program: sendmsg$NL80211_CMD_JOIN_IBSS(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={0x0, 0x248}, 0x1, 0x0, 0x0, 0x4010}, 0x800) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000440)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000800)="21ae1baf930b4569b9ddef9797ffd935c7d80e6466b3e4e62dc9603583f5d4b61fbc65b6ac744d7319535e75bf552062e4cfde1ba7ce29263322e18ea9740aa82ca692f123993e57cda00d2b1f4e799bd41e3f76258180fa91a42aaa8b1ebc4e0ea8fb12f2c71e6e5bc57a8e91f254005514721d93c13c5606ae1fea7f31f558d562bd5a8dfb0b9fed873efa221fccffa847cd374c92e6cbb03e6a9de890ce323f000000abcc6c01326d588495b7c1a7db31ec4129e6336f26bb9e0b7552af3cd2d5dda1632799bbc98425c433384d8a8e4071ff39a36dfdfdf05af35a4ddd340cfecd7ec935f4ce7d3e851583ba1cf53a90a7f7bce5703de57ce93ddef7849b30a01de0637e6d5e507b801d32e582e0c2d564539ebfc84c", 0x118}, {&(0x7f0000000140)="f610e61ac81cc3edc86f0500194d27a5a443f10dfd1ecda0fd0ed9a444b7fb76afe3a0002f0a5eafcd3555a6cad574af080de74a37f54ee5f10fe3f42b445293ca980200000000000000ecfd6cc1b3a9a9263506e88c5557069d0ca055991454ec1307b7411892a1beaef9ae54833107eb88b0411b1bc0ba9bc28d0eb6a73ad76be9facd1d9d82b6a3cc2040e84b398d279e50535b6557df8a633cfc7615fca9879b11834eb07eeb4278cab057f89b7464048cf573c21df5435e", 0xba}], 0x2, 0x0, 0x0, 0x900}}], 0x1, 0x0) r0 = socket(0x10, 0x803, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x40980, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000db0a0101"], 0x1e4}}, 0x0) write$binfmt_misc(r3, &(0x7f0000000000), 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x7fff, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r1, 0x400455c8, 0x4) syz_usb_connect$uac1(0x4, 0x72, 0x0, 0x0) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff) r6 = socket(0x10, 0x3, 0x0) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="d5"], 0x24}}, 0x0) recvmmsg$unix(r6, &(0x7f0000000900)=[{{0x0, 0x0, &(0x7f0000001bc0)=[{&(0x7f00000002c0)=""/88, 0x58}, {&(0x7f0000003100)=""/264, 0x108}, {&(0x7f0000003240)=""/4095, 0xfff}, {&(0x7f0000001a00)=""/196, 0xc4}, {&(0x7f00000004c0)=""/183, 0xb7}], 0x5}}], 0x1, 0x0, 0x0) write(r6, &(0x7f0000000100)="1400000052004f7fb3e4bf80a000080000000000", 0x14) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r7 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0) write(r7, &(0x7f0000000680)="34343130302c3438b1ee302c38383230302c39363030302c3137363430302c313932303030433335323830302c337856706fb50ec671c4b68734039c6f4a0ceb6012c84a25b2c45a64d84db832745d92f05a3958", 0x54) quotactl_fd$Q_QUOTAOFF(r5, 0xffffffff80000301, 0x0, 0x0) symlinkat(&(0x7f0000000580)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00') r8 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x265) write(r8, &(0x7f0000000640)='usbip-vudc.0', 0xc) sendto(r0, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) [ 123.848684][ T4653] Bluetooth: hci0: command tx timeout [ 123.978881][ T5337] ================================================================== [ 123.985712][ T5337] BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x225/0x2b0 [ 123.989813][ T5337] Free of addr ffff8880124ca60c by task syz.0.0/5337 [ 123.992572][ T5337] [ 123.993721][ T5337] CPU: 0 UID: 0 PID: 5337 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 123.993740][ T5337] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 123.993750][ T5337] Call Trace: [ 123.993783][ T5337] [ 123.993791][ T5337] dump_stack_lvl+0xe8/0x150 [ 123.993816][ T5337] print_address_description+0x55/0x1e0 [ 123.993837][ T5337] print_report+0x58/0x70 [ 123.993852][ T5337] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 123.993874][ T5337] kasan_report_invalid_free+0xea/0x110 [ 123.993894][ T5337] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 123.993910][ T5337] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 123.993926][ T5337] __kasan_slab_pre_free+0x104/0x120 [ 123.993943][ T5337] kfree+0x173/0x640 [ 123.993955][ T5337] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 123.993970][ T5337] f_uac2_opts_p_srate_store+0x225/0x2b0 [ 123.993995][ T5337] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 123.994010][ T5337] ? down_read+0x2be/0x330 [ 123.994024][ T5337] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 123.994039][ T5337] configfs_write_iter+0x337/0x430 [ 123.994062][ T5337] vfs_write+0x612/0xba0 [ 123.994082][ T5337] ? __pfx_vfs_write+0x10/0x10 [ 123.994100][ T5337] ? __fget_files+0x2a/0x420 [ 123.994117][ T5337] ksys_write+0x150/0x270 [ 123.994140][ T5337] ? __pfx_ksys_write+0x10/0x10 [ 123.994158][ T5337] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.994172][ T5337] do_syscall_64+0x174/0x580 [ 123.994191][ T5337] ? trace_irq_disable+0x3b/0x140 [ 123.994206][ T5337] ? clear_bhb_loop+0x40/0x90 [ 123.994221][ T5337] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.994234][ T5337] RIP: 0033:0x7fa10cd9de99 [ 123.994265][ T5337] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 123.994277][ T5337] RSP: 002b:00007fa10dcc5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 123.994293][ T5337] RAX: ffffffffffffffda RBX: 00007fa10d026090 RCX: 00007fa10cd9de99 [ 123.994304][ T5337] RDX: 0000000000000054 RSI: 0000200000000680 RDI: 000000000000000a [ 123.994313][ T5337] RBP: 00007fa10ce33eaf R08: 0000000000000000 R09: 0000000000000000 [ 123.994321][ T5337] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 123.994329][ T5337] R13: 00007fa10d026128 R14: 00007fa10d026090 R15: 00007ffc38e463d8 [ 123.994344][ T5337] [ 123.994349][ T5337] [ 124.090727][ T5337] Allocated by task 5337: [ 124.092532][ T5337] kasan_save_track+0x3e/0x80 [ 124.094564][ T5337] __kasan_kmalloc+0x93/0xb0 [ 124.096348][ T5337] __kmalloc_node_track_caller_noprof+0x4c3/0x730 [ 124.098980][ T5337] kstrdup+0x42/0x100 [ 124.100685][ T5337] f_uac2_opts_p_srate_store+0x11f/0x2b0 [ 124.102912][ T5337] configfs_write_iter+0x337/0x430 [ 124.105034][ T5337] vfs_write+0x612/0xba0 [ 124.107054][ T5337] ksys_write+0x150/0x270 [ 124.109051][ T5337] do_syscall_64+0x174/0x580 [ 124.111470][ T5337] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.114071][ T5337] [ 124.115089][ T5337] The buggy address belongs to the object at ffff8880124ca600 [ 124.115089][ T5337] which belongs to the cache kmalloc-96 of size 96 [ 124.121101][ T5337] The buggy address is located 12 bytes inside of [ 124.121101][ T5337] 85-byte region [ffff8880124ca600, ffff8880124ca655) [ 124.126390][ T5337] [ 124.127500][ T5337] The buggy address belongs to the physical page: [ 124.130134][ T5337] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x124ca [ 124.133771][ T5337] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 124.136804][ T5337] page_type: f5(slab) [ 124.138582][ T5337] raw: 00fff00000000000 ffff88801b041280 dead000000000122 0000000000000000 [ 124.142167][ T5337] raw: 0000000000000000 0000000800200020 00000000f5000000 0000000000000000 [ 124.145682][ T5337] page dumped because: kasan: bad access detected [ 124.148359][ T5337] page_owner tracks the page as allocated [ 124.150658][ T5337] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 24, tgid 24 (kworker/u4:2), ts 123942602619, free_ts 123940797900 [ 124.158893][ T5337] post_alloc_hook+0x1f9/0x250 [ 124.160847][ T5337] get_page_from_freelist+0x21fa/0x2270 [ 124.163109][ T5337] __alloc_frozen_pages_noprof+0x18d/0x380 [ 124.165681][ T5337] allocate_slab+0x79/0x5e0 [ 124.167548][ T5337] refill_objects+0x2d5/0x350 [ 124.169581][ T5337] __pcs_replace_empty_main+0x2bf/0x6b0 [ 124.171780][ T5337] __kmalloc_cache_noprof+0x3a7/0x660 [ 124.173964][ T5337] dst_cow_metrics_generic+0x56/0x1c0 [ 124.176135][ T5337] icmp6_dst_alloc+0x265/0x430 [ 124.178000][ T5337] mld_sendpack+0x697/0xe10 [ 124.179785][ T5337] ipv6_mc_dad_complete+0x87/0x410 [ 124.181857][ T5337] addrconf_dad_completed+0x8af/0xe60 [ 124.184044][ T5337] addrconf_dad_work+0xcf8/0x15c0 [ 124.186051][ T5337] process_scheduled_works+0xa8e/0x14e0 [ 124.188216][ T5337] worker_thread+0xa47/0xfb0 [ 124.190033][ T5337] kthread+0x388/0x470 [ 124.191576][ T5337] page last free pid 5337 tgid 5335 stack trace: [ 124.194077][ T5337] free_pages_prepare+0x960/0xa60 [ 124.196280][ T5337] __free_contig_range_common+0x174/0x340 [ 124.198725][ T5337] free_pages_bulk+0x48/0x120 [ 124.200706][ T5337] vfree+0x224/0x4a0 [ 124.202308][ T5337] n_tty_close+0x147/0x1c0 [ 124.204184][ T5337] tty_set_ldisc+0x331/0x540 [ 124.206193][ T5337] tty_ioctl+0xc30/0xdd0 [ 124.207774][ T5337] __se_sys_ioctl+0xfc/0x170 [ 124.209528][ T5337] do_syscall_64+0x174/0x580 [ 124.211792][ T5337] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.214476][ T5337] [ 124.215445][ T5337] Memory state around the buggy address: [ 124.217732][ T5337] ffff8880124ca500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 124.220901][ T5337] ffff8880124ca580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 124.224263][ T5337] >ffff8880124ca600: 00 00 00 00 00 00 00 00 00 00 05 fc fc fc fc fc [ 124.227615][ T5337] ^ [ 124.229355][ T5337] ffff8880124ca680: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc [ 124.232556][ T5337] ffff8880124ca700: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc [ 124.235902][ T5337] ================================================================== [ 124.263464][ T5337] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 124.266447][ T5337] CPU: 0 UID: 0 PID: 5337 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 124.269944][ T5337] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 124.273991][ T5337] Call Trace: [ 124.275435][ T5337] [ 124.276881][ T5337] vpanic+0x56c/0xa60 [ 124.278617][ T5337] ? __pfx_vpanic+0x10/0x10 [ 124.280501][ T5337] ? __pfx___schedule+0x10/0x10 [ 124.282540][ T5337] panic+0xc5/0xd0 [ 124.284117][ T5337] ? __pfx_panic+0x10/0x10 [ 124.285983][ T5337] ? preempt_schedule_common+0x82/0xd0 [ 124.288213][ T5337] check_panic_on_warn+0x89/0xb0 [ 124.290228][ T5337] end_report+0x73/0x170 [ 124.291999][ T5337] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 124.294478][ T5337] kasan_report_invalid_free+0xfa/0x110 [ 124.296762][ T5337] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 124.299217][ T5337] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 124.301740][ T5337] __kasan_slab_pre_free+0x104/0x120 [ 124.303994][ T5337] kfree+0x173/0x640 [ 124.305686][ T5337] ? f_uac2_opts_p_srate_store+0x225/0x2b0 [ 124.308105][ T5337] f_uac2_opts_p_srate_store+0x225/0x2b0 [ 124.310466][ T5337] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 124.313001][ T5337] ? down_read+0x2be/0x330 [ 124.314826][ T5337] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 124.317385][ T5337] configfs_write_iter+0x337/0x430 [ 124.319472][ T5337] vfs_write+0x612/0xba0 [ 124.321144][ T5337] ? __pfx_vfs_write+0x10/0x10 [ 124.323171][ T5337] ? __fget_files+0x2a/0x420 [ 124.325064][ T5337] ksys_write+0x150/0x270 [ 124.326886][ T5337] ? __pfx_ksys_write+0x10/0x10 [ 124.328969][ T5337] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.331401][ T5337] do_syscall_64+0x174/0x580 [ 124.333392][ T5337] ? trace_irq_disable+0x3b/0x140 [ 124.335559][ T5337] ? clear_bhb_loop+0x40/0x90 [ 124.337833][ T5337] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.340382][ T5337] RIP: 0033:0x7fa10cd9de99 [ 124.342322][ T5337] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 124.350593][ T5337] RSP: 002b:00007fa10dcc5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 124.354069][ T5337] RAX: ffffffffffffffda RBX: 00007fa10d026090 RCX: 00007fa10cd9de99 [ 124.357402][ T5337] RDX: 0000000000000054 RSI: 0000200000000680 RDI: 000000000000000a [ 124.360717][ T5337] RBP: 00007fa10ce33eaf R08: 0000000000000000 R09: 0000000000000000 [ 124.364181][ T5337] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 124.367494][ T5337] R13: 00007fa10d026128 R14: 00007fa10d026090 R15: 00007ffc38e463d8 [ 124.370958][ T5337] [ 124.372653][ T5337] Kernel Offset: disabled [ 124.374491][ T5337] Rebooting in 86400 seconds..