program: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)="34343130302c34383030302c38383230302c39363030302c3137363430302c31828b4222acacef07323830302c33", 0x2e) symlinkat(&(0x7f0000000580)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./myconfig/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r1, &(0x7f0000000640)='usbip-vudc.0', 0xc) madvise(&(0x7f00001df000/0x2000)=nil, 0x2000, 0x72) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x7fff}}, './file0\x00'}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0) write(r3, &(0x7f0000000200)='wwnn=0', 0x6) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r4, 0x84, 0x7d, 0x0, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f00001e0000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, &(0x7f0000000040)="470f35660f5de30f20e035000200000f22e0430f078f2858cdca09b9800000c00f3235008000000f30c421f852f5c4a3857c16d866b8a5008ec041d9ee", 0x3d}], 0x1, 0x50, &(0x7f00000000c0), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff) (async) mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff) (async) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) (async) openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0) (async) write(r0, &(0x7f0000000500)="34343130302c34383030302c38383230302c39363030302c3137363430302c31828b4222acacef07323830302c33", 0x2e) (async) symlinkat(&(0x7f0000000580)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00') (async) openat(0xffffffffffffff9c, &(0x7f0000000600)='./myconfig/usb_gadget/g1/UDC\x00', 0x1, 0x0) (async) write(r1, &(0x7f0000000640)='usbip-vudc.0', 0xc) (async) madvise(&(0x7f00001df000/0x2000)=nil, 0x2000, 0x72) (async) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x7fff}}, './file0\x00'}) (async) openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0) (async) write(r3, &(0x7f0000000200)='wwnn=0', 0x6) (async) socket$inet6_sctp(0xa, 0x1, 0x84) (async) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r4, 0x84, 0x7d, 0x0, 0x0) (async) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f00001e0000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, &(0x7f0000000040)="470f35660f5de30f20e035000200000f22e0430f078f2858cdca09b9800000c00f3235008000000f30c421f852f5c4a3857c16d866b8a5008ec041d9ee", 0x3d}], 0x1, 0x50, &(0x7f00000000c0), 0x0) (async) [ 92.775758][ T10] cfg80211: failed to load regulatory.db [ 92.835280][ T45] Bluetooth: hci0: command tx timeout [ 92.858918][ T5319] ================================================================== [ 92.861752][ T5319] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0 [ 92.864508][ T5319] Free of addr ffff888043bdea2d by task syz.0.0/5319 [ 92.866881][ T5319] [ 92.867785][ T5319] CPU: 0 UID: 0 PID: 5319 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 92.867795][ T5319] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 92.867800][ T5319] Call Trace: [ 92.867804][ T5319] [ 92.867807][ T5319] dump_stack_lvl+0xe8/0x150 [ 92.867820][ T5319] print_address_description+0x55/0x1e0 [ 92.867829][ T5319] print_report+0x58/0x70 [ 92.867836][ T5319] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 92.867845][ T5319] kasan_report_invalid_free+0xea/0x110 [ 92.867854][ T5319] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 92.867861][ T5319] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 92.867868][ T5319] __kasan_slab_pre_free+0x104/0x120 [ 92.867876][ T5319] kfree+0x173/0x640 [ 92.867882][ T5319] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 92.867890][ T5319] f_uac2_opts_c_srate_store+0x225/0x2b0 [ 92.867898][ T5319] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 92.867906][ T5319] ? down_read+0x2be/0x330 [ 92.867914][ T5319] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 92.867921][ T5319] configfs_write_iter+0x337/0x430 [ 92.867929][ T5319] vfs_write+0x612/0xba0 [ 92.867941][ T5319] ? __pfx_vfs_write+0x10/0x10 [ 92.867951][ T5319] ? __fget_files+0x2a/0x420 [ 92.867961][ T5319] ksys_write+0x150/0x270 [ 92.867967][ T5319] ? __pfx_ksys_write+0x10/0x10 [ 92.867977][ T5319] do_syscall_64+0x166/0x520 [ 92.867985][ T5319] ? trace_irq_disable+0x3b/0x140 [ 92.867993][ T5319] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.868000][ T5319] ? clear_bhb_loop+0x70/0xc0 [ 92.868009][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.868015][ T5319] RIP: 0033:0x7f6c9919e159 [ 92.868023][ T5319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.868028][ T5319] RSP: 002b:00007f6c9a000fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 92.868036][ T5319] RAX: ffffffffffffffda RBX: 00007f6c99425fa0 RCX: 00007f6c9919e159 [ 92.868041][ T5319] RDX: 000000000000002e RSI: 0000200000000500 RDI: 0000000000000003 [ 92.868046][ T5319] RBP: 00007f6c99235024 R08: 0000000000000000 R09: 0000000000000000 [ 92.868050][ T5319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 92.868054][ T5319] R13: 00007f6c99426038 R14: 00007f6c99425fa0 R15: 00007ffd2d3d4828 [ 92.868061][ T5319] [ 92.868063][ T5319] [ 92.958170][ T5319] Allocated by task 5319: [ 92.959719][ T5319] kasan_save_track+0x3e/0x80 [ 92.961411][ T5319] __kasan_kmalloc+0x93/0xb0 [ 92.963028][ T5319] __kmalloc_node_track_caller_noprof+0x4c7/0x740 [ 92.965288][ T5319] kstrdup+0x42/0x100 [ 92.966774][ T5319] f_uac2_opts_c_srate_store+0x11f/0x2b0 [ 92.968976][ T5319] configfs_write_iter+0x337/0x430 [ 92.971044][ T5319] vfs_write+0x612/0xba0 [ 92.972903][ T5319] ksys_write+0x150/0x270 [ 92.974868][ T5319] do_syscall_64+0x166/0x520 [ 92.976996][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.979577][ T5319] [ 92.980579][ T5319] The buggy address belongs to the object at ffff888043bdea00 [ 92.980579][ T5319] which belongs to the cache kmalloc-64 of size 64 [ 92.986459][ T5319] The buggy address is located 45 bytes inside of [ 92.986459][ T5319] 47-byte region [ffff888043bdea00, ffff888043bdea2f) [ 92.992076][ T5319] [ 92.993172][ T5319] The buggy address belongs to the physical page: [ 92.995912][ T5319] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x43bde [ 92.999758][ T5319] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 93.002874][ T5319] page_type: f5(slab) [ 93.004655][ T5319] raw: 04fff00000000000 ffff88801b0418c0 dead000000000100 dead000000000122 [ 93.008598][ T5319] raw: 0000000000000000 0000000800200020 00000000f5000000 0000000000000000 [ 93.012374][ T5319] page dumped because: kasan: bad access detected [ 93.015252][ T5319] page_owner tracks the page as allocated [ 93.017754][ T5319] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 804, tgid 804 (kworker/0:2), ts 58340153729 [ 93.025073][ T5319] post_alloc_hook+0x1f9/0x250 [ 93.026790][ T5319] get_page_from_freelist+0x2209/0x2280 [ 93.029118][ T5319] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 93.031719][ T5319] allocate_slab+0x7c/0x5e0 [ 93.033728][ T5319] refill_objects+0x2d5/0x350 [ 93.035800][ T5319] __pcs_replace_empty_main+0x2c3/0x6b0 [ 93.038081][ T5319] __kmalloc_noprof+0x489/0x720 [ 93.040036][ T5319] drm_atomic_commit_init+0x9e/0x370 [ 93.042364][ T5319] drm_atomic_commit_alloc+0xbc/0x100 [ 93.044653][ T5319] drm_atomic_helper_dirtyfb+0x129/0xfd0 [ 93.047081][ T5319] drm_fbdev_shmem_helper_fb_dirty+0x160/0x310 [ 93.049658][ T5319] drm_fb_helper_damage_work+0x84c/0xf20 [ 93.052082][ T5319] process_scheduled_works+0xc3d/0x1630 [ 93.054955][ T5319] worker_thread+0xa47/0xfb0 [ 93.057040][ T5319] kthread+0x38b/0x480 [ 93.058744][ T5319] ret_from_fork+0x514/0xb70 [ 93.060571][ T5319] page last free pid 5048 tgid 5048 ts 58339106556 stack trace: [ 93.063549][ T5319] __free_frozen_pages+0xc93/0xd90 [ 93.065597][ T5319] tlb_finish_mmu+0x13e/0x220 [ 93.067479][ T5319] exit_mmap+0x4b2/0x9f0 [ 93.069167][ T5319] __mmput+0x118/0x420 [ 93.070855][ T5319] setup_new_exec+0x30d/0x360 [ 93.072822][ T5319] load_elf_binary+0xbc0/0x28d0 [ 93.074850][ T5319] bprm_execve+0x930/0x1590 [ 93.076869][ T5319] do_execveat_common+0x4f4/0x670 [ 93.078997][ T5319] __x64_sys_execve+0x97/0xc0 [ 93.080980][ T5319] do_syscall_64+0x166/0x520 [ 93.082856][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.085468][ T5319] [ 93.086514][ T5319] Memory state around the buggy address: [ 93.088977][ T5319] ffff888043bde900: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 93.092341][ T5319] ffff888043bde980: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 93.095786][ T5319] >ffff888043bdea00: 00 00 00 00 00 07 fc fc fc fc fc fc fc fc fc fc [ 93.099216][ T5319] ^ [ 93.101535][ T5319] ffff888043bdea80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 93.104935][ T5319] ffff888043bdeb00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 93.108312][ T5319] ================================================================== [ 93.146196][ T5319] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 93.149198][ T5319] CPU: 0 UID: 0 PID: 5319 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.153000][ T5319] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.157375][ T5319] Call Trace: [ 93.158762][ T5319] [ 93.159746][ T5319] vpanic+0x56d/0xa60 [ 93.161123][ T5319] ? __pfx_vpanic+0x10/0x10 [ 93.162821][ T5319] ? __pfx___schedule+0x10/0x10 [ 93.164775][ T5319] panic+0xc5/0xd0 [ 93.166316][ T5319] ? __pfx_panic+0x10/0x10 [ 93.168227][ T5319] ? preempt_schedule_common+0x7f/0xd0 [ 93.170549][ T5319] check_panic_on_warn+0x89/0xb0 [ 93.172669][ T5319] end_report+0x73/0x170 [ 93.174554][ T5319] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 93.176968][ T5319] kasan_report_invalid_free+0xfa/0x110 [ 93.179282][ T5319] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 93.181699][ T5319] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 93.184180][ T5319] __kasan_slab_pre_free+0x104/0x120 [ 93.186415][ T5319] kfree+0x173/0x640 [ 93.187962][ T5319] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 93.190349][ T5319] f_uac2_opts_c_srate_store+0x225/0x2b0 [ 93.192635][ T5319] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 93.195282][ T5319] ? down_read+0x2be/0x330 [ 93.197221][ T5319] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 93.199770][ T5319] configfs_write_iter+0x337/0x430 [ 93.202020][ T5319] vfs_write+0x612/0xba0 [ 93.203898][ T5319] ? __pfx_vfs_write+0x10/0x10 [ 93.205898][ T5319] ? __fget_files+0x2a/0x420 [ 93.207927][ T5319] ksys_write+0x150/0x270 [ 93.209661][ T5319] ? __pfx_ksys_write+0x10/0x10 [ 93.211707][ T5319] do_syscall_64+0x166/0x520 [ 93.213745][ T5319] ? trace_irq_disable+0x3b/0x140 [ 93.215923][ T5319] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.218540][ T5319] ? clear_bhb_loop+0x70/0xc0 [ 93.220482][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.222797][ T5319] RIP: 0033:0x7f6c9919e159 [ 93.224650][ T5319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.232662][ T5319] RSP: 002b:00007f6c9a000fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 93.236030][ T5319] RAX: ffffffffffffffda RBX: 00007f6c99425fa0 RCX: 00007f6c9919e159 [ 93.239478][ T5319] RDX: 000000000000002e RSI: 0000200000000500 RDI: 0000000000000003 [ 93.242783][ T5319] RBP: 00007f6c99235024 R08: 0000000000000000 R09: 0000000000000000 [ 93.246303][ T5319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 93.249853][ T5319] R13: 00007f6c99426038 R14: 00007f6c99425fa0 R15: 00007ffd2d3d4828 [ 93.252989][ T5319] [ 93.254474][ T5319] Kernel Offset: disabled [ 93.256263][ T5319] Rebooting in 86400 seconds..