program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ef)
r0 = socket$rxrpc(0x21, 0x2, 0xa)
setsockopt$RXRPC_SECURITY_KEY(r0, 0x110, 0x1, &(0x7f0000000040)='-\x00', 0xff2a)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)="34343130302c345642ff38ae507f9fde7c919b2d766a87fb7e0a0bbf65126ad9998397181ed9e73fd67825e6453b648cd3a86c0512903b7145a85708f507781b6e4a472c34608af43b0062d396b252ef2267677fc52ecdf9309e6e6f288a99504be14dbbd89576ea79e5f4542f6c15dc1e6c3c42772959c60cf55be66306f4956e2299eebae6182fb278c354984a94a2c35803ac6d2da18287ab00de3c8163dbef2e54518bcaf17ccb9c9d197260b89123253f56434523cd", 0xb8)
syz_emit_ethernet(0x7e, &(0x7f0000000240)={@broadcast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote}, @dest_unreach={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @dev, @local, {[@generic={0x0, 0xa, "ee0dd9de36ed4bcc"}, @timestamp_prespec={0x44, 0xc, 0x0, 0x3, 0x0, [{@loopback=0x7f00002f}]}, @ssrr={0x89, 0xf, 0x0, [@private, @broadcast, @broadcast]}, @timestamp_addr={0x44, 0x4}, @timestamp={0x44, 0x14, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0]}]}}}}}}}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000005f00)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x0, 0x0)
[ 93.241547][ T5290] Bluetooth: hci0: command tx timeout
[ 93.250533][ T10] cfg80211: failed to load regulatory.db
[ 93.411965][ T5328] ==================================================================
[ 93.415408][ T5328] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.418747][ T5328] Free of addr ffff888043e85a44 by task syz.0.0/5328
[ 93.421592][ T5328]
[ 93.422729][ T5328] CPU: 0 UID: 0 PID: 5328 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 93.422745][ T5328] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 93.422753][ T5328] Call Trace:
[ 93.422760][ T5328]
[ 93.422766][ T5328] dump_stack_lvl+0xe8/0x150
[ 93.422788][ T5328] print_address_description+0x55/0x1e0
[ 93.422805][ T5328] print_report+0x58/0x70
[ 93.422818][ T5328] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.422831][ T5328] kasan_report_invalid_free+0xea/0x110
[ 93.422846][ T5328] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.422859][ T5328] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.422872][ T5328] __kasan_slab_pre_free+0x104/0x120
[ 93.422885][ T5328] kfree+0x173/0x640
[ 93.422896][ T5328] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.422909][ T5328] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.422922][ T5328] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 93.422936][ T5328] ? down_read+0x2be/0x330
[ 93.422948][ T5328] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 93.422960][ T5328] configfs_write_iter+0x337/0x430
[ 93.422976][ T5328] vfs_write+0x612/0xba0
[ 93.422992][ T5328] ? __pfx_vfs_write+0x10/0x10
[ 93.423008][ T5328] ? __fget_files+0x2a/0x420
[ 93.423023][ T5328] ksys_write+0x150/0x270
[ 93.423036][ T5328] ? __pfx_ksys_write+0x10/0x10
[ 93.423051][ T5328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.423063][ T5328] do_syscall_64+0x174/0x580
[ 93.423074][ T5328] ? trace_irq_disable+0x3b/0x140
[ 93.423087][ T5328] ? clear_bhb_loop+0x40/0x90
[ 93.423099][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.423109][ T5328] RIP: 0033:0x7f74fd59de99
[ 93.423121][ T5328] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 93.423130][ T5328] RSP: 002b:00007f74fe4e0fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 93.423142][ T5328] RAX: ffffffffffffffda RBX: 00007f74fd825fa0 RCX: 00007f74fd59de99
[ 93.423150][ T5328] RDX: 00000000000000b8 RSI: 0000200000000280 RDI: 0000000000000004
[ 93.423157][ T5328] RBP: 00007f74fd633eaf R08: 0000000000000000 R09: 0000000000000000
[ 93.423165][ T5328] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 93.423172][ T5328] R13: 00007f74fd826038 R14: 00007f74fd825fa0 R15: 00007ffde0302ca8
[ 93.423186][ T5328]
[ 93.423190][ T5328]
[ 93.515884][ T5328] Allocated by task 5328:
[ 93.517529][ T5328] kasan_save_track+0x3e/0x80
[ 93.519437][ T5328] __kasan_kmalloc+0x93/0xb0
[ 93.521399][ T5328] __kmalloc_node_track_caller_noprof+0x4c3/0x730
[ 93.524157][ T5328] kstrdup+0x42/0x100
[ 93.525852][ T5328] f_uac2_opts_c_srate_store+0x11f/0x2b0
[ 93.528162][ T5328] configfs_write_iter+0x337/0x430
[ 93.530185][ T5328] vfs_write+0x612/0xba0
[ 93.531923][ T5328] ksys_write+0x150/0x270
[ 93.533583][ T5328] do_syscall_64+0x174/0x580
[ 93.535236][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.537405][ T5328]
[ 93.538351][ T5328] The buggy address belongs to the object at ffff888043e85a00
[ 93.538351][ T5328] which belongs to the cache kmalloc-96 of size 96
[ 93.543297][ T5328] The buggy address is located 68 bytes inside of
[ 93.543297][ T5328] 74-byte region [ffff888043e85a00, ffff888043e85a4a)
[ 93.548245][ T5328]
[ 93.549205][ T5328] The buggy address belongs to the physical page:
[ 93.551800][ T5328] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x43e85
[ 93.555011][ T5328] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 93.557698][ T5328] page_type: f5(slab)
[ 93.559392][ T5328] raw: 04fff00000000000 ffff88801b041280 dead000000000122 0000000000000000
[ 93.562909][ T5328] raw: 0000000000000000 0000000800200020 00000000f5000000 0000000000000000
[ 93.566447][ T5328] page dumped because: kasan: bad access detected
[ 93.569074][ T5328] page_owner tracks the page as allocated
[ 93.571440][ T5328] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 13, tgid 13 (kworker/u4:1), ts 93353207201, free_ts 90817492997
[ 93.579315][ T5328] post_alloc_hook+0x1f9/0x250
[ 93.581160][ T5328] get_page_from_freelist+0x21fa/0x2270
[ 93.583399][ T5328] __alloc_frozen_pages_noprof+0x18d/0x380
[ 93.585824][ T5328] allocate_slab+0x79/0x5e0
[ 93.587696][ T5328] refill_objects+0x2d5/0x350
[ 93.589496][ T5328] __pcs_replace_empty_main+0x2bf/0x6b0
[ 93.591710][ T5328] __kmalloc_cache_noprof+0x3a7/0x660
[ 93.593866][ T5328] nsim_fib_event_nb+0x185/0x11d0
[ 93.596075][ T5328] notifier_call_chain+0x1a5/0x3d0
[ 93.598143][ T5328] atomic_notifier_call_chain+0xda/0x180
[ 93.600529][ T5328] call_fib_notifiers+0x31/0x60
[ 93.602649][ T5328] fib6_add_rt2node+0x15f3/0x3940
[ 93.604856][ T5328] fib6_add+0x952/0x1930
[ 93.606723][ T5328] ip6_ins_rt+0xd6/0x140
[ 93.608473][ T5328] __ipv6_ifa_notify+0x4e8/0xc60
[ 93.610555][ T5328] addrconf_dad_completed+0x1a1/0xe60
[ 93.612792][ T5328] page last free pid 5289 tgid 5289 stack trace:
[ 93.615422][ T5328] __free_frozen_pages+0xc1e/0xd10
[ 93.617549][ T5328] __slab_free+0x274/0x2c0
[ 93.619473][ T5328] qlist_free_all+0x99/0x100
[ 93.621405][ T5328] kasan_quarantine_reduce+0x148/0x160
[ 93.623726][ T5328] __kasan_slab_alloc+0x22/0x80
[ 93.625704][ T5328] kmem_cache_alloc_node_noprof+0x355/0x610
[ 93.628041][ T5328] __alloc_skb+0x1d7/0x7a0
[ 93.629819][ T5328] netlink_sendmsg+0x5d4/0xb40
[ 93.631804][ T5328] sock_sendmsg_nosec+0x13a/0x180
[ 93.633966][ T5328] __sys_sendto+0x408/0x5a0
[ 93.635860][ T5328] __x64_sys_sendto+0xde/0x100
[ 93.637862][ T5328] do_syscall_64+0x174/0x580
[ 93.639766][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.642231][ T5328]
[ 93.643094][ T5328] Memory state around the buggy address:
[ 93.645210][ T5328] ffff888043e85900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 93.648222][ T5328] ffff888043e85980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 93.651505][ T5328] >ffff888043e85a00: 00 00 00 00 00 00 00 00 00 02 fc fc fc fc fc fc
[ 93.654867][ T5328] ^
[ 93.657362][ T5328] ffff888043e85a80: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[ 93.660593][ T5328] ffff888043e85b00: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[ 93.663743][ T5328] ==================================================================
[ 93.726970][ T25] audit: type=1804 audit(1785298257.431:2): pid=5329 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.0" name="/newroot/0/myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate" dev="configfs" ino=4256 res=1 errno=0
[ 93.740254][ T5328] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 93.743436][ T5328] CPU: 0 UID: 0 PID: 5328 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 93.746989][ T5328] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 93.751074][ T5328] Call Trace:
[ 93.752502][ T5328]
[ 93.753706][ T5328] vpanic+0x56c/0xa60
[ 93.755447][ T5328] ? __pfx_vpanic+0x10/0x10
[ 93.757392][ T5328] ? __pfx___schedule+0x10/0x10
[ 93.759380][ T5328] panic+0xc5/0xd0
[ 93.761013][ T5328] ? __pfx_panic+0x10/0x10
[ 93.763008][ T5328] ? preempt_schedule_common+0x82/0xd0
[ 93.765295][ T5328] check_panic_on_warn+0x89/0xb0
[ 93.767362][ T5328] end_report+0x73/0x170
[ 93.769146][ T5328] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.771599][ T5328] kasan_report_invalid_free+0xfa/0x110
[ 93.773890][ T5328] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.776470][ T5328] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.778943][ T5328] __kasan_slab_pre_free+0x104/0x120
[ 93.781152][ T5328] kfree+0x173/0x640
[ 93.782821][ T5328] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.785219][ T5328] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.787587][ T5328] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 93.790176][ T5328] ? down_read+0x2be/0x330
[ 93.792163][ T5328] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 93.794684][ T5328] configfs_write_iter+0x337/0x430
[ 93.796842][ T5328] vfs_write+0x612/0xba0
[ 93.798658][ T5328] ? __pfx_vfs_write+0x10/0x10
[ 93.800788][ T5328] ? __fget_files+0x2a/0x420
[ 93.802782][ T5328] ksys_write+0x150/0x270
[ 93.804597][ T5328] ? __pfx_ksys_write+0x10/0x10
[ 93.806719][ T5328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.809318][ T5328] do_syscall_64+0x174/0x580
[ 93.811425][ T5328] ? trace_irq_disable+0x3b/0x140
[ 93.813604][ T5328] ? clear_bhb_loop+0x40/0x90
[ 93.815704][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.818229][ T5328] RIP: 0033:0x7f74fd59de99
[ 93.820146][ T5328] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 93.828130][ T5328] RSP: 002b:00007f74fe4e0fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 93.831722][ T5328] RAX: ffffffffffffffda RBX: 00007f74fd825fa0 RCX: 00007f74fd59de99
[ 93.835147][ T5328] RDX: 00000000000000b8 RSI: 0000200000000280 RDI: 0000000000000004
[ 93.838523][ T5328] RBP: 00007f74fd633eaf R08: 0000000000000000 R09: 0000000000000000
[ 93.841896][ T5328] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 93.845197][ T5328] R13: 00007f74fd826038 R14: 00007f74fd825fa0 R15: 00007ffde0302ca8
[ 93.848467][ T5328]
[ 93.850166][ T5328] Kernel Offset: disabled
[ 93.852057][ T5328] Rebooting in 86400 seconds..