program: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000a80)={0x14, 0x2f, 0x107, 0xfffffffc, 0x4, {0x1, 0x7c}}, 0x14}, 0x1, 0x0, 0x0, 0x488c4}, 0x2400c080) r1 = socket$nl_generic(0x10, 0x3, 0x10) mkdir(&(0x7f0000000000)='config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000400)='config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='config/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) write$dsp(r2, &(0x7f0000000440)="c67c5940132f85c0b11637ac5a0fbcc450348f061062dc6abf07941222540676cf5bb995db42a7958b21a3612723bcd00fa3f9ad8840e44a9844fcd865713a69eaedecbab3b5f45b7b126430560336fb0ae556f3a435529237da057767db6e5ca9edb35ab598a9c4a4d6f62fedfcadcf8ace09bd0ae3e9dda94d2cc3cfd232233cf609a63eaec78631a761b06ac514a96128682c3a5d6587019e98449897c934eb74580486", 0xa5) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000640)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={0x4c, r4, 0x105, 0xffffffff, 0xa, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @crypto_settings=[@NL80211_ATTR_AKM_SUITES={0x15, 0x4c, [0xfac0e, 0xfac03, 0xfac08]}, @NL80211_ATTR_WPA_VERSIONS={0x8}, @NL80211_ATTR_CIPHER_SUITES_PAIRWISE={0xc, 0x49, [0xfac0b, 0xfac0a]}]]}, 0x4c}, 0x1, 0x0, 0x0, 0x800}, 0x4004050) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_MCAST_RATE(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)={0x24, r7, 0x1, 0x0, 0xfffffffe, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x28a}]}, 0x24}, 0x1, 0x0, 0x0, 0x8081}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000140)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_MESH_CONFIG(r0, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x6c, r4, 0x8, 0x70bd2a, 0x25dfdbff, {{}, {@val={0x8, 0x3, r9}, @val={0xc, 0x99, {0xa56f, 0x11}}}}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r10}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x50}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r11}, @NL80211_ATTR_MESH_CONFIG={0x2c, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_MAX_PEER_LINKS={0x6, 0x4, 0x3}, @NL80211_MESHCONF_ELEMENT_TTL={0x5, 0xf, 0xfa}, @NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL={0x6, 0xc, 0x7ff}, @NL80211_MESHCONF_PLINK_TIMEOUT={0x8, 0x1c, 0xfffffff7}, @NL80211_MESHCONF_PATH_REFRESH_TIME={0x8, 0x9, 0x883}]}]}, 0x6c}}, 0x83) write(r2, &(0x7f0000000700)='44100,48000,88200,96000,176400,192000\x00', 0x25) r12 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0) write(r12, &(0x7f0000000900)='44100,48000,88200,96000,176400,192000\x00', 0x25) symlink(&(0x7f0000000a00)='config/usb_gadget/g1/functions/uac2.usb0\x00', &(0x7f0000000b00)='config/usb_gadget/g1/configs/c.1/uac2.usb0\x00') r13 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r13, &(0x7f0000000d00)='dummy_udc.0\x00', 0xb) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000001400)={0x14, 0x2f, 0x9, 0x70bd25, 0x25dfd3ff, {0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x4000811}, 0x480f0) [ 75.796117][ T5284] Bluetooth: hci0: command tx timeout [ 75.906064][ T5321] ================================================================== [ 75.909334][ T5321] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0 [ 75.912653][ T5321] Free of addr ffff88803678727b by task syz.0.0/5321 [ 75.915384][ T5321] [ 75.916446][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 75.916462][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 75.916471][ T5321] Call Trace: [ 75.916478][ T5321] [ 75.916483][ T5321] dump_stack_lvl+0xe8/0x150 [ 75.916505][ T5321] print_address_description+0x55/0x1e0 [ 75.916524][ T5321] print_report+0x58/0x70 [ 75.916538][ T5321] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 75.916552][ T5321] kasan_report_invalid_free+0xea/0x110 [ 75.916569][ T5321] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 75.916583][ T5321] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 75.916596][ T5321] __kasan_slab_pre_free+0x104/0x120 [ 75.916609][ T5321] kfree+0x173/0x640 [ 75.916621][ T5321] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 75.916635][ T5321] f_uac2_opts_c_srate_store+0x225/0x2b0 [ 75.916648][ T5321] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 75.916663][ T5321] ? down_read+0x2be/0x330 [ 75.916676][ T5321] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 75.916707][ T5321] configfs_write_iter+0x337/0x430 [ 75.916723][ T5321] vfs_write+0x612/0xba0 [ 75.916744][ T5321] ? __pfx_vfs_write+0x10/0x10 [ 75.916762][ T5321] ? __fget_files+0x2a/0x420 [ 75.916778][ T5321] ksys_write+0x150/0x270 [ 75.916796][ T5321] ? __pfx_ksys_write+0x10/0x10 [ 75.916810][ T5321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.916822][ T5321] do_syscall_64+0x174/0x580 [ 75.916835][ T5321] ? trace_irq_disable+0x3b/0x140 [ 75.916851][ T5321] ? clear_bhb_loop+0x40/0x90 [ 75.916861][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.916873][ T5321] RIP: 0033:0x7fcbd939de99 [ 75.916886][ T5321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 75.916897][ T5321] RSP: 002b:00007fcbda22cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 75.916911][ T5321] RAX: ffffffffffffffda RBX: 00007fcbd9625fa0 RCX: 00007fcbd939de99 [ 75.916919][ T5321] RDX: 00000000000000a5 RSI: 0000200000000440 RDI: 0000000000000005 [ 75.916927][ T5321] RBP: 00007fcbd9433eaf R08: 0000000000000000 R09: 0000000000000000 [ 75.916942][ T5321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 75.916948][ T5321] R13: 00007fcbd9626038 R14: 00007fcbd9625fa0 R15: 00007ffd3c7d3c48 [ 75.916958][ T5321] [ 75.916962][ T5321] [ 76.013328][ T5321] Allocated by task 5321: [ 76.015196][ T5321] kasan_save_track+0x3e/0x80 [ 76.017192][ T5321] __kasan_kmalloc+0x93/0xb0 [ 76.019098][ T5321] __kmalloc_node_track_caller_noprof+0x4c3/0x730 [ 76.021827][ T5321] kstrdup+0x42/0x100 [ 76.023543][ T5321] f_uac2_opts_c_srate_store+0x11f/0x2b0 [ 76.025880][ T5321] configfs_write_iter+0x337/0x430 [ 76.028034][ T5321] vfs_write+0x612/0xba0 [ 76.029800][ T5321] ksys_write+0x150/0x270 [ 76.031607][ T5321] do_syscall_64+0x174/0x580 [ 76.033538][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.035976][ T5321] [ 76.037058][ T5321] The buggy address belongs to the object at ffff888036787200 [ 76.037058][ T5321] which belongs to the cache kmalloc-192 of size 192 [ 76.042934][ T5321] The buggy address is located 123 bytes inside of [ 76.042934][ T5321] 166-byte region [ffff888036787200, ffff8880367872a6) [ 76.048514][ T5321] [ 76.049594][ T5321] The buggy address belongs to the physical page: [ 76.052370][ T5321] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x36787 [ 76.056149][ T5321] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 76.059173][ T5321] page_type: f5(slab) [ 76.060823][ T5321] raw: 04fff00000000000 ffff88801b0413c0 dead000000000100 dead000000000122 [ 76.064529][ T5321] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 76.068132][ T5321] page dumped because: kasan: bad access detected [ 76.070841][ T5321] page_owner tracks the page as allocated [ 76.073217][ T5321] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 12134768581, free_ts 12133866477 [ 76.081431][ T5321] post_alloc_hook+0x1f9/0x250 [ 76.083569][ T5321] get_page_from_freelist+0x21fa/0x2270 [ 76.085986][ T5321] __alloc_frozen_pages_noprof+0x18d/0x380 [ 76.088394][ T5321] allocate_slab+0x79/0x5e0 [ 76.090349][ T5321] refill_objects+0x2d5/0x350 [ 76.092416][ T5321] __pcs_replace_empty_main+0x2bf/0x6b0 [ 76.094835][ T5321] __kmalloc_cache_node_noprof+0x445/0x630 [ 76.097300][ T5321] init_rescuer+0x167/0x530 [ 76.099246][ T5321] __alloc_workqueue+0x1c1a/0x2060 [ 76.101418][ T5321] alloc_workqueue_noprof+0xe3/0x210 [ 76.103671][ T5321] iscsi_transport_init+0x194/0x260 [ 76.105922][ T5321] do_one_initcall+0x250/0x870 [ 76.108069][ T5321] do_initcall_level+0x10a/0x1a0 [ 76.110178][ T5321] do_initcalls+0x59/0xa0 [ 76.112064][ T5321] kernel_init_freeable+0x29d/0x3e0 [ 76.114265][ T5321] kernel_init+0x1d/0x1d0 [ 76.116080][ T5321] page last free pid 68 tgid 68 stack trace: [ 76.118580][ T5321] __free_frozen_pages+0xc1e/0xd10 [ 76.120700][ T5321] __kasan_populate_vmalloc+0x1a8/0x1c0 [ 76.123041][ T5321] alloc_vmap_area+0xd1a/0x1420 [ 76.125107][ T5321] __get_vm_area_node+0x1f2/0x300 [ 76.127237][ T5321] __vmalloc_node_range_noprof+0x358/0x1730 [ 76.129669][ T5321] __vmalloc_node_noprof+0xc2/0x100 [ 76.131874][ T5321] dup_task_struct+0x2a0/0x8e0 [ 76.133886][ T5321] copy_process+0x820/0x4390 [ 76.135924][ T5321] kernel_clone+0x2d7/0x940 [ 76.137951][ T5321] user_mode_thread+0x110/0x180 [ 76.140046][ T5321] call_usermodehelper_exec_work+0x5c/0x230 [ 76.142584][ T5321] process_scheduled_works+0xa8e/0x14e0 [ 76.144970][ T5321] worker_thread+0xa47/0xfb0 [ 76.147024][ T5321] kthread+0x388/0x470 [ 76.148733][ T5321] ret_from_fork+0x514/0xb70 [ 76.150702][ T5321] ret_from_fork_asm+0x1a/0x30 [ 76.152826][ T5321] [ 76.153847][ T5321] Memory state around the buggy address: [ 76.156158][ T5321] ffff888036787100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 76.159444][ T5321] ffff888036787180: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 76.162795][ T5321] >ffff888036787200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 76.166014][ T5321] ^ [ 76.169441][ T5321] ffff888036787280: 00 00 00 00 06 fc fc fc fc fc fc fc fc fc fc fc [ 76.172769][ T5321] ffff888036787300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 76.176187][ T5321] ================================================================== [ 76.238984][ T5321] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 76.242889][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 76.246897][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 76.251204][ T5321] Call Trace: [ 76.252694][ T5321] [ 76.254027][ T5321] vpanic+0x56c/0xa60 [ 76.255782][ T5321] ? __pfx_vpanic+0x10/0x10 [ 76.257767][ T5321] ? __pfx___schedule+0x10/0x10 [ 76.259875][ T5321] panic+0xc5/0xd0 [ 76.261525][ T5321] ? __pfx_panic+0x10/0x10 [ 76.263499][ T5321] ? preempt_schedule_common+0x82/0xd0 [ 76.265860][ T5321] check_panic_on_warn+0x89/0xb0 [ 76.268047][ T5321] end_report+0x73/0x170 [ 76.269954][ T5321] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 76.272483][ T5321] kasan_report_invalid_free+0xfa/0x110 [ 76.274954][ T5321] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 76.277499][ T5321] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 76.279993][ T5321] __kasan_slab_pre_free+0x104/0x120 [ 76.282266][ T5321] kfree+0x173/0x640 [ 76.283971][ T5321] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 76.286467][ T5321] f_uac2_opts_c_srate_store+0x225/0x2b0 [ 76.288962][ T5321] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 76.291702][ T5321] ? down_read+0x2be/0x330 [ 76.293679][ T5321] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 76.296384][ T5321] configfs_write_iter+0x337/0x430 [ 76.298634][ T5321] vfs_write+0x612/0xba0 [ 76.300515][ T5321] ? __pfx_vfs_write+0x10/0x10 [ 76.302543][ T5321] ? __fget_files+0x2a/0x420 [ 76.304498][ T5321] ksys_write+0x150/0x270 [ 76.306295][ T5321] ? __pfx_ksys_write+0x10/0x10 [ 76.308380][ T5321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.311007][ T5321] do_syscall_64+0x174/0x580 [ 76.312952][ T5321] ? trace_irq_disable+0x3b/0x140 [ 76.315179][ T5321] ? clear_bhb_loop+0x40/0x90 [ 76.317272][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.319888][ T5321] RIP: 0033:0x7fcbd939de99 [ 76.321884][ T5321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 76.330079][ T5321] RSP: 002b:00007fcbda22cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 76.333671][ T5321] RAX: ffffffffffffffda RBX: 00007fcbd9625fa0 RCX: 00007fcbd939de99 [ 76.337093][ T5321] RDX: 00000000000000a5 RSI: 0000200000000440 RDI: 0000000000000005 [ 76.340530][ T5321] RBP: 00007fcbd9433eaf R08: 0000000000000000 R09: 0000000000000000 [ 76.343925][ T5321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 76.347295][ T5321] R13: 00007fcbd9626038 R14: 00007fcbd9625fa0 R15: 00007ffd3c7d3c48 [ 76.350642][ T5321] [ 76.352391][ T5321] Kernel Offset: disabled [ 76.354212][ T5321] Rebooting in 86400 seconds..