==================================================================
BUG: KASAN: slab-use-after-free in tasklet_action_common+0x103/0x490 kernel/softirq.c:954
Read of size 8 at addr ffff88803610d158 by task syz.1.3001/16900

CPU: 0 UID: 0 PID: 16900 Comm: syz.1.3001 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 tasklet_action_common+0x103/0x490 kernel/softirq.c:954
 handle_softirqs+0x226/0x860 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:lock_acquire+0x232/0x350 kernel/locking/lockdep.c:5947
Code: ff ff ff e8 b0 9d 43 0a f7 44 24 10 00 02 00 00 0f 84 38 ff ff ff 65 48 8b 05 42 48 f2 11 48 3b 44 24 50 75 33 fb 48 83 c4 58 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 48 8d 3d 87 56 da
RSP: 0018:ffffc900058a76b0 EFLAGS: 00000292
RAX: 268ef7e220fdbb00 RBX: 0000000000000000 RCX: 0000000000000046
RDX: 000000006dc0dabe RSI: ffffffff8e69f504 RDI: ffffffff8c6dad80
RBP: ffff888030af0000 R08: ffffffff82416369 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff20f4c90 R12: ffffffff8ed5c8a0
R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000246
 rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 rcu_read_lock include/linux/rcupdate.h:849 [inline]
 percpu_ref_put_many include/linux/percpu-refcount.h:331 [inline]
 percpu_ref_put+0x35/0x180 include/linux/percpu-refcount.h:352
 css_put include/linux/cgroup_refcnt.h:79 [inline]
 __mem_cgroup_charge+0x56/0x80 mm/memcontrol.c:5228
 mem_cgroup_charge include/linux/memcontrol.h:662 [inline]
 folio_prealloc mm/memory.c:1296 [inline]
 alloc_anon_folio mm/memory.c:5387 [inline]
 do_anonymous_page mm/memory.c:5482 [inline]
 do_pte_missing+0x175b/0x34b0 mm/memory.c:4698
 handle_pte_fault mm/memory.c:6558 [inline]
 __handle_mm_fault mm/memory.c:6707 [inline]
 handle_mm_fault+0x1a53/0x3750 mm/memory.c:6876
 do_user_addr_fault+0x746/0x1340 arch/x86/mm/fault.c:1394
 handle_page_fault arch/x86/mm/fault.c:1483 [inline]
 exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1536
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595
RIP: 0010:rep_stos_alternative+0x5b/0x80 arch/x86/lib/clear_page_64.S:83
Code: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 07 48 89 47 08 48 89 47 10 48 89 47 18 48 89 47 20 48 89 47 28 48 89 47 30 <48> 89 47 38 48 83 c7 40 48 83 e9 40 48 83 f9 40 73 d3 83 f9 08 73
RSP: 0018:ffffc900058a7bf8 EFLAGS: 00050206
RAX: 0000000000000000 RBX: 0000200100000136 RCX: 00000000ffe9d16e
RDX: 000000008332a1de RSI: ffffffff8e69f504 RDI: 0000200000162fc8
RBP: ffffc900058a7ea8 R08: ffffffff821ed4ef R09: 0000000000000000
R10: dffffc0000000000 R11: fffff52000b14fbe R12: 0000200000000208
R13: 00000000ffffff2e R14: 0000000000000001 R15: 00007ffffffff000
 __clear_user arch/x86/include/asm/uaccess_64.h:190 [inline]
 clear_user arch/x86/include/asm/uaccess_64.h:207 [inline]
 evdev_get_mask drivers/input/evdev.c:1026 [inline]
 evdev_do_ioctl drivers/input/evdev.c:1108 [inline]
 evdev_ioctl_handler+0x15a3/0x1c70 drivers/input/evdev.c:1277
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f63a7d9e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f63a8c75028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f63a8025fa0 RCX: 00007f63a7d9e159
RDX: 0000200000000300 RSI: 0000000080104592 RDI: 0000000000000003
RBP: 00007f63a7e3506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f63a8026038 R14: 00007f63a8025fa0 R15: 00007f63a814fa48
 </TASK>

Allocated by task 15306:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:409 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:426
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x321/0x600 mm/slub.c:5563
 _kmalloc_noprof include/linux/slab.h:991 [inline]
 _kzalloc_noprof include/linux/slab.h:1312 [inline]
 ath9k_init_wmi+0x4f/0x2b0 drivers/net/wireless/ath/ath9k/wmi.c:95
 ath9k_htc_probe_device+0x1e5/0x2370 drivers/net/wireless/ath/ath9k/htc_drv_init.c:956
 ath9k_htc_hw_init+0x32/0x70 drivers/net/wireless/ath/ath9k/htc_hst.c:532
 ath9k_hif_usb_firmware_cb+0x214/0x4b0 drivers/net/wireless/ath/ath9k/hif_usb.c:1255
 request_firmware_work_func+0xf7/0x2d0 drivers/base/firmware_loader/main.c:1164
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Freed by task 15306:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:264 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:296
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2748 [inline]
 slab_free mm/slub.c:6508 [inline]
 kfree+0x1c5/0x650 mm/slub.c:6801
 ath9k_htc_probe_device+0x11a9/0x2370 drivers/net/wireless/ath/ath9k/htc_drv_init.c:978
 ath9k_htc_hw_init+0x32/0x70 drivers/net/wireless/ath/ath9k/htc_hst.c:532
 ath9k_hif_usb_firmware_cb+0x214/0x4b0 drivers/net/wireless/ath/ath9k/hif_usb.c:1255
 request_firmware_work_func+0xf7/0x2d0 drivers/base/firmware_loader/main.c:1164
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

The buggy address belongs to the object at ffff88803610d000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 344 bytes inside of
 freed 2048-byte region [ffff88803610d000, ffff88803610d800)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x36108
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122
head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 7357, tgid 7357 (kworker/1:15), ts 662744125668
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1871
 prep_new_page mm/page_alloc.c:1879 [inline]
 get_page_from_freelist+0x2209/0x2280 mm/page_alloc.c:3943
 __alloc_frozen_pages_noprof+0x217/0x5a0 mm/page_alloc.c:5436
 alloc_slab_page mm/slub.c:3347 [inline]
 allocate_slab+0x7d/0x620 mm/slub.c:3462
 new_slab mm/slub.c:3513 [inline]
 refill_objects+0x2d5/0x350 mm/slub.c:7417
 refill_sheaf mm/slub.c:2885 [inline]
 __pcs_replace_empty_main+0x2c8/0x6c0 mm/slub.c:4774
 alloc_from_pcs mm/slub.c:4850 [inline]
 slab_alloc_node mm/slub.c:4984 [inline]
 __kmalloc_cache_noprof+0x39b/0x600 mm/slub.c:5559
 _kmalloc_noprof include/linux/slab.h:991 [inline]
 _kzalloc_noprof include/linux/slab.h:1312 [inline]
 usb_alloc_dev+0x5f/0xf10 drivers/usb/core/usb.c:651
 hub_port_connect drivers/usb/core/hub.c:5483 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5720 [inline]
 port_event drivers/usb/core/hub.c:5884 [inline]
 hub_event+0x20fb/0x4d30 drivers/usb/core/hub.c:5966
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
page last free pid 7355 tgid 7355 ts 662743850937 stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 __free_pages_prepare mm/page_alloc.c:1418 [inline]
 free_pages_prepare+0x9eb/0xaf0 mm/page_alloc.c:1463
 __free_contig_range_common+0x174/0x340 mm/page_alloc.c:7072
 __free_contig_range mm/page_alloc.c:7117 [inline]
 free_pages_bulk+0x48/0x120 mm/page_alloc.c:5322
 vm_area_free_pages mm/vmalloc.c:3461 [inline]
 vfree+0x231/0x490 mm/vmalloc.c:3510
 delayed_vfree_work+0x55/0x80 mm/vmalloc.c:3414
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Memory state around the buggy address:
 ffff88803610d000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88803610d080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88803610d100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                    ^
 ffff88803610d180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88803610d200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess), 2 bytes skipped:
   0:	ff                   	ljmp   (bad)
   1:	e8 b0 9d 43 0a       	call   0xa439db6
   6:	f7 44 24 10 00 02 00 	testl  $0x200,0x10(%rsp)
   d:	00
   e:	0f 84 38 ff ff ff    	je     0xffffff4c
  14:	65 48 8b 05 42 48 f2 	mov    %gs:0x11f24842(%rip),%rax        # 0x11f2485e
  1b:	11
  1c:	48 3b 44 24 50       	cmp    0x50(%rsp),%rax
  21:	75 33                	jne    0x56
  23:	fb                   	sti
  24:	48 83 c4 58          	add    $0x58,%rsp
* 28:	5b                   	pop    %rbx <-- trapping instruction
  29:	41 5c                	pop    %r12
  2b:	41 5d                	pop    %r13
  2d:	41 5e                	pop    %r14
  2f:	41 5f                	pop    %r15
  31:	5d                   	pop    %rbp
  32:	c3                   	ret
  33:	cc                   	int3
  34:	cc                   	int3
  35:	cc                   	int3
  36:	cc                   	int3
  37:	cc                   	int3
  38:	48                   	rex.W
  39:	8d                   	.byte 0x8d
  3a:	3d                   	.byte 0x3d
  3b:	87 56 da             	xchg   %edx,-0x26(%rsi)