syzbot
KASAN: slab-out-of-bounds Read in mcp2221_raw_event
Status:
upstream: reported C repro on 2026/06/03 13:39
Bug presence:
origin:upstream
[Documentation on labels]
Reported-by: syzbot+4823889ef9f2f6f7ea07@syzkaller.appspotmail.com
First crash: 133d, last: 41d
▶
▼
Bug presence (2)
| Date |
Name |
Commit |
Repro |
Result |
| 2026/06/10 |
upstream (ToT) |
acb7500801e9 |
C
|
[report] KASAN: slab-out-of-bounds Read in mcp2221_raw_event
|
| 2026/10/11 |
upstream (ToT) |
d6d3455d8751 |
C
|
Didn't crash |
▶
▼
Fix bisection attempts (1)
Sample crash report:
==================================================================
BUG: KASAN: slab-out-of-bounds in mcp2221_raw_event+0x1062/0x1240 drivers/hid/hid-mcp2221.c:858
Read of size 1 at addr ffff88805e6dffff by task kworker/0:2/789
CPU: 0 PID: 789 Comm: kworker/0:2 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
<IRQ>
dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:364 [inline]
print_report+0xa8/0x210 mm/kasan/report.c:468
kasan_report+0x117/0x150 mm/kasan/report.c:581
mcp2221_raw_event+0x1062/0x1240 drivers/hid/hid-mcp2221.c:858
hid_input_report+0x3ed/0x500 drivers/hid/hid-core.c:2132
hid_irq_in+0x478/0x6d0 drivers/hid/usbhid/hid-core.c:284
__usb_hcd_giveback_urb+0x35d/0x520 drivers/usb/core/hcd.c:1648
dummy_timer+0xa58/0x34e0 drivers/usb/gadget/udc/dummy_hcd.c:2017
__run_hrtimer kernel/time/hrtimer.c:1754 [inline]
__hrtimer_run_queues+0x525/0xc10 kernel/time/hrtimer.c:1818
hrtimer_run_softirq+0x177/0x290 kernel/time/hrtimer.c:1835
handle_softirqs+0x27d/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:__sanitizer_cov_trace_pc+0x45/0x60 kernel/kcov.c:217
Code: ff 00 74 11 81 fa 00 01 00 00 75 35 83 b9 24 16 00 00 00 74 2c 8b 91 00 16 00 00 83 fa 02 75 21 48 8b 91 08 16 00 00 48 8b 32 <48> 8d 7e 01 8b 89 04 16 00 00 48 39 cf 73 08 48 89 3a 48 89 44 f2
RSP: 0018:ffffc90003b16438 EFLAGS: 00000246
RAX: ffffffff813bb2a1 RBX: ffffc90003b164b0 RCX: ffff888021605a00
RDX: ffffc900170d8000 RSI: 000000000006fcdc RDI: 0000000000000000
RBP: 0000000000000001 R08: ffff888021605a00 R09: 0000000000000003
R10: 0000000000000004 R11: 0000000000000002 R12: ffffffff86f67a86
R13: 1ffff92000762d10 R14: dffffc0000000000 R15: 1ffff92000762c96
unwind_get_return_address+0x71/0xc0 arch/x86/kernel/unwind_orc.c:369
arch_stack_walk+0x11d/0x190 arch/x86/kernel/stacktrace.c:26
stack_trace_save+0xaa/0x100 kernel/stacktrace.c:122
kasan_save_stack+0x3e/0x60 mm/kasan/common.c:46
__kasan_record_aux_stack+0xaf/0xc0 mm/kasan/generic.c:492
__call_rcu_common kernel/rcu/tree.c:2721 [inline]
call_rcu+0x153/0x900 kernel/rcu/tree.c:2837
kernfs_put+0x1d3/0x360 fs/kernfs/dir.c:578
kernfs_remove_by_name_ns+0xe4/0x150 fs/kernfs/dir.c:1696
kernfs_remove_by_name include/linux/kernfs.h:624 [inline]
sysfs_unmerge_group+0xd3/0x130 fs/sysfs/group.c:372
i2c_register_adapter+0x7b6/0x1350 drivers/i2c/i2c-core-base.c:1574
devm_i2c_add_adapter+0x1b/0x80 drivers/i2c/i2c-core-base.c:1869
mcp2221_probe+0x300/0x760 drivers/hid/hid-mcp2221.c:1198
__hid_device_probe drivers/hid/hid-core.c:2681 [inline]
hid_device_probe+0x290/0x5a0 drivers/hid/hid-core.c:2718
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x247/0xae0 drivers/base/dd.c:717
__driver_probe_device+0x1f5/0x390 drivers/base/dd.c:879
driver_probe_device+0x4f/0x420 drivers/base/dd.c:909
__device_attach_driver+0x2ca/0x510 drivers/base/dd.c:1037
bus_for_each_drv+0x252/0x2e0 drivers/base/bus.c:459
__device_attach+0x2c1/0x420 drivers/base/dd.c:1109
bus_probe_device+0x180/0x260 drivers/base/bus.c:580
device_add+0x87c/0xc40 drivers/base/core.c:3700
hid_add_device+0x365/0x500 drivers/hid/hid-core.c:2864
usbhid_probe+0xe43/0x1260 drivers/hid/usbhid/hid-core.c:1447
usb_probe_interface+0x5c2/0xaf0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x247/0xae0 drivers/base/dd.c:717
__driver_probe_device+0x1f5/0x390 drivers/base/dd.c:879
driver_probe_device+0x4f/0x420 drivers/base/dd.c:909
__device_attach_driver+0x2ca/0x510 drivers/base/dd.c:1037
bus_for_each_drv+0x252/0x2e0 drivers/base/bus.c:459
__device_attach+0x2c1/0x420 drivers/base/dd.c:1109
bus_probe_device+0x180/0x260 drivers/base/bus.c:580
device_add+0x87c/0xc40 drivers/base/core.c:3700
usb_set_configuration+0x1ad0/0x2150 drivers/usb/core/message.c:2265
usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:238
usb_probe_device+0x12a/0x260 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x247/0xae0 drivers/base/dd.c:717
__driver_probe_device+0x1f5/0x390 drivers/base/dd.c:879
driver_probe_device+0x4f/0x420 drivers/base/dd.c:909
__device_attach_driver+0x2ca/0x510 drivers/base/dd.c:1037
bus_for_each_drv+0x252/0x2e0 drivers/base/bus.c:459
__device_attach+0x2c1/0x420 drivers/base/dd.c:1109
bus_probe_device+0x180/0x260 drivers/base/bus.c:580
device_add+0x87c/0xc40 drivers/base/core.c:3700
usb_new_device+0x995/0x1550 drivers/usb/core/hub.c:2665
hub_port_connect drivers/usb/core/hub.c:5534 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5674 [inline]
port_event drivers/usb/core/hub.c:5838 [inline]
hub_event+0x29d5/0x4a80 drivers/usb/core/hub.c:5920
process_one_work kernel/workqueue.c:2657 [inline]
process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
Allocated by task 6848:
kasan_save_stack mm/kasan/common.c:46 [inline]
kasan_set_track+0x4e/0x70 mm/kasan/common.c:53
____kasan_kmalloc mm/kasan/common.c:375 [inline]
__kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:384
kasan_kmalloc include/linux/kasan.h:198 [inline]
__do_kmalloc_node mm/slab_common.c:1007 [inline]
__kmalloc_node_track_caller+0xb4/0x230 mm/slab_common.c:1027
kmalloc_reserve+0x116/0x240 net/core/skbuff.c:584
__alloc_skb+0x138/0x2c0 net/core/skbuff.c:653
alloc_skb include/linux/skbuff.h:1316 [inline]
nlmsg_new include/net/netlink.h:1010 [inline]
nl80211_tx_mgmt+0x97c/0xd80 net/wireless/nl80211.c:12704
genl_family_rcv_msg_doit+0x21a/0x310 net/netlink/genetlink.c:971
genl_family_rcv_msg net/netlink/genetlink.c:1051 [inline]
genl_rcv_msg+0x611/0x7a0 net/netlink/genetlink.c:1066
netlink_rcv_skb+0x235/0x4c0 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1075
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0x7b1/0x930 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x8d0/0xbf0 net/netlink/af_netlink.c:1899
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
____sys_sendmsg+0x61b/0x980 net/socket.c:2595
___sys_sendmsg+0x2a6/0x360 net/socket.c:2649
__sys_sendmsg net/socket.c:2678 [inline]
__do_sys_sendmsg net/socket.c:2687 [inline]
__se_sys_sendmsg+0x1d0/0x2c0 net/socket.c:2685
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
Freed by task 6848:
kasan_save_stack mm/kasan/common.c:46 [inline]
kasan_set_track+0x4e/0x70 mm/kasan/common.c:53
kasan_save_free_info+0x28/0x40 mm/kasan/generic.c:522
____kasan_slab_free+0x126/0x1f0 mm/kasan/common.c:237
kasan_slab_free include/linux/kasan.h:164 [inline]
slab_free_hook mm/slub.c:1811 [inline]
slab_free_freelist_hook+0x130/0x1a0 mm/slub.c:1837
slab_free mm/slub.c:3830 [inline]
__kmem_cache_free+0xba/0x1f0 mm/slub.c:3843
skb_kfree_head net/core/skbuff.c:946 [inline]
skb_free_head net/core/skbuff.c:958 [inline]
skb_release_data+0x609/0x7f0 net/core/skbuff.c:988
skb_release_all net/core/skbuff.c:1054 [inline]
__kfree_skb net/core/skbuff.c:1068 [inline]
kfree_skb_reason+0x10e/0x170 net/core/skbuff.c:1104
kfree_skb include/linux/skbuff.h:1264 [inline]
nlmsg_free include/net/netlink.h:1072 [inline]
nl80211_tx_mgmt+0xab1/0xd80 net/wireless/nl80211.c:12735
genl_family_rcv_msg_doit+0x21a/0x310 net/netlink/genetlink.c:971
genl_family_rcv_msg net/netlink/genetlink.c:1051 [inline]
genl_rcv_msg+0x611/0x7a0 net/netlink/genetlink.c:1066
netlink_rcv_skb+0x235/0x4c0 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1075
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0x7b1/0x930 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x8d0/0xbf0 net/netlink/af_netlink.c:1899
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
____sys_sendmsg+0x61b/0x980 net/socket.c:2595
___sys_sendmsg+0x2a6/0x360 net/socket.c:2649
__sys_sendmsg net/socket.c:2678 [inline]
__do_sys_sendmsg net/socket.c:2687 [inline]
__se_sys_sendmsg+0x1d0/0x2c0 net/socket.c:2685
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
The buggy address belongs to the object at ffff88805e6de000
which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 4095 bytes to the right of
allocated 4096-byte region [ffff88805e6de000, ffff88805e6df000)
The buggy address belongs to the physical page:
page:ffffea000179b600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5e6d8
head:ffffea000179b600 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff888017c42140 0000000000000000 0000000000000001
raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5140, tgid 5140 (udevd), ts 123465265784, free_ts 123439197584
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x1c1/0x200 mm/page_alloc.c:1582
prep_new_page mm/page_alloc.c:1589 [inline]
get_page_from_freelist+0x2181/0x22a0 mm/page_alloc.c:3221
__alloc_pages+0x1f0/0x460 mm/page_alloc.c:4501
alloc_slab_page+0x5d/0x180 mm/slub.c:1881
allocate_slab mm/slub.c:2028 [inline]
new_slab+0x87/0x2d0 mm/slub.c:2081
___slab_alloc+0xc5c/0x12f0 mm/slub.c:3253
__slab_alloc mm/slub.c:3339 [inline]
__slab_alloc_node mm/slub.c:3392 [inline]
slab_alloc_node mm/slub.c:3485 [inline]
__kmem_cache_alloc_node+0x11f/0x250 mm/slub.c:3534
kmalloc_trace+0x2a/0xe0 mm/slab_common.c:1098
kmalloc include/linux/slab.h:600 [inline]
kzalloc include/linux/slab.h:721 [inline]
uevent_show+0x158/0x300 drivers/base/core.c:2701
dev_attr_show+0x54/0xc0 drivers/base/core.c:2379
sysfs_kf_seq_show+0x34d/0x4c0 fs/sysfs/file.c:59
seq_read_iter+0x464/0xc50 fs/seq_file.c:230
call_read_iter include/linux/fs.h:2012 [inline]
new_sync_read fs/read_write.c:389 [inline]
vfs_read+0x486/0x990 fs/read_write.c:470
ksys_read+0x151/0x260 fs/read_write.c:613
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1182 [inline]
free_unref_page_prepare+0x7d7/0x8f0 mm/page_alloc.c:2366
free_unref_page+0x32/0x2e0 mm/page_alloc.c:2459
discard_slab mm/slub.c:2127 [inline]
__unfreeze_partials+0x1cf/0x210 mm/slub.c:2667
put_cpu_partial+0x17c/0x250 mm/slub.c:2743
__slab_free+0x319/0x400 mm/slub.c:3700
qlink_free mm/kasan/quarantine.c:166 [inline]
qlist_free_all+0x75/0xd0 mm/kasan/quarantine.c:185
kasan_quarantine_reduce+0x143/0x160 mm/kasan/quarantine.c:292
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:306
kasan_slab_alloc include/linux/kasan.h:188 [inline]
slab_post_alloc_hook+0x6a/0x4d0 mm/slab.h:770
slab_alloc_node mm/slub.c:3495 [inline]
__kmem_cache_alloc_node+0x194/0x250 mm/slub.c:3534
__do_kmalloc_node mm/slab_common.c:1006 [inline]
__kmalloc_node+0xa6/0x240 mm/slab_common.c:1014
kmalloc_node include/linux/slab.h:620 [inline]
kvmalloc_node+0x70/0x180 mm/util.c:617
kvmalloc include/linux/slab.h:738 [inline]
xt_alloc_table_info+0x3b/0xa0 net/netfilter/x_tables.c:1215
do_replace net/ipv6/netfilter/ip6_tables.c:1141 [inline]
do_ip6t_set_ctl+0x90c/0xe10 net/ipv6/netfilter/ip6_tables.c:1641
nf_setsockopt+0x263/0x280 net/netfilter/nf_sockopt.c:101
do_sock_setsockopt+0x175/0x1a0 net/socket.c:2322
Memory state around the buggy address:
ffff88805e6dfe80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88805e6dff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88805e6dff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88805e6e0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88805e6e0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess):
0: ff 00 incl (%rax)
2: 74 11 je 0x15
4: 81 fa 00 01 00 00 cmp $0x100,%edx
a: 75 35 jne 0x41
c: 83 b9 24 16 00 00 00 cmpl $0x0,0x1624(%rcx)
13: 74 2c je 0x41
15: 8b 91 00 16 00 00 mov 0x1600(%rcx),%edx
1b: 83 fa 02 cmp $0x2,%edx
1e: 75 21 jne 0x41
20: 48 8b 91 08 16 00 00 mov 0x1608(%rcx),%rdx
27: 48 8b 32 mov (%rdx),%rsi
* 2a: 48 8d 7e 01 lea 0x1(%rsi),%rdi <-- trapping instruction
2e: 8b 89 04 16 00 00 mov 0x1604(%rcx),%ecx
34: 48 39 cf cmp %rcx,%rdi
37: 73 08 jae 0x41
39: 48 89 3a mov %rdi,(%rdx)
3c: 48 rex.W
3d: 89 .byte 0x89
3e: 44 rex.R
3f: f2 repnz
Struck through repros no longer work on HEAD.