program:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200))
r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/4\x00')
preadv(r0, &(0x7f0000000240)=[{&(0x7f00000004c0)=""/152, 0x98}], 0x1, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)="34343130302c34383030302c38383230302c39363030302c3137363430302c3139323030302c47ac323830302c3338343030302c37bdc98ea998b9e4436831a0ef34c8cde3fbfa37e9d7c5970b92005039cf8cd8dcd6160572c802e24712", 0x5e)
listen(r1, 0x7)
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
[ 94.466082][ T5276] Bluetooth: hci0: command tx timeout
[ 94.676235][ T5311] ==================================================================
[ 94.679607][ T5311] BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.682855][ T5311] Free of addr ffff88801adda42d by task syz.0.0/5311
[ 94.685634][ T5311]
[ 94.686670][ T5311] CPU: 0 UID: 0 PID: 5311 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.686688][ T5311] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.686697][ T5311] Call Trace:
[ 94.686704][ T5311]
[ 94.686711][ T5311] dump_stack_lvl+0xe8/0x150
[ 94.686733][ T5311] print_address_description+0x55/0x1e0
[ 94.686751][ T5311] print_report+0x58/0x70
[ 94.686767][ T5311] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.686781][ T5311] kasan_report_invalid_free+0xea/0x110
[ 94.686797][ T5311] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.686811][ T5311] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.686823][ T5311] __kasan_slab_pre_free+0x104/0x120
[ 94.686838][ T5311] kfree+0x173/0x640
[ 94.686852][ T5311] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.686866][ T5311] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.686880][ T5311] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 94.686894][ T5311] ? down_read+0x2be/0x330
[ 94.686911][ T5311] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 94.686924][ T5311] configfs_write_iter+0x337/0x430
[ 94.686941][ T5311] vfs_write+0x612/0xba0
[ 94.686960][ T5311] ? __pfx_vfs_write+0x10/0x10
[ 94.686978][ T5311] ? __fget_files+0x2a/0x420
[ 94.686995][ T5311] ksys_write+0x150/0x270
[ 94.687010][ T5311] ? __pfx_ksys_write+0x10/0x10
[ 94.687027][ T5311] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.687040][ T5311] do_syscall_64+0x174/0x580
[ 94.687055][ T5311] ? trace_irq_disable+0x3b/0x140
[ 94.687070][ T5311] ? clear_bhb_loop+0x70/0xc0
[ 94.687083][ T5311] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.687095][ T5311] RIP: 0033:0x7f043079e0d9
[ 94.687108][ T5311] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.687118][ T5311] RSP: 002b:00007f0431599fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 94.687132][ T5311] RAX: ffffffffffffffda RBX: 00007f0430a25fa0 RCX: 00007f043079e0d9
[ 94.687142][ T5311] RDX: 000000000000005e RSI: 0000200000000280 RDI: 0000000000000006
[ 94.687150][ T5311] RBP: 00007f0430835024 R08: 0000000000000000 R09: 0000000000000000
[ 94.687157][ T5311] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.687165][ T5311] R13: 00007f0430a26038 R14: 00007f0430a25fa0 R15: 00007ffd3a9efab8
[ 94.687178][ T5311]
[ 94.687182][ T5311]
[ 94.783103][ T5311] Allocated by task 5311:
[ 94.784829][ T5311] kasan_save_track+0x3e/0x80
[ 94.786486][ T5311] __kasan_kmalloc+0x93/0xb0
[ 94.788118][ T5311] __kmalloc_node_track_caller_noprof+0x4c3/0x730
[ 94.790690][ T5311] kstrdup+0x42/0x100
[ 94.792457][ T5311] f_uac2_opts_p_srate_store+0x11f/0x2b0
[ 94.795044][ T5311] configfs_write_iter+0x337/0x430
[ 94.797225][ T5311] vfs_write+0x612/0xba0
[ 94.799034][ T5311] ksys_write+0x150/0x270
[ 94.800889][ T5311] do_syscall_64+0x174/0x580
[ 94.802900][ T5311] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.805417][ T5311]
[ 94.806442][ T5311] The buggy address belongs to the object at ffff88801adda400
[ 94.806442][ T5311] which belongs to the cache kmalloc-96 of size 96
[ 94.811892][ T5311] The buggy address is located 45 bytes inside of
[ 94.811892][ T5311] 79-byte region [ffff88801adda400, ffff88801adda44f)
[ 94.816685][ T5311]
[ 94.817739][ T5311] The buggy address belongs to the physical page:
[ 94.820350][ T5311] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1adda
[ 94.823991][ T5311] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 94.827058][ T5311] page_type: f5(slab)
[ 94.828867][ T5311] raw: 00fff00000000000 ffff88801b041280 dead000000000100 dead000000000122
[ 94.832460][ T5311] raw: 0000000000000000 0000000800200020 00000000f5000000 0000000000000000
[ 94.835950][ T5311] page dumped because: kasan: bad access detected
[ 94.838543][ T5311] page_owner tracks the page as allocated
[ 94.840819][ T5311] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 5311, tgid 5310 (syz.0.0), ts 94533992568, free_ts 91980838437
[ 94.848861][ T5311] post_alloc_hook+0x1f9/0x250
[ 94.850981][ T5311] get_page_from_freelist+0x21fa/0x2270
[ 94.853338][ T5311] __alloc_pages_slowpath+0x383/0xcc0
[ 94.855589][ T5311] __alloc_frozen_pages_noprof+0x31f/0x380
[ 94.858144][ T5311] allocate_slab+0x79/0x5e0
[ 94.860103][ T5311] ___slab_alloc+0x16a/0x950
[ 94.862086][ T5311] __kmalloc_flags_noprof+0x347/0x800
[ 94.864446][ T5311] alloc_slab_obj_exts+0x4d/0x170
[ 94.866592][ T5311] __memcg_slab_post_alloc_hook+0x5d3/0xf10
[ 94.869069][ T5311] kmem_cache_alloc_lru_noprof+0x358/0x5f0
[ 94.871487][ T5311] sock_alloc_inode+0x2c/0x1a0
[ 94.873360][ T5311] alloc_inode+0x6a/0x1b0
[ 94.875135][ T5311] __sock_create+0x12d/0x9d0
[ 94.877072][ T5311] __sys_socketpair+0x1c4/0x560
[ 94.879139][ T5311] __x64_sys_socketpair+0x9b/0xb0
[ 94.881249][ T5311] do_syscall_64+0x174/0x580
[ 94.883053][ T5311] page last free pid 28 tgid 28 stack trace:
[ 94.885322][ T5311] __free_frozen_pages+0xc1e/0xd10
[ 94.887317][ T5311] __folio_put+0x4b3/0x590
[ 94.889121][ T5311] migrate_pages_batch+0x3be1/0x4e50
[ 94.891289][ T5311] migrate_pages+0x1b9f/0x2920
[ 94.893377][ T5311] compact_zone+0x310e/0x4a30
[ 94.895256][ T5311] compact_node+0x210/0x310
[ 94.897057][ T5311] kcompactd+0xc0b/0x12c0
[ 94.898772][ T5311] kthread+0x388/0x470
[ 94.900327][ T5311] ret_from_fork+0x514/0xb70
[ 94.902090][ T5311] ret_from_fork_asm+0x1a/0x30
[ 94.903966][ T5311]
[ 94.904870][ T5311] Memory state around the buggy address:
[ 94.906991][ T5311] ffff88801adda300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.910463][ T5311] ffff88801adda380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.913659][ T5311] >ffff88801adda400: 00 00 00 00 00 00 00 00 00 07 fc fc fc fc fc fc
[ 94.916518][ T5311] ^
[ 94.918701][ T5311] ffff88801adda480: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc
[ 94.921905][ T5311] ffff88801adda500: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[ 94.925253][ T5311] ==================================================================
[ 95.127864][ T5311] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 95.130916][ T5311] CPU: 0 UID: 0 PID: 5311 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 95.134715][ T5311] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.138869][ T5311] Call Trace:
[ 95.140282][ T5311]
[ 95.141574][ T5311] vpanic+0x56c/0xa60
[ 95.143316][ T5311] ? __pfx_vpanic+0x10/0x10
[ 95.145277][ T5311] ? __pfx___schedule+0x10/0x10
[ 95.147404][ T5311] panic+0xc5/0xd0
[ 95.149055][ T5311] ? __pfx_panic+0x10/0x10
[ 95.151015][ T5311] ? preempt_schedule_common+0x82/0xd0
[ 95.153310][ T5311] check_panic_on_warn+0x89/0xb0
[ 95.155405][ T5311] end_report+0x73/0x170
[ 95.157321][ T5311] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 95.159867][ T5311] kasan_report_invalid_free+0xfa/0x110
[ 95.162181][ T5311] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 95.164718][ T5311] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 95.167105][ T5311] __kasan_slab_pre_free+0x104/0x120
[ 95.169296][ T5311] kfree+0x173/0x640
[ 95.170811][ T5311] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 95.173134][ T5311] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 95.175427][ T5311] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 95.177888][ T5311] ? down_read+0x2be/0x330
[ 95.179647][ T5311] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 95.182236][ T5311] configfs_write_iter+0x337/0x430
[ 95.184431][ T5311] vfs_write+0x612/0xba0
[ 95.186276][ T5311] ? __pfx_vfs_write+0x10/0x10
[ 95.188323][ T5311] ? __fget_files+0x2a/0x420
[ 95.190272][ T5311] ksys_write+0x150/0x270
[ 95.192100][ T5311] ? __pfx_ksys_write+0x10/0x10
[ 95.194127][ T5311] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.196295][ T5311] do_syscall_64+0x174/0x580
[ 95.197958][ T5311] ? trace_irq_disable+0x3b/0x140
[ 95.200011][ T5311] ? clear_bhb_loop+0x70/0xc0
[ 95.201731][ T5311] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.204193][ T5311] RIP: 0033:0x7f043079e0d9
[ 95.206424][ T5311] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 95.215238][ T5311] RSP: 002b:00007f0431599fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 95.219011][ T5311] RAX: ffffffffffffffda RBX: 00007f0430a25fa0 RCX: 00007f043079e0d9
[ 95.222453][ T5311] RDX: 000000000000005e RSI: 0000200000000280 RDI: 0000000000000006
[ 95.226025][ T5311] RBP: 00007f0430835024 R08: 0000000000000000 R09: 0000000000000000
[ 95.229575][ T5311] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 95.232997][ T5311] R13: 00007f0430a26038 R14: 00007f0430a25fa0 R15: 00007ffd3a9efab8
[ 95.236396][ T5311]
[ 95.238066][ T5311] Kernel Offset: disabled
[ 95.239900][ T5311] Rebooting in 86400 seconds..