program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config\x00', 0x1c0)
mount(0x0, &(0x7f0000000240)='./config\x00', &(0x7f0000000280)='configfs\x00', 0x0, 0x0)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
sendmsg$NFT_BATCH(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000880)=ANY=[@ANYRES8=r0, @ANYRESHEX=0x0, @ANYRES64], 0x7c}}, 0x84)
sendmsg$NFT_BATCH(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000940)=ANY=[@ANYBLOB="140000009010080000000000000000000000000a5c0054c20000060a0946058062060000000000000004300004802c000180090001007866726d000000001c00028008000240000000010500030000000000080041400000000f090001007379000900a3e073797a3200000a0000000000000000000000e5ff00000036fec2889b53496e56df9567343e8b7b2a06ab619a04a4939f794393eeb20c9eff96404508e67434015f9763d23948697c0025b091feb394f49a00d1bfa3949cfad1923b400d260e4a0beb4a52659f8a26e9ad7876d81104952f1b01c0f3da37b9baf57567ba3a8997df784aec292ac4f1675f22132ca0d4d1b62f3f538f5a553a007359bf15b1eb34"], 0x84}}, 0x20008020)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1\x00', 0x1c0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1c0)
r1 = fsopen(&(0x7f00000000c0)='befs\x00', 0x1)
ioprio_get$uid(0x3, 0xffffffffffffffff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./sys\x00', &(0x7f00000002c0)='sysfs\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./cgroup.cpu/test\x00', 0x777)
r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0)
write(r3, &(0x7f0000000480)='10000', 0x5)
r4 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0)
write(r4, &(0x7f0000000500)='1', 0x1)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f00000007c0)=ANY=[@ANYBLOB="2000000003050000000000000000000003000008050003008800000004000480"], 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x4000000)
write(r5, &(0x7f0000000580)='0', 0x1)
socket$inet6_udp(0xa, 0x2, 0x0)
socket(0x10, 0x803, 0x0)
openat$dir(0xffffffffffffff9c, &(0x7f00000005c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x200200, 0x4)
write(r2, &(0x7f0000000600)='/dev/loop0', 0xa)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000100)='source\x00', &(0x7f0000000140)='//127.0.0.1/share\x00', 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.usb0/control/extensions/xu1\x00', 0x1c0)
mknod$loop(&(0x7f0000000800)='./file0\x00', 0x0, 0x0)
mount$overlay(0x0, &(0x7f0000000840)='./file0\x00', &(0x7f0000000a80), 0x0, &(0x7f0000000ac0)={[{@lowerdir, 0x3a}], [], 0x2f})
[ 86.050439][ T47] Bluetooth: hci0: command tx timeout
[ 86.215751][ T5322] oom_control is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 86.244311][ T5322] block2mtd: error: cannot open device /dev/loop0
[ 86.263021][ T5322] ==================================================================
[ 86.263035][ T5322] BUG: KASAN: slab-use-after-free in __list_del_entry_valid_or_report+0x31/0x190
[ 86.263178][ T5322] Read of size 8 at addr ffff888044cf3058 by task syz.0.0/5322
[ 86.263187][ T5322]
[ 86.263213][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 86.263226][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.263235][ T5322] Call Trace:
[ 86.263262][ T5322]
[ 86.263267][ T5322] dump_stack_lvl+0xe8/0x150
[ 86.263285][ T5322] print_address_description+0x55/0x1e0
[ 86.263301][ T5322] ? __list_del_entry_valid_or_report+0x31/0x190
[ 86.263314][ T5322] print_report+0x58/0x70
[ 86.263326][ T5322] kasan_report+0x117/0x150
[ 86.263338][ T5322] ? __list_del_entry_valid_or_report+0x31/0x190
[ 86.263356][ T5322] __list_del_entry_valid_or_report+0x31/0x190
[ 86.263372][ T5322] uvcg_extension_drop+0x81/0x1f0
[ 86.263427][ T5322] configfs_mkdir+0x7e9/0x9e0
[ 86.263441][ T5322] ? __pfx_configfs_mkdir+0x10/0x10
[ 86.263454][ T5322] ? generic_permission+0x2bf/0x670
[ 86.263470][ T5322] ? bpf_lsm_inode_mkdir+0x9/0x20
[ 86.263482][ T5322] vfs_mkdir+0x40c/0x620
[ 86.263496][ T5322] filename_mkdirat+0x285/0x510
[ 86.263508][ T5322] ? __pfx_filename_mkdirat+0x10/0x10
[ 86.263520][ T5322] ? do_getname+0x151/0x250
[ 86.263534][ T5322] __se_sys_mkdirat+0x35/0x150
[ 86.263545][ T5322] do_syscall_64+0x166/0x520
[ 86.263556][ T5322] ? trace_irq_disable+0x3b/0x140
[ 86.263568][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.263580][ T5322] ? clear_bhb_loop+0x70/0xc0
[ 86.263595][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.263606][ T5322] RIP: 0033:0x7f9164d9e1d9
[ 86.263616][ T5322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 86.263625][ T5322] RSP: 002b:00007f9165bc7fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
[ 86.263639][ T5322] RAX: ffffffffffffffda RBX: 00007f9165025fa0 RCX: 00007f9164d9e1d9
[ 86.263648][ T5322] RDX: 00000000000001c0 RSI: 0000200000000400 RDI: ffffffffffffff9c
[ 86.263656][ T5322] RBP: 00007f9164e35888 R08: 0000000000000000 R09: 0000000000000000
[ 86.263663][ T5322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 86.263670][ T5322] R13: 00007f9165026038 R14: 00007f9165025fa0 R15: 00007ffcaf9e5638
[ 86.263683][ T5322]
[ 86.263688][ T5322]
[ 86.263691][ T5322] Allocated by task 5322:
[ 86.263696][ T5322] kasan_save_track+0x3e/0x80
[ 86.263706][ T5322] __kasan_kmalloc+0x93/0xb0
[ 86.263718][ T5322] __kmalloc_cache_noprof+0x321/0x600
[ 86.263728][ T5322] uvcg_extension_make+0x95/0x300
[ 86.263741][ T5322] configfs_mkdir+0x580/0x9e0
[ 86.263752][ T5322] vfs_mkdir+0x40c/0x620
[ 86.263760][ T5322] filename_mkdirat+0x285/0x510
[ 86.263769][ T5322] __se_sys_mkdirat+0x35/0x150
[ 86.263779][ T5322] do_syscall_64+0x166/0x520
[ 86.263787][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.263795][ T5322]
[ 86.263798][ T5322] Freed by task 5322:
[ 86.263802][ T5322] kasan_save_track+0x3e/0x80
[ 86.263812][ T5322] kasan_save_free_info+0x40/0x50
[ 86.263825][ T5322] __kasan_slab_free+0x5c/0x80
[ 86.263834][ T5322] kfree+0x1c5/0x650
[ 86.263847][ T5322] config_item_release+0x13a/0x2d0
[ 86.263859][ T5322] uvcg_extension_drop+0x75/0x1f0
[ 86.263871][ T5322] configfs_mkdir+0x7e9/0x9e0
[ 86.263884][ T5322] vfs_mkdir+0x40c/0x620
[ 86.263893][ T5322] filename_mkdirat+0x285/0x510
[ 86.263903][ T5322] __se_sys_mkdirat+0x35/0x150
[ 86.263912][ T5322] do_syscall_64+0x166/0x520
[ 86.263921][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.263930][ T5322]
[ 86.263933][ T5322] The buggy address belongs to the object at ffff888044cf3000
[ 86.263933][ T5322] which belongs to the cache kmalloc-192 of size 192
[ 86.263942][ T5322] The buggy address is located 88 bytes inside of
[ 86.263942][ T5322] freed 192-byte region [ffff888044cf3000, ffff888044cf30c0)
[ 86.263953][ T5322]
[ 86.263956][ T5322] The buggy address belongs to the physical page:
[ 86.263962][ T5322] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888044cf3a00 pfn:0x44cf3
[ 86.263973][ T5322] flags: 0x4fff00000000200(workingset|node=1|zone=1|lastcpupid=0x7ff)
[ 86.263983][ T5322] page_type: f5(slab)
[ 86.263994][ T5322] raw: 04fff00000000200 ffff88801c0413c0 ffff888030400288 ffff888030400288
[ 86.264004][ T5322] raw: ffff888044cf3a00 000000000010000a 00000000f5000000 0000000000000000
[ 86.264010][ T5322] page dumped because: kasan: bad access detected
[ 86.264015][ T5322] page_owner tracks the page as allocated
[ 86.264020][ T5322] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5322, tgid 5321 (syz.0.0), ts 86212935744
[ 86.264037][ T5322] post_alloc_hook+0x1f9/0x250
[ 86.264050][ T5322] get_page_from_freelist+0x2209/0x2280
[ 86.264059][ T5322] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 86.264070][ T5322] allocate_slab+0x7d/0x620
[ 86.264082][ T5322] refill_objects+0x2d5/0x350
[ 86.264093][ T5322] __pcs_replace_empty_main+0x2c8/0x6c0
[ 86.264104][ T5322] __kmalloc_cache_noprof+0x39b/0x600
[ 86.264121][ T5322] cgroup_file_open+0x8d/0x3a0
[ 86.264137][ T5322] kernfs_fop_open+0xa1e/0xce0
[ 86.264151][ T5322] do_dentry_open+0x816/0x1380
[ 86.264162][ T5322] vfs_open+0x3b/0x340
[ 86.264171][ T5322] path_openat+0x1443/0x1d60
[ 86.264180][ T5322] do_file_open+0x23e/0x4a0
[ 86.264189][ T5322] do_sys_openat2+0x115/0x200
[ 86.264199][ T5322] __x64_sys_openat+0x138/0x170
[ 86.264209][ T5322] do_syscall_64+0x166/0x520
[ 86.264219][ T5322] page last free pid 5322 tgid 5321 ts 86201564702 stack trace:
[ 86.264226][ T5322] __free_frozen_pages+0xc93/0xd90
[ 86.264240][ T5322] tlb_remove_table_rcu+0x85/0x100
[ 86.264250][ T5322] rcu_core+0x926/0x1260
[ 86.264261][ T5322] handle_softirqs+0x226/0x860
[ 86.264273][ T5322] do_softirq+0x77/0xd0
[ 86.264285][ T5322] __local_bh_enable_ip+0x100/0x140
[ 86.264298][ T5322] cgroup_apply_control_enable+0x9e5/0xda0
[ 86.264311][ T5322] cgroup_mkdir+0xd2c/0xf90
[ 86.264321][ T5322] kernfs_iop_mkdir+0x213/0x360
[ 86.264331][ T5322] vfs_mkdir+0x40c/0x620
[ 86.264339][ T5322] filename_mkdirat+0x285/0x510
[ 86.264349][ T5322] __se_sys_mkdirat+0x35/0x150
[ 86.264358][ T5322] do_syscall_64+0x166/0x520
[ 86.264367][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.264376][ T5322]
[ 86.264408][ T5322] Memory state around the buggy address:
[ 86.264416][ T5322] ffff888044cf2f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 86.264422][ T5322] ffff888044cf2f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 86.264430][ T5322] >ffff888044cf3000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 86.264436][ T5322] ^
[ 86.264442][ T5322] ffff888044cf3080: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 86.264449][ T5322] ffff888044cf3100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 86.264455][ T5322] ==================================================================
[ 86.264512][ T5322] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 86.563644][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 86.567552][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.572078][ T5322] Call Trace:
[ 86.573648][ T5322]
[ 86.574985][ T5322] vpanic+0x56d/0xa60
[ 86.576810][ T5322] ? __pfx_vpanic+0x10/0x10
[ 86.578806][ T5322] panic+0xc5/0xd0
[ 86.580474][ T5322] ? __pfx_panic+0x10/0x10
[ 86.582464][ T5322] ? preempt_schedule_thunk+0x16/0x40
[ 86.584890][ T5322] ? preempt_schedule_thunk+0x16/0x40
[ 86.587232][ T5322] ? __list_del_entry_valid_or_report+0x31/0x190
[ 86.589979][ T5322] check_panic_on_warn+0x89/0xb0
[ 86.592113][ T5322] ? __list_del_entry_valid_or_report+0x31/0x190
[ 86.594819][ T5322] end_report+0x73/0x170
[ 86.596741][ T5322] ? __list_del_entry_valid_or_report+0x31/0x190
[ 86.599500][ T5322] kasan_report+0x128/0x150
[ 86.601539][ T5322] ? __list_del_entry_valid_or_report+0x31/0x190
[ 86.604297][ T5322] __list_del_entry_valid_or_report+0x31/0x190
[ 86.607013][ T5322] uvcg_extension_drop+0x81/0x1f0
[ 86.609341][ T5322] configfs_mkdir+0x7e9/0x9e0
[ 86.611488][ T5322] ? __pfx_configfs_mkdir+0x10/0x10
[ 86.613920][ T5322] ? generic_permission+0x2bf/0x670
[ 86.616294][ T5322] ? bpf_lsm_inode_mkdir+0x9/0x20
[ 86.618585][ T5322] vfs_mkdir+0x40c/0x620
[ 86.620471][ T5322] filename_mkdirat+0x285/0x510
[ 86.622497][ T5322] ? __pfx_filename_mkdirat+0x10/0x10
[ 86.624800][ T5322] ? do_getname+0x151/0x250
[ 86.626612][ T5322] __se_sys_mkdirat+0x35/0x150
[ 86.628554][ T5322] do_syscall_64+0x166/0x520
[ 86.630585][ T5322] ? trace_irq_disable+0x3b/0x140
[ 86.632836][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.635533][ T5322] ? clear_bhb_loop+0x70/0xc0
[ 86.637514][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.640124][ T5322] RIP: 0033:0x7f9164d9e1d9
[ 86.641941][ T5322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 86.650214][ T5322] RSP: 002b:00007f9165bc7fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
[ 86.653800][ T5322] RAX: ffffffffffffffda RBX: 00007f9165025fa0 RCX: 00007f9164d9e1d9
[ 86.657101][ T5322] RDX: 00000000000001c0 RSI: 0000200000000400 RDI: ffffffffffffff9c
[ 86.660490][ T5322] RBP: 00007f9164e35888 R08: 0000000000000000 R09: 0000000000000000
[ 86.663932][ T5322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 86.667416][ T5322] R13: 00007f9165026038 R14: 00007f9165025fa0 R15: 00007ffcaf9e5638
[ 86.670750][ T5322]
[ 86.672558][ T5322] Kernel Offset: disabled
[ 86.674495][ T5322] Rebooting in 86400 seconds..