program: mkdir(&(0x7f0000000000)='config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x3e) mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000000206050000000000000000000700fffd05000500020000000900020073797a020200000010000300686173683a69702c6d61630005000500020000000500010006000000c24d93a1dd5043494726c620a7ca4f67320c3d6c4330225ceba35f038b43103cc082d75dca06d8d19387da22047c5f806cbe7f3fa6364a00390d73d8dae7c0e5887708dac2f1bf3f55a92dbe48b18d9cce8a3328bc3e6fbcf693b7aa76"], 0x48}}, 0x4000000) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000001c0)={0x0, 0x32, &(0x7f0000000240)={&(0x7f0000000280)={0x4c, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x8}, [@IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x3d, 0x1, 0x1, 0x0, @private=0xa010102}}, @IPSET_ATTR_IP_TO={0x18, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @dev={0xfe, 0x80, '\x00', 0x3c}}}]}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4000050) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='config/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0) openat(r2, &(0x7f00000000c0)='config\x00', 0x88ac0, 0x42) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$VFAT_IOCTL_READDIR_BOTH(r3, 0x82307201, &(0x7f0000000740)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) mkdirat(r2, &(0x7f0000000140)='config/usb_gadget/g1\x00', 0x164) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r2, 0xc0189373, &(0x7f0000000180)={{0x1, 0x1, 0x18, r1, {0x6}}, 'config\x00'}) connect$unix(r4, &(0x7f0000000340)=@abs={0x1, 0x0, 0x4e21}, 0x6e) write(r2, &(0x7f0000000980)="34343130302c34383030302c38383230082c39363030302c31125b9d5f5b4943e40596d163cc6bc5995ba70dfd0100093b2b1b503476dd5f5b396613c0aad4c69b6e0c90ee9ee3b9afc84c05e08c429c7a4bc4ca5e00305008d201000000dafd6358611f369c786f5abdd68b12dd892a4393ea134b1e3fefbbdda82035c75439567ade6def00f139df83da211d87991faeae68ab0038ab53737a2d97fb53c0ff36162a2e078ce2bb5b28245ae52ceaa07dafb53c2dfc61b6d23e8d6a643fee12698e9f10c2b9cc3eb6c3109d523d41de782cc841fd080000708495e8a888f500d34e8a8ceb880a372778cf8cac73759c000000000000", 0xf6) syz_open_procfs(0x0, &(0x7f00000003c0)='net/netstat\x00') ioctl$RTC_RD_TIME(r2, 0x80247009, &(0x7f0000000080)) open$dir(&(0x7f0000000040)='config\x00', 0xe8002, 0x2a) [ 92.536448][ T5278] Bluetooth: hci0: command tx timeout [ 92.565041][ T1361] cfg80211: failed to load regulatory.db [ 92.665125][ T5319] ================================================================== [ 92.668485][ T5319] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0 [ 92.671756][ T5319] Free of addr ffff88803760c112 by task syz.0.0/5319 [ 92.674407][ T5319] [ 92.675419][ T5319] CPU: 0 UID: 0 PID: 5319 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 92.675434][ T5319] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 92.675441][ T5319] Call Trace: [ 92.675447][ T5319] [ 92.675453][ T5319] dump_stack_lvl+0xe8/0x150 [ 92.675471][ T5319] print_address_description+0x55/0x1e0 [ 92.675488][ T5319] print_report+0x58/0x70 [ 92.675501][ T5319] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 92.675513][ T5319] kasan_report_invalid_free+0xea/0x110 [ 92.675528][ T5319] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 92.675542][ T5319] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 92.675555][ T5319] __kasan_slab_pre_free+0x104/0x120 [ 92.675568][ T5319] kfree+0x173/0x640 [ 92.675583][ T5319] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 92.675596][ T5319] f_uac2_opts_c_srate_store+0x225/0x2b0 [ 92.675614][ T5319] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 92.675628][ T5319] ? down_read+0x2be/0x330 [ 92.675640][ T5319] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 92.675653][ T5319] configfs_write_iter+0x337/0x430 [ 92.675667][ T5319] vfs_write+0x612/0xba0 [ 92.675682][ T5319] ? __pfx_vfs_write+0x10/0x10 [ 92.675697][ T5319] ? __fget_files+0x2a/0x420 [ 92.675710][ T5319] ksys_write+0x150/0x270 [ 92.675723][ T5319] ? __pfx_ksys_write+0x10/0x10 [ 92.675738][ T5319] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.675748][ T5319] do_syscall_64+0x174/0x580 [ 92.675760][ T5319] ? trace_irq_disable+0x3b/0x140 [ 92.675773][ T5319] ? clear_bhb_loop+0x70/0xc0 [ 92.675784][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.675794][ T5319] RIP: 0033:0x7f34cbb9e0d9 [ 92.675804][ T5319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.675813][ T5319] RSP: 002b:00007f34cca94fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 92.675826][ T5319] RAX: ffffffffffffffda RBX: 00007f34cbe25fa0 RCX: 00007f34cbb9e0d9 [ 92.675835][ T5319] RDX: 00000000000000f6 RSI: 0000200000000980 RDI: 0000000000000005 [ 92.675842][ T5319] RBP: 00007f34cbc35024 R08: 0000000000000000 R09: 0000000000000000 [ 92.675849][ T5319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 92.675856][ T5319] R13: 00007f34cbe26038 R14: 00007f34cbe25fa0 R15: 00007ffd89f95b48 [ 92.675868][ T5319] [ 92.675872][ T5319] [ 92.767309][ T5319] Allocated by task 5319: [ 92.769049][ T5319] kasan_save_track+0x3e/0x80 [ 92.770948][ T5319] __kasan_kmalloc+0x93/0xb0 [ 92.772831][ T5319] __kmalloc_node_track_caller_noprof+0x4c3/0x730 [ 92.775228][ T5319] kstrdup+0x42/0x100 [ 92.776861][ T5319] f_uac2_opts_c_srate_store+0x11f/0x2b0 [ 92.779038][ T5319] configfs_write_iter+0x337/0x430 [ 92.781124][ T5319] vfs_write+0x612/0xba0 [ 92.782803][ T5319] ksys_write+0x150/0x270 [ 92.784322][ T5319] do_syscall_64+0x174/0x580 [ 92.785941][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.788008][ T5319] [ 92.788860][ T5319] The buggy address belongs to the object at ffff88803760c100 [ 92.788860][ T5319] which belongs to the cache kmalloc-64 of size 64 [ 92.793905][ T5319] The buggy address is located 18 bytes inside of [ 92.793905][ T5319] 47-byte region [ffff88803760c100, ffff88803760c12f) [ 92.798817][ T5319] [ 92.799664][ T5319] The buggy address belongs to the physical page: [ 92.802144][ T5319] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3760c [ 92.805325][ T5319] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 92.808308][ T5319] page_type: f5(slab) [ 92.809849][ T5319] raw: 04fff00000000000 ffff88801b0418c0 dead000000000100 dead000000000122 [ 92.813039][ T5319] raw: 0000000000000000 0000000800200020 00000000f5000000 0000000000000000 [ 92.816280][ T5319] page dumped because: kasan: bad access detected [ 92.818828][ T5319] page_owner tracks the page as allocated [ 92.821068][ T5319] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1051, tgid 1051 (kworker/u4:7), ts 16780149169, free_ts 16780081191 [ 92.829368][ T5319] post_alloc_hook+0x1f9/0x250 [ 92.831394][ T5319] get_page_from_freelist+0x21fa/0x2270 [ 92.833805][ T5319] __alloc_frozen_pages_noprof+0x18d/0x380 [ 92.836358][ T5319] allocate_slab+0x79/0x5e0 [ 92.838290][ T5319] refill_objects+0x2d5/0x350 [ 92.840296][ T5319] __pcs_replace_empty_main+0x2bf/0x6b0 [ 92.842649][ T5319] __kmalloc_noprof+0x485/0x720 [ 92.844762][ T5319] security_task_alloc+0x4d/0x330 [ 92.847014][ T5319] copy_process+0x1c45/0x4390 [ 92.849028][ T5319] kernel_clone+0x2d7/0x940 [ 92.850972][ T5319] user_mode_thread+0x110/0x180 [ 92.852994][ T5319] call_usermodehelper_exec_work+0x5c/0x230 [ 92.855670][ T5319] process_scheduled_works+0xa8e/0x14e0 [ 92.857981][ T5319] worker_thread+0xa47/0xfb0 [ 92.859908][ T5319] kthread+0x388/0x470 [ 92.861687][ T5319] ret_from_fork+0x514/0xb70 [ 92.863683][ T5319] page last free pid 1051 tgid 1051 stack trace: [ 92.866311][ T5319] __free_frozen_pages+0xc1e/0xd10 [ 92.868429][ T5319] __kasan_populate_vmalloc+0x1a8/0x1c0 [ 92.870773][ T5319] alloc_vmap_area+0xd1a/0x1420 [ 92.872884][ T5319] __get_vm_area_node+0x1f2/0x300 [ 92.874967][ T5319] __vmalloc_node_range_noprof+0x358/0x1730 [ 92.877476][ T5319] __vmalloc_node_noprof+0xc2/0x100 [ 92.879700][ T5319] dup_task_struct+0x2a0/0x8e0 [ 92.881729][ T5319] copy_process+0x820/0x4390 [ 92.883605][ T5319] kernel_clone+0x2d7/0x940 [ 92.885533][ T5319] user_mode_thread+0x110/0x180 [ 92.887674][ T5319] call_usermodehelper_exec_work+0x5c/0x230 [ 92.890116][ T5319] process_scheduled_works+0xa8e/0x14e0 [ 92.892403][ T5319] worker_thread+0xa47/0xfb0 [ 92.894352][ T5319] kthread+0x388/0x470 [ 92.896129][ T5319] ret_from_fork+0x514/0xb70 [ 92.898150][ T5319] ret_from_fork_asm+0x1a/0x30 [ 92.900196][ T5319] [ 92.901256][ T5319] Memory state around the buggy address: [ 92.903648][ T5319] ffff88803760c000: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 92.906943][ T5319] ffff88803760c080: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 92.910377][ T5319] >ffff88803760c100: 00 00 00 00 00 07 fc fc fc fc fc fc fc fc fc fc [ 92.913741][ T5319] ^ [ 92.915718][ T5319] ffff88803760c180: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 92.919091][ T5319] ffff88803760c200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 92.922490][ T5319] ================================================================== [ 92.970671][ T5319] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 92.973756][ T5319] CPU: 0 UID: 0 PID: 5319 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 92.977433][ T5319] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 92.981505][ T5319] Call Trace: [ 92.982782][ T5319] [ 92.983978][ T5319] vpanic+0x56c/0xa60 [ 92.985662][ T5319] ? __pfx_vpanic+0x10/0x10 [ 92.987567][ T5319] ? __pfx___schedule+0x10/0x10 [ 92.989529][ T5319] panic+0xc5/0xd0 [ 92.991104][ T5319] ? __pfx_panic+0x10/0x10 [ 92.992778][ T5319] ? preempt_schedule_common+0x82/0xd0 [ 92.994762][ T5319] check_panic_on_warn+0x89/0xb0 [ 92.996455][ T5319] end_report+0x73/0x170 [ 92.998068][ T5319] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 93.000519][ T5319] kasan_report_invalid_free+0xfa/0x110 [ 93.002880][ T5319] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 93.005282][ T5319] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 93.007752][ T5319] __kasan_slab_pre_free+0x104/0x120 [ 93.009884][ T5319] kfree+0x173/0x640 [ 93.011507][ T5319] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 93.013939][ T5319] f_uac2_opts_c_srate_store+0x225/0x2b0 [ 93.016219][ T5319] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 93.018536][ T5319] ? down_read+0x2be/0x330 [ 93.020254][ T5319] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 93.022480][ T5319] configfs_write_iter+0x337/0x430 [ 93.024316][ T5319] vfs_write+0x612/0xba0 [ 93.025906][ T5319] ? __pfx_vfs_write+0x10/0x10 [ 93.027854][ T5319] ? __fget_files+0x2a/0x420 [ 93.029726][ T5319] ksys_write+0x150/0x270 [ 93.031542][ T5319] ? __pfx_ksys_write+0x10/0x10 [ 93.033339][ T5319] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.035719][ T5319] do_syscall_64+0x174/0x580 [ 93.037674][ T5319] ? trace_irq_disable+0x3b/0x140 [ 93.039739][ T5319] ? clear_bhb_loop+0x70/0xc0 [ 93.041568][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.043909][ T5319] RIP: 0033:0x7f34cbb9e0d9 [ 93.045690][ T5319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.052962][ T5319] RSP: 002b:00007f34cca94fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 93.055951][ T5319] RAX: ffffffffffffffda RBX: 00007f34cbe25fa0 RCX: 00007f34cbb9e0d9 [ 93.059138][ T5319] RDX: 00000000000000f6 RSI: 0000200000000980 RDI: 0000000000000005 [ 93.062336][ T5319] RBP: 00007f34cbc35024 R08: 0000000000000000 R09: 0000000000000000 [ 93.065543][ T5319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 93.068881][ T5319] R13: 00007f34cbe26038 R14: 00007f34cbe25fa0 R15: 00007ffd89f95b48 [ 93.072221][ T5319] [ 93.073978][ T5319] Kernel Offset: disabled [ 93.075837][ T5319] Rebooting in 86400 seconds..