program: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff) ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc0385869, &(0x7f0000000280)={0xffffffffffffffff, &(0x7f0000000040)=']\x00', 0xa001, &(0x7f0000000080)={@align=0x101, {0xfffc, 0xffff, 0x4, 0x5}}, 0x5, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000180)=0x3}) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000300), 0xffffffffffffffff) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="5c00000002060108deff00000000000000000000050005000a000000050001000700000005000400000000000900020073797a310000001d16000300686173683a6e65742c706f72742c6e657400"], 0x5c}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000540)=ANY=[@ANYRES64=r1, @ANYRESDEC=0x0], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x80) sendmsg$IPSET_CMD_FLUSH(r3, &(0x7f0000005a40)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000300)={0x1c, 0x4, 0x6, 0x5, 0x0, 0x0, {0x7, 0x0, 0x7}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x51}, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f00000000c0)=@framed, &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)="a0", 0x0, 0x7}, 0x50) sendmsg$IPVS_CMD_ZERO(r0, &(0x7f0000000440)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x3c, r1, 0x200, 0x70bd2d, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x80000001}, @IPVS_CMD_ATTR_DAEMON={0x20, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0xfffffffffffffeb8, 0x5, @private=0xa010102}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr=' \x01\x00'}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20008004}, 0x8000) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r6 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0) write(r6, &(0x7f0000000000)="34343130302c34ed5adac92d9d8cd69f383030302c3838", 0x17) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') [ 93.795582][ T4649] Bluetooth: hci0: command tx timeout [ 93.867640][ T5329] netlink: 12 bytes leftover after parsing attributes in process `syz.0.0'. [ 93.898885][ T5329] ================================================================== [ 93.902234][ T5329] BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x225/0x2b0 [ 93.905654][ T5329] Free of addr ffff8880353551d5 by task syz.0.0/5329 [ 93.908387][ T5329] [ 93.909333][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.909348][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.909355][ T5329] Call Trace: [ 93.909361][ T5329] [ 93.909367][ T5329] dump_stack_lvl+0xe8/0x150 [ 93.909388][ T5329] print_address_description+0x55/0x1e0 [ 93.909405][ T5329] print_report+0x58/0x70 [ 93.909418][ T5329] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 93.909427][ T5329] kasan_report_invalid_free+0xea/0x110 [ 93.909438][ T5329] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 93.909447][ T5329] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 93.909460][ T5329] __kasan_slab_pre_free+0x104/0x120 [ 93.909472][ T5329] kfree+0x173/0x640 [ 93.909482][ T5329] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 93.909495][ T5329] f_uac2_opts_p_srate_store+0x225/0x2b0 [ 93.909508][ T5329] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 93.909521][ T5329] ? down_read+0x2be/0x330 [ 93.909533][ T5329] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 93.909550][ T5329] configfs_write_iter+0x337/0x430 [ 93.909568][ T5329] vfs_write+0x612/0xba0 [ 93.909585][ T5329] ? __pfx_vfs_write+0x10/0x10 [ 93.909601][ T5329] ? __fget_files+0x2a/0x420 [ 93.909615][ T5329] ksys_write+0x150/0x270 [ 93.909630][ T5329] ? __pfx_ksys_write+0x10/0x10 [ 93.909644][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.909654][ T5329] do_syscall_64+0x174/0x580 [ 93.909672][ T5329] ? trace_irq_disable+0x3b/0x140 [ 93.909686][ T5329] ? clear_bhb_loop+0x40/0x90 [ 93.909698][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.909708][ T5329] RIP: 0033:0x7f85e959e019 [ 93.909719][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.909727][ T5329] RSP: 002b:00007f85e59f4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 93.909740][ T5329] RAX: ffffffffffffffda RBX: 00007f85e9825fa0 RCX: 00007f85e959e019 [ 93.909749][ T5329] RDX: 0000000000000017 RSI: 0000200000000000 RDI: 0000000000000007 [ 93.909756][ T5329] RBP: 00007f85e963500c R08: 0000000000000000 R09: 0000000000000000 [ 93.909762][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 93.909769][ T5329] R13: 00007f85e9826038 R14: 00007f85e9825fa0 R15: 00007ffe472ecdc8 [ 93.909779][ T5329] [ 93.909783][ T5329] [ 94.002351][ T5329] Allocated by task 5329: [ 94.004023][ T5329] kasan_save_track+0x3e/0x80 [ 94.006000][ T5329] __kasan_kmalloc+0x93/0xb0 [ 94.008052][ T5329] __kmalloc_node_track_caller_noprof+0x4c3/0x730 [ 94.010787][ T5329] kstrdup+0x42/0x100 [ 94.012471][ T5329] f_uac2_opts_p_srate_store+0x11f/0x2b0 [ 94.014662][ T5329] configfs_write_iter+0x337/0x430 [ 94.016726][ T5329] vfs_write+0x612/0xba0 [ 94.018482][ T5329] ksys_write+0x150/0x270 [ 94.020265][ T5329] do_syscall_64+0x174/0x580 [ 94.022186][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.024719][ T5329] [ 94.025687][ T5329] The buggy address belongs to the object at ffff8880353551c0 [ 94.025687][ T5329] which belongs to the cache kmalloc-32 of size 32 [ 94.031037][ T5329] The buggy address is located 21 bytes inside of [ 94.031037][ T5329] 24-byte region [ffff8880353551c0, ffff8880353551d8) [ 94.036149][ T5329] [ 94.037149][ T5329] The buggy address belongs to the physical page: [ 94.039721][ T5329] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x35355 [ 94.043126][ T5329] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 94.045900][ T5329] page_type: f5(slab) [ 94.047458][ T5329] raw: 04fff00000000000 ffff88801b041780 dead000000000100 dead000000000122 [ 94.050936][ T5329] raw: 0000000000000000 0000000800400040 00000000f5000000 0000000000000000 [ 94.054372][ T5329] page dumped because: kasan: bad access detected [ 94.057021][ T5329] page_owner tracks the page as allocated [ 94.067501][ T5329] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 11884982171, free_ts 0 [ 94.075287][ T5329] post_alloc_hook+0x1f9/0x250 [ 94.077109][ T5329] get_page_from_freelist+0x21fa/0x2270 [ 94.079333][ T5329] __alloc_frozen_pages_noprof+0x18d/0x380 [ 94.081762][ T5329] allocate_slab+0x79/0x5e0 [ 94.083657][ T5329] refill_objects+0x2d5/0x350 [ 94.085534][ T5329] __pcs_replace_empty_main+0x2bf/0x6b0 [ 94.087850][ T5329] __kmalloc_noprof+0x485/0x720 [ 94.089967][ T5329] kobject_get_path+0xc5/0x2f0 [ 94.092034][ T5329] kobject_uevent_env+0x29e/0x9e0 [ 94.094167][ T5329] device_add+0x544/0xb80 [ 94.096076][ T5329] device_create+0x269/0x300 [ 94.098017][ T5329] bdi_register_va+0x9c/0x740 [ 94.100039][ T5329] bdi_register+0xe2/0x140 [ 94.101982][ T5329] __add_disk+0x7da/0xe30 [ 94.103881][ T5329] add_disk_fwnode+0x143/0x3a0 [ 94.105956][ T5329] brd_alloc+0x5a9/0x7c0 [ 94.107844][ T5329] page_owner free stack trace missing [ 94.110089][ T5329] [ 94.111049][ T5329] Memory state around the buggy address: [ 94.113394][ T5329] ffff888035355080: 00 00 00 00 fc fc fc fc 00 00 00 fc fc fc fc fc [ 94.116803][ T5329] ffff888035355100: 00 00 04 fc fc fc fc fc 00 00 00 02 fc fc fc fc [ 94.120173][ T5329] >ffff888035355180: 00 00 02 fc fc fc fc fc 00 00 00 fc fc fc fc fc [ 94.123410][ T5329] ^ [ 94.125971][ T5329] ffff888035355200: fa fb fb fb fc fc fc fc 00 00 02 fc fc fc fc fc [ 94.129176][ T5329] ffff888035355280: 00 00 00 fc fc fc fc fc 00 00 05 fc fc fc fc fc [ 94.132527][ T5329] ================================================================== [ 94.146797][ T5329] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 94.149772][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.153588][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.157442][ T5329] Call Trace: [ 94.158816][ T5329] [ 94.160100][ T5329] vpanic+0x56c/0xa60 [ 94.161748][ T5329] ? __pfx_vpanic+0x10/0x10 [ 94.163551][ T5329] ? __pfx___schedule+0x10/0x10 [ 94.165520][ T5329] panic+0xc5/0xd0 [ 94.167051][ T5329] ? __pfx_panic+0x10/0x10 [ 94.168888][ T5329] ? preempt_schedule_common+0x82/0xd0 [ 94.171150][ T5329] check_panic_on_warn+0x89/0xb0 [ 94.173214][ T5329] end_report+0x73/0x170 [ 94.174958][ T5329] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 94.177239][ T5329] kasan_report_invalid_free+0xfa/0x110 [ 94.179489][ T5329] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 94.181944][ T5329] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 94.184399][ T5329] __kasan_slab_pre_free+0x104/0x120 [ 94.186567][ T5329] kfree+0x173/0x640 [ 94.188208][ T5329] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 94.190583][ T5329] f_uac2_opts_p_srate_store+0x225/0x2b0 [ 94.192868][ T5329] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 94.195352][ T5329] ? down_read+0x2be/0x330 [ 94.197178][ T5329] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 94.199735][ T5329] configfs_write_iter+0x337/0x430 [ 94.201826][ T5329] vfs_write+0x612/0xba0 [ 94.203565][ T5329] ? __pfx_vfs_write+0x10/0x10 [ 94.205510][ T5329] ? __fget_files+0x2a/0x420 [ 94.207461][ T5329] ksys_write+0x150/0x270 [ 94.209271][ T5329] ? __pfx_ksys_write+0x10/0x10 [ 94.211327][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.213786][ T5329] do_syscall_64+0x174/0x580 [ 94.215727][ T5329] ? trace_irq_disable+0x3b/0x140 [ 94.217784][ T5329] ? clear_bhb_loop+0x40/0x90 [ 94.219825][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.222233][ T5329] RIP: 0033:0x7f85e959e019 [ 94.224121][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.231897][ T5329] RSP: 002b:00007f85e59f4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 94.235338][ T5329] RAX: ffffffffffffffda RBX: 00007f85e9825fa0 RCX: 00007f85e959e019 [ 94.238659][ T5329] RDX: 0000000000000017 RSI: 0000200000000000 RDI: 0000000000000007 [ 94.242036][ T5329] RBP: 00007f85e963500c R08: 0000000000000000 R09: 0000000000000000 [ 94.245290][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.248526][ T5329] R13: 00007f85e9826038 R14: 00007f85e9825fa0 R15: 00007ffe472ecdc8 [ 94.251733][ T5329] [ 94.253434][ T5329] Kernel Offset: disabled [ 94.255279][ T5329] Rebooting in 86400 seconds..