program: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff) r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001500010000000000000000000200000081487b0eb481ba743acf4483a1e9203c250c46c0a35c7e18a565752ad815eb7f"], 0x14}}, 0x0) r1 = io_uring_setup(0xda7, &(0x7f00000000c0)={0x0, 0x0, 0x1000, 0x101, 0xfefffffd}) io_uring_register$IORING_REGISTER_RESIZE_RINGS(r1, 0x21, &(0x7f0000000340)={0x0, 0xebb9, 0x0, 0xb, 0xd5}, 0x1) mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0) write(r2, &(0x7f0000000440)='44100,48000,88200,96', 0x14) ioctl$SG_GET_KEEP_ORPHAN(r2, 0x2288, &(0x7f0000000500)) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)={0x60, r4, 0x1, 0x70bd2d, 0x25dfdbfe, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_PEERS={0x38, 0x8, 0x0, 0x1, [{0x34, 0x0, 0x0, 0x1, [@WGPEER_A_ALLOWEDIPS={0xc, 0x9, 0x0, 0x1, [{0x4}, {0x4}]}, @WGPEER_A_PUBLIC_KEY={0x24}]}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x2004c000}, 0x80) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) r7 = gettid() syz_open_procfs(r7, &(0x7f0000000040)='smaps_rollup\x00') exit(0xffff) syz_open_procfs(r7, &(0x7f0000000880)='net/protocols\x00') sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r6, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4c840) sendmsg$nl_route_sched(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=@newtfilter={0x40, 0x2c, 0x800, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0xb, 0xfff3}, {0x0, 0x4}, {0xd, 0x10}}, [@filter_kind_options=@f_basic={{0xa}, {0x10, 0x2, [@TCA_BASIC_EMATCHES={0xc, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2086}}]}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) sendmsg$WG_CMD_SET_DEVICE(r2, &(0x7f00000004c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000800}, 0xc, &(0x7f0000000480)={&(0x7f0000000580)=ANY=[@ANYBLOB="88000000", @ANYRES16=r4, @ANYBLOB="020027bd7000fbdbdf2501000000080087000300000008000100a4933dd7b735667e931214c18cece5a2ad8675e1453a9392cb2eea1a9ad1f63d7d17d553748a2375eda36b50eab183a5b00cc7eb3b650f7681335a4c69875bde0b6791f542891abd34363f7442f07e08326354da58c69e7ca6aec8977e7f83dbdf2bd756540d6130be171fed91226d14e87a747dbd6e98b5871e234508312c", @ANYRES32=r6, @ANYBLOB="140002007767310000000000000000000000000024000300a0cb879a47f5bc644c0e693fa6d031c74a1553b6e901b9ff2f518c78042fb54224000300a05ca84f6c9c8e3853e2fd7a70ae0fb20fa152600cb00845174f08076f8d78430800050000000000"], 0x88}, 0x1, 0x0, 0x0, 0x10}, 0x0) r8 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000200)=ANY=[@ANYBLOB="180100002000010000000000fcdbdf250501f2800f0018007d3a2e9c5bc85c23277d000014000200fc02000000000000000000000000000050bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c22dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c0400e900000000"], 0x118}], 0x1, 0x0, 0x0, 0x20008001}, 0x0) r9 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs_dir/buffer_size_kb\x00', 0x1, 0x0) ioctl$MEDIA_IOC_ENUM_ENTITIES(r9, 0xc1007c01, &(0x7f0000000780)) write$binfmt_misc(r2, &(0x7f00000006c0)="d7a5fa8cd1a0836cd83144a108c3dcebd88cc26a830702c746ab9c916ee6b2ac2cd9c8539d935f1d44e70fde79b09da0d092d1043c177f5062035a129f710e5cbba34d55f6440b8b532aa39272ba565863ee3c1be59cd22b18b8c25614c14ad3c856933ef4474b45c0526053a2711bdbb56d10cd7fa49dea79a1f162cfef8bf88d26d5eb3124354dcad7944452396c897249b137d489a970afb6ac7eecdc76b241c0e61f44b2fabb2b87fb762f73", 0xae) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') [ 101.623768][ T5292] Bluetooth: hci0: command tx timeout [ 101.794854][ T5335] netlink: 224 bytes leftover after parsing attributes in process `syz.0.0'. [ 101.799585][ T5335] ================================================================== [ 101.803008][ T5335] BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x225/0x2b0 [ 101.806329][ T5335] Free of addr ffff8880136a2e21 by task syz.0.0/5335 [ 101.809113][ T5335] [ 101.810016][ T5335] CPU: 0 UID: 0 PID: 5335 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 101.810029][ T5335] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 101.810034][ T5335] Call Trace: [ 101.810040][ T5335] [ 101.810044][ T5335] dump_stack_lvl+0xe8/0x150 [ 101.810062][ T5335] print_address_description+0x55/0x1e0 [ 101.810077][ T5335] print_report+0x58/0x70 [ 101.810088][ T5335] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 101.810099][ T5335] kasan_report_invalid_free+0xea/0x110 [ 101.810112][ T5335] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 101.810123][ T5335] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 101.810134][ T5335] __kasan_slab_pre_free+0x104/0x120 [ 101.810146][ T5335] kfree+0x173/0x640 [ 101.810155][ T5335] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 101.810168][ T5335] f_uac2_opts_p_srate_store+0x225/0x2b0 [ 101.810178][ T5335] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 101.810189][ T5335] ? down_read+0x2be/0x330 [ 101.810199][ T5335] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 101.810209][ T5335] configfs_write_iter+0x337/0x430 [ 101.810221][ T5335] vfs_write+0x612/0xba0 [ 101.810234][ T5335] ? __pfx_vfs_write+0x10/0x10 [ 101.810246][ T5335] ? __fget_files+0x2a/0x420 [ 101.810260][ T5335] ksys_write+0x150/0x270 [ 101.810272][ T5335] ? __pfx_ksys_write+0x10/0x10 [ 101.810286][ T5335] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.810296][ T5335] do_syscall_64+0x174/0x580 [ 101.810306][ T5335] ? trace_irq_disable+0x3b/0x140 [ 101.810317][ T5335] ? clear_bhb_loop+0x40/0x90 [ 101.810326][ T5335] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.810335][ T5335] RIP: 0033:0x7f5528f9e019 [ 101.810344][ T5335] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 101.810351][ T5335] RSP: 002b:00007f5529de4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 101.810361][ T5335] RAX: ffffffffffffffda RBX: 00007f5529226090 RCX: 00007f5528f9e019 [ 101.810368][ T5335] RDX: 00000000000000ae RSI: 00002000000006c0 RDI: 0000000000000005 [ 101.810373][ T5335] RBP: 00007f552903500c R08: 0000000000000000 R09: 0000000000000000 [ 101.810378][ T5335] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 101.810383][ T5335] R13: 00007f5529226128 R14: 00007f5529226090 R15: 00007ffd9152de88 [ 101.810392][ T5335] [ 101.810395][ T5335] [ 101.907864][ T5335] Allocated by task 5335: [ 101.909705][ T5335] kasan_save_track+0x3e/0x80 [ 101.911801][ T5335] __kasan_kmalloc+0x93/0xb0 [ 101.913773][ T5335] __kmalloc_node_track_caller_noprof+0x4c3/0x730 [ 101.916509][ T5335] kstrdup+0x42/0x100 [ 101.918323][ T5335] f_uac2_opts_p_srate_store+0x11f/0x2b0 [ 101.920808][ T5335] configfs_write_iter+0x337/0x430 [ 101.923013][ T5335] vfs_write+0x612/0xba0 [ 101.924893][ T5335] ksys_write+0x150/0x270 [ 101.926823][ T5335] do_syscall_64+0x174/0x580 [ 101.928812][ T5335] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.931263][ T5335] [ 101.932274][ T5335] The buggy address belongs to the object at ffff8880136a2e00 [ 101.932274][ T5335] which belongs to the cache kmalloc-192 of size 192 [ 101.938104][ T5335] The buggy address is located 33 bytes inside of [ 101.938104][ T5335] 175-byte region [ffff8880136a2e00, ffff8880136a2eaf) [ 101.943496][ T5335] [ 101.944523][ T5335] The buggy address belongs to the physical page: [ 101.947248][ T5335] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x136a2 [ 101.950936][ T5335] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 101.953918][ T5335] page_type: f5(slab) [ 101.955635][ T5335] raw: 00fff00000000000 ffff88801b0413c0 dead000000000100 dead000000000122 [ 101.959309][ T5335] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 101.962922][ T5335] page dumped because: kasan: bad access detected [ 101.965673][ T5335] page_owner tracks the page as allocated [ 101.968155][ T5335] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5291, tgid 5291 (syz-executor), ts 99512168246, free_ts 99496511151 [ 101.976881][ T5335] post_alloc_hook+0x1f9/0x250 [ 101.979000][ T5335] get_page_from_freelist+0x21fa/0x2270 [ 101.981446][ T5335] __alloc_frozen_pages_noprof+0x18d/0x380 [ 101.984022][ T5335] allocate_slab+0x79/0x5e0 [ 101.986026][ T5335] refill_objects+0x2d5/0x350 [ 101.988065][ T5335] __pcs_replace_empty_main+0x2bf/0x6b0 [ 101.990431][ T5335] __kvmalloc_node_noprof+0x66b/0x860 [ 101.992798][ T5335] __rhashtable_init_noprof+0x545/0xaf0 [ 101.995233][ T5335] __rhltable_init_noprof+0x26/0x70 [ 101.997565][ T5335] sta_info_init+0x2f/0x130 [ 101.999553][ T5335] ieee80211_alloc_hw_nm+0x808/0x1ec0 [ 102.002018][ T5335] mac80211_hwsim_new_radio+0x1ea/0x5680 [ 102.004443][ T5335] hwsim_new_radio_nl+0xd8b/0xf90 [ 102.006745][ T5335] genl_family_rcv_msg_doit+0x233/0x340 [ 102.009182][ T5335] genl_rcv_msg+0x614/0x7a0 [ 102.011045][ T5335] netlink_rcv_skb+0x226/0x4a0 [ 102.013018][ T5335] page last free pid 75 tgid 75 stack trace: [ 102.015411][ T5335] free_unref_folios+0xd84/0x14a0 [ 102.017463][ T5335] shrink_folio_list+0x4b16/0x5330 [ 102.019554][ T5335] evict_folios+0x3821/0x49e0 [ 102.021490][ T5335] try_to_shrink_lruvec+0xb4f/0xed0 [ 102.023686][ T5335] shrink_one+0x233/0x730 [ 102.025582][ T5335] shrink_node+0x3303/0x3b60 [ 102.027623][ T5335] kswapd+0x17b6/0x31c0 [ 102.029414][ T5335] kthread+0x388/0x470 [ 102.031226][ T5335] ret_from_fork+0x514/0xb70 [ 102.033299][ T5335] ret_from_fork_asm+0x1a/0x30 [ 102.035319][ T5335] [ 102.036416][ T5335] Memory state around the buggy address: [ 102.038838][ T5335] ffff8880136a2d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 102.042148][ T5335] ffff8880136a2d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 102.045634][ T5335] >ffff8880136a2e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 102.049183][ T5335] ^ [ 102.051338][ T5335] ffff8880136a2e80: 00 00 00 00 00 07 fc fc fc fc fc fc fc fc fc fc [ 102.054649][ T5335] ffff8880136a2f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 102.058222][ T5335] ================================================================== [ 102.079690][ T5335] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 102.082799][ T5335] CPU: 0 UID: 0 PID: 5335 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 102.086581][ T5335] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.090974][ T5335] Call Trace: [ 102.092513][ T5335] [ 102.093851][ T5335] vpanic+0x56c/0xa60 [ 102.095598][ T5335] ? __pfx_vpanic+0x10/0x10 [ 102.097568][ T5335] ? __pfx___schedule+0x10/0x10 [ 102.099596][ T5335] panic+0xc5/0xd0 [ 102.101181][ T5335] ? __pfx_panic+0x10/0x10 [ 102.103049][ T5335] ? preempt_schedule_common+0x82/0xd0 [ 102.105319][ T5335] check_panic_on_warn+0x89/0xb0 [ 102.107428][ T5335] end_report+0x73/0x170 [ 102.109300][ T5335] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 102.111778][ T5335] kasan_report_invalid_free+0xfa/0x110 [ 102.114105][ T5335] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 102.116557][ T5335] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 102.119032][ T5335] __kasan_slab_pre_free+0x104/0x120 [ 102.121350][ T5335] kfree+0x173/0x640 [ 102.123058][ T5335] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 102.125504][ T5335] f_uac2_opts_p_srate_store+0x225/0x2b0 [ 102.127976][ T5335] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 102.130491][ T5335] ? down_read+0x2be/0x330 [ 102.132292][ T5335] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 102.134847][ T5335] configfs_write_iter+0x337/0x430 [ 102.137150][ T5335] vfs_write+0x612/0xba0 [ 102.138771][ T5335] ? __pfx_vfs_write+0x10/0x10 [ 102.140789][ T5335] ? __fget_files+0x2a/0x420 [ 102.142820][ T5335] ksys_write+0x150/0x270 [ 102.144751][ T5335] ? __pfx_ksys_write+0x10/0x10 [ 102.146874][ T5335] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.149564][ T5335] do_syscall_64+0x174/0x580 [ 102.151527][ T5335] ? trace_irq_disable+0x3b/0x140 [ 102.154050][ T5335] ? clear_bhb_loop+0x40/0x90 [ 102.156561][ T5335] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.158904][ T5335] RIP: 0033:0x7f5528f9e019 [ 102.160733][ T5335] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 102.168592][ T5335] RSP: 002b:00007f5529de4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 102.171944][ T5335] RAX: ffffffffffffffda RBX: 00007f5529226090 RCX: 00007f5528f9e019 [ 102.175131][ T5335] RDX: 00000000000000ae RSI: 00002000000006c0 RDI: 0000000000000005 [ 102.178415][ T5335] RBP: 00007f552903500c R08: 0000000000000000 R09: 0000000000000000 [ 102.181647][ T5335] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.184816][ T5335] R13: 00007f5529226128 R14: 00007f5529226090 R15: 00007ffd9152de88 [ 102.187989][ T5335] [ 102.189543][ T5335] Kernel Offset: disabled [ 102.191291][ T5335] Rebooting in 86400 seconds..