program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002000000402a1101000001010203010902270001010080fa0904000003ffffff00070581024000000705820240000007050302400000"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
[ 75.554377][ T44] Bluetooth: hci0: command tx timeout
[ 75.832698][ T9] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 75.985649][ T9] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64
[ 75.989823][ T9] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64
[ 75.995301][ T9] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64
[ 76.003229][ T9] usb 5-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice= 1.00
[ 76.007102][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 76.010416][ T9] usb 5-1: Product: syz
[ 76.012173][ T9] usb 5-1: Manufacturer: syz
[ 76.014772][ T9] usb 5-1: SerialNumber: syz
[ 76.028066][ T5317] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[ 76.031310][ T5317] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[ 76.034214][ T5317] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[ 76.195319][ T1330] ieee802154 phy0 wpan0: encryption failed: -22
[ 76.198331][ T1330] ieee802154 phy1 wpan1: encryption failed: -22
[ 77.247080][ T9] redrat3 5-1:1.0: Problem fetching firmware ID
[ 77.275155][ T9] redrat3 5-1:1.0: Failed to read timeout from hardware
[ 77.362698][ T9] rc_core: IR keymap rc-hauppauge not found
[ 77.365925][ T9] Registered IR keymap rc-empty
[ 77.370965][ T9] rc rc0: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/rc/rc0
[ 77.378620][ T9] input: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/rc/rc0/input5
[ 77.391441][ T9] redrat3 5-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0
[ 77.395616][ T9] redrat3 5-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0
[ 77.398979][ T9] redrat3 5-1:1.0: redrat3_enable_detector: detector status: -5, should be 1
[ 77.407619][ T9] redrat3 5-1:1.0: probe with driver redrat3 failed with error -5
[ 77.421884][ T4698] ==================================================================
[ 77.424750][ T4698] BUG: KASAN: slab-use-after-free in string+0x216/0x2d0
[ 77.427335][ T4698] Read of size 1 at addr ffff88801d1e7758 by task udevd/4698
[ 77.430168][ T4698]
[ 77.431121][ T4698] CPU: 0 UID: 0 PID: 4698 Comm: udevd Not tainted syzkaller #0 PREEMPT(full)
[ 77.431135][ T4698] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 77.431140][ T4698] Call Trace:
[ 77.431143][ T4698]
[ 77.431147][ T4698] dump_stack_lvl+0xe8/0x150
[ 77.431160][ T4698] print_address_description+0x55/0x1e0
[ 77.431171][ T4698] ? string+0x216/0x2d0
[ 77.431177][ T4698] print_report+0x58/0x70
[ 77.431188][ T4698] kasan_report+0x117/0x150
[ 77.431203][ T4698] ? string+0x216/0x2d0
[ 77.431214][ T4698] string+0x216/0x2d0
[ 77.431224][ T4698] vsnprintf+0x74a/0xef0
[ 77.431237][ T4698] add_uevent_var+0x1ce/0x460
[ 77.431249][ T4698] ? __pfx___mutex_lock+0x10/0x10
[ 77.431262][ T4698] ? __pfx_add_uevent_var+0x10/0x10
[ 77.431275][ T4698] rc_dev_uevent+0x164/0x1a0
[ 77.431290][ T4698] dev_uevent+0x537/0x870
[ 77.431342][ T4698] ? __pfx_dev_uevent+0x10/0x10
[ 77.431356][ T4698] ? __kmalloc_cache_noprof+0x32d/0x660
[ 77.431369][ T4698] ? __kmalloc_cache_noprof+0x150/0x660
[ 77.431381][ T4698] ? uevent_show+0x15c/0x310
[ 77.431395][ T4698] uevent_show+0x1a0/0x310
[ 77.431409][ T4698] dev_attr_show+0x58/0xc0
[ 77.431421][ T4698] ? __pfx_dev_attr_show+0x10/0x10
[ 77.431435][ T4698] sysfs_kf_seq_show+0x331/0x490
[ 77.431450][ T4698] seq_read_iter+0x463/0xca0
[ 77.431465][ T4698] vfs_read+0x595/0xa80
[ 77.431481][ T4698] ? __pfx_vfs_read+0x10/0x10
[ 77.431495][ T4698] ? do_sys_openat2+0x14e/0x200
[ 77.431510][ T4698] ksys_read+0x150/0x270
[ 77.431525][ T4698] ? __pfx_ksys_read+0x10/0x10
[ 77.431540][ T4698] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 77.431552][ T4698] do_syscall_64+0x174/0x580
[ 77.431565][ T4698] ? clear_bhb_loop+0x40/0x90
[ 77.431577][ T4698] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 77.431589][ T4698] RIP: 0033:0x7fd6918a7407
[ 77.431599][ T4698] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[ 77.431608][ T4698] RSP: 002b:00007fff44f47f10 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[ 77.431621][ T4698] RAX: ffffffffffffffda RBX: 00007fd69201b880 RCX: 00007fd6918a7407
[ 77.431628][ T4698] RDX: 0000000000001000 RSI: 00005619dc2df660 RDI: 000000000000000c
[ 77.431635][ T4698] RBP: 00007fd6919efff0 R08: 0000000000000000 R09: 0000000000000000
[ 77.431641][ T4698] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
[ 77.431648][ T4698] R13: 00007fd6919efea0 R14: 0000000000000000 R15: 00005619dc2d8b50
[ 77.431658][ T4698]
[ 77.431662][ T4698]
[ 77.528096][ T4698] Allocated by task 9:
[ 77.529506][ T4698] kasan_save_track+0x3e/0x80
[ 77.531056][ T4698] __kasan_kmalloc+0x93/0xb0
[ 77.532746][ T4698] __kmalloc_cache_noprof+0x32d/0x660
[ 77.534701][ T4698] redrat3_dev_probe+0x477/0x2570
[ 77.536558][ T4698] usb_probe_interface+0x653/0xc60
[ 77.538460][ T4698] really_probe+0x254/0xae0
[ 77.540142][ T4698] __driver_probe_device+0x1e8/0x360
[ 77.541968][ T4698] driver_probe_device+0x4f/0x240
[ 77.543658][ T4698] __device_attach_driver+0x270/0x410
[ 77.545579][ T4698] bus_for_each_drv+0x258/0x2f0
[ 77.547289][ T4698] __device_attach+0x2c4/0x450
[ 77.548960][ T4698] device_initial_probe+0xa1/0xd0
[ 77.550760][ T4698] bus_probe_device+0x12a/0x220
[ 77.552478][ T4698] device_add+0x7d7/0xb80
[ 77.554002][ T4698] usb_set_configuration+0x1ad8/0x2180
[ 77.556009][ T4698] usb_generic_driver_probe+0x8d/0x150
[ 77.557981][ T4698] usb_probe_device+0x1c3/0x3b0
[ 77.559744][ T4698] really_probe+0x254/0xae0
[ 77.561358][ T4698] __driver_probe_device+0x1e8/0x360
[ 77.563372][ T4698] driver_probe_device+0x4f/0x240
[ 77.565317][ T4698] __device_attach_driver+0x270/0x410
[ 77.567418][ T4698] bus_for_each_drv+0x258/0x2f0
[ 77.569260][ T4698] __device_attach+0x2c4/0x450
[ 77.571189][ T4698] device_initial_probe+0xa1/0xd0
[ 77.573176][ T4698] bus_probe_device+0x12a/0x220
[ 77.575154][ T4698] device_add+0x7d7/0xb80
[ 77.576915][ T4698] usb_new_device+0x99d/0x1620
[ 77.578908][ T4698] hub_event+0x28e8/0x4d30
[ 77.580760][ T4698] process_scheduled_works+0xa8e/0x14e0
[ 77.583012][ T4698] worker_thread+0xa47/0xfb0
[ 77.584827][ T4698] kthread+0x388/0x470
[ 77.586533][ T4698] ret_from_fork+0x514/0xb70
[ 77.588484][ T4698] ret_from_fork_asm+0x1a/0x30
[ 77.590526][ T4698]
[ 77.591546][ T4698] Freed by task 9:
[ 77.593094][ T4698] kasan_save_track+0x3e/0x80
[ 77.595025][ T4698] kasan_save_free_info+0x40/0x50
[ 77.597121][ T4698] __kasan_slab_free+0x5c/0x80
[ 77.599119][ T4698] kfree+0x1c5/0x640
[ 77.600751][ T4698] redrat3_dev_probe+0x1bf4/0x2570
[ 77.602919][ T4698] usb_probe_interface+0x653/0xc60
[ 77.605027][ T4698] really_probe+0x254/0xae0
[ 77.606913][ T4698] __driver_probe_device+0x1e8/0x360
[ 77.609035][ T4698] driver_probe_device+0x4f/0x240
[ 77.611105][ T4698] __device_attach_driver+0x270/0x410
[ 77.613314][ T4698] bus_for_each_drv+0x258/0x2f0
[ 77.615310][ T4698] __device_attach+0x2c4/0x450
[ 77.617312][ T4698] device_initial_probe+0xa1/0xd0
[ 77.619362][ T4698] bus_probe_device+0x12a/0x220
[ 77.621373][ T4698] device_add+0x7d7/0xb80
[ 77.623146][ T4698] usb_set_configuration+0x1ad8/0x2180
[ 77.625434][ T4698] usb_generic_driver_probe+0x8d/0x150
[ 77.627670][ T4698] usb_probe_device+0x1c3/0x3b0
[ 77.630241][ T4698] really_probe+0x254/0xae0
[ 77.632126][ T4698] __driver_probe_device+0x1e8/0x360
[ 77.634290][ T4698] driver_probe_device+0x4f/0x240
[ 77.636390][ T4698] __device_attach_driver+0x270/0x410
[ 77.638576][ T4698] bus_for_each_drv+0x258/0x2f0
[ 77.640602][ T4698] __device_attach+0x2c4/0x450
[ 77.642607][ T4698] device_initial_probe+0xa1/0xd0
[ 77.644690][ T4698] bus_probe_device+0x12a/0x220
[ 77.646710][ T4698] device_add+0x7d7/0xb80
[ 77.648485][ T4698] usb_new_device+0x99d/0x1620
[ 77.650479][ T4698] hub_event+0x28e8/0x4d30
[ 77.652347][ T4698] process_scheduled_works+0xa8e/0x14e0
[ 77.654684][ T4698] worker_thread+0xa47/0xfb0
[ 77.656635][ T4698] kthread+0x388/0x470
[ 77.658367][ T4698] ret_from_fork+0x514/0xb70
[ 77.660265][ T4698] ret_from_fork_asm+0x1a/0x30
[ 77.662210][ T4698]
[ 77.663213][ T4698] The buggy address belongs to the object at ffff88801d1e7000
[ 77.663213][ T4698] which belongs to the cache kmalloc-2k of size 2048
[ 77.668810][ T4698] The buggy address is located 1880 bytes inside of
[ 77.668810][ T4698] freed 2048-byte region [ffff88801d1e7000, ffff88801d1e7800)
[ 77.674324][ T4698]
[ 77.675330][ T4698] The buggy address belongs to the physical page:
[ 77.677934][ T4698] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1d1e0
[ 77.681424][ T4698] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 77.684744][ T4698] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 77.687784][ T4698] page_type: f5(slab)
[ 77.689274][ T4698] raw: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122
[ 77.692088][ T4698] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[ 77.694876][ T4698] head: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122
[ 77.697683][ T4698] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[ 77.700460][ T4698] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 77.703363][ T4698] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 77.706480][ T4698] page dumped because: kasan: bad access detected
[ 77.708605][ T4698] page_owner tracks the page as allocated
[ 77.710475][ T4698] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4687, tgid 4687 (klogd), ts 72695156423, free_ts 24710491022
[ 77.717967][ T4698] post_alloc_hook+0x1f9/0x250
[ 77.719745][ T4698] get_page_from_freelist+0x21fa/0x2270
[ 77.721562][ T4698] __alloc_frozen_pages_noprof+0x18d/0x380
[ 77.723478][ T4698] allocate_slab+0x79/0x5e0
[ 77.725136][ T4698] refill_objects+0x2d5/0x350
[ 77.727010][ T4698] __pcs_replace_empty_main+0x2bf/0x6b0
[ 77.729272][ T4698] __kmalloc_cache_noprof+0x3a7/0x660
[ 77.731471][ T4698] syslog_print+0x103/0x610
[ 77.733371][ T4698] do_syslog+0x583/0x7d0
[ 77.735156][ T4698] __x64_sys_syslog+0x7c/0x90
[ 77.737108][ T4698] do_syscall_64+0x174/0x580
[ 77.739076][ T4698] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 77.741521][ T4698] page last free pid 4695 tgid 4695 stack trace:
[ 77.744041][ T4698] __free_frozen_pages+0xc1e/0xd10
[ 77.746196][ T4698] __slab_free+0x274/0x2c0
[ 77.748048][ T4698] qlist_free_all+0x99/0x100
[ 77.749795][ T4698] kasan_quarantine_reduce+0x148/0x160
[ 77.751555][ T4698] __kasan_slab_alloc+0x22/0x80
[ 77.753128][ T4698] kmem_cache_alloc_noprof+0x2a0/0x5f0
[ 77.754868][ T4698] __anon_vma_prepare+0xc3/0x4e0
[ 77.756516][ T4698] do_pte_missing+0x3029/0x34b0
[ 77.758471][ T4698] handle_mm_fault+0x1b36/0x3080
[ 77.760497][ T4698] do_user_addr_fault+0xa4d/0x1340
[ 77.762578][ T4698] exc_page_fault+0x6a/0xc0
[ 77.764424][ T4698] asm_exc_page_fault+0x26/0x30
[ 77.766416][ T4698]
[ 77.767394][ T4698] Memory state around the buggy address:
[ 77.769643][ T4698] ffff88801d1e7600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.772697][ T4698] ffff88801d1e7680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.775291][ T4698] >ffff88801d1e7700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.778126][ T4698] ^
[ 77.780270][ T4698] ffff88801d1e7780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.782797][ T4698] ffff88801d1e7800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 77.785352][ T4698] ==================================================================
[ 77.789891][ T9] usb 5-1: USB disconnect, device number 2
[ 77.795369][ T44] Bluetooth: hci0: command tx timeout
[ 77.819816][ T4698] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 77.822481][ T4698] CPU: 0 UID: 0 PID: 4698 Comm: udevd Not tainted syzkaller #0 PREEMPT(full)
[ 77.825660][ T4698] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 77.829295][ T4698] Call Trace:
[ 77.830552][ T4698]
[ 77.831673][ T4698] vpanic+0x56c/0xa60
[ 77.833171][ T4698] ? __pfx_vpanic+0x10/0x10
[ 77.834859][ T4698] ? __pfx___schedule+0x10/0x10
[ 77.836639][ T4698] panic+0xc5/0xd0
[ 77.838043][ T4698] ? __pfx_panic+0x10/0x10
[ 77.839707][ T4698] ? preempt_schedule_thunk+0x16/0x40
[ 77.841707][ T4698] ? string+0x216/0x2d0
[ 77.843254][ T4698] check_panic_on_warn+0x89/0xb0
[ 77.845179][ T4698] ? string+0x216/0x2d0
[ 77.846766][ T4698] end_report+0x73/0x170
[ 77.848336][ T4698] ? string+0x216/0x2d0
[ 77.849733][ T4698] kasan_report+0x128/0x150
[ 77.851255][ T4698] ? string+0x216/0x2d0
[ 77.852772][ T4698] string+0x216/0x2d0
[ 77.854253][ T4698] vsnprintf+0x74a/0xef0
[ 77.855829][ T4698] add_uevent_var+0x1ce/0x460
[ 77.857556][ T4698] ? __pfx___mutex_lock+0x10/0x10
[ 77.859392][ T4698] ? __pfx_add_uevent_var+0x10/0x10
[ 77.861163][ T4698] rc_dev_uevent+0x164/0x1a0
[ 77.862662][ T4698] dev_uevent+0x537/0x870
[ 77.864193][ T4698] ? __pfx_dev_uevent+0x10/0x10
[ 77.866023][ T4698] ? __kmalloc_cache_noprof+0x32d/0x660
[ 77.868061][ T4698] ? __kmalloc_cache_noprof+0x150/0x660
[ 77.870059][ T4698] ? uevent_show+0x15c/0x310
[ 77.871785][ T4698] uevent_show+0x1a0/0x310
[ 77.873379][ T4698] dev_attr_show+0x58/0xc0
[ 77.874814][ T4698] ? __pfx_dev_attr_show+0x10/0x10
[ 77.876579][ T4698] sysfs_kf_seq_show+0x331/0x490
[ 77.878351][ T4698] seq_read_iter+0x463/0xca0
[ 77.879981][ T4698] vfs_read+0x595/0xa80
[ 77.881395][ T4698] ? __pfx_vfs_read+0x10/0x10
[ 77.882895][ T4698] ? do_sys_openat2+0x14e/0x200
[ 77.884435][ T4698] ksys_read+0x150/0x270
[ 77.885852][ T4698] ? __pfx_ksys_read+0x10/0x10
[ 77.887399][ T4698] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 77.889532][ T4698] do_syscall_64+0x174/0x580
[ 77.891173][ T4698] ? clear_bhb_loop+0x40/0x90
[ 77.892807][ T4698] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 77.894897][ T4698] RIP: 0033:0x7fd6918a7407
[ 77.896523][ T4698] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[ 77.903287][ T4698] RSP: 002b:00007fff44f47f10 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[ 77.906292][ T4698] RAX: ffffffffffffffda RBX: 00007fd69201b880 RCX: 00007fd6918a7407
[ 77.908895][ T4698] RDX: 0000000000001000 RSI: 00005619dc2df660 RDI: 000000000000000c
[ 77.911634][ T4698] RBP: 00007fd6919efff0 R08: 0000000000000000 R09: 0000000000000000
[ 77.914456][ T4698] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
[ 77.917036][ T4698] R13: 00007fd6919efea0 R14: 0000000000000000 R15: 00005619dc2d8b50
[ 77.919659][ T4698]
[ 77.921093][ T4698] Kernel Offset: disabled
[ 77.922612][ T4698] Rebooting in 86400 seconds..