program:
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102"], 0x0)
[ 85.432857][ T4652] Bluetooth: hci0: command tx timeout
[ 85.825514][ T1258] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 85.987444][ T1258] usb 5-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice= 1.00
[ 85.989624][ T1258] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64
[ 85.989644][ T1258] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64
[ 85.989657][ T1258] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0
[ 85.989667][ T1258] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0
[ 85.991369][ T1258] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 85.991384][ T1258] usb 5-1: Product: syz
[ 85.991392][ T1258] usb 5-1: Manufacturer: syz
[ 86.042914][ T5320] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[ 86.043045][ T5320] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[ 86.257783][ T1258] redrat3 5-1:1.0: Problem fetching firmware ID
[ 86.275618][ T1258] redrat3 5-1:1.0: Failed to read timeout from hardware
[ 86.355364][ T1258] rc_core: IR keymap rc-hauppauge not found
[ 86.355381][ T1258] Registered IR keymap rc-empty
[ 86.362017][ T1258] rc rc0: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/rc/rc0
[ 86.386608][ T1258] input: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/rc/rc0/input5
[ 86.417031][ T1258] redrat3 5-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0
[ 86.417668][ T1258] redrat3 5-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0
[ 86.417701][ T1258] redrat3 5-1:1.0: redrat3_enable_detector: detector status: -5, should be 1
[ 86.447784][ T1258] redrat3 5-1:1.0: probe with driver redrat3 failed with error -5
[ 86.462288][ T5327] ==================================================================
[ 86.462301][ T5327] BUG: KASAN: slab-use-after-free in string+0x216/0x2d0
[ 86.462414][ T5327] Read of size 1 at addr ffff888012398758 by task udevd/5327
[ 86.462424][ T5327]
[ 86.462431][ T5327] CPU: 0 UID: 0 PID: 5327 Comm: udevd Not tainted syzkaller #0 PREEMPT(full)
[ 86.462442][ T5327] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.462449][ T5327] Call Trace:
[ 86.462454][ T5327]
[ 86.462459][ T5327] dump_stack_lvl+0xe8/0x150
[ 86.462494][ T5327] print_address_description+0x55/0x1e0
[ 86.462510][ T5327] ? string+0x216/0x2d0
[ 86.462524][ T5327] print_report+0x58/0x70
[ 86.462537][ T5327] kasan_report+0x117/0x150
[ 86.462550][ T5327] ? string+0x216/0x2d0
[ 86.462565][ T5327] string+0x216/0x2d0
[ 86.462581][ T5327] vsnprintf+0x74a/0xef0
[ 86.462597][ T5327] vscnprintf+0x41/0x90
[ 86.462619][ T5327] sysfs_emit+0x10e/0x180
[ 86.462634][ T5327] ? __pfx_sysfs_emit+0x10/0x10
[ 86.462647][ T5327] ? sysfs_file_kobj+0x1a/0x230
[ 86.462660][ T5327] input_dev_show_name+0x58/0x70
[ 86.462676][ T5327] dev_attr_show+0x58/0xc0
[ 86.462724][ T5327] ? __pfx_dev_attr_show+0x10/0x10
[ 86.462737][ T5327] sysfs_kf_seq_show+0x331/0x490
[ 86.462752][ T5327] seq_read_iter+0x463/0xca0
[ 86.462767][ T5327] vfs_read+0x595/0xa80
[ 86.462781][ T5327] ? __pfx_vfs_read+0x10/0x10
[ 86.462794][ T5327] ? do_sys_openat2+0x14e/0x200
[ 86.462805][ T5327] ? kmem_cache_free+0x182/0x650
[ 86.462823][ T5327] ksys_read+0x150/0x270
[ 86.462837][ T5327] ? __pfx_ksys_read+0x10/0x10
[ 86.462853][ T5327] do_syscall_64+0x166/0x520
[ 86.462864][ T5327] ? trace_irq_disable+0x3b/0x140
[ 86.462875][ T5327] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.462885][ T5327] ? clear_bhb_loop+0x70/0xc0
[ 86.462897][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.462908][ T5327] RIP: 0033:0x7f5aa2ea7407
[ 86.462919][ T5327] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[ 86.462928][ T5327] RSP: 002b:00007fff64704470 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[ 86.462941][ T5327] RAX: ffffffffffffffda RBX: 00007f5aa36af880 RCX: 00007f5aa2ea7407
[ 86.462949][ T5327] RDX: 0000000000001000 RSI: 00007fff64704950 RDI: 0000000000000008
[ 86.462956][ T5327] RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000
[ 86.462963][ T5327] R10: 0000000000000000 R11: 0000000000000202 R12: 000055eba31441c0
[ 86.462969][ T5327] R13: 00007fff64704550 R14: 00007fff64704950 R15: 000055eba2696bcc
[ 86.462981][ T5327]
[ 86.462985][ T5327]
[ 86.462988][ T5327] Allocated by task 1258:
[ 86.462993][ T5327] kasan_save_track+0x3e/0x80
[ 86.463008][ T5327] __kasan_kmalloc+0x93/0xb0
[ 86.463017][ T5327] __kmalloc_cache_noprof+0x321/0x600
[ 86.463031][ T5327] redrat3_dev_probe+0x477/0x2570
[ 86.463044][ T5327] usb_probe_interface+0x788/0xe50
[ 86.463055][ T5327] really_probe+0x254/0xae0
[ 86.463064][ T5327] __driver_probe_device+0x1e8/0x360
[ 86.463074][ T5327] driver_probe_device+0x4f/0x240
[ 86.463083][ T5327] __device_attach_driver+0x270/0x410
[ 86.463093][ T5327] bus_for_each_drv+0x258/0x2f0
[ 86.463105][ T5327] __device_attach+0x2c4/0x450
[ 86.463113][ T5327] device_initial_probe+0xa1/0xd0
[ 86.463122][ T5327] bus_probe_device+0x12a/0x220
[ 86.463133][ T5327] device_add+0x7d7/0xb80
[ 86.463146][ T5327] usb_set_configuration+0x1ad8/0x2180
[ 86.463156][ T5327] usb_generic_driver_probe+0x8d/0x150
[ 86.463166][ T5327] usb_probe_device+0x1c3/0x3b0
[ 86.463175][ T5327] really_probe+0x254/0xae0
[ 86.463184][ T5327] __driver_probe_device+0x1e8/0x360
[ 86.463193][ T5327] driver_probe_device+0x4f/0x240
[ 86.463202][ T5327] __device_attach_driver+0x270/0x410
[ 86.463211][ T5327] bus_for_each_drv+0x258/0x2f0
[ 86.463222][ T5327] __device_attach+0x2c4/0x450
[ 86.463230][ T5327] device_initial_probe+0xa1/0xd0
[ 86.463238][ T5327] bus_probe_device+0x12a/0x220
[ 86.463249][ T5327] device_add+0x7d7/0xb80
[ 86.463261][ T5327] usb_new_device+0x9aa/0x1690
[ 86.463274][ T5327] hub_event+0x28e8/0x4d30
[ 86.463283][ T5327] process_scheduled_works+0xc3d/0x1630
[ 86.463295][ T5327] worker_thread+0xa47/0xfb0
[ 86.463307][ T5327] kthread+0x38b/0x480
[ 86.463315][ T5327] ret_from_fork+0x514/0xb70
[ 86.463325][ T5327] ret_from_fork_asm+0x1a/0x30
[ 86.463339][ T5327]
[ 86.463342][ T5327] Freed by task 1258:
[ 86.463347][ T5327] kasan_save_track+0x3e/0x80
[ 86.463360][ T5327] kasan_save_free_info+0x40/0x50
[ 86.463371][ T5327] __kasan_slab_free+0x5c/0x80
[ 86.463379][ T5327] kfree+0x1c5/0x650
[ 86.463390][ T5327] redrat3_dev_probe+0x1bf4/0x2570
[ 86.463402][ T5327] usb_probe_interface+0x788/0xe50
[ 86.463412][ T5327] really_probe+0x254/0xae0
[ 86.463421][ T5327] __driver_probe_device+0x1e8/0x360
[ 86.463430][ T5327] driver_probe_device+0x4f/0x240
[ 86.463439][ T5327] __device_attach_driver+0x270/0x410
[ 86.463448][ T5327] bus_for_each_drv+0x258/0x2f0
[ 86.463460][ T5327] __device_attach+0x2c4/0x450
[ 86.463469][ T5327] device_initial_probe+0xa1/0xd0
[ 86.463477][ T5327] bus_probe_device+0x12a/0x220
[ 86.463488][ T5327] device_add+0x7d7/0xb80
[ 86.463500][ T5327] usb_set_configuration+0x1ad8/0x2180
[ 86.463510][ T5327] usb_generic_driver_probe+0x8d/0x150
[ 86.463519][ T5327] usb_probe_device+0x1c3/0x3b0
[ 86.463529][ T5327] really_probe+0x254/0xae0
[ 86.463538][ T5327] __driver_probe_device+0x1e8/0x360
[ 86.463548][ T5327] driver_probe_device+0x4f/0x240
[ 86.463557][ T5327] __device_attach_driver+0x270/0x410
[ 86.463567][ T5327] bus_for_each_drv+0x258/0x2f0
[ 86.463577][ T5327] __device_attach+0x2c4/0x450
[ 86.463586][ T5327] device_initial_probe+0xa1/0xd0
[ 86.463594][ T5327] bus_probe_device+0x12a/0x220
[ 86.463606][ T5327] device_add+0x7d7/0xb80
[ 86.463625][ T5327] usb_new_device+0x9aa/0x1690
[ 86.463639][ T5327] hub_event+0x28e8/0x4d30
[ 86.463648][ T5327] process_scheduled_works+0xc3d/0x1630
[ 86.463659][ T5327] worker_thread+0xa47/0xfb0
[ 86.463671][ T5327] kthread+0x38b/0x480
[ 86.463679][ T5327] ret_from_fork+0x514/0xb70
[ 86.463688][ T5327] ret_from_fork_asm+0x1a/0x30
[ 86.463701][ T5327]
[ 86.463704][ T5327] The buggy address belongs to the object at ffff888012398000
[ 86.463704][ T5327] which belongs to the cache kmalloc-2k of size 2048
[ 86.463713][ T5327] The buggy address is located 1880 bytes inside of
[ 86.463713][ T5327] freed 2048-byte region [ffff888012398000, ffff888012398800)
[ 86.463724][ T5327]
[ 86.463727][ T5327] The buggy address belongs to the physical page:
[ 86.463734][ T5327] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12398
[ 86.463744][ T5327] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 86.463752][ T5327] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 86.463763][ T5327] page_type: f5(slab)
[ 86.463772][ T5327] raw: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122
[ 86.463780][ T5327] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 86.463790][ T5327] head: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122
[ 86.463799][ T5327] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 86.463807][ T5327] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 86.463815][ T5327] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 86.463821][ T5327] page dumped because: kasan: bad access detected
[ 86.463826][ T5327] page_owner tracks the page as allocated
[ 86.463830][ T5327] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1258, tgid 1258 (kworker/0:3), ts 86060266069
[ 86.463847][ T5327] post_alloc_hook+0x1f9/0x250
[ 86.463860][ T5327] get_page_from_freelist+0x2209/0x2280
[ 86.463874][ T5327] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 86.463888][ T5327] allocate_slab+0x7d/0x620
[ 86.463899][ T5327] refill_objects+0x2d5/0x350
[ 86.463909][ T5327] __pcs_replace_empty_main+0x2c8/0x6c0
[ 86.463919][ T5327] __kmalloc_cache_noprof+0x39b/0x600
[ 86.463932][ T5327] redrat3_dev_probe+0x477/0x2570
[ 86.463944][ T5327] usb_probe_interface+0x788/0xe50
[ 86.463954][ T5327] really_probe+0x254/0xae0
[ 86.463962][ T5327] __driver_probe_device+0x1e8/0x360
[ 86.463971][ T5327] driver_probe_device+0x4f/0x240
[ 86.463980][ T5327] __device_attach_driver+0x270/0x410
[ 86.463989][ T5327] bus_for_each_drv+0x258/0x2f0
[ 86.464000][ T5327] __device_attach+0x2c4/0x450
[ 86.464008][ T5327] device_initial_probe+0xa1/0xd0
[ 86.464017][ T5327] page last free pid 1 tgid 1 ts 28930471611 stack trace:
[ 86.464025][ T5327] __free_frozen_pages+0xc93/0xd90
[ 86.464037][ T5327] free_reserved_area+0x204/0x2e0
[ 86.464049][ T5327] free_kernel_image_pages+0xa2/0x100
[ 86.464063][ T5327] kernel_init+0x36/0x1d0
[ 86.464075][ T5327] ret_from_fork+0x514/0xb70
[ 86.464083][ T5327] ret_from_fork_asm+0x1a/0x30
[ 86.464096][ T5327]
[ 86.464099][ T5327] Memory state around the buggy address:
[ 86.464105][ T5327] ffff888012398600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 86.464111][ T5327] ffff888012398680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 86.464117][ T5327] >ffff888012398700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 86.464122][ T5327] ^
[ 86.464128][ T5327] ffff888012398780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 86.464135][ T5327] ffff888012398800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 86.464140][ T5327] ==================================================================
[ 86.464148][ T5327] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 86.874343][ T5327] CPU: 0 UID: 0 PID: 5327 Comm: udevd Not tainted syzkaller #0 PREEMPT(full)
[ 86.879009][ T5327] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.884187][ T5327] Call Trace:
[ 86.886227][ T5327]
[ 86.887879][ T5327] vpanic+0x56d/0xa60
[ 86.889798][ T5327] ? __pfx_vpanic+0x10/0x10
[ 86.891821][ T5327] panic+0xc5/0xd0
[ 86.893501][ T5327] ? __pfx_panic+0x10/0x10
[ 86.895433][ T5327] ? string+0x216/0x2d0
[ 86.898306][ T5327] ? string+0x216/0x2d0
[ 86.900063][ T5327] check_panic_on_warn+0x89/0xb0
[ 86.902166][ T5327] ? string+0x216/0x2d0
[ 86.903939][ T5327] end_report+0x73/0x170
[ 86.905843][ T5327] ? string+0x216/0x2d0
[ 86.907760][ T5327] kasan_report+0x128/0x150
[ 86.910127][ T5327] ? string+0x216/0x2d0
[ 86.912212][ T5327] string+0x216/0x2d0
[ 86.914012][ T5327] vsnprintf+0x74a/0xef0
[ 86.915867][ T5327] vscnprintf+0x41/0x90
[ 86.917766][ T5327] sysfs_emit+0x10e/0x180
[ 86.920199][ T5327] ? __pfx_sysfs_emit+0x10/0x10
[ 86.922272][ T5327] ? sysfs_file_kobj+0x1a/0x230
[ 86.924341][ T5327] input_dev_show_name+0x58/0x70
[ 86.926793][ T5327] dev_attr_show+0x58/0xc0
[ 86.929033][ T5327] ? __pfx_dev_attr_show+0x10/0x10
[ 86.931165][ T5327] sysfs_kf_seq_show+0x331/0x490
[ 86.933287][ T5327] seq_read_iter+0x463/0xca0
[ 86.935205][ T5327] vfs_read+0x595/0xa80
[ 86.936869][ T5327] ? __pfx_vfs_read+0x10/0x10
[ 86.938843][ T5327] ? do_sys_openat2+0x14e/0x200
[ 86.940824][ T5327] ? kmem_cache_free+0x182/0x650
[ 86.942921][ T5327] ksys_read+0x150/0x270
[ 86.944735][ T5327] ? __pfx_ksys_read+0x10/0x10
[ 86.946773][ T5327] do_syscall_64+0x166/0x520
[ 86.948794][ T5327] ? trace_irq_disable+0x3b/0x140
[ 86.950939][ T5327] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.953503][ T5327] ? clear_bhb_loop+0x70/0xc0
[ 86.955519][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.958128][ T5327] RIP: 0033:0x7f5aa2ea7407
[ 86.960065][ T5327] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[ 86.968068][ T5327] RSP: 002b:00007fff64704470 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[ 86.971579][ T5327] RAX: ffffffffffffffda RBX: 00007f5aa36af880 RCX: 00007f5aa2ea7407
[ 86.974834][ T5327] RDX: 0000000000001000 RSI: 00007fff64704950 RDI: 0000000000000008
[ 86.978204][ T5327] RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000
[ 86.981553][ T5327] R10: 0000000000000000 R11: 0000000000000202 R12: 000055eba31441c0
[ 86.984955][ T5327] R13: 00007fff64704550 R14: 00007fff64704950 R15: 000055eba2696bcc
[ 86.988337][ T5327]
[ 86.990069][ T5327] Kernel Offset: disabled
[ 86.991973][ T5327] Rebooting in 86400 seconds..