program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./myconfig\x00', 0x1ff)
mount(0x0, &(0x7f0000000280)='./myconfig\x00', &(0x7f00000002c0)='configfs\x00', 0x0, 0x0) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x175) (async)
r0 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r0, &(0x7f00000006c0)="34343130302c74383030302c38383230302c39363030302c31370721bf17c249f10b3f721927ebbd89ba08779adce9ea0af670bbcf1d3dfdd09c84a4fd69ad1715fa2fd66754864fd793c673b525b8f8f733274995f81c8d4defc9d36b7b0155eb03ae9dff5cced40d474fdce9a3f7269d6be287557ff0f734dce2b5b174e989060c45f7dc850cf1fac6a4db6422b41a6d8a08d7aa46fc7ad134f2b33f17b8a4c91262be183b86045100201d3dbb2f19c84b02b3a5585fbc5e99ca8ca6561bfb32f464e1bb060000001e3a6cb717f6d990e47833a9b52ee42e3413f20af3ac12641e13eb680df667bc365188bccdc999063a4b0025b3e7fdb0324b081c26a1549e730f5b6bd5507e7ded2d810ee0d394b1a64a07060f4d05e0a61295edf95f386d7ac6eb5cae9ea503f394050e7e4a548ca65e1f2939905cbd91b2b3eb911ddb03d922cf0e1c3656c0993d7d734646c8d86f09e875dff9dbdb021d65d4b4c434d50c276824a98cd215a400dcdbe0a042b4c38187136541d2", 0x9f)
symlinkat(&(0x7f00000005c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00') (async)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./myconfig/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r1, &(0x7f0000000680)='usbip-vudc.0', 0xc)
[ 87.432574][ T4642] Bluetooth: hci0: command tx timeout
[ 87.477764][ T5314] ==================================================================
[ 87.480937][ T5314] BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x225/0x2b0
[ 87.484491][ T5314] Free of addr ffff888034cf4b0c by task syz.0.0/5314
[ 87.487369][ T5314]
[ 87.488418][ T5314] CPU: 0 UID: 0 PID: 5314 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 87.488433][ T5314] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 87.488439][ T5314] Call Trace:
[ 87.488446][ T5314]
[ 87.488452][ T5314] dump_stack_lvl+0xe8/0x150
[ 87.488471][ T5314] print_address_description+0x55/0x1e0
[ 87.488486][ T5314] print_report+0x58/0x70
[ 87.488498][ T5314] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 87.488511][ T5314] kasan_report_invalid_free+0xea/0x110
[ 87.488526][ T5314] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 87.488538][ T5314] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 87.488549][ T5314] __kasan_slab_pre_free+0x104/0x120
[ 87.488561][ T5314] kfree+0x173/0x640
[ 87.488577][ T5314] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 87.488589][ T5314] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 87.488600][ T5314] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 87.488613][ T5314] ? down_read+0x2be/0x330
[ 87.488625][ T5314] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 87.488638][ T5314] configfs_write_iter+0x337/0x430
[ 87.488654][ T5314] vfs_write+0x612/0xba0
[ 87.488670][ T5314] ? __pfx_vfs_write+0x10/0x10
[ 87.488685][ T5314] ? __fget_files+0x2a/0x420
[ 87.488699][ T5314] ksys_write+0x150/0x270
[ 87.488712][ T5314] ? __pfx_ksys_write+0x10/0x10
[ 87.488727][ T5314] do_syscall_64+0x166/0x520
[ 87.488739][ T5314] ? trace_irq_disable+0x3b/0x140
[ 87.488754][ T5314] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.488764][ T5314] ? clear_bhb_loop+0x70/0xc0
[ 87.488777][ T5314] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.488787][ T5314] RIP: 0033:0x7f689239e0d9
[ 87.488798][ T5314] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 87.488807][ T5314] RSP: 002b:00007f6893262fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 87.488819][ T5314] RAX: ffffffffffffffda RBX: 00007f6892625fa0 RCX: 00007f689239e0d9
[ 87.488827][ T5314] RDX: 000000000000009f RSI: 00002000000006c0 RDI: 0000000000000003
[ 87.488834][ T5314] RBP: 00007f6892435024 R08: 0000000000000000 R09: 0000000000000000
[ 87.488840][ T5314] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 87.488847][ T5314] R13: 00007f6892626038 R14: 00007f6892625fa0 R15: 00007ffcf6ce7268
[ 87.488857][ T5314]
[ 87.488861][ T5314]
[ 87.579836][ T5314] Allocated by task 5314:
[ 87.581678][ T5314] kasan_save_track+0x3e/0x80
[ 87.584003][ T5314] __kasan_kmalloc+0x93/0xb0
[ 87.586538][ T5314] __kmalloc_node_track_caller_noprof+0x4c7/0x740
[ 87.589375][ T5314] kstrdup+0x42/0x100
[ 87.591307][ T5314] f_uac2_opts_p_srate_store+0x11f/0x2b0
[ 87.593835][ T5314] configfs_write_iter+0x337/0x430
[ 87.596502][ T5314] vfs_write+0x612/0xba0
[ 87.598845][ T5314] ksys_write+0x150/0x270
[ 87.600902][ T5314] do_syscall_64+0x166/0x520
[ 87.603019][ T5314] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.605606][ T5314]
[ 87.606571][ T5314] The buggy address belongs to the object at ffff888034cf4b00
[ 87.606571][ T5314] which belongs to the cache kmalloc-192 of size 192
[ 87.612089][ T5314] The buggy address is located 12 bytes inside of
[ 87.612089][ T5314] 160-byte region [ffff888034cf4b00, ffff888034cf4ba0)
[ 87.617093][ T5314]
[ 87.618113][ T5314] The buggy address belongs to the physical page:
[ 87.620558][ T5314] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34cf4
[ 87.623803][ T5314] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 87.626520][ T5314] page_type: f5(slab)
[ 87.628229][ T5314] raw: 04fff00000000000 ffff88801b0413c0 dead000000000100 dead000000000122
[ 87.631648][ T5314] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
[ 87.635047][ T5314] page dumped because: kasan: bad access detected
[ 87.637544][ T5314] page_owner tracks the page as allocated
[ 87.639889][ T5314] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 9, tgid 9 (kworker/0:0), ts 14200907877, free_ts 14132906790
[ 87.647479][ T5314] post_alloc_hook+0x1f9/0x250
[ 87.649529][ T5314] get_page_from_freelist+0x21fe/0x2270
[ 87.651818][ T5314] __alloc_frozen_pages_noprof+0x18d/0x380
[ 87.654174][ T5314] allocate_slab+0x79/0x5e0
[ 87.656154][ T5314] refill_objects+0x2d5/0x350
[ 87.658021][ T5314] __pcs_replace_empty_main+0x2c3/0x6b0
[ 87.660338][ T5314] __kmalloc_cache_noprof+0x3ab/0x660
[ 87.662535][ T5314] drm_atomic_commit_alloc+0xa9/0x100
[ 87.664829][ T5314] drm_atomic_helper_dirtyfb+0x129/0xfd0
[ 87.667314][ T5314] drm_fbdev_shmem_helper_fb_dirty+0x160/0x310
[ 87.669824][ T5314] drm_fb_helper_damage_work+0x84c/0xf20
[ 87.672257][ T5314] process_scheduled_works+0xa88/0x14c0
[ 87.674644][ T5314] worker_thread+0xa47/0xfb0
[ 87.676659][ T5314] kthread+0x38b/0x480
[ 87.678372][ T5314] ret_from_fork+0x514/0xb70
[ 87.680356][ T5314] ret_from_fork_asm+0x1a/0x30
[ 87.682471][ T5314] page last free pid 1053 tgid 1053 stack trace:
[ 87.685189][ T5314] __free_frozen_pages+0xc22/0xd20
[ 87.687385][ T5314] __kasan_populate_vmalloc+0x12d/0x1c0
[ 87.689768][ T5314] alloc_vmap_area+0xd1a/0x1420
[ 87.691873][ T5314] __get_vm_area_node+0x200/0x2f0
[ 87.693930][ T5314] __vmalloc_node_range_noprof+0x358/0x1730
[ 87.696396][ T5314] __vmalloc_node_noprof+0xc2/0x100
[ 87.698562][ T5314] dup_task_struct+0x2c1/0xa20
[ 87.700522][ T5314] copy_process+0x820/0x43e0
[ 87.702414][ T5314] kernel_clone+0x2d7/0x940
[ 87.704254][ T5314] user_mode_thread+0x115/0x180
[ 87.706251][ T5314] call_usermodehelper_exec_work+0x5c/0x230
[ 87.708681][ T5314] process_scheduled_works+0xa88/0x14c0
[ 87.710934][ T5314] worker_thread+0xa47/0xfb0
[ 87.712868][ T5314] kthread+0x38b/0x480
[ 87.714672][ T5314] ret_from_fork+0x514/0xb70
[ 87.716720][ T5314] ret_from_fork_asm+0x1a/0x30
[ 87.718863][ T5314]
[ 87.719935][ T5314] Memory state around the buggy address:
[ 87.722297][ T5314] ffff888034cf4a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 87.725754][ T5314] ffff888034cf4a80: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
[ 87.729205][ T5314] >ffff888034cf4b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 87.732520][ T5314] ^
[ 87.734428][ T5314] ffff888034cf4b80: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc
[ 87.737901][ T5314] ffff888034cf4c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 87.741224][ T5314] ==================================================================
[ 87.745060][ T5314] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 87.747978][ T5314] CPU: 0 UID: 0 PID: 5314 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 87.752162][ T5314] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 87.755800][ T5314] Call Trace:
[ 87.757306][ T5314]
[ 87.758545][ T5314] vpanic+0x56d/0xa60
[ 87.760184][ T5314] ? __pfx_vpanic+0x10/0x10
[ 87.762042][ T5314] ? __pfx___schedule+0x10/0x10
[ 87.764066][ T5314] panic+0xc5/0xd0
[ 87.765695][ T5314] ? __pfx_panic+0x10/0x10
[ 87.767723][ T5314] ? preempt_schedule_common+0x7f/0xd0
[ 87.770077][ T5314] check_panic_on_warn+0x89/0xb0
[ 87.772166][ T5314] end_report+0x73/0x170
[ 87.773928][ T5314] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 87.776294][ T5314] kasan_report_invalid_free+0xfa/0x110
[ 87.778580][ T5314] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 87.781011][ T5314] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 87.783354][ T5314] __kasan_slab_pre_free+0x104/0x120
[ 87.785537][ T5314] kfree+0x173/0x640
[ 87.787135][ T5314] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 87.789438][ T5314] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 87.791676][ T5314] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 87.794008][ T5314] ? down_read+0x2be/0x330
[ 87.795763][ T5314] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 87.798031][ T5314] configfs_write_iter+0x337/0x430
[ 87.799999][ T5314] vfs_write+0x612/0xba0
[ 87.801526][ T5314] ? __pfx_vfs_write+0x10/0x10
[ 87.803435][ T5314] ? __fget_files+0x2a/0x420
[ 87.805399][ T5314] ksys_write+0x150/0x270
[ 87.807465][ T5314] ? __pfx_ksys_write+0x10/0x10
[ 87.809460][ T5314] do_syscall_64+0x166/0x520
[ 87.811336][ T5314] ? trace_irq_disable+0x3b/0x140
[ 87.813330][ T5314] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.815895][ T5314] ? clear_bhb_loop+0x70/0xc0
[ 87.817846][ T5314] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.820125][ T5314] RIP: 0033:0x7f689239e0d9
[ 87.821876][ T5314] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 87.829291][ T5314] RSP: 002b:00007f6893262fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 87.832468][ T5314] RAX: ffffffffffffffda RBX: 00007f6892625fa0 RCX: 00007f689239e0d9
[ 87.835291][ T5314] RDX: 000000000000009f RSI: 00002000000006c0 RDI: 0000000000000003
[ 87.838156][ T5314] RBP: 00007f6892435024 R08: 0000000000000000 R09: 0000000000000000
[ 87.841105][ T5314] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 87.843770][ T5314] R13: 00007f6892626038 R14: 00007f6892625fa0 R15: 00007ffcf6ce7268
[ 87.846407][ T5314]
[ 87.847728][ T5314] Kernel Offset: disabled
[ 87.849168][ T5314] Rebooting in 86400 seconds..