program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000400)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/functions/uac1_legacy.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000000200)='./config/usb_gadget/g1/functions/uac1_legacy.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1/uac1_legacy.usb0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) lseek(r1, 0x0, 0x4) getdents64(r1, 0x0, 0x0) syz_ublk_setup_queues(r1, 0x0, &(0x7f0000000340)={0x0, 0x8592, 0x40000, 0x1, 0x166, 0x0, r1}, &(0x7f0000000540)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x790b, 0x8, 0x0, 0xb2, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4d87, 0x10, 0x0, 0x324, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xafde, 0x20, 0x0, 0x170, 0x0, r0}, 0xffffffffffffffff}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x48b2, 0x0, 0x0, 0x2a7, 0x0, r1}}], 0x4, &(0x7f00000017c0)={0x2e, 0x40, 0x0, r1, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xf}, 0x0, 0x0, '\x00', {0x4, 0x6c5, 0x0, &(0x7f00000007c0)=@buf_1k="dd5f64619d19ac0ecee38704be2d0ff1d2fc0d119360c95b104906b1cf327fc5aaec0185bcbef65339d45129309d8b458857b427019512d03aae506ae2e2e95bada852b57629065c7b09751f8a9c9fbf35692a96f252842adf4bd22d3c7085bee8c5248e0ef388ad8bdc86668032784737c092d92b0ead3d37cea21817897a4cd1e18cece71e211b894459a862be2eed4f5668be7fc519bc8314d22402313ad48b6dfab5a011fb2e14e82dfc32efb5adba0d92b54eee79002688d660a6fda661797309cf19159a05ccfdeb70f3b8928579bc08be620410824a8025397a9b2e73d0b08775009aff4ba0c42d72c2f59ca29d8a2035cf5997ca3d138c88ef2bc1033cfa0fa463e493b08b63fda3891a7d7925fd0affb1bae7f4f89bdcd65af085320bf63a6f78d9f3f2f89580984e8dbe140248d3fbf73dbbb983ca94688a6523f0e72bd2030b7ef68b2b66ccb33c5a4c5715b0a45edbf0472c97ee5acafdfd7fb07afe376e023243eb2045cc5e221269413022ea2160dab2c6e07a628020a761aea3d60ca8a75279b5e73de7b612fcdcff5393b69f30c6a3a747e4213e3fcee5cbaf4a6d3c9f2cd22acfe8f14e93648cabdc7d7b781fddd345cb121b448a39c35dd1c8097877cd3cb25a0f502bcb588d4967cf58858e5844eef4c1868d4560e5561ae8e26ea48e560d61a48ab0b400c019cefcacfbceb8ff120b978db256f639592d948eb02f42b1ca8149bb60acd227b79720365c05f69ade880109e81e70faaf15bb5ca560cce55f7980a4177a84ac6a06960cc2c68a2b1160db681b5c12beb40fe5cc9c7dc316b64730e137aa08ec85d6a0c30e32454a3c30eb5f9ad0d6932ab67a12427788fe160f1ff319f80cee52ad8810cacecc8d543427f69c90a2d8142e32a8a6df562eec9a31a3931eacecea0658fd0d3dba23b46338a8ca99fc578aa8a6482cc936221fb1bc04abdbde8d1a35d9e05f8e2456b275a1162dbf19227570010c8a6ca88a5f2152789c770381fb1d64a23587250a7481fd2868b546a45f2af3bc40a3af73ce324e6ae94c734d34ac82a76233be4ada2133c88de1eed44b87c8b24d0ccae713fb3994c0a10ba4f366c04adc9fa942d75258a9625e5233a12ba1f04f72a0fb67db7371fda1b0f6736c1e79beaa714e30df9fba1eb2a9f87d1b8d0b0d5dc6d6ccd58e4e2b11f8b45b3e301a9bf5148d54cad4b9d1626b0b287fe64427f2c6f6d59f2d8ee8b44e4fb828c179c4fd5f7cf7b1ecf54d097e3ffa49e7f789a4c2bf85e9b5bf45294fb7db5c012ea0e49b0fb1b72e9a2df8429cd415d85c098b33454e1a30ece425e6536c3b4d04241d1063ba0d0c8601a95b8f08196c47e391d20f76f742ff3840285b53985b226d651e6f6ad984d39843d9b125d1290c498700daf2b268b43b649246f8f2e093ed064757bab2538daab8323ffd"}}, &(0x7f0000001840)) mmap$IORING_OFF_SQES(0x0, 0x2, 0x1000002, 0x1010, r2, 0x10000000) r3 = getpgrp(0x0) r4 = syz_pidfd_open(r3, 0x0) fsetxattr$trusted_overlay_nlink(r4, &(0x7f00000018c0), 0x0, 0x0, 0x1) flistxattr(r4, 0x0, 0x0) migrate_pages(r3, 0xffffffff, &(0x7f00000000c0)=0xeb, &(0x7f0000000140)=0x2) write(r0, &(0x7f0000000400)='dummy_udc.0\n\x00', 0xc) nanosleep(&(0x7f0000000500)={0x0, 0x2faf080}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000400)='configfs\x00', 0x0, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/functions/uac1_legacy.usb0\x00', 0x1ff) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) (async) symlinkat(&(0x7f0000000200)='./config/usb_gadget/g1/functions/uac1_legacy.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1/uac1_legacy.usb0\x00') (async) openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) (async) lseek(r1, 0x0, 0x4) (async) getdents64(r1, 0x0, 0x0) (async) syz_ublk_setup_queues(r1, 0x0, &(0x7f0000000340)={0x0, 0x8592, 0x40000, 0x1, 0x166, 0x0, r1}, &(0x7f0000000540)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x790b, 0x8, 0x0, 0xb2, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4d87, 0x10, 0x0, 0x324, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xafde, 0x20, 0x0, 0x170, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x48b2, 0x0, 0x0, 0x2a7, 0x0, r1}}], 0x4, &(0x7f00000017c0)={0x2e, 0x40, 0x0, r1, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xf}, 0x0, 0x0, '\x00', {0x4, 0x6c5, 0x0, &(0x7f00000007c0)=@buf_1k="dd5f64619d19ac0ecee38704be2d0ff1d2fc0d119360c95b104906b1cf327fc5aaec0185bcbef65339d45129309d8b458857b427019512d03aae506ae2e2e95bada852b57629065c7b09751f8a9c9fbf35692a96f252842adf4bd22d3c7085bee8c5248e0ef388ad8bdc86668032784737c092d92b0ead3d37cea21817897a4cd1e18cece71e211b894459a862be2eed4f5668be7fc519bc8314d22402313ad48b6dfab5a011fb2e14e82dfc32efb5adba0d92b54eee79002688d660a6fda661797309cf19159a05ccfdeb70f3b8928579bc08be620410824a8025397a9b2e73d0b08775009aff4ba0c42d72c2f59ca29d8a2035cf5997ca3d138c88ef2bc1033cfa0fa463e493b08b63fda3891a7d7925fd0affb1bae7f4f89bdcd65af085320bf63a6f78d9f3f2f89580984e8dbe140248d3fbf73dbbb983ca94688a6523f0e72bd2030b7ef68b2b66ccb33c5a4c5715b0a45edbf0472c97ee5acafdfd7fb07afe376e023243eb2045cc5e221269413022ea2160dab2c6e07a628020a761aea3d60ca8a75279b5e73de7b612fcdcff5393b69f30c6a3a747e4213e3fcee5cbaf4a6d3c9f2cd22acfe8f14e93648cabdc7d7b781fddd345cb121b448a39c35dd1c8097877cd3cb25a0f502bcb588d4967cf58858e5844eef4c1868d4560e5561ae8e26ea48e560d61a48ab0b400c019cefcacfbceb8ff120b978db256f639592d948eb02f42b1ca8149bb60acd227b79720365c05f69ade880109e81e70faaf15bb5ca560cce55f7980a4177a84ac6a06960cc2c68a2b1160db681b5c12beb40fe5cc9c7dc316b64730e137aa08ec85d6a0c30e32454a3c30eb5f9ad0d6932ab67a12427788fe160f1ff319f80cee52ad8810cacecc8d543427f69c90a2d8142e32a8a6df562eec9a31a3931eacecea0658fd0d3dba23b46338a8ca99fc578aa8a6482cc936221fb1bc04abdbde8d1a35d9e05f8e2456b275a1162dbf19227570010c8a6ca88a5f2152789c770381fb1d64a23587250a7481fd2868b546a45f2af3bc40a3af73ce324e6ae94c734d34ac82a76233be4ada2133c88de1eed44b87c8b24d0ccae713fb3994c0a10ba4f366c04adc9fa942d75258a9625e5233a12ba1f04f72a0fb67db7371fda1b0f6736c1e79beaa714e30df9fba1eb2a9f87d1b8d0b0d5dc6d6ccd58e4e2b11f8b45b3e301a9bf5148d54cad4b9d1626b0b287fe64427f2c6f6d59f2d8ee8b44e4fb828c179c4fd5f7cf7b1ecf54d097e3ffa49e7f789a4c2bf85e9b5bf45294fb7db5c012ea0e49b0fb1b72e9a2df8429cd415d85c098b33454e1a30ece425e6536c3b4d04241d1063ba0d0c8601a95b8f08196c47e391d20f76f742ff3840285b53985b226d651e6f6ad984d39843d9b125d1290c498700daf2b268b43b649246f8f2e093ed064757bab2538daab8323ffd"}}, &(0x7f0000001840)) (async) mmap$IORING_OFF_SQES(0x0, 0x2, 0x1000002, 0x1010, r2, 0x10000000) (async) getpgrp(0x0) (async) syz_pidfd_open(r3, 0x0) (async) fsetxattr$trusted_overlay_nlink(r4, &(0x7f00000018c0), 0x0, 0x0, 0x1) (async) flistxattr(r4, 0x0, 0x0) (async) migrate_pages(r3, 0xffffffff, &(0x7f00000000c0)=0xeb, &(0x7f0000000140)=0x2) (async) write(r0, &(0x7f0000000400)='dummy_udc.0\n\x00', 0xc) (async) nanosleep(&(0x7f0000000500)={0x0, 0x2faf080}, 0x0) (async) [ 103.323745][ T5279] Bluetooth: hci0: command tx timeout [ 103.424372][ T5320] configfs-gadget.g1 gadget.0: Hardware params: access 3, format 2, channels 2, rate 48000 [ 103.429779][ T5320] udc dummy_udc.0: failed to start g1: -19 [ 103.438649][ T5320] UDC core: g1: couldn't find an available UDC or it's busy [ 103.515859][ T5322] ================================================================== [ 103.519057][ T5322] BUG: KASAN: slab-use-after-free in filp_flush+0x31/0x190 [ 103.521862][ T5322] Read of size 8 at addr ffff888012532a18 by task syz.0.0/5322 [ 103.524611][ T5322] [ 103.525506][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.525520][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.525527][ T5322] Call Trace: [ 103.525534][ T5322] [ 103.525539][ T5322] dump_stack_lvl+0xe8/0x150 [ 103.525552][ T5322] print_address_description+0x55/0x1e0 [ 103.525562][ T5322] ? filp_flush+0x31/0x190 [ 103.525570][ T5322] print_report+0x58/0x70 [ 103.525578][ T5322] kasan_report+0x117/0x150 [ 103.525588][ T5322] ? filp_flush+0x31/0x190 [ 103.525596][ T5322] kasan_check_range+0x264/0x2c0 [ 103.525605][ T5322] filp_flush+0x31/0x190 [ 103.525612][ T5322] filp_close+0x1d/0x40 [ 103.525619][ T5322] gaudio_cleanup+0x54/0xf0 [ 103.525670][ T5322] f_audio_bind+0x4a0/0x630 [ 103.525681][ T5322] ? __pfx_f_audio_bind+0x10/0x10 [ 103.525692][ T5322] ? rcu_is_watching+0x15/0xb0 [ 103.525702][ T5322] ? usb_gadget_set_selfpowered+0xf5/0x260 [ 103.525713][ T5322] usb_add_function+0x2e1/0x9f0 [ 103.525758][ T5322] ? check_remote_wakeup_config+0x58/0x1c0 [ 103.525768][ T5322] configfs_composite_bind+0xde0/0x1410 [ 103.525779][ T5322] ? __pfx_configfs_composite_bind+0x10/0x10 [ 103.525788][ T5322] gadget_bind_driver+0x2ca/0x9e0 [ 103.525797][ T5322] ? __pfx_gadget_bind_driver+0x10/0x10 [ 103.525804][ T5322] really_probe+0x254/0xae0 [ 103.525812][ T5322] __driver_probe_device+0x1e8/0x360 [ 103.525819][ T5322] driver_probe_device+0x4f/0x240 [ 103.525827][ T5322] __driver_attach+0x339/0x600 [ 103.525833][ T5322] bus_for_each_dev+0x23b/0x2c0 [ 103.525842][ T5322] ? __pfx___driver_attach+0x10/0x10 [ 103.525850][ T5322] ? __pfx_bus_for_each_dev+0x10/0x10 [ 103.525863][ T5322] ? do_raw_spin_unlock+0x4d/0x210 [ 103.525875][ T5322] bus_add_driver+0x345/0x670 [ 103.525890][ T5322] driver_register+0x23a/0x320 [ 103.525902][ T5322] usb_gadget_register_driver_owner+0xf9/0x270 [ 103.525911][ T5322] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 103.525919][ T5322] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10 [ 103.525927][ T5322] configfs_write_iter+0x337/0x430 [ 103.525936][ T5322] vfs_write+0x612/0xba0 [ 103.525948][ T5322] ? __pfx_vfs_write+0x10/0x10 [ 103.525958][ T5322] ? __fget_files+0x2a/0x420 [ 103.525968][ T5322] ksys_write+0x150/0x270 [ 103.525977][ T5322] ? __pfx_ksys_write+0x10/0x10 [ 103.525987][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.525997][ T5322] do_syscall_64+0x174/0x580 [ 103.526011][ T5322] ? trace_irq_disable+0x3b/0x140 [ 103.526025][ T5322] ? clear_bhb_loop+0x70/0xc0 [ 103.526037][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.526049][ T5322] RIP: 0033:0x7ff4cd99e0d9 [ 103.526057][ T5322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.526063][ T5322] RSP: 002b:00007ff4ce7fbfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 103.526072][ T5322] RAX: ffffffffffffffda RBX: 00007ff4cdc26180 RCX: 00007ff4cd99e0d9 [ 103.526078][ T5322] RDX: 000000000000000c RSI: 0000200000000400 RDI: 0000000000000003 [ 103.526082][ T5322] RBP: 00007ff4cda35024 R08: 0000000000000000 R09: 0000000000000000 [ 103.526087][ T5322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.526091][ T5322] R13: 00007ff4cdc26218 R14: 00007ff4cdc26180 R15: 00007ffff2e359a8 [ 103.526098][ T5322] [ 103.526101][ T5322] [ 103.663285][ T5322] Allocated by task 5320: [ 103.664914][ T5322] kasan_save_track+0x3e/0x80 [ 103.666950][ T5322] __kasan_slab_alloc+0x6c/0x80 [ 103.668949][ T5322] kmem_cache_alloc_noprof+0x2a0/0x5f0 [ 103.671254][ T5322] alloc_empty_file+0x5b/0x1d0 [ 103.673321][ T5322] path_openat+0x8f/0x3830 [ 103.675170][ T5322] do_file_open+0x23e/0x4a0 [ 103.677166][ T5322] filp_open+0x16d/0x1d0 [ 103.678984][ T5322] gaudio_setup+0x11b/0xf10 [ 103.680944][ T5322] f_audio_bind+0x137/0x630 [ 103.682895][ T5322] usb_add_function+0x2e1/0x9f0 [ 103.685017][ T5322] configfs_composite_bind+0xde0/0x1410 [ 103.687361][ T5322] gadget_bind_driver+0x2ca/0x9e0 [ 103.689441][ T5322] really_probe+0x254/0xae0 [ 103.691290][ T5322] __driver_probe_device+0x1e8/0x360 [ 103.693528][ T5322] driver_probe_device+0x4f/0x240 [ 103.695689][ T5322] __driver_attach+0x339/0x600 [ 103.697794][ T5322] bus_for_each_dev+0x23b/0x2c0 [ 103.699763][ T5322] bus_add_driver+0x345/0x670 [ 103.701759][ T5322] driver_register+0x23a/0x320 [ 103.703805][ T5322] usb_gadget_register_driver_owner+0xf9/0x270 [ 103.706524][ T5322] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 103.708877][ T5322] configfs_write_iter+0x337/0x430 [ 103.710903][ T5322] vfs_write+0x612/0xba0 [ 103.712707][ T5322] ksys_write+0x150/0x270 [ 103.714649][ T5322] do_syscall_64+0x174/0x580 [ 103.716705][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.719275][ T5322] [ 103.720321][ T5322] Freed by task 15: [ 103.721993][ T5322] kasan_save_track+0x3e/0x80 [ 103.723984][ T5322] kasan_save_free_info+0x40/0x50 [ 103.725985][ T5322] __kasan_slab_free+0x5c/0x80 [ 103.728055][ T5322] slab_free_after_rcu_debug+0x12a/0x220 [ 103.730390][ T5322] rcu_core+0x78b/0x10a0 [ 103.732196][ T5322] handle_softirqs+0x225/0x840 [ 103.734211][ T5322] run_ksoftirqd+0x36/0x60 [ 103.736024][ T5322] smpboot_thread_fn+0x57c/0xa80 [ 103.738138][ T5322] kthread+0x388/0x470 [ 103.739834][ T5322] ret_from_fork+0x514/0xb70 [ 103.741763][ T5322] ret_from_fork_asm+0x1a/0x30 [ 103.743726][ T5322] [ 103.744795][ T5322] Last potentially related work creation: [ 103.747086][ T5322] kasan_save_stack+0x3e/0x60 [ 103.749035][ T5322] kasan_record_aux_stack+0xbd/0xd0 [ 103.751077][ T5322] kmem_cache_free+0x44f/0x650 [ 103.753101][ T5322] task_work_run+0x1d9/0x270 [ 103.755033][ T5322] exit_to_user_mode_loop+0x1fa/0x730 [ 103.757223][ T5322] do_syscall_64+0x353/0x580 [ 103.759185][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.761666][ T5322] [ 103.762694][ T5322] Second to last potentially related work creation: [ 103.765367][ T5322] kasan_save_stack+0x3e/0x60 [ 103.767284][ T5322] kasan_record_aux_stack+0xbd/0xd0 [ 103.769391][ T5322] task_work_add+0xae/0x420 [ 103.771206][ T5322] __fput_deferred+0x143/0x380 [ 103.773185][ T5322] fput_close+0x11f/0x240 [ 103.774991][ T5322] filp_close+0x27/0x40 [ 103.776744][ T5322] gaudio_cleanup+0x54/0xf0 [ 103.778648][ T5322] f_audio_bind+0x4a0/0x630 [ 103.780607][ T5322] usb_add_function+0x2e1/0x9f0 [ 103.782651][ T5322] configfs_composite_bind+0xde0/0x1410 [ 103.784722][ T5322] gadget_bind_driver+0x2ca/0x9e0 [ 103.786624][ T5322] really_probe+0x254/0xae0 [ 103.788582][ T5322] __driver_probe_device+0x1e8/0x360 [ 103.790660][ T5322] driver_probe_device+0x4f/0x240 [ 103.792652][ T5322] __driver_attach+0x339/0x600 [ 103.794643][ T5322] bus_for_each_dev+0x23b/0x2c0 [ 103.796638][ T5322] bus_add_driver+0x345/0x670 [ 103.798682][ T5322] driver_register+0x23a/0x320 [ 103.800764][ T5322] usb_gadget_register_driver_owner+0xf9/0x270 [ 103.803462][ T5322] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 103.805874][ T5322] configfs_write_iter+0x337/0x430 [ 103.808104][ T5322] vfs_write+0x612/0xba0 [ 103.809933][ T5322] ksys_write+0x150/0x270 [ 103.811664][ T5322] do_syscall_64+0x174/0x580 [ 103.813607][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.816054][ T5322] [ 103.817126][ T5322] The buggy address belongs to the object at ffff8880125328c0 [ 103.817126][ T5322] which belongs to the cache filp of size 352 [ 103.822820][ T5322] The buggy address is located 344 bytes inside of [ 103.822820][ T5322] freed 352-byte region [ffff8880125328c0, ffff888012532a20) [ 103.828469][ T5322] [ 103.829595][ T5322] The buggy address belongs to the physical page: [ 103.832626][ T5322] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12532 [ 103.836841][ T5322] memcg:ffff888012443981 [ 103.838811][ T5322] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 103.841539][ T5322] page_type: f5(slab) [ 103.843111][ T5322] raw: 00fff00000000000 ffff888030414500 dead000000000100 dead000000000122 [ 103.846709][ T5322] raw: 0000000000000000 0000000800090009 00000000f5000000 ffff888012443981 [ 103.850302][ T5322] page dumped because: kasan: bad access detected [ 103.852959][ T5322] page_owner tracks the page as allocated [ 103.855549][ T5322] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5286, tgid 5286 (modprobe), ts 98251014237, free_ts 98143814926 [ 103.864180][ T5322] post_alloc_hook+0x1f9/0x250 [ 103.866212][ T5322] get_page_from_freelist+0x21fa/0x2270 [ 103.868438][ T5322] __alloc_frozen_pages_noprof+0x18d/0x380 [ 103.870819][ T5322] allocate_slab+0x79/0x5e0 [ 103.872762][ T5322] refill_objects+0x2d5/0x350 [ 103.874602][ T5322] __pcs_replace_empty_main+0x2bf/0x6b0 [ 103.876719][ T5322] kmem_cache_alloc_noprof+0x382/0x5f0 [ 103.878989][ T5322] alloc_empty_file+0x5b/0x1d0 [ 103.880964][ T5322] path_openat+0x8f/0x3830 [ 103.882835][ T5322] do_file_open+0x23e/0x4a0 [ 103.884828][ T5322] do_sys_openat2+0x115/0x200 [ 103.886780][ T5322] __x64_sys_openat+0x138/0x170 [ 103.888849][ T5322] do_syscall_64+0x174/0x580 [ 103.890670][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.893019][ T5322] page last free pid 15 tgid 15 stack trace: [ 103.895377][ T5322] __free_frozen_pages+0xc1e/0xd10 [ 103.899011][ T5322] tlb_remove_table_rcu+0x85/0x100 [ 103.901174][ T5322] rcu_core+0x78b/0x10a0 [ 103.903031][ T5322] handle_softirqs+0x225/0x840 [ 103.905101][ T5322] run_ksoftirqd+0x36/0x60 [ 103.906993][ T5322] smpboot_thread_fn+0x57c/0xa80 [ 103.909121][ T5322] kthread+0x388/0x470 [ 103.910855][ T5322] ret_from_fork+0x514/0xb70 [ 103.912657][ T5322] ret_from_fork_asm+0x1a/0x30 [ 103.914751][ T5322] [ 103.915724][ T5322] Memory state around the buggy address: [ 103.917858][ T5322] ffff888012532900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 103.921173][ T5322] ffff888012532980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 103.924399][ T5322] >ffff888012532a00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc [ 103.927719][ T5322] ^ [ 103.929809][ T5322] ffff888012532a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 103.933149][ T5322] ffff888012532b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 103.936981][ T5322] ================================================================== [ 103.960141][ T5322] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 103.963350][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.967198][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.971444][ T5322] Call Trace: [ 103.972902][ T5322] [ 103.974208][ T5322] vpanic+0x56c/0xa60 [ 103.975946][ T5322] ? __pfx_vpanic+0x10/0x10 [ 103.977954][ T5322] panic+0xc5/0xd0 [ 103.979610][ T5322] ? __pfx_panic+0x10/0x10 [ 103.981610][ T5322] ? preempt_schedule_thunk+0x16/0x40 [ 103.983926][ T5322] ? filp_flush+0x31/0x190 [ 103.985851][ T5322] ? preempt_schedule_thunk+0x16/0x40 [ 103.988146][ T5322] ? filp_flush+0x31/0x190 [ 103.990145][ T5322] check_panic_on_warn+0x89/0xb0 [ 103.992223][ T5322] ? filp_flush+0x31/0x190 [ 103.994077][ T5322] end_report+0x73/0x170 [ 103.995866][ T5322] ? filp_flush+0x31/0x190 [ 103.997793][ T5322] kasan_report+0x128/0x150 [ 103.999571][ T5322] ? filp_flush+0x31/0x190 [ 104.001683][ T5322] kasan_check_range+0x264/0x2c0 [ 104.003774][ T5322] filp_flush+0x31/0x190 [ 104.005652][ T5322] filp_close+0x1d/0x40 [ 104.007454][ T5322] gaudio_cleanup+0x54/0xf0 [ 104.009462][ T5322] f_audio_bind+0x4a0/0x630 [ 104.011211][ T5322] ? __pfx_f_audio_bind+0x10/0x10 [ 104.013087][ T5322] ? rcu_is_watching+0x15/0xb0 [ 104.015184][ T5322] ? usb_gadget_set_selfpowered+0xf5/0x260 [ 104.017699][ T5322] usb_add_function+0x2e1/0x9f0 [ 104.019791][ T5322] ? check_remote_wakeup_config+0x58/0x1c0 [ 104.022156][ T5322] configfs_composite_bind+0xde0/0x1410 [ 104.024356][ T5322] ? __pfx_configfs_composite_bind+0x10/0x10 [ 104.026805][ T5322] gadget_bind_driver+0x2ca/0x9e0 [ 104.028808][ T5322] ? __pfx_gadget_bind_driver+0x10/0x10 [ 104.031062][ T5322] really_probe+0x254/0xae0 [ 104.032919][ T5322] __driver_probe_device+0x1e8/0x360 [ 104.035175][ T5322] driver_probe_device+0x4f/0x240 [ 104.037345][ T5322] __driver_attach+0x339/0x600 [ 104.039324][ T5322] bus_for_each_dev+0x23b/0x2c0 [ 104.041364][ T5322] ? __pfx___driver_attach+0x10/0x10 [ 104.043535][ T5322] ? __pfx_bus_for_each_dev+0x10/0x10 [ 104.045693][ T5322] ? do_raw_spin_unlock+0x4d/0x210 [ 104.047809][ T5322] bus_add_driver+0x345/0x670 [ 104.049858][ T5322] driver_register+0x23a/0x320 [ 104.051772][ T5322] usb_gadget_register_driver_owner+0xf9/0x270 [ 104.054396][ T5322] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 104.056908][ T5322] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10 [ 104.059640][ T5322] configfs_write_iter+0x337/0x430 [ 104.061868][ T5322] vfs_write+0x612/0xba0 [ 104.063763][ T5322] ? __pfx_vfs_write+0x10/0x10 [ 104.065820][ T5322] ? __fget_files+0x2a/0x420 [ 104.067753][ T5322] ksys_write+0x150/0x270 [ 104.069595][ T5322] ? __pfx_ksys_write+0x10/0x10 [ 104.071674][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.074232][ T5322] do_syscall_64+0x174/0x580 [ 104.076203][ T5322] ? trace_irq_disable+0x3b/0x140 [ 104.078375][ T5322] ? clear_bhb_loop+0x70/0xc0 [ 104.080360][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.082793][ T5322] RIP: 0033:0x7ff4cd99e0d9 [ 104.084718][ T5322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 104.092806][ T5322] RSP: 002b:00007ff4ce7fbfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 104.096366][ T5322] RAX: ffffffffffffffda RBX: 00007ff4cdc26180 RCX: 00007ff4cd99e0d9 [ 104.099552][ T5322] RDX: 000000000000000c RSI: 0000200000000400 RDI: 0000000000000003 [ 104.102501][ T5322] RBP: 00007ff4cda35024 R08: 0000000000000000 R09: 0000000000000000 [ 104.105865][ T5322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 104.109159][ T5322] R13: 00007ff4cdc26218 R14: 00007ff4cdc26180 R15: 00007ffff2e359a8 [ 104.112323][ T5322] [ 104.114029][ T5322] Kernel Offset: disabled [ 104.115795][ T5322] Rebooting in 86400 seconds..