlock_debug.c:85 [inline]
BUG: KASAN: use-after-free in do_raw_spin_lock+0x283/0x2f0 kernel/locking/spinlock_debug.c:114
Read of size 4 at addr ffff888057cbac1c by task kworker/0:9/4813
CPU: 0 PID: 4813 Comm: kworker/0:9 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
<TASK>
dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
print_address_description mm/kasan/report.c:316 [inline]
print_report+0xa8/0x210 mm/kasan/report.c:420
kasan_report+0x10b/0x140 mm/kasan/report.c:524
debug_spin_lock_before kernel/locking/spinlock_debug.c:85 [inline]
do_raw_spin_lock+0x283/0x2f0 kernel/locking/spinlock_debug.c:114
__mutex_unlock_slowpath+0x36e/0x6c0 kernel/locking/mutex.c:932
hid_disconnect drivers/hid/hid-core.c:2290 [inline]
hid_hw_stop drivers/hid/hid-core.c:2335 [inline]
hid_device_remove+0x17b/0x330 drivers/hid/hid-core.c:2677
device_remove drivers/base/dd.c:548 [inline]
__device_release_driver drivers/base/dd.c:1260 [inline]
device_release_driver_internal+0x4be/0x850 drivers/base/dd.c:1286
bus_remove_device+0x2e2/0x400 drivers/base/bus.c:531
device_del+0x6af/0xaf0 drivers/base/core.c:3885
hid_remove_device drivers/hid/hid-core.c:2847 [inline]
hid_destroy_device+0x66/0x100 drivers/hid/hid-core.c:2866
usbhid_disconnect+0x9b/0xc0 drivers/hid/usbhid/hid-core.c:1469
usb_unbind_interface+0x1ee/0x860 drivers/usb/core/driver.c:458
device_remove drivers/base/dd.c:550 [inline]
__device_release_driver drivers/base/dd.c:1260 [inline]
device_release_driver_internal+0x522/0x850 drivers/base/dd.c:1286
bus_remove_device+0x2e2/0x400 drivers/base/bus.c:531
device_del+0x6af/0xaf0 drivers/base/core.c:3885
usb_disable_device+0x3e2/0x890 drivers/usb/core/message.c:1472
usb_disconnect+0x348/0x8a0 drivers/usb/core/hub.c:2314
hub_port_connect drivers/usb/core/hub.c:5361 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5657 [inline]
port_event drivers/usb/core/hub.c:5817 [inline]
hub_event+0x1e50/0x5560 drivers/usb/core/hub.c:5899
process_one_work+0x8a2/0x1160 kernel/workqueue.c:2292
worker_thread+0xaa2/0x1270 kernel/workqueue.c:2439
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>
Allocated by task 4314:
kasan_save_stack mm/kasan/common.c:46 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
____kasan_kmalloc mm/kasan/common.c:375 [inline]
__kasan_kmalloc+0x8e/0xa0 mm/kasan/common.c:384
kmalloc include/linux/slab.h:563 [inline]
kzalloc include/linux/slab.h:699 [inline]
hiddev_connect+0x94/0x5c0 drivers/hid/usbhid/hiddev.c:893
hid_connect+0x54f/0x1970 drivers/hid/hid-core.c:2207
hid_hw_start+0x99/0x100 drivers/hid/hid-core.c:2315
plantronics_probe+0x2cc/0x380 drivers/hid/hid-plantronics.c:209
hid_device_probe+0x25c/0x350 drivers/hid/hid-core.c:2646
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x2aa/0xc70 drivers/base/dd.c:639
__driver_probe_device+0x18c/0x330 drivers/base/dd.c:785
driver_probe_device+0x4f/0x420 drivers/base/dd.c:815
__device_attach_driver+0x2c6/0x510 drivers/base/dd.c:943
bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
__device_attach+0x2a8/0x480 drivers/base/dd.c:1015
bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489
device_add+0xa00/0xfb0 drivers/base/core.c:3697
hid_add_device+0x389/0x530 drivers/hid/hid-core.c:2798
usbhid_probe+0xc09/0xfe0 drivers/hid/usbhid/hid-core.c:1442
usb_probe_interface+0x5c5/0xb20 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x2aa/0xc70 drivers/base/dd.c:639
__driver_probe_device+0x18c/0x330 drivers/base/dd.c:785
driver_probe_device+0x4f/0x420 drivers/base/dd.c:815
__device_attach_driver+0x2c6/0x510 drivers/base/dd.c:943
bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
__device_attach+0x2a8/0x480 drivers/base/dd.c:1015
bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489
device_add+0xa00/0xfb0 drivers/base/core.c:3697
usb_set_configuration+0x1991/0x1fd0 drivers/usb/core/message.c:2223
usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
usb_probe_device+0x139/0x270 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x2aa/0xc70 drivers/base/dd.c:639
__driver_probe_device+0x18c/0x330 drivers/base/dd.c:785
driver_probe_device+0x4f/0x420 drivers/base/dd.c:815
__device_attach_driver+0x2c6/0x510 drivers/base/dd.c:943
bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
__device_attach+0x2a8/0x480 drivers/base/dd.c:1015
bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489
device_add+0xa00/0xfb0 drivers/base/core.c:3697
usb_new_device+0xd66/0x1650 drivers/usb/core/hub.c:2659
hub_port_connect drivers/usb/core/hub.c:5517 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5657 [inline]
port_event drivers/usb/core/hub.c:5817 [inline]
hub_event+0x2dcf/0x5560 drivers/usb/core/hub.c:5899
process_one_work+0x8a2/0x1160 kernel/workqueue.c:2292
worker_thread+0xaa2/0x1270 kernel/workqueue.c:2439
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Freed by task 11256:
kasan_save_stack mm/kasan/common.c:46 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
kasan_save_free_info+0x2d/0x50 mm/kasan/generic.c:516
____kasan_slab_free+0x126/0x1e0 mm/kasan/common.c:237
kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1729 [inline]
slab_free_freelist_hook+0x131/0x1a0 mm/slub.c:1755
slab_free mm/slub.c:3687 [inline]
__kmem_cache_free+0xb6/0x1f0 mm/slub.c:3700
hiddev_release+0x33e/0x390 drivers/hid/usbhid/hiddev.c:232
__fput+0x22c/0x920 fs/file_table.c:320
task_work_run+0x1d0/0x260 kernel/task_work.c:203
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210
__syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:303
do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x68/0xd2
Last potentially related work creation:
kasan_save_stack+0x3a/0x60 mm/kasan/common.c:46
__kasan_record_aux_stack+0xb2/0xc0 mm/kasan/generic.c:486
call_rcu+0x14f/0x990 kernel/rcu/tree.c:2849
inetdev_destroy net/ipv4/devinet.c:333 [inline]
inetdev_event+0x777/0x1400 net/ipv4/devinet.c:1615
notifier_call_chain kernel/notifier.c:87 [inline]
raw_notifier_call_chain+0xcb/0x160 kernel/notifier.c:455
call_netdevice_notifiers_extack net/core/dev.c:2052 [inline]
call_netdevice_notifiers net/core/dev.c:2066 [inline]
unregister_netdevice_many_notify+0x10ac/0x19c0 net/core/dev.c:11023
ip6_tnl_exit_batch_net+0x5d7/0x620 net/ipv6/ip6_tunnel.c:2302
ops_exit_list net/core/net_namespace.c:177 [inline]
cleanup_net+0x791/0xba0 net/core/net_namespace.c:640
process_one_work+0x8a2/0x1160 kernel/workqueue.c:2292
worker_thread+0xaa2/0x1270 kernel/workqueue.c:2439
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Second to last potentially related work creation:
kasan_save_stack+0x3a/0x60 mm/kasan/common.c:46
__kasan_record_aux_stack+0xb2/0xc0 mm/kasan/generic.c:486
insert_work+0x54/0x3c0 kernel/workqueue.c:1361
__queue_work+0xba3/0xfb0 kernel/workqueue.c:1520
call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701
expire_timers kernel/time/timer.c:1747 [inline]
__run_timers+0x569/0x800 kernel/time/timer.c:2023
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036
handle_softirqs+0x2a1/0x930 kernel/softirq.c:596
__do_softirq kernel/softirq.c:630 [inline]
invoke_softirq kernel/softirq.c:470 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
The buggy address belongs to the object at ffff888057cbac00
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 28 bytes inside of
512-byte region [ffff888057cbac00, ffff888057cbae00)
The buggy address belongs to the physical page:
page:ffffea00015f2e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x57cb8
head:ffffea00015f2e00 order:2 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 0000000000000000 dead000000000001 ffff888017441c80
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4279, tgid 4279 (syz-executor), ts 71811380548, free_ts 21061910654
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x173/0x1a0 mm/page_alloc.c:2559
prep_new_page mm/page_alloc.c:2566 [inline]
get_page_from_freelist+0x1a1e/0x1ab0 mm/page_alloc.c:4357
__alloc_pages+0x1ec/0x4f0 mm/page_alloc.c:5657
alloc_slab_page+0x5d/0x160 mm/slub.c:1799
allocate_slab mm/slub.c:1944 [inline]
new_slab+0x87/0x2c0 mm/slub.c:1997
___slab_alloc+0xbc6/0x1240 mm/slub.c:3154
__slab_alloc mm/slub.c:3240 [inline]
slab_alloc_node mm/slub.c:3325 [inline]
__kmem_cache_alloc_node+0x1a0/0x260 mm/slub.c:3398
__do_kmalloc_node mm/slab_common.c:935 [inline]
__kmalloc_node_track_caller+0x9e/0x230 mm/slab_common.c:956
kmalloc_reserve net/core/skbuff.c:446 [inline]
__alloc_skb+0x22a/0x7e0 net/core/skbuff.c:515
alloc_skb include/linux/skbuff.h:1303 [inline]
netlink_alloc_large_skb net/netlink/af_netlink.c:1182 [inline]
netlink_sendmsg+0x654/0xbd0 net/netlink/af_netlink.c:1847
sock_sendmsg_nosec net/socket.c:718 [inline]
__sock_sendmsg net/socket.c:730 [inline]
__sys_sendto+0x497/0x650 net/socket.c:2152
__do_sys_sendto net/socket.c:2164 [inline]
__se_sys_sendto net/socket.c:2160 [inline]
__x64_sys_sendto+0xda/0xf0 net/socket.c:2160
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1486 [inline]
free_pcp_prepare mm/page_alloc.c:1536 [inline]
free_unref_page_prepare+0x8b4/0x9a0 mm/page_alloc.c:3413
free_unref_page+0x2e/0x3f0 mm/page_alloc.c:3508
free_contig_range+0x9d/0x150 mm/page_alloc.c:9625
destroy_args+0xf0/0xa0a mm/debug_vm_pgtable.c:1031
debug_vm_pgtable+0x33c/0x38e mm/debug_vm_pgtable.c:1359
do_one_initcall+0x26a/0x840 init/main.c:1310
do_initcall_level+0x137/0x1e4 init/main.c:1383
do_initcalls+0x4b/0x8a init/main.c:1399
kernel_init_freeable+0x415/0x5be init/main.c:1638
kernel_init+0x19/0x1b0 init/main.c:1526
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Memory state around the buggy address:
ffff888057cbab00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888057cbab80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888057cbac00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888057cbac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888057cbad00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Reply all
Reply to author
Forward
0 new messages