ci2-upstream-fs/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-upstream-fs/syz-executor3387534966 <...> Warning: Permanently added '10.128.1.14' (ED25519) to the list of known hosts. execve("ci2-upstream-fs/syz-executor3387534966", ["ci2-upstream-fs/syz-executor3387534966"], 0x7ffc79ee2780 /* 10 vars */) = 0 brk(NULL) = 0x555559a49000 brk(0x555559a49d80) = 0x555559a49d80 arch_prctl(ARCH_SET_FS, 0x555559a49400) = 0 set_tid_address(0x555559a496d0) = 5608 set_robust_list(0x555559a496e0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-upstream-fs/syz-executor3387534966", 4096) = 44 getrandom("\xea\x7a\x5b\xce\x30\x95\x96\xbb", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555559a49d80 brk(0x555559a6ad80) = 0x555559a6ad80 brk(0x555559a6b000) = 0x555559a6b000 mprotect(0x7f5aced91000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555559a496d0) = 5609 ci2-upstream-fs/strace-static-x86_64: Process 5609 attached [pid 5608] rt_sigprocmask(SIG_SETMASK, [] [pid 5609] set_robust_list(0x555559a496e0, 24 [pid 5608] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5609] <... set_robust_list resumed>) = 0 [pid 5609] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5609] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5609] setpgid(0, 0) = 0 [pid 5609] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5609] write(3, "1000", 4) = 4 [pid 5609] close(3) = 0 [pid 5609] write(1, "executing program\n", 18) = 18 executing program [pid 5609] mkdir("config", 0777) = 0 [pid 5609] mount(NULL, "config", "configfs", 0, NULL) = 0 [pid 5609] mkdir("config/usb_gadget/g1", 0777) = 0 [pid 5609] mkdir("config/usb_gadget/g1/functions/uac2.usb0", 0777) = 0 [pid 5609] openat(AT_FDCWD, "config/usb_gadget/g1/functions/uac2.usb0/c_srate", O_WRONLY) = 3 [ 95.641973][ T5609] ================================================================== [ 95.641986][ T5609] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0 [ 95.642030][ T5609] Free of addr ffff88802c3c1e06 by task syz-executor338/5609 [ 95.642039][ T5609] [ 95.642047][ T5609] CPU: 0 UID: 0 PID: 5609 Comm: syz-executor338 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 95.642062][ T5609] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 95.642069][ T5609] Call Trace: [ 95.642074][ T5609] [ 95.642079][ T5609] dump_stack_lvl+0xe8/0x150 [ 95.642097][ T5609] print_address_description+0x55/0x1e0 [ 95.642113][ T5609] print_report+0x58/0x70 [ 95.642127][ T5609] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 95.642143][ T5609] kasan_report_invalid_free+0xea/0x110 [ 95.642162][ T5609] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 95.642183][ T5609] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 95.642199][ T5609] __kasan_slab_pre_free+0x104/0x120 [ 95.642210][ T5609] kfree+0x173/0x6c0 [ 95.642226][ T5609] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 95.642243][ T5609] f_uac2_opts_c_srate_store+0x225/0x2b0 [ 95.642260][ T5609] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 95.642276][ T5609] ? down_read+0x156/0x200 [ 95.642296][ T5609] ? __pfx_down_read+0x10/0x10 [ 95.642312][ T5609] ? configfs_write_iter+0xf2/0x430 [ 95.642325][ T5609] ? configfs_write_iter+0xf2/0x430 [ 95.642337][ T5609] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 95.642354][ T5609] configfs_write_iter+0x33a/0x430 [ 95.642367][ T5609] vfs_write+0x61e/0xbb0 [ 95.642382][ T5609] ? __pfx_vfs_write+0x10/0x10 [ 95.642396][ T5609] ? rt_spin_unlock+0x157/0x200 [ 95.642409][ T5609] ? rt_spin_unlock+0x163/0x200 [ 95.642423][ T5609] ksys_write+0x156/0x270 [ 95.642437][ T5609] ? __pfx_ksys_write+0x10/0x10 [ 95.642451][ T5609] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.642463][ T5609] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.642474][ T5609] do_syscall_64+0x174/0x580 [ 95.642490][ T5609] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.642502][ T5609] ? clear_bhb_loop+0x70/0xc0 [ 95.642514][ T5609] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.642526][ T5609] RIP: 0033:0x7f5acecfe5c9 [ 95.642537][ T5609] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 95.642547][ T5609] RSP: 002b:00007ffdd0c1a768 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 95.642562][ T5609] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5acecfe5c9 [ 95.642571][ T5609] RDX: 000000000000006e RSI: 0000200000000280 RDI: 0000000000000003 [ 95.642579][ T5609] RBP: 0000000000000001 R08: 0000000000000006 R09: 0000000000000006 [ 95.642586][ T5609] R10: 0000000000000006 R11: 0000000000000246 R12: 00007ffdd0c1a8d8 [ 95.642593][ T5609] R13: 431bde82d7b634db R14: 00007f5aced91c40 R15: 0000000000000002 [ 95.642606][ T5609] [ 95.642610][ T5609] [ 95.642613][ T5609] Allocated by task 5609: [ 95.642618][ T5609] kasan_save_track+0x3e/0x80 [ 95.642636][ T5609] __kasan_kmalloc+0x93/0xb0 [ 95.642645][ T5609] __kmalloc_node_track_caller_noprof+0x57f/0x7c0 [ 95.642656][ T5609] kstrdup+0x42/0x100 [ 95.642676][ T5609] f_uac2_opts_c_srate_store+0x11f/0x2b0 [ 95.642691][ T5609] configfs_write_iter+0x33a/0x430 [ 95.642702][ T5609] vfs_write+0x61e/0xbb0 [ 95.642713][ T5609] ksys_write+0x156/0x270 [ 95.642724][ T5609] do_syscall_64+0x174/0x580 [ 95.642738][ T5609] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.642749][ T5609] [ 95.642751][ T5609] The buggy address belongs to the object at ffff88802c3c1e00 [ 95.642751][ T5609] which belongs to the cache kmalloc-128 of size 128 [ 95.642761][ T5609] The buggy address is located 6 bytes inside of [ 95.642761][ T5609] 111-byte region [ffff88802c3c1e00, ffff88802c3c1e6f) [ 95.642773][ T5609] [ 95.642776][ T5609] The buggy address belongs to the physical page: [ 95.642782][ T5609] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2c3c1 [ 95.642794][ T5609] flags: 0x80000000000000(node=0|zone=1) [ 95.642803][ T5609] page_type: f5(slab) [ 95.642819][ T5609] raw: 0080000000000000 ffff88813ffb1a00 dead000000000100 dead000000000122 [ 95.642829][ T5609] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 95.642835][ T5609] page dumped because: kasan: bad access detected [ 95.642841][ T5609] page_owner tracks the page as allocated [ 95.642845][ T5609] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 16917466028, free_ts 0 [ 95.642866][ T5609] post_alloc_hook+0x1f9/0x250 [ 95.642887][ T5609] get_page_from_freelist+0x262a/0x26a0 [ 95.642899][ T5609] __alloc_frozen_pages_noprof+0x18d/0x380 [ 95.642911][ T5609] allocate_slab+0x79/0x5e0 [ 95.642924][ T5609] refill_objects+0x2d8/0x350 [ 95.642937][ T5609] __pcs_replace_empty_main+0x330/0x690 [ 95.642950][ T5609] __kmalloc_cache_noprof+0x468/0x6b0 [ 95.642960][ T5609] request_threaded_irq+0x1eb/0x3a0 [ 95.642977][ T5609] i8042_probe+0xbc2/0x17f0 [ 95.642992][ T5609] platform_probe+0xf9/0x190 [ 95.643004][ T5609] really_probe+0x254/0xae0 [ 95.643018][ T5609] __driver_probe_device+0x1e8/0x360 [ 95.643031][ T5609] driver_probe_device+0x4f/0x240 [ 95.643045][ T5609] __device_attach_driver+0x270/0x410 [ 95.643058][ T5609] bus_for_each_drv+0x25b/0x2f0 [ 95.643068][ T5609] __device_attach+0x2c7/0x450 [ 95.643080][ T5609] page_owner free stack trace missing [ 95.643084][ T5609] [ 95.643087][ T5609] Memory state around the buggy address: [ 95.643093][ T5609] ffff88802c3c1d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc [ 95.643101][ T5609] ffff88802c3c1d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 95.643109][ T5609] >ffff88802c3c1e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 07 fc fc [ 95.643114][ T5609] ^ [ 95.643120][ T5609] ffff88802c3c1e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 95.643127][ T5609] ffff88802c3c1f00: 00 00 00 00 00 00 00 00 00 00 00 00 05 fc fc fc [ 95.643133][ T5609] ================================================================== [ 95.643642][ T5609] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 95.643660][ T5609] CPU: 0 UID: 0 PID: 5609 Comm: syz-executor338 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 95.643697][ T5609] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 95.643709][ T5609] Call Trace: [ 95.643717][ T5609] [ 95.643726][ T5609] vpanic+0x56c/0xa60 [ 95.643760][ T5609] ? __pfx_vpanic+0x10/0x10 [ 95.643791][ T5609] ? __pfx___schedule+0x10/0x10 [ 95.643820][ T5609] panic+0xc5/0xd0 [ 95.643848][ T5609] ? __pfx_panic+0x10/0x10 [ 95.643879][ T5609] ? preempt_schedule_common+0x82/0xd0 [ 95.643911][ T5609] check_panic_on_warn+0x89/0xb0 [ 95.643942][ T5609] end_report+0x73/0x170 [ 95.643963][ T5609] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 95.643991][ T5609] kasan_report_invalid_free+0xfa/0x110 [ 95.644014][ T5609] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 95.644034][ T5609] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 95.644050][ T5609] __kasan_slab_pre_free+0x104/0x120 [ 95.644062][ T5609] kfree+0x173/0x6c0 [ 95.644077][ T5609] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 95.644094][ T5609] f_uac2_opts_c_srate_store+0x225/0x2b0 [ 95.644111][ T5609] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 95.644126][ T5609] ? down_read+0x156/0x200 [ 95.644142][ T5609] ? __pfx_down_read+0x10/0x10 [ 95.644159][ T5609] ? configfs_write_iter+0xf2/0x430 [ 95.644173][ T5609] ? configfs_write_iter+0xf2/0x430 [ 95.644187][ T5609] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 95.644203][ T5609] configfs_write_iter+0x33a/0x430 [ 95.644216][ T5609] vfs_write+0x61e/0xbb0 [ 95.644231][ T5609] ? __pfx_vfs_write+0x10/0x10 [ 95.644245][ T5609] ? rt_spin_unlock+0x157/0x200 [ 95.644258][ T5609] ? rt_spin_unlock+0x163/0x200 [ 95.644272][ T5609] ksys_write+0x156/0x270 [ 95.644285][ T5609] ? __pfx_ksys_write+0x10/0x10 [ 95.644299][ T5609] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.644311][ T5609] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.644322][ T5609] do_syscall_64+0x174/0x580 [ 95.644339][ T5609] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.644350][ T5609] ? clear_bhb_loop+0x70/0xc0 [ 95.644362][ T5609] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.644374][ T5609] RIP: 0033:0x7f5acecfe5c9 [ 95.644385][ T5609] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 95.644395][ T5609] RSP: 002b:00007ffdd0c1a768 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 95.644408][ T5609] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5acecfe5c9 [ 95.644417][ T5609] RDX: 000000000000006e RSI: 0000200000000280 RDI: 0000000000000003 [ 95.644425][ T5609] RBP: 0000000000000001 R08: 0000000000000006 R09: 0000000000000006 [ 95.644432][ T5609] R10: 0000000000000006 R11: 0000000000000246 R12: 00007ffdd0c1a8d8 [ 95.644439][ T5609] R13: 431bde82d7b634db R14: 00007f5aced91c40 R15: 0000000000000002 [ 95.644451][ T5609] [ 95.644607][ T5609] Kernel Offset: disabled