program: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001600010325bd70000000000015"], 0x14}, 0x1, 0x0, 0x0, 0x25238faddd3d601f}, 0x4000000) sendmsg$NLBL_UNLABEL_C_STATICADD(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0) write(r1, &(0x7f0000000000)="3434f130704782fecc528be6813832302c39306681f409c72a3024a95abc89e0c4e46bfb", 0x24) symlinkat(&(0x7f0000000500)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00') read$FUSE(r1, &(0x7f0000000600)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_BMAP(r1, &(0x7f0000002640)={0x18, 0x0, r2, {0x7}}, 0x18) r3 = openat(r1, &(0x7f0000000040)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x105000, 0xa3) write(r3, &(0x7f00000005c0)='usbip-vudc.0', 0xc) [ 145.384009][ T4648] Bluetooth: hci0: command tx timeout [ 145.459690][ T5346] ================================================================== [ 145.462849][ T5346] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0 [ 145.466106][ T5346] Free of addr ffff8880126b7f11 by task syz.0.0/5346 [ 145.468721][ T5346] [ 145.469699][ T5346] CPU: 0 UID: 0 PID: 5346 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 145.469715][ T5346] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 145.469723][ T5346] Call Trace: [ 145.469730][ T5346] [ 145.469736][ T5346] dump_stack_lvl+0xe8/0x150 [ 145.469756][ T5346] print_address_description+0x55/0x1e0 [ 145.469774][ T5346] print_report+0x58/0x70 [ 145.469787][ T5346] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 145.469800][ T5346] kasan_report_invalid_free+0xea/0x110 [ 145.469814][ T5346] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 145.469825][ T5346] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 145.469836][ T5346] __kasan_slab_pre_free+0x104/0x120 [ 145.469848][ T5346] kfree+0x173/0x640 [ 145.469860][ T5346] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 145.469872][ T5346] f_uac2_opts_c_srate_store+0x225/0x2b0 [ 145.469884][ T5346] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 145.469898][ T5346] ? down_read+0x2be/0x330 [ 145.469918][ T5346] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 145.469934][ T5346] configfs_write_iter+0x337/0x430 [ 145.469948][ T5346] vfs_write+0x612/0xba0 [ 145.469967][ T5346] ? __pfx_vfs_write+0x10/0x10 [ 145.469984][ T5346] ? __fget_files+0x2a/0x420 [ 145.469997][ T5346] ksys_write+0x150/0x270 [ 145.470010][ T5346] ? __pfx_ksys_write+0x10/0x10 [ 145.470027][ T5346] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 145.470037][ T5346] do_syscall_64+0x174/0x580 [ 145.470050][ T5346] ? trace_irq_disable+0x3b/0x140 [ 145.470063][ T5346] ? clear_bhb_loop+0x40/0x90 [ 145.470073][ T5346] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 145.470083][ T5346] RIP: 0033:0x7fb19239e019 [ 145.470095][ T5346] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 145.470104][ T5346] RSP: 002b:00007fb1932abfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 145.470115][ T5346] RAX: ffffffffffffffda RBX: 00007fb192625fa0 RCX: 00007fb19239e019 [ 145.470122][ T5346] RDX: 0000000000000024 RSI: 0000200000000000 RDI: 0000000000000003 [ 145.470128][ T5346] RBP: 00007fb19243500c R08: 0000000000000000 R09: 0000000000000000 [ 145.470136][ T5346] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 145.470142][ T5346] R13: 00007fb192626038 R14: 00007fb192625fa0 R15: 00007ffe095ebae8 [ 145.470153][ T5346] [ 145.470157][ T5346] [ 145.570121][ T5346] Allocated by task 5346: [ 145.572091][ T5346] kasan_save_track+0x3e/0x80 [ 145.574244][ T5346] __kasan_kmalloc+0x93/0xb0 [ 145.576273][ T5346] __kmalloc_node_track_caller_noprof+0x4c3/0x730 [ 145.579024][ T5346] kstrdup+0x42/0x100 [ 145.580774][ T5346] f_uac2_opts_c_srate_store+0x11f/0x2b0 [ 145.583157][ T5346] configfs_write_iter+0x337/0x430 [ 145.585357][ T5346] vfs_write+0x612/0xba0 [ 145.587214][ T5346] ksys_write+0x150/0x270 [ 145.589143][ T5346] do_syscall_64+0x174/0x580 [ 145.591146][ T5346] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 145.593717][ T5346] [ 145.594763][ T5346] The buggy address belongs to the object at ffff8880126b7f00 [ 145.594763][ T5346] which belongs to the cache kmalloc-64 of size 64 [ 145.600672][ T5346] The buggy address is located 17 bytes inside of [ 145.600672][ T5346] 37-byte region [ffff8880126b7f00, ffff8880126b7f25) [ 145.606265][ T5346] [ 145.607339][ T5346] The buggy address belongs to the physical page: [ 145.610066][ T5346] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x126b7 [ 145.613746][ T5346] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 145.616872][ T5346] page_type: f5(slab) [ 145.618657][ T5346] raw: 00fff00000000000 ffff88801b0418c0 dead000000000100 dead000000000122 [ 145.622394][ T5346] raw: 0000000000000000 0000000800200020 00000000f5000000 0000000000000000 [ 145.626098][ T5346] page dumped because: kasan: bad access detected [ 145.628914][ T5346] page_owner tracks the page as allocated [ 145.631449][ T5346] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 5309, tgid 5309 (syz-executor), ts 143518979911, free_ts 143415995718 [ 145.639942][ T5346] post_alloc_hook+0x1f9/0x250 [ 145.642088][ T5346] get_page_from_freelist+0x21fa/0x2270 [ 145.644520][ T5346] __alloc_pages_slowpath+0x383/0xcc0 [ 145.646912][ T5346] __alloc_frozen_pages_noprof+0x31f/0x380 [ 145.649466][ T5346] allocate_slab+0x79/0x5e0 [ 145.651449][ T5346] ___slab_alloc+0x16a/0x950 [ 145.653449][ T5346] __kmalloc_flags_noprof+0x347/0x800 [ 145.655799][ T5346] alloc_slab_obj_exts+0x4d/0x170 [ 145.657997][ T5346] __memcg_slab_post_alloc_hook+0x5d3/0xf10 [ 145.660550][ T5346] __kvmalloc_node_noprof+0x61c/0x860 [ 145.662845][ T5346] xt_alloc_table_info+0x40/0xb0 [ 145.665040][ T5346] arpt_register_table+0xe0/0x440 [ 145.667268][ T5346] arptable_filter_table_init+0x41/0x70 [ 145.669697][ T5346] xt_find_table_lock+0x311/0x400 [ 145.671935][ T5346] xt_request_find_table_lock+0x26/0x100 [ 145.674373][ T5346] do_arpt_get_ctl+0x719/0x1190 [ 145.676430][ T5346] page last free pid 180 tgid 180 stack trace: [ 145.679039][ T5346] __free_frozen_pages+0xc1e/0xd10 [ 145.681258][ T5346] __slab_free+0x274/0x2c0 [ 145.683118][ T5346] qlist_free_all+0x99/0x100 [ 145.685190][ T5346] kasan_quarantine_reduce+0x148/0x160 [ 145.687560][ T5346] __kasan_slab_alloc+0x22/0x80 [ 145.689616][ T5346] __kmalloc_cache_noprof+0x2ab/0x660 [ 145.691907][ T5346] __ipv6_dev_mc_inc+0x447/0xa40 [ 145.693997][ T5346] addrconf_dad_work+0x3fc/0x15c0 [ 145.696230][ T5346] process_scheduled_works+0xa8e/0x14e0 [ 145.698654][ T5346] worker_thread+0xa47/0xfb0 [ 145.700641][ T5346] kthread+0x388/0x470 [ 145.702318][ T5346] ret_from_fork+0x514/0xb70 [ 145.704283][ T5346] ret_from_fork_asm+0x1a/0x30 [ 145.706346][ T5346] [ 145.707365][ T5346] Memory state around the buggy address: [ 145.709705][ T5346] ffff8880126b7e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 145.713035][ T5346] ffff8880126b7e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 145.716445][ T5346] >ffff8880126b7f00: 00 00 00 00 05 fc fc fc fc fc fc fc fc fc fc fc [ 145.719914][ T5346] ^ [ 145.721770][ T5346] ffff8880126b7f80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 145.725220][ T5346] ffff8880126b8000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 145.728692][ T5346] ================================================================== [ 145.750485][ T5346] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 145.753483][ T5346] CPU: 0 UID: 0 PID: 5346 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 145.757110][ T5346] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 145.761179][ T5346] Call Trace: [ 145.762550][ T5346] [ 145.763805][ T5346] vpanic+0x56c/0xa60 [ 145.765575][ T5346] ? __pfx_vpanic+0x10/0x10 [ 145.767657][ T5346] ? __pfx___schedule+0x10/0x10 [ 145.769777][ T5346] panic+0xc5/0xd0 [ 145.771468][ T5346] ? __pfx_panic+0x10/0x10 [ 145.773464][ T5346] ? preempt_schedule_common+0x82/0xd0 [ 145.775976][ T5346] check_panic_on_warn+0x89/0xb0 [ 145.778227][ T5346] end_report+0x73/0x170 [ 145.780108][ T5346] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 145.782507][ T5346] kasan_report_invalid_free+0xfa/0x110 [ 145.784944][ T5346] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 145.787457][ T5346] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 145.790028][ T5346] __kasan_slab_pre_free+0x104/0x120 [ 145.792294][ T5346] kfree+0x173/0x640 [ 145.794090][ T5346] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 145.796545][ T5346] f_uac2_opts_c_srate_store+0x225/0x2b0 [ 145.798962][ T5346] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 145.801643][ T5346] ? down_read+0x2be/0x330 [ 145.803676][ T5346] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 145.806334][ T5346] configfs_write_iter+0x337/0x430 [ 145.808584][ T5346] vfs_write+0x612/0xba0 [ 145.810420][ T5346] ? __pfx_vfs_write+0x10/0x10 [ 145.812555][ T5346] ? __fget_files+0x2a/0x420 [ 145.814571][ T5346] ksys_write+0x150/0x270 [ 145.816478][ T5346] ? __pfx_ksys_write+0x10/0x10 [ 145.818521][ T5346] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 145.820997][ T5346] do_syscall_64+0x174/0x580 [ 145.822904][ T5346] ? trace_irq_disable+0x3b/0x140 [ 145.824981][ T5346] ? clear_bhb_loop+0x40/0x90 [ 145.826859][ T5346] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 145.829233][ T5346] RIP: 0033:0x7fb19239e019 [ 145.831109][ T5346] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 145.839410][ T5346] RSP: 002b:00007fb1932abfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 145.842873][ T5346] RAX: ffffffffffffffda RBX: 00007fb192625fa0 RCX: 00007fb19239e019 [ 145.846358][ T5346] RDX: 0000000000000024 RSI: 0000200000000000 RDI: 0000000000000003 [ 145.849881][ T5346] RBP: 00007fb19243500c R08: 0000000000000000 R09: 0000000000000000 [ 145.853291][ T5346] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 145.856633][ T5346] R13: 00007fb192626038 R14: 00007fb192625fa0 R15: 00007ffe095ebae8 [ 145.860099][ T5346] [ 145.861786][ T5346] Kernel Offset: disabled [ 145.863605][ T5346] Rebooting in 86400 seconds..