==================================================================
BUG: KASAN: double-free in dev_free+0x43f/0x750 drivers/usb/gadget/legacy/raw_gadget.c:226
Free of addr ffff88804ca7c520 by task syz.1.2625/13366

CPU: 0 UID: 0 PID: 13366 Comm: syz.1.2625 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report_invalid_free+0xea/0x110 mm/kasan/report.c:557
 check_slab_allocation mm/kasan/common.c:-1 [inline]
 __kasan_slab_pre_free+0x104/0x120 mm/kasan/common.c:272
 kasan_slab_pre_free include/linux/kasan.h:199 [inline]
 slab_free_hook mm/slub.c:2693 [inline]
 slab_free mm/slub.c:6509 [inline]
 kfree+0x173/0x650 mm/slub.c:6802
 dev_free+0x43f/0x750 drivers/usb/gadget/legacy/raw_gadget.c:226
 kref_put include/linux/kref.h:65 [inline]
 raw_release+0x199/0x260 drivers/usb/gadget/legacy/raw_gadget.c:474
 __fput+0x40d/0xa50 fs/file_table.c:512
 task_work_run+0x1d9/0x270 kernel/task_work.c:233
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0x73a/0x2350 kernel/exit.c:986
 __do_sys_exit kernel/exit.c:1096 [inline]
 __se_sys_exit kernel/exit.c:1094 [inline]
 __ia32_sys_exit+0x40/0x40 kernel/exit.c:1094
 ia32_sys_call+0x18c5/0x18d0 arch/x86/include/generated/asm/syscalls_32.h:2
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline]
 __do_fast_syscall_32+0x27a/0x6b0 arch/x86/entry/syscall_32.c:291
 do_fast_syscall_32+0x33/0x70 arch/x86/entry/syscall_32.c:316
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf740f0ec
Code: Unable to access opcode bytes at 0xf740f0c2.
RSP: 002b:00000000f54264cc EFLAGS: 00000206 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000000
RDX: 0000000000000000 RSI: 00000000f7051360 RDI: 00000000f54265f4
RBP: 00000000f70565b9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>

Allocated by task 13379:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:409 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:426
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5414 [inline]
 __kmalloc_node_track_caller_noprof+0x4b4/0x720 mm/slub.c:5545
 memdup_user+0x2b/0xd0 mm/util.c:221
 raw_ioctl_ep_enable drivers/usb/gadget/legacy/raw_gadget.c:848 [inline]
 raw_ioctl+0xdbc/0x41c0 drivers/usb/gadget/legacy/raw_gadget.c:1319
 __do_compat_sys_ioctl fs/ioctl.c:695 [inline]
 __se_compat_sys_ioctl fs/ioctl.c:638 [inline]
 __ia32_compat_sys_ioctl+0x5ea/0x950 fs/ioctl.c:638
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline]
 __do_fast_syscall_32+0x27a/0x6b0 arch/x86/entry/syscall_32.c:291
 do_fast_syscall_32+0x33/0x70 arch/x86/entry/syscall_32.c:316
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e

Freed by task 13377:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:264 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:296
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2748 [inline]
 slab_free mm/slub.c:6509 [inline]
 kfree+0x1c5/0x650 mm/slub.c:6802
 dev_free+0x43f/0x750 drivers/usb/gadget/legacy/raw_gadget.c:226
 kref_put include/linux/kref.h:65 [inline]
 raw_release+0x199/0x260 drivers/usb/gadget/legacy/raw_gadget.c:474
 __fput+0x40d/0xa50 fs/file_table.c:512
 task_work_run+0x1d9/0x270 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:70 [inline]
 exit_to_user_mode_loop+0x204/0x770 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline]
 __do_fast_syscall_32+0x437/0x6b0 arch/x86/entry/syscall_32.c:294
 do_fast_syscall_32+0x33/0x70 arch/x86/entry/syscall_32.c:316
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e

The buggy address belongs to the object at ffff88804ca7c520
 which belongs to the cache kmalloc-16 of size 16
The buggy address is located 0 bytes inside of
 16-byte region [ffff88804ca7c520, ffff88804ca7c530)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88804ca7c780 pfn:0x4ca7c
flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000200 ffff88801c041640 ffffea00012ae8d0 ffffea00012a8ed0
raw: ffff88804ca7c780 000000000080003c 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5680, tgid 5680 (kworker/0:4), ts 616529361705
 create_dummy_stack mm/page_owner.c:121 [inline]
 register_dummy_stack+0x98/0x100 mm/page_owner.c:127
 init_page_owner+0x2e/0x600 mm/page_owner.c:145
 invoke_init_callbacks mm/page_ext.c:152 [inline]
 page_ext_init+0x511/0x550 mm/page_ext.c:485
 mm_core_init+0x97/0xb0 mm/mm_init.c:2685
page last free pid 13371 tgid 13357 ts 616507637365 stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 __free_pages_prepare mm/page_alloc.c:1418 [inline]
 __free_frozen_pages+0xc93/0xd90 mm/page_alloc.c:2962
 tlb_batch_list_free mm/mmu_gather.c:161 [inline]
 tlb_finish_mmu+0x13e/0x220 mm/mmu_gather.c:552
 exit_mmap+0x4b2/0x9f0 mm/mmap.c:1328
 __mmput+0x118/0x420 kernel/fork.c:1193
 exit_mm+0x18e/0x240 kernel/exit.c:592
 do_exit+0x6cd/0x2350 kernel/exit.c:974
 do_group_exit+0x22d/0x2f0 kernel/exit.c:1129
 get_signal+0x121b/0x12c0 kernel/signal.c:3112
 arch_do_signal_or_restart+0xbb/0x860 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
 exit_to_user_mode_loop+0x10e/0x770 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline]
 __do_fast_syscall_32+0x437/0x6b0 arch/x86/entry/syscall_32.c:294
 do_fast_syscall_32+0x33/0x70 arch/x86/entry/syscall_32.c:316
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e

Memory state around the buggy address:
 ffff88804ca7c400: fa fb fc fc fa fb fc fc 00 01 fc fc 00 05 fc fc
 ffff88804ca7c480: 00 05 fc fc 00 00 fc fc fa fb fc fc fa fb fc fc
>ffff88804ca7c500: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
                               ^
 ffff88804ca7c580: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
 ffff88804ca7c600: fa fb fc fc fa fb fc fc 00 06 fc fc fa fb fc fc
==================================================================