==================================================================
BUG: KASAN: stack-out-of-bounds in append_midi1_out_jack.isra.0+0x346/0x3e4 drivers/usb/gadget/function/f_midi2.c:1713
Write of size 1 at addr ffff8f800a937518 by task syz.1.7/3901

CPU: 0 UID: 0 PID: 3901 Comm: syz.1.7 Not tainted syzkaller #0 PREEMPT 
Hardware name: riscv-virtio,qemu (DT)
Call Trace:
[<ffffffff8007c6e4>] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:149
[<ffffffff80003112>] show_stack+0x30/0x3c arch/riscv/kernel/stacktrace.c:155
[<ffffffff80060ea4>] __dump_stack lib/dump_stack.c:94 [inline]
[<ffffffff80060ea4>] dump_stack_lvl+0x114/0x1aa lib/dump_stack.c:120
[<ffffffff8000df00>] print_address_description mm/kasan/report.c:378 [inline]
[<ffffffff8000df00>] print_report+0x27a/0x592 mm/kasan/report.c:482
[<ffffffff80bd8b6e>] kasan_report+0xf0/0x26c mm/kasan/report.c:595
[<ffffffff80bda852>] __asan_report_store1_noabort+0x12/0x1a mm/kasan/report_generic.c:383
[<ffffffff83fe50c4>] append_midi1_out_jack.isra.0+0x346/0x3e4 drivers/usb/gadget/function/f_midi2.c:1713
[<ffffffff83feb28c>] f_midi2_create_usb_configs+0x5be/0xcae drivers/usb/gadget/function/f_midi2.c:1815
[<ffffffff83fed26c>] f_midi2_bind+0x18f0/0x2302 drivers/usb/gadget/function/f_midi2.c:2013
[<ffffffff83e4cd64>] usb_add_function+0x1ce/0x7ca drivers/usb/gadget/composite.c:333
[<ffffffff83e6282e>] configfs_composite_bind+0x906/0x149a drivers/usb/gadget/configfs.c:1802
[<ffffffff83e67ce8>] gadget_bind_driver+0x228/0xafa drivers/usb/gadget/udc/core.c:1662
[<ffffffff82c7e082>] call_driver_probe drivers/base/dd.c:628 [inline]
[<ffffffff82c7e082>] really_probe+0x222/0xa8e drivers/base/dd.c:706
[<ffffffff82c7eac4>] __driver_probe_device+0x1d6/0x43e drivers/base/dd.c:868
[<ffffffff82c7ef80>] driver_probe_device+0x5e/0x162 drivers/base/dd.c:898
[<ffffffff82c7f58a>] __driver_attach+0x1fc/0x57e drivers/base/dd.c:1292
[<ffffffff82c77ef4>] bus_for_each_dev+0x126/0x1bc drivers/base/bus.c:383
[<ffffffff82c7cdae>] driver_attach+0x3e/0x52 drivers/base/dd.c:1310
[<ffffffff82c7b6fe>] bus_add_driver+0x2c8/0x612 drivers/base/bus.c:763
[<ffffffff82c8224c>] driver_register+0x1a4/0x3b4 drivers/base/driver.c:174
[<ffffffff83e650e0>] usb_gadget_register_driver_owner+0x10c/0x2d2 drivers/usb/gadget/udc/core.c:1752
[<ffffffff83e5ddd2>] gadget_dev_desc_UDC_store+0x1b6/0x2a0 drivers/usb/gadget/configfs.c:300
[<ffffffff80fb6806>] flush_write_buffer fs/configfs/file.c:207 [inline]
[<ffffffff80fb6806>] configfs_write_iter+0x284/0x406 fs/configfs/file.c:229
[<ffffffff80ce8248>] new_sync_write fs/read_write.c:595 [inline]
[<ffffffff80ce8248>] vfs_write+0x81a/0x1020 fs/read_write.c:687
[<ffffffff80ce8e58>] ksys_write+0x126/0x244 fs/read_write.c:739
[<ffffffff80ce8fe4>] __do_sys_write fs/read_write.c:750 [inline]
[<ffffffff80ce8fe4>] __se_sys_write fs/read_write.c:747 [inline]
[<ffffffff80ce8fe4>] __riscv_sys_write+0x6e/0xa0 fs/read_write.c:747
[<ffffffff80078f30>] syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112
[<ffffffff8651fb84>] do_trap_ecall_u+0x3e4/0x636 arch/riscv/kernel/traps.c:345
[<ffffffff8654beb0>] handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237

The buggy address belongs to stack of task syz.1.7/3901
 and is located at offset 440 in frame:
 f_midi2_bind+0x0/0x2302 drivers/usb/gadget/function/f_midi2.c:1841

This frame has 6 objects:
 [32, 36) 'sw'
 [48, 56) 'card'
 [80, 88) 'ump'
 [112, 128) 'string_fn'
 [144, 160) 'strings'
 [176, 440) 'config'

The buggy address belongs to a 8-page vmalloc region starting at 0xffff8f800a930000 allocated at kernel_clone+0x198/0xf7c kernel/fork.c:2748
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xb1f07
memcg:ffffaf801b724f82
flags: 0x0(node=0|zone=0)
raw: 0000000000000000 0000000000000000 ffff8d8002c7c1c8 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff ffffaf801b724f82
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x29c2(GFP_NOWAIT|__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_ZERO), pid 3900, tgid 3900 (syz.1.7), ts 1160887011100, free_ts 1160654041100
 __set_page_owner+0x92/0x4b0 mm/page_owner.c:341
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0xe4/0x1a0 mm/page_alloc.c:1859
 prep_new_page mm/page_alloc.c:1867 [inline]
 get_page_from_freelist+0x914/0x395c mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x224/0x2e40 mm/page_alloc.c:5304
 alloc_pages_mpol+0x1f0/0x59c mm/mempolicy.c:2490
 alloc_frozen_pages_noprof+0x156/0x2ce mm/mempolicy.c:2561
 alloc_pages_noprof+0x20/0x140 mm/mempolicy.c:2581
 vm_area_alloc_pages mm/vmalloc.c:3667 [inline]
 __vmalloc_area_node mm/vmalloc.c:3892 [inline]
 __vmalloc_node_range_noprof+0x103e/0x1b34 mm/vmalloc.c:4082
 __vmalloc_node_noprof+0xfc/0x132 mm/vmalloc.c:4143
 alloc_thread_stack_node kernel/fork.c:359 [inline]
 dup_task_struct kernel/fork.c:929 [inline]
 copy_process+0x764/0x7e8a kernel/fork.c:2115
 kernel_clone+0x198/0xf7c kernel/fork.c:2748
 __do_sys_clone3+0x238/0x48c kernel/fork.c:3050
 __se_sys_clone3 kernel/fork.c:3029 [inline]
 __riscv_sys_clone3+0x52/0x72 kernel/fork.c:3029
 syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112
 do_trap_ecall_u+0x3e4/0x636 arch/riscv/kernel/traps.c:345
 handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237
page last free pid 3900 tgid 3900 stack trace:
 __reset_page_owner+0x76/0x1bc mm/page_owner.c:320
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1406 [inline]
 __free_frozen_pages+0x6b0/0x136c mm/page_alloc.c:2950
 free_frozen_pages+0xe/0x16 mm/page_alloc.c:2988
 __free_slab+0xda/0x250 mm/slub.c:3441
 free_slab+0x28/0x16c mm/slub.c:3475
 discard_slab mm/slub.c:3481 [inline]
 __slab_free+0x23c/0x2f8 mm/slub.c:5741
 ___cache_free+0x94/0xac mm/slub.c:6449
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x64/0x134 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x152/0x1b4 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x5c/0x82 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4584 [inline]
 slab_alloc_node mm/slub.c:4917 [inline]
 kmem_cache_alloc_noprof+0x202/0x67a mm/slub.c:4931
 anon_vma_alloc mm/rmap.c:94 [inline]
 __anon_vma_prepare+0x302/0x534 mm/rmap.c:201
 __vmf_anon_prepare+0x124/0x23a mm/memory.c:3829
 vmf_anon_prepare mm/internal.h:494 [inline]
 do_anonymous_page+0x366/0x2982 mm/memory.c:5338
 do_pte_missing mm/memory.c:4564 [inline]
 handle_pte_fault mm/memory.c:6379 [inline]
 __handle_mm_fault+0x1216/0x14fa mm/memory.c:6517
 handle_mm_fault+0x25a/0x8bc mm/memory.c:6686

Memory state around the buggy address:
 ffff8f800a937400: f2 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8f800a937480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8f800a937500: 00 00 00 f3 f3 f3 f3 f3 f3 f3 f3 f3 00 00 00 00
                            ^
 ffff8f800a937580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8f800a937600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================