Hello, syzbot found the following crash on: HEAD commit: 7ae77150 Merge tag 'powerpc-5.8-1' of git://git.kernel.org.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=14a0b46e100000 kernel config: https://syzkaller.appspot.com/x/.config?x=d195fe572fb15312 dashboard link: https://syzkaller.appspot.com/bug?extid=fb14314433463ad51625 compiler: gcc (GCC) 9.0.0 20181231 (experimental) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11bb9d35100000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1309c569100000 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+fb14314433463ad51625@syzkaller.appspotmail.com ================================================================== BUG: KASAN: slab-out-of-bounds in snd_usb_mixer_notify_id+0x219/0x2a0 sound/usb/mixer.c:3240 Write of size 4 at addr ffff888095d78ce0 by task swapper/1/0 CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.7.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x188/0x20d lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xd3/0x413 mm/kasan/report.c:383 __kasan_report mm/kasan/report.c:513 [inline] kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530 snd_usb_mixer_notify_id+0x219/0x2a0 sound/usb/mixer.c:3240 snd_usb_mixer_interrupt+0x416/0x980 sound/usb/mixer.c:3379 __usb_hcd_giveback_urb+0x2af/0x4b0 drivers/usb/core/hcd.c:1650 usb_hcd_giveback_urb+0x368/0x420 drivers/usb/core/hcd.c:1716 __skb_queue_head_init include/linux/skbuff.h:1854 [inline] skbpoolfree drivers/block/aoe/aoedev.c:435 [inline] freedev drivers/block/aoe/aoedev.c:290 [inline] dummy_timer+0x1243/0x2fe1 drivers/block/aoe/aoedev.c:366 call_timer_fn+0x1ac/0x780 kernel/time/timer.c:1404 expire_timers kernel/time/timer.c:1449 [inline] __run_timers kernel/time/timer.c:1773 [inline] __run_timers kernel/time/timer.c:1740 [inline] run_timer_softirq+0x623/0x1600 kernel/time/timer.c:1786 --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. syzbot can test patches for this bug, for details see: https://goo.gl/tpsmEJ#testing-patches