program: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000000)={0xd, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x2, r1, 0x0, &(0x7f0000ffd000/0x3000)=nil, 0x3000}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000080)={0x28, 0x2, r1, 0x0, &(0x7f00000001c0)="6b1d24b5dd", 0x5, 0x2}) ioctl$IOMMU_IOAS_COPY(r0, 0x3b83, &(0x7f0000000040)={0x28, 0x7, r1, r1, 0xa93, 0x0, 0x3fff}) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={0x1, 0xffffffffffffffff}, 0x4) r3 = open(&(0x7f0000001600)='./myconfig/usb_gadget/g1\x00', 0x210000, 0x0) getdents64(r3, &(0x7f0000000180)=""/82, 0x52) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(0xffffffffffffffff, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_REFS(0xffffffffffffffff, 0x3ba0, 0x0) ioctl$IOMMU_IOAS_UNMAP(0xffffffffffffffff, 0x3b86, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x48, 0x5, 0x0, 0x0, 0x0, 0x1}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000a00)={0x28, 0x7, 0x0, 0x0, &(0x7f00000a0000)='LLLLLLLLLLLLLLLLLLLLLLLLLLLL', 0x1000}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000a40)={0x48, 0x7, r4, 0x0, 0x0, 0x0, 0x0, 0x1000}) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000b80)={0x48, 0x6, r4, 0x0, r5}) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000001640)={0x48, 0x6, r1, 0x0, r5}) lseek(r3, 0xffffffffffffffff, 0x1) getdents(r3, &(0x7f0000000200)=""/4096, 0x1000) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x3, 0x19, &(0x7f00000014c0)=@raw=[@call={0x85, 0x0, 0x0, 0x8c}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x86}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r2}}, @initr0={0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x9}, @jmp={0x5, 0x0, 0x5, 0x7, 0x9, 0x4, 0x4}, @cb_func={0x18, 0x5, 0x4, 0x0, 0x6}, @btf_id={0x18, 0x6, 0x3, 0x0, 0x2}, @map_val={0x18, 0xd, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0x400}, @func={0x85, 0x0, 0x1, 0x0, 0x7}, @func={0x85, 0x0, 0x1, 0x0, 0x4}], &(0x7f0000000000)='GPL\x00'}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r6 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0) write(r6, &(0x7f0000000440)='44100,48000,88', 0xe) pwritev2(r6, &(0x7f0000001480)=[{&(0x7f0000000000)="13f25595409491efe0a70b1ea4e74197fbd8390641d7c255a3045a547ddb7c8610848609ff588db5d8c7e5569b068cf388094bbff112533058b59fc17f44af07078844399ec0e8370f17dfe084530ea80912cb3c423a66", 0x57}, {&(0x7f0000000480)="5811ff6c2f8320060e2f63e44bd28211f2ad487ef66ee07367a81603d1ffa236c8fb53c26bbb9d914a2f41a2a2a2115af0354b347f195084862dfccedb6b89a1336e835525f3f76c57777088e098aabe7665b229055793641a763ef0ce7004a8e34e9a1d70a55da50433e2350ee63ecae801cfef2c0ab004dae0adaf691ece70c03c9adb24ccdfafee93f38a7af369001f274a5c05aafadcf92c7cf4d284df4d4ad89ac7ba7c614d3811b56e2f88764bebe15a0f93b862e68fded9b0a9995160eab299c3289c51dfb93b22e47d234fa2a43e1e5e217b94b43716bc81e49d50d37027279a341626e379a89532c06fd5f502a1382a61ecdfa6c6fa7a216ef027d4c5313f6db0f50eac720448aadfaee5b3e2dbc35849b4b05bbf062b8d33564a3ce57b33b2328a3f43ec1ff16a2f07a90e5dc959a4b508054a51f0c9af6595a07ae9098a8c489dbdb67366cddbd23e51aeef540a7a486e309d7c63435d94dc37fe97bb105a509aec79fcae8590d62383489c7431af99000d8b9c20cd25bec848751833c0286b2dcbfefd72bd8b007ccda7e79be2a7b8b9f02635f3524b1ae09ed1fe8989743ba189c7ccd1d29f602a757cd5100ab927e4197a1de25ee5cd324474c2237544cf81d0d1bba2dbf6e910bbfd5cfa000fbf6e64dd5fedac0cb9d744f21f1f5a167edfd17a0e9d543e4085931763090b419361766fd9509646cda2652c2a817f0c8275de343b078f0b114f9733f26a198005abcd47b3b3db0a0082b33f0760b740de5a383665be5fb8430c1d2f928082bfa5bb948a02de32449b88bd49d0dd0d09acbd914983efb0b1e774ac805b6d5d993552b088f2b5a13370859aaabfefc13afe68753ecde0478f3017ee29acdf3906c8310d542113b15790785a4c44ef369c6b369257bbdec36fc8cf2338aa64683f42bbb1512bf94199f6891d00156bf1089ab026479ea67c32e4c59f1436b0b28ecccf05a33e0ac2a10f65d258ca702d7a5e848a1eaeff186ccb0bfd2d769212a24f7f86aab168514414b7807c3af6d624db9e1d53705277270022d7631a697c5fc078bccaa68b9226c21fd2ddeffdd0c6bdf5afae818fbfc5cf44ed500e859112c4e55b6d1314b839a562af82e58c2d411d568b8683d598592d4f25577e25bed8bb730e704d2140435693e08e57ba1bb6d6cc9e0d339810f2b4707ec0ea08086ff58b635844fd111fa10e4972b29adb0d8e43fe238d3b5f80e255387c8582480aeeaec43545f86d7ae67a53d3a5df926b910774fa73127ee15f3a87b8159d94eba57080e348848e290468490c4235f1b0dcff7124b7f9d513d748370d541fe63977cb4da2aae204100f1cc436cf470a0328b8480251c39b98c593ae6ecdfb20c67b6c0f263f7b25d6351481166137ba7dcf1a7d841c6ff352c0e15e68181c9d8edecbc55346c39e92079ff4d6eda3ddb8014940889c792af350379ba8edfab7f8aad770cd91df748cf813b9b07384c9609494b61610ee0aa14a60600b7de59bedb08134ea7430e2513072424477d93b3db88ced1d0ea15f81c9e9aa439762fcaf184c3b785dc9dfde94199da84269148be4d3bf9e60d409236e39413cdccb1be0b95c8bb2d668465f0296953fdd3cc2266526e529f4a5b1b08603aae653279f3827259277d8a6561a691c83589522a740a837b904d3f835759db0e9a57a9fce26028d8764d9582d469971f2f7fc1559e4a2ed091b82f1713527fd467016094ed334360c6916031b2c111fdff25d03988bfd0dc4cb0502eaeea6584d2c7ac976fc38816ca97d5e08eadbdee274d40925383e041263fac3f68257a6b32b86a032a98707ed7e935e1a3a58239066191b75167c35f51ecca94b4098f6402f42852619df1b3e687f62321f59cbdd9a02530a768bcdd4a53deb57e37408d55caef339fcb6745694a9a1c821a19cc699416828baa4c7fbbc071d8fae22826aac2dd37cd9714041d3b3190eae861ebc27c80a0d383745e20e876fc274ae27ed14659c157e997397334b35e90843679201a16ede7504c532c60fe9980b8be7dd6d609e919ccb0c8ffe02e418d783e6229b3f55ad5d6901b014a039d9109bd1ee77794520479367224e14ef6c57af7bd0eb50a875e0daa930807c95e47a6699d7f590f1ef3efb7ef10c4f932bee57f0658f616c7a53fbaaa524a35271df3312ec3693ba429c038ca7bd45fed3059f1cdc837391a35b62d00a3e422ff7e0ce06925d6239e1f0828c5b3499f2808154190ca266fd03f5345d9f5bd773b4f300b834f5b7a0e1e94250211b68dc7e5e8269dec3008bac3b46f6fdf30ed49418593d44b493f860d39115948d9c7caa88c2db32dd30f733106d285752c1beba590fe62a390c63f7bdba6c2f563e6ac0f2e6f16c65eda1d9cd0b8791a5d4abb6b2f1edaa29649d1ef6c2403e908feec72d2429901fd7752976708babefd20c078611c523ff665b3666b9f4b4877de698dca63111cbb43c6c856e789116f4c5a0f35b5a612412efe09c056d200926d3af4d97eaf16d1737329875b583c4058509c99e4095df2e30927de1830f7f7dd0990a502509e94ced9fe5890da829aeb733fb03e58df38dc264d8916e3a21415d5b08ffaef9ef61fbc4dffd4657613783e127d9a146876bddfa3c76a0071cb9e05d8fd2e32c08fedcd820ed55b41bdf5e5fd605369565633235344333749051290fec3ce9a35ecf090edc0887336136e8bd427e030b75635611132bac90d6b4f3dd1424ed812c8c17da838a8f116d42964d35fabc4e1a59269e8f41621c3b469ccd574eb886eb928c57c2bebefc46ad1f9de9b08fd5bdf3534e9ab6b15e5f08e1bb8ea5ceeceb0a74936eac9b033bf63f5b470394457667c9ba06f906acdc4cddcee35aed5c0292f065e56238332ff2bfde3b357457520ba9d3fea504b485a91d5d8cb0c1dcd435db8dfc7f9198afb856e134dc3f9d832e6d35324cac5cbc191b0ee376d3d0dd9b02a23f81c2efb6b626d7c2a1d7a389e15139c05dee53a7f4637138173e31a7f3e631f5e71cc4aa6f2bbf90a2be1ac0c24179dcad9412fa19b264fef2e1b908f6078d98044d72b6c04809def3ce470697b1f9916964bccc54b769125c8aa57172674c4571cb08684968e6decc59e239cc6e001dd3acaa7a49c0f4cf9fd87f4ea60562e4853e552a0fdbb52694936c1ae3f260e9d7534b99c357a75fc5e26c06b52664bcc20e041f1dc33aca74cf07f94f02314ddadcf242a6b732413870f933184096c58d8bac8087028fbfd00417c0a0b0e72725a0c9c31ebaed0364c5942ec7351f448950f48792b1a46f52d3c1432f6b4246f13318159651328766ed0a51bf9af3a4abddc25082b90e6a3ed8f7e3cc7c9ea8ada2cc168966746eac9345bbc114e9ae76e0b3582dfd2c1079ac1e5fd886631279f69c427b093610b6aca866ae612702e956bec1b14dae67e37fd446ca5be01f063f6fb4131b51098cecbea8015c90f7d8c1c5f35035de43b4a211114f6ca3c3e578e8c248a7f8b8c1f961e116a58fed7288c789d9a897f905343de381dc3aa518f9cfa6541fc7f21038f13c23f2cf68700bb58281809a2562d057d05dc63a8f6953e4b813fbd85fb7f6fb94102986bcdcec4935d8f3ec2cfe878a535ab6cfd827aac6f31d545ade7757efa94df773a6e522e677e2bca49d923983878216cfd6f5e8affd684d3f493d3fbeccb7c3daeee2f56f0f55f198361bac64711b7aa0ecaa57ba0e2d509d69589adb8ad3316200e0e0d2bed568a1a9e303e5516494128fb32a665c758b8adcd25581533b6583e2a311a655985c3e124f5330d6d4e39474ae4512d7dcc031253bb35d70496c9b62e2f6f626dbebddf3e03076a0f93b1ceee62b69ba56c16ef681e54a05f780628ae0aa2358ee08389a77dcba23238f813d828582e13c3da689dbbf3c34eb0f743ef38ab08fef5dfdbbc0573e88ed1d8338cc2dd80a39ea92f6b00842ca37a90bab5b71bb2e21fadaa5b89a2fc80210475a68876793f6cdc38c057ed63159bc9a55167cd5d6ced37bef71e472d39cade14bf931bbaacf891b697ffe4039aee6d392e4fa08cdc1a318b41845380ecfe811b5cbd53715c68733d1a615df7cb2b13f2e7856d84111bd0f6d6e6f5a7b3bbb5988a0a9a4f079c26b056f7732ad8684d89cdfa8b2f80d1afaddaf9398b1be7eac7516bc273ca6cbe3a4005aa5ef71c7883f5171969591eb2a6ffd329629ede7144804ae0c7f8c4f59898626eb37b4e3ea93cf998396b882d2e7a29f45228c5b92db817cec9e612419ee471f4369854b926b934146342eeba58a09b006078fcc2f7b7e623fc3ab416689a87f0040e57d145cfa92202840182d4799c1199136da6df124433404d519b29c9f197c456d92feb9e22f11403c8dc6c9c04362570d9361b34fe62329f596c68b28632096c56b165157afb33d2a69af7e39d7cf9dffe8763ce5c8b21cc89903d0aa14d9483855a4eea1140a1009b3b4315831683933828967d83e4af6966b9b87c55e19a773ae613fab872086ad1d5ffd3ff3feb4c4565ace848fa61a464d63381c6e605075996d8e6a85cb7c2d3f01ff5064cbc06912b432960c80c3e52e558309d8bd6a5b4fe8f529d66de2e72ef93d8d6c7750ccc7729ebe35f6f922435fa43c24f381880f3e36ec28d185fb9f36694177f6174d19bf40b1a61823f45f10e03d662050742b2e117174881aaf883447ba1e1ff97b026cfb87634c77eaae0faf2ce4c7101299654d9c479b220d0db42a78593da0d5efcf803e64114e7ee217a289fd774d6782d2543dff751386f35186e266eb0db349a4e27e2fb9ed27bd605f877ca106470b94d1aea1f7d316a23ebb6adadcdc597faf0d7608a800ddcd3fb9af2e62c1f5cdd7a0e3ae1518c9115b0c6b3831b55554fa5b706731ef10c986dffc802cad9b97e83fc98d5c67be5e017c7d557c2f38864e3863a19b91046010a8142fe17e71a9402c896f4e9280f59cc3f26454f825b4d7899fcdc7e6a4533468b4c01afdd5a5635246702e03131d200e38d5d6b1ff348454f213647850df4337c3e66767ded55911b2473baa0f1fcf0e13d4900e37897333bf7ef4156a0912bb6da655d4dd66953b940bfa05fabc95b24f7207536ca574e7ca89e6fc4627fcfc49bbc3c3eb675b63c185983f39236c20529004071997fd50b77dc32054ed7cf906e2a7d18bc8a59f759f57f9065504fa21a00dd8e1b4fdb814e2a6ccedc93fddd5e7204a6f5739913d8749e48ea496fffd118670545780268607d70bae909d836f8bcff7216ba6510a24a45c59bf47c0b7cb1d2b9511d3ce087ba92401c12eab90579db484dd75f04d6db2a445b99269d97c691400fb10196bd365e4fe1b7d62210c0cc7a786f48311bf5475030450745cb375de542f74e8e1ed8b755077553d7d98254b4b6dc3efdabe9092b752de949b8fa7d1799308f01d330a21d864a2d8e7d03feb5e1f7e9d092d60dc436346a028e4f6229b500454718a051c485961d2d642f38f63aadb610f9b0ee19b7d903d7340d210dcaaa80c09daa88d9f4904aa8773e0783247a86fc5409872a98934371725dc23d3f7c32d02c21642a8150431dee8b1207147029affaf05b4daa1f3b7371387f53a3fd777f64ed5c7c6a54620fc745eeef227acbe26fc1a5dfeff1780ea5b998241c64e2580c411cb1aba1fce3c59d2643729e2816fff4fbfc7407d99866c34f63333ebebf9f56e8f71847341973c3e5fe2d79cf4c781ec2ff65928e89a53c2611ca2e264ea42af643e8ae44cf4886110", 0x1000}], 0x2, 0x6de0, 0xf97, 0x14) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x12, 0x9, 0x4, 0x2}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{r8}, &(0x7f00000000c0), &(0x7f0000000100)=r7}, 0x20) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') [ 93.119149][ T4654] Bluetooth: hci0: command tx timeout [ 93.167606][ T9] cfg80211: failed to load regulatory.db [ 93.275405][ T5332] ================================================================== [ 93.278894][ T5332] BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x225/0x2b0 [ 93.282323][ T5332] Free of addr ffff8880433ec6cc by task syz.0.0/5332 [ 93.285156][ T5332] [ 93.286227][ T5332] CPU: 0 UID: 0 PID: 5332 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.286241][ T5332] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.286249][ T5332] Call Trace: [ 93.286256][ T5332] [ 93.286261][ T5332] dump_stack_lvl+0xe8/0x150 [ 93.286281][ T5332] print_address_description+0x55/0x1e0 [ 93.286298][ T5332] print_report+0x58/0x70 [ 93.286311][ T5332] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 93.286323][ T5332] kasan_report_invalid_free+0xea/0x110 [ 93.286337][ T5332] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 93.286352][ T5332] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 93.286364][ T5332] __kasan_slab_pre_free+0x104/0x120 [ 93.286377][ T5332] kfree+0x173/0x640 [ 93.286388][ T5332] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 93.286399][ T5332] f_uac2_opts_p_srate_store+0x225/0x2b0 [ 93.286412][ T5332] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 93.286426][ T5332] ? down_read+0x2be/0x330 [ 93.286438][ T5332] ? __pfx___futex_wait+0x10/0x10 [ 93.286450][ T5332] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 93.286463][ T5332] configfs_write_iter+0x337/0x430 [ 93.286478][ T5332] do_iter_readv_writev+0x612/0x8c0 [ 93.286496][ T5332] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 93.286515][ T5332] vfs_writev+0x343/0x990 [ 93.286528][ T5332] ? __pfx_vfs_writev+0x10/0x10 [ 93.286542][ T5332] ? __fget_files+0x2a/0x420 [ 93.286555][ T5332] ? __fget_files+0x3a2/0x420 [ 93.286566][ T5332] ? __fget_files+0x2a/0x420 [ 93.286580][ T5332] __se_sys_pwritev2+0x177/0x2a0 [ 93.286590][ T5332] ? __pfx___se_sys_pwritev2+0x10/0x10 [ 93.286601][ T5332] ? __x64_sys_pwritev2+0x20/0xc0 [ 93.286611][ T5332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.286622][ T5332] do_syscall_64+0x174/0x580 [ 93.286634][ T5332] ? trace_irq_disable+0x3b/0x140 [ 93.286647][ T5332] ? clear_bhb_loop+0x40/0x90 [ 93.286659][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.286670][ T5332] RIP: 0033:0x7f5d35b9e019 [ 93.286681][ T5332] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.286692][ T5332] RSP: 002b:00007f5d369fdfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000148 [ 93.286705][ T5332] RAX: ffffffffffffffda RBX: 00007f5d35e25fa0 RCX: 00007f5d35b9e019 [ 93.286713][ T5332] RDX: 0000000000000002 RSI: 0000200000001480 RDI: 0000000000000005 [ 93.286721][ T5332] RBP: 00007f5d35c3500c R08: 0000000000000f97 R09: 0000000000000014 [ 93.286728][ T5332] R10: 0000000000006de0 R11: 0000000000000246 R12: 0000000000000000 [ 93.286735][ T5332] R13: 00007f5d35e26038 R14: 00007f5d35e25fa0 R15: 00007ffe4d06ad08 [ 93.286747][ T5332] [ 93.286758][ T5332] [ 93.396899][ T5332] Allocated by task 5332: [ 93.398778][ T5332] kasan_save_track+0x3e/0x80 [ 93.400782][ T5332] __kasan_kmalloc+0x93/0xb0 [ 93.402793][ T5332] __kmalloc_node_track_caller_noprof+0x4c3/0x730 [ 93.405635][ T5332] kstrdup+0x42/0x100 [ 93.407321][ T5332] f_uac2_opts_p_srate_store+0x11f/0x2b0 [ 93.409714][ T5332] configfs_write_iter+0x337/0x430 [ 93.411920][ T5332] do_iter_readv_writev+0x612/0x8c0 [ 93.414098][ T5332] vfs_writev+0x343/0x990 [ 93.415841][ T5332] __se_sys_pwritev2+0x177/0x2a0 [ 93.417833][ T5332] do_syscall_64+0x174/0x580 [ 93.419700][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.422134][ T5332] [ 93.423222][ T5332] The buggy address belongs to the object at ffff8880433ec600 [ 93.423222][ T5332] which belongs to the cache kmalloc-256 of size 256 [ 93.429097][ T5332] The buggy address is located 204 bytes inside of [ 93.429097][ T5332] 231-byte region [ffff8880433ec600, ffff8880433ec6e7) [ 93.434819][ T5332] [ 93.435913][ T5332] The buggy address belongs to the physical page: [ 93.438702][ T5332] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x433ec [ 93.442439][ T5332] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 93.445218][ T5332] page_type: f5(slab) [ 93.446648][ T5332] raw: 04fff00000000000 ffff88801b041b40 dead000000000122 0000000000000000 [ 93.449731][ T5332] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 93.452931][ T5332] page dumped because: kasan: bad access detected [ 93.455420][ T5332] page_owner tracks the page as allocated [ 93.457702][ T5332] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5290, tgid 5290 (syz-executor), ts 91179827496, free_ts 91177166319 [ 93.466319][ T5332] post_alloc_hook+0x1f9/0x250 [ 93.468398][ T5332] get_page_from_freelist+0x21fa/0x2270 [ 93.470708][ T5332] __alloc_frozen_pages_noprof+0x18d/0x380 [ 93.473257][ T5332] allocate_slab+0x79/0x5e0 [ 93.475260][ T5332] refill_objects+0x2d5/0x350 [ 93.477281][ T5332] __pcs_replace_empty_main+0x2bf/0x6b0 [ 93.479650][ T5332] __kmalloc_noprof+0x485/0x720 [ 93.481773][ T5332] __list_lru_init+0xba/0x5d0 [ 93.483816][ T5332] sget_fc+0xef0/0x1900 [ 93.485661][ T5332] get_tree_single+0x2f/0x150 [ 93.487669][ T5332] vfs_get_tree+0x92/0x2a0 [ 93.489569][ T5332] do_new_mount+0x319/0xdc0 [ 93.491480][ T5332] __se_sys_mount+0x31d/0x420 [ 93.493539][ T5332] do_syscall_64+0x174/0x580 [ 93.495848][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.498434][ T5332] page last free pid 5290 tgid 5290 stack trace: [ 93.501083][ T5332] __free_frozen_pages+0xc1e/0xd10 [ 93.503258][ T5332] __slab_free+0x274/0x2c0 [ 93.505309][ T5332] qlist_free_all+0x99/0x100 [ 93.507214][ T5332] kasan_quarantine_reduce+0x148/0x160 [ 93.509411][ T5332] __kasan_slab_alloc+0x22/0x80 [ 93.511388][ T5332] kmem_cache_alloc_noprof+0x2a0/0x5f0 [ 93.513616][ T5332] do_getname_kernel+0x54/0x230 [ 93.515574][ T5332] kern_path+0x25/0x150 [ 93.517122][ T5332] tomoyo_mount_permission+0x79e/0x9e0 [ 93.519396][ T5332] security_sb_mount+0xe4/0x320 [ 93.521348][ T5332] path_mount+0xbc/0x1040 [ 93.523136][ T5332] __se_sys_mount+0x31d/0x420 [ 93.525089][ T5332] do_syscall_64+0x174/0x580 [ 93.527062][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.529474][ T5332] [ 93.530444][ T5332] Memory state around the buggy address: [ 93.532664][ T5332] ffff8880433ec580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 93.535853][ T5332] ffff8880433ec600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 93.538887][ T5332] >ffff8880433ec680: 00 00 00 00 00 00 00 00 00 00 00 00 07 fc fc fc [ 93.541854][ T5332] ^ [ 93.544332][ T5332] ffff8880433ec700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 93.547642][ T5332] ffff8880433ec780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 93.551063][ T5332] ================================================================== [ 93.596563][ T5332] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 93.599465][ T5332] CPU: 0 UID: 0 PID: 5332 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.602943][ T5332] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.607052][ T5332] Call Trace: [ 93.608482][ T5332] [ 93.609732][ T5332] vpanic+0x56c/0xa60 [ 93.611407][ T5332] ? __pfx_vpanic+0x10/0x10 [ 93.613413][ T5332] ? __pfx___schedule+0x10/0x10 [ 93.615485][ T5332] panic+0xc5/0xd0 [ 93.617099][ T5332] ? __pfx_panic+0x10/0x10 [ 93.619018][ T5332] ? preempt_schedule_common+0x82/0xd0 [ 93.621254][ T5332] check_panic_on_warn+0x89/0xb0 [ 93.623164][ T5332] end_report+0x73/0x170 [ 93.624832][ T5332] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 93.627063][ T5332] kasan_report_invalid_free+0xfa/0x110 [ 93.629363][ T5332] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 93.631855][ T5332] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 93.634245][ T5332] __kasan_slab_pre_free+0x104/0x120 [ 93.636106][ T5332] kfree+0x173/0x640 [ 93.637725][ T5332] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 93.640336][ T5332] f_uac2_opts_p_srate_store+0x225/0x2b0 [ 93.642831][ T5332] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 93.645611][ T5332] ? down_read+0x2be/0x330 [ 93.647408][ T5332] ? __pfx___futex_wait+0x10/0x10 [ 93.649454][ T5332] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 93.651798][ T5332] configfs_write_iter+0x337/0x430 [ 93.653771][ T5332] do_iter_readv_writev+0x612/0x8c0 [ 93.655852][ T5332] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 93.658188][ T5332] vfs_writev+0x343/0x990 [ 93.659950][ T5332] ? __pfx_vfs_writev+0x10/0x10 [ 93.662086][ T5332] ? __fget_files+0x2a/0x420 [ 93.664082][ T5332] ? __fget_files+0x3a2/0x420 [ 93.666188][ T5332] ? __fget_files+0x2a/0x420 [ 93.668142][ T5332] __se_sys_pwritev2+0x177/0x2a0 [ 93.670248][ T5332] ? __pfx___se_sys_pwritev2+0x10/0x10 [ 93.672321][ T5332] ? __x64_sys_pwritev2+0x20/0xc0 [ 93.674422][ T5332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.677055][ T5332] do_syscall_64+0x174/0x580 [ 93.678895][ T5332] ? trace_irq_disable+0x3b/0x140 [ 93.680937][ T5332] ? clear_bhb_loop+0x40/0x90 [ 93.682897][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.685271][ T5332] RIP: 0033:0x7f5d35b9e019 [ 93.686959][ T5332] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.693559][ T5332] RSP: 002b:00007f5d369fdfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000148 [ 93.696604][ T5332] RAX: ffffffffffffffda RBX: 00007f5d35e25fa0 RCX: 00007f5d35b9e019 [ 93.699363][ T5332] RDX: 0000000000000002 RSI: 0000200000001480 RDI: 0000000000000005 [ 93.701881][ T5332] RBP: 00007f5d35c3500c R08: 0000000000000f97 R09: 0000000000000014 [ 93.704503][ T5332] R10: 0000000000006de0 R11: 0000000000000246 R12: 0000000000000000 [ 93.707368][ T5332] R13: 00007f5d35e26038 R14: 00007f5d35e25fa0 R15: 00007ffe4d06ad08 [ 93.710164][ T5332] [ 93.711677][ T5332] Kernel Offset: disabled [ 93.713285][ T5332] Rebooting in 86400 seconds..