==================================================================
BUG: KASAN: slab-out-of-bounds in mcp2221_raw_event+0x110d/0x1140 drivers/hid/hid-mcp2221.c:975
Read of size 1 at addr ffff88813462ffff by task syz.2.296/6351

CPU: 1 UID: 0 PID: 6351 Comm: syz.2.296 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
 mcp2221_raw_event+0x110d/0x1140 drivers/hid/hid-mcp2221.c:975
 __hid_input_report.constprop.0+0x319/0x470 drivers/hid/hid-core.c:2175
 hid_irq_in+0x55d/0x710 drivers/hid/usbhid/hid-core.c:287
 __usb_hcd_giveback_urb+0x38e/0x610 drivers/usb/core/hcd.c:1657
 usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
 dummy_timer+0xdb2/0x3700 drivers/usb/gadget/udc/dummy_hcd.c:2019
 __run_hrtimer kernel/time/hrtimer.c:2067 [inline]
 __hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2124
 hrtimer_run_softirq+0x1ca/0x360 kernel/time/hrtimer.c:2141
 handle_softirqs+0x1d9/0x9b0 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0x168/0x210 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
RIP: 0010:rcu_read_lock include/linux/rcupdate.h:849 [inline]
RIP: 0010:is_bpf_text_address+0x26/0x1a0 kernel/bpf/core.c:749
Code: 90 90 90 90 0f 1f 40 d6 55 48 89 fd 53 e8 42 b3 ed ff e8 dd fc d1 ff 45 31 c9 45 31 c0 b9 02 00 00 00 48 8d 05 00 00 00 00 50 <31> d2 31 f6 48 c7 c7 20 4c 8e 89 e8 5a 7d c9 ff e8 55 f6 c0 05 31
RSP: 0018:ffffc900147779a8 EFLAGS: 00000246
RAX: ffffffff81c74585 RBX: 00007f3f42a8ddeb RCX: 0000000000000002
RDX: 0000000000000000 RSI: ffffffff81c7456e RDI: ffff88811521847c
RBP: 00007f3f42a8ddeb R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000200 R11: 0000000000000000 R12: ffffffff819f4a80
R13: ffffc90014777ac8 R14: 0000000000000000 R15: ffff888115218000
 kernel_text_address kernel/extable.c:125 [inline]
 kernel_text_address+0x8d/0x100 kernel/extable.c:94
 __kernel_text_address+0xd/0x30 kernel/extable.c:79
 unwind_get_return_address+0x59/0xa0 arch/x86/kernel/unwind_orc.c:385
 arch_stack_walk+0xa6/0xf0 arch/x86/kernel/stacktrace.c:26
 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x43/0x70 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2748 [inline]
 slab_free mm/slub.c:6499 [inline]
 kfree+0x20c/0x650 mm/slub.c:6792
 raw_ioctl_ep_write drivers/usb/gadget/legacy/raw_gadget.c:1154 [inline]
 raw_ioctl+0x265/0x2b80 drivers/usb/gadget/legacy/raw_gadget.c:1325
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl fs/ioctl.c:583 [inline]
 __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x119/0x710 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3f42a8ddeb
Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
RSP: 002b:00007f3f414e5f60 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f3f42a8ddeb
RDX: 00007f3f414e5fe0 RSI: 0000000040085507 RDI: 0000000000000003
RBP: 0000000000000003 R08: 00007f3f42e40320 R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000246 R12: 0000200000000080
R13: 0000000000000000 R14: 00007f3f42d15fa0 R15: 00007ffd394e0368
 </TASK>

Allocated by task 6311:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 unpoison_slab_object mm/kasan/common.c:340 [inline]
 __kasan_slab_alloc+0x6e/0x70 mm/kasan/common.c:366
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4683 [inline]
 slab_alloc_node mm/slub.c:4996 [inline]
 kmem_cache_alloc_noprof+0x264/0x650 mm/slub.c:5010
 lsm_inode_alloc security/security.c:254 [inline]
 security_inode_alloc+0x3b/0x150 security/security.c:1215
 inode_init_always_gfp+0xc6f/0xfb0 fs/inode.c:298
 inode_init_always include/linux/fs.h:2965 [inline]
 alloc_inode+0x8e/0x250 fs/inode.c:345
 new_inode+0x22/0x1c0 fs/inode.c:1171
 proc_pid_make_inode+0x22/0x160 fs/proc/base.c:1932
 proc_pid_make_base_inode.constprop.0+0x25/0x180 fs/proc/base.c:1983
 proc_pid_instantiate+0x51/0x1e0 fs/proc/base.c:3459
 proc_pid_lookup+0x1f3/0x4e0 fs/proc/base.c:3502
 proc_root_lookup+0x23/0x70 fs/proc/root.c:417
 __lookup_slow+0x155/0x320 fs/namei.c:1919
 lookup_slow+0x50/0x70 fs/namei.c:1936
 walk_component fs/namei.c:2282 [inline]
 link_path_walk+0x1712/0x1cc0 fs/namei.c:2653
 path_openat+0x1ac/0x2440 fs/namei.c:4996
 do_file_open+0x20e/0x430 fs/namei.c:5029
 do_sys_openat2+0x10f/0x1e0 fs/open.c:1417
 do_sys_open fs/open.c:1423 [inline]
 __do_sys_openat fs/open.c:1439 [inline]
 __se_sys_openat fs/open.c:1434 [inline]
 __x64_sys_openat+0x12d/0x210 fs/open.c:1434
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x119/0x710 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 14:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x43/0x70 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2748 [inline]
 slab_free mm/slub.c:6499 [inline]
 kmem_cache_free+0x108/0x650 mm/slub.c:6626
 rcu_do_batch kernel/rcu/tree.c:2650 [inline]
 rcu_core+0x5f0/0x1260 kernel/rcu/tree.c:2919
 handle_softirqs+0x1d9/0x9b0 kernel/softirq.c:645
 run_ksoftirqd kernel/softirq.c:1099 [inline]
 run_ksoftirqd+0x38/0x60 kernel/softirq.c:1091
 smpboot_thread_fn+0x3d3/0xab0 kernel/smpboot.c:160
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x69f/0xc90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Last potentially related work creation:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_record_aux_stack+0x8c/0xa0 mm/kasan/generic.c:556
 __call_rcu_common.constprop.0+0xa5/0x9b0 kernel/rcu/tree.c:3181
 security_inode_free+0x53/0x90 security/security.c:1253
 __destroy_inode+0x1ea/0x710 fs/inode.c:362
 destroy_inode+0x91/0x1c0 fs/inode.c:385
 evict+0x599/0xad0 fs/inode.c:846
 iput_final fs/inode.c:2015 [inline]
 iput.part.0+0x989/0x1050 fs/inode.c:2064
 iput+0x35/0x40 fs/inode.c:2030
 proc_invalidate_siblings_dcache+0x27e/0x750 fs/proc/inode.c:152
 release_task+0xd41/0x1ab0 kernel/exit.c:295
 wait_task_zombie kernel/exit.c:1313 [inline]
 wait_consider_task+0x1791/0x3e00 kernel/exit.c:1540
 do_wait_thread kernel/exit.c:1603 [inline]
 __do_wait+0x218/0x8b0 kernel/exit.c:1721
 do_wait+0x1ec/0x570 kernel/exit.c:1755
 kernel_wait4+0x16d/0x280 kernel/exit.c:1914
 __do_sys_wait4+0x161/0x170 kernel/exit.c:1942
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x119/0x710 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff88813462ff18
 which belongs to the cache lsm_inode_cache of size 120
The buggy address is located 111 bytes to the right of
 allocated 120-byte region [ffff88813462ff18, ffff88813462ff90)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13462f
flags: 0x200000000000000(node=0|zone=2)
page_type: f5(slab)
raw: 0200000000000000 ffff8881012e9500 dead000000000100 dead000000000122
raw: 0000000000000000 0000000200160016 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 2863, tgid 2863 (udevd), ts 135131450313
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871
 prep_new_page mm/page_alloc.c:1879 [inline]
 get_page_from_freelist+0xf4b/0x3440 mm/page_alloc.c:3943
 __alloc_frozen_pages_noprof+0x2d7/0x2f70 mm/page_alloc.c:5436
 alloc_slab_page mm/slub.c:3347 [inline]
 allocate_slab mm/slub.c:3462 [inline]
 new_slab+0xa9/0x6e0 mm/slub.c:3513
 refill_objects+0xe3/0x410 mm/slub.c:7410
 refill_sheaf mm/slub.c:2885 [inline]
 __pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4774
 alloc_from_pcs mm/slub.c:4850 [inline]
 slab_alloc_node mm/slub.c:4984 [inline]
 kmem_cache_alloc_noprof+0x471/0x650 mm/slub.c:5010
 lsm_inode_alloc security/security.c:254 [inline]
 security_inode_alloc+0x3b/0x150 security/security.c:1215
 inode_init_always_gfp+0xc6f/0xfb0 fs/inode.c:298
 inode_init_always include/linux/fs.h:2965 [inline]
 alloc_inode+0x8e/0x250 fs/inode.c:345
 new_inode+0x22/0x1c0 fs/inode.c:1171
 __shmem_get_inode+0x1df/0xec0 mm/shmem.c:3040
 shmem_get_inode mm/shmem.c:3137 [inline]
 shmem_mknod+0xcb/0x2e0 mm/shmem.c:3830
 lookup_open+0x1255/0x1990 fs/namei.c:4567
 open_last_lookups fs/namei.c:4767 [inline]
 path_openat+0xa2c/0x2440 fs/namei.c:4997
 do_file_open+0x20e/0x430 fs/namei.c:5029
page last free pid 24 tgid 24 ts 134966506733 stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 __free_pages_prepare mm/page_alloc.c:1418 [inline]
 __free_frozen_pages+0x714/0xfc0 mm/page_alloc.c:2962
 rcu_do_batch kernel/rcu/tree.c:2650 [inline]
 rcu_core+0x5f0/0x1260 kernel/rcu/tree.c:2919
 handle_softirqs+0x1d9/0x9b0 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0x168/0x210 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674

Memory state around the buggy address:
 ffff88813462fe80: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc
 ffff88813462ff00: fc fc fc fa fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88813462ff80: fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                                                                ^
 ffff888134630000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888134630080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess):
   0:	90                   	nop
   1:	90                   	nop
   2:	90                   	nop
   3:	90                   	nop
   4:	0f 1f 40 d6          	nopl   -0x2a(%rax)
   8:	55                   	push   %rbp
   9:	48 89 fd             	mov    %rdi,%rbp
   c:	53                   	push   %rbx
   d:	e8 42 b3 ed ff       	call   0xffedb354
  12:	e8 dd fc d1 ff       	call   0xffd1fcf4
  17:	45 31 c9             	xor    %r9d,%r9d
  1a:	45 31 c0             	xor    %r8d,%r8d
  1d:	b9 02 00 00 00       	mov    $0x2,%ecx
  22:	48 8d 05 00 00 00 00 	lea    0x0(%rip),%rax        # 0x29
  29:	50                   	push   %rax
* 2a:	31 d2                	xor    %edx,%edx <-- trapping instruction
  2c:	31 f6                	xor    %esi,%esi
  2e:	48 c7 c7 20 4c 8e 89 	mov    $0xffffffff898e4c20,%rdi
  35:	e8 5a 7d c9 ff       	call   0xffc97d94
  3a:	e8 55 f6 c0 05       	call   0x5c0f694
  3f:	31                   	.byte 0x31