program: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000001000070100dd21200100005b91325b38", @ANYRES32=0x0, @ANYBLOB="000000000080000008001b00000000000500100005"], 0x30}}, 0x0) write(r0, &(0x7f0000000080)="176ab85e3997cc", 0x7) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000240)={'vlan0\x00', 0x0}) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x11, &(0x7f0000000180)={&(0x7f0000000840)=ANY=[], 0x3c}}, 0x20) mkdir(&(0x7f0000000000)='config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) ioctl$EXT4_IOC_SHUTDOWN(r0, 0x8004587d) mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000400)='config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0) write$binfmt_misc(r4, &(0x7f0000000580)="30b6bab32306d98db67a4eb16744358701b5bd6b0696ed677bda34621dff306fcf15a7db923b4bba64e55f580d28dd86a884976a36fd4a0f90923226c8af81cfce95d1d6e6bc693612d2b34ab482f186691ab74861e4b60dc858ab2da5821ef2ade82cffd69db290f9e88e1b1a2770716e21ad122b0d0dae7a524b793cf4939d6421c4e24f7321bb2d156f80c333cbaa7a224d1e6c6959b25fbb1fc2b1e32e01ab5f0a2ab4f10ae61e2b102da9ff44e77f18dc4cb2d7e1a032c94457edfda20c2ab3f59a8bd5ba70ba9db0e276359127948de7e97ecddd4858a6d2c17a9656b7", 0xe0) symlink(&(0x7f0000000a00)='config/usb_gadget/g1/functions/uac2.usb0\x00', &(0x7f0000000b00)='config/usb_gadget/g1/configs/c.1/uac2.usb0\x00') write$P9_RREADLINK(r4, &(0x7f0000001780)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) r6 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) r8 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) shutdown(r8, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0xd}, 0x94) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ff5000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r9 = io_uring_setup(0xd61, &(0x7f0000000340)={0x0, 0x3cb1, 0x1c080, 0x1, 0x20002f7}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00'}, 0x10) io_uring_enter(r9, 0x2219, 0x7721, 0x16, 0x0, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x34, 0x24, 0xf0b, 0x0, 0x25dfdbfc, {0x60, 0x0, 0x0, r7, {}, {0xfff3, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) connect$can_bcm(r6, &(0x7f0000000140)={0x1d, r2}, 0x10) [ 94.825234][ T4642] Bluetooth: hci0: command tx timeout [ 94.915288][ T5318] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.929674][ T5318] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.998766][ T5318] ================================================================== [ 95.001634][ T5318] BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x225/0x2b0 [ 95.004461][ T5318] Free of addr ffff888012fd8a63 by task syz.0.0/5318 [ 95.006758][ T5318] [ 95.007614][ T5318] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.007628][ T5318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.007637][ T5318] Call Trace: [ 95.007643][ T5318] [ 95.007650][ T5318] dump_stack_lvl+0xe8/0x150 [ 95.007671][ T5318] print_address_description+0x55/0x1e0 [ 95.007690][ T5318] print_report+0x58/0x70 [ 95.007706][ T5318] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 95.007718][ T5318] kasan_report_invalid_free+0xea/0x110 [ 95.007736][ T5318] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 95.007749][ T5318] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 95.007761][ T5318] __kasan_slab_pre_free+0x104/0x120 [ 95.007777][ T5318] kfree+0x173/0x640 [ 95.007790][ T5318] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 95.007804][ T5318] f_uac2_opts_p_srate_store+0x225/0x2b0 [ 95.007815][ T5318] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 95.007829][ T5318] ? down_read+0x2be/0x330 [ 95.007843][ T5318] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 95.007856][ T5318] configfs_write_iter+0x337/0x430 [ 95.007870][ T5318] vfs_write+0x612/0xba0 [ 95.007892][ T5318] ? __pfx_vfs_write+0x10/0x10 [ 95.007913][ T5318] ? __fget_files+0x2a/0x420 [ 95.007932][ T5318] ksys_write+0x150/0x270 [ 95.007951][ T5318] ? __pfx_ksys_write+0x10/0x10 [ 95.007970][ T5318] do_syscall_64+0x166/0x520 [ 95.007982][ T5318] ? trace_irq_disable+0x3b/0x140 [ 95.007998][ T5318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.008010][ T5318] ? clear_bhb_loop+0x70/0xc0 [ 95.008024][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.008035][ T5318] RIP: 0033:0x7f5351b9e0d9 [ 95.008058][ T5318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.008068][ T5318] RSP: 002b:00007f5352b46fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 95.008085][ T5318] RAX: ffffffffffffffda RBX: 00007f5351e25fa0 RCX: 00007f5351b9e0d9 [ 95.008094][ T5318] RDX: 00000000000000e0 RSI: 0000200000000580 RDI: 0000000000000006 [ 95.008102][ T5318] RBP: 00007f5351c35024 R08: 0000000000000000 R09: 0000000000000000 [ 95.008109][ T5318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.008117][ T5318] R13: 00007f5351e26038 R14: 00007f5351e25fa0 R15: 00007ffc722cb718 [ 95.008161][ T5318] [ 95.008167][ T5318] [ 95.101562][ T5318] Allocated by task 5318: [ 95.103336][ T5318] kasan_save_track+0x3e/0x80 [ 95.105233][ T5318] __kasan_kmalloc+0x93/0xb0 [ 95.107189][ T5318] __kmalloc_node_track_caller_noprof+0x4c7/0x740 [ 95.109746][ T5318] kstrdup+0x42/0x100 [ 95.111423][ T5318] f_uac2_opts_p_srate_store+0x11f/0x2b0 [ 95.113808][ T5318] configfs_write_iter+0x337/0x430 [ 95.116039][ T5318] vfs_write+0x612/0xba0 [ 95.117872][ T5318] ksys_write+0x150/0x270 [ 95.119700][ T5318] do_syscall_64+0x166/0x520 [ 95.121816][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.124381][ T5318] [ 95.125408][ T5318] The buggy address belongs to the object at ffff888012fd8a00 [ 95.125408][ T5318] which belongs to the cache kmalloc-256 of size 256 [ 95.131318][ T5318] The buggy address is located 99 bytes inside of [ 95.131318][ T5318] 225-byte region [ffff888012fd8a00, ffff888012fd8ae1) [ 95.136475][ T5318] [ 95.137535][ T5318] The buggy address belongs to the physical page: [ 95.140314][ T5318] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12fd8 [ 95.144044][ T5318] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 95.147104][ T5318] page_type: f5(slab) [ 95.148784][ T5318] raw: 00fff00000000000 ffff88801b041b40 dead000000000122 0000000000000000 [ 95.152507][ T5318] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 95.156372][ T5318] page dumped because: kasan: bad access detected [ 95.159105][ T5318] page_owner tracks the page as allocated [ 95.161581][ T5318] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5277, tgid 5277 (syz-executor), ts 92891529793, free_ts 92774134990 [ 95.170154][ T5318] post_alloc_hook+0x1f9/0x250 [ 95.172246][ T5318] get_page_from_freelist+0x21fe/0x2270 [ 95.174566][ T5318] __alloc_frozen_pages_noprof+0x18d/0x380 [ 95.177194][ T5318] allocate_slab+0x79/0x5e0 [ 95.179078][ T5318] refill_objects+0x2d5/0x350 [ 95.180996][ T5318] __pcs_replace_empty_main+0x2c3/0x6b0 [ 95.183360][ T5318] __kmalloc_node_track_caller_noprof+0x55b/0x740 [ 95.186112][ T5318] kmemdup_array+0x3f/0x80 [ 95.188194][ T5318] xt_register_table+0xac/0xa40 [ 95.190227][ T5318] arpt_register_table+0x18d/0x440 [ 95.192365][ T5318] arptable_filter_table_init+0x41/0x70 [ 95.194630][ T5318] xt_find_table_lock+0x311/0x400 [ 95.196771][ T5318] xt_request_find_table_lock+0x26/0x100 [ 95.199118][ T5318] do_arpt_get_ctl+0x719/0x1190 [ 95.201286][ T5318] nf_getsockopt+0x26e/0x290 [ 95.203250][ T5318] ip_getsockopt+0x19e/0x230 [ 95.205184][ T5318] page last free pid 803 tgid 803 stack trace: [ 95.207742][ T5318] __free_frozen_pages+0xc22/0xd20 [ 95.209841][ T5318] __slab_free+0x274/0x2c0 [ 95.211666][ T5318] qlist_free_all+0x99/0x100 [ 95.213577][ T5318] kasan_quarantine_reduce+0x148/0x160 [ 95.215968][ T5318] __kasan_slab_alloc+0x22/0x80 [ 95.218040][ T5318] __kmalloc_cache_noprof+0x2af/0x660 [ 95.220379][ T5318] nsim_fib_event+0xf37/0xa3a0 [ 95.222418][ T5318] nsim_fib_event_work+0x244/0x3b0 [ 95.224596][ T5318] process_scheduled_works+0xa88/0x14c0 [ 95.226988][ T5318] worker_thread+0xa47/0xfb0 [ 95.229030][ T5318] kthread+0x38b/0x480 [ 95.230772][ T5318] ret_from_fork+0x514/0xb70 [ 95.232775][ T5318] ret_from_fork_asm+0x1a/0x30 [ 95.234820][ T5318] [ 95.235838][ T5318] Memory state around the buggy address: [ 95.238264][ T5318] ffff888012fd8900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 95.241726][ T5318] ffff888012fd8980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 95.245192][ T5318] >ffff888012fd8a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 95.248581][ T5318] ^ [ 95.251599][ T5318] ffff888012fd8a80: 00 00 00 00 00 00 00 00 00 00 00 00 01 fc fc fc [ 95.255064][ T5318] ffff888012fd8b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 95.258483][ T5318] ================================================================== [ 95.336664][ T5318] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 95.339855][ T5318] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.343539][ T5318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.347906][ T5318] Call Trace: [ 95.349368][ T5318] [ 95.350645][ T5318] vpanic+0x56d/0xa60 [ 95.352455][ T5318] ? __pfx_vpanic+0x10/0x10 [ 95.354431][ T5318] ? __pfx___schedule+0x10/0x10 [ 95.356606][ T5318] panic+0xc5/0xd0 [ 95.358236][ T5318] ? __pfx_panic+0x10/0x10 [ 95.360181][ T5318] ? preempt_schedule_common+0x7f/0xd0 [ 95.362482][ T5318] check_panic_on_warn+0x89/0xb0 [ 95.364526][ T5318] end_report+0x73/0x170 [ 95.366280][ T5318] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 95.368706][ T5318] kasan_report_invalid_free+0xfa/0x110 [ 95.371083][ T5318] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 95.373632][ T5318] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 95.376065][ T5318] __kasan_slab_pre_free+0x104/0x120 [ 95.378377][ T5318] kfree+0x173/0x640 [ 95.380062][ T5318] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 95.382475][ T5318] f_uac2_opts_p_srate_store+0x225/0x2b0 [ 95.384767][ T5318] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 95.387464][ T5318] ? down_read+0x2be/0x330 [ 95.389426][ T5318] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 95.392112][ T5318] configfs_write_iter+0x337/0x430 [ 95.394418][ T5318] vfs_write+0x612/0xba0 [ 95.396279][ T5318] ? __pfx_vfs_write+0x10/0x10 [ 95.398339][ T5318] ? __fget_files+0x2a/0x420 [ 95.400377][ T5318] ksys_write+0x150/0x270 [ 95.402224][ T5318] ? __pfx_ksys_write+0x10/0x10 [ 95.404242][ T5318] do_syscall_64+0x166/0x520 [ 95.406164][ T5318] ? trace_irq_disable+0x3b/0x140 [ 95.408425][ T5318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.410948][ T5318] ? clear_bhb_loop+0x70/0xc0 [ 95.412927][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.415477][ T5318] RIP: 0033:0x7f5351b9e0d9 [ 95.417412][ T5318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.425417][ T5318] RSP: 002b:00007f5352b46fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 95.429149][ T5318] RAX: ffffffffffffffda RBX: 00007f5351e25fa0 RCX: 00007f5351b9e0d9 [ 95.432573][ T5318] RDX: 00000000000000e0 RSI: 0000200000000580 RDI: 0000000000000006 [ 95.436013][ T5318] RBP: 00007f5351c35024 R08: 0000000000000000 R09: 0000000000000000 [ 95.439344][ T5318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.442738][ T5318] R13: 00007f5351e26038 R14: 00007f5351e25fa0 R15: 00007ffc722cb718 [ 95.446198][ T5318] [ 95.447937][ T5318] Kernel Offset: disabled [ 95.449890][ T5318] Rebooting in 86400 seconds..