program: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x20081, 0x0) write$vga_arbiter(r1, &(0x7f0000000340)=ANY=[@ANYBLOB='nock io\x00'], 0x8) write$vga_arbiter(r1, &(0x7f0000000b80)=ANY=[@ANYBLOB="00008000000000000000e47d67f0ab94bcd2810f232c9d32d137bf17230f74fea0d5d7be1cdb1cf309bf861369fddb779eeee4cf8755d65a44da17615fb331d424109ddc9571101d372503a977baa088749dbe03775c47724f52deef43228a55102c509692701f29e27c5b500ff9bda8719abe08aff37ae4e9e92c83b693a9966a0cb58c26f38e65e6bbf708"], 0xa) write(r0, &(0x7f0000000440)="e17734343130302c34383030302c38383230302c39363030302c3137293430302c31391f3030302c333532383030", 0x2e) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400, 0xfe123, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24000000, 0x0, @perf_bp={&(0x7f00000008c0)}, 0x0, 0x0, 0x0, 0x0, 0x7, 0x3, 0x1}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000b40)={r0, 0x20, &(0x7f0000000b00)={&(0x7f00000007c0)=""/200, 0xc8, 0x0, &(0x7f0000000a00)=""/226, 0xe2}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x9, 0xc, &(0x7f0000000900)=ANY=[@ANYRESDEC=r2, @ANYBLOB="bc4ce297c93ddc18b1252214e093274376c4c6783d6fcf006a8bcc453324d5515ca05965d75cd4da6287772cdca5a2b93dd7fdeeb0d8963663ece2a84ef8e7a21be8c191fb6dd2a3878314ef723092ede6eadb1c0e5775cbfa70aceab0db3c261e32991ef8f6b079a29b21c9f9696164cb1393869a70ae49da6af1fb685a2d7de0cdd3d1ee85bd0a8e106721642bafe1bd2c2313f2848156f95af9e8b0e19a12826887b2a576b661d87b333848855709f0b96865748053fcae821f6148"], 0x0, 0x20000003, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1ff}, 0x94) r4 = perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400, 0xf6103, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24000000, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="07000000040000001800000001"], 0x50) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), r0) sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f00000004c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000680)=ANY=[@ANYBLOB="340000001bf23054509ba3b7f18c14413230503fcad011ad310b5c3ffa8dade3350d1aa8f6079c2649441f7c31ac5fa1d8c943ced73f25d8e66cf61536a0a96e606e05c473c58b95e7de8b2047ec046858d8ee70a19572fd2a9789b87b0ce787dffa3890ab62d94a46fe48656359406359f2d5dae8c7bd1072a84e2c455feb3cb24df9c1923b18835f1c09ade5f5877d1b3a928a56dba190602954a9fb9ffe591d30c67970c70129eb582f1fd1ff19c4dc68bbd093a7f28da5f0235d80d6e085b3ccfd519ffb46db7b8ecf2a3949f52729eea1", @ANYRES16=r6, @ANYBLOB="a2212bbd7000fcdbdf250400000008000c0000000000050012000200000005002200000000000600020000000000"], 0x34}}, 0x4000) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xc, 0x200000000000005b, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000001000000000000000018120000", @ANYRES32=r5, @ANYBLOB="0000000000000000b703000000030000850000001b"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, r7) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r8) perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400, 0x66137, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24000000, 0x0, @perf_bp={0x0, 0x8}, 0x40, 0x0, 0x0, 0x7, 0x7, 0x40000000}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.current\x00', 0x275a, 0x0) write$cgroup_pid(r9, &(0x7f0000000000), 0x2a979d) bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000000300)={0xe, 0x0}, 0x8) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000480)={r10, 0xff, 0x10}, 0xc) symlinkat(&(0x7f0000000580)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00') openat(0xffffffffffffff9c, &(0x7f0000000600)='./myconfig/usb_gadget/g1/UDC\x00', 0x1, 0x0) [ 94.832824][ T5291] Bluetooth: hci0: command tx timeout [ 94.944742][ T5332] ================================================================== [ 94.948014][ T5332] BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x225/0x2b0 [ 94.951287][ T5332] Free of addr ffff88801fd01b08 by task syz.0.0/5332 [ 94.954442][ T5332] [ 94.955644][ T5332] CPU: 0 UID: 0 PID: 5332 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.955660][ T5332] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.955668][ T5332] Call Trace: [ 94.955675][ T5332] [ 94.955681][ T5332] dump_stack_lvl+0xe8/0x150 [ 94.955703][ T5332] print_address_description+0x55/0x1e0 [ 94.955719][ T5332] print_report+0x58/0x70 [ 94.955731][ T5332] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 94.955746][ T5332] kasan_report_invalid_free+0xea/0x110 [ 94.955769][ T5332] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 94.955783][ T5332] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 94.955797][ T5332] __kasan_slab_pre_free+0x104/0x120 [ 94.955810][ T5332] kfree+0x173/0x640 [ 94.955820][ T5332] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 94.955833][ T5332] f_uac2_opts_p_srate_store+0x225/0x2b0 [ 94.955845][ T5332] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 94.955859][ T5332] ? down_read+0x2be/0x330 [ 94.955871][ T5332] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 94.955882][ T5332] configfs_write_iter+0x337/0x430 [ 94.955899][ T5332] vfs_write+0x612/0xba0 [ 94.955917][ T5332] ? __pfx_vfs_write+0x10/0x10 [ 94.955933][ T5332] ? __fget_files+0x2a/0x420 [ 94.955948][ T5332] ksys_write+0x150/0x270 [ 94.955961][ T5332] ? __pfx_ksys_write+0x10/0x10 [ 94.955977][ T5332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.955988][ T5332] do_syscall_64+0x174/0x580 [ 94.955999][ T5332] ? trace_irq_disable+0x3b/0x140 [ 94.956014][ T5332] ? clear_bhb_loop+0x40/0x90 [ 94.956027][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.956038][ T5332] RIP: 0033:0x7fa5e579de99 [ 94.956050][ T5332] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.956059][ T5332] RSP: 002b:00007fa5e659afe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 94.956072][ T5332] RAX: ffffffffffffffda RBX: 00007fa5e5a25fa0 RCX: 00007fa5e579de99 [ 94.956080][ T5332] RDX: 000000000000002e RSI: 0000200000000440 RDI: 0000000000000003 [ 94.956087][ T5332] RBP: 00007fa5e5833eaf R08: 0000000000000000 R09: 0000000000000000 [ 94.956093][ T5332] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.956099][ T5332] R13: 00007fa5e5a26038 R14: 00007fa5e5a25fa0 R15: 00007ffd83b70d38 [ 94.956110][ T5332] [ 94.956114][ T5332] [ 95.051241][ T5332] Allocated by task 5332: [ 95.053026][ T5332] kasan_save_track+0x3e/0x80 [ 95.054989][ T5332] __kasan_kmalloc+0x93/0xb0 [ 95.056996][ T5332] __kmalloc_node_track_caller_noprof+0x4c3/0x730 [ 95.059744][ T5332] kstrdup+0x42/0x100 [ 95.061415][ T5332] f_uac2_opts_p_srate_store+0x11f/0x2b0 [ 95.063715][ T5332] configfs_write_iter+0x337/0x430 [ 95.065892][ T5332] vfs_write+0x612/0xba0 [ 95.067660][ T5332] ksys_write+0x150/0x270 [ 95.069493][ T5332] do_syscall_64+0x174/0x580 [ 95.071504][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.074083][ T5332] [ 95.075164][ T5332] The buggy address belongs to the object at ffff88801fd01b00 [ 95.075164][ T5332] which belongs to the cache kmalloc-64 of size 64 [ 95.080920][ T5332] The buggy address is located 8 bytes inside of [ 95.080920][ T5332] 47-byte region [ffff88801fd01b00, ffff88801fd01b2f) [ 95.086543][ T5332] [ 95.087585][ T5332] The buggy address belongs to the physical page: [ 95.090221][ T5332] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1fd01 [ 95.093778][ T5332] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 95.096798][ T5332] page_type: f5(slab) [ 95.098621][ T5332] raw: 00fff00000000000 ffff88801b0418c0 dead000000000100 dead000000000122 [ 95.102347][ T5332] raw: 0000000000000000 0000000800200020 00000000f5000000 0000000000000000 [ 95.106018][ T5332] page dumped because: kasan: bad access detected [ 95.108706][ T5332] page_owner tracks the page as allocated [ 95.111130][ T5332] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 5290, tgid 5290 (syz-executor), ts 93000768223, free_ts 93000682656 [ 95.119312][ T5332] post_alloc_hook+0x1f9/0x250 [ 95.121283][ T5332] get_page_from_freelist+0x21fa/0x2270 [ 95.123589][ T5332] __alloc_frozen_pages_noprof+0x18d/0x380 [ 95.126124][ T5332] allocate_slab+0x79/0x5e0 [ 95.128052][ T5332] ___slab_alloc+0x16a/0x950 [ 95.129970][ T5332] __kmalloc_flags_noprof+0x347/0x800 [ 95.132302][ T5332] alloc_slab_obj_exts+0x4d/0x170 [ 95.134499][ T5332] __memcg_slab_post_alloc_hook+0x5d3/0xf10 [ 95.137045][ T5332] __kvmalloc_node_noprof+0x61c/0x860 [ 95.139254][ T5332] xt_alloc_table_info+0x40/0xb0 [ 95.141409][ T5332] ip6t_register_table+0xcd/0x320 [ 95.143490][ T5332] ip6table_nat_table_init+0x42/0x300 [ 95.145793][ T5332] xt_find_table_lock+0x311/0x400 [ 95.147899][ T5332] xt_request_find_table_lock+0x26/0x100 [ 95.150284][ T5332] do_ip6t_get_ctl+0x77b/0x12f0 [ 95.152341][ T5332] nf_getsockopt+0x26e/0x290 [ 95.154126][ T5332] page last free pid 5290 tgid 5290 stack trace: [ 95.156876][ T5332] free_pages_prepare+0x960/0xa60 [ 95.159059][ T5332] __free_contig_range_common+0x174/0x340 [ 95.161493][ T5332] free_pages_bulk+0x48/0x120 [ 95.163482][ T5332] vfree+0x224/0x4a0 [ 95.165247][ T5332] do_ip6t_get_ctl+0xf3e/0x12f0 [ 95.167361][ T5332] nf_getsockopt+0x26e/0x290 [ 95.169381][ T5332] ipv6_getsockopt+0x213/0x2c0 [ 95.171356][ T5332] do_sock_getsockopt+0x569/0xa70 [ 95.173277][ T5332] __x64_sys_getsockopt+0x1a4/0x240 [ 95.175478][ T5332] do_syscall_64+0x174/0x580 [ 95.177502][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.179860][ T5332] [ 95.180836][ T5332] Memory state around the buggy address: [ 95.183328][ T5332] ffff88801fd01a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 95.186627][ T5332] ffff88801fd01a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 95.189976][ T5332] >ffff88801fd01b00: 00 00 00 00 00 07 fc fc fc fc fc fc fc fc fc fc [ 95.193337][ T5332] ^ [ 95.195217][ T5332] ffff88801fd01b80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 95.198623][ T5332] ffff88801fd01c00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 95.202061][ T5332] ================================================================== [ 95.275263][ T5332] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 95.278229][ T5332] CPU: 0 UID: 0 PID: 5332 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.282413][ T5332] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.287495][ T5332] Call Trace: [ 95.288867][ T5332] [ 95.290076][ T5332] vpanic+0x56c/0xa60 [ 95.291789][ T5332] ? __pfx_vpanic+0x10/0x10 [ 95.293750][ T5332] ? __pfx___schedule+0x10/0x10 [ 95.295852][ T5332] panic+0xc5/0xd0 [ 95.297493][ T5332] ? __pfx_panic+0x10/0x10 [ 95.299400][ T5332] ? preempt_schedule_common+0x82/0xd0 [ 95.301720][ T5332] check_panic_on_warn+0x89/0xb0 [ 95.303766][ T5332] end_report+0x73/0x170 [ 95.305518][ T5332] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 95.307971][ T5332] kasan_report_invalid_free+0xfa/0x110 [ 95.310617][ T5332] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 95.313226][ T5332] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 95.315575][ T5332] __kasan_slab_pre_free+0x104/0x120 [ 95.317844][ T5332] kfree+0x173/0x640 [ 95.319484][ T5332] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 95.322052][ T5332] f_uac2_opts_p_srate_store+0x225/0x2b0 [ 95.324343][ T5332] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 95.326882][ T5332] ? down_read+0x2be/0x330 [ 95.328725][ T5332] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 95.331340][ T5332] configfs_write_iter+0x337/0x430 [ 95.333454][ T5332] vfs_write+0x612/0xba0 [ 95.335102][ T5332] ? __pfx_vfs_write+0x10/0x10 [ 95.337147][ T5332] ? __fget_files+0x2a/0x420 [ 95.339117][ T5332] ksys_write+0x150/0x270 [ 95.341251][ T5332] ? __pfx_ksys_write+0x10/0x10 [ 95.343240][ T5332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.345890][ T5332] do_syscall_64+0x174/0x580 [ 95.347864][ T5332] ? trace_irq_disable+0x3b/0x140 [ 95.349975][ T5332] ? clear_bhb_loop+0x40/0x90 [ 95.351974][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.354497][ T5332] RIP: 0033:0x7fa5e579de99 [ 95.356394][ T5332] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.364332][ T5332] RSP: 002b:00007fa5e659afe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 95.367840][ T5332] RAX: ffffffffffffffda RBX: 00007fa5e5a25fa0 RCX: 00007fa5e579de99 [ 95.370861][ T5332] RDX: 000000000000002e RSI: 0000200000000440 RDI: 0000000000000003 [ 95.374062][ T5332] RBP: 00007fa5e5833eaf R08: 0000000000000000 R09: 0000000000000000 [ 95.377366][ T5332] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.380608][ T5332] R13: 00007fa5e5a26038 R14: 00007fa5e5a25fa0 R15: 00007ffd83b70d38 [ 95.383884][ T5332] [ 95.385453][ T5332] Kernel Offset: disabled [ 95.387220][ T5332] Rebooting in 86400 seconds..