program: r0 = syz_open_dev$dri(&(0x7f0000000280), 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff) fsopen(&(0x7f0000000440)='qnx6\x00', 0x1) mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)="34343130302c34383030302c38383330302c39b63030012c31", 0x19) symlinkat(&(0x7f0000000580)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./myconfig/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r2, &(0x7f0000000640)='usbip-vudc.0', 0xc) r3 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f0000000040)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r3, 0xc06864a1, &(0x7f00000002c0)={0x0, 0x0, r4, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r3, 0xc06864ce, &(0x7f0000000440)={r5, 0x0, 0x0, 0x0, 0x0, [0x0]}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000100)={r6, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000800)={0x0, 0x0, r7}) [ 158.015832][ T5334] ================================================================== [ 158.019321][ T5334] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0 [ 158.023182][ T5334] Free of addr ffff888012ae6118 by task syz.0.0/5334 [ 158.026419][ T5334] [ 158.027636][ T5334] CPU: 0 UID: 0 PID: 5334 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 158.027654][ T5334] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 158.027663][ T5334] Call Trace: [ 158.027671][ T5334] [ 158.027678][ T5334] dump_stack_lvl+0xe8/0x150 [ 158.027704][ T5334] print_address_description+0x55/0x1e0 [ 158.027723][ T5334] print_report+0x58/0x70 [ 158.027742][ T5334] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 158.027763][ T5334] kasan_report_invalid_free+0xea/0x110 [ 158.027782][ T5334] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 158.027797][ T5334] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 158.027811][ T5334] __kasan_slab_pre_free+0x104/0x120 [ 158.027826][ T5334] kfree+0x173/0x640 [ 158.027838][ T5334] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 158.027854][ T5334] f_uac2_opts_c_srate_store+0x225/0x2b0 [ 158.027870][ T5334] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 158.027888][ T5334] ? down_read+0x2be/0x330 [ 158.027904][ T5334] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 158.027920][ T5334] configfs_write_iter+0x337/0x430 [ 158.027938][ T5334] vfs_write+0x612/0xba0 [ 158.027957][ T5334] ? __pfx_vfs_write+0x10/0x10 [ 158.027976][ T5334] ? __fget_files+0x2a/0x420 [ 158.027993][ T5334] ksys_write+0x150/0x270 [ 158.028009][ T5334] ? __pfx_ksys_write+0x10/0x10 [ 158.028028][ T5334] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.028042][ T5334] do_syscall_64+0x174/0x580 [ 158.028057][ T5334] ? trace_irq_disable+0x3b/0x140 [ 158.028072][ T5334] ? clear_bhb_loop+0x40/0x90 [ 158.028086][ T5334] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.028101][ T5334] RIP: 0033:0x7faa7c39e019 [ 158.028115][ T5334] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 158.028126][ T5334] RSP: 002b:00007faa7d1fbfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 158.028141][ T5334] RAX: ffffffffffffffda RBX: 00007faa7c625fa0 RCX: 00007faa7c39e019 [ 158.028150][ T5334] RDX: 0000000000000019 RSI: 0000200000000500 RDI: 0000000000000005 [ 158.028158][ T5334] RBP: 00007faa7c43500c R08: 0000000000000000 R09: 0000000000000000 [ 158.028167][ T5334] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 158.028175][ T5334] R13: 00007faa7c626038 R14: 00007faa7c625fa0 R15: 00007ffcd5e4e7a8 [ 158.028189][ T5334] [ 158.028193][ T5334] [ 158.147456][ T5334] Allocated by task 5334: [ 158.149869][ T5334] kasan_save_track+0x3e/0x80 [ 158.152727][ T5334] __kasan_kmalloc+0x93/0xb0 [ 158.155440][ T5334] __kmalloc_node_track_caller_noprof+0x4c3/0x730 [ 158.158834][ T5334] kstrdup+0x42/0x100 [ 158.160888][ T5334] f_uac2_opts_c_srate_store+0x11f/0x2b0 [ 158.163259][ T5334] configfs_write_iter+0x337/0x430 [ 158.165579][ T5334] vfs_write+0x612/0xba0 [ 158.167517][ T5334] ksys_write+0x150/0x270 [ 158.169501][ T5334] do_syscall_64+0x174/0x580 [ 158.171724][ T5334] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.174397][ T5334] [ 158.175810][ T5334] The buggy address belongs to the object at ffff888012ae6100 [ 158.175810][ T5334] which belongs to the cache kmalloc-32 of size 32 [ 158.183261][ T5334] The buggy address is located 24 bytes inside of [ 158.183261][ T5334] 26-byte region [ffff888012ae6100, ffff888012ae611a) [ 158.190465][ T5334] [ 158.191870][ T5334] The buggy address belongs to the physical page: [ 158.195597][ T5334] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12ae6 [ 158.203348][ T5334] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 158.206644][ T5334] page_type: f5(slab) [ 158.208877][ T5334] raw: 00fff00000000000 ffff88801b041780 dead000000000100 dead000000000122 [ 158.213941][ T5334] raw: 0000000000000000 0000000800400040 00000000f5000000 0000000000000000 [ 158.219541][ T5334] page dumped because: kasan: bad access detected [ 158.222565][ T5334] page_owner tracks the page as allocated [ 158.225078][ T5334] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4994, tgid 4994 (dhcpcd), ts 107327607360, free_ts 107326917771 [ 158.235604][ T5334] post_alloc_hook+0x1f9/0x250 [ 158.238136][ T5334] get_page_from_freelist+0x21fa/0x2270 [ 158.240638][ T5334] __alloc_frozen_pages_noprof+0x18d/0x380 [ 158.243144][ T5334] allocate_slab+0x79/0x5e0 [ 158.245459][ T5334] refill_objects+0x2d5/0x350 [ 158.247890][ T5334] __pcs_replace_empty_main+0x2bf/0x6b0 [ 158.250964][ T5334] __kmalloc_cache_noprof+0x3a7/0x660 [ 158.254062][ T5334] kmem_cache_free+0x156/0x650 [ 158.256333][ T5334] tear_down_vmas+0x312/0x520 [ 158.258233][ T5334] exit_mmap+0x4ca/0x9f0 [ 158.260095][ T5334] __mmput+0x118/0x420 [ 158.262136][ T5334] setup_new_exec+0x30d/0x360 [ 158.264785][ T5334] load_elf_binary+0xbcf/0x2950 [ 158.268170][ T5334] bprm_execve+0x9c7/0x1630 [ 158.270957][ T5334] do_execveat_common+0x4f4/0x670 [ 158.273226][ T5334] __x64_sys_execve+0x97/0xc0 [ 158.275180][ T5334] page last free pid 4994 tgid 4994 stack trace: [ 158.278089][ T5334] __free_frozen_pages+0xc1e/0xd10 [ 158.280845][ T5334] tlb_finish_mmu+0x13e/0x220 [ 158.283265][ T5334] exit_mmap+0x4b2/0x9f0 [ 158.285550][ T5334] __mmput+0x118/0x420 [ 158.287777][ T5334] setup_new_exec+0x30d/0x360 [ 158.290156][ T5334] load_elf_binary+0xbcf/0x2950 [ 158.292369][ T5334] bprm_execve+0x9c7/0x1630 [ 158.294435][ T5334] do_execveat_common+0x4f4/0x670 [ 158.296793][ T5334] __x64_sys_execve+0x97/0xc0 [ 158.299142][ T5334] do_syscall_64+0x174/0x580 [ 158.301472][ T5334] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.304127][ T5334] [ 158.305311][ T5334] Memory state around the buggy address: [ 158.307599][ T5334] ffff888012ae6000: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc [ 158.310961][ T5334] ffff888012ae6080: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc [ 158.314810][ T5334] >ffff888012ae6100: 00 00 00 02 fc fc fc fc 00 00 00 00 fc fc fc fc [ 158.318310][ T5334] ^ [ 158.320273][ T5334] ffff888012ae6180: 00 00 00 00 fc fc fc fc 00 00 03 fc fc fc fc fc [ 158.324079][ T5334] ffff888012ae6200: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc [ 158.327613][ T5334] ================================================================== [ 158.335264][ T5334] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 158.338718][ T5334] CPU: 0 UID: 0 PID: 5334 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 158.342364][ T5334] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 158.346840][ T5334] Call Trace: [ 158.348575][ T5334] [ 158.350065][ T5334] vpanic+0x56c/0xa60 [ 158.351989][ T5334] ? __pfx_vpanic+0x10/0x10 [ 158.354276][ T5334] ? __pfx___schedule+0x10/0x10 [ 158.356657][ T5334] panic+0xc5/0xd0 [ 158.358565][ T5334] ? __pfx_panic+0x10/0x10 [ 158.360763][ T5334] ? preempt_schedule_common+0x82/0xd0 [ 158.363232][ T5334] check_panic_on_warn+0x89/0xb0 [ 158.365787][ T5334] end_report+0x73/0x170 [ 158.367798][ T5334] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 158.370344][ T5334] kasan_report_invalid_free+0xfa/0x110 [ 158.373019][ T5334] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 158.375790][ T5334] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 158.378414][ T5334] __kasan_slab_pre_free+0x104/0x120 [ 158.380991][ T5334] kfree+0x173/0x640 [ 158.382940][ T5334] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 158.385820][ T5334] f_uac2_opts_c_srate_store+0x225/0x2b0 [ 158.388668][ T5334] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 158.391613][ T5334] ? down_read+0x2be/0x330 [ 158.393875][ T5334] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 158.397041][ T5334] configfs_write_iter+0x337/0x430 [ 158.399617][ T5334] vfs_write+0x612/0xba0 [ 158.401642][ T5334] ? __pfx_vfs_write+0x10/0x10 [ 158.404106][ T5334] ? __fget_files+0x2a/0x420 [ 158.406251][ T5334] ksys_write+0x150/0x270 [ 158.408397][ T5334] ? __pfx_ksys_write+0x10/0x10 [ 158.410892][ T5334] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.413937][ T5334] do_syscall_64+0x174/0x580 [ 158.416151][ T5334] ? trace_irq_disable+0x3b/0x140 [ 158.418648][ T5334] ? clear_bhb_loop+0x40/0x90 [ 158.421033][ T5334] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.424093][ T5334] RIP: 0033:0x7faa7c39e019 [ 158.426349][ T5334] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 158.435617][ T5334] RSP: 002b:00007faa7d1fbfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 158.439721][ T5334] RAX: ffffffffffffffda RBX: 00007faa7c625fa0 RCX: 00007faa7c39e019 [ 158.443701][ T5334] RDX: 0000000000000019 RSI: 0000200000000500 RDI: 0000000000000005 [ 158.447303][ T5334] RBP: 00007faa7c43500c R08: 0000000000000000 R09: 0000000000000000 [ 158.450869][ T5334] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 158.454730][ T5334] R13: 00007faa7c626038 R14: 00007faa7c625fa0 R15: 00007ffcd5e4e7a8 [ 158.458332][ T5334] [ 158.460311][ T5334] Kernel Offset: disabled [ 158.462441][ T5334] Rebooting in 86400 seconds..