================================================================== BUG: KASAN: slab-use-after-free in read_report_descriptor+0xb4/0x100 drivers/hid/hid-core.c:2244 Read of size 40 at addr ffff88811c4cad80 by task fido_id/1756 CPU: 0 UID: 0 PID: 1756 Comm: fido_id Not tainted syzkaller #0 c7f5503d26b438f3979f72c504038c741c73a5b1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:94 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120 print_address_description+0x71/0x210 mm/kasan/report.c:377 print_report+0x4a/0x70 mm/kasan/report.c:481 kasan_report+0x162/0x1a0 mm/kasan/report.c:594 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x25a/0x2b0 mm/kasan/generic.c:189 __asan_memcpy+0x31/0x80 mm/kasan/shadow.c:105 read_report_descriptor+0xb4/0x100 drivers/hid/hid-core.c:2244 sysfs_kf_bin_read+0x1c6/0x200 fs/sysfs/file.c:97 kernfs_file_read_iter fs/kernfs/file.c:269 [inline] kernfs_fop_read_iter+0x2fa/0x570 fs/kernfs/file.c:298 new_sync_read fs/read_write.c:489 [inline] vfs_read+0x60b/0xc70 fs/read_write.c:570 ksys_read+0x145/0x260 fs/read_write.c:713 __do_sys_read fs/read_write.c:723 [inline] __se_sys_read fs/read_write.c:721 [inline] __x64_sys_read+0x7f/0x90 fs/read_write.c:721 x64_sys_call+0x2638/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:1 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f8c906a7407 Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: 002b:00007ffdc6c6fd40 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007f8c90e9b880 RCX: 00007f8c906a7407 RDX: 0000000000001000 RSI: 00007ffdc6c6fd90 RDI: 0000000000000004 RBP: 000055d325b2e2c0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 000055d325b2d4c0 R13: 00007ffdc6c6fd90 R14: 0000000000000004 R15: 000055d2eba484d8 Allocated by task 357: kasan_save_stack mm/kasan/common.c:49 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:70 kasan_save_alloc_info+0x3a/0x50 mm/kasan/generic.c:565 poison_kmalloc_redzone mm/kasan/common.c:379 [inline] __kasan_kmalloc+0x96/0xb0 mm/kasan/common.c:396 kasan_kmalloc include/linux/kasan.h:261 [inline] __do_kmalloc_node mm/slub.c:4395 [inline] __kmalloc_node_track_caller_noprof+0x24e/0x4f0 mm/slub.c:4414 kmemdup_noprof+0x31/0x80 mm/util.c:139 kmemdup_noprof include/linux/fortify-string.h:753 [inline] hid_open_report+0x200/0x1120 drivers/hid/hid-core.c:1276 hid_parse include/linux/hid.h:1139 [inline] pl_probe+0x88/0xb40 drivers/hid/hid-pl.c:185 __hid_device_probe drivers/hid/hid-core.c:2760 [inline] hid_device_probe+0x2ce/0x5f0 drivers/hid/hid-core.c:2797 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x2e1/0x8b0 drivers/base/dd.c:657 __driver_probe_device+0x193/0x280 drivers/base/dd.c:799 driver_probe_device+0x54/0x3f0 drivers/base/dd.c:829 __device_attach_driver+0x2f1/0x4b0 drivers/base/dd.c:957 bus_for_each_drv+0x264/0x300 drivers/base/bus.c:459 __device_attach+0x2c4/0x3c0 drivers/base/dd.c:1029 device_initial_probe+0x1e/0x30 drivers/base/dd.c:1078 bus_probe_device+0x18b/0x270 drivers/base/bus.c:534 device_add+0x7fd/0xbf0 drivers/base/core.c:3692 hid_add_device+0x3c4/0x5a0 drivers/hid/hid-core.c:2943 usbhid_probe+0xdca/0x1310 drivers/hid/usbhid/hid-core.c:1451 usb_probe_interface+0x6a8/0xbf0 drivers/usb/core/driver.c:400 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x2e1/0x8b0 drivers/base/dd.c:657 __driver_probe_device+0x193/0x280 drivers/base/dd.c:799 driver_probe_device+0x54/0x3f0 drivers/base/dd.c:829 __device_attach_driver+0x2f1/0x4b0 drivers/base/dd.c:957 bus_for_each_drv+0x264/0x300 drivers/base/bus.c:459 __device_attach+0x2c4/0x3c0 drivers/base/dd.c:1029 device_initial_probe+0x1e/0x30 drivers/base/dd.c:1078 bus_probe_device+0x18b/0x270 drivers/base/bus.c:534 device_add+0x7fd/0xbf0 drivers/base/core.c:3692 usb_set_configuration+0x1aad/0x2080 drivers/usb/core/message.c:2268 usb_generic_driver_probe+0x95/0x160 drivers/usb/core/generic.c:254 usb_probe_device+0x1f2/0x3b0 drivers/usb/core/driver.c:295 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x2e1/0x8b0 drivers/base/dd.c:657 __driver_probe_device+0x193/0x280 drivers/base/dd.c:799 driver_probe_device+0x54/0x3f0 drivers/base/dd.c:829 __device_attach_driver+0x2f1/0x4b0 drivers/base/dd.c:957 bus_for_each_drv+0x264/0x300 drivers/base/bus.c:459 __device_attach+0x2c4/0x3c0 drivers/base/dd.c:1029 device_initial_probe+0x1e/0x30 drivers/base/dd.c:1078 bus_probe_device+0x18b/0x270 drivers/base/bus.c:534 device_add+0x7fd/0xbf0 drivers/base/core.c:3692 usb_new_device+0x98d/0x1500 drivers/usb/core/hub.c:2703 hub_port_connect drivers/usb/core/hub.c:5574 [inline] hub_port_connect_change drivers/usb/core/hub.c:5714 [inline] port_event drivers/usb/core/hub.c:5878 [inline] hub_event+0x2dbd/0x4360 drivers/usb/core/hub.c:5960 process_one_work kernel/workqueue.c:3273 [inline] process_scheduled_works+0x7f7/0x1060 kernel/workqueue.c:3354 worker_thread+0xc99/0x13f0 kernel/workqueue.c:3435 kthread+0x2c7/0x360 kernel/kthread.c:389 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Freed by task 357: kasan_save_stack mm/kasan/common.c:49 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:70 kasan_save_free_info+0x44/0x50 mm/kasan/generic.c:579 poison_slab_object mm/kasan/common.c:249 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:266 kasan_slab_free include/linux/kasan.h:234 [inline] slab_free_hook mm/slub.c:2445 [inline] slab_free mm/slub.c:4714 [inline] kfree+0x158/0x440 mm/slub.c:4875 hid_close_report+0x628/0x6f0 drivers/hid/hid-core.c:723 __hid_device_probe drivers/hid/hid-core.c:2777 [inline] hid_device_probe+0x538/0x5f0 drivers/hid/hid-core.c:2797 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x2e1/0x8b0 drivers/base/dd.c:657 __driver_probe_device+0x193/0x280 drivers/base/dd.c:799 driver_probe_device+0x54/0x3f0 drivers/base/dd.c:829 __device_attach_driver+0x2f1/0x4b0 drivers/base/dd.c:957 bus_for_each_drv+0x264/0x300 drivers/base/bus.c:459 __device_attach+0x2c4/0x3c0 drivers/base/dd.c:1029 device_initial_probe+0x1e/0x30 drivers/base/dd.c:1078 bus_probe_device+0x18b/0x270 drivers/base/bus.c:534 device_add+0x7fd/0xbf0 drivers/base/core.c:3692 hid_add_device+0x3c4/0x5a0 drivers/hid/hid-core.c:2943 usbhid_probe+0xdca/0x1310 drivers/hid/usbhid/hid-core.c:1451 usb_probe_interface+0x6a8/0xbf0 drivers/usb/core/driver.c:400 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x2e1/0x8b0 drivers/base/dd.c:657 __driver_probe_device+0x193/0x280 drivers/base/dd.c:799 driver_probe_device+0x54/0x3f0 drivers/base/dd.c:829 __device_attach_driver+0x2f1/0x4b0 drivers/base/dd.c:957 bus_for_each_drv+0x264/0x300 drivers/base/bus.c:459 __device_attach+0x2c4/0x3c0 drivers/base/dd.c:1029 device_initial_probe+0x1e/0x30 drivers/base/dd.c:1078 bus_probe_device+0x18b/0x270 drivers/base/bus.c:534 device_add+0x7fd/0xbf0 drivers/base/core.c:3692 usb_set_configuration+0x1aad/0x2080 drivers/usb/core/message.c:2268 usb_generic_driver_probe+0x95/0x160 drivers/usb/core/generic.c:254 usb_probe_device+0x1f2/0x3b0 drivers/usb/core/driver.c:295 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x2e1/0x8b0 drivers/base/dd.c:657 __driver_probe_device+0x193/0x280 drivers/base/dd.c:799 driver_probe_device+0x54/0x3f0 drivers/base/dd.c:829 __device_attach_driver+0x2f1/0x4b0 drivers/base/dd.c:957 bus_for_each_drv+0x264/0x300 drivers/base/bus.c:459 __device_attach+0x2c4/0x3c0 drivers/base/dd.c:1029 device_initial_probe+0x1e/0x30 drivers/base/dd.c:1078 bus_probe_device+0x18b/0x270 drivers/base/bus.c:534 device_add+0x7fd/0xbf0 drivers/base/core.c:3692 usb_new_device+0x98d/0x1500 drivers/usb/core/hub.c:2703 hub_port_connect drivers/usb/core/hub.c:5574 [inline] hub_port_connect_change drivers/usb/core/hub.c:5714 [inline] port_event drivers/usb/core/hub.c:5878 [inline] hub_event+0x2dbd/0x4360 drivers/usb/core/hub.c:5960 process_one_work kernel/workqueue.c:3273 [inline] process_scheduled_works+0x7f7/0x1060 kernel/workqueue.c:3354 worker_thread+0xc99/0x13f0 kernel/workqueue.c:3435 kthread+0x2c7/0x360 kernel/kthread.c:389 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 The buggy address belongs to the object at ffff88811c4cad80 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 0 bytes inside of freed 64-byte region [ffff88811c4cad80, ffff88811c4cadc0) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88811c4ca080 pfn:0x11c4ca flags: 0x4000000000000000(zone=1) page_type: f5(slab) raw: 4000000000000000 ffff8881000418c0 ffffea00046dda40 dead000000000002 raw: ffff88811c4ca080 000000000020001d 00000001f5000000 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 211, tgid 211 (dhcpcd-run-hook), ts 13101211336, free_ts 8288184579 set_page_owner include/linux/page_owner.h:35 [inline] post_alloc_hook+0x37d/0x3b0 mm/page_alloc.c:1863 prep_new_page+0x2d/0x180 mm/page_alloc.c:1871 get_page_from_freelist+0x4aea/0x4ba0 mm/page_alloc.c:3948 __alloc_pages_noprof+0x35a/0x7e0 mm/page_alloc.c:5315 alloc_slab_page+0x6b/0x1e0 mm/slub.c:-1 allocate_slab+0x69/0x430 mm/slub.c:2687 new_slab mm/slub.c:2741 [inline] ___slab_alloc+0x591/0x8c0 mm/slub.c:3934 __slab_alloc mm/slub.c:4025 [inline] __slab_alloc_node mm/slub.c:4078 [inline] slab_alloc_node mm/slub.c:4239 [inline] __kmalloc_cache_noprof+0x2cd/0x470 mm/slub.c:4421 kmalloc_noprof include/linux/slab.h:881 [inline] kzalloc_noprof include/linux/slab.h:1017 [inline] alloc_task_dma_buf_info drivers/dma-buf/dma-buf.c:492 [inline] compute_dmabuf_info drivers/dma-buf/dma-buf.c:528 [inline] copy_dmabuf_info+0x385/0xf30 drivers/dma-buf/dma-buf.c:666 copy_process+0x1adf/0x3350 kernel/fork.c:2519 kernel_clone+0x233/0x810 kernel/fork.c:2851 __do_sys_clone kernel/fork.c:2996 [inline] __se_sys_clone kernel/fork.c:2980 [inline] __x64_sys_clone+0x1b7/0x230 kernel/fork.c:2980 x64_sys_call+0x2b3c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:57 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e page last free pid 20 tgid 20 stack trace: reset_page_owner include/linux/page_owner.h:28 [inline] free_pages_prepare mm/page_alloc.c:1390 [inline] free_unref_page+0xbb8/0xf70 mm/page_alloc.c:2876 __free_pages+0x6b/0x3b0 mm/page_alloc.c:5402 free_pages+0x86/0x90 mm/page_alloc.c:5415 __tlb_remove_table_free mm/mmu_gather.c:230 [inline] tlb_remove_table_rcu+0x366/0x3d0 mm/mmu_gather.c:283 rcu_do_batch+0x56a/0xcb0 kernel/rcu/tree.c:2575 nocb_cb_wait kernel/rcu/tree_nocb.h:923 [inline] rcu_nocb_cb_kthread+0x533/0xb60 kernel/rcu/tree_nocb.h:957 kthread+0x2c7/0x360 kernel/kthread.c:389 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Memory state around the buggy address: ffff88811c4cac80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff88811c4cad00: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc >ffff88811c4cad80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ffff88811c4cae00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff88811c4cae80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ==================================================================