program: r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="02000000040000000800000001"], 0xe) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x2, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000110000007b8bf8ff00000000b70800000f0000007b8af0ff00000000bfa10000000000000701000000feffffbfa40000000000000704000000feffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000c500000095"], &(0x7f0000000380)='syzkaller\x00', 0x6, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$eventfd(r1, &(0x7f0000000040)=0x9, 0x8) symlinkat(&(0x7f00000000c0)='./myconfig\x00', r1, &(0x7f0000000100)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00') syz_open_dev$sg(&(0x7f0000000000), 0x7fffffff, 0x0) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000040)='/dev/bsg/2:0:0:0\x00', 0x200000, 0x0) ioctl$SCSI_IOCTL_GET_IDLUN(r2, 0x5382, &(0x7f0000000080)) r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3) mprotect(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3000001) write(r3, &(0x7f0000000280)="34343130302c343830563d4fd7ebdf8264232df842392b2c39363043302c31251fc539f7b95b6a3dd5dd242d136553d9b3d7746d95563ba7c50a9b26627511199799f6f577a472739dce2c7cb4b0dfdd8c7617c64809612561dd253cd3f6d2c3f35ea8f4d0", 0x65) read$FUSE(r3, &(0x7f00000005c0)={0x2020}, 0x2020) [ 104.188103][ T5329] ================================================================== [ 104.191533][ T5329] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0 [ 104.195591][ T5329] Free of addr ffff88803f046918 by task syz.0.0/5329 [ 104.198278][ T5329] [ 104.199297][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 104.199313][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 104.199320][ T5329] Call Trace: [ 104.199327][ T5329] [ 104.199333][ T5329] dump_stack_lvl+0xe8/0x150 [ 104.199350][ T5329] print_address_description+0x55/0x1e0 [ 104.199366][ T5329] print_report+0x58/0x70 [ 104.199378][ T5329] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 104.199393][ T5329] kasan_report_invalid_free+0xea/0x110 [ 104.199409][ T5329] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 104.199425][ T5329] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 104.199439][ T5329] __kasan_slab_pre_free+0x104/0x120 [ 104.199450][ T5329] kfree+0x173/0x640 [ 104.199457][ T5329] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 104.199494][ T5329] f_uac2_opts_c_srate_store+0x225/0x2b0 [ 104.199504][ T5329] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 104.199514][ T5329] ? down_read+0x2be/0x330 [ 104.199529][ T5329] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 104.199542][ T5329] configfs_write_iter+0x337/0x430 [ 104.199559][ T5329] vfs_write+0x612/0xba0 [ 104.199577][ T5329] ? __pfx_vfs_write+0x10/0x10 [ 104.199593][ T5329] ? __fget_files+0x2a/0x420 [ 104.199605][ T5329] ksys_write+0x150/0x270 [ 104.199619][ T5329] ? __pfx_ksys_write+0x10/0x10 [ 104.199634][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.199645][ T5329] do_syscall_64+0x174/0x580 [ 104.199657][ T5329] ? trace_irq_disable+0x3b/0x140 [ 104.199671][ T5329] ? clear_bhb_loop+0x40/0x90 [ 104.199681][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.199687][ T5329] RIP: 0033:0x7ffb0119e0d9 [ 104.199695][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 104.199704][ T5329] RSP: 002b:00007ffafd5f4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 104.199717][ T5329] RAX: ffffffffffffffda RBX: 00007ffb01425fa0 RCX: 00007ffb0119e0d9 [ 104.199726][ T5329] RDX: 0000000000000065 RSI: 0000200000000280 RDI: 0000000000000007 [ 104.199733][ T5329] RBP: 00007ffb01235024 R08: 0000000000000000 R09: 0000000000000000 [ 104.199739][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 104.199745][ T5329] R13: 00007ffb01426038 R14: 00007ffb01425fa0 R15: 00007ffd028c7948 [ 104.199756][ T5329] [ 104.199760][ T5329] [ 104.301970][ T5329] Allocated by task 5329: [ 104.303827][ T5329] kasan_save_track+0x3e/0x80 [ 104.305608][ T5329] __kasan_kmalloc+0x93/0xb0 [ 104.307305][ T5329] __kmalloc_node_track_caller_noprof+0x4c3/0x730 [ 104.309734][ T5329] kstrdup+0x42/0x100 [ 104.311339][ T5329] f_uac2_opts_c_srate_store+0x11f/0x2b0 [ 104.313828][ T5329] configfs_write_iter+0x337/0x430 [ 104.316002][ T5329] vfs_write+0x612/0xba0 [ 104.317723][ T5329] ksys_write+0x150/0x270 [ 104.319654][ T5329] do_syscall_64+0x174/0x580 [ 104.322137][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.324829][ T5329] [ 104.325828][ T5329] The buggy address belongs to the object at ffff88803f046900 [ 104.325828][ T5329] which belongs to the cache kmalloc-128 of size 128 [ 104.331212][ T5329] The buggy address is located 24 bytes inside of [ 104.331212][ T5329] 102-byte region [ffff88803f046900, ffff88803f046966) [ 104.336511][ T5329] [ 104.337505][ T5329] The buggy address belongs to the physical page: [ 104.340077][ T5329] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3f046 [ 104.343524][ T5329] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 104.346397][ T5329] page_type: f5(slab) [ 104.348152][ T5329] raw: 04fff00000000000 ffff88801b041a00 dead000000000100 dead000000000122 [ 104.351706][ T5329] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 104.355394][ T5329] page dumped because: kasan: bad access detected [ 104.357912][ T5329] page_owner tracks the page as allocated [ 104.360120][ T5329] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1, tgid 1 (swapper/0), ts 26612857441, free_ts 26470781161 [ 104.367629][ T5329] post_alloc_hook+0x1f9/0x250 [ 104.369627][ T5329] get_page_from_freelist+0x21fa/0x2270 [ 104.371939][ T5329] __alloc_frozen_pages_noprof+0x18d/0x380 [ 104.374396][ T5329] allocate_slab+0x79/0x5e0 [ 104.376309][ T5329] ___slab_alloc+0x16a/0x950 [ 104.378317][ T5329] __kmalloc_cache_node_noprof+0x1d5/0x630 [ 104.380790][ T5329] do_kmem_cache_create+0x726/0x970 [ 104.382948][ T5329] __kmem_cache_create_args+0x307/0x440 [ 104.385238][ T5329] bch_request_init+0xad/0x110 [ 104.387229][ T5329] bcache_init+0x25b/0x2c0 [ 104.389078][ T5329] do_one_initcall+0x250/0x870 [ 104.391009][ T5329] do_initcall_level+0x10a/0x1a0 [ 104.393066][ T5329] do_initcalls+0x59/0xa0 [ 104.394802][ T5329] kernel_init_freeable+0x29d/0x3e0 [ 104.397044][ T5329] kernel_init+0x1d/0x1d0 [ 104.398806][ T5329] ret_from_fork+0x514/0xb70 [ 104.400595][ T5329] page last free pid 1 tgid 1 stack trace: [ 104.403073][ T5329] free_pages_prepare+0x960/0xa60 [ 104.405240][ T5329] __free_contig_range_common+0x174/0x340 [ 104.407682][ T5329] free_pages_bulk+0x48/0x120 [ 104.409660][ T5329] vfree+0x224/0x4a0 [ 104.411355][ T5329] tpg_free+0x176/0x420 [ 104.413161][ T5329] vivid_dev_release+0xc5/0x120 [ 104.415284][ T5329] v4l2_device_put+0x81/0xd0 [ 104.417223][ T5329] vivid_probe+0x4977/0x70c0 [ 104.419055][ T5329] platform_probe+0xf9/0x190 [ 104.421037][ T5329] really_probe+0x254/0xae0 [ 104.422836][ T5329] __driver_probe_device+0x1e8/0x360 [ 104.424863][ T5329] driver_probe_device+0x4f/0x240 [ 104.426882][ T5329] __driver_attach+0x339/0x600 [ 104.428746][ T5329] bus_for_each_dev+0x23b/0x2c0 [ 104.430819][ T5329] bus_add_driver+0x345/0x670 [ 104.432856][ T5329] driver_register+0x23a/0x320 [ 104.434721][ T5329] [ 104.435725][ T5329] Memory state around the buggy address: [ 104.438248][ T5329] ffff88803f046800: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc [ 104.441792][ T5329] ffff88803f046880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 104.445005][ T5329] >ffff88803f046900: 00 00 00 00 00 00 00 00 00 00 00 00 06 fc fc fc [ 104.448212][ T5329] ^ [ 104.450041][ T5329] ffff88803f046980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 104.453171][ T5329] ffff88803f046a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc [ 104.456457][ T5329] ================================================================== [ 104.460880][ T5329] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 104.465022][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 104.468712][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 104.473099][ T5329] Call Trace: [ 104.474633][ T5329] [ 104.475952][ T5329] vpanic+0x56c/0xa60 [ 104.477681][ T5329] ? __pfx_vpanic+0x10/0x10 [ 104.480040][ T5329] ? __pfx___schedule+0x10/0x10 [ 104.482344][ T5329] panic+0xc5/0xd0 [ 104.484092][ T5329] ? __pfx_panic+0x10/0x10 [ 104.486022][ T5329] ? preempt_schedule_common+0x82/0xd0 [ 104.488408][ T5329] check_panic_on_warn+0x89/0xb0 [ 104.490571][ T5329] end_report+0x73/0x170 [ 104.492439][ T5329] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 104.494898][ T5329] kasan_report_invalid_free+0xfa/0x110 [ 104.497170][ T5329] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 104.499690][ T5329] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 104.502301][ T5329] __kasan_slab_pre_free+0x104/0x120 [ 104.504594][ T5329] kfree+0x173/0x640 [ 104.506285][ T5329] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 104.508895][ T5329] f_uac2_opts_c_srate_store+0x225/0x2b0 [ 104.512592][ T5329] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 104.515190][ T5329] ? down_read+0x2be/0x330 [ 104.517091][ T5329] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 104.519679][ T5329] configfs_write_iter+0x337/0x430 [ 104.521891][ T5329] vfs_write+0x612/0xba0 [ 104.523792][ T5329] ? __pfx_vfs_write+0x10/0x10 [ 104.525842][ T5329] ? __fget_files+0x2a/0x420 [ 104.527761][ T5329] ksys_write+0x150/0x270 [ 104.529606][ T5329] ? __pfx_ksys_write+0x10/0x10 [ 104.531749][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.534361][ T5329] do_syscall_64+0x174/0x580 [ 104.536356][ T5329] ? trace_irq_disable+0x3b/0x140 [ 104.538444][ T5329] ? clear_bhb_loop+0x40/0x90 [ 104.540441][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.542947][ T5329] RIP: 0033:0x7ffb0119e0d9 [ 104.544945][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 104.553018][ T5329] RSP: 002b:00007ffafd5f4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 104.556445][ T5329] RAX: ffffffffffffffda RBX: 00007ffb01425fa0 RCX: 00007ffb0119e0d9 [ 104.559735][ T5329] RDX: 0000000000000065 RSI: 0000200000000280 RDI: 0000000000000007 [ 104.562928][ T5329] RBP: 00007ffb01235024 R08: 0000000000000000 R09: 0000000000000000 [ 104.566191][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 104.569399][ T5329] R13: 00007ffb01426038 R14: 00007ffb01425fa0 R15: 00007ffd028c7948 [ 104.572626][ T5329] [ 104.574295][ T5329] Kernel Offset: disabled [ 104.576159][ T5329] Rebooting in 86400 seconds..