program: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff) r0 = fsmount(0xffffffffffffffff, 0x0, 0xe) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000000)={0x7, 0x3, 0x4, 0x8, 0xfffffff8}) openat(0xffffffffffffff9c, 0x0, 0x84fd92f06f664ba7, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x7, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r2 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_int(r2, 0x29, 0x19, &(0x7f0000000000)=0x84, 0xfde1) sendto$inet6(r2, 0x0, 0x0, 0x200cc0c5, &(0x7f0000000080)={0xa, 0x4c20, 0x0, @mcast2}, 0x1c) sendto$inet6(r2, &(0x7f0000001cc0)="2501d77b330b7e73d6b1d1b8a473ff7420b4b43ce0861f000000714fa228ee1f5b48", 0xfffffffffffffe57, 0x8000, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x21, &(0x7f0000000040)=0x40, 0x4) recvmmsg(r2, &(0x7f0000002480)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40002003, 0x0) r3 = gettid() timer_create(0x1, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)=0x0) timer_settime(r4, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) pipe2$9p(&(0x7f0000000000), 0x0) readv(0xffffffffffffffff, &(0x7f0000002980)=[{&(0x7f0000000700)=""/163, 0xa3}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0) write(r5, &(0x7f0000000040)="34343130302c34383030302c38383230302cb6f178da0d3b9792f5fd86eb8639363030302c3137363430302c3139323030302c3335323830731251091a0f83ce2f47905b22035b192d50fcc52ebd0ec21a61f0acb72889ac26f29e7f64a8596fdf2b8e1e110cb021ecb26693346cdd36de9d398e649889646aaa07b734c136a5835ff4c3807c0d370831bcba71834cc1df935fc117a78d906590e71bac95815cf69c82000683012ea8546900"/185, 0xb9) r6 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/comedi4\x00', 0x109040, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$COMEDI_CMD(r6, 0x80506409, &(0x7f0000000180)={0x1, 0x80, 0x80, 0xd, 0x10, 0x3e8, 0x2, 0x0, 0x20, 0x1, 0x20, 0xffffffff, &(0x7f0000000600)=[0x7], 0x1, 0x0}) pselect6(0x40, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0xffffffffffbffff9, 0x80000000000, 0x0, 0xfffffffffffff30a, 0x5}, &(0x7f0000000000)={0x1c, 0x26d7, 0x2, 0x0, 0xfffffffffffffffc, 0x0, 0x6, 0x9}, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0) symlinkat(&(0x7f0000000580)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00') [ 93.594326][ T4653] Bluetooth: hci0: command tx timeout [ 93.691207][ T24] audit: type=1326 audit(1785528590.113:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5330 comm="syz.0.0" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fed8d99e019 code=0x7ffc0000 [ 93.721540][ T24] audit: type=1326 audit(1785528590.123:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5330 comm="syz.0.0" exe="/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fed8d99e019 code=0x7ffc0000 [ 93.749678][ T5331] ================================================================== [ 93.752825][ T5331] BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x225/0x2b0 [ 93.756212][ T5331] Free of addr ffff88803362d125 by task syz.0.0/5331 [ 93.759082][ T5331] [ 93.760114][ T5331] CPU: 0 UID: 0 PID: 5331 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.760130][ T5331] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.760137][ T5331] Call Trace: [ 93.760145][ T5331] [ 93.760151][ T5331] dump_stack_lvl+0xe8/0x150 [ 93.760168][ T5331] print_address_description+0x55/0x1e0 [ 93.760180][ T5331] print_report+0x58/0x70 [ 93.760189][ T5331] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 93.760199][ T5331] kasan_report_invalid_free+0xea/0x110 [ 93.760209][ T5331] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 93.760217][ T5331] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 93.760224][ T5331] __kasan_slab_pre_free+0x104/0x120 [ 93.760232][ T5331] kfree+0x173/0x640 [ 93.760238][ T5331] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 93.760247][ T5331] f_uac2_opts_p_srate_store+0x225/0x2b0 [ 93.760255][ T5331] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 93.760263][ T5331] ? down_read+0x2be/0x330 [ 93.760271][ T5331] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 93.760281][ T5331] configfs_write_iter+0x337/0x430 [ 93.760296][ T5331] vfs_write+0x612/0xba0 [ 93.760312][ T5331] ? __pfx_vfs_write+0x10/0x10 [ 93.760329][ T5331] ? __fget_files+0x2a/0x420 [ 93.760344][ T5331] ksys_write+0x150/0x270 [ 93.760360][ T5331] ? __pfx_ksys_write+0x10/0x10 [ 93.760375][ T5331] ? __secure_computing+0xe7/0x2b0 [ 93.760385][ T5331] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.760392][ T5331] do_syscall_64+0x174/0x580 [ 93.760399][ T5331] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.760405][ T5331] ? clear_bhb_loop+0x40/0x90 [ 93.760412][ T5331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.760419][ T5331] RIP: 0033:0x7fed8d99e019 [ 93.760427][ T5331] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.760433][ T5331] RSP: 002b:00007fed8e8affe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 93.760445][ T5331] RAX: ffffffffffffffda RBX: 00007fed8dc25fa0 RCX: 00007fed8d99e019 [ 93.760453][ T5331] RDX: 00000000000000b9 RSI: 0000200000000040 RDI: 0000000000000006 [ 93.760459][ T5331] RBP: 00007fed8da3500c R08: 0000000000000000 R09: 0000000000000000 [ 93.760466][ T5331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 93.760473][ T5331] R13: 00007fed8dc26038 R14: 00007fed8dc25fa0 R15: 00007ffd1a1b9968 [ 93.760490][ T5331] [ 93.760495][ T5331] [ 93.862340][ T5331] Allocated by task 5331: [ 93.864242][ T5331] kasan_save_track+0x3e/0x80 [ 93.866211][ T5331] __kasan_kmalloc+0x93/0xb0 [ 93.868140][ T5331] __kmalloc_node_track_caller_noprof+0x4c3/0x730 [ 93.870735][ T5331] kstrdup+0x42/0x100 [ 93.872385][ T5331] f_uac2_opts_p_srate_store+0x11f/0x2b0 [ 93.874633][ T5331] configfs_write_iter+0x337/0x430 [ 93.876765][ T5331] vfs_write+0x612/0xba0 [ 93.878510][ T5331] ksys_write+0x150/0x270 [ 93.880406][ T5331] do_syscall_64+0x174/0x580 [ 93.882273][ T5331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.884895][ T5331] [ 93.885903][ T5331] The buggy address belongs to the object at ffff88803362d100 [ 93.885903][ T5331] which belongs to the cache kmalloc-192 of size 192 [ 93.891166][ T5331] The buggy address is located 37 bytes inside of [ 93.891166][ T5331] 164-byte region [ffff88803362d100, ffff88803362d1a4) [ 93.896411][ T5331] [ 93.897454][ T5331] The buggy address belongs to the physical page: [ 93.900176][ T5331] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3362d [ 93.903839][ T5331] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 93.906740][ T5331] page_type: f5(slab) [ 93.908357][ T5331] raw: 04fff00000000000 ffff88801b0413c0 dead000000000100 dead000000000122 [ 93.911664][ T5331] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 93.914823][ T5331] page dumped because: kasan: bad access detected [ 93.917395][ T5331] page_owner tracks the page as allocated [ 93.919714][ T5331] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 10788707980, free_ts 0 [ 93.927605][ T5331] post_alloc_hook+0x1f9/0x250 [ 93.929634][ T5331] get_page_from_freelist+0x21fa/0x2270 [ 93.931939][ T5331] __alloc_frozen_pages_noprof+0x18d/0x380 [ 93.934361][ T5331] allocate_slab+0x79/0x5e0 [ 93.936380][ T5331] refill_objects+0x2d5/0x350 [ 93.938615][ T5331] __pcs_replace_empty_main+0x2bf/0x6b0 [ 93.940933][ T5331] __kmalloc_cache_noprof+0x3a7/0x660 [ 93.943164][ T5331] call_usermodehelper_setup+0x8e/0x270 [ 93.945381][ T5331] kobject_uevent_env+0x662/0x9e0 [ 93.947491][ T5331] tty_register_device_attr+0x573/0x950 [ 93.949848][ T5331] tty_register_driver+0x82c/0xdf0 [ 93.951972][ T5331] legacy_pty_init+0x3a2/0x5d0 [ 93.954026][ T5331] pty_init+0x9/0x20 [ 93.955890][ T5331] do_one_initcall+0x250/0x870 [ 93.957901][ T5331] do_initcall_level+0x10a/0x1a0 [ 93.960131][ T5331] do_initcalls+0x59/0xa0 [ 93.961925][ T5331] page_owner free stack trace missing [ 93.964154][ T5331] [ 93.965170][ T5331] Memory state around the buggy address: [ 93.967407][ T5331] ffff88803362d000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 93.970697][ T5331] ffff88803362d080: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc [ 93.973576][ T5331] >ffff88803362d100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 93.976348][ T5331] ^ [ 93.978437][ T5331] ffff88803362d180: 00 00 00 00 04 fc fc fc fc fc fc fc fc fc fc fc [ 93.981764][ T5331] ffff88803362d200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 93.984955][ T5331] ================================================================== [ 93.998892][ T24] audit: type=1326 audit(1785528590.123:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5330 comm="syz.0.0" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fed8d99e019 code=0x7ffc0000 [ 94.012576][ T24] audit: type=1326 audit(1785528590.123:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5330 comm="syz.0.0" exe="/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7fed8d99e019 code=0x7ffc0000 [ 94.020600][ T24] audit: type=1326 audit(1785528590.123:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5330 comm="syz.0.0" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fed8d99e019 code=0x7ffc0000 [ 94.029313][ T24] audit: type=1326 audit(1785528590.123:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5330 comm="syz.0.0" exe="/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7fed8d99e019 code=0x7ffc0000 [ 94.037445][ T24] audit: type=1326 audit(1785528590.123:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5330 comm="syz.0.0" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fed8d99e019 code=0x7ffc0000 [ 94.046322][ T24] audit: type=1326 audit(1785528590.123:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5330 comm="syz.0.0" exe="/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7fed8d99e019 code=0x7ffc0000 [ 94.060125][ T24] audit: type=1326 audit(1785528590.123:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5330 comm="syz.0.0" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fed8d99e019 code=0x7ffc0000 [ 94.077911][ T24] audit: type=1326 audit(1785528590.123:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5330 comm="syz.0.0" exe="/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7fed8d99e019 code=0x7ffc0000 [ 94.103678][ T5331] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 94.106575][ T5331] CPU: 0 UID: 0 PID: 5331 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.109577][ T5331] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.113551][ T5331] Call Trace: [ 94.114892][ T5331] [ 94.116110][ T5331] vpanic+0x56c/0xa60 [ 94.117714][ T5331] ? __pfx_vpanic+0x10/0x10 [ 94.119604][ T5331] ? __pfx___schedule+0x10/0x10 [ 94.121646][ T5331] panic+0xc5/0xd0 [ 94.123199][ T5331] ? __pfx_panic+0x10/0x10 [ 94.125067][ T5331] ? preempt_schedule_common+0x82/0xd0 [ 94.127263][ T5331] check_panic_on_warn+0x89/0xb0 [ 94.129174][ T5331] end_report+0x73/0x170 [ 94.130826][ T5331] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 94.133192][ T5331] kasan_report_invalid_free+0xfa/0x110 [ 94.135482][ T5331] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 94.137708][ T5331] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 94.139758][ T5331] __kasan_slab_pre_free+0x104/0x120 [ 94.141684][ T5331] kfree+0x173/0x640 [ 94.143089][ T5331] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 94.145123][ T5331] f_uac2_opts_p_srate_store+0x225/0x2b0 [ 94.147095][ T5331] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 94.149340][ T5331] ? down_read+0x2be/0x330 [ 94.151130][ T5331] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 94.153601][ T5331] configfs_write_iter+0x337/0x430 [ 94.155731][ T5331] vfs_write+0x612/0xba0 [ 94.157519][ T5331] ? __pfx_vfs_write+0x10/0x10 [ 94.159519][ T5331] ? __fget_files+0x2a/0x420 [ 94.161474][ T5331] ksys_write+0x150/0x270 [ 94.163241][ T5331] ? __pfx_ksys_write+0x10/0x10 [ 94.165173][ T5331] ? __secure_computing+0xe7/0x2b0 [ 94.167229][ T5331] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.169973][ T5331] do_syscall_64+0x174/0x580 [ 94.171860][ T5331] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.174311][ T5331] ? clear_bhb_loop+0x40/0x90 [ 94.176285][ T5331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.178614][ T5331] RIP: 0033:0x7fed8d99e019 [ 94.180354][ T5331] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.188070][ T5331] RSP: 002b:00007fed8e8affe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 94.191396][ T5331] RAX: ffffffffffffffda RBX: 00007fed8dc25fa0 RCX: 00007fed8d99e019 [ 94.194615][ T5331] RDX: 00000000000000b9 RSI: 0000200000000040 RDI: 0000000000000006 [ 94.197827][ T5331] RBP: 00007fed8da3500c R08: 0000000000000000 R09: 0000000000000000 [ 94.201112][ T5331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.204228][ T5331] R13: 00007fed8dc26038 R14: 00007fed8dc25fa0 R15: 00007ffd1a1b9968 [ 94.207336][ T5331] [ 94.208922][ T5331] Kernel Offset: disabled [ 94.210665][ T5331] Rebooting in 86400 seconds..