program: mkdir(&(0x7f0000000000)='config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000400)='config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='config/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='44100,48000,88200,96000,176400,192000\x00', 0x25) r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0) write(r1, &(0x7f0000000900)="34343130302c34383030302c38383230302c3937662b3389f5791c363030302c313736343030", 0x26) syz_mount_image$ext4(&(0x7f0000000400)='ext4\x00', &(0x7f0000000440)='./file0\x00', 0x0, &(0x7f0000000480), 0x1, 0x3d0, &(0x7f00000004c0)="$eJzs3M1uG0UcAPD/br5I+mEjcUCFgyUQBAFxHQhQhEThyscFeAArSUuF21SNkWjJoSBOnDggbhz6Ahx4gKpCSEi8Ai+AKlUozQFuQWvvOm4cp7Fix2r6+0mjndkdZ/bv3axm1rsTwGOrEhHnI2IiIhYjopSvT/MUN9spq3d/c2N5a3NjOYnt7U/+SSLJ1xV/K8mXJ/LCfBqRfhfxzM3edtev3/ii3misXsvL1eblq9X16zdevXS5fnH14uqV2pvnarWlxbdqrw8t1p+ef+ncxPvnz/z8V+nO0vT0bLa/J/Nt3XEMSyUqne9kt6VhNzZm0+PeAQAADiTN+/6Trf5/KSZaubZSVDfGunMAAADAUGy/my8BAACAYywx9gcAAIBjrngO4P7mxnKRxvg4wpG7915ElHfebd7qxD8ZT+R1pkb4fmslIq6+kJSyFCN6DxkAoNudrP9zdq/+XxpPd9WbiWj1h2aH3H5lV7m3/5PeHXKTD8j6f+9ExFZP/y8tqpQn8tKpVldxKrlwqbF6NiJOR8R8TM1k5do+bXzw7y8f99uWxf97cup0kbL2s+VOjfTu5MyDn1mpN+uHibnbvW8izkzuFX/S6f8mETF3iDYmvr71dr9tD49/tLZvRby45/Hfmbkn2X9+omrrfKgWZ0Wv/7799aN+7Y87/uz4z+0ffznpnq9pffA2bn/+57P9tnWPfwY5/6eTT1v5Ylz2Vb3ZvFaLmE4+7F2/uPPZolzUz+Kff27v///i+pfkc1qdzK8Bg/r+h99eOUj8WcraL8aCRyGLf2Wg4z945o3bf3zWr/2Hx58d//YcYPP5moNc/w66g4f57gAAAOBRkbbuayTpQiefpgsL7fsdT8Vc2lhbb758Ye3LKyvt+x/lmEqLO12lrvuhtfbP6J3y4q7yaxHxZET8WJptlReW1xor4w4eAAAAHhMn+oz/M38f2VMIAAAAwMiVx70DAAAAwMgZ/wMAAMCxdph5/WRkZI5rZtxXJgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEfb/wEAAP//Wt22ag==") acct(&(0x7f00000000c0)='./file0/file0\x00') symlink(&(0x7f0000000a00)='config/usb_gadget/g1/functions/uac2.usb0\x00', &(0x7f0000000b00)='config/usb_gadget/g1/configs/c.1/uac2.usb0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r2, &(0x7f0000000d00)='dummy_udc.0\x00', 0xb) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000002c0)={'ip_vti0\x00', &(0x7f0000000240)={'tunl0\x00', 0x0, 0x40, 0x700, 0x9, 0x9, {{0xf, 0x4, 0x1, 0x6, 0x3c, 0x65, 0x0, 0x6, 0x6, 0x0, @broadcast, @empty, {[@ssrr={0x89, 0x23, 0xf7, [@remote, @initdev={0xac, 0x1e, 0x1, 0x0}, @remote, @dev={0xac, 0x14, 0x14, 0xf}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @private=0xa010100, @multicast2]}, @generic={0x7, 0x5, "4bd678"}]}}}}}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, [@ldst={0x1, 0x3, 0x3, 0x2, 0x1}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', r3, 0x24}, 0x94) [ 86.717317][ T5277] Bluetooth: hci0: command tx timeout [ 86.822908][ T5313] ================================================================== [ 86.826402][ T5313] BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x225/0x2b0 [ 86.829786][ T5313] Free of addr ffff88800e7322a0 by task syz.0.0/5313 [ 86.832734][ T5313] [ 86.833853][ T5313] CPU: 0 UID: 0 PID: 5313 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 86.833871][ T5313] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.833879][ T5313] Call Trace: [ 86.833886][ T5313] [ 86.833892][ T5313] dump_stack_lvl+0xe8/0x150 [ 86.833914][ T5313] print_address_description+0x55/0x1e0 [ 86.833933][ T5313] print_report+0x58/0x70 [ 86.833949][ T5313] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 86.833966][ T5313] kasan_report_invalid_free+0xea/0x110 [ 86.833982][ T5313] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 86.833997][ T5313] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 86.834011][ T5313] __kasan_slab_pre_free+0x104/0x120 [ 86.834026][ T5313] kfree+0x173/0x640 [ 86.834045][ T5313] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 86.834060][ T5313] f_uac2_opts_p_srate_store+0x225/0x2b0 [ 86.834075][ T5313] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 86.834088][ T5313] ? down_read+0x2be/0x330 [ 86.834103][ T5313] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 86.834117][ T5313] configfs_write_iter+0x337/0x430 [ 86.834139][ T5313] vfs_write+0x612/0xba0 [ 86.834158][ T5313] ? __pfx_vfs_write+0x10/0x10 [ 86.834173][ T5313] ? __fget_files+0x2a/0x420 [ 86.834188][ T5313] ksys_write+0x150/0x270 [ 86.834204][ T5313] ? __pfx_ksys_write+0x10/0x10 [ 86.834221][ T5313] do_syscall_64+0x166/0x520 [ 86.834234][ T5313] ? trace_irq_disable+0x3b/0x140 [ 86.834251][ T5313] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.834265][ T5313] ? clear_bhb_loop+0x70/0xc0 [ 86.834277][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.834289][ T5313] RIP: 0033:0x7f60d319e0d9 [ 86.834301][ T5313] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 86.834311][ T5313] RSP: 002b:00007f60d404afe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 86.834326][ T5313] RAX: ffffffffffffffda RBX: 00007f60d3425fa0 RCX: 00007f60d319e0d9 [ 86.834335][ T5313] RDX: 0000000000000026 RSI: 0000200000000900 RDI: 0000000000000004 [ 86.834350][ T5313] RBP: 00007f60d3235024 R08: 0000000000000000 R09: 0000000000000000 [ 86.834358][ T5313] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 86.834365][ T5313] R13: 00007f60d3426038 R14: 00007f60d3425fa0 R15: 00007fff7563daf8 [ 86.834379][ T5313] [ 86.834384][ T5313] [ 86.931679][ T5313] Allocated by task 5313: [ 86.933489][ T5313] kasan_save_track+0x3e/0x80 [ 86.935346][ T5313] __kasan_kmalloc+0x93/0xb0 [ 86.937311][ T5313] __kmalloc_node_track_caller_noprof+0x4c7/0x740 [ 86.940015][ T5313] kstrdup+0x42/0x100 [ 86.941752][ T5313] f_uac2_opts_p_srate_store+0x11f/0x2b0 [ 86.943903][ T5313] configfs_write_iter+0x337/0x430 [ 86.945907][ T5313] vfs_write+0x612/0xba0 [ 86.947598][ T5313] ksys_write+0x150/0x270 [ 86.949442][ T5313] do_syscall_64+0x166/0x520 [ 86.951416][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.953993][ T5313] [ 86.955084][ T5313] The buggy address belongs to the object at ffff88800e732280 [ 86.955084][ T5313] which belongs to the cache kmalloc-64 of size 64 [ 86.960840][ T5313] The buggy address is located 32 bytes inside of [ 86.960840][ T5313] 39-byte region [ffff88800e732280, ffff88800e7322a7) [ 86.966198][ T5313] [ 86.967199][ T5313] The buggy address belongs to the physical page: [ 86.969934][ T5313] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xe732 [ 86.973777][ T5313] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 86.976656][ T5313] page_type: f5(slab) [ 86.978350][ T5313] raw: 00fff00000000000 ffff88801b0418c0 dead000000000100 dead000000000122 [ 86.981903][ T5313] raw: 0000000000000000 0000000800200020 00000000f5000000 0000000000000000 [ 86.985535][ T5313] page dumped because: kasan: bad access detected [ 86.988271][ T5313] page_owner tracks the page as allocated [ 86.990665][ T5313] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 5276, tgid 5276 (syz-executor), ts 84868960079, free_ts 84859100822 [ 86.998817][ T5313] post_alloc_hook+0x1f9/0x250 [ 87.000931][ T5313] get_page_from_freelist+0x21fe/0x2270 [ 87.003317][ T5313] __alloc_pages_slowpath+0x383/0xcd0 [ 87.005622][ T5313] __alloc_frozen_pages_noprof+0x31f/0x380 [ 87.008049][ T5313] allocate_slab+0x79/0x5e0 [ 87.009889][ T5313] ___slab_alloc+0x16a/0x950 [ 87.011882][ T5313] __kmalloc_flags_noprof+0x349/0x810 [ 87.014270][ T5313] alloc_slab_obj_exts+0x4d/0x170 [ 87.016468][ T5313] __memcg_slab_post_alloc_hook+0x5d4/0xf10 [ 87.019001][ T5313] __kvmalloc_node_noprof+0x620/0x870 [ 87.021269][ T5313] xt_alloc_table_info+0x40/0xb0 [ 87.023247][ T5313] ip6t_register_table+0xcd/0x320 [ 87.025438][ T5313] ip6table_nat_table_init+0x42/0x300 [ 87.027758][ T5313] xt_find_table_lock+0x311/0x400 [ 87.029923][ T5313] xt_request_find_table_lock+0x26/0x100 [ 87.032382][ T5313] do_ip6t_get_ctl+0x77b/0x12f0 [ 87.034511][ T5313] page last free pid 5276 tgid 5276 stack trace: [ 87.037309][ T5313] free_pages_prepare+0x960/0xa60 [ 87.039526][ T5313] __free_contig_range_common+0x174/0x340 [ 87.041847][ T5313] free_pages_bulk+0x48/0x120 [ 87.043828][ T5313] vfree+0x226/0x4a0 [ 87.045487][ T5313] do_ip6t_get_ctl+0xf3e/0x12f0 [ 87.047567][ T5313] nf_getsockopt+0x26e/0x290 [ 87.049566][ T5313] ipv6_getsockopt+0x213/0x2c0 [ 87.051555][ T5313] do_sock_getsockopt+0x569/0xa70 [ 87.053532][ T5313] __x64_sys_getsockopt+0x1a4/0x240 [ 87.055624][ T5313] do_syscall_64+0x166/0x520 [ 87.057559][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.060238][ T5313] [ 87.061320][ T5313] Memory state around the buggy address: [ 87.063670][ T5313] ffff88800e732180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 87.066929][ T5313] ffff88800e732200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 87.070114][ T5313] >ffff88800e732280: 00 00 00 00 07 fc fc fc fc fc fc fc fc fc fc fc [ 87.073491][ T5313] ^ [ 87.075459][ T5313] ffff88800e732300: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 87.078830][ T5313] ffff88800e732380: 00 00 00 00 06 fc fc fc fc fc fc fc fc fc fc fc [ 87.082258][ T5313] ================================================================== [ 87.122254][ T5314] loop0: detected capacity change from 0 to 512 [ 87.195207][ T5314] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 87.217011][ T5313] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 87.220111][ T5313] CPU: 0 UID: 0 PID: 5313 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 87.223701][ T5313] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 87.227649][ T5313] Call Trace: [ 87.229033][ T5313] [ 87.230258][ T5313] vpanic+0x56d/0xa60 [ 87.231912][ T5313] ? __pfx_vpanic+0x10/0x10 [ 87.233613][ T5313] ? __pfx___schedule+0x10/0x10 [ 87.235627][ T5313] panic+0xc5/0xd0 [ 87.237216][ T5313] ? __pfx_panic+0x10/0x10 [ 87.239106][ T5313] ? preempt_schedule_common+0x7f/0xd0 [ 87.241137][ T5313] check_panic_on_warn+0x89/0xb0 [ 87.243090][ T5313] end_report+0x73/0x170 [ 87.244746][ T5313] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 87.247002][ T5313] kasan_report_invalid_free+0xfa/0x110 [ 87.249180][ T5313] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 87.251462][ T5313] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 87.253749][ T5313] __kasan_slab_pre_free+0x104/0x120 [ 87.255741][ T5313] kfree+0x173/0x640 [ 87.257269][ T5313] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 87.259551][ T5313] f_uac2_opts_p_srate_store+0x225/0x2b0 [ 87.261746][ T5313] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 87.264206][ T5313] ? down_read+0x2be/0x330 [ 87.265961][ T5313] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 87.268346][ T5313] configfs_write_iter+0x337/0x430 [ 87.270373][ T5313] vfs_write+0x612/0xba0 [ 87.272071][ T5313] ? __pfx_vfs_write+0x10/0x10 [ 87.274032][ T5313] ? __fget_files+0x2a/0x420 [ 87.275766][ T5313] ksys_write+0x150/0x270 [ 87.277538][ T5313] ? __pfx_ksys_write+0x10/0x10 [ 87.279488][ T5313] do_syscall_64+0x166/0x520 [ 87.281341][ T5313] ? trace_irq_disable+0x3b/0x140 [ 87.283375][ T5313] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.285907][ T5313] ? clear_bhb_loop+0x70/0xc0 [ 87.287777][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.290068][ T5313] RIP: 0033:0x7f60d319e0d9 [ 87.291955][ T5313] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 87.299821][ T5313] RSP: 002b:00007f60d404afe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 87.303394][ T5313] RAX: ffffffffffffffda RBX: 00007f60d3425fa0 RCX: 00007f60d319e0d9 [ 87.306732][ T5313] RDX: 0000000000000026 RSI: 0000200000000900 RDI: 0000000000000004 [ 87.310061][ T5313] RBP: 00007f60d3235024 R08: 0000000000000000 R09: 0000000000000000 [ 87.313775][ T5313] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 87.316820][ T5313] R13: 00007f60d3426038 R14: 00007f60d3425fa0 R15: 00007fff7563daf8 [ 87.319787][ T5313] [ 87.321381][ T5313] Kernel Offset: disabled [ 87.323247][ T5313] Rebooting in 86400 seconds..