program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000440)='44100,48000,88200,96000,176400,192000,3', 0x27)
openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000000)="34343130302c34383030302c38383230302c39363030302c3137363430302c314bcf6eaa302c33227b944a735786015f4358221877b26e2503415e5ecef322b8c5be6dd601a4facf9d53812b8056b836d6a33eb73b66c3730f9661158beee5c1d8cfd9c1efebad8026", 0x69)
symlinkat(&(0x7f0000000500)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./myconfig/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r1, &(0x7f00000005c0)='usbip-vudc.0', 0xc)
[ 95.303952][ T4653] Bluetooth: hci0: command tx timeout
[ 95.422103][ T5333] ==================================================================
[ 95.425118][ T5333] BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x225/0x2b0
[ 95.429666][ T5333] Free of addr ffff888011d21526 by task syz.0.0/5333
[ 95.432214][ T5333]
[ 95.433120][ T5333] CPU: 0 UID: 0 PID: 5333 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 95.433135][ T5333] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.433142][ T5333] Call Trace:
[ 95.433146][ T5333]
[ 95.433151][ T5333] dump_stack_lvl+0xe8/0x150
[ 95.433172][ T5333] print_address_description+0x55/0x1e0
[ 95.433188][ T5333] print_report+0x58/0x70
[ 95.433202][ T5333] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 95.433216][ T5333] kasan_report_invalid_free+0xea/0x110
[ 95.433234][ T5333] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 95.433246][ T5333] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 95.433257][ T5333] __kasan_slab_pre_free+0x104/0x120
[ 95.433270][ T5333] kfree+0x173/0x640
[ 95.433281][ T5333] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 95.433294][ T5333] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 95.433307][ T5333] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 95.433321][ T5333] ? down_read+0x2be/0x330
[ 95.433333][ T5333] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 95.433344][ T5333] configfs_write_iter+0x337/0x430
[ 95.433361][ T5333] vfs_write+0x612/0xba0
[ 95.433377][ T5333] ? __pfx_vfs_write+0x10/0x10
[ 95.433394][ T5333] ? __fget_files+0x2a/0x420
[ 95.433408][ T5333] ksys_write+0x150/0x270
[ 95.433422][ T5333] ? __pfx_ksys_write+0x10/0x10
[ 95.433432][ T5333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.433439][ T5333] do_syscall_64+0x174/0x580
[ 95.433446][ T5333] ? trace_irq_disable+0x3b/0x140
[ 95.433455][ T5333] ? clear_bhb_loop+0x40/0x90
[ 95.433462][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.433472][ T5333] RIP: 0033:0x7fa81e19de99
[ 95.433483][ T5333] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 95.433492][ T5333] RSP: 002b:00007fa81a5f4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 95.433505][ T5333] RAX: ffffffffffffffda RBX: 00007fa81e425fa0 RCX: 00007fa81e19de99
[ 95.433514][ T5333] RDX: 0000000000000069 RSI: 0000200000000000 RDI: 0000000000000003
[ 95.433521][ T5333] RBP: 00007fa81e233eaf R08: 0000000000000000 R09: 0000000000000000
[ 95.433528][ T5333] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 95.433535][ T5333] R13: 00007fa81e426038 R14: 00007fa81e425fa0 R15: 00007ffc0b631468
[ 95.433548][ T5333]
[ 95.433551][ T5333]
[ 95.521891][ T5333] Allocated by task 5333:
[ 95.523335][ T5333] kasan_save_track+0x3e/0x80
[ 95.524987][ T5333] __kasan_kmalloc+0x93/0xb0
[ 95.526630][ T5333] __kmalloc_node_track_caller_noprof+0x4c3/0x730
[ 95.529606][ T5333] kstrdup+0x42/0x100
[ 95.531444][ T5333] f_uac2_opts_p_srate_store+0x11f/0x2b0
[ 95.534055][ T5333] configfs_write_iter+0x337/0x430
[ 95.535957][ T5333] vfs_write+0x612/0xba0
[ 95.537537][ T5333] ksys_write+0x150/0x270
[ 95.539092][ T5333] do_syscall_64+0x174/0x580
[ 95.540673][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.542795][ T5333]
[ 95.543642][ T5333] The buggy address belongs to the object at ffff888011d21500
[ 95.543642][ T5333] which belongs to the cache kmalloc-128 of size 128
[ 95.548647][ T5333] The buggy address is located 38 bytes inside of
[ 95.548647][ T5333] 106-byte region [ffff888011d21500, ffff888011d2156a)
[ 95.553193][ T5333]
[ 95.554249][ T5333] The buggy address belongs to the physical page:
[ 95.556782][ T5333] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11d21
[ 95.560404][ T5333] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 95.563237][ T5333] page_type: f5(slab)
[ 95.564631][ T5333] raw: 00fff00000000000 ffff88801b041a00 dead000000000122 0000000000000000
[ 95.567596][ T5333] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
[ 95.571163][ T5333] page dumped because: kasan: bad access detected
[ 95.573927][ T5333] page_owner tracks the page as allocated
[ 95.576165][ T5333] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5290, tgid 5290 (syz-executor), ts 93415213502, free_ts 93414870048
[ 95.584893][ T5333] post_alloc_hook+0x1f9/0x250
[ 95.587036][ T5333] get_page_from_freelist+0x21fa/0x2270
[ 95.589351][ T5333] __alloc_frozen_pages_noprof+0x18d/0x380
[ 95.591779][ T5333] allocate_slab+0x79/0x5e0
[ 95.593647][ T5333] refill_objects+0x2d5/0x350
[ 95.595615][ T5333] __pcs_replace_empty_main+0x2bf/0x6b0
[ 95.597963][ T5333] __kmalloc_flags_noprof+0x5be/0x800
[ 95.600334][ T5333] alloc_slab_obj_exts+0x4d/0x170
[ 95.602417][ T5333] __memcg_slab_post_alloc_hook+0x5d3/0xf10
[ 95.604892][ T5333] kmem_cache_alloc_noprof+0x350/0x5f0
[ 95.607210][ T5333] prepare_creds+0x30/0x820
[ 95.609167][ T5333] copy_creds+0x109/0x9f0
[ 95.611125][ T5333] copy_process+0xd1f/0x4390
[ 95.613086][ T5333] kernel_clone+0x2d7/0x940
[ 95.615072][ T5333] __x64_sys_clone+0x1b6/0x230
[ 95.617046][ T5333] do_syscall_64+0x174/0x580
[ 95.618973][ T5333] page last free pid 5290 tgid 5290 stack trace:
[ 95.621780][ T5333] free_pages_prepare+0x960/0xa60
[ 95.624340][ T5333] __free_contig_range_common+0x174/0x340
[ 95.626719][ T5333] free_pages_bulk+0x48/0x120
[ 95.628792][ T5333] vfree+0x224/0x4a0
[ 95.630496][ T5333] do_ip6t_get_ctl+0xf3e/0x12f0
[ 95.632449][ T5333] nf_getsockopt+0x26e/0x290
[ 95.634364][ T5333] ipv6_getsockopt+0x213/0x2c0
[ 95.636217][ T5333] do_sock_getsockopt+0x569/0xa70
[ 95.638404][ T5333] __x64_sys_getsockopt+0x1a4/0x240
[ 95.640699][ T5333] do_syscall_64+0x174/0x580
[ 95.642821][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.645459][ T5333]
[ 95.646411][ T5333] Memory state around the buggy address:
[ 95.648753][ T5333] ffff888011d21400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 95.652380][ T5333] ffff888011d21480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 95.655627][ T5333] >ffff888011d21500: 00 00 00 00 00 00 00 00 00 00 00 00 00 02 fc fc
[ 95.658915][ T5333] ^
[ 95.661125][ T5333] ffff888011d21580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 95.664646][ T5333] ffff888011d21600: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
[ 95.667967][ T5333] ==================================================================
[ 95.703641][ T5333] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 95.706755][ T5333] CPU: 0 UID: 0 PID: 5333 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 95.710547][ T5333] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.714761][ T5333] Call Trace:
[ 95.716205][ T5333]
[ 95.717472][ T5333] vpanic+0x56c/0xa60
[ 95.719195][ T5333] ? __pfx_vpanic+0x10/0x10
[ 95.721220][ T5333] ? __pfx___schedule+0x10/0x10
[ 95.723376][ T5333] panic+0xc5/0xd0
[ 95.724961][ T5333] ? __pfx_panic+0x10/0x10
[ 95.726954][ T5333] ? preempt_schedule_common+0x82/0xd0
[ 95.729288][ T5333] check_panic_on_warn+0x89/0xb0
[ 95.731473][ T5333] end_report+0x73/0x170
[ 95.733294][ T5333] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 95.735826][ T5333] kasan_report_invalid_free+0xfa/0x110
[ 95.738220][ T5333] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 95.740682][ T5333] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 95.743124][ T5333] __kasan_slab_pre_free+0x104/0x120
[ 95.745365][ T5333] kfree+0x173/0x640
[ 95.747025][ T5333] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 95.749611][ T5333] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 95.751737][ T5333] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 95.754057][ T5333] ? down_read+0x2be/0x330
[ 95.755715][ T5333] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 95.758117][ T5333] configfs_write_iter+0x337/0x430
[ 95.760114][ T5333] vfs_write+0x612/0xba0
[ 95.761800][ T5333] ? __pfx_vfs_write+0x10/0x10
[ 95.763628][ T5333] ? __fget_files+0x2a/0x420
[ 95.765500][ T5333] ksys_write+0x150/0x270
[ 95.767471][ T5333] ? __pfx_ksys_write+0x10/0x10
[ 95.769591][ T5333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.772231][ T5333] do_syscall_64+0x174/0x580
[ 95.774277][ T5333] ? trace_irq_disable+0x3b/0x140
[ 95.776478][ T5333] ? clear_bhb_loop+0x40/0x90
[ 95.778552][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.781187][ T5333] RIP: 0033:0x7fa81e19de99
[ 95.783140][ T5333] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 95.791362][ T5333] RSP: 002b:00007fa81a5f4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 95.794817][ T5333] RAX: ffffffffffffffda RBX: 00007fa81e425fa0 RCX: 00007fa81e19de99
[ 95.798376][ T5333] RDX: 0000000000000069 RSI: 0000200000000000 RDI: 0000000000000003
[ 95.801792][ T5333] RBP: 00007fa81e233eaf R08: 0000000000000000 R09: 0000000000000000
[ 95.805104][ T5333] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 95.808565][ T5333] R13: 00007fa81e426038 R14: 00007fa81e425fa0 R15: 00007ffc0b631468
[ 95.811971][ T5333]
[ 95.813712][ T5333] Kernel Offset: disabled
[ 95.815608][ T5333] Rebooting in 86400 seconds..