program:
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff00000007058202400000070581024000000705010240"], 0x0)
[ 101.746205][ T4644] Bluetooth: hci0: command tx timeout
[ 102.072372][ T933] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 102.224397][ T933] usb 5-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice= 1.00
[ 102.226434][ T933] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64
[ 102.226455][ T933] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64
[ 102.226466][ T933] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64
[ 102.229201][ T933] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 102.229216][ T933] usb 5-1: Product: syz
[ 102.229223][ T933] usb 5-1: Manufacturer: syz
[ 102.274664][ T5323] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[ 102.274804][ T5323] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[ 102.274874][ T5323] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[ 102.488977][ T933] redrat3 5-1:1.0: Problem fetching firmware ID
[ 102.505062][ T933] redrat3 5-1:1.0: Failed to read timeout from hardware
[ 102.572283][ T933] rc_core: IR keymap rc-hauppauge not found
[ 102.572300][ T933] Registered IR keymap rc-empty
[ 102.579332][ T933] rc rc0: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/rc/rc0
[ 102.606264][ T933] input: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/rc/rc0/input5
[ 102.641858][ T933] redrat3 5-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0
[ 102.646501][ T933] redrat3 5-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0
[ 102.646533][ T933] redrat3 5-1:1.0: redrat3_enable_detector: detector status: -5, should be 1
[ 102.668163][ T933] redrat3 5-1:1.0: probe with driver redrat3 failed with error -5
[ 102.682961][ T5286] ==================================================================
[ 102.682971][ T5286] BUG: KASAN: slab-use-after-free in string+0x216/0x2d0
[ 102.683090][ T5286] Read of size 1 at addr ffff88801f8c0758 by task udevd/5286
[ 102.683099][ T5286]
[ 102.683106][ T5286] CPU: 0 UID: 0 PID: 5286 Comm: udevd Not tainted syzkaller #0 PREEMPT(full)
[ 102.683118][ T5286] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 102.683124][ T5286] Call Trace:
[ 102.683129][ T5286]
[ 102.683134][ T5286] dump_stack_lvl+0xe8/0x150
[ 102.683152][ T5286] print_address_description+0x55/0x1e0
[ 102.683166][ T5286] ? string+0x216/0x2d0
[ 102.683179][ T5286] print_report+0x58/0x70
[ 102.683191][ T5286] kasan_report+0x117/0x150
[ 102.683203][ T5286] ? string+0x216/0x2d0
[ 102.683218][ T5286] string+0x216/0x2d0
[ 102.683234][ T5286] vsnprintf+0x74a/0xef0
[ 102.683250][ T5286] vscnprintf+0x41/0x90
[ 102.683265][ T5286] sysfs_emit+0x10e/0x180
[ 102.683281][ T5286] ? __pfx_sysfs_emit+0x10/0x10
[ 102.683293][ T5286] ? sysfs_file_kobj+0x1a/0x230
[ 102.683307][ T5286] input_dev_show_name+0x58/0x70
[ 102.683321][ T5286] dev_attr_show+0x58/0xc0
[ 102.683366][ T5286] ? __pfx_dev_attr_show+0x10/0x10
[ 102.683378][ T5286] sysfs_kf_seq_show+0x331/0x490
[ 102.683394][ T5286] seq_read_iter+0x463/0xca0
[ 102.683408][ T5286] vfs_read+0x595/0xa80
[ 102.683424][ T5286] ? __pfx_vfs_read+0x10/0x10
[ 102.683435][ T5286] ? do_sys_openat2+0x14e/0x200
[ 102.683445][ T5286] ? kmem_cache_free+0x182/0x650
[ 102.683464][ T5286] ksys_read+0x150/0x270
[ 102.683477][ T5286] ? __pfx_ksys_read+0x10/0x10
[ 102.683491][ T5286] do_syscall_64+0x166/0x520
[ 102.683503][ T5286] ? trace_irq_disable+0x3b/0x140
[ 102.683514][ T5286] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.683525][ T5286] ? clear_bhb_loop+0x70/0xc0
[ 102.683537][ T5286] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.683547][ T5286] RIP: 0033:0x7f59cb0a7407
[ 102.683557][ T5286] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[ 102.683567][ T5286] RSP: 002b:00007ffd051a6ac0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[ 102.683580][ T5286] RAX: ffffffffffffffda RBX: 00007f59cb807880 RCX: 00007f59cb0a7407
[ 102.683588][ T5286] RDX: 0000000000001000 RSI: 00007ffd051a6fa0 RDI: 0000000000000008
[ 102.683602][ T5286] RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000
[ 102.683608][ T5286] R10: 0000000000000000 R11: 0000000000000202 R12: 000055cabfacf020
[ 102.683614][ T5286] R13: 00007ffd051a6ba0 R14: 00007ffd051a6fa0 R15: 000055cab07d0bcc
[ 102.683626][ T5286]
[ 102.683630][ T5286]
[ 102.683633][ T5286] Allocated by task 933:
[ 102.683639][ T5286] kasan_save_track+0x3e/0x80
[ 102.683653][ T5286] __kasan_kmalloc+0x93/0xb0
[ 102.683661][ T5286] __kmalloc_cache_noprof+0x321/0x600
[ 102.683674][ T5286] redrat3_dev_probe+0x477/0x2570
[ 102.683687][ T5286] usb_probe_interface+0x788/0xe50
[ 102.683698][ T5286] really_probe+0x254/0xae0
[ 102.683706][ T5286] __driver_probe_device+0x1e8/0x360
[ 102.683715][ T5286] driver_probe_device+0x4f/0x240
[ 102.683725][ T5286] __device_attach_driver+0x270/0x410
[ 102.683735][ T5286] bus_for_each_drv+0x258/0x2f0
[ 102.683746][ T5286] __device_attach+0x2c4/0x450
[ 102.683755][ T5286] device_initial_probe+0xa1/0xd0
[ 102.683763][ T5286] bus_probe_device+0x12a/0x220
[ 102.683774][ T5286] device_add+0x7d7/0xb80
[ 102.683785][ T5286] usb_set_configuration+0x1ad8/0x2180
[ 102.683793][ T5286] usb_generic_driver_probe+0x8d/0x150
[ 102.683802][ T5286] usb_probe_device+0x1c3/0x3b0
[ 102.683812][ T5286] really_probe+0x254/0xae0
[ 102.683820][ T5286] __driver_probe_device+0x1e8/0x360
[ 102.683828][ T5286] driver_probe_device+0x4f/0x240
[ 102.683836][ T5286] __device_attach_driver+0x270/0x410
[ 102.683844][ T5286] bus_for_each_drv+0x258/0x2f0
[ 102.683855][ T5286] __device_attach+0x2c4/0x450
[ 102.683863][ T5286] device_initial_probe+0xa1/0xd0
[ 102.683872][ T5286] bus_probe_device+0x12a/0x220
[ 102.683883][ T5286] device_add+0x7d7/0xb80
[ 102.683894][ T5286] usb_new_device+0x9aa/0x1690
[ 102.683908][ T5286] hub_event+0x28e8/0x4d30
[ 102.683917][ T5286] process_scheduled_works+0xc3d/0x1630
[ 102.683930][ T5286] worker_thread+0xa47/0xfb0
[ 102.683943][ T5286] kthread+0x38b/0x480
[ 102.683951][ T5286] ret_from_fork+0x514/0xb70
[ 102.683959][ T5286] ret_from_fork_asm+0x1a/0x30
[ 102.683973][ T5286]
[ 102.683976][ T5286] Freed by task 933:
[ 102.683986][ T5286] kasan_save_track+0x3e/0x80
[ 102.684000][ T5286] kasan_save_free_info+0x40/0x50
[ 102.684012][ T5286] __kasan_slab_free+0x5c/0x80
[ 102.684020][ T5286] kfree+0x1c5/0x650
[ 102.684030][ T5286] redrat3_dev_probe+0x1bf4/0x2570
[ 102.684042][ T5286] usb_probe_interface+0x788/0xe50
[ 102.684052][ T5286] really_probe+0x254/0xae0
[ 102.684061][ T5286] __driver_probe_device+0x1e8/0x360
[ 102.684070][ T5286] driver_probe_device+0x4f/0x240
[ 102.684079][ T5286] __device_attach_driver+0x270/0x410
[ 102.684088][ T5286] bus_for_each_drv+0x258/0x2f0
[ 102.684099][ T5286] __device_attach+0x2c4/0x450
[ 102.684107][ T5286] device_initial_probe+0xa1/0xd0
[ 102.684115][ T5286] bus_probe_device+0x12a/0x220
[ 102.684127][ T5286] device_add+0x7d7/0xb80
[ 102.684139][ T5286] usb_set_configuration+0x1ad8/0x2180
[ 102.684148][ T5286] usb_generic_driver_probe+0x8d/0x150
[ 102.684157][ T5286] usb_probe_device+0x1c3/0x3b0
[ 102.684166][ T5286] really_probe+0x254/0xae0
[ 102.684175][ T5286] __driver_probe_device+0x1e8/0x360
[ 102.684183][ T5286] driver_probe_device+0x4f/0x240
[ 102.684192][ T5286] __device_attach_driver+0x270/0x410
[ 102.684201][ T5286] bus_for_each_drv+0x258/0x2f0
[ 102.684211][ T5286] __device_attach+0x2c4/0x450
[ 102.684219][ T5286] device_initial_probe+0xa1/0xd0
[ 102.684227][ T5286] bus_probe_device+0x12a/0x220
[ 102.684238][ T5286] device_add+0x7d7/0xb80
[ 102.684251][ T5286] usb_new_device+0x9aa/0x1690
[ 102.684263][ T5286] hub_event+0x28e8/0x4d30
[ 102.684271][ T5286] process_scheduled_works+0xc3d/0x1630
[ 102.684282][ T5286] worker_thread+0xa47/0xfb0
[ 102.684294][ T5286] kthread+0x38b/0x480
[ 102.684302][ T5286] ret_from_fork+0x514/0xb70
[ 102.684309][ T5286] ret_from_fork_asm+0x1a/0x30
[ 102.684321][ T5286]
[ 102.684324][ T5286] The buggy address belongs to the object at ffff88801f8c0000
[ 102.684324][ T5286] which belongs to the cache kmalloc-2k of size 2048
[ 102.684333][ T5286] The buggy address is located 1880 bytes inside of
[ 102.684333][ T5286] freed 2048-byte region [ffff88801f8c0000, ffff88801f8c0800)
[ 102.684345][ T5286]
[ 102.684348][ T5286] The buggy address belongs to the physical page:
[ 102.684355][ T5286] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1f8c0
[ 102.684365][ T5286] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 102.684374][ T5286] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 102.684383][ T5286] page_type: f5(slab)
[ 102.684394][ T5286] raw: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122
[ 102.684403][ T5286] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 102.684413][ T5286] head: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122
[ 102.684421][ T5286] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 102.684430][ T5286] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 102.684439][ T5286] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 102.684444][ T5286] page dumped because: kasan: bad access detected
[ 102.684450][ T5286] page_owner tracks the page as allocated
[ 102.684453][ T5286] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5287, tgid 5287 (syz-executor), ts 97797694093
[ 102.684470][ T5286] post_alloc_hook+0x1f9/0x250
[ 102.684483][ T5286] get_page_from_freelist+0x2209/0x2280
[ 102.684496][ T5286] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 102.684509][ T5286] allocate_slab+0x7d/0x620
[ 102.684520][ T5286] refill_objects+0x2d5/0x350
[ 102.684530][ T5286] __pcs_replace_empty_main+0x2c8/0x6c0
[ 102.684541][ T5286] __kmalloc_cache_noprof+0x39b/0x600
[ 102.684554][ T5286] rxrpc_alloc_connection+0x7b/0x590
[ 102.684566][ T5286] rxrpc_prealloc_service_connection+0x26/0x300
[ 102.684578][ T5286] rxrpc_service_prealloc_one+0x2d6/0xe10
[ 102.684600][ T5286] rxrpc_kernel_charge_accept+0xc7/0x120
[ 102.684614][ T5286] afs_charge_preallocation+0x3ec/0x570
[ 102.684623][ T5286] afs_open_socket+0x33c/0x3f0
[ 102.684631][ T5286] afs_net_init+0x67d/0x880
[ 102.684643][ T5286] ops_init+0x35d/0x5d0
[ 102.684653][ T5286] setup_net+0x118/0x350
[ 102.684661][ T5286] page last free pid 4695 tgid 4695 ts 32640319392 stack trace:
[ 102.684669][ T5286] __free_frozen_pages+0xc93/0xd90
[ 102.684682][ T5286] __slab_free+0x274/0x2c0
[ 102.684694][ T5286] qlist_free_all+0x99/0x100
[ 102.684707][ T5286] kasan_quarantine_reduce+0x148/0x160
[ 102.684720][ T5286] __kasan_slab_alloc+0x22/0x80
[ 102.684728][ T5286] kmem_cache_alloc_noprof+0x2b9/0x600
[ 102.684739][ T5286] do_getname+0x2e/0x250
[ 102.684749][ T5286] do_readlinkat+0xc8/0x510
[ 102.684759][ T5286] __x64_sys_readlink+0x7f/0x90
[ 102.684769][ T5286] do_syscall_64+0x166/0x520
[ 102.684779][ T5286] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.684789][ T5286]
[ 102.684792][ T5286] Memory state around the buggy address:
[ 102.684798][ T5286] ffff88801f8c0600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 102.684804][ T5286] ffff88801f8c0680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 102.684811][ T5286] >ffff88801f8c0700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 102.684815][ T5286] ^
[ 102.684821][ T5286] ffff88801f8c0780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 102.684828][ T5286] ffff88801f8c0800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 102.684834][ T5286] ==================================================================
[ 102.685121][ T933] usb 5-1: USB disconnect, device number 2
[ 102.688431][ T5286] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 103.105958][ T5286] CPU: 0 UID: 0 PID: 5286 Comm: udevd Not tainted syzkaller #0 PREEMPT(full)
[ 103.109847][ T5286] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 103.114714][ T5286] Call Trace:
[ 103.116780][ T5286]
[ 103.118643][ T5286] vpanic+0x56d/0xa60
[ 103.121043][ T5286] ? __pfx_vpanic+0x10/0x10
[ 103.123678][ T5286] panic+0xc5/0xd0
[ 103.125896][ T5286] ? __pfx_panic+0x10/0x10
[ 103.128545][ T5286] ? preempt_schedule_thunk+0x16/0x40
[ 103.131500][ T5286] ? string+0x216/0x2d0
[ 103.133330][ T5286] ? preempt_schedule_thunk+0x16/0x40
[ 103.135953][ T5286] ? string+0x216/0x2d0
[ 103.137976][ T5286] check_panic_on_warn+0x89/0xb0
[ 103.140088][ T5286] ? string+0x216/0x2d0
[ 103.141890][ T5286] end_report+0x73/0x170
[ 103.143786][ T5286] ? string+0x216/0x2d0
[ 103.145564][ T5286] kasan_report+0x128/0x150
[ 103.147614][ T5286] ? string+0x216/0x2d0
[ 103.149472][ T5286] string+0x216/0x2d0
[ 103.151382][ T5286] vsnprintf+0x74a/0xef0
[ 103.153160][ T5286] vscnprintf+0x41/0x90
[ 103.155024][ T5286] sysfs_emit+0x10e/0x180
[ 103.156978][ T5286] ? __pfx_sysfs_emit+0x10/0x10
[ 103.159129][ T5286] ? sysfs_file_kobj+0x1a/0x230
[ 103.161254][ T5286] input_dev_show_name+0x58/0x70
[ 103.163364][ T5286] dev_attr_show+0x58/0xc0
[ 103.165285][ T5286] ? __pfx_dev_attr_show+0x10/0x10
[ 103.167519][ T5286] sysfs_kf_seq_show+0x331/0x490
[ 103.169630][ T5286] seq_read_iter+0x463/0xca0
[ 103.171669][ T5286] vfs_read+0x595/0xa80
[ 103.173482][ T5286] ? __pfx_vfs_read+0x10/0x10
[ 103.175518][ T5286] ? do_sys_openat2+0x14e/0x200
[ 103.177578][ T5286] ? kmem_cache_free+0x182/0x650
[ 103.179713][ T5286] ksys_read+0x150/0x270
[ 103.181562][ T5286] ? __pfx_ksys_read+0x10/0x10
[ 103.183552][ T5286] do_syscall_64+0x166/0x520
[ 103.185425][ T5286] ? trace_irq_disable+0x3b/0x140
[ 103.187464][ T5286] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.189912][ T5286] ? clear_bhb_loop+0x70/0xc0
[ 103.191827][ T5286] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.194195][ T5286] RIP: 0033:0x7f59cb0a7407
[ 103.196023][ T5286] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[ 103.204026][ T5286] RSP: 002b:00007ffd051a6ac0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[ 103.207604][ T5286] RAX: ffffffffffffffda RBX: 00007f59cb807880 RCX: 00007f59cb0a7407
[ 103.211079][ T5286] RDX: 0000000000001000 RSI: 00007ffd051a6fa0 RDI: 0000000000000008
[ 103.214474][ T5286] RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000
[ 103.217847][ T5286] R10: 0000000000000000 R11: 0000000000000202 R12: 000055cabfacf020
[ 103.221311][ T5286] R13: 00007ffd051a6ba0 R14: 00007ffd051a6fa0 R15: 000055cab07d0bcc
[ 103.224819][ T5286]
[ 103.226629][ T5286] Kernel Offset: disabled
[ 103.228578][ T5286] Rebooting in 86400 seconds..