program: mkdir(&(0x7f0000000000)='config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x306) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$sock_inet_SIOCSARP(r1, 0x8955, &(0x7f00000001c0)={{0x2, 0x4e24, @local}, {0x1}, 0x10, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x46}}, 'syzkaller0\x00'}) mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='config/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0) write(r2, &(0x7f0000000040)='44100,48000888200,9', 0x13) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000340)={{{@in=@loopback, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@empty}}, &(0x7f0000000440)=0xe8) quotactl$Q_SETQUOTA(0xffffffff80000802, &(0x7f0000000080)=@sg0, r3, &(0x7f0000000480)={0x6, 0x8, 0x34f, 0x80000000, 0x4, 0x2, 0xfffffffffffffffb, 0x6}) [ 86.416286][ T5312] ================================================================== [ 86.419676][ T5312] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0 [ 86.422760][ T5312] Free of addr ffff88803fd1bb52 by task syz.0.0/5312 [ 86.425270][ T5312] [ 86.426231][ T5312] CPU: 0 UID: 0 PID: 5312 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 86.426241][ T5312] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.426246][ T5312] Call Trace: [ 86.426250][ T5312] [ 86.426255][ T5312] dump_stack_lvl+0xe8/0x150 [ 86.426272][ T5312] print_address_description+0x55/0x1e0 [ 86.426293][ T5312] print_report+0x58/0x70 [ 86.426305][ T5312] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 86.426319][ T5312] kasan_report_invalid_free+0xea/0x110 [ 86.426335][ T5312] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 86.426348][ T5312] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 86.426362][ T5312] __kasan_slab_pre_free+0x104/0x120 [ 86.426373][ T5312] kfree+0x173/0x640 [ 86.426379][ T5312] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 86.426387][ T5312] f_uac2_opts_c_srate_store+0x225/0x2b0 [ 86.426395][ T5312] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 86.426403][ T5312] ? down_read+0x2be/0x330 [ 86.426411][ T5312] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 86.426419][ T5312] configfs_write_iter+0x337/0x430 [ 86.426428][ T5312] vfs_write+0x612/0xba0 [ 86.426439][ T5312] ? __pfx_vfs_write+0x10/0x10 [ 86.426453][ T5312] ? __fget_files+0x2a/0x420 [ 86.426468][ T5312] ksys_write+0x150/0x270 [ 86.426477][ T5312] ? __pfx_ksys_write+0x10/0x10 [ 86.426494][ T5312] do_syscall_64+0x166/0x520 [ 86.426507][ T5312] ? trace_irq_disable+0x3b/0x140 [ 86.426521][ T5312] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.426531][ T5312] ? clear_bhb_loop+0x70/0xc0 [ 86.426542][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.426552][ T5312] RIP: 0033:0x7f16b319e0d9 [ 86.426564][ T5312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 86.426573][ T5312] RSP: 002b:00007f16b4058fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 86.426585][ T5312] RAX: ffffffffffffffda RBX: 00007f16b3425fa0 RCX: 00007f16b319e0d9 [ 86.426592][ T5312] RDX: 0000000000000013 RSI: 0000200000000040 RDI: 0000000000000005 [ 86.426599][ T5312] RBP: 00007f16b3235024 R08: 0000000000000000 R09: 0000000000000000 [ 86.426612][ T5312] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 86.426616][ T5312] R13: 00007f16b3426038 R14: 00007f16b3425fa0 R15: 00007ffc930039e8 [ 86.426623][ T5312] [ 86.426626][ T5312] [ 86.523423][ T5312] Allocated by task 5312: [ 86.525313][ T5312] kasan_save_track+0x3e/0x80 [ 86.527359][ T5312] __kasan_kmalloc+0x93/0xb0 [ 86.529328][ T5312] __kmalloc_node_track_caller_noprof+0x4c7/0x740 [ 86.531833][ T5312] kstrdup+0x42/0x100 [ 86.533389][ T5312] f_uac2_opts_c_srate_store+0x11f/0x2b0 [ 86.535559][ T5312] configfs_write_iter+0x337/0x430 [ 86.537505][ T5312] vfs_write+0x612/0xba0 [ 86.539083][ T5312] ksys_write+0x150/0x270 [ 86.540687][ T5312] do_syscall_64+0x166/0x520 [ 86.542509][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.544725][ T5312] [ 86.545784][ T5312] The buggy address belongs to the object at ffff88803fd1bb40 [ 86.545784][ T5312] which belongs to the cache kmalloc-32 of size 32 [ 86.551570][ T5312] The buggy address is located 18 bytes inside of [ 86.551570][ T5312] 20-byte region [ffff88803fd1bb40, ffff88803fd1bb54) [ 86.556798][ T5312] [ 86.557771][ T5312] The buggy address belongs to the physical page: [ 86.560302][ T5312] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803fd1b580 pfn:0x3fd1b [ 86.564384][ T5312] flags: 0x4fff00000000200(workingset|node=1|zone=1|lastcpupid=0x7ff) [ 86.567339][ T5312] page_type: f5(slab) [ 86.568969][ T5312] raw: 04fff00000000200 ffff88801b041780 ffff8880304004c8 ffffea00010ba010 [ 86.572516][ T5312] raw: ffff88803fd1b580 0000000800400034 00000000f5000000 0000000000000000 [ 86.575822][ T5312] page dumped because: kasan: bad access detected [ 86.578411][ T5312] page_owner tracks the page as allocated [ 86.580699][ T5312] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5104, tgid 5104 (rm), ts 59394015746 [ 86.586934][ T5312] post_alloc_hook+0x1f9/0x250 [ 86.588690][ T5312] get_page_from_freelist+0x2209/0x2280 [ 86.590619][ T5312] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 86.592852][ T5312] allocate_slab+0x7c/0x5e0 [ 86.594630][ T5312] refill_objects+0x2d5/0x350 [ 86.596298][ T5312] __pcs_replace_empty_main+0x2c3/0x6b0 [ 86.598347][ T5312] __kmalloc_cache_noprof+0x3ab/0x660 [ 86.600378][ T5312] kmem_cache_free+0x156/0x650 [ 86.602285][ T5312] __put_anon_vma+0x12b/0x2d0 [ 86.604013][ T5312] unlink_anon_vmas+0x544/0x720 [ 86.605787][ T5312] free_pgtables+0x836/0xb70 [ 86.607505][ T5312] exit_mmap+0x4aa/0x9f0 [ 86.609106][ T5312] __mmput+0x118/0x420 [ 86.610734][ T5312] setup_new_exec+0x30d/0x360 [ 86.612573][ T5312] load_elf_binary+0xbc0/0x28d0 [ 86.614426][ T5312] bprm_execve+0x930/0x1590 [ 86.616220][ T5312] page last free pid 5103 tgid 5103 ts 59358538679 stack trace: [ 86.619177][ T5312] __free_frozen_pages+0xc93/0xd90 [ 86.621265][ T5312] __slab_free+0x274/0x2c0 [ 86.623110][ T5312] qlist_free_all+0x99/0x100 [ 86.625022][ T5312] kasan_quarantine_reduce+0x148/0x160 [ 86.627266][ T5312] __kasan_slab_alloc+0x22/0x80 [ 86.629341][ T5312] __kmalloc_noprof+0x315/0x720 [ 86.631251][ T5312] load_elf_binary+0x2c6/0x28d0 [ 86.633229][ T5312] bprm_execve+0x930/0x1590 [ 86.635082][ T5312] do_execveat_common+0x4f4/0x670 [ 86.637090][ T5312] __x64_sys_execve+0x97/0xc0 [ 86.639001][ T5312] do_syscall_64+0x166/0x520 [ 86.640696][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.642782][ T5312] [ 86.643814][ T5312] Memory state around the buggy address: [ 86.646178][ T5312] ffff88803fd1ba00: 00 00 00 00 fc fc fc fc fa fb fb fb fc fc fc fc [ 86.649499][ T5312] ffff88803fd1ba80: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc [ 86.652734][ T5312] >ffff88803fd1bb00: fa fb fb fb fc fc fc fc 00 00 04 fc fc fc fc fc [ 86.656103][ T5312] ^ [ 86.658893][ T5312] ffff88803fd1bb80: fa fb fb fb fc fc fc fc 00 00 00 00 fc fc fc fc [ 86.662177][ T5312] ffff88803fd1bc00: fa fb fb fb fc fc fc fc 00 00 00 00 fc fc fc fc [ 86.665215][ T5312] ================================================================== [ 86.679036][ T5276] Bluetooth: hci0: command tx timeout [ 86.692197][ T5312] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 86.694786][ T5312] CPU: 0 UID: 0 PID: 5312 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 86.698154][ T5312] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.702139][ T5312] Call Trace: [ 86.703552][ T5312] [ 86.704813][ T5312] vpanic+0x56d/0xa60 [ 86.706471][ T5312] ? __pfx_vpanic+0x10/0x10 [ 86.708396][ T5312] ? __pfx___schedule+0x10/0x10 [ 86.710483][ T5312] panic+0xc5/0xd0 [ 86.712157][ T5312] ? __pfx_panic+0x10/0x10 [ 86.714127][ T5312] ? preempt_schedule_common+0x7f/0xd0 [ 86.716448][ T5312] check_panic_on_warn+0x89/0xb0 [ 86.718523][ T5312] end_report+0x73/0x170 [ 86.720312][ T5312] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 86.722789][ T5312] kasan_report_invalid_free+0xfa/0x110 [ 86.725122][ T5312] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 86.727600][ T5312] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 86.730062][ T5312] __kasan_slab_pre_free+0x104/0x120 [ 86.732330][ T5312] kfree+0x173/0x640 [ 86.734067][ T5312] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 86.736516][ T5312] f_uac2_opts_c_srate_store+0x225/0x2b0 [ 86.738918][ T5312] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 86.741616][ T5312] ? down_read+0x2be/0x330 [ 86.743546][ T5312] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 86.746160][ T5312] configfs_write_iter+0x337/0x430 [ 86.748401][ T5312] vfs_write+0x612/0xba0 [ 86.750232][ T5312] ? __pfx_vfs_write+0x10/0x10 [ 86.752202][ T5312] ? __fget_files+0x2a/0x420 [ 86.754186][ T5312] ksys_write+0x150/0x270 [ 86.756035][ T5312] ? __pfx_ksys_write+0x10/0x10 [ 86.758103][ T5312] do_syscall_64+0x166/0x520 [ 86.760044][ T5312] ? trace_irq_disable+0x3b/0x140 [ 86.762284][ T5312] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.764917][ T5312] ? clear_bhb_loop+0x70/0xc0 [ 86.766943][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.769355][ T5312] RIP: 0033:0x7f16b319e0d9 [ 86.771238][ T5312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 86.779275][ T5312] RSP: 002b:00007f16b4058fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 86.782781][ T5312] RAX: ffffffffffffffda RBX: 00007f16b3425fa0 RCX: 00007f16b319e0d9 [ 86.786065][ T5312] RDX: 0000000000000013 RSI: 0000200000000040 RDI: 0000000000000005 [ 86.789282][ T5312] RBP: 00007f16b3235024 R08: 0000000000000000 R09: 0000000000000000 [ 86.792273][ T5312] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 86.795325][ T5312] R13: 00007f16b3426038 R14: 00007f16b3425fa0 R15: 00007ffc930039e8 [ 86.798536][ T5312] [ 86.800132][ T5312] Kernel Offset: disabled [ 86.801839][ T5312] Rebooting in 86400 seconds..