ci2 starts bisection 2026-09-22 06:49:11.354621623 +0000 UTC m=+8905.093805860 bisecting fixing commit since e4f7d8be268ecf717f94ee2e242afa79ddeacaed building syzkaller on 359b2492fb73a5bf44731ae260190a27e877d5ca ensuring issue is reproducible on original commit e4f7d8be268ecf717f94ee2e242afa79ddeacaed testing commit e4f7d8be268ecf717f94ee2e242afa79ddeacaed gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 49602583d03e17a52fd131d712df9dd745404d69a02e9b2895b580af8265dcea all runs: crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store representative crash: KASAN: invalid-free in f_uac2_opts_p_srate_store, types: [KASAN-INVALID-FREE] check whether we can drop unnecessary instrumentation disabling configs for [hang memleak ubsan bug_or_warning locking atomic_sleep], they are not needed testing commit e4f7d8be268ecf717f94ee2e242afa79ddeacaed gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 3e93a4d4fd096b789e7d3fa8ec523addfc75abb8661d811939c08ec9f7b6b7e6 all runs: crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store representative crash: KASAN: invalid-free in f_uac2_opts_p_srate_store, types: [KASAN-INVALID-FREE] the bug reproduces without the instrumentation disabling configs for [locking atomic_sleep hang memleak ubsan bug_or_warning], they are not needed kconfig minimization: base=7505 full=9788 leaves diff=2010 split chunks (needed=false): <2010> split chunk #0 of len 2010 into 5 parts testing without sub-chunk 1/5 disabling configs for [locking atomic_sleep hang memleak ubsan bug_or_warning], they are not needed testing commit e4f7d8be268ecf717f94ee2e242afa79ddeacaed gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 96c3c4f5a114188b989860b9810886af58e53cb32477f167f50ac51f505b5c0c all runs: crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store representative crash: KASAN: invalid-free in f_uac2_opts_p_srate_store, types: [KASAN-INVALID-FREE] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [locking atomic_sleep hang memleak ubsan bug_or_warning], they are not needed testing commit e4f7d8be268ecf717f94ee2e242afa79ddeacaed gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 9d53352069694b19342c5ece510526ad618ff38dce723723a3b856f46ef83819 all runs: crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store representative crash: KASAN: invalid-free in f_uac2_opts_p_srate_store, types: [KASAN-INVALID-FREE] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [ubsan bug_or_warning locking atomic_sleep hang memleak], they are not needed testing commit e4f7d8be268ecf717f94ee2e242afa79ddeacaed gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 0028286fab70a2e37fa823493a6705c5f7982ba985c198f580879e6a2a470eef all runs: crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store representative crash: KASAN: invalid-free in f_uac2_opts_p_srate_store, types: [KASAN-INVALID-FREE] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [atomic_sleep hang memleak ubsan bug_or_warning locking], they are not needed testing commit e4f7d8be268ecf717f94ee2e242afa79ddeacaed gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 00f51517935a58325342fc571b4165ed08b39080dcb14db9e36367f39f5b2a3d all runs: crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store representative crash: KASAN: invalid-free in f_uac2_opts_p_srate_store, types: [KASAN-INVALID-FREE] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [atomic_sleep hang memleak ubsan bug_or_warning locking], they are not needed testing commit e4f7d8be268ecf717f94ee2e242afa79ddeacaed gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: f616fccdb2271866e17794c945b8bf35d777f1033d822d2655f1b54a36e4a432 all runs: OK false negative chance: 0.000 minimized to 402 configs; suspects: [ATM BCMA BLK_DEV_ZONED CFG80211 CFG80211_WEXT CRYPTO_842 CRYPTO_LZ4 CRYPTO_LZ4HC CRYPTO_LZO CRYPTO_ZSTD DRM HID_ZEROPLUS INPUT_TOUCHSCREEN ISO9660_FS MAC80211 MEDIA_CEC_SUPPORT MEDIA_RADIO_SUPPORT MEDIA_TEST_SUPPORT MFD_MT6370 MFD_VIPERBOARD MTD_UBI PARPORT PARTITION_ADVANCED PCCARD PCMCIA PHONET RADIO_ADAPTERS RADIO_SI470X RADIO_SI4713 RFKILL SND SOUND SSB TARGET_CORE TLS TLS_TOE TOOLS_SUPPORT_RELR TOUCHSCREEN_ATMEL_MXT TOUCHSCREEN_EDT_FT5X06 TOUCHSCREEN_GOODIX TOUCHSCREEN_SUR40 TOUCHSCREEN_USB_3M TOUCHSCREEN_USB_COMPOSITE TOUCHSCREEN_USB_DMC_TSC10 TOUCHSCREEN_USB_E2I TOUCHSCREEN_USB_EASYTOUCH TOUCHSCREEN_USB_EGALAX TOUCHSCREEN_USB_ELO TOUCHSCREEN_USB_ETT_TC45USB TOUCHSCREEN_USB_ETURBO TOUCHSCREEN_USB_GENERAL_TOUCH TOUCHSCREEN_USB_GOTOP TOUCHSCREEN_USB_GUNZE TOUCHSCREEN_USB_IDEALTEK TOUCHSCREEN_USB_IRTOUCH TOUCHSCREEN_USB_ITM TOUCHSCREEN_USB_JASTEC TOUCHSCREEN_USB_NEXIO TOUCHSCREEN_USB_PANJIT TOUCHSCREEN_USB_ZYTRONIC TRANSPARENT_HUGEPAGE_MADVISE TTPCI_EEPROM TTY_PRINTK TUN_VNET_CROSS_LE TYPEC_ANX7411 TYPEC_DP_ALTMODE TYPEC_MT6360 TYPEC_MUX_FSA4480 TYPEC_MUX_PI3USB30532 TYPEC_NVIDIA_ALTMODE TYPEC_RT1711H TYPEC_RT1719 TYPEC_STUSB160X TYPEC_TCPCI_MAXIM TYPEC_TCPCI_MT6370 TYPEC_UCSI TYPEC_WUSB3801 UBIFS_ATIME_SUPPORT UBIFS_FS UBIFS_FS_ADVANCED_COMPR UBIFS_FS_LZO UBIFS_FS_SECURITY UBIFS_FS_XATTR UBIFS_FS_ZLIB UBIFS_FS_ZSTD UCSI_ACPI UCSI_CCG UCSI_STM32G0 UDF_FS UDMABUF UFS_FS UFS_FS_WRITE UHID ULTRIX_PARTITION UNICODE UNIXWARE_DISKLABEL UNIX_DIAG USB4 USB4_NET USBIP_CORE USBIP_HOST USBIP_VHCI_HCD USBIP_VUDC USBPCWATCHDOG USB_ADUTUX USB_AIRSPY USB_ALI_M5632 USB_AMD5536UDC USB_AN2720 USB_ANNOUNCE_NEW_DEVICES USB_APPLEDISPLAY USB_ATM USB_C67X00_HCD USB_CATC USB_CDC_PHONET USB_CDNSP_GADGET USB_CDNSP_HOST USB_CDNSP_PCI USB_CHAOSKEY USB_CONFIGFS_F_HID USB_CONFIGFS_F_LB_SS USB_CONFIGFS_F_MIDI USB_CONFIGFS_F_PRINTER USB_CONFIGFS_F_TCM USB_CONFIGFS_F_UAC1 USB_CONFIGFS_F_UAC1_LEGACY USB_CONFIGFS_F_UAC2 USB_CONFIGFS_F_UVC USB_CONFIGFS_PHONET USB_CXACRU USB_CYPRESS_CY7C63 USB_CYTHERM USB_DSBR USB_DUMMY_HCD USB_DWC2_PCI USB_DWC3_GADGET USB_DWC3_ULPI USB_DYNAMIC_MINORS USB_EG20T USB_EHCI_FSL USB_EHSET_TEST_FIXTURE USB_EMI26 USB_EMI62 USB_EPSON2888 USB_EZUSB_FX2 USB_FEW_INIT_RETRIES USB_FOTG210_HCD USB_FOTG210_UDC USB_FTDI_ELAN USB_F_HID USB_F_MIDI USB_F_PHONET USB_F_PRINTER USB_F_SS_LB USB_F_TCM USB_F_UAC1 USB_F_UAC1_LEGACY USB_F_UAC2 USB_F_UVC USB_GADGETFS USB_GADGET_DEBUG_FILES USB_GADGET_DEBUG_FS USB_GL860 USB_GOKU USB_GPIO_VBUS USB_GR_UDC USB_GSPCA USB_GSPCA_BENQ USB_GSPCA_CONEX USB_GSPCA_CPIA1 USB_GSPCA_DTCS033 USB_GSPCA_ETOMS USB_GSPCA_FINEPIX USB_GSPCA_JEILINJ USB_GSPCA_JL2005BCD USB_GSPCA_KINECT USB_GSPCA_KONICA USB_GSPCA_MARS USB_GSPCA_MR97310A USB_GSPCA_NW80X USB_GSPCA_OV519 USB_GSPCA_OV534 USB_GSPCA_OV534_9 USB_GSPCA_PAC207 USB_GSPCA_PAC7302 USB_GSPCA_PAC7311 USB_GSPCA_SE401 USB_GSPCA_SN9C2028 USB_GSPCA_SN9C20X USB_GSPCA_SONIXB USB_GSPCA_SONIXJ USB_GSPCA_SPCA1528 USB_GSPCA_SPCA500 USB_GSPCA_SPCA501 USB_GSPCA_SPCA505 USB_GSPCA_SPCA506 USB_GSPCA_SPCA508 USB_GSPCA_SPCA561 USB_GSPCA_SQ905 USB_GSPCA_SQ905C USB_GSPCA_SQ930X USB_GSPCA_STK014 USB_GSPCA_STK1135 USB_GSPCA_STV0680 USB_GSPCA_SUNPLUS USB_GSPCA_T613 USB_GSPCA_TOPRO USB_GSPCA_TOUPTEK USB_GSPCA_TV8532 USB_GSPCA_VC032X USB_GSPCA_VICAM USB_GSPCA_XIRLINK_CIT USB_GSPCA_ZC3XX USB_HACKRF USB_HCD_BCMA USB_HCD_SSB USB_HIDDEV USB_HSIC_USB4604 USB_HSO USB_HUB_USB251XB USB_IDMOUSE USB_IOWARRIOR USB_IPHETH USB_ISIGHTFW USB_ISP116X_HCD USB_ISP1301 USB_KAWETH USB_KC2190 USB_KEENE USB_LCD USB_LD USB_LEDS_TRIGGER_USBPORT USB_LED_TRIG USB_LEGOTOWER USB_LINK_LAYER_TEST USB_M5602 USB_MA901 USB_MAX3420_UDC USB_MAX3421_HCD USB_MDC800 USB_MICROTEK USB_MON USB_MR800 USB_MSI2500 USB_MV_U3D USB_MV_UDC USB_NET2272 USB_NET2272_DMA USB_NET2280 USB_NET_AQC111 USB_NET_CDC_EEM USB_NET_CDC_MBIM USB_NET_CH9200 USB_NET_CX82310_ETH USB_NET_GL620A USB_NET_HUAWEI_CDC_NCM USB_NET_INT51X1 USB_NET_KALMIA USB_NET_QMI_WWAN USB_NET_RNDIS_HOST USB_NET_RNDIS_WLAN USB_NET_SR9700 USB_OTG_FSM USB_OXU210HP_HCD USB_PRINTER USB_PULSE8_CEC USB_PWC USB_PWC_INPUT_EVDEV USB_PXA27X USB_R8A66597 USB_R8A66597_HCD USB_RAINSHADOW_CEC USB_RAREMONO USB_RAW_GADGET USB_S2255 USB_SERIAL_AIRCABLE USB_SERIAL_ARK3116 USB_SERIAL_BELKIN USB_SERIAL_CH341 USB_SERIAL_CONSOLE USB_SERIAL_CYBERJACK USB_SERIAL_CYPRESS_M8 USB_SERIAL_DEBUG USB_SERIAL_DIGI_ACCELEPORT USB_SERIAL_EDGEPORT USB_SERIAL_EDGEPORT_TI USB_SERIAL_EMPEG USB_SERIAL_F81232 USB_SERIAL_F8153X USB_SERIAL_GARMIN USB_SERIAL_GENERIC USB_SERIAL_IPAQ USB_SERIAL_IPW USB_SERIAL_IR USB_SERIAL_IUU USB_SERIAL_KEYSPAN USB_SERIAL_KEYSPAN_PDA USB_SERIAL_KLSI USB_SERIAL_KOBIL_SCT USB_SERIAL_MCT_U232 USB_SERIAL_METRO USB_SERIAL_MOS7715_PARPORT USB_SERIAL_MOS7720 USB_SERIAL_MOS7840 USB_SERIAL_MXUPORT USB_SERIAL_NAVMAN USB_SERIAL_OMNINET USB_SERIAL_OPTICON USB_SERIAL_OTI6858 USB_SERIAL_PL2303 USB_SERIAL_QCAUX USB_SERIAL_QT2 USB_SERIAL_QUALCOMM USB_SERIAL_SAFE USB_SERIAL_SIERRAWIRELESS USB_SERIAL_SIMPLE USB_SERIAL_SPCP8X5 USB_SERIAL_SSU100 USB_SERIAL_SYMBOL USB_SERIAL_TI USB_SERIAL_UPD78F0730 USB_SERIAL_VISOR USB_SERIAL_WHITEHEAT USB_SERIAL_WISHBONE USB_SERIAL_XR USB_SERIAL_XSENS_MT USB_SEVSEG USB_SI470X USB_SI4713 USB_SIERRA_NET USB_SISUSBVGA USB_SL811_CS USB_SL811_HCD USB_SL811_HCD_ISO USB_SPEEDTOUCH USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_ENE_UB6250 USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_STV06XX USB_TEST USB_TMC USB_TRANCEVIBRATOR USB_U132_HCD USB_UAS USB_UEAGLEATM USB_UHCI_HCD USB_USS720 USB_U_AUDIO USB_VL600 USB_WDM USB_XHCI_DBGCAP USB_XUSBATM USB_YUREX USERFAULTFD USERIO U_SERIAL_CONSOLE V4L_TEST_DRIVERS VALIDATE_FS_PARSER VDPA VDPA_SIM VDPA_SIM_BLOCK VDPA_SIM_NET VDPA_USER VHOST VHOST_CROSS_ENDIAN_LEGACY VHOST_IOTLB VHOST_NET VHOST_RING VHOST_VDPA VHOST_VSOCK VIDEOMODE_HELPERS VIDEO_AU0828 VIDEO_AU0828_RC VIDEO_AU0828_V4L2 VIDEO_CS53L32A VIDEO_CX231XX VIDEO_CX231XX_ALSA VIDEO_CX231XX_DVB VIDEO_CX231XX_RC VIDEO_CX2341X VIDEO_CX25840 VIDEO_EM28XX VIDEO_EM28XX_ALSA VIDEO_EM28XX_DVB VIDEO_EM28XX_RC VIDEO_EM28XX_V4L2 VIDEO_GO7007 VIDEO_GO7007_LOADER VIDEO_GO7007_USB VIDEO_GO7007_USB_S2250_BOARD VIDEO_HDPVR VIDEO_MSP3400 VIDEO_PVRUSB2 VIDEO_PVRUSB2_DVB VIDEO_PVRUSB2_SYSFS VIDEO_SAA711X VIDEO_STK1160 VIDEO_STK1160_COMMON VIDEO_TUNER VIDEO_TVEEPROM VIDEO_USBTV VIDEO_V4L2_TPG VIDEO_VICODEC VIDEO_VIM2M VIDEO_VIMC VIDEO_VIVID VIDEO_VIVID_CEC VIDEO_WM8775 VIPERBOARD_ADC VIRTIO_DMA_SHARED_BUFFER VIRTIO_FS VIRTIO_MMIO_CMDLINE_DEVICES VIRTIO_VDPA VIRTIO_VSOCKETS VIRTIO_VSOCKETS_COMMON VIRT_WIFI VMXNET3 VP_VDPA VSOCKETS VSOCKETS_DIAG VSOCKETS_LOOPBACK VSOCKMON VXFS_FS WCN36XX WEXT_CORE WEXT_PRIV WEXT_PROC WIREGUARD WIRELESS WIRELESS_EXT WLAN WLAN_VENDOR_ADMTEK WLAN_VENDOR_ATH WLAN_VENDOR_SILABS XDP_SOCKETS XDP_SOCKETS_DIAG XFRM XFRM_AH XFRM_ALGO XFRM_ESP XFRM_ESPINTCP XFRM_INTERFACE XFRM_IPCOMP XFRM_MIGRATE XFRM_OFFLOAD XFRM_STATISTICS XFRM_SUB_POLICY XFRM_USER XFS_FS XFS_ONLINE_REPAIR XFS_ONLINE_SCRUB XFS_POSIX_ACL XFS_QUOTA XFS_RT XILLYBUS_CLASS XILLYUSB ZBUD ZEROPLUS_FF ZISOFS ZONEFS_FS ZPOOL ZRAM ZRAM_DEF_COMP_LZORLE ZSMALLOC ZSWAP ZSWAP_COMPRESSOR_DEFAULT_LZO ZSWAP_DEFAULT_ON ZSWAP_ZPOOL_DEFAULT_ZBUD] disabling configs for [memleak ubsan bug_or_warning locking atomic_sleep hang], they are not needed testing current HEAD 1a8763b93150b2c8f3992c27a5ce7857fee4ab0f testing commit 1a8763b93150b2c8f3992c27a5ce7857fee4ab0f gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: f0230558061215413042a4c7f3ba0e7c2351724d3a08e0e0f33353465e957ad9 all runs: crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store representative crash: KASAN: invalid-free in f_uac2_opts_p_srate_store, types: [KASAN-INVALID-FREE] crash still not fixed/happens on the oldest tested release revisions tested: 8, total time: 2h17m30.644986546s (build: 55m51.147792087s, test: 1h10m22.777018763s) crash still not fixed or there were kernel test errors commit msg: Linux 6.1.188 crash: KASAN: invalid-free in f_uac2_opts_p_srate_store ================================================================== BUG: KASAN: invalid-free in slab_free mm/slub.c:3687 [inline] BUG: KASAN: invalid-free in __kmem_cache_free+0xbc/0x21c mm/slub.c:3700 Free of addr ffff0000d5cf8112 by task syz.2.17/4069 CPU: 0 PID: 4069 Comm: syz.2.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 Call trace: dump_backtrace+0x100/0x14c arch/arm64/kernel/stacktrace.c:158 show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:165 __dump_stack+0x28/0x38 lib/dump_stack.c:88 dump_stack_lvl+0x64/0x90 lib/dump_stack.c:106 print_address_description+0x88/0x218 mm/kasan/report.c:316 print_report+0x50/0x68 mm/kasan/report.c:420 kasan_report_invalid_free+0x98/0xe0 mm/kasan/report.c:489 ____kasan_slab_free+0x168/0x1b0 mm/kasan/common.c:-1 __kasan_slab_free+0x18/0x28 mm/kasan/common.c:245 kasan_slab_free include/linux/kasan.h:177 [inline] slab_free_hook mm/slub.c:1729 [inline] slab_free_freelist_hook+0x16c/0x1e8 mm/slub.c:1755 slab_free mm/slub.c:3687 [inline] __kmem_cache_free+0xbc/0x21c mm/slub.c:3700 kfree+0x88/0xb8 mm/slab_common.c:988 f_uac2_opts_p_srate_store+0xcc/0x210 drivers/usb/gadget/function/f_uac2.c:2078 flush_write_buffer fs/configfs/file.c:207 [inline] configfs_write_iter+0x21c/0x2e8 fs/configfs/file.c:229 call_write_iter include/linux/fs.h:2271 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x32c/0x690 fs/read_write.c:584 ksys_write+0xec/0x1a8 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __arm64_sys_write+0x78/0x8c fs/read_write.c:646 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x78/0x230 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x160/0x1d4 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x50/0xfc arch/arm64/kernel/syscall.c:204 el0_svc+0x34/0xc4 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 Allocated by task 4069: kasan_save_stack mm/kasan/common.c:46 [inline] kasan_set_track+0x4c/0x80 mm/kasan/common.c:53 kasan_save_alloc_info+0x24/0x30 mm/kasan/generic.c:505 ____kasan_kmalloc mm/kasan/common.c:375 [inline] __kasan_kmalloc+0xa0/0xb8 mm/kasan/common.c:384 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slab_common.c:936 [inline] __kmalloc_node_track_caller+0xc4/0xf0 mm/slab_common.c:956 kstrdup+0x54/0x80 mm/util.c:61 f_uac2_opts_p_srate_store+0x14c/0x210 drivers/usb/gadget/function/f_uac2.c:2078 flush_write_buffer fs/configfs/file.c:207 [inline] configfs_write_iter+0x21c/0x2e8 fs/configfs/file.c:229 call_write_iter include/linux/fs.h:2271 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x32c/0x690 fs/read_write.c:584 ksys_write+0xec/0x1a8 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __arm64_sys_write+0x78/0x8c fs/read_write.c:646 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x78/0x230 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x160/0x1d4 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x50/0xfc arch/arm64/kernel/syscall.c:204 el0_svc+0x34/0xc4 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 Last potentially related work creation: kasan_save_stack+0x40/0x70 mm/kasan/common.c:46 __kasan_record_aux_stack+0xc0/0xdc mm/kasan/generic.c:486 kasan_record_aux_stack_noalloc+0x14/0x20 mm/kasan/generic.c:496 kvfree_call_rcu+0x6c/0x644 kernel/rcu/tree.c:3405 kernfs_unlink_open_file+0x210/0x2a4 fs/kernfs/file.c:653 kernfs_fop_release+0x210/0x2f8 fs/kernfs/file.c:825 __fput+0x148/0x5ec fs/file_table.c:320 ____fput+0x10/0x1c fs/file_table.c:348 task_work_run+0x180/0x214 kernel/task_work.c:203 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] do_notify_resume+0x12a8/0x1f88 arch/arm64/kernel/signal.c:1151 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline] exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline] el0_svc+0x60/0xc4 arch/arm64/kernel/entry-common.c:638 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 Second to last potentially related work creation: kasan_save_stack+0x40/0x70 mm/kasan/common.c:46 __kasan_record_aux_stack+0xc0/0xdc mm/kasan/generic.c:486 kasan_record_aux_stack_noalloc+0x14/0x20 mm/kasan/generic.c:496 kvfree_call_rcu+0x6c/0x644 kernel/rcu/tree.c:3405 kernfs_unlink_open_file+0x210/0x2a4 fs/kernfs/file.c:653 kernfs_fop_release+0x210/0x2f8 fs/kernfs/file.c:825 __fput+0x148/0x5ec fs/file_table.c:320 ____fput+0x10/0x1c fs/file_table.c:348 task_work_run+0x180/0x214 kernel/task_work.c:203 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] do_notify_resume+0x12a8/0x1f88 arch/arm64/kernel/signal.c:1151 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline] exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline] el0_svc+0x60/0xc4 arch/arm64/kernel/entry-common.c:638 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 The buggy address belongs to the object at ffff0000d5cf8100 which belongs to the cache kmalloc-128 of size 128 The buggy address is located 18 bytes inside of 128-byte region [ffff0000d5cf8100, ffff0000d5cf8180) The buggy address belongs to the physical page: page:0000000000d9791d refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115cf8 flags: 0xbff800000000200(slab|node=0|zone=2|lastcpupid=0x7ff) raw: 0bff800000000200 fffffc000323d980 dead000000000003 ffff0000c0002300 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000d5cf8000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff0000d5cf8080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff0000d5cf8100: 00 00 00 00 00 07 fc fc fc fc fc fc fc fc fc fc ^ ffff0000d5cf8180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff0000d5cf8200: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc ==================================================================