program:
r0 = socket$unix(0x1, 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev_mnt\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev_mnt\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000407d1e5a2d00000000000109022400010000000009040000010301020009210000000122220009058103"], 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002222000000962313"], 0x0}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev_mnt/roccatsavu0\x00', 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0)
r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x7ffffffb}]})
close_range(r2, 0xffffffffffffffff, 0x0)
[ 94.013241][ T4648] Bluetooth: hci0: command tx timeout
[ 94.380156][ T10] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 94.531079][ T10] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00
[ 94.536947][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 94.541814][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[ 94.546101][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 94.562887][ T10] usb 5-1: config 0 descriptor??
[ 94.999642][ T10] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 95.003024][ T10] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 95.006105][ T10] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 95.009287][ T10] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 95.012628][ T10] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 95.015703][ T10] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 95.018735][ T10] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 95.022153][ T10] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 95.025391][ T10] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 95.028554][ T10] savu 0003:1E7D:2D5A.0002: unknown main item tag 0x0
[ 95.039888][ T10] savu 0003:1E7D:2D5A.0002: hidraw1: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.0-1/input0
[ 95.238825][ T10] usb 5-1: USB disconnect, device number 2
[ 95.264364][ T10] ==================================================================
[ 95.264388][ T10] BUG: KASAN: slab-use-after-free in roccat_disconnect+0x23d/0x250
[ 95.264495][ T10] Read of size 4 at addr ffff888052984808 by task kworker/0:1/10
[ 95.264505][ T10]
[ 95.264512][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full)
[ 95.264524][ T10] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.264532][ T10] Workqueue: usb_hub_wq hub_event
[ 95.264551][ T10] Call Trace:
[ 95.264556][ T10]
[ 95.264561][ T10] dump_stack_lvl+0xe8/0x150
[ 95.264577][ T10] print_address_description+0x55/0x1e0
[ 95.264593][ T10] ? roccat_disconnect+0x23d/0x250
[ 95.264606][ T10] print_report+0x58/0x70
[ 95.264618][ T10] kasan_report+0x117/0x150
[ 95.264629][ T10] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 95.264646][ T10] ? roccat_disconnect+0x23d/0x250
[ 95.264662][ T10] roccat_disconnect+0x23d/0x250
[ 95.264677][ T10] savu_remove+0xe9/0x160
[ 95.264686][ T10] ? __pfx_savu_remove+0x10/0x10
[ 95.264694][ T10] hid_device_remove+0xc5/0x1c0
[ 95.264711][ T10] ? __pfx_hid_device_remove+0x10/0x10
[ 95.264726][ T10] device_release_driver_internal+0x48b/0x880
[ 95.264783][ T10] bus_remove_device+0x444/0x560
[ 95.264796][ T10] ? __pfx_bus_remove_device+0x10/0x10
[ 95.264809][ T10] ? kernfs_remove_by_name_ns+0x101/0x140
[ 95.264827][ T10] device_del+0x524/0x8f0
[ 95.264870][ T10] ? __pfx_device_del+0x10/0x10
[ 95.264888][ T10] hid_destroy_device+0x6b/0x1b0
[ 95.264899][ T10] usbhid_disconnect+0x9f/0xc0
[ 95.264910][ T10] usb_unbind_interface+0x295/0x9f0
[ 95.264927][ T10] ? kernfs_remove_by_name_ns+0x101/0x140
[ 95.264944][ T10] ? kernfs_remove_by_name_ns+0x101/0x140
[ 95.264961][ T10] ? __pfx_usb_unbind_interface+0x10/0x10
[ 95.264977][ T10] device_release_driver_internal+0x4f5/0x880
[ 95.264994][ T10] bus_remove_device+0x444/0x560
[ 95.265008][ T10] ? __pfx_bus_remove_device+0x10/0x10
[ 95.265025][ T10] ? kernfs_remove_by_name_ns+0x101/0x140
[ 95.265042][ T10] device_del+0x524/0x8f0
[ 95.265058][ T10] ? __pfx_device_del+0x10/0x10
[ 95.265072][ T10] ? kobject_put+0x516/0x550
[ 95.265085][ T10] usb_disable_device+0x3d4/0x8d0
[ 95.265101][ T10] usb_disconnect+0x346/0x9a0
[ 95.265116][ T10] hub_event+0x1bbb/0x4d30
[ 95.265131][ T10] ? __lock_acquire+0x6df/0x2e50
[ 95.265146][ T10] ? register_lock_class+0x31/0x2e0
[ 95.265158][ T10] ? rcu_is_watching+0x16/0xb0
[ 95.265174][ T10] ? __pfx_hub_event+0x10/0x10
[ 95.265190][ T10] ? rcu_is_watching+0x16/0xb0
[ 95.265209][ T10] ? process_scheduled_works+0x97a/0x1630
[ 95.265224][ T10] process_scheduled_works+0xc3d/0x1630
[ 95.265243][ T10] ? __pfx_process_scheduled_works+0x10/0x10
[ 95.265252][ T10] ? assign_work+0x3cf/0x5d0
[ 95.265262][ T10] worker_thread+0xa47/0xfb0
[ 95.265275][ T10] kthread+0x38b/0x480
[ 95.265282][ T10] ? __pfx_worker_thread+0x10/0x10
[ 95.265292][ T10] ? __pfx_kthread+0x10/0x10
[ 95.265302][ T10] ret_from_fork+0x514/0xb70
[ 95.265313][ T10] ? __pfx_ret_from_fork+0x10/0x10
[ 95.265322][ T10] ? __switch_to+0xc89/0x1420
[ 95.265339][ T10] ? __pfx_kthread+0x10/0x10
[ 95.265349][ T10] ret_from_fork_asm+0x1a/0x30
[ 95.265370][ T10]
[ 95.265375][ T10]
[ 95.265377][ T10] Allocated by task 10:
[ 95.265383][ T10] kasan_save_track+0x3e/0x80
[ 95.265393][ T10] __kasan_kmalloc+0x93/0xb0
[ 95.265402][ T10] __kmalloc_cache_noprof+0x321/0x600
[ 95.265412][ T10] roccat_connect+0x5d/0x4a0
[ 95.265421][ T10] savu_probe+0x18e/0x340
[ 95.265426][ T10] hid_device_probe+0x46a/0x870
[ 95.265440][ T10] really_probe+0x254/0xae0
[ 95.265453][ T10] __driver_probe_device+0x1e8/0x360
[ 95.265466][ T10] driver_probe_device+0x4f/0x240
[ 95.265481][ T10] __device_attach_driver+0x270/0x410
[ 95.265494][ T10] bus_for_each_drv+0x258/0x2f0
[ 95.265505][ T10] __device_attach+0x2c4/0x450
[ 95.265518][ T10] device_initial_probe+0xa1/0xd0
[ 95.265531][ T10] bus_probe_device+0x12a/0x220
[ 95.265541][ T10] device_add+0x7d7/0xb80
[ 95.265553][ T10] hid_add_device+0x272/0x3e0
[ 95.265560][ T10] usbhid_probe+0x9d4/0xde0
[ 95.265566][ T10] usb_probe_interface+0x788/0xe50
[ 95.265572][ T10] really_probe+0x254/0xae0
[ 95.265585][ T10] __driver_probe_device+0x1e8/0x360
[ 95.265597][ T10] driver_probe_device+0x4f/0x240
[ 95.265611][ T10] __device_attach_driver+0x270/0x410
[ 95.265626][ T10] bus_for_each_drv+0x258/0x2f0
[ 95.265636][ T10] __device_attach+0x2c4/0x450
[ 95.265649][ T10] device_initial_probe+0xa1/0xd0
[ 95.265662][ T10] bus_probe_device+0x12a/0x220
[ 95.265673][ T10] device_add+0x7d7/0xb80
[ 95.265684][ T10] usb_set_configuration+0x1ad8/0x2180
[ 95.265699][ T10] usb_generic_driver_probe+0x8d/0x150
[ 95.265712][ T10] usb_probe_device+0x1c3/0x3b0
[ 95.265721][ T10] really_probe+0x254/0xae0
[ 95.265734][ T10] __driver_probe_device+0x1e8/0x360
[ 95.265748][ T10] driver_probe_device+0x4f/0x240
[ 95.265762][ T10] __device_attach_driver+0x270/0x410
[ 95.265777][ T10] bus_for_each_drv+0x258/0x2f0
[ 95.265787][ T10] __device_attach+0x2c4/0x450
[ 95.265800][ T10] device_initial_probe+0xa1/0xd0
[ 95.265812][ T10] bus_probe_device+0x12a/0x220
[ 95.265822][ T10] device_add+0x7d7/0xb80
[ 95.265833][ T10] usb_new_device+0x9aa/0x1690
[ 95.265845][ T10] hub_event+0x28e8/0x4d30
[ 95.265858][ T10] process_scheduled_works+0xc3d/0x1630
[ 95.265871][ T10] worker_thread+0xa47/0xfb0
[ 95.265884][ T10] kthread+0x38b/0x480
[ 95.265892][ T10] ret_from_fork+0x514/0xb70
[ 95.265900][ T10] ret_from_fork_asm+0x1a/0x30
[ 95.265910][ T10]
[ 95.265911][ T10] Freed by task 5317:
[ 95.265915][ T10] kasan_save_track+0x3e/0x80
[ 95.265924][ T10] kasan_save_free_info+0x40/0x50
[ 95.265932][ T10] __kasan_slab_free+0x5c/0x80
[ 95.265946][ T10] kfree+0x1c5/0x650
[ 95.265956][ T10] roccat_release+0x2ad/0x380
[ 95.265969][ T10] __fput+0x418/0xa50
[ 95.265979][ T10] task_work_run+0x1d9/0x270
[ 95.265989][ T10] exit_to_user_mode_loop+0x204/0x770
[ 95.265999][ T10] do_syscall_64+0x328/0x520
[ 95.266013][ T10] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.266024][ T10]
[ 95.266027][ T10] The buggy address belongs to the object at ffff888052984800
[ 95.266027][ T10] which belongs to the cache kmalloc-1k of size 1024
[ 95.266036][ T10] The buggy address is located 8 bytes inside of
[ 95.266036][ T10] freed 1024-byte region [ffff888052984800, ffff888052984c00)
[ 95.266046][ T10]
[ 95.266048][ T10] The buggy address belongs to the physical page:
[ 95.266055][ T10] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x52984
[ 95.266065][ T10] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 95.266074][ T10] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff)
[ 95.266084][ T10] page_type: f5(slab)
[ 95.266093][ T10] raw: 04fff00000000040 ffff88801b041dc0 dead000000000122 0000000000000000
[ 95.266103][ T10] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 95.266112][ T10] head: 04fff00000000040 ffff88801b041dc0 dead000000000122 0000000000000000
[ 95.266120][ T10] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 95.266129][ T10] head: 04fff00000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff
[ 95.266137][ T10] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[ 95.266142][ T10] page dumped because: kasan: bad access detected
[ 95.266149][ T10] page_owner tracks the page as allocated
[ 95.266153][ T10] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1066, tgid 1066 (kworker/u4:12), ts 94890619541
[ 95.266171][ T10] post_alloc_hook+0x1f9/0x250
[ 95.266184][ T10] get_page_from_freelist+0x2209/0x2280
[ 95.266205][ T10] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 95.266219][ T10] allocate_slab+0x7d/0x620
[ 95.266229][ T10] refill_objects+0x2d5/0x350
[ 95.266239][ T10] __pcs_replace_empty_main+0x2c8/0x6c0
[ 95.266249][ T10] __kmalloc_noprof+0x47b/0x720
[ 95.266261][ T10] ieee802_11_parse_elems_full+0x14b/0x2de0
[ 95.266273][ T10] ieee80211_ibss_rx_queued_mgmt+0x509/0x2c40
[ 95.266288][ T10] ieee80211_iface_work+0x78a/0x1010
[ 95.266298][ T10] cfg80211_wiphy_work+0x29e/0x420
[ 95.266309][ T10] process_scheduled_works+0xc3d/0x1630
[ 95.266321][ T10] worker_thread+0xa47/0xfb0
[ 95.266333][ T10] kthread+0x38b/0x480
[ 95.266342][ T10] ret_from_fork+0x514/0xb70
[ 95.266350][ T10] ret_from_fork_asm+0x1a/0x30
[ 95.266365][ T10] page_owner free stack trace missing
[ 95.266369][ T10]
[ 95.266371][ T10] Memory state around the buggy address:
[ 95.266378][ T10] ffff888052984700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 95.266385][ T10] ffff888052984780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 95.266390][ T10] >ffff888052984800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 95.266393][ T10] ^
[ 95.266397][ T10] ffff888052984880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 95.266401][ T10] ffff888052984900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 95.266405][ T10] ==================================================================
[ 95.700355][ T10] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 95.703295][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full)
[ 95.707017][ T10] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.711738][ T10] Workqueue: usb_hub_wq hub_event
[ 95.713816][ T10] Call Trace:
[ 95.715178][ T10]
[ 95.716387][ T10] vpanic+0x56d/0xa60
[ 95.718011][ T10] ? __pfx_vpanic+0x10/0x10
[ 95.719882][ T10] panic+0xc5/0xd0
[ 95.721422][ T10] ? __pfx_panic+0x10/0x10
[ 95.723343][ T10] ? preempt_schedule_thunk+0x16/0x40
[ 95.725521][ T10] ? preempt_schedule_thunk+0x16/0x40
[ 95.727865][ T10] ? roccat_disconnect+0x23d/0x250
[ 95.730003][ T10] check_panic_on_warn+0x89/0xb0
[ 95.731955][ T10] ? roccat_disconnect+0x23d/0x250
[ 95.733991][ T10] end_report+0x73/0x170
[ 95.735762][ T10] ? roccat_disconnect+0x23d/0x250
[ 95.737841][ T10] kasan_report+0x128/0x150
[ 95.739749][ T10] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 95.742247][ T10] ? roccat_disconnect+0x23d/0x250
[ 95.744372][ T10] roccat_disconnect+0x23d/0x250
[ 95.746421][ T10] savu_remove+0xe9/0x160
[ 95.748235][ T10] ? __pfx_savu_remove+0x10/0x10
[ 95.750385][ T10] hid_device_remove+0xc5/0x1c0
[ 95.752524][ T10] ? __pfx_hid_device_remove+0x10/0x10
[ 95.755043][ T10] device_release_driver_internal+0x48b/0x880
[ 95.757598][ T10] bus_remove_device+0x444/0x560
[ 95.760023][ T10] ? __pfx_bus_remove_device+0x10/0x10
[ 95.762795][ T10] ? kernfs_remove_by_name_ns+0x101/0x140
[ 95.765117][ T10] device_del+0x524/0x8f0
[ 95.766879][ T10] ? __pfx_device_del+0x10/0x10
[ 95.768993][ T10] hid_destroy_device+0x6b/0x1b0
[ 95.771063][ T10] usbhid_disconnect+0x9f/0xc0
[ 95.773090][ T10] usb_unbind_interface+0x295/0x9f0
[ 95.775293][ T10] ? kernfs_remove_by_name_ns+0x101/0x140
[ 95.777729][ T10] ? kernfs_remove_by_name_ns+0x101/0x140
[ 95.779951][ T10] ? __pfx_usb_unbind_interface+0x10/0x10
[ 95.782177][ T10] device_release_driver_internal+0x4f5/0x880
[ 95.784711][ T10] bus_remove_device+0x444/0x560
[ 95.786810][ T10] ? __pfx_bus_remove_device+0x10/0x10
[ 95.788962][ T10] ? kernfs_remove_by_name_ns+0x101/0x140
[ 95.791366][ T10] device_del+0x524/0x8f0
[ 95.793277][ T10] ? __pfx_device_del+0x10/0x10
[ 95.795420][ T10] ? kobject_put+0x516/0x550
[ 95.797411][ T10] usb_disable_device+0x3d4/0x8d0
[ 95.799430][ T10] usb_disconnect+0x346/0x9a0
[ 95.801326][ T10] hub_event+0x1bbb/0x4d30
[ 95.803217][ T10] ? __lock_acquire+0x6df/0x2e50
[ 95.805350][ T10] ? register_lock_class+0x31/0x2e0
[ 95.807525][ T10] ? rcu_is_watching+0x16/0xb0
[ 95.809739][ T10] ? __pfx_hub_event+0x10/0x10
[ 95.811860][ T10] ? rcu_is_watching+0x16/0xb0
[ 95.813926][ T10] ? process_scheduled_works+0x97a/0x1630
[ 95.816372][ T10] process_scheduled_works+0xc3d/0x1630
[ 95.818565][ T10] ? __pfx_process_scheduled_works+0x10/0x10
[ 95.821114][ T10] ? assign_work+0x3cf/0x5d0
[ 95.823133][ T10] worker_thread+0xa47/0xfb0
[ 95.825165][ T10] kthread+0x38b/0x480
[ 95.826870][ T10] ? __pfx_worker_thread+0x10/0x10
[ 95.829080][ T10] ? __pfx_kthread+0x10/0x10
[ 95.831069][ T10] ret_from_fork+0x514/0xb70
[ 95.833121][ T10] ? __pfx_ret_from_fork+0x10/0x10
[ 95.835140][ T10] ? __switch_to+0xc89/0x1420
[ 95.837143][ T10] ? __pfx_kthread+0x10/0x10
[ 95.839028][ T10] ret_from_fork_asm+0x1a/0x30
[ 95.841059][ T10]
[ 95.842706][ T10] Kernel Offset: disabled
[ 95.844496][ T10] Rebooting in 86400 seconds..