program:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='config/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000340)="ae12bea89b34343130302c34383030302cb8383230302e3936a3eb85ee721b2103ce49f57edf515a862b34202f080004af38c2595fb57a0218550bce6b7fe122505c8e6e0000000000007800f9606651e98b77d88e01339204f80b0e7276557c4710b17431676c10c838a3de0cbd01ec9f6f25c0c4cec02f3ef0d4ffa5f1b572aa6c98ec46be8f548f91c00c70602900d7569d18f3596820ff893d57987cc60a5338555b2d35becaa76fa620a86715c39cf0c6f919658df5a7dfb155fb498603bc9ee9458ba2677093583aae6429c6b29f1ec0861e24df026e65b9da09a112354a134c444517f1688586c1aa2e501eef83cb3e8413e80dd6bfa397a52b16b9bc6d7933763b147651d2e3fda3428ad8cd3fdf02efbdf7b3e214bf7a76b12ad0f90f56e3a2705ebaa09501673937c9877f13fa51e5deecb5b6290105317ec7e0005cdd97b35af131c3f96eb19fd2dd8f78746642579fe5ecbabec47a665243096ca2bec0b6aa016b9a283c6a3475e2e0c9ab5ce5f3503fdd69f81f925782ba00000000000000", 0x6b)
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
[ 86.720165][ T4641] Bluetooth: hci0: command tx timeout
[ 86.850308][ T5313] ==================================================================
[ 86.853746][ T5313] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0
[ 86.857091][ T5313] Free of addr ffff8880354f4a0b by task syz.0.0/5313
[ 86.859756][ T5313]
[ 86.861080][ T5313] CPU: 0 UID: 0 PID: 5313 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 86.861102][ T5313] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.861112][ T5313] Call Trace:
[ 86.861119][ T5313]
[ 86.861127][ T5313] dump_stack_lvl+0xe8/0x150
[ 86.861153][ T5313] print_address_description+0x55/0x1e0
[ 86.861171][ T5313] print_report+0x58/0x70
[ 86.861187][ T5313] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 86.861210][ T5313] kasan_report_invalid_free+0xea/0x110
[ 86.861228][ T5313] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 86.861249][ T5313] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 86.861267][ T5313] __kasan_slab_pre_free+0x104/0x120
[ 86.861282][ T5313] kfree+0x173/0x640
[ 86.861301][ T5313] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 86.861320][ T5313] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 86.861339][ T5313] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 86.861360][ T5313] ? down_read+0x2be/0x330
[ 86.861373][ T5313] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 86.861396][ T5313] configfs_write_iter+0x337/0x430
[ 86.861419][ T5313] vfs_write+0x612/0xba0
[ 86.861439][ T5313] ? __pfx_vfs_write+0x10/0x10
[ 86.861461][ T5313] ? __fget_files+0x2a/0x420
[ 86.861484][ T5313] ksys_write+0x150/0x270
[ 86.861499][ T5313] ? __pfx_ksys_write+0x10/0x10
[ 86.861516][ T5313] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.861530][ T5313] do_syscall_64+0x174/0x580
[ 86.861557][ T5313] ? clear_bhb_loop+0x70/0xc0
[ 86.861573][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.861584][ T5313] RIP: 0033:0x7fd23ad9e0d9
[ 86.861596][ T5313] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 86.861606][ T5313] RSP: 002b:00007fd23bc23fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 86.861633][ T5313] RAX: ffffffffffffffda RBX: 00007fd23b025fa0 RCX: 00007fd23ad9e0d9
[ 86.861642][ T5313] RDX: 000000000000006b RSI: 0000200000000340 RDI: 0000000000000003
[ 86.861651][ T5313] RBP: 00007fd23ae35024 R08: 0000000000000000 R09: 0000000000000000
[ 86.861658][ T5313] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 86.861666][ T5313] R13: 00007fd23b026038 R14: 00007fd23b025fa0 R15: 00007ffce8b61bc8
[ 86.861679][ T5313]
[ 86.861683][ T5313]
[ 86.956424][ T5313] Allocated by task 5313:
[ 86.958264][ T5313] kasan_save_track+0x3e/0x80
[ 86.960259][ T5313] __kasan_kmalloc+0x93/0xb0
[ 86.962091][ T5313] __kmalloc_node_track_caller_noprof+0x4c3/0x730
[ 86.964572][ T5313] kstrdup+0x42/0x100
[ 86.966173][ T5313] f_uac2_opts_c_srate_store+0x11f/0x2b0
[ 86.968328][ T5313] configfs_write_iter+0x337/0x430
[ 86.970439][ T5313] vfs_write+0x612/0xba0
[ 86.972292][ T5313] ksys_write+0x150/0x270
[ 86.974104][ T5313] do_syscall_64+0x174/0x580
[ 86.976108][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.978642][ T5313]
[ 86.979701][ T5313] The buggy address belongs to the object at ffff8880354f4a00
[ 86.979701][ T5313] which belongs to the cache kmalloc-64 of size 64
[ 86.985513][ T5313] The buggy address is located 11 bytes inside of
[ 86.985513][ T5313] 47-byte region [ffff8880354f4a00, ffff8880354f4a2f)
[ 86.990792][ T5313]
[ 86.991779][ T5313] The buggy address belongs to the physical page:
[ 86.994431][ T5313] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x354f4
[ 86.998013][ T5313] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 87.000920][ T5313] page_type: f5(slab)
[ 87.002628][ T5313] raw: 04fff00000000000 ffff88801b0418c0 dead000000000100 dead000000000122
[ 87.006166][ T5313] raw: 0000000000000000 0000000800200020 00000000f5000000 0000000000000000
[ 87.009700][ T5313] page dumped because: kasan: bad access detected
[ 87.012382][ T5313] page_owner tracks the page as allocated
[ 87.014710][ T5313] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1084, tgid 1084 (kworker/u4:8), ts 12880987122, free_ts 12880952550
[ 87.023040][ T5313] post_alloc_hook+0x1f9/0x250
[ 87.025097][ T5313] get_page_from_freelist+0x21fa/0x2270
[ 87.027337][ T5313] __alloc_frozen_pages_noprof+0x18d/0x380
[ 87.029747][ T5313] allocate_slab+0x79/0x5e0
[ 87.031840][ T5313] refill_objects+0x2d5/0x350
[ 87.033931][ T5313] __pcs_replace_empty_main+0x2bf/0x6b0
[ 87.036191][ T5313] __kmalloc_node_noprof+0x55c/0x740
[ 87.038364][ T5313] __vmalloc_node_range_noprof+0x5d9/0x1730
[ 87.040883][ T5313] __vmalloc_node_noprof+0xc2/0x100
[ 87.043061][ T5313] dup_task_struct+0x2a0/0x8e0
[ 87.045055][ T5313] copy_process+0x820/0x43e0
[ 87.046991][ T5313] kernel_clone+0x2d7/0x940
[ 87.048851][ T5313] user_mode_thread+0x115/0x180
[ 87.050907][ T5313] call_usermodehelper_exec_work+0x5c/0x230
[ 87.053383][ T5313] process_scheduled_works+0xa8e/0x14e0
[ 87.055779][ T5313] worker_thread+0xa47/0xfb0
[ 87.057775][ T5313] page last free pid 1084 tgid 1084 stack trace:
[ 87.060413][ T5313] __free_frozen_pages+0xc1e/0xd10
[ 87.062616][ T5313] __kasan_populate_vmalloc+0x12d/0x1c0
[ 87.064969][ T5313] alloc_vmap_area+0xd1a/0x1420
[ 87.067053][ T5313] __get_vm_area_node+0x1f2/0x300
[ 87.069180][ T5313] __vmalloc_node_range_noprof+0x358/0x1730
[ 87.071786][ T5313] __vmalloc_node_noprof+0xc2/0x100
[ 87.073921][ T5313] dup_task_struct+0x2a0/0x8e0
[ 87.075967][ T5313] copy_process+0x820/0x43e0
[ 87.077942][ T5313] kernel_clone+0x2d7/0x940
[ 87.079914][ T5313] user_mode_thread+0x115/0x180
[ 87.081948][ T5313] call_usermodehelper_exec_work+0x5c/0x230
[ 87.084458][ T5313] process_scheduled_works+0xa8e/0x14e0
[ 87.086751][ T5313] worker_thread+0xa47/0xfb0
[ 87.088632][ T5313] kthread+0x388/0x470
[ 87.090355][ T5313] ret_from_fork+0x514/0xb70
[ 87.092383][ T5313] ret_from_fork_asm+0x1a/0x30
[ 87.094411][ T5313]
[ 87.095472][ T5313] Memory state around the buggy address:
[ 87.097816][ T5313] ffff8880354f4900: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
[ 87.101201][ T5313] ffff8880354f4980: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 87.104471][ T5313] >ffff8880354f4a00: 00 00 00 00 00 07 fc fc fc fc fc fc fc fc fc fc
[ 87.107769][ T5313] ^
[ 87.109596][ T5313] ffff8880354f4a80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
[ 87.112861][ T5313] ffff8880354f4b00: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
[ 87.116120][ T5313] ==================================================================
[ 87.278638][ T5313] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 87.281752][ T5313] CPU: 0 UID: 0 PID: 5313 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 87.285487][ T5313] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 87.289801][ T5313] Call Trace:
[ 87.291420][ T5313]
[ 87.292819][ T5313] vpanic+0x56c/0xa60
[ 87.294500][ T5313] ? __pfx_vpanic+0x10/0x10
[ 87.296417][ T5313] ? __pfx___schedule+0x10/0x10
[ 87.298445][ T5313] panic+0xc5/0xd0
[ 87.300160][ T5313] ? __pfx_panic+0x10/0x10
[ 87.302082][ T5313] ? preempt_schedule_common+0x82/0xd0
[ 87.304346][ T5313] check_panic_on_warn+0x89/0xb0
[ 87.306379][ T5313] end_report+0x73/0x170
[ 87.308220][ T5313] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 87.310785][ T5313] kasan_report_invalid_free+0xfa/0x110
[ 87.313134][ T5313] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 87.315545][ T5313] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 87.317967][ T5313] __kasan_slab_pre_free+0x104/0x120
[ 87.320304][ T5313] kfree+0x173/0x640
[ 87.321920][ T5313] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 87.324319][ T5313] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 87.326662][ T5313] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 87.329232][ T5313] ? down_read+0x2be/0x330
[ 87.331129][ T5313] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 87.333664][ T5313] configfs_write_iter+0x337/0x430
[ 87.335838][ T5313] vfs_write+0x612/0xba0
[ 87.337599][ T5313] ? __pfx_vfs_write+0x10/0x10
[ 87.339792][ T5313] ? __fget_files+0x2a/0x420
[ 87.341755][ T5313] ksys_write+0x150/0x270
[ 87.343555][ T5313] ? __pfx_ksys_write+0x10/0x10
[ 87.345463][ T5313] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.347935][ T5313] do_syscall_64+0x174/0x580
[ 87.349827][ T5313] ? clear_bhb_loop+0x70/0xc0
[ 87.351839][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.354208][ T5313] RIP: 0033:0x7fd23ad9e0d9
[ 87.356092][ T5313] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 87.364131][ T5313] RSP: 002b:00007fd23bc23fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 87.367732][ T5313] RAX: ffffffffffffffda RBX: 00007fd23b025fa0 RCX: 00007fd23ad9e0d9
[ 87.371175][ T5313] RDX: 000000000000006b RSI: 0000200000000340 RDI: 0000000000000003
[ 87.374461][ T5313] RBP: 00007fd23ae35024 R08: 0000000000000000 R09: 0000000000000000
[ 87.377980][ T5313] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 87.381459][ T5313] R13: 00007fd23b026038 R14: 00007fd23b025fa0 R15: 00007ffce8b61bc8
[ 87.384928][ T5313]
[ 87.386648][ T5313] Kernel Offset: disabled
[ 87.388461][ T5313] Rebooting in 86400 seconds..