program: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./myconfig\x00', 0x1ff) mount(0x0, &(0x7f0000000280)='./myconfig\x00', &(0x7f00000002c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)="343431302c38381f30302c1d363030302c313700000000000000", 0x1a) symlinkat(&(0x7f00000005c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00') openat(r0, &(0x7f0000000040)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x18000, 0x168) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4080) tee(r1, r1, 0x7ff, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./myconfig/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r2, &(0x7f0000000680)='usbip-vudc.0', 0xc) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6}]}) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, 0x0) syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @hci_ev_disconn_complete={{0x5, 0x4}, {0x0, 0xc8, 0x15}}}, 0x7) r3 = syz_open_procfs(0x0, &(0x7f0000000100)='syscall\x00') ioctl$KVM_SET_TSC_KHZ_cpu(r3, 0xaea2, 0x7) socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000009a40)={&(0x7f00000003c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xf}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x4}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x801, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x955}]}], {0x14}}, 0x74}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x10}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x78}}, 0x0) syz_emit_ethernet(0x82, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000088a800008100000086dd605f106000442f00fc010000000000000000000000fba20000000000000000000000000000000001"], 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41100}, 0x94) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00'}, 0x90) r6 = socket(0x10, 0x2, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, &(0x7f0000000040)={0x6}, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_WOL_SET(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)={0x18, r7, 0xe7d02281b1d40447, 0x0, 0x0, {0xa, 0x0, 0x700}, [@ETHTOOL_A_WOL_HEADER={0x4}]}, 0x18}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) [ 94.915730][ T4638] Bluetooth: hci0: command tx timeout [ 95.023014][ T5312] ================================================================== [ 95.026613][ T5312] BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x225/0x2b0 [ 95.030200][ T5312] Free of addr ffff8880439db9cb by task syz.0.0/5312 [ 95.033178][ T5312] [ 95.034276][ T5312] CPU: 0 UID: 0 PID: 5312 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.034291][ T5312] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.034298][ T5312] Call Trace: [ 95.034303][ T5312] [ 95.034310][ T5312] dump_stack_lvl+0xe8/0x150 [ 95.034329][ T5312] print_address_description+0x55/0x1e0 [ 95.034344][ T5312] print_report+0x58/0x70 [ 95.034357][ T5312] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 95.034368][ T5312] kasan_report_invalid_free+0xea/0x110 [ 95.034383][ T5312] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 95.034395][ T5312] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 95.034407][ T5312] __kasan_slab_pre_free+0x104/0x120 [ 95.034419][ T5312] kfree+0x173/0x640 [ 95.034428][ T5312] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 95.034440][ T5312] f_uac2_opts_p_srate_store+0x225/0x2b0 [ 95.034452][ T5312] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 95.034465][ T5312] ? down_read+0x2be/0x330 [ 95.034479][ T5312] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 95.034490][ T5312] configfs_write_iter+0x337/0x430 [ 95.034502][ T5312] vfs_write+0x612/0xba0 [ 95.034520][ T5312] ? __pfx_vfs_write+0x10/0x10 [ 95.034545][ T5312] ? __fget_files+0x2a/0x420 [ 95.034562][ T5312] ksys_write+0x150/0x270 [ 95.034572][ T5312] ? __pfx_ksys_write+0x10/0x10 [ 95.034592][ T5312] do_syscall_64+0x166/0x520 [ 95.034603][ T5312] ? trace_irq_disable+0x3b/0x140 [ 95.034618][ T5312] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.034628][ T5312] ? clear_bhb_loop+0x70/0xc0 [ 95.034638][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.034648][ T5312] RIP: 0033:0x7f084c59e0d9 [ 95.034659][ T5312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.034668][ T5312] RSP: 002b:00007f084d3d3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 95.034680][ T5312] RAX: ffffffffffffffda RBX: 00007f084c825fa0 RCX: 00007f084c59e0d9 [ 95.034688][ T5312] RDX: 000000000000001a RSI: 0000200000000500 RDI: 0000000000000003 [ 95.034695][ T5312] RBP: 00007f084c635024 R08: 0000000000000000 R09: 0000000000000000 [ 95.034702][ T5312] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.034709][ T5312] R13: 00007f084c826038 R14: 00007f084c825fa0 R15: 00007ffd3cc56448 [ 95.034720][ T5312] [ 95.034726][ T5312] [ 95.137359][ T5312] Allocated by task 5312: [ 95.138876][ T5312] kasan_save_track+0x3e/0x80 [ 95.140511][ T5312] __kasan_kmalloc+0x93/0xb0 [ 95.142213][ T5312] __kmalloc_node_track_caller_noprof+0x4c7/0x740 [ 95.144419][ T5312] kstrdup+0x42/0x100 [ 95.146072][ T5312] f_uac2_opts_p_srate_store+0x11f/0x2b0 [ 95.148369][ T5312] configfs_write_iter+0x337/0x430 [ 95.150654][ T5312] vfs_write+0x612/0xba0 [ 95.152623][ T5312] ksys_write+0x150/0x270 [ 95.154511][ T5312] do_syscall_64+0x166/0x520 [ 95.156990][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.160273][ T5312] [ 95.161656][ T5312] The buggy address belongs to the object at ffff8880439db9c0 [ 95.161656][ T5312] which belongs to the cache kmalloc-32 of size 32 [ 95.167757][ T5312] The buggy address is located 11 bytes inside of [ 95.167757][ T5312] 20-byte region [ffff8880439db9c0, ffff8880439db9d4) [ 95.174298][ T5312] [ 95.175675][ T5312] The buggy address belongs to the physical page: [ 95.178937][ T5312] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880439db0c0 pfn:0x439db [ 95.183141][ T5312] flags: 0x4fff00000000200(workingset|node=1|zone=1|lastcpupid=0x7ff) [ 95.186316][ T5312] page_type: f5(slab) [ 95.187954][ T5312] raw: 04fff00000000200 ffff88801b041780 ffff8880304004c8 ffffea0000ffe490 [ 95.191506][ T5312] raw: ffff8880439db0c0 000000080040003a 00000000f5000000 0000000000000000 [ 95.195017][ T5312] page dumped because: kasan: bad access detected [ 95.197597][ T5312] page_owner tracks the page as allocated [ 95.199978][ T5312] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5256, tgid 5256 (dhcpcd), ts 77150852991 [ 95.206862][ T5312] post_alloc_hook+0x1f9/0x250 [ 95.208954][ T5312] get_page_from_freelist+0x2209/0x2280 [ 95.211135][ T5312] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 95.213661][ T5312] allocate_slab+0x7c/0x5e0 [ 95.215683][ T5312] refill_objects+0x2d5/0x350 [ 95.217733][ T5312] __pcs_replace_empty_main+0x2c3/0x6b0 [ 95.220034][ T5312] __kmalloc_cache_noprof+0x3ab/0x660 [ 95.222173][ T5312] kmem_cache_free+0x156/0x650 [ 95.224258][ T5312] vms_complete_munmap_vmas+0x897/0xbe0 [ 95.226635][ T5312] do_vmi_align_munmap+0x3b7/0x4b0 [ 95.228866][ T5312] do_vmi_munmap+0x252/0x2d0 [ 95.230889][ T5312] __vm_munmap+0x241/0x3e0 [ 95.232927][ T5312] __x64_sys_munmap+0x60/0x70 [ 95.234998][ T5312] do_syscall_64+0x166/0x520 [ 95.236771][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.239199][ T5312] page last free pid 5256 tgid 5256 ts 77150818543 stack trace: [ 95.242156][ T5312] __free_frozen_pages+0xc93/0xd90 [ 95.244274][ T5312] tlb_finish_mmu+0x13e/0x220 [ 95.246262][ T5312] unmap_region+0x2a5/0x330 [ 95.248237][ T5312] vms_complete_munmap_vmas+0x427/0xbe0 [ 95.250645][ T5312] do_vmi_align_munmap+0x3b7/0x4b0 [ 95.252750][ T5312] do_vmi_munmap+0x252/0x2d0 [ 95.254725][ T5312] __vm_munmap+0x241/0x3e0 [ 95.256707][ T5312] __x64_sys_munmap+0x60/0x70 [ 95.258747][ T5312] do_syscall_64+0x166/0x520 [ 95.260734][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.262912][ T5312] [ 95.263918][ T5312] Memory state around the buggy address: [ 95.266346][ T5312] ffff8880439db880: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 95.269647][ T5312] ffff8880439db900: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 95.272967][ T5312] >ffff8880439db980: fa fb fb fb fc fc fc fc 00 00 04 fc fc fc fc fc [ 95.276278][ T5312] ^ [ 95.278878][ T5312] ffff8880439dba00: 00 00 00 fc fc fc fc fc 00 00 00 fc fc fc fc fc [ 95.282015][ T5312] ffff8880439dba80: 00 00 00 00 fc fc fc fc fa fb fb fb fc fc fc fc [ 95.285414][ T5312] ================================================================== [ 95.313400][ T5312] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 95.316495][ T5312] CPU: 0 UID: 0 PID: 5312 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.320378][ T5312] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.324551][ T5312] Call Trace: [ 95.326029][ T5312] [ 95.327291][ T5312] vpanic+0x56d/0xa60 [ 95.329052][ T5312] ? __pfx_vpanic+0x10/0x10 [ 95.330999][ T5312] ? __pfx___schedule+0x10/0x10 [ 95.333012][ T5312] panic+0xc5/0xd0 [ 95.334616][ T5312] ? __pfx_panic+0x10/0x10 [ 95.336448][ T5312] ? preempt_schedule_common+0x7f/0xd0 [ 95.338696][ T5312] check_panic_on_warn+0x89/0xb0 [ 95.340802][ T5312] end_report+0x73/0x170 [ 95.342612][ T5312] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 95.345130][ T5312] kasan_report_invalid_free+0xfa/0x110 [ 95.347402][ T5312] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 95.349978][ T5312] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 95.352363][ T5312] __kasan_slab_pre_free+0x104/0x120 [ 95.354477][ T5312] kfree+0x173/0x640 [ 95.356095][ T5312] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 95.358553][ T5312] f_uac2_opts_p_srate_store+0x225/0x2b0 [ 95.360934][ T5312] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 95.363555][ T5312] ? down_read+0x2be/0x330 [ 95.365473][ T5312] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 95.368066][ T5312] configfs_write_iter+0x337/0x430 [ 95.370283][ T5312] vfs_write+0x612/0xba0 [ 95.372038][ T5312] ? __pfx_vfs_write+0x10/0x10 [ 95.374114][ T5312] ? __fget_files+0x2a/0x420 [ 95.375998][ T5312] ksys_write+0x150/0x270 [ 95.377865][ T5312] ? __pfx_ksys_write+0x10/0x10 [ 95.379974][ T5312] do_syscall_64+0x166/0x520 [ 95.381813][ T5312] ? trace_irq_disable+0x3b/0x140 [ 95.383929][ T5312] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.386458][ T5312] ? clear_bhb_loop+0x70/0xc0 [ 95.388279][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.390510][ T5312] RIP: 0033:0x7f084c59e0d9 [ 95.392433][ T5312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.400508][ T5312] RSP: 002b:00007f084d3d3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 95.403740][ T5312] RAX: ffffffffffffffda RBX: 00007f084c825fa0 RCX: 00007f084c59e0d9 [ 95.406771][ T5312] RDX: 000000000000001a RSI: 0000200000000500 RDI: 0000000000000003 [ 95.409890][ T5312] RBP: 00007f084c635024 R08: 0000000000000000 R09: 0000000000000000 [ 95.412940][ T5312] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.415833][ T5312] R13: 00007f084c826038 R14: 00007f084c825fa0 R15: 00007ffd3cc56448 [ 95.419005][ T5312] [ 95.420615][ T5312] Kernel Offset: disabled [ 95.422429][ T5312] Rebooting in 86400 seconds..