================================================================== BUG: KASAN: stack-out-of-bounds in cp2112_write_req drivers/hid/hid-cp2112.c:483 [inline] BUG: KASAN: stack-out-of-bounds in cp2112_xfer+0x714/0xf00 drivers/hid/hid-cp2112.c:698 Read of size 42 at addr ffffc9000470fd41 by task syz.0.964/9623 CPU: 0 PID: 9623 Comm: syz.0.964 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:364 [inline] print_report+0xac/0x220 mm/kasan/report.c:468 kasan_report+0x117/0x150 mm/kasan/report.c:581 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x288/0x290 mm/kasan/generic.c:187 __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105 cp2112_write_req drivers/hid/hid-cp2112.c:483 [inline] cp2112_xfer+0x714/0xf00 drivers/hid/hid-cp2112.c:698 __i2c_smbus_xfer+0x888/0x1d90 drivers/i2c/i2c-core-smbus.c:590 i2c_smbus_xfer+0x267/0x3a0 drivers/i2c/i2c-core-smbus.c:545 i2cdev_ioctl_smbus+0x423/0x670 drivers/i2c/i2c-dev.c:381 i2cdev_ioctl+0x5d1/0x7e0 drivers/i2c/i2c-dev.c:467 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl+0xfd/0x170 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fcefd78f749 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fcefe70e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fcefd9e5fa0 RCX: 00007fcefd78f749 RDX: 0000200000000200 RSI: 0000000000000720 RDI: 0000000000000004 RBP: 00007fcefd813f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fcefd9e6038 R14: 00007fcefd9e5fa0 R15: 00007ffc7df80f88 The buggy address belongs to stack of task syz.0.964/9623 and is located at offset 33 in frame: i2cdev_ioctl_smbus+0x0/0x670 This frame has 1 object: [32, 66) 'temp' The buggy address belongs to a 8-page vmalloc region starting at 0xffffc90004708000 allocated at copy_process+0x549/0x3d70 kernel/fork.c:2331 The buggy address belongs to the physical page: page:ffffea00009c4b40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2712d memcg:ffff888077ddcd02 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff ffff888077ddcd02 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102dc2(GFP_HIGHUSER|__GFP_NOWARN|__GFP_ZERO), pid 9611, tgid 9611 (syz.0.960), ts 502844571524, free_ts 500710453766 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1cd/0x210 mm/page_alloc.c:1554 prep_new_page mm/page_alloc.c:1561 [inline] get_page_from_freelist+0x195c/0x19f0 mm/page_alloc.c:3191 __alloc_pages+0x1e3/0x460 mm/page_alloc.c:4457 vm_area_alloc_pages mm/vmalloc.c:3089 [inline] __vmalloc_area_node mm/vmalloc.c:3158 [inline] __vmalloc_node_range+0x96b/0x1320 mm/vmalloc.c:3339 alloc_thread_stack_node kernel/fork.c:310 [inline] dup_task_struct+0x3d0/0x7c0 kernel/fork.c:1124 copy_process+0x549/0x3d70 kernel/fork.c:2331 kernel_clone+0x21b/0x840 kernel/fork.c:2914 __do_sys_clone3 kernel/fork.c:3215 [inline] __se_sys_clone3+0x252/0x2c0 kernel/fork.c:3199 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1154 [inline] free_unref_page_prepare+0x7ce/0x8e0 mm/page_alloc.c:2336 free_unref_page+0x32/0x2e0 mm/page_alloc.c:2429 vfree+0x1a6/0x320 mm/vmalloc.c:2868 dvb_usb_adapter_dvb_exit+0x9c/0x1b0 drivers/media/usb/dvb-usb/dvb-usb-dvb.c:225 dvb_usb_adapter_exit+0x8b/0x230 drivers/media/usb/dvb-usb/dvb-usb-init.c:128 dvb_usb_exit drivers/media/usb/dvb-usb/dvb-usb-init.c:143 [inline] dvb_usb_device_exit+0x1b7/0x330 drivers/media/usb/dvb-usb/dvb-usb-init.c:338 usb_unbind_interface+0x1f2/0x870 drivers/usb/core/driver.c:458 device_remove drivers/base/dd.c:569 [inline] __device_release_driver drivers/base/dd.c:1272 [inline] device_release_driver_internal+0x4cb/0x7a0 drivers/base/dd.c:1295 bus_remove_device+0x342/0x400 drivers/base/bus.c:576 device_del+0x50b/0x900 drivers/base/core.c:3872 usb_disable_device+0x3e9/0x8a0 drivers/usb/core/message.c:1416 usb_disconnect+0x34c/0x8a0 drivers/usb/core/hub.c:2315 hub_port_connect drivers/usb/core/hub.c:5369 [inline] hub_port_connect_change drivers/usb/core/hub.c:5669 [inline] port_event drivers/usb/core/hub.c:5833 [inline] hub_event+0x1cef/0x49c0 drivers/usb/core/hub.c:5915 process_one_work kernel/workqueue.c:2634 [inline] process_scheduled_works+0xa45/0x15b0 kernel/workqueue.c:2711 worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792 kthread+0x2fa/0x390 kernel/kthread.c:388 Memory state around the buggy address: ffffc9000470fc00: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 f3 f3 f3 ffffc9000470fc80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffc9000470fd00: 00 00 00 00 f1 f1 f1 f1 00 00 00 00 02 f3 f3 f3 ^ ffffc9000470fd80: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 ffffc9000470fe00: f1 f1 f1 f1 04 f2 00 00 f2 f2 00 00 f3 f3 f3 f3 ==================================================================