program: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000001c0)={0x1004, 0x0, 0x0, 'queue0\x00'}) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x208a80) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1c0000006800e97800000000000000000a0000000000000004000400"], 0x1c}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="2000ca060000e97800000000000000000a0000000500", @ANYRES32=r4, @ANYBLOB], 0x20}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000380)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x4090) r5 = socket(0x10, 0x3, 0x0) write(r5, &(0x7f00000011c0)="240000001a005f0214f9f407000904001f00000000000000000000000800040001000000", 0x24) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000400)={0x20000, 0x0, {0x0, 0x0, 0x0, 0x1}, 0x8}) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/seq/timer\x00', 0x0, 0x0) read$char_usb(r6, &(0x7f00000001c0)=""/4068, 0xfe4) r7 = userfaultfd(0x1) ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f0000000040)) ioctl$UFFDIO_WRITEPROTECT(r7, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000800000/0x800000)=nil, 0x802000}, 0x2}) r8 = fcntl$dupfd(r7, 0x0, r7) ioctl$UFFDIO_CONTINUE(r8, 0xc020aa08, &(0x7f00000000c0)={{&(0x7f0000800000/0x800000)=nil, 0x800000}}) syz_open_procfs(0x0, &(0x7f00000000c0)='smaps_rollup\x00') preadv(r8, &(0x7f0000000080)=[{&(0x7f0000000000)=""/92, 0x5c}], 0x1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r9 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0) write(r9, &(0x7f0000000000)="34343130162c34", 0x7) [ 86.488234][ T5322] ================================================================== [ 86.491630][ T5322] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0 [ 86.495083][ T5322] Free of addr ffff888044658c46 by task syz.0.0/5322 [ 86.497873][ T5322] [ 86.498909][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 86.498925][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.498932][ T5322] Call Trace: [ 86.498939][ T5322] [ 86.498945][ T5322] dump_stack_lvl+0xe8/0x150 [ 86.498967][ T5322] print_address_description+0x55/0x1e0 [ 86.498986][ T5322] print_report+0x58/0x70 [ 86.499001][ T5322] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 86.499016][ T5322] kasan_report_invalid_free+0xea/0x110 [ 86.499033][ T5322] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 86.499049][ T5322] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 86.499065][ T5322] __kasan_slab_pre_free+0x104/0x120 [ 86.499080][ T5322] kfree+0x173/0x640 [ 86.499091][ T5322] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 86.499107][ T5322] f_uac2_opts_c_srate_store+0x225/0x2b0 [ 86.499123][ T5322] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 86.499139][ T5322] ? down_read+0x2be/0x330 [ 86.499154][ T5322] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 86.499170][ T5322] configfs_write_iter+0x337/0x430 [ 86.499187][ T5322] vfs_write+0x612/0xba0 [ 86.499206][ T5322] ? __pfx_vfs_write+0x10/0x10 [ 86.499224][ T5322] ? __fget_files+0x2a/0x420 [ 86.499240][ T5322] ksys_write+0x150/0x270 [ 86.499255][ T5322] ? __pfx_ksys_write+0x10/0x10 [ 86.499273][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.499284][ T5322] do_syscall_64+0x174/0x580 [ 86.499298][ T5322] ? trace_irq_disable+0x3b/0x140 [ 86.499311][ T5322] ? clear_bhb_loop+0x70/0xc0 [ 86.499325][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.499338][ T5322] RIP: 0033:0x7f2c0d59e0d9 [ 86.499351][ T5322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 86.499361][ T5322] RSP: 002b:00007f2c0e514fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 86.499377][ T5322] RAX: ffffffffffffffda RBX: 00007f2c0d825fa0 RCX: 00007f2c0d59e0d9 [ 86.499386][ T5322] RDX: 0000000000000007 RSI: 0000200000000000 RDI: 000000000000000e [ 86.499394][ T5322] RBP: 00007f2c0d635024 R08: 0000000000000000 R09: 0000000000000000 [ 86.499402][ T5322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 86.499410][ T5322] R13: 00007f2c0d826038 R14: 00007f2c0d825fa0 R15: 00007ffe0a4383a8 [ 86.499424][ T5322] [ 86.499429][ T5322] [ 86.595625][ T5322] Allocated by task 5322: [ 86.597510][ T5322] kasan_save_track+0x3e/0x80 [ 86.599470][ T5322] __kasan_kmalloc+0x93/0xb0 [ 86.601555][ T5322] __kmalloc_node_track_caller_noprof+0x4c3/0x730 [ 86.604109][ T5322] kstrdup+0x42/0x100 [ 86.605856][ T5322] f_uac2_opts_c_srate_store+0x11f/0x2b0 [ 86.608253][ T5322] configfs_write_iter+0x337/0x430 [ 86.610492][ T5322] vfs_write+0x612/0xba0 [ 86.612376][ T5322] ksys_write+0x150/0x270 [ 86.614640][ T5322] do_syscall_64+0x174/0x580 [ 86.617046][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.619518][ T5322] [ 86.620624][ T5322] The buggy address belongs to the object at ffff888044658c40 [ 86.620624][ T5322] which belongs to the cache kmalloc-8 of size 8 [ 86.626570][ T5322] The buggy address is located 6 bytes inside of [ 86.626570][ T5322] 8-byte region [ffff888044658c40, ffff888044658c48) [ 86.632738][ T5322] [ 86.633789][ T5322] The buggy address belongs to the physical page: [ 86.636953][ T5322] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888044658da0 pfn:0x44658 [ 86.641217][ T5322] flags: 0x4fff00000000200(workingset|node=1|zone=1|lastcpupid=0x7ff) [ 86.644446][ T5322] page_type: f5(slab) [ 86.646058][ T5322] raw: 04fff00000000200 ffff88801b041500 ffff888030400348 ffffea0000dee1d0 [ 86.649727][ T5322] raw: ffff888044658da0 000000080080006d 00000000f5000000 0000000000000000 [ 86.653091][ T5322] page dumped because: kasan: bad access detected [ 86.655675][ T5322] page_owner tracks the page as allocated [ 86.658073][ T5322] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5285, tgid 5285 (syz-executor), ts 83222000983, free_ts 83080314136 [ 86.667074][ T5322] post_alloc_hook+0x1f9/0x250 [ 86.669145][ T5322] get_page_from_freelist+0x21fa/0x2270 [ 86.671400][ T5322] __alloc_frozen_pages_noprof+0x18d/0x380 [ 86.673839][ T5322] allocate_slab+0x79/0x5e0 [ 86.675733][ T5322] refill_objects+0x2d5/0x350 [ 86.677770][ T5322] __pcs_replace_empty_main+0x2bf/0x6b0 [ 86.680079][ T5322] __kmalloc_node_track_caller_noprof+0x557/0x730 [ 86.682760][ T5322] kstrdup+0x42/0x100 [ 86.684537][ T5322] __kernfs_new_node+0xa9/0x980 [ 86.686566][ T5322] kernfs_create_dir_ns+0xfe/0x230 [ 86.688769][ T5322] sysfs_create_dir_ns+0x12f/0x2a0 [ 86.690957][ T5322] kobject_add_internal+0x622/0xcd0 [ 86.693184][ T5322] kobject_init_and_add+0x12b/0x1a0 [ 86.695351][ T5322] net_rx_queue_update_kobjects+0x247/0x780 [ 86.697844][ T5322] netdev_register_kobject+0x21f/0x310 [ 86.700164][ T5322] register_netdevice+0x1433/0x1eb0 [ 86.702238][ T5322] page last free pid 5285 tgid 5285 stack trace: [ 86.704940][ T5322] __free_frozen_pages+0xc1e/0xd10 [ 86.707101][ T5322] __slab_free+0x274/0x2c0 [ 86.709139][ T5322] qlist_free_all+0x99/0x100 [ 86.711203][ T5322] kasan_quarantine_reduce+0x148/0x160 [ 86.713571][ T5322] __kasan_slab_alloc+0x22/0x80 [ 86.715429][ T5322] __kmalloc_cache_noprof+0x2ab/0x660 [ 86.717405][ T5322] ref_tracker_alloc+0x15b/0x4b0 [ 86.719500][ T5322] netdev_queue_update_kobjects+0x1d1/0x6b0 [ 86.721935][ T5322] netdev_register_kobject+0x258/0x310 [ 86.724238][ T5322] register_netdevice+0x1433/0x1eb0 [ 86.726483][ T5322] veth_newlink+0x676/0xb70 [ 86.728490][ T5322] rtnl_newlink_create+0x310/0xb00 [ 86.730641][ T5322] rtnl_newlink+0x167f/0x1bd0 [ 86.732682][ T5322] rtnetlink_rcv_msg+0x802/0xc00 [ 86.734781][ T5322] netlink_rcv_skb+0x226/0x4a0 [ 86.736815][ T5322] netlink_unicast+0x7bb/0x940 [ 86.738779][ T5322] [ 86.739815][ T5322] Memory state around the buggy address: [ 86.742273][ T5322] ffff888044658b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 86.745548][ T5322] ffff888044658b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 86.748914][ T5322] >ffff888044658c00: fc fc fc fc fc fc fc fc 00 fc fc fc 02 fc fc fc [ 86.752217][ T5322] ^ [ 86.754737][ T5322] ffff888044658c80: 00 fc fc fc 00 fc fc fc 00 fc fc fc 00 fc fc fc [ 86.758019][ T5322] ffff888044658d00: 00 fc fc fc 00 fc fc fc 00 fc fc fc 00 fc fc fc [ 86.761354][ T5322] ================================================================== [ 86.774662][ T4650] Bluetooth: hci0: command tx timeout [ 86.797508][ T5322] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 86.800421][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 86.804172][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.808385][ T5322] Call Trace: [ 86.809808][ T5322] [ 86.811085][ T5322] vpanic+0x56c/0xa60 [ 86.812803][ T5322] ? __pfx_vpanic+0x10/0x10 [ 86.814723][ T5322] ? __pfx___schedule+0x10/0x10 [ 86.816793][ T5322] panic+0xc5/0xd0 [ 86.818369][ T5322] ? __pfx_panic+0x10/0x10 [ 86.820256][ T5322] ? preempt_schedule_common+0x82/0xd0 [ 86.822489][ T5322] check_panic_on_warn+0x89/0xb0 [ 86.824655][ T5322] end_report+0x73/0x170 [ 86.826490][ T5322] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 86.829070][ T5322] kasan_report_invalid_free+0xfa/0x110 [ 86.831463][ T5322] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 86.833889][ T5322] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 86.836454][ T5322] __kasan_slab_pre_free+0x104/0x120 [ 86.838731][ T5322] kfree+0x173/0x640 [ 86.840509][ T5322] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 86.843025][ T5322] f_uac2_opts_c_srate_store+0x225/0x2b0 [ 86.845461][ T5322] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 86.848198][ T5322] ? down_read+0x2be/0x330 [ 86.850068][ T5322] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 86.852684][ T5322] configfs_write_iter+0x337/0x430 [ 86.854880][ T5322] vfs_write+0x612/0xba0 [ 86.856779][ T5322] ? __pfx_vfs_write+0x10/0x10 [ 86.858900][ T5322] ? __fget_files+0x2a/0x420 [ 86.860945][ T5322] ksys_write+0x150/0x270 [ 86.862856][ T5322] ? __pfx_ksys_write+0x10/0x10 [ 86.864998][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.867537][ T5322] do_syscall_64+0x174/0x580 [ 86.869653][ T5322] ? trace_irq_disable+0x3b/0x140 [ 86.871788][ T5322] ? clear_bhb_loop+0x70/0xc0 [ 86.873752][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.876268][ T5322] RIP: 0033:0x7f2c0d59e0d9 [ 86.878258][ T5322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 86.886291][ T5322] RSP: 002b:00007f2c0e514fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 86.889729][ T5322] RAX: ffffffffffffffda RBX: 00007f2c0d825fa0 RCX: 00007f2c0d59e0d9 [ 86.893044][ T5322] RDX: 0000000000000007 RSI: 0000200000000000 RDI: 000000000000000e [ 86.896375][ T5322] RBP: 00007f2c0d635024 R08: 0000000000000000 R09: 0000000000000000 [ 86.899685][ T5322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 86.903141][ T5322] R13: 00007f2c0d826038 R14: 00007f2c0d825fa0 R15: 00007ffe0a4383a8 [ 86.906532][ T5322] [ 86.908262][ T5322] Kernel Offset: disabled [ 86.910087][ T5322] Rebooting in 86400 seconds..