program: r0 = socket$igmp6(0xa, 0x3, 0x2) getsockopt(r0, 0xff, 0x6, 0x0, &(0x7f0000000000)=0x49) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=ANY=[@ANYBLOB="3c01000019000100000000000000000020010000000000000000000000000000ac1414aa00000000000000000000000000000000000000001162b845c057827de2517e0a000000000000ae", @ANYRES32=r0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000000000000080400000000000000000000000000000000000000000000000000084000500ac1414aa000000000000000000000000000000003c00000000000000ffffffff0000000000000000000000000000000000030000000000000000000000000000fe8000000000000000000000000000bb000000003300000000000000fe8000"/244], 0x13c}}, 0x80c08c0) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000140)={'nr0\x00', 0x8001}) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000780)=ANY=[@ANYBLOB="48010000160000022bbd7000fcdbdf25fe80000000000000000000000000001c000000000000000000000000000000004e2100004e2382090a0020805e000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe800000000000000000000000000012000004d32b000000ff0200000000000000000000000000010100000000000000ffffffff000000000001000000000000f2020000000000000600000000000000040000000000000000f01f0000000000fdffffffffffffff05000000000000006ebc0000000000000200000000000000880a00000000000004000000020000000002000027bd70000135000008000004c000000000000000090000000700000014000e00ac1414aa0000000000000000000000000c001c00", @ANYRES32=0x0, @ANYBLOB="01000000300017000500000027bd70002bbd70002cbd700025bd7000040000000000000004000000f6000d0009000000e1660000"], 0x148}}, 0x0) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x1c3) write(r4, &(0x7f00000004c0)=':4100,48000,88200,96000,176400,1', 0x20) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x0, 0x4, 0x12, r4, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'ip_vti0\x00', 0x0}) r6 = socket$netlink(0x10, 0x3, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r7 = syz_open_procfs(0x0, &(0x7f0000000180)='net/tcp6\x00') prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) read$FUSE(r7, 0x0, 0x0) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000030500000000000000000090f84f", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b0001006d616373656300000400028008000500", @ANYRES32=r5], 0x3c}}, 0x0) syz_emit_ethernet(0xfdef, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa1798cf6b62a981d1000388e5400700880068000003029078ffffffffe0000002009405ed789d442cce83ac1e00017fe29d680a01010200000006ffffffff00000005e0000002fffffffce000000100000001891b52ffffffffac1e0101ac1414aa000000007f000001ac1414aa441c2c410000000000000401ffffffff00000000000000000000001800000013069078e0000001"], 0x0) ioctl$IOMMU_IOAS_UNMAP(0xffffffffffffffff, 0x3b86, &(0x7f0000000340)={0x18, 0x0, 0x2, 0x1c}) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x9, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], 0x0, 0x40d, 0x0, 0x0, 0x100, 0x75, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa7}, 0x94) truncate(&(0x7f0000000100)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x4) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x2, 0x4, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x4, 0x0, 0x0, 0x41100, 0x70, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r7, 0x0, 0x0, 0x0, 0x0, 0xfffffff5}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r8, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)=[0x4], 0x0, 0x0, 0x2e, 0x1}}, 0x40) syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00') [ 94.014173][ T44] Bluetooth: hci0: command tx timeout [ 94.090351][ T5328] netlink: 132 bytes leftover after parsing attributes in process `syz.0.0'. [ 94.187616][ T5328] ================================================================== [ 94.190909][ T5328] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0 [ 94.194659][ T5328] Free of addr ffff88801f9b6b86 by task syz.0.0/5328 [ 94.197569][ T5328] [ 94.198681][ T5328] CPU: 0 UID: 0 PID: 5328 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.198697][ T5328] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.198703][ T5328] Call Trace: [ 94.198712][ T5328] [ 94.198717][ T5328] dump_stack_lvl+0xe8/0x150 [ 94.198737][ T5328] print_address_description+0x55/0x1e0 [ 94.198753][ T5328] print_report+0x58/0x70 [ 94.198766][ T5328] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 94.198779][ T5328] kasan_report_invalid_free+0xea/0x110 [ 94.198794][ T5328] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 94.198807][ T5328] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 94.198819][ T5328] __kasan_slab_pre_free+0x104/0x120 [ 94.198832][ T5328] kfree+0x173/0x640 [ 94.198842][ T5328] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 94.198856][ T5328] f_uac2_opts_c_srate_store+0x225/0x2b0 [ 94.198869][ T5328] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 94.198882][ T5328] ? down_read+0x2be/0x330 [ 94.198896][ T5328] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 94.198908][ T5328] configfs_write_iter+0x337/0x430 [ 94.198924][ T5328] vfs_write+0x612/0xba0 [ 94.198940][ T5328] ? __pfx_vfs_write+0x10/0x10 [ 94.198956][ T5328] ? __fget_files+0x2a/0x420 [ 94.198970][ T5328] ksys_write+0x150/0x270 [ 94.198985][ T5328] ? __pfx_ksys_write+0x10/0x10 [ 94.199000][ T5328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.199012][ T5328] do_syscall_64+0x174/0x580 [ 94.199024][ T5328] ? clear_bhb_loop+0x40/0x90 [ 94.199036][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.199046][ T5328] RIP: 0033:0x7f8849d9e019 [ 94.199057][ T5328] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.199066][ T5328] RSP: 002b:00007f884ac5bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 94.199079][ T5328] RAX: ffffffffffffffda RBX: 00007f884a025fa0 RCX: 00007f8849d9e019 [ 94.199087][ T5328] RDX: 0000000000000020 RSI: 00002000000004c0 RDI: 0000000000000007 [ 94.199093][ T5328] RBP: 00007f8849e3500c R08: 0000000000000000 R09: 0000000000000000 [ 94.199101][ T5328] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.199108][ T5328] R13: 00007f884a026038 R14: 00007f884a025fa0 R15: 00007ffcfb4e0f88 [ 94.199121][ T5328] [ 94.199124][ T5328] [ 94.302766][ T5328] Allocated by task 5328: [ 94.304676][ T5328] kasan_save_track+0x3e/0x80 [ 94.306731][ T5328] __kasan_kmalloc+0x93/0xb0 [ 94.308672][ T5328] __kmalloc_node_track_caller_noprof+0x4c3/0x730 [ 94.311378][ T5328] kstrdup+0x42/0x100 [ 94.313048][ T5328] f_uac2_opts_c_srate_store+0x11f/0x2b0 [ 94.315354][ T5328] configfs_write_iter+0x337/0x430 [ 94.317506][ T5328] vfs_write+0x612/0xba0 [ 94.319508][ T5328] ksys_write+0x150/0x270 [ 94.321314][ T5328] do_syscall_64+0x174/0x580 [ 94.323315][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.325700][ T5328] [ 94.326638][ T5328] The buggy address belongs to the object at ffff88801f9b6b80 [ 94.326638][ T5328] which belongs to the cache kmalloc-64 of size 64 [ 94.332059][ T5328] The buggy address is located 6 bytes inside of [ 94.332059][ T5328] 33-byte region [ffff88801f9b6b80, ffff88801f9b6ba1) [ 94.337103][ T5328] [ 94.338113][ T5328] The buggy address belongs to the physical page: [ 94.340369][ T5328] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1f9b6 [ 94.343580][ T5328] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 94.346533][ T5328] page_type: f5(slab) [ 94.348228][ T5328] raw: 00fff00000000000 ffff88801b0418c0 dead000000000100 dead000000000122 [ 94.351942][ T5328] raw: 0000000000000000 0000000800200020 00000000f5000000 0000000000000000 [ 94.355637][ T5328] page dumped because: kasan: bad access detected [ 94.358306][ T5328] page_owner tracks the page as allocated [ 94.360770][ T5328] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 5290, tgid 5290 (syz-executor), ts 92115119697, free_ts 92098223357 [ 94.368908][ T5328] post_alloc_hook+0x1f9/0x250 [ 94.371039][ T5328] get_page_from_freelist+0x21fa/0x2270 [ 94.373436][ T5328] __alloc_frozen_pages_noprof+0x18d/0x380 [ 94.376078][ T5328] allocate_slab+0x79/0x5e0 [ 94.378133][ T5328] ___slab_alloc+0x16a/0x950 [ 94.380267][ T5328] __kmalloc_flags_noprof+0x347/0x800 [ 94.382602][ T5328] alloc_slab_obj_exts+0x4d/0x170 [ 94.384891][ T5328] __memcg_slab_post_alloc_hook+0x5d3/0xf10 [ 94.387471][ T5328] __kvmalloc_node_noprof+0x61c/0x860 [ 94.389751][ T5328] xt_alloc_table_info+0x40/0xb0 [ 94.391733][ T5328] ip6t_register_table+0xcd/0x320 [ 94.393756][ T5328] ip6table_nat_table_init+0x42/0x300 [ 94.395965][ T5328] xt_find_table_lock+0x311/0x400 [ 94.398051][ T5328] xt_request_find_table_lock+0x26/0x100 [ 94.400479][ T5328] do_ip6t_get_ctl+0x77b/0x12f0 [ 94.402576][ T5328] nf_getsockopt+0x26e/0x290 [ 94.404474][ T5328] page last free pid 5326 tgid 5326 stack trace: [ 94.407120][ T5328] __free_frozen_pages+0xc1e/0xd10 [ 94.409329][ T5328] __mmdrop+0xf3/0x510 [ 94.411068][ T5328] exit_mm+0x221/0x2d0 [ 94.412729][ T5328] do_exit+0x6cd/0x2360 [ 94.414275][ T5328] do_group_exit+0x22d/0x2f0 [ 94.416168][ T5328] __x64_sys_exit_group+0x3f/0x40 [ 94.418311][ T5328] x64_sys_call+0x221a/0x2240 [ 94.420262][ T5328] do_syscall_64+0x174/0x580 [ 94.422025][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.424633][ T5328] [ 94.425712][ T5328] Memory state around the buggy address: [ 94.427939][ T5328] ffff88801f9b6a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 94.431226][ T5328] ffff88801f9b6b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 94.434515][ T5328] >ffff88801f9b6b80: 00 00 00 00 01 fc fc fc fc fc fc fc fc fc fc fc [ 94.437844][ T5328] ^ [ 94.439535][ T5328] ffff88801f9b6c00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 94.442718][ T5328] ffff88801f9b6c80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 94.445770][ T5328] ================================================================== [ 94.474754][ T5328] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 94.477827][ T5328] CPU: 0 UID: 0 PID: 5328 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.481511][ T5328] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.485894][ T5328] Call Trace: [ 94.487354][ T5328] [ 94.488586][ T5328] vpanic+0x56c/0xa60 [ 94.490230][ T5328] ? __pfx_vpanic+0x10/0x10 [ 94.492214][ T5328] ? __pfx___schedule+0x10/0x10 [ 94.494274][ T5328] panic+0xc5/0xd0 [ 94.495930][ T5328] ? __pfx_panic+0x10/0x10 [ 94.497845][ T5328] ? preempt_schedule_common+0x82/0xd0 [ 94.500214][ T5328] check_panic_on_warn+0x89/0xb0 [ 94.502116][ T5328] end_report+0x73/0x170 [ 94.503848][ T5328] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 94.506361][ T5328] kasan_report_invalid_free+0xfa/0x110 [ 94.508654][ T5328] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 94.511176][ T5328] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 94.513609][ T5328] __kasan_slab_pre_free+0x104/0x120 [ 94.515891][ T5328] kfree+0x173/0x640 [ 94.517611][ T5328] ? f_uac2_opts_c_srate_store+0x225/0x2b0 [ 94.520091][ T5328] f_uac2_opts_c_srate_store+0x225/0x2b0 [ 94.522441][ T5328] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 94.524800][ T5328] ? down_read+0x2be/0x330 [ 94.526615][ T5328] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10 [ 94.529046][ T5328] configfs_write_iter+0x337/0x430 [ 94.531124][ T5328] vfs_write+0x612/0xba0 [ 94.532662][ T5328] ? __pfx_vfs_write+0x10/0x10 [ 94.534515][ T5328] ? __fget_files+0x2a/0x420 [ 94.536376][ T5328] ksys_write+0x150/0x270 [ 94.538228][ T5328] ? __pfx_ksys_write+0x10/0x10 [ 94.540328][ T5328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.542792][ T5328] do_syscall_64+0x174/0x580 [ 94.544771][ T5328] ? clear_bhb_loop+0x40/0x90 [ 94.546747][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.549271][ T5328] RIP: 0033:0x7f8849d9e019 [ 94.551108][ T5328] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.559408][ T5328] RSP: 002b:00007f884ac5bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 94.562912][ T5328] RAX: ffffffffffffffda RBX: 00007f884a025fa0 RCX: 00007f8849d9e019 [ 94.566090][ T5328] RDX: 0000000000000020 RSI: 00002000000004c0 RDI: 0000000000000007 [ 94.569434][ T5328] RBP: 00007f8849e3500c R08: 0000000000000000 R09: 0000000000000000 [ 94.572607][ T5328] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.576046][ T5328] R13: 00007f884a026038 R14: 00007f884a025fa0 R15: 00007ffcfb4e0f88 [ 94.579479][ T5328] [ 94.581232][ T5328] Kernel Offset: disabled [ 94.583506][ T5328] Rebooting in 86400 seconds..