program:
r0 = socket$unix(0x1, 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev_mnt\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev_mnt\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000407d1e5a2d00000000000109022400010000000009040000010301020009210000000122220009058103"], 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002222000000962313"], 0x0}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev_mnt/roccatsavu0\x00', 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0)
r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x7ffffffb}]})
close_range(r2, 0xffffffffffffffff, 0x0)
[ 93.933855][ T4645] Bluetooth: hci0: command tx timeout
[ 94.266191][ T5305] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 94.417295][ T5305] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00
[ 94.423759][ T5305] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 94.428945][ T5305] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[ 94.433329][ T5305] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 94.449877][ T5305] usb 5-1: config 0 descriptor??
[ 94.871076][ T5305] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 94.876841][ T5305] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 94.880041][ T5305] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 94.883167][ T5305] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 94.887584][ T5305] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 94.890698][ T5305] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 94.893893][ T5305] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 94.897389][ T5305] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 94.900464][ T5305] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 94.903392][ T5305] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 94.915534][ T5305] savu 0003:1E7D:2D5A.0002: hidraw1: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.0-1/input0
[ 95.114764][ T5305] usb 5-1: USB disconnect, device number 2
[ 95.137990][ T5305] ==================================================================
[ 95.138020][ T5305] BUG: KASAN: slab-use-after-free in roccat_disconnect+0x23d/0x250
[ 95.138120][ T5305] Read of size 4 at addr ffff88801220f008 by task kworker/0:5/5305
[ 95.138130][ T5305]
[ 95.138137][ T5305] CPU: 0 UID: 0 PID: 5305 Comm: kworker/0:5 Not tainted syzkaller #0 PREEMPT(full)
[ 95.138149][ T5305] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.138157][ T5305] Workqueue: usb_hub_wq hub_event
[ 95.138176][ T5305] Call Trace:
[ 95.138181][ T5305]
[ 95.138186][ T5305] dump_stack_lvl+0xe8/0x150
[ 95.138203][ T5305] print_address_description+0x55/0x1e0
[ 95.138218][ T5305] ? roccat_disconnect+0x23d/0x250
[ 95.138232][ T5305] print_report+0x58/0x70
[ 95.138245][ T5305] kasan_report+0x117/0x150
[ 95.138257][ T5305] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 95.138274][ T5305] ? roccat_disconnect+0x23d/0x250
[ 95.138290][ T5305] roccat_disconnect+0x23d/0x250
[ 95.138311][ T5305] savu_remove+0xe9/0x160
[ 95.138322][ T5305] ? __pfx_savu_remove+0x10/0x10
[ 95.138331][ T5305] hid_device_remove+0xc5/0x1c0
[ 95.138349][ T5305] ? __pfx_hid_device_remove+0x10/0x10
[ 95.138364][ T5305] device_release_driver_internal+0x48b/0x880
[ 95.138419][ T5305] bus_remove_device+0x444/0x560
[ 95.138433][ T5305] ? __pfx_bus_remove_device+0x10/0x10
[ 95.138446][ T5305] ? kernfs_remove_by_name_ns+0x101/0x140
[ 95.138465][ T5305] device_del+0x524/0x8f0
[ 95.138482][ T5305] ? __pfx_device_del+0x10/0x10
[ 95.138498][ T5305] hid_destroy_device+0x6b/0x1b0
[ 95.138509][ T5305] usbhid_disconnect+0x9f/0xc0
[ 95.138520][ T5305] usb_unbind_interface+0x295/0x9f0
[ 95.138537][ T5305] ? kernfs_remove_by_name_ns+0x101/0x140
[ 95.138555][ T5305] ? kernfs_remove_by_name_ns+0x101/0x140
[ 95.138594][ T5305] ? __pfx_usb_unbind_interface+0x10/0x10
[ 95.138610][ T5305] device_release_driver_internal+0x4f5/0x880
[ 95.138627][ T5305] bus_remove_device+0x444/0x560
[ 95.138641][ T5305] ? __pfx_bus_remove_device+0x10/0x10
[ 95.138654][ T5305] ? kernfs_remove_by_name_ns+0x101/0x140
[ 95.138671][ T5305] device_del+0x524/0x8f0
[ 95.138687][ T5305] ? __pfx_device_del+0x10/0x10
[ 95.138700][ T5305] ? kobject_put+0x516/0x550
[ 95.138714][ T5305] usb_disable_device+0x3d4/0x8d0
[ 95.138731][ T5305] usb_disconnect+0x346/0x9a0
[ 95.138747][ T5305] hub_event+0x1bbb/0x4d30
[ 95.138762][ T5305] ? __lock_acquire+0x6df/0x2e50
[ 95.138777][ T5305] ? register_lock_class+0x31/0x2e0
[ 95.138790][ T5305] ? rcu_is_watching+0x16/0xb0
[ 95.138807][ T5305] ? __pfx_hub_event+0x10/0x10
[ 95.138823][ T5305] ? rcu_is_watching+0x16/0xb0
[ 95.138835][ T5305] ? process_scheduled_works+0x97a/0x1630
[ 95.138850][ T5305] process_scheduled_works+0xc3d/0x1630
[ 95.138871][ T5305] ? __pfx_process_scheduled_works+0x10/0x10
[ 95.138887][ T5305] ? assign_work+0x3cf/0x5d0
[ 95.138901][ T5305] worker_thread+0xa47/0xfb0
[ 95.138919][ T5305] ? __kthread_parkme+0x71/0x1f0
[ 95.138937][ T5305] kthread+0x38b/0x480
[ 95.138947][ T5305] ? __pfx_worker_thread+0x10/0x10
[ 95.138961][ T5305] ? __pfx_kthread+0x10/0x10
[ 95.138971][ T5305] ret_from_fork+0x514/0xb70
[ 95.138983][ T5305] ? __pfx_ret_from_fork+0x10/0x10
[ 95.138993][ T5305] ? __switch_to+0xc89/0x1420
[ 95.139007][ T5305] ? __pfx_kthread+0x10/0x10
[ 95.139016][ T5305] ret_from_fork_asm+0x1a/0x30
[ 95.139034][ T5305]
[ 95.139038][ T5305]
[ 95.139041][ T5305] Allocated by task 5305:
[ 95.139047][ T5305] kasan_save_track+0x3e/0x80
[ 95.139064][ T5305] __kasan_kmalloc+0x93/0xb0
[ 95.139080][ T5305] __kmalloc_cache_noprof+0x321/0x600
[ 95.139095][ T5305] roccat_connect+0x5d/0x4a0
[ 95.139108][ T5305] savu_probe+0x18e/0x340
[ 95.139116][ T5305] hid_device_probe+0x46a/0x870
[ 95.139130][ T5305] really_probe+0x254/0xae0
[ 95.139145][ T5305] __driver_probe_device+0x1e8/0x360
[ 95.139160][ T5305] driver_probe_device+0x4f/0x240
[ 95.139173][ T5305] __device_attach_driver+0x270/0x410
[ 95.139187][ T5305] bus_for_each_drv+0x258/0x2f0
[ 95.139198][ T5305] __device_attach+0x2c4/0x450
[ 95.139212][ T5305] device_initial_probe+0xa1/0xd0
[ 95.139225][ T5305] bus_probe_device+0x12a/0x220
[ 95.139235][ T5305] device_add+0x7d7/0xb80
[ 95.139247][ T5305] hid_add_device+0x272/0x3e0
[ 95.139256][ T5305] usbhid_probe+0x9d4/0xde0
[ 95.139265][ T5305] usb_probe_interface+0x788/0xe50
[ 95.139276][ T5305] really_probe+0x254/0xae0
[ 95.139289][ T5305] __driver_probe_device+0x1e8/0x360
[ 95.139310][ T5305] driver_probe_device+0x4f/0x240
[ 95.139325][ T5305] __device_attach_driver+0x270/0x410
[ 95.139339][ T5305] bus_for_each_drv+0x258/0x2f0
[ 95.139349][ T5305] __device_attach+0x2c4/0x450
[ 95.139362][ T5305] device_initial_probe+0xa1/0xd0
[ 95.139375][ T5305] bus_probe_device+0x12a/0x220
[ 95.139385][ T5305] device_add+0x7d7/0xb80
[ 95.139396][ T5305] usb_set_configuration+0x1ad8/0x2180
[ 95.139411][ T5305] usb_generic_driver_probe+0x8d/0x150
[ 95.139425][ T5305] usb_probe_device+0x1c3/0x3b0
[ 95.139434][ T5305] really_probe+0x254/0xae0
[ 95.139448][ T5305] __driver_probe_device+0x1e8/0x360
[ 95.139463][ T5305] driver_probe_device+0x4f/0x240
[ 95.139477][ T5305] __device_attach_driver+0x270/0x410
[ 95.139492][ T5305] bus_for_each_drv+0x258/0x2f0
[ 95.139502][ T5305] __device_attach+0x2c4/0x450
[ 95.139515][ T5305] device_initial_probe+0xa1/0xd0
[ 95.139528][ T5305] bus_probe_device+0x12a/0x220
[ 95.139539][ T5305] device_add+0x7d7/0xb80
[ 95.139550][ T5305] usb_new_device+0x9aa/0x1690
[ 95.139562][ T5305] hub_event+0x28e8/0x4d30
[ 95.139575][ T5305] process_scheduled_works+0xc3d/0x1630
[ 95.139588][ T5305] worker_thread+0xa47/0xfb0
[ 95.139601][ T5305] kthread+0x38b/0x480
[ 95.139610][ T5305] ret_from_fork+0x514/0xb70
[ 95.139619][ T5305] ret_from_fork_asm+0x1a/0x30
[ 95.139634][ T5305]
[ 95.139637][ T5305] Freed by task 5316:
[ 95.139643][ T5305] kasan_save_track+0x3e/0x80
[ 95.139657][ T5305] kasan_save_free_info+0x40/0x50
[ 95.139669][ T5305] __kasan_slab_free+0x5c/0x80
[ 95.139683][ T5305] kfree+0x1c5/0x650
[ 95.139694][ T5305] roccat_release+0x2ad/0x380
[ 95.139707][ T5305] __fput+0x418/0xa50
[ 95.139717][ T5305] task_work_run+0x1d9/0x270
[ 95.139726][ T5305] exit_to_user_mode_loop+0x204/0x770
[ 95.139737][ T5305] do_syscall_64+0x328/0x520
[ 95.139752][ T5305] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.139763][ T5305]
[ 95.139765][ T5305] The buggy address belongs to the object at ffff88801220f000
[ 95.139765][ T5305] which belongs to the cache kmalloc-1k of size 1024
[ 95.139774][ T5305] The buggy address is located 8 bytes inside of
[ 95.139774][ T5305] freed 1024-byte region [ffff88801220f000, ffff88801220f400)
[ 95.139785][ T5305]
[ 95.139788][ T5305] The buggy address belongs to the physical page:
[ 95.139794][ T5305] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1220c
[ 95.139804][ T5305] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 95.139814][ T5305] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 95.139825][ T5305] page_type: f5(slab)
[ 95.139836][ T5305] raw: 00fff00000000040 ffff88801b041dc0 dead000000000100 dead000000000122
[ 95.139845][ T5305] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 95.139855][ T5305] head: 00fff00000000040 ffff88801b041dc0 dead000000000100 dead000000000122
[ 95.139864][ T5305] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 95.139873][ T5305] head: 00fff00000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff
[ 95.139882][ T5305] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[ 95.139887][ T5305] page dumped because: kasan: bad access detected
[ 95.139894][ T5305] page_owner tracks the page as allocated
[ 95.139898][ T5305] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1054, tgid 1054 (kworker/u4:7), ts 94579905641
[ 95.139917][ T5305] post_alloc_hook+0x1f9/0x250
[ 95.139929][ T5305] get_page_from_freelist+0x2209/0x2280
[ 95.139945][ T5305] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 95.139960][ T5305] allocate_slab+0x7d/0x620
[ 95.139970][ T5305] refill_objects+0x2d5/0x350
[ 95.139980][ T5305] __pcs_replace_empty_main+0x2c8/0x6c0
[ 95.139991][ T5305] __kmalloc_noprof+0x47b/0x720
[ 95.140003][ T5305] ieee802_11_parse_elems_full+0x14b/0x2de0
[ 95.140015][ T5305] ieee80211_ibss_rx_queued_mgmt+0x509/0x2c40
[ 95.140031][ T5305] ieee80211_iface_work+0x78a/0x1010
[ 95.140041][ T5305] cfg80211_wiphy_work+0x29e/0x420
[ 95.140054][ T5305] process_scheduled_works+0xc3d/0x1630
[ 95.140066][ T5305] worker_thread+0xa47/0xfb0
[ 95.140079][ T5305] kthread+0x38b/0x480
[ 95.140087][ T5305] ret_from_fork+0x514/0xb70
[ 95.140095][ T5305] ret_from_fork_asm+0x1a/0x30
[ 95.140110][ T5305] page last free pid 4707 tgid 4707 ts 36612901726 stack trace:
[ 95.140117][ T5305] __free_frozen_pages+0xc93/0xd90
[ 95.140129][ T5305] __slab_free+0x274/0x2c0
[ 95.140142][ T5305] qlist_free_all+0x99/0x100
[ 95.140155][ T5305] kasan_quarantine_reduce+0x148/0x160
[ 95.140170][ T5305] __kasan_slab_alloc+0x22/0x80
[ 95.140185][ T5305] __kmalloc_cache_noprof+0x29f/0x600
[ 95.140198][ T5305] kernfs_fop_open+0x3ac/0xce0
[ 95.140208][ T5305] do_dentry_open+0x816/0x1380
[ 95.140217][ T5305] vfs_open+0x3b/0x340
[ 95.140225][ T5305] path_openat+0x1443/0x1d60
[ 95.140238][ T5305] do_file_open+0x23e/0x4a0
[ 95.140251][ T5305] do_sys_openat2+0x115/0x200
[ 95.140261][ T5305] __x64_sys_openat+0x138/0x170
[ 95.140270][ T5305] do_syscall_64+0x166/0x520
[ 95.140284][ T5305] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.140294][ T5305]
[ 95.140297][ T5305] Memory state around the buggy address:
[ 95.140309][ T5305] ffff88801220ef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 95.140317][ T5305] ffff88801220ef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 95.140324][ T5305] >ffff88801220f000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 95.140330][ T5305] ^
[ 95.140335][ T5305] ffff88801220f080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 95.140342][ T5305] ffff88801220f100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 95.140347][ T5305] ==================================================================
[ 95.603893][ T5305] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 95.607022][ T5305] CPU: 0 UID: 0 PID: 5305 Comm: kworker/0:5 Not tainted syzkaller #0 PREEMPT(full)
[ 95.610921][ T5305] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.615225][ T5305] Workqueue: usb_hub_wq hub_event
[ 95.617452][ T5305] Call Trace:
[ 95.618908][ T5305]
[ 95.620242][ T5305] vpanic+0x56d/0xa60
[ 95.622002][ T5305] ? __pfx_vpanic+0x10/0x10
[ 95.623954][ T5305] panic+0xc5/0xd0
[ 95.625620][ T5305] ? __pfx_panic+0x10/0x10
[ 95.628039][ T5305] ? preempt_schedule_thunk+0x16/0x40
[ 95.630974][ T5305] ? preempt_schedule_thunk+0x16/0x40
[ 95.633639][ T5305] ? roccat_disconnect+0x23d/0x250
[ 95.635735][ T5305] check_panic_on_warn+0x89/0xb0
[ 95.637712][ T5305] ? roccat_disconnect+0x23d/0x250
[ 95.639924][ T5305] end_report+0x73/0x170
[ 95.641737][ T5305] ? roccat_disconnect+0x23d/0x250
[ 95.643886][ T5305] kasan_report+0x128/0x150
[ 95.645848][ T5305] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 95.648484][ T5305] ? roccat_disconnect+0x23d/0x250
[ 95.650639][ T5305] roccat_disconnect+0x23d/0x250
[ 95.652596][ T5305] savu_remove+0xe9/0x160
[ 95.654497][ T5305] ? __pfx_savu_remove+0x10/0x10
[ 95.656461][ T5305] hid_device_remove+0xc5/0x1c0
[ 95.658596][ T5305] ? __pfx_hid_device_remove+0x10/0x10
[ 95.660978][ T5305] device_release_driver_internal+0x48b/0x880
[ 95.663806][ T5305] bus_remove_device+0x444/0x560
[ 95.665898][ T5305] ? __pfx_bus_remove_device+0x10/0x10
[ 95.668098][ T5305] ? kernfs_remove_by_name_ns+0x101/0x140
[ 95.670501][ T5305] device_del+0x524/0x8f0
[ 95.672228][ T5305] ? __pfx_device_del+0x10/0x10
[ 95.674203][ T5305] hid_destroy_device+0x6b/0x1b0
[ 95.676015][ T5305] usbhid_disconnect+0x9f/0xc0
[ 95.678013][ T5305] usb_unbind_interface+0x295/0x9f0
[ 95.680052][ T5305] ? kernfs_remove_by_name_ns+0x101/0x140
[ 95.682347][ T5305] ? kernfs_remove_by_name_ns+0x101/0x140
[ 95.684652][ T5305] ? __pfx_usb_unbind_interface+0x10/0x10
[ 95.687070][ T5305] device_release_driver_internal+0x4f5/0x880
[ 95.689840][ T5305] bus_remove_device+0x444/0x560
[ 95.691895][ T5305] ? __pfx_bus_remove_device+0x10/0x10
[ 95.694283][ T5305] ? kernfs_remove_by_name_ns+0x101/0x140
[ 95.696730][ T5305] device_del+0x524/0x8f0
[ 95.698645][ T5305] ? __pfx_device_del+0x10/0x10
[ 95.700721][ T5305] ? kobject_put+0x516/0x550
[ 95.702663][ T5305] usb_disable_device+0x3d4/0x8d0
[ 95.704916][ T5305] usb_disconnect+0x346/0x9a0
[ 95.706987][ T5305] hub_event+0x1bbb/0x4d30
[ 95.708945][ T5305] ? __lock_acquire+0x6df/0x2e50
[ 95.711281][ T5305] ? register_lock_class+0x31/0x2e0
[ 95.713526][ T5305] ? rcu_is_watching+0x16/0xb0
[ 95.715645][ T5305] ? __pfx_hub_event+0x10/0x10
[ 95.717746][ T5305] ? rcu_is_watching+0x16/0xb0
[ 95.719883][ T5305] ? process_scheduled_works+0x97a/0x1630
[ 95.722318][ T5305] process_scheduled_works+0xc3d/0x1630
[ 95.724676][ T5305] ? __pfx_process_scheduled_works+0x10/0x10
[ 95.727211][ T5305] ? assign_work+0x3cf/0x5d0
[ 95.729151][ T5305] worker_thread+0xa47/0xfb0
[ 95.731093][ T5305] ? __kthread_parkme+0x71/0x1f0
[ 95.733220][ T5305] kthread+0x38b/0x480
[ 95.735009][ T5305] ? __pfx_worker_thread+0x10/0x10
[ 95.737278][ T5305] ? __pfx_kthread+0x10/0x10
[ 95.739267][ T5305] ret_from_fork+0x514/0xb70
[ 95.741359][ T5305] ? __pfx_ret_from_fork+0x10/0x10
[ 95.743511][ T5305] ? __switch_to+0xc89/0x1420
[ 95.745701][ T5305] ? __pfx_kthread+0x10/0x10
[ 95.747779][ T5305] ret_from_fork_asm+0x1a/0x30
[ 95.749926][ T5305]
[ 95.751647][ T5305] Kernel Offset: disabled
[ 95.753499][ T5305] Rebooting in 86400 seconds..