program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000400)='configfs\x00', 0x0, 0x0) (async)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000400)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x125)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/functions/uac1_legacy.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
symlinkat(&(0x7f0000000200)='./config/usb_gadget/g1/functions/uac1_legacy.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1/uac1_legacy.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0\n\x00', 0xc) (async)
write(r0, &(0x7f0000000400)='dummy_udc.0\n\x00', 0xc)
nanosleep(&(0x7f0000000500)={0x0, 0x2faf080}, 0x0)
[ 93.945166][ T4643] Bluetooth: hci0: command tx timeout
[ 94.042615][ T5318] configfs-gadget.g1 gadget.0: Hardware params: access 3, format 2, channels 2, rate 48000
[ 94.052242][ T5318] udc dummy_udc.0: failed to start g1: -19
[ 94.056786][ T5318] UDC core: g1: couldn't find an available UDC or it's busy
[ 94.061260][ T5317] slab filp start ffff888033b7da80 pointer offset 0 size 352
[ 94.068394][ T5317] ==================================================================
[ 94.071710][ T5317] BUG: KASAN: slab-use-after-free in filp_flush+0x174/0x190
[ 94.074932][ T5317] Read of size 8 at addr ffff888033b7dac8 by task syz.0.0/5317
[ 94.077910][ T5317]
[ 94.078933][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.078947][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.078955][ T5317] Call Trace:
[ 94.078962][ T5317]
[ 94.078968][ T5317] dump_stack_lvl+0xe8/0x150
[ 94.078988][ T5317] print_address_description+0x55/0x1e0
[ 94.079009][ T5317] ? filp_flush+0x174/0x190
[ 94.079023][ T5317] print_report+0x58/0x70
[ 94.079035][ T5317] kasan_report+0x117/0x150
[ 94.079050][ T5317] ? filp_flush+0x174/0x190
[ 94.079064][ T5317] filp_flush+0x174/0x190
[ 94.079078][ T5317] filp_close+0x1d/0x40
[ 94.079091][ T5317] gaudio_cleanup+0x54/0xf0
[ 94.079149][ T5317] f_audio_bind+0x4a0/0x630
[ 94.079159][ T5317] ? __pfx_f_audio_bind+0x10/0x10
[ 94.079170][ T5317] ? rcu_is_watching+0x16/0xb0
[ 94.079180][ T5317] ? usb_gadget_set_selfpowered+0xf5/0x260
[ 94.079197][ T5317] usb_add_function+0x2e1/0x9f0
[ 94.079212][ T5317] ? check_remote_wakeup_config+0x58/0x1c0
[ 94.079227][ T5317] configfs_composite_bind+0xde0/0x1410
[ 94.079245][ T5317] ? __pfx_configfs_composite_bind+0x10/0x10
[ 94.079259][ T5317] gadget_bind_driver+0x2ca/0x9e0
[ 94.079274][ T5317] ? __pfx_gadget_bind_driver+0x10/0x10
[ 94.079285][ T5317] really_probe+0x254/0xae0
[ 94.079330][ T5317] __driver_probe_device+0x1e8/0x360
[ 94.079339][ T5317] driver_probe_device+0x4f/0x240
[ 94.079349][ T5317] __driver_attach+0x339/0x600
[ 94.079358][ T5317] bus_for_each_dev+0x23b/0x2c0
[ 94.079370][ T5317] ? __pfx___driver_attach+0x10/0x10
[ 94.079379][ T5317] ? __pfx_bus_for_each_dev+0x10/0x10
[ 94.079390][ T5317] ? do_raw_spin_unlock+0x4d/0x200
[ 94.079403][ T5317] bus_add_driver+0x345/0x670
[ 94.079418][ T5317] driver_register+0x23a/0x320
[ 94.079430][ T5317] usb_gadget_register_driver_owner+0xf9/0x270
[ 94.079443][ T5317] gadget_dev_desc_UDC_store+0x1c9/0x2f0
[ 94.079455][ T5317] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10
[ 94.079467][ T5317] configfs_write_iter+0x337/0x430
[ 94.079479][ T5317] vfs_write+0x612/0xba0
[ 94.079495][ T5317] ? __pfx_vfs_write+0x10/0x10
[ 94.079511][ T5317] ? __fget_files+0x2a/0x420
[ 94.079527][ T5317] ksys_write+0x150/0x270
[ 94.079543][ T5317] ? __pfx_ksys_write+0x10/0x10
[ 94.079560][ T5317] do_syscall_64+0x166/0x520
[ 94.079575][ T5317] ? trace_irq_disable+0x3b/0x140
[ 94.079588][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.079598][ T5317] ? clear_bhb_loop+0x70/0xc0
[ 94.079610][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.079621][ T5317] RIP: 0033:0x7f1562f9e0d9
[ 94.079633][ T5317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.079642][ T5317] RSP: 002b:00007f1563df1fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 94.079654][ T5317] RAX: ffffffffffffffda RBX: 00007f1563225fa0 RCX: 00007f1562f9e0d9
[ 94.079661][ T5317] RDX: 000000000000000c RSI: 0000200000000400 RDI: 0000000000000003
[ 94.079665][ T5317] RBP: 00007f1563035024 R08: 0000000000000000 R09: 0000000000000000
[ 94.079670][ T5317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.079674][ T5317] R13: 00007f1563226038 R14: 00007f1563225fa0 R15: 00007fff5552d058
[ 94.079681][ T5317]
[ 94.079684][ T5317]
[ 94.212528][ T5317] Allocated by task 5318:
[ 94.214297][ T5317] kasan_save_track+0x3e/0x80
[ 94.216180][ T5317] __kasan_slab_alloc+0x6c/0x80
[ 94.218131][ T5317] kmem_cache_alloc_noprof+0x2a4/0x5f0
[ 94.220163][ T5317] alloc_empty_file+0x5b/0x1d0
[ 94.222056][ T5317] path_openat+0xa2/0x1d60
[ 94.223924][ T5317] do_file_open+0x23e/0x4a0
[ 94.225733][ T5317] filp_open+0x16d/0x1d0
[ 94.227586][ T5317] gaudio_setup+0x11b/0xf10
[ 94.229502][ T5317] f_audio_bind+0x137/0x630
[ 94.231551][ T5317] usb_add_function+0x2e1/0x9f0
[ 94.233639][ T5317] configfs_composite_bind+0xde0/0x1410
[ 94.236030][ T5317] gadget_bind_driver+0x2ca/0x9e0
[ 94.238213][ T5317] really_probe+0x254/0xae0
[ 94.239985][ T5317] __driver_probe_device+0x1e8/0x360
[ 94.242129][ T5317] driver_probe_device+0x4f/0x240
[ 94.244185][ T5317] __driver_attach+0x339/0x600
[ 94.246211][ T5317] bus_for_each_dev+0x23b/0x2c0
[ 94.248289][ T5317] bus_add_driver+0x345/0x670
[ 94.250556][ T5317] driver_register+0x23a/0x320
[ 94.252526][ T5317] usb_gadget_register_driver_owner+0xf9/0x270
[ 94.254984][ T5317] gadget_dev_desc_UDC_store+0x1c9/0x2f0
[ 94.257334][ T5317] configfs_write_iter+0x337/0x430
[ 94.259578][ T5317] vfs_write+0x612/0xba0
[ 94.261495][ T5317] ksys_write+0x150/0x270
[ 94.263591][ T5317] do_syscall_64+0x166/0x520
[ 94.266097][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.269106][ T5317]
[ 94.270186][ T5317] Freed by task 5317:
[ 94.271958][ T5317] kasan_save_track+0x3e/0x80
[ 94.274223][ T5317] kasan_save_free_info+0x40/0x50
[ 94.276708][ T5317] __kasan_slab_free+0x5c/0x80
[ 94.278819][ T5317] slab_free_after_rcu_debug+0x12a/0x220
[ 94.281287][ T5317] rcu_core+0x794/0x10b0
[ 94.283148][ T5317] handle_softirqs+0x226/0x860
[ 94.285177][ T5317] __irq_exit_rcu+0xcb/0x220
[ 94.287219][ T5317] irq_exit_rcu+0x9/0x30
[ 94.288990][ T5317] sysvec_apic_timer_interrupt+0xa6/0xc0
[ 94.291471][ T5317] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 94.294047][ T5317]
[ 94.295116][ T5317] Last potentially related work creation:
[ 94.297504][ T5317] kasan_save_stack+0x3e/0x60
[ 94.299375][ T5317] kasan_record_aux_stack+0xbd/0xd0
[ 94.301253][ T5317] kmem_cache_free+0x453/0x650
[ 94.302998][ T5317] task_work_run+0x1d9/0x270
[ 94.304786][ T5317] exit_to_user_mode_loop+0x204/0x770
[ 94.306931][ T5317] do_syscall_64+0x328/0x520
[ 94.308942][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.311552][ T5317]
[ 94.312501][ T5317] Second to last potentially related work creation:
[ 94.314890][ T5317] kasan_save_stack+0x3e/0x60
[ 94.316841][ T5317] kasan_record_aux_stack+0xbd/0xd0
[ 94.318964][ T5317] task_work_add+0xae/0x420
[ 94.320644][ T5317] __fput_deferred+0x152/0x390
[ 94.322322][ T5317] fput_close+0x11f/0x240
[ 94.323842][ T5317] filp_close+0x27/0x40
[ 94.325535][ T5317] gaudio_cleanup+0x54/0xf0
[ 94.327450][ T5317] f_audio_bind+0x4a0/0x630
[ 94.329416][ T5317] usb_add_function+0x2e1/0x9f0
[ 94.331525][ T5317] configfs_composite_bind+0xde0/0x1410
[ 94.333894][ T5317] gadget_bind_driver+0x2ca/0x9e0
[ 94.335989][ T5317] really_probe+0x254/0xae0
[ 94.337830][ T5317] __driver_probe_device+0x1e8/0x360
[ 94.340116][ T5317] driver_probe_device+0x4f/0x240
[ 94.342254][ T5317] __driver_attach+0x339/0x600
[ 94.344277][ T5317] bus_for_each_dev+0x23b/0x2c0
[ 94.346344][ T5317] bus_add_driver+0x345/0x670
[ 94.348368][ T5317] driver_register+0x23a/0x320
[ 94.350257][ T5317] usb_gadget_register_driver_owner+0xf9/0x270
[ 94.352571][ T5317] gadget_dev_desc_UDC_store+0x1c9/0x2f0
[ 94.354700][ T5317] configfs_write_iter+0x337/0x430
[ 94.356592][ T5317] vfs_write+0x612/0xba0
[ 94.358285][ T5317] ksys_write+0x150/0x270
[ 94.360145][ T5317] do_syscall_64+0x166/0x520
[ 94.362096][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.364483][ T5317]
[ 94.365446][ T5317] The buggy address belongs to the object at ffff888033b7da80
[ 94.365446][ T5317] which belongs to the cache filp of size 352
[ 94.370811][ T5317] The buggy address is located 72 bytes inside of
[ 94.370811][ T5317] freed 352-byte region [ffff888033b7da80, ffff888033b7dbe0)
[ 94.376352][ T5317]
[ 94.377605][ T5317] The buggy address belongs to the physical page:
[ 94.380880][ T5317] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x33b7d
[ 94.384554][ T5317] memcg:ffff888040411e01
[ 94.386309][ T5317] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 94.389171][ T5317] page_type: f5(slab)
[ 94.390946][ T5317] raw: 04fff00000000000 ffff888030414500 dead000000000100 dead000000000122
[ 94.394672][ T5317] raw: 0000000000000000 0000000800090009 00000000f5000000 ffff888040411e01
[ 94.398230][ T5317] page dumped because: kasan: bad access detected
[ 94.401068][ T5317] page_owner tracks the page as allocated
[ 94.403306][ T5317] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 334, tgid 334 (kworker/u4:3), ts 10689055531, free_ts 0
[ 94.411565][ T5317] post_alloc_hook+0x1f9/0x250
[ 94.413633][ T5317] get_page_from_freelist+0x21fe/0x2270
[ 94.416015][ T5317] __alloc_frozen_pages_noprof+0x18d/0x380
[ 94.418475][ T5317] allocate_slab+0x79/0x5e0
[ 94.420683][ T5317] refill_objects+0x2d5/0x350
[ 94.422967][ T5317] __pcs_replace_empty_main+0x2c3/0x6b0
[ 94.425473][ T5317] kmem_cache_alloc_noprof+0x386/0x5f0
[ 94.427994][ T5317] alloc_empty_file+0x5b/0x1d0
[ 94.430131][ T5317] path_openat+0xa2/0x1d60
[ 94.432187][ T5317] do_file_open+0x23e/0x4a0
[ 94.434357][ T5317] do_open_execat+0x12b/0x590
[ 94.436513][ T5317] alloc_bprm+0x24/0x640
[ 94.438489][ T5317] kernel_execve+0x85/0x9c0
[ 94.440536][ T5317] call_usermodehelper_exec_async+0x20f/0x360
[ 94.443382][ T5317] ret_from_fork+0x514/0xb70
[ 94.445480][ T5317] ret_from_fork_asm+0x1a/0x30
[ 94.447729][ T5317] page_owner free stack trace missing
[ 94.450151][ T5317]
[ 94.451314][ T5317] Memory state around the buggy address:
[ 94.453734][ T5317] ffff888033b7d980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 94.456962][ T5317] ffff888033b7da00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.460240][ T5317] >ffff888033b7da80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 94.463364][ T5317] ^
[ 94.465878][ T5317] ffff888033b7db00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 94.469087][ T5317] ffff888033b7db80: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[ 94.472090][ T5317] ==================================================================
[ 94.606312][ T5317] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 94.609214][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.612939][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.616977][ T5317] Call Trace:
[ 94.618373][ T5317]
[ 94.619675][ T5317] vpanic+0x56d/0xa60
[ 94.621430][ T5317] ? __pfx_vpanic+0x10/0x10
[ 94.623350][ T5317] panic+0xc5/0xd0
[ 94.624861][ T5317] ? __pfx_panic+0x10/0x10
[ 94.626760][ T5317] ? preempt_schedule_thunk+0x16/0x40
[ 94.629417][ T5317] ? preempt_schedule_thunk+0x16/0x40
[ 94.631926][ T5317] ? filp_flush+0x174/0x190
[ 94.633830][ T5317] check_panic_on_warn+0x89/0xb0
[ 94.635882][ T5317] ? filp_flush+0x174/0x190
[ 94.637771][ T5317] end_report+0x73/0x170
[ 94.639916][ T5317] ? filp_flush+0x174/0x190
[ 94.642313][ T5317] kasan_report+0x128/0x150
[ 94.644214][ T5317] ? filp_flush+0x174/0x190
[ 94.646103][ T5317] filp_flush+0x174/0x190
[ 94.647931][ T5317] filp_close+0x1d/0x40
[ 94.649600][ T5317] gaudio_cleanup+0x54/0xf0
[ 94.651505][ T5317] f_audio_bind+0x4a0/0x630
[ 94.653367][ T5317] ? __pfx_f_audio_bind+0x10/0x10
[ 94.655511][ T5317] ? rcu_is_watching+0x16/0xb0
[ 94.657419][ T5317] ? usb_gadget_set_selfpowered+0xf5/0x260
[ 94.659778][ T5317] usb_add_function+0x2e1/0x9f0
[ 94.661822][ T5317] ? check_remote_wakeup_config+0x58/0x1c0
[ 94.664178][ T5317] configfs_composite_bind+0xde0/0x1410
[ 94.666305][ T5317] ? __pfx_configfs_composite_bind+0x10/0x10
[ 94.668673][ T5317] gadget_bind_driver+0x2ca/0x9e0
[ 94.671285][ T5317] ? __pfx_gadget_bind_driver+0x10/0x10
[ 94.674176][ T5317] really_probe+0x254/0xae0
[ 94.676470][ T5317] __driver_probe_device+0x1e8/0x360
[ 94.678755][ T5317] driver_probe_device+0x4f/0x240
[ 94.681015][ T5317] __driver_attach+0x339/0x600
[ 94.683104][ T5317] bus_for_each_dev+0x23b/0x2c0
[ 94.685213][ T5317] ? __pfx___driver_attach+0x10/0x10
[ 94.687469][ T5317] ? __pfx_bus_for_each_dev+0x10/0x10
[ 94.689756][ T5317] ? do_raw_spin_unlock+0x4d/0x200
[ 94.691846][ T5317] bus_add_driver+0x345/0x670
[ 94.693699][ T5317] driver_register+0x23a/0x320
[ 94.695648][ T5317] usb_gadget_register_driver_owner+0xf9/0x270
[ 94.698201][ T5317] gadget_dev_desc_UDC_store+0x1c9/0x2f0
[ 94.700534][ T5317] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10
[ 94.703034][ T5317] configfs_write_iter+0x337/0x430
[ 94.705114][ T5317] vfs_write+0x612/0xba0
[ 94.706932][ T5317] ? __pfx_vfs_write+0x10/0x10
[ 94.708957][ T5317] ? __fget_files+0x2a/0x420
[ 94.710989][ T5317] ksys_write+0x150/0x270
[ 94.712881][ T5317] ? __pfx_ksys_write+0x10/0x10
[ 94.714819][ T5317] do_syscall_64+0x166/0x520
[ 94.716820][ T5317] ? trace_irq_disable+0x3b/0x140
[ 94.718948][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.721374][ T5317] ? clear_bhb_loop+0x70/0xc0
[ 94.723305][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.725529][ T5317] RIP: 0033:0x7f1562f9e0d9
[ 94.727268][ T5317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.735261][ T5317] RSP: 002b:00007f1563df1fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 94.738499][ T5317] RAX: ffffffffffffffda RBX: 00007f1563225fa0 RCX: 00007f1562f9e0d9
[ 94.741653][ T5317] RDX: 000000000000000c RSI: 0000200000000400 RDI: 0000000000000003
[ 94.744874][ T5317] RBP: 00007f1563035024 R08: 0000000000000000 R09: 0000000000000000
[ 94.748130][ T5317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.751638][ T5317] R13: 00007f1563226038 R14: 00007f1563225fa0 R15: 00007fff5552d058
[ 94.755229][ T5317]
[ 94.757069][ T5317] Kernel Offset: disabled
[ 94.759133][ T5317] Rebooting in 86400 seconds..