program: r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000100)={0x0, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xff}}, {0x2, 0x3, @initdev={0xac, 0x1e, 0x41, 0x0}}, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x28}}, 0xaf, 0x0, 0x0, 0x0, 0xdffc, 0x0, 0xc8}) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'ip_vti0\x00', 0x0}) sendto$packet(r1, &(0x7f0000000100)='O', 0x5c8, 0x0, &(0x7f0000000080)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @broadcast}, 0x14) mkdir(&(0x7f0000000000)='config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x3e) ioctl$KVM_CAP_DISABLE_QUIRKS(r4, 0x4068aea3, &(0x7f0000000180)={0x74, 0x0, 0x50}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) ioctl$KVM_SET_CPUID2(r6, 0x4008ae90, &(0x7f0000000340)={0x5, 0x0, [{0x40000001, 0x9, 0x7, 0xfff, 0xe, 0x7, 0xf}, {0xc0000001, 0x57b47ce7, 0x7, 0xf2b, 0xb6, 0xb, 0x504}, {0xb, 0xf, 0x5, 0x9, 0xffffd0cb, 0x6, 0x50d}, {0x80000000, 0x81, 0x2, 0x3e, 0x0, 0x7, 0x6}, {0x4, 0x3, 0x4, 0xc, 0x2, 0x2, 0x6}]}) mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff) mount$nfs(&(0x7f0000000280)='\\-\x00', &(0x7f00000002c0)='config/usb_gadget/g1/functions/uac2.usb0\x00', &(0x7f0000000440), 0x1080, &(0x7f0000000480)={[{'^-\xa1}%'}, {'\xff\xff\xff\xff\xff\xff'}, {'configfs\x00'}, {'fd/3\x00'}, {'\xff\xff\xff\xff\xff\xff'}, {'syzkaller\x00'}, {',#'}], [{@hash}]}) mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r7 = openat(0xffffffffffffff9c, &(0x7f0000000600)='config/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0) write(r7, &(0x7f0000000240)="34343130302c4f383030312c3838c36047c801c9616933646ef911431ff7", 0x1e) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x4, 0x10, &(0x7f0000000740)=@framed={{}, [@snprintf={{0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x8, 0xfe00}, {0x7, 0x0, 0x8}, {}, {0x5}, {0x7, 0x0, 0x0, 0x0}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x32}}]}, &(0x7f0000000ac0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) [ 86.920978][ T5278] Bluetooth: hci0: command tx timeout [ 87.109280][ T5315] ================================================================== [ 87.112592][ T5315] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0 [ 87.115551][ T5315] Free of addr ffff88801ce9ce0c by task syz.0.0/5315 [ 87.117956][ T5315] [ 87.118964][ T5315] CPU: 0 UID: 0 PID: 5315 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 87.118980][ T5315] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 87.118986][ T5315] Call Trace: [ 87.118990][ T5315] [ 87.118995][ T5315] dump_stack_lvl+0xe8/0x150 [ 87.119009][ T5315] print_address_description+0x55/0x1e0 [ 87.119020][ T5315] print_report+0x58/0x70 [ 87.119029][ T5315] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 87.119041][ T5315] kasan_report_invalid_free+0xea/0x110 [ 87.119056][ T5315] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 87.119069][ T5315] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 87.119081][ T5315] __kasan_slab_pre_free+0x104/0x120 [ 87.119108][ T5315] kfree+0x173/0x640 [ 87.119123][ T5315] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 87.119133][ T5315] f_uac2_opts_c_srate_store+0x225/0x2b0 [ 87.119141][ T5315] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 87.119150][ T5315] ? down_read+0x2be/0x330 [ 87.119163][ T5315] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 87.119171][ T5315] configfs_write_iter+0x337/0x430 [ 87.119182][ T5315] vfs_write+0x612/0xba0 [ 87.119192][ T5315] ? __pfx_vfs_write+0x10/0x10 [ 87.119201][ T5315] ? __fget_files+0x2a/0x420 [ 87.119210][ T5315] ksys_write+0x150/0x270 [ 87.119218][ T5315] ? __pfx_ksys_write+0x10/0x10 [ 87.119227][ T5315] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.119235][ T5315] do_syscall_64+0x174/0x580 [ 87.119245][ T5315] ? clear_bhb_loop+0x70/0xc0 [ 87.119252][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.119259][ T5315] RIP: 0033:0x7f2b8599e0d9 [ 87.119267][ T5315] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 87.119276][ T5315] RSP: 002b:00007f2b868effe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 87.119288][ T5315] RAX: ffffffffffffffda RBX: 00007f2b85c26090 RCX: 00007f2b8599e0d9 [ 87.119297][ T5315] RDX: 000000000000001e RSI: 0000200000000240 RDI: 0000000000000008 [ 87.119305][ T5315] RBP: 00007f2b85a35024 R08: 0000000000000000 R09: 0000000000000000 [ 87.119311][ T5315] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 87.119317][ T5315] R13: 00007f2b85c26128 R14: 00007f2b85c26090 R15: 00007ffda0c31eb8 [ 87.119327][ T5315] [ 87.119330][ T5315] [ 87.212919][ T5315] Allocated by task 5315: [ 87.215042][ T5315] kasan_save_track+0x3e/0x80 [ 87.217453][ T5315] __kasan_kmalloc+0x93/0xb0 [ 87.219972][ T5315] __kmalloc_node_track_caller_noprof+0x4c3/0x730 [ 87.223399][ T5315] kstrdup+0x42/0x100 [ 87.225510][ T5315] f_uac2_opts_c_srate_store+0x11f/0x2b0 [ 87.228521][ T5315] configfs_write_iter+0x337/0x430 [ 87.230889][ T5315] vfs_write+0x612/0xba0 [ 87.232637][ T5315] ksys_write+0x150/0x270 [ 87.234448][ T5315] do_syscall_64+0x174/0x580 [ 87.236403][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.238848][ T5315] [ 87.239844][ T5315] The buggy address belongs to the object at ffff88801ce9ce00 [ 87.239844][ T5315] which belongs to the cache kmalloc-32 of size 32 [ 87.246328][ T5315] The buggy address is located 12 bytes inside of [ 87.246328][ T5315] 31-byte region [ffff88801ce9ce00, ffff88801ce9ce1f) [ 87.251532][ T5315] [ 87.252566][ T5315] The buggy address belongs to the physical page: [ 87.255326][ T5315] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1ce9c [ 87.259148][ T5315] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 87.261891][ T5315] page_type: f5(slab) [ 87.263602][ T5315] raw: 00fff00000000000 ffff88801b041780 dead000000000100 dead000000000122 [ 87.267158][ T5315] raw: 0000000000000000 0000000800400040 00000000f5000000 0000000000000000 [ 87.270734][ T5315] page dumped because: kasan: bad access detected [ 87.273417][ T5315] page_owner tracks the page as allocated [ 87.275868][ T5315] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5064, tgid 5064 (rm), ts 59258547019, free_ts 41285923060 [ 87.283675][ T5315] post_alloc_hook+0x1f9/0x250 [ 87.285905][ T5315] get_page_from_freelist+0x21fa/0x2270 [ 87.288713][ T5315] __alloc_frozen_pages_noprof+0x18d/0x380 [ 87.291403][ T5315] allocate_slab+0x79/0x5e0 [ 87.293254][ T5315] refill_objects+0x2d5/0x350 [ 87.295179][ T5315] __pcs_replace_empty_main+0x2bf/0x6b0 [ 87.297378][ T5315] __kmalloc_noprof+0x485/0x720 [ 87.299356][ T5315] tomoyo_encode+0x2ad/0x570 [ 87.301322][ T5315] tomoyo_realpath_from_path+0x5fa/0x640 [ 87.303708][ T5315] tomoyo_path_perm+0x283/0x560 [ 87.305768][ T5315] security_inode_getattr+0x12b/0x310 [ 87.308008][ T5315] __x64_sys_newfstat+0x133/0x270 [ 87.310186][ T5315] do_syscall_64+0x174/0x580 [ 87.312188][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.314768][ T5315] page last free pid 4702 tgid 4702 stack trace: [ 87.317497][ T5315] __free_frozen_pages+0xc1e/0xd10 [ 87.320088][ T5315] __slab_free+0x274/0x2c0 [ 87.322430][ T5315] qlist_free_all+0x99/0x100 [ 87.324804][ T5315] kasan_quarantine_reduce+0x148/0x160 [ 87.327501][ T5315] __kasan_slab_alloc+0x22/0x80 [ 87.329852][ T5315] kmem_cache_alloc_noprof+0x2a0/0x5f0 [ 87.332381][ T5315] do_getname+0x2e/0x250 [ 87.334257][ T5315] do_sys_openat2+0xcc/0x200 [ 87.336371][ T5315] __x64_sys_openat+0x138/0x170 [ 87.338482][ T5315] do_syscall_64+0x174/0x580 [ 87.340484][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.342868][ T5315] [ 87.343916][ T5315] Memory state around the buggy address: [ 87.346224][ T5315] ffff88801ce9cd00: 00 00 00 00 fc fc fc fc fa fb fb fb fc fc fc fc [ 87.349591][ T5315] ffff88801ce9cd80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 87.352916][ T5315] >ffff88801ce9ce00: 00 00 00 07 fc fc fc fc 00 00 00 00 fc fc fc fc [ 87.356378][ T5315] ^ [ 87.358259][ T5315] ffff88801ce9ce80: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc [ 87.361662][ T5315] ffff88801ce9cf00: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc [ 87.365023][ T5315] ================================================================== [ 87.679728][ T5315] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 87.682696][ T5315] CPU: 0 UID: 0 PID: 5315 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 87.686256][ T5315] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 87.690021][ T5315] Call Trace: [ 87.691322][ T5315] [ 87.692500][ T5315] vpanic+0x56c/0xa60 [ 87.694094][ T5315] ? __pfx_vpanic+0x10/0x10 [ 87.695820][ T5315] ? __pfx___schedule+0x10/0x10 [ 87.697671][ T5315] panic+0xc5/0xd0 [ 87.699267][ T5315] ? __pfx_panic+0x10/0x10 [ 87.701218][ T5315] ? preempt_schedule_common+0x82/0xd0 [ 87.704303][ T5315] check_panic_on_warn+0x89/0xb0 [ 87.706621][ T5315] end_report+0x73/0x170 [ 87.708423][ T5315] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 87.710879][ T5315] kasan_report_invalid_free+0xfa/0x110 [ 87.713267][ T5315] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 87.715752][ T5315] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 87.718197][ T5315] __kasan_slab_pre_free+0x104/0x120 [ 87.720478][ T5315] kfree+0x173/0x640 [ 87.722152][ T5315] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 87.724622][ T5315] f_uac2_opts_c_srate_store+0x225/0x2b0 [ 87.727069][ T5315] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 87.729769][ T5315] ? down_read+0x2be/0x330 [ 87.731800][ T5315] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 87.734485][ T5315] configfs_write_iter+0x337/0x430 [ 87.736764][ T5315] vfs_write+0x612/0xba0 [ 87.738704][ T5315] ? __pfx_vfs_write+0x10/0x10 [ 87.740779][ T5315] ? __fget_files+0x2a/0x420 [ 87.742843][ T5315] ksys_write+0x150/0x270 [ 87.744791][ T5315] ? __pfx_ksys_write+0x10/0x10 [ 87.746957][ T5315] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.749636][ T5315] do_syscall_64+0x174/0x580 [ 87.751713][ T5315] ? clear_bhb_loop+0x70/0xc0 [ 87.753750][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.756366][ T5315] RIP: 0033:0x7f2b8599e0d9 [ 87.758373][ T5315] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 87.766227][ T5315] RSP: 002b:00007f2b868effe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 87.769787][ T5315] RAX: ffffffffffffffda RBX: 00007f2b85c26090 RCX: 00007f2b8599e0d9 [ 87.773158][ T5315] RDX: 000000000000001e RSI: 0000200000000240 RDI: 0000000000000008 [ 87.776517][ T5315] RBP: 00007f2b85a35024 R08: 0000000000000000 R09: 0000000000000000 [ 87.779943][ T5315] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 87.783335][ T5315] R13: 00007f2b85c26128 R14: 00007f2b85c26090 R15: 00007ffda0c31eb8 [ 87.786657][ T5315] [ 87.788337][ T5315] Kernel Offset: disabled [ 87.790069][ T5315] Rebooting in 86400 seconds..