program:
socket$inet_tcp(0x2, 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev_mnt\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev_mnt\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000407d1e5a2d00000000000109022400010000000009040000010301020009210000000122220009058103"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00222200000096231306e53f"], 0x0}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev_mnt/roccatsavu0\x00', 0x2, 0x0)
r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, 0x0)
close(0x4)
ioctl$DRM_IOCTL_PANTHOR_BO_CREATE(r1, 0xc0186445, 0x0)
[ 86.803674][ T4644] Bluetooth: hci0: command tx timeout
[ 86.824342][ T1470] cfg80211: failed to load regulatory.db
[ 87.247450][ T5300] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 87.400207][ T5300] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00
[ 87.402179][ T5300] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 87.402203][ T5300] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[ 87.402227][ T5300] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 87.406340][ T5300] usb 5-1: config 0 descriptor??
[ 87.841545][ T5300] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 87.841587][ T5300] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 87.841601][ T5300] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 87.841614][ T5300] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 87.841628][ T5300] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 87.841642][ T5300] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 87.841656][ T5300] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 87.841669][ T5300] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 87.841684][ T5300] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 87.841699][ T5300] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 87.846503][ T5300] savu 0003:1E7D:2D5A.0002: hidraw1: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.0-1/input0
[ 88.092280][ T806] usb 5-1: USB disconnect, device number 2
[ 88.112321][ T806] ==================================================================
[ 88.112335][ T806] BUG: KASAN: slab-use-after-free in roccat_disconnect+0x23d/0x250
[ 88.112417][ T806] Read of size 4 at addr ffff88800befe808 by task kworker/0:2/806
[ 88.112424][ T806]
[ 88.112430][ T806] CPU: 0 UID: 0 PID: 806 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full)
[ 88.112438][ T806] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 88.112444][ T806] Workqueue: usb_hub_wq hub_event
[ 88.112472][ T806] Call Trace:
[ 88.112476][ T806]
[ 88.112480][ T806] dump_stack_lvl+0xe8/0x150
[ 88.112492][ T806] print_address_description+0x55/0x1e0
[ 88.112507][ T806] ? roccat_disconnect+0x23d/0x250
[ 88.112515][ T806] print_report+0x58/0x70
[ 88.112531][ T806] kasan_report+0x117/0x150
[ 88.112542][ T806] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 88.112556][ T806] ? roccat_disconnect+0x23d/0x250
[ 88.112568][ T806] roccat_disconnect+0x23d/0x250
[ 88.114123][ T806] savu_remove+0xe9/0x160
[ 88.114134][ T806] ? __pfx_savu_remove+0x10/0x10
[ 88.114145][ T806] hid_device_remove+0xc5/0x1c0
[ 88.114157][ T806] ? __pfx_hid_device_remove+0x10/0x10
[ 88.114169][ T806] device_release_driver_internal+0x48b/0x880
[ 88.114221][ T806] bus_remove_device+0x444/0x560
[ 88.114237][ T806] ? __pfx_bus_remove_device+0x10/0x10
[ 88.114251][ T806] ? kernfs_remove_by_name_ns+0x101/0x140
[ 88.114264][ T806] device_del+0x524/0x8f0
[ 88.114275][ T806] ? __pfx_device_del+0x10/0x10
[ 88.114293][ T806] hid_destroy_device+0x6b/0x1b0
[ 88.114304][ T806] usbhid_disconnect+0x9f/0xc0
[ 88.114318][ T806] usb_unbind_interface+0x295/0x9f0
[ 88.114331][ T806] ? kernfs_remove_by_name_ns+0x101/0x140
[ 88.114343][ T806] ? kernfs_remove_by_name_ns+0x101/0x140
[ 88.114354][ T806] ? __pfx_usb_unbind_interface+0x10/0x10
[ 88.114365][ T806] device_release_driver_internal+0x4f5/0x880
[ 88.114377][ T806] bus_remove_device+0x444/0x560
[ 88.114394][ T806] ? __pfx_bus_remove_device+0x10/0x10
[ 88.114409][ T806] ? kernfs_remove_by_name_ns+0x101/0x140
[ 88.114419][ T806] device_del+0x524/0x8f0
[ 88.114429][ T806] ? __pfx_device_del+0x10/0x10
[ 88.114443][ T806] ? kobject_put+0x516/0x550
[ 88.114460][ T806] usb_disable_device+0x3d4/0x8d0
[ 88.114472][ T806] usb_disconnect+0x346/0x9a0
[ 88.114489][ T806] hub_event+0x1bbb/0x4d30
[ 88.114500][ T806] ? __lock_acquire+0x747/0x2de0
[ 88.114513][ T806] ? register_lock_class+0x31/0x2e0
[ 88.114529][ T806] ? __pfx_hub_event+0x10/0x10
[ 88.114541][ T806] ? rcu_is_watching+0x16/0xb0
[ 88.114553][ T806] ? process_scheduled_works+0x97a/0x1630
[ 88.114566][ T806] process_scheduled_works+0xc3d/0x1630
[ 88.114586][ T806] ? __pfx_process_scheduled_works+0x10/0x10
[ 88.114601][ T806] ? assign_work+0x3cf/0x5d0
[ 88.114614][ T806] worker_thread+0xa47/0xfb0
[ 88.114631][ T806] ? __kthread_parkme+0x71/0x1f0
[ 88.114648][ T806] kthread+0x38b/0x480
[ 88.114659][ T806] ? __pfx_worker_thread+0x10/0x10
[ 88.114673][ T806] ? __pfx_kthread+0x10/0x10
[ 88.114683][ T806] ret_from_fork+0x514/0xb70
[ 88.114693][ T806] ? __pfx_ret_from_fork+0x10/0x10
[ 88.114702][ T806] ? __switch_to+0xc89/0x1420
[ 88.114716][ T806] ? __pfx_kthread+0x10/0x10
[ 88.114726][ T806] ret_from_fork_asm+0x1a/0x30
[ 88.114744][ T806]
[ 88.114748][ T806]
[ 88.114751][ T806] Allocated by task 5300:
[ 88.114801][ T806] kasan_save_track+0x3e/0x80
[ 88.114819][ T806] __kasan_kmalloc+0x93/0xb0
[ 88.114828][ T806] __kmalloc_cache_noprof+0x321/0x600
[ 88.114841][ T806] roccat_connect+0x5d/0x4a0
[ 88.114849][ T806] savu_probe+0x18e/0x340
[ 88.114859][ T806] hid_device_probe+0x46a/0x870
[ 88.114869][ T806] really_probe+0x254/0xae0
[ 88.114878][ T806] __driver_probe_device+0x1e8/0x360
[ 88.114887][ T806] driver_probe_device+0x4f/0x240
[ 88.114896][ T806] __device_attach_driver+0x270/0x410
[ 88.114905][ T806] bus_for_each_drv+0x258/0x2f0
[ 88.114917][ T806] __device_attach+0x2c4/0x450
[ 88.114925][ T806] device_initial_probe+0xa1/0xd0
[ 88.114935][ T806] bus_probe_device+0x12a/0x220
[ 88.114947][ T806] device_add+0x7d7/0xb80
[ 88.114960][ T806] hid_add_device+0x272/0x3e0
[ 88.114970][ T806] usbhid_probe+0x9d4/0xde0
[ 88.114980][ T806] usb_probe_interface+0x788/0xe50
[ 88.114991][ T806] really_probe+0x254/0xae0
[ 88.115000][ T806] __driver_probe_device+0x1e8/0x360
[ 88.115008][ T806] driver_probe_device+0x4f/0x240
[ 88.115016][ T806] __device_attach_driver+0x270/0x410
[ 88.115026][ T806] bus_for_each_drv+0x258/0x2f0
[ 88.115037][ T806] __device_attach+0x2c4/0x450
[ 88.115046][ T806] device_initial_probe+0xa1/0xd0
[ 88.115062][ T806] bus_probe_device+0x12a/0x220
[ 88.115073][ T806] device_add+0x7d7/0xb80
[ 88.115086][ T806] usb_set_configuration+0x1ad8/0x2180
[ 88.115096][ T806] usb_generic_driver_probe+0x8d/0x150
[ 88.115105][ T806] usb_probe_device+0x1c3/0x3b0
[ 88.115115][ T806] really_probe+0x254/0xae0
[ 88.115124][ T806] __driver_probe_device+0x1e8/0x360
[ 88.115134][ T806] driver_probe_device+0x4f/0x240
[ 88.115142][ T806] __device_attach_driver+0x270/0x410
[ 88.115151][ T806] bus_for_each_drv+0x258/0x2f0
[ 88.115162][ T806] __device_attach+0x2c4/0x450
[ 88.115171][ T806] device_initial_probe+0xa1/0xd0
[ 88.115180][ T806] bus_probe_device+0x12a/0x220
[ 88.115191][ T806] device_add+0x7d7/0xb80
[ 88.115204][ T806] usb_new_device+0x9aa/0x1690
[ 88.115218][ T806] hub_event+0x28e8/0x4d30
[ 88.115226][ T806] process_scheduled_works+0xc3d/0x1630
[ 88.115233][ T806] worker_thread+0xa47/0xfb0
[ 88.115242][ T806] kthread+0x38b/0x480
[ 88.115249][ T806] ret_from_fork+0x514/0xb70
[ 88.115257][ T806] ret_from_fork_asm+0x1a/0x30
[ 88.115270][ T806]
[ 88.115273][ T806] Freed by task 5313:
[ 88.115317][ T806] kasan_save_track+0x3e/0x80
[ 88.115334][ T806] kasan_save_free_info+0x40/0x50
[ 88.115343][ T806] __kasan_slab_free+0x5c/0x80
[ 88.115349][ T806] kfree+0x1c5/0x650
[ 88.115359][ T806] roccat_release+0x2ad/0x380
[ 88.115367][ T806] __fput+0x418/0xa50
[ 88.115378][ T806] task_work_run+0x1d9/0x270
[ 88.115387][ T806] exit_to_user_mode_loop+0x204/0x770
[ 88.115398][ T806] do_syscall_64+0x328/0x520
[ 88.115410][ T806] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.115426][ T806]
[ 88.115429][ T806] The buggy address belongs to the object at ffff88800befe800
[ 88.115429][ T806] which belongs to the cache kmalloc-1k of size 1024
[ 88.115439][ T806] The buggy address is located 8 bytes inside of
[ 88.115439][ T806] freed 1024-byte region [ffff88800befe800, ffff88800befec00)
[ 88.115449][ T806]
[ 88.115451][ T806] The buggy address belongs to the physical page:
[ 88.115456][ T806] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xbefc
[ 88.115463][ T806] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 88.115469][ T806] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 88.115479][ T806] page_type: f5(slab)
[ 88.115488][ T806] raw: 00fff00000000040 ffff88801b041dc0 dead000000000122 0000000000000000
[ 88.115496][ T806] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 88.115504][ T806] head: 00fff00000000040 ffff88801b041dc0 dead000000000122 0000000000000000
[ 88.115513][ T806] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 88.115522][ T806] head: 00fff00000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff
[ 88.115530][ T806] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[ 88.115534][ T806] page dumped because: kasan: bad access detected
[ 88.115540][ T806] page_owner tracks the page as allocated
[ 88.115544][ T806] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 0, tgid 0 (swapper/0), ts 87801990453
[ 88.115598][ T806] post_alloc_hook+0x1f9/0x250
[ 88.115613][ T806] get_page_from_freelist+0x2209/0x2280
[ 88.115626][ T806] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 88.115640][ T806] allocate_slab+0x7d/0x620
[ 88.115653][ T806] refill_objects+0x2d5/0x350
[ 88.115664][ T806] __pcs_replace_empty_main+0x2c8/0x6c0
[ 88.115674][ T806] __kmalloc_noprof+0x47b/0x720
[ 88.115686][ T806] ieee802_11_parse_elems_full+0x14b/0x2de0
[ 88.115700][ T806] ieee80211_inform_bss+0x163/0x10d0
[ 88.115712][ T806] cfg80211_inform_single_bss_data+0xd9c/0x1be0
[ 88.115726][ T806] cfg80211_inform_bss_data+0x263/0x3cc0
[ 88.115737][ T806] cfg80211_inform_bss_frame_data+0x3c7/0x840
[ 88.115749][ T806] ieee80211_bss_info_update+0x791/0xa50
[ 88.115760][ T806] ieee80211_scan_rx+0x552/0xa40
[ 88.115770][ T806] ieee80211_rx_list+0x2d0e/0x3b00
[ 88.115782][ T806] ieee80211_rx_napi+0x1ad/0x3d0
[ 88.115794][ T806] page last free pid 71 tgid 71 ts 83158849401 stack trace:
[ 88.115801][ T806] free_unref_folios+0xdc2/0x14e0
[ 88.115814][ T806] shrink_folio_list+0x4a2d/0x5250
[ 88.115828][ T806] evict_folios+0x3055/0x3fb0
[ 88.115837][ T806] try_to_shrink_lruvec+0xe3b/0x1340
[ 88.115845][ T806] shrink_one+0x233/0x730
[ 88.115853][ T806] shrink_node+0x35d0/0x3e30
[ 88.115861][ T806] kswapd+0x185e/0x32c0
[ 88.115869][ T806] kthread+0x38b/0x480
[ 88.115877][ T806] ret_from_fork+0x514/0xb70
[ 88.115885][ T806] ret_from_fork_asm+0x1a/0x30
[ 88.115898][ T806]
[ 88.115901][ T806] Memory state around the buggy address:
[ 88.115907][ T806] ffff88800befe700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 88.115914][ T806] ffff88800befe780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 88.115921][ T806] >ffff88800befe800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 88.115926][ T806] ^
[ 88.115932][ T806] ffff88800befe880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 88.115938][ T806] ffff88800befe900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 88.115943][ T806] ==================================================================
[ 88.116021][ T806] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 88.540039][ T806] CPU: 0 UID: 0 PID: 806 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full)
[ 88.544157][ T806] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 88.548565][ T806] Workqueue: usb_hub_wq hub_event
[ 88.550845][ T806] Call Trace:
[ 88.552276][ T806]
[ 88.553563][ T806] vpanic+0x56d/0xa60
[ 88.555350][ T806] ? __pfx_vpanic+0x10/0x10
[ 88.557365][ T806] panic+0xc5/0xd0
[ 88.559094][ T806] ? __pfx_panic+0x10/0x10
[ 88.561054][ T806] ? preempt_schedule_thunk+0x16/0x40
[ 88.563477][ T806] ? preempt_schedule_thunk+0x16/0x40
[ 88.565864][ T806] ? roccat_disconnect+0x23d/0x250
[ 88.568208][ T806] check_panic_on_warn+0x89/0xb0
[ 88.570500][ T806] ? roccat_disconnect+0x23d/0x250
[ 88.572898][ T806] end_report+0x73/0x170
[ 88.574881][ T806] ? roccat_disconnect+0x23d/0x250
[ 88.577607][ T806] kasan_report+0x128/0x150
[ 88.579661][ T806] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 88.582333][ T806] ? roccat_disconnect+0x23d/0x250
[ 88.584676][ T806] roccat_disconnect+0x23d/0x250
[ 88.587071][ T806] savu_remove+0xe9/0x160
[ 88.589072][ T806] ? __pfx_savu_remove+0x10/0x10
[ 88.591445][ T806] hid_device_remove+0xc5/0x1c0
[ 88.593604][ T806] ? __pfx_hid_device_remove+0x10/0x10
[ 88.596002][ T806] device_release_driver_internal+0x48b/0x880
[ 88.598742][ T806] bus_remove_device+0x444/0x560
[ 88.600930][ T806] ? __pfx_bus_remove_device+0x10/0x10
[ 88.603325][ T806] ? kernfs_remove_by_name_ns+0x101/0x140
[ 88.605897][ T806] device_del+0x524/0x8f0
[ 88.607852][ T806] ? __pfx_device_del+0x10/0x10
[ 88.610196][ T806] hid_destroy_device+0x6b/0x1b0
[ 88.612446][ T806] usbhid_disconnect+0x9f/0xc0
[ 88.614625][ T806] usb_unbind_interface+0x295/0x9f0
[ 88.617141][ T806] ? kernfs_remove_by_name_ns+0x101/0x140
[ 88.619686][ T806] ? kernfs_remove_by_name_ns+0x101/0x140
[ 88.622189][ T806] ? __pfx_usb_unbind_interface+0x10/0x10
[ 88.624737][ T806] device_release_driver_internal+0x4f5/0x880
[ 88.627327][ T806] bus_remove_device+0x444/0x560
[ 88.629332][ T806] ? __pfx_bus_remove_device+0x10/0x10
[ 88.631599][ T806] ? kernfs_remove_by_name_ns+0x101/0x140
[ 88.633957][ T806] device_del+0x524/0x8f0
[ 88.635755][ T806] ? __pfx_device_del+0x10/0x10
[ 88.637923][ T806] ? kobject_put+0x516/0x550
[ 88.639932][ T806] usb_disable_device+0x3d4/0x8d0
[ 88.642151][ T806] usb_disconnect+0x346/0x9a0
[ 88.644268][ T806] hub_event+0x1bbb/0x4d30
[ 88.646445][ T806] ? __lock_acquire+0x747/0x2de0
[ 88.648781][ T806] ? register_lock_class+0x31/0x2e0
[ 88.651085][ T806] ? __pfx_hub_event+0x10/0x10
[ 88.653170][ T806] ? rcu_is_watching+0x16/0xb0
[ 88.655157][ T806] ? process_scheduled_works+0x97a/0x1630
[ 88.657682][ T806] process_scheduled_works+0xc3d/0x1630
[ 88.660164][ T806] ? __pfx_process_scheduled_works+0x10/0x10
[ 88.662932][ T806] ? assign_work+0x3cf/0x5d0
[ 88.664972][ T806] worker_thread+0xa47/0xfb0
[ 88.666942][ T806] ? __kthread_parkme+0x71/0x1f0
[ 88.668980][ T806] kthread+0x38b/0x480
[ 88.670691][ T806] ? __pfx_worker_thread+0x10/0x10
[ 88.672777][ T806] ? __pfx_kthread+0x10/0x10
[ 88.674473][ T806] ret_from_fork+0x514/0xb70
[ 88.676469][ T806] ? __pfx_ret_from_fork+0x10/0x10
[ 88.678595][ T806] ? __switch_to+0xc89/0x1420
[ 88.680698][ T806] ? __pfx_kthread+0x10/0x10
[ 88.682725][ T806] ret_from_fork_asm+0x1a/0x30
[ 88.684943][ T806]
[ 88.686653][ T806] Kernel Offset: disabled
[ 88.688462][ T806] Rebooting in 86400 seconds..