program: mkdir(&(0x7f0000000000)='config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000000240)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)={0x5c, r4, 0x405, 0x70bd27, 0x25dfdbff, {}, [{{0x8, 0x1, r5}, {0x40, 0x2, 0x0, 0x1, [{0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000401}, 0x4c004) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$inet_sctp(0x2, 0x1, 0x84) r8 = socket$inet_sctp(0x2, 0x1, 0x84) r9 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r9, 0x84, 0x14, &(0x7f0000000100)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) r11 = dup2(r7, r8) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r11, 0x84, 0x85, &(0x7f00000003c0)={r10, @in={{0x2, 0x0, @private}}}, &(0x7f0000000000)=0x90) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f0000000340)={r10, 0x83, "b1bbdc02c00ac082213f3f2916bbe6e1c157168b48ae97472695a58d05b783a875a9f305d9c827e68238378e36c8b457d80556e9ebf35f65eaf105e7bcd7858c1781548fb726ef413987a6e3d5f9d3ac2f33e0a330ebe1d87ca2715f4ae0d600b5d8f12507ccd5aac695b3a8b5fbd33d614fc546199cdb309e5f50c740ec9fe58123fe"}, &(0x7f0000000540)=0x8b) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x7, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10104}, [@IFLA_IFNAME={0x14, 0x3, 'vlan0\x00'}, @IFLA_MASTER={0x8, 0xa, r12}]}, 0x3c}}, 0x0) mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000440)={0x0, 0xa1ff, &(0x7f0000000400)={&(0x7f0000000280)={0x34, r1, 0x1, 0x0, 0x25dfdbff, {{}, {}, {0x18, 0x17, {0x0, 0x0, @l2={'eth', 0x3a, 'team0\x00'}}}}}, 0x34}}, 0x0) mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r13 = openat(0xffffffffffffff9c, &(0x7f0000000600)='config/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0) write(r13, &(0x7f0000000140)="fa343108581b46853fca130d73e42c34ce79789d5038d629383030302c38383230c733bcff6506d6a8e178d1ad25f435d6548d7e178ddf331c2f0a92840af5604b5c823bb1df4b951256c18bf6a6d7abdc9e686e2ef4e85fa1ccec9fb8430e5655b4cd", 0x63) r14 = io_uring_setup(0x17f, &(0x7f0000000080)={0x0, 0x5235, 0x40, 0x1, 0x80}) munmap(&(0x7f0000000000/0x2000)=nil, 0x2000) io_uring_register$IORING_REGISTER_IOWQ_AFF(r14, 0x11, &(0x7f0000000100)="e8085d", 0x3) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') [ 76.683839][ T1327] ieee802154 phy0 wpan0: encryption failed: -22 [ 76.686656][ T1327] ieee802154 phy1 wpan1: encryption failed: -22 [ 76.821157][ T5271] Bluetooth: hci0: command tx timeout [ 76.851903][ T5308] bridge_slave_0: left allmulticast mode [ 76.854365][ T5308] bridge_slave_0: left promiscuous mode [ 76.856941][ T5308] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.888001][ T5308] bridge_slave_1: left allmulticast mode [ 76.890965][ T5308] bridge_slave_1: left promiscuous mode [ 76.894208][ T5308] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.905819][ T5308] bond0: (slave bond_slave_0): Releasing backup interface [ 76.913239][ T5308] bond0: (slave bond_slave_1): Releasing backup interface [ 76.931163][ T5308] team0: Port device team_slave_0 removed [ 76.937334][ T5308] team0: Port device team_slave_1 removed [ 76.946137][ T5308] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 76.951010][ T5308] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 76.955808][ T5308] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 76.959026][ T5308] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 76.967203][ T5308] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 76.976689][ T5309] team0: Mode changed to "random" [ 76.985596][ T5310] vlan0: entered promiscuous mode [ 76.997068][ T5310] team0: Port device vlan0 added [ 77.062391][ T5309] tipc: Started in network mode [ 77.064785][ T5309] tipc: Node identity aaaaaaaaaa1a, cluster identity 4711 [ 77.069010][ T5309] tipc: Enabled bearer , priority 0 [ 77.085090][ T5308] ================================================================== [ 77.088498][ T5308] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0 [ 77.091688][ T5308] Free of addr ffff888042d6790f by task syz.0.0/5308 [ 77.094476][ T5308] [ 77.095597][ T5308] CPU: 0 UID: 0 PID: 5308 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 77.095615][ T5308] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 77.095623][ T5308] Call Trace: [ 77.095630][ T5308] [ 77.095635][ T5308] dump_stack_lvl+0xe8/0x150 [ 77.095656][ T5308] print_address_description+0x55/0x1e0 [ 77.095671][ T5308] print_report+0x58/0x70 [ 77.095685][ T5308] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 77.095698][ T5308] kasan_report_invalid_free+0xea/0x110 [ 77.095712][ T5308] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 77.095728][ T5308] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 77.095741][ T5308] __kasan_slab_pre_free+0x104/0x120 [ 77.095755][ T5308] kfree+0x173/0x640 [ 77.095767][ T5308] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 77.095779][ T5308] f_uac2_opts_c_srate_store+0x225/0x2b0 [ 77.095791][ T5308] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 77.095804][ T5308] ? down_read+0x2be/0x330 [ 77.095817][ T5308] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 77.095830][ T5308] configfs_write_iter+0x337/0x430 [ 77.095843][ T5308] vfs_write+0x612/0xba0 [ 77.095860][ T5308] ? __pfx_vfs_write+0x10/0x10 [ 77.095876][ T5308] ? __fget_files+0x2a/0x420 [ 77.095893][ T5308] ksys_write+0x150/0x270 [ 77.095903][ T5308] ? __pfx_ksys_write+0x10/0x10 [ 77.095921][ T5308] do_syscall_64+0x166/0x520 [ 77.095934][ T5308] ? trace_irq_disable+0x3b/0x140 [ 77.095945][ T5308] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.095955][ T5308] ? clear_bhb_loop+0x70/0xc0 [ 77.095965][ T5308] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.095976][ T5308] RIP: 0033:0x7ff2d699e159 [ 77.095986][ T5308] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 77.095995][ T5308] RSP: 002b:00007ff2d2df4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 77.096008][ T5308] RAX: ffffffffffffffda RBX: 00007ff2d6c25fa0 RCX: 00007ff2d699e159 [ 77.096017][ T5308] RDX: 0000000000000063 RSI: 0000200000000140 RDI: 000000000000000a [ 77.096024][ T5308] RBP: 00007ff2d6a35024 R08: 0000000000000000 R09: 0000000000000000 [ 77.096031][ T5308] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 77.096038][ T5308] R13: 00007ff2d6c26038 R14: 00007ff2d6c25fa0 R15: 00007ffe734ecb98 [ 77.096049][ T5308] [ 77.096054][ T5308] [ 77.194124][ T5308] Allocated by task 5308: [ 77.196166][ T5308] kasan_save_track+0x3e/0x80 [ 77.198019][ T5308] __kasan_kmalloc+0x93/0xb0 [ 77.199877][ T5308] __kmalloc_node_track_caller_noprof+0x4c7/0x740 [ 77.202392][ T5308] kstrdup+0x42/0x100 [ 77.203985][ T5308] f_uac2_opts_c_srate_store+0x11f/0x2b0 [ 77.206233][ T5308] configfs_write_iter+0x337/0x430 [ 77.208301][ T5308] vfs_write+0x612/0xba0 [ 77.210005][ T5308] ksys_write+0x150/0x270 [ 77.211740][ T5308] do_syscall_64+0x166/0x520 [ 77.213700][ T5308] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.216133][ T5308] [ 77.217162][ T5308] The buggy address belongs to the object at ffff888042d67900 [ 77.217162][ T5308] which belongs to the cache kmalloc-128 of size 128 [ 77.222833][ T5308] The buggy address is located 15 bytes inside of [ 77.222833][ T5308] 100-byte region [ffff888042d67900, ffff888042d67964) [ 77.228086][ T5308] [ 77.229141][ T5308] The buggy address belongs to the physical page: [ 77.231823][ T5308] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888042d67a00 pfn:0x42d67 [ 77.236049][ T5308] flags: 0x4fff00000000200(workingset|node=1|zone=1|lastcpupid=0x7ff) [ 77.239297][ T5308] page_type: f5(slab) [ 77.240930][ T5308] raw: 04fff00000000200 ffff88801b041a00 ffff888030400648 ffffea0001010a10 [ 77.244474][ T5308] raw: ffff888042d67a00 000000080010000a 00000000f5000000 0000000000000000 [ 77.248097][ T5308] page dumped because: kasan: bad access detected [ 77.250733][ T5308] page_owner tracks the page as allocated [ 77.253087][ T5308] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5295, tgid 5295 (kworker/0:5), ts 74036241425 [ 77.260785][ T5308] post_alloc_hook+0x1f9/0x250 [ 77.262857][ T5308] get_page_from_freelist+0x2209/0x2280 [ 77.265207][ T5308] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 77.267542][ T5308] allocate_slab+0x7c/0x5e0 [ 77.269520][ T5308] refill_objects+0x2d5/0x350 [ 77.271513][ T5308] __pcs_replace_empty_main+0x2c3/0x6b0 [ 77.273905][ T5308] __kmalloc_cache_noprof+0x3ab/0x660 [ 77.276180][ T5308] drm_atomic_helper_setup_commit+0x5fc/0x1a30 [ 77.278898][ T5308] drm_atomic_helper_commit+0x6a/0xb10 [ 77.281362][ T5308] drm_atomic_commit+0x24e/0x2b0 [ 77.283508][ T5308] drm_atomic_helper_dirtyfb+0xe2f/0xfd0 [ 77.285841][ T5308] drm_fbdev_shmem_helper_fb_dirty+0x160/0x310 [ 77.288229][ T5308] drm_fb_helper_damage_work+0x84c/0xf20 [ 77.290399][ T5308] process_scheduled_works+0xc3d/0x1630 [ 77.292448][ T5308] worker_thread+0xa47/0xfb0 [ 77.294216][ T5308] kthread+0x38b/0x480 [ 77.295929][ T5308] page last free pid 15 tgid 15 ts 73970374305 stack trace: [ 77.298981][ T5308] __free_frozen_pages+0xc93/0xd90 [ 77.301159][ T5308] rcu_core+0x794/0x10b0 [ 77.302991][ T5308] handle_softirqs+0x226/0x860 [ 77.305107][ T5308] run_ksoftirqd+0x36/0x60 [ 77.306996][ T5308] smpboot_thread_fn+0x565/0xa70 [ 77.309045][ T5308] kthread+0x38b/0x480 [ 77.310729][ T5308] ret_from_fork+0x514/0xb70 [ 77.312730][ T5308] ret_from_fork_asm+0x1a/0x30 [ 77.314802][ T5308] [ 77.315882][ T5308] Memory state around the buggy address: [ 77.318293][ T5308] ffff888042d67800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 77.321671][ T5308] ffff888042d67880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 77.325267][ T5308] >ffff888042d67900: 00 00 00 00 00 00 00 00 00 00 00 00 04 fc fc fc [ 77.328737][ T5308] ^ [ 77.330541][ T5308] ffff888042d67980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 77.333868][ T5308] ffff888042d67a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 77.337115][ T5308] ================================================================== [ 77.359783][ T5308] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 77.362906][ T5308] CPU: 0 UID: 0 PID: 5308 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 77.366846][ T5308] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 77.371081][ T5308] Call Trace: [ 77.372568][ T5308] [ 77.373933][ T5308] vpanic+0x56d/0xa60 [ 77.375765][ T5308] ? __pfx_vpanic+0x10/0x10 [ 77.377693][ T5308] ? __pfx___schedule+0x10/0x10 [ 77.379825][ T5308] panic+0xc5/0xd0 [ 77.381465][ T5308] ? __pfx_panic+0x10/0x10 [ 77.383379][ T5308] ? preempt_schedule_common+0x7f/0xd0 [ 77.385655][ T5308] check_panic_on_warn+0x89/0xb0 [ 77.387796][ T5308] end_report+0x73/0x170 [ 77.389592][ T5308] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 77.391995][ T5308] kasan_report_invalid_free+0xfa/0x110 [ 77.394343][ T5308] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 77.396850][ T5308] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 77.399268][ T5308] __kasan_slab_pre_free+0x104/0x120 [ 77.401529][ T5308] kfree+0x173/0x640 [ 77.403216][ T5308] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 77.405727][ T5308] f_uac2_opts_c_srate_store+0x225/0x2b0 [ 77.408027][ T5308] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 77.410823][ T5308] ? down_read+0x2be/0x330 [ 77.412652][ T5308] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 77.415091][ T5308] configfs_write_iter+0x337/0x430 [ 77.417135][ T5308] vfs_write+0x612/0xba0 [ 77.418813][ T5308] ? __pfx_vfs_write+0x10/0x10 [ 77.420813][ T5308] ? __fget_files+0x2a/0x420 [ 77.422847][ T5308] ksys_write+0x150/0x270 [ 77.424688][ T5308] ? __pfx_ksys_write+0x10/0x10 [ 77.426893][ T5308] do_syscall_64+0x166/0x520 [ 77.428989][ T5308] ? trace_irq_disable+0x3b/0x140 [ 77.431199][ T5308] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.433906][ T5308] ? clear_bhb_loop+0x70/0xc0 [ 77.435998][ T5308] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.438629][ T5308] RIP: 0033:0x7ff2d699e159 [ 77.440610][ T5308] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 77.448787][ T5308] RSP: 002b:00007ff2d2df4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 77.452183][ T5308] RAX: ffffffffffffffda RBX: 00007ff2d6c25fa0 RCX: 00007ff2d699e159 [ 77.455535][ T5308] RDX: 0000000000000063 RSI: 0000200000000140 RDI: 000000000000000a [ 77.458841][ T5308] RBP: 00007ff2d6a35024 R08: 0000000000000000 R09: 0000000000000000 [ 77.462181][ T5308] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 77.465599][ T5308] R13: 00007ff2d6c26038 R14: 00007ff2d6c25fa0 R15: 00007ffe734ecb98 [ 77.468923][ T5308] [ 77.470663][ T5308] Kernel Offset: disabled [ 77.472567][ T5308] Rebooting in 86400 seconds..