configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP ================================================================== BUG: KASAN: slab-out-of-bounds in list_empty include/linux/list.h:404 [inline] BUG: KASAN: slab-out-of-bounds in dummy_free_request+0x8a/0x90 drivers/usb/gadget/udc/dummy_hcd.c:691 Read of size 8 at addr ffff88802861b8f0 by task syz.7.1193/11986 CPU: 0 UID: 0 PID: 11986 Comm: syz.7.1193 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 list_empty include/linux/list.h:404 [inline] dummy_free_request+0x8a/0x90 drivers/usb/gadget/udc/dummy_hcd.c:691 uvc_function_bind+0x181a/0x1939 drivers/usb/gadget/function/f_uvc.c:893 usb_add_function+0x219/0x890 drivers/usb/gadget/composite.c:333 configfs_composite_bind+0xd83/0x1960 drivers/usb/gadget/configfs.c:1802 gadget_bind_driver+0x28c/0xbf0 drivers/usb/gadget/udc/core.c:1662 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __driver_attach+0x21f/0x5b0 drivers/base/dd.c:1292 bus_for_each_dev+0x13e/0x1d0 drivers/base/bus.c:383 bus_add_driver+0x305/0x5b0 drivers/base/bus.c:763 driver_register+0x1e2/0x360 drivers/base/driver.c:174 usb_gadget_register_driver_owner+0x132/0x210 drivers/usb/gadget/udc/core.c:1752 gadget_dev_desc_UDC_store+0x1b0/0x2e0 drivers/usb/gadget/configfs.c:300 flush_write_buffer fs/configfs/file.c:207 [inline] configfs_write_iter+0x302/0x4e0 fs/configfs/file.c:229 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0xe7/0x970 arch/x86/entry/syscall_32.c:307 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:332 entry_SYSENTER_compat_after_hwframe+0x84/0x8e RIP: 0023:0xf7f78fec Code: Unable to access opcode bytes at 0xf7f78fc2. RSP: 002b:00000000f541550c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000080000340 RDX: 000000000000000b RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Allocated by task 9247: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x2e5/0x6c0 mm/slub.c:5515 _kmalloc_noprof include/linux/slab.h:969 [inline] __hw_addr_create+0x57/0x220 net/core/dev_addr_lists.c:62 __hw_addr_add_ex+0x32b/0x650 net/core/dev_addr_lists.c:120 __hw_addr_add net/core/dev_addr_lists.c:137 [inline] dev_addr_init+0x161/0x250 net/core/dev_addr_lists.c:689 alloc_netdev_mqs+0x363/0x15c0 net/core/dev.c:12071 rtnl_create_link+0xc13/0xf80 net/core/rtnetlink.c:3721 veth_newlink+0x203/0xa00 drivers/net/veth.c:1850 rtnl_newlink_create net/core/rtnetlink.c:3913 [inline] __rtnl_newlink net/core/rtnetlink.c:4044 [inline] rtnl_newlink+0x1499/0x2380 net/core/rtnetlink.c:4159 rtnetlink_rcv_msg+0x95e/0xe90 net/core/rtnetlink.c:7076 netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x585/0x850 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x8b0/0xda0 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec net/socket.c:775 [inline] __sock_sendmsg net/socket.c:790 [inline] __sys_sendto+0x48b/0x4e0 net/socket.c:2252 __do_compat_sys_socketcall net/compat.c:474 [inline] __se_compat_sys_socketcall net/compat.c:422 [inline] __ia32_compat_sys_socketcall+0x59a/0x770 net/compat.c:422 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] do_int80_emulation+0x14b/0x720 arch/x86/entry/syscall_32.c:172 asm_int80_emulation+0x1a/0x20 arch/x86/include/asm/idtentry.h:598 The buggy address belongs to the object at ffff88802861b800 which belongs to the cache kmalloc-128 of size 128 The buggy address is located 136 bytes to the right of allocated 104-byte region [ffff88802861b800, ffff88802861b868) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2861b flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000000 ffff88801bc42a00 dead000000000100 dead000000000122 raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 5750, tgid 5750 (syz-executor), ts 66260950891, free_ts 64170543812 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_pages_slowpath mm/page_alloc.c:4821 [inline] __alloc_frozen_pages_noprof+0x6ab/0x2dc0 mm/page_alloc.c:5317 alloc_slab_page mm/slub.c:3294 [inline] allocate_slab mm/slub.c:3408 [inline] new_slab+0xa2/0x650 mm/slub.c:3454 ___slab_alloc+0x5d1/0x800 mm/slub.c:4491 slab_alloc_node mm/slub.c:4936 [inline] __do_kmalloc_node mm/slub.c:5361 [inline] __kmalloc_flags_noprof+0x466/0x890 mm/slub.c:5554 _kmalloc_flags_noprof mm/slab.h:38 [inline] alloc_slab_obj_exts+0xb2/0x250 mm/slub.c:2181 __memcg_slab_post_alloc_hook+0x3d4/0x1160 mm/memcontrol.c:3587 memcg_slab_post_alloc_hook mm/slub.c:2475 [inline] slab_post_alloc_hook mm/slub.c:4631 [inline] slab_alloc_node mm/slub.c:4945 [inline] kmem_cache_alloc_noprof+0x587/0x6a0 mm/slub.c:4959 copy_fs_struct+0x49/0x340 fs/fs_struct.c:109 copy_fs kernel/fork.c:1636 [inline] copy_process+0x50d8/0x8030 kernel/fork.c:2280 kernel_clone+0x176/0x9d0 kernel/fork.c:2748 __do_compat_sys_ia32_clone+0xd4/0x120 arch/x86/kernel/sys_ia32.c:255 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0xe7/0x970 arch/x86/entry/syscall_32.c:307 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:332 entry_SYSENTER_compat_after_hwframe+0x84/0x8e page last free pid 6158 tgid 6156 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4612 [inline] slab_alloc_node mm/slub.c:4945 [inline] kmem_cache_alloc_node_noprof+0x27d/0x6b0 mm/slub.c:5017 __alloc_skb+0x140/0x710 net/core/skbuff.c:704 alloc_skb include/linux/skbuff.h:1384 [inline] alloc_skb_with_frags+0xdd/0x760 net/core/skbuff.c:6769 __virtio_vsock_alloc_skb_with_frags include/linux/virtio_vsock.h:68 [inline] virtio_vsock_alloc_linear_skb include/linux/virtio_vsock.h:81 [inline] virtio_vsock_alloc_skb include/linux/virtio_vsock.h:87 [inline] virtio_transport_alloc_skb+0xaaf/0x13c0 net/vmw_vsock/virtio_transport_common.c:230 virtio_transport_send_pkt_info+0x595/0x10d0 net/vmw_vsock/virtio_transport_common.c:380 virtio_transport_send_credit_update net/vmw_vsock/virtio_transport_common.c:666 [inline] virtio_transport_stream_do_dequeue net/vmw_vsock/virtio_transport_common.c:788 [inline] virtio_transport_stream_dequeue+0x8fc/0xc50 net/vmw_vsock/virtio_transport_common.c:942 __vsock_stream_recvmsg net/vmw_vsock/af_vsock.c:2455 [inline] __vsock_connectible_recvmsg+0x7a4/0xb80 net/vmw_vsock/af_vsock.c:2594 vsock_connectible_recvmsg+0xcd/0xf0 net/vmw_vsock/af_vsock.c:2616 sock_recvmsg_nosec net/socket.c:1126 [inline] sock_recvmsg+0x1d5/0x220 net/socket.c:1148 __sys_recvfrom+0x1f2/0x2f0 net/socket.c:2302 __compat_sys_recvfrom net/compat.c:388 [inline] __do_compat_sys_recvfrom net/compat.c:401 [inline] __se_compat_sys_recvfrom net/compat.c:397 [inline] __ia32_compat_sys_recvfrom+0xe4/0x1c0 net/compat.c:397 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0xe7/0x970 arch/x86/entry/syscall_32.c:307 Memory state around the buggy address: ffff88802861b780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88802861b800: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc >ffff88802861b880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff88802861b900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88802861b980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================