program: mkdir(&(0x7f0000000000)='config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='config/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0) write(r0, &(0x7f0000000340)="34343130307ad72b04b46453f0e281d02c34383030302c38383230302c39363030302c3137363430302c31049cbc02ecbb730105dd2aff6d9eb242e7408f5d91f64bb92ed61abad713417fa485c88ef1aff7c0f5b51be945cabbc2686138339d173a59309f362ce3e96a41d604edc0dfb26c931816ff92b0a259b380a3173d5e95f1758c802da167d55d6ea13453d842ca05987b9d7afad244a8c088d56694fb9af3305426775af0f52a9b8a89ac31cda8428e14a076e8fefa2f929b707434ae95f6c1ff0946f44d7a09376108f8440187f983b45cf90468b79ce3d4099e17b2e79ad21968962f69d680013e133dedef5299e89de180add6611ec7bc29207146a513963fe23c9eccbe3a033bf25d455d643717c5d03f8c2a5e0fa3884d92e1c2e5dfb3019ddaa97c7b4dedd9105573f79c93f57d566d71255471ba41c1ff1517c2baf9bdf0e634ed26a1a5273e48f68c2e6d52d8", 0x1f) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000240)=@mgmt_frame=@beacon={{{}, {}, @broadcast, @broadcast}, 0x0, @random=0x9, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @void, @void, @void, @void, @val={0x5, 0x3, {0x80, 0x1a, 0x4}}, @val={0x25, 0x3, {0x1, 0x6c}}, @void, @val={0x3c, 0x4, {0x1, 0x3, 0x1, 0xf3}}, @val={0x2d, 0x1a, {0xc, 0x0, 0x3, 0x0, {0xe920, 0x4, 0x0, 0x3, 0x0, 0x0, 0x1, 0x0, 0x1}, 0x0, 0x7ff, 0x8}}, @void, @val={0x71, 0x7, {0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x1, 0x1, 0x4, 0x28}}, @void}, 0x61) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r2, 0x5, 0xfffffffe, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x4004800) sendmsg$NL80211_CMD_CONNECT(r1, &(0x7f00000001c0)={0x0, 0x3e7, &(0x7f0000000200)={&(0x7f0000000a00)={0x28, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}]}, 0x28}}, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') [ 95.090931][ T4641] Bluetooth: hci0: command tx timeout [ 95.239867][ T5314] ================================================================== [ 95.243301][ T5314] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0 [ 95.246848][ T5314] Free of addr ffff88804079d211 by task syz.0.0/5314 [ 95.249665][ T5314] [ 95.250742][ T5314] CPU: 0 UID: 0 PID: 5314 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.250759][ T5314] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.250768][ T5314] Call Trace: [ 95.250775][ T5314] [ 95.250780][ T5314] dump_stack_lvl+0xe8/0x150 [ 95.250801][ T5314] print_address_description+0x55/0x1e0 [ 95.250844][ T5314] print_report+0x58/0x70 [ 95.250858][ T5314] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 95.250873][ T5314] kasan_report_invalid_free+0xea/0x110 [ 95.250894][ T5314] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 95.250909][ T5314] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 95.250920][ T5314] __kasan_slab_pre_free+0x104/0x120 [ 95.250930][ T5314] kfree+0x173/0x640 [ 95.250937][ T5314] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 95.250945][ T5314] f_uac2_opts_c_srate_store+0x225/0x2b0 [ 95.250955][ T5314] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 95.250964][ T5314] ? down_read+0x2be/0x330 [ 95.250973][ T5314] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 95.250981][ T5314] configfs_write_iter+0x337/0x430 [ 95.250989][ T5314] vfs_write+0x612/0xba0 [ 95.251005][ T5314] ? __pfx_vfs_write+0x10/0x10 [ 95.251021][ T5314] ? __fget_files+0x2a/0x420 [ 95.251036][ T5314] ksys_write+0x150/0x270 [ 95.251046][ T5314] ? __pfx_ksys_write+0x10/0x10 [ 95.251064][ T5314] do_syscall_64+0x166/0x520 [ 95.251077][ T5314] ? trace_irq_disable+0x3b/0x140 [ 95.251092][ T5314] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.251101][ T5314] ? clear_bhb_loop+0x70/0xc0 [ 95.251112][ T5314] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.251123][ T5314] RIP: 0033:0x7f553a79e0d9 [ 95.251134][ T5314] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.251143][ T5314] RSP: 002b:00007f553b656fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 95.251156][ T5314] RAX: ffffffffffffffda RBX: 00007f553aa25fa0 RCX: 00007f553a79e0d9 [ 95.251164][ T5314] RDX: 000000000000001f RSI: 0000200000000340 RDI: 0000000000000003 [ 95.251170][ T5314] RBP: 00007f553a835024 R08: 0000000000000000 R09: 0000000000000000 [ 95.251176][ T5314] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.251183][ T5314] R13: 00007f553aa26038 R14: 00007f553aa25fa0 R15: 00007ffc9178a158 [ 95.251192][ T5314] [ 95.251194][ T5314] [ 95.348908][ T5314] Allocated by task 5314: [ 95.350735][ T5314] kasan_save_track+0x3e/0x80 [ 95.352699][ T5314] __kasan_kmalloc+0x93/0xb0 [ 95.354364][ T5314] __kmalloc_node_track_caller_noprof+0x4c7/0x740 [ 95.356652][ T5314] kstrdup+0x42/0x100 [ 95.358057][ T5314] f_uac2_opts_c_srate_store+0x11f/0x2b0 [ 95.359998][ T5314] configfs_write_iter+0x337/0x430 [ 95.361964][ T5314] vfs_write+0x612/0xba0 [ 95.363646][ T5314] ksys_write+0x150/0x270 [ 95.365368][ T5314] do_syscall_64+0x166/0x520 [ 95.367151][ T5314] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.369480][ T5314] [ 95.370476][ T5314] The buggy address belongs to the object at ffff88804079d200 [ 95.370476][ T5314] which belongs to the cache kmalloc-32 of size 32 [ 95.376291][ T5314] The buggy address is located 17 bytes inside of [ 95.376291][ T5314] 32-byte region [ffff88804079d200, ffff88804079d220) [ 95.381710][ T5314] [ 95.382753][ T5314] The buggy address belongs to the physical page: [ 95.385475][ T5314] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4079d [ 95.389281][ T5314] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 95.392311][ T5314] page_type: f5(slab) [ 95.394108][ T5314] raw: 04fff00000000000 ffff88801b041780 dead000000000100 dead000000000122 [ 95.397660][ T5314] raw: 0000000000000000 0000000800400040 00000000f5000000 0000000000000000 [ 95.401132][ T5314] page dumped because: kasan: bad access detected [ 95.403858][ T5314] page_owner tracks the page as allocated [ 95.406489][ T5314] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5202, tgid 5202 (dhcpcd-run-hook), ts 74876878215 [ 95.413711][ T5314] post_alloc_hook+0x1f9/0x250 [ 95.415583][ T5314] get_page_from_freelist+0x2209/0x2280 [ 95.417782][ T5314] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 95.419904][ T5314] allocate_slab+0x7c/0x5e0 [ 95.421536][ T5314] refill_objects+0x2d5/0x350 [ 95.425613][ T5314] __pcs_replace_empty_main+0x2c3/0x6b0 [ 95.428118][ T5314] __kmalloc_cache_noprof+0x3ab/0x660 [ 95.430535][ T5314] kmem_cache_free+0x156/0x650 [ 95.432537][ T5314] tear_down_vmas+0x31f/0x530 [ 95.434534][ T5314] exit_mmap+0x4ca/0x9f0 [ 95.436284][ T5314] __mmput+0x118/0x420 [ 95.438160][ T5314] exit_mm+0x221/0x2d0 [ 95.439945][ T5314] do_exit+0x6cd/0x2360 [ 95.441715][ T5314] do_group_exit+0x22d/0x2f0 [ 95.443775][ T5314] __x64_sys_exit_group+0x3f/0x40 [ 95.445949][ T5314] x64_sys_call+0x18c6/0x18d0 [ 95.448084][ T5314] page last free pid 5202 tgid 5202 ts 74875768375 stack trace: [ 95.451318][ T5314] __free_frozen_pages+0xc93/0xd90 [ 95.453605][ T5314] tlb_finish_mmu+0x13e/0x220 [ 95.455671][ T5314] exit_mmap+0x4b2/0x9f0 [ 95.457554][ T5314] __mmput+0x118/0x420 [ 95.459426][ T5314] exit_mm+0x221/0x2d0 [ 95.461125][ T5314] do_exit+0x6cd/0x2360 [ 95.463018][ T5314] do_group_exit+0x22d/0x2f0 [ 95.465065][ T5314] __x64_sys_exit_group+0x3f/0x40 [ 95.467377][ T5314] x64_sys_call+0x18c6/0x18d0 [ 95.469392][ T5314] do_syscall_64+0x166/0x520 [ 95.471404][ T5314] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.473895][ T5314] [ 95.474990][ T5314] Memory state around the buggy address: [ 95.477446][ T5314] ffff88804079d100: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 95.480770][ T5314] ffff88804079d180: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 95.484226][ T5314] >ffff88804079d200: 00 00 00 00 fc fc fc fc fa fb fb fb fc fc fc fc [ 95.487773][ T5314] ^ [ 95.489653][ T5314] ffff88804079d280: 00 00 03 fc fc fc fc fc 00 00 00 00 fc fc fc fc [ 95.493065][ T5314] ffff88804079d300: 00 00 00 fc fc fc fc fc 00 00 00 fc fc fc fc fc [ 95.496444][ T5314] ================================================================== [ 95.502774][ T5315] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 95.529408][ T5314] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 95.532633][ T5314] CPU: 0 UID: 0 PID: 5314 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.536031][ T5314] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.540232][ T5314] Call Trace: [ 95.541682][ T5314] [ 95.542954][ T5314] vpanic+0x56d/0xa60 [ 95.544624][ T5314] ? __pfx_vpanic+0x10/0x10 [ 95.546580][ T5314] ? __pfx___schedule+0x10/0x10 [ 95.548641][ T5314] panic+0xc5/0xd0 [ 95.550150][ T5314] ? __pfx_panic+0x10/0x10 [ 95.551969][ T5314] ? preempt_schedule_common+0x7f/0xd0 [ 95.554472][ T5314] check_panic_on_warn+0x89/0xb0 [ 95.556599][ T5314] end_report+0x73/0x170 [ 95.558501][ T5314] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 95.560922][ T5314] kasan_report_invalid_free+0xfa/0x110 [ 95.563147][ T5314] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 95.565331][ T5314] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 95.567709][ T5314] __kasan_slab_pre_free+0x104/0x120 [ 95.569771][ T5314] kfree+0x173/0x640 [ 95.571235][ T5314] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 95.573506][ T5314] f_uac2_opts_c_srate_store+0x225/0x2b0 [ 95.575770][ T5314] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 95.578403][ T5314] ? down_read+0x2be/0x330 [ 95.580336][ T5314] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 95.582929][ T5314] configfs_write_iter+0x337/0x430 [ 95.584987][ T5314] vfs_write+0x612/0xba0 [ 95.586764][ T5314] ? __pfx_vfs_write+0x10/0x10 [ 95.588704][ T5314] ? __fget_files+0x2a/0x420 [ 95.590611][ T5314] ksys_write+0x150/0x270 [ 95.592419][ T5314] ? __pfx_ksys_write+0x10/0x10 [ 95.594428][ T5314] do_syscall_64+0x166/0x520 [ 95.596403][ T5314] ? trace_irq_disable+0x3b/0x140 [ 95.598537][ T5314] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.601031][ T5314] ? clear_bhb_loop+0x70/0xc0 [ 95.603127][ T5314] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.605684][ T5314] RIP: 0033:0x7f553a79e0d9 [ 95.607682][ T5314] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.615815][ T5314] RSP: 002b:00007f553b656fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 95.619219][ T5314] RAX: ffffffffffffffda RBX: 00007f553aa25fa0 RCX: 00007f553a79e0d9 [ 95.622395][ T5314] RDX: 000000000000001f RSI: 0000200000000340 RDI: 0000000000000003 [ 95.625846][ T5314] RBP: 00007f553a835024 R08: 0000000000000000 R09: 0000000000000000 [ 95.629258][ T5314] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.632579][ T5314] R13: 00007f553aa26038 R14: 00007f553aa25fa0 R15: 00007ffc9178a158 [ 95.635961][ T5314] [ 95.637636][ T5314] Kernel Offset: disabled [ 95.639562][ T5314] Rebooting in 86400 seconds..