program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r0, &(0x7f00000004c0)="34343130302c743856adffbd92834635ae2c3c", 0x13)
symlinkat(&(0x7f0000000500)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./myconfig/usb_gadget/g1/UDC\x00', 0x1, 0x0)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r2, &(0x7f0000000000)={0x2, 0x1a0b, @loopback}, 0x10)
listen(r2, 0x5)
r3 = fsopen(&(0x7f0000000100)='ceph\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000200)='mon_addr\x00', &(0x7f0000000300)='127.0.0.1:6789\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0)
r4 = accept$inet(r2, 0x0, 0x0)
write(r4, &(0x7f0000000400)='ceph v027\x00'/152, 0x91)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x4c, 0x2, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0xfffd}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}]}, 0x4c}}, 0x80e0)
r6 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(r6, 0x29, 0x23, &(0x7f0000000880)={{{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in=@empty, 0x4e21, 0x400, 0x4e20, 0x3, 0xa, 0x80, 0x0, 0x2}, {0x3, 0xc0, 0x747, 0x1, 0x2a7ca8f7, 0x1, 0xfffffffffffffff9, 0x2}, {0x10000, 0x80, 0x1, 0x101}, 0x4, 0x0, 0x0, 0x1, 0x3, 0x3}, {{@in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x4d4, 0x6c}, 0xa, @in=@dev={0xac, 0x14, 0x14, 0x24}, 0x3505, 0x5, 0x1, 0xa, 0x9, 0x5, 0x6}}, 0xe8)
r7 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000200)={0x58, 0x2, 0x6, 0x801, 0x0, 0x0, {0x2, 0x0, 0x40}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x3}]}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}]}, 0x58}}, 0x0)
write(r1, &(0x7f00000005c0)='usbip-vudc.0', 0xc)
[ 102.281812][ T5281] Bluetooth: hci0: command tx timeout
[ 102.391100][ T5315] ==================================================================
[ 102.394340][ T5315] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0
[ 102.397660][ T5315] Free of addr ffff88803d798ed2 by task syz.0.0/5315
[ 102.400299][ T5315]
[ 102.401297][ T5315] CPU: 0 UID: 0 PID: 5315 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 102.401312][ T5315] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 102.401321][ T5315] Call Trace:
[ 102.401328][ T5315]
[ 102.401333][ T5315] dump_stack_lvl+0xe8/0x150
[ 102.401354][ T5315] print_address_description+0x55/0x1e0
[ 102.401371][ T5315] print_report+0x58/0x70
[ 102.401379][ T5315] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 102.401389][ T5315] kasan_report_invalid_free+0xea/0x110
[ 102.401400][ T5315] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 102.401410][ T5315] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 102.401418][ T5315] __kasan_slab_pre_free+0x104/0x120
[ 102.401427][ T5315] kfree+0x173/0x640
[ 102.401437][ T5315] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 102.401447][ T5315] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 102.401460][ T5315] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 102.401473][ T5315] ? down_read+0x2be/0x330
[ 102.401488][ T5315] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 102.401501][ T5315] configfs_write_iter+0x337/0x430
[ 102.401517][ T5315] vfs_write+0x612/0xba0
[ 102.401533][ T5315] ? __pfx_vfs_write+0x10/0x10
[ 102.401549][ T5315] ? __fget_files+0x2a/0x420
[ 102.401564][ T5315] ksys_write+0x150/0x270
[ 102.401577][ T5315] ? __pfx_ksys_write+0x10/0x10
[ 102.401592][ T5315] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.401604][ T5315] do_syscall_64+0x174/0x580
[ 102.401618][ T5315] ? trace_irq_disable+0x3b/0x140
[ 102.401631][ T5315] ? clear_bhb_loop+0x70/0xc0
[ 102.401643][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.401654][ T5315] RIP: 0033:0x7f86dc19e0d9
[ 102.401666][ T5315] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 102.401674][ T5315] RSP: 002b:00007f86dd084fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 102.401686][ T5315] RAX: ffffffffffffffda RBX: 00007f86dc425fa0 RCX: 00007f86dc19e0d9
[ 102.401694][ T5315] RDX: 0000000000000013 RSI: 00002000000004c0 RDI: 0000000000000003
[ 102.401702][ T5315] RBP: 00007f86dc235024 R08: 0000000000000000 R09: 0000000000000000
[ 102.401708][ T5315] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 102.401715][ T5315] R13: 00007f86dc426038 R14: 00007f86dc425fa0 R15: 00007ffcd7bb1308
[ 102.401726][ T5315]
[ 102.401730][ T5315]
[ 102.501687][ T5315] Allocated by task 5315:
[ 102.503791][ T5315] kasan_save_track+0x3e/0x80
[ 102.505768][ T5315] __kasan_kmalloc+0x93/0xb0
[ 102.507713][ T5315] __kmalloc_node_track_caller_noprof+0x4c3/0x730
[ 102.510379][ T5315] kstrdup+0x42/0x100
[ 102.512089][ T5315] f_uac2_opts_c_srate_store+0x11f/0x2b0
[ 102.514477][ T5315] configfs_write_iter+0x337/0x430
[ 102.516897][ T5315] vfs_write+0x612/0xba0
[ 102.519001][ T5315] ksys_write+0x150/0x270
[ 102.521149][ T5315] do_syscall_64+0x174/0x580
[ 102.523480][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.526046][ T5315]
[ 102.527079][ T5315] The buggy address belongs to the object at ffff88803d798ec0
[ 102.527079][ T5315] which belongs to the cache kmalloc-32 of size 32
[ 102.532741][ T5315] The buggy address is located 18 bytes inside of
[ 102.532741][ T5315] 20-byte region [ffff88803d798ec0, ffff88803d798ed4)
[ 102.538110][ T5315]
[ 102.539132][ T5315] The buggy address belongs to the physical page:
[ 102.541792][ T5315] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3d798
[ 102.545459][ T5315] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 102.548739][ T5315] page_type: f5(slab)
[ 102.550802][ T5315] raw: 04fff00000000000 ffff88801b041780 dead000000000100 dead000000000122
[ 102.554790][ T5315] raw: 0000000000000000 0000000800400040 00000000f5000000 0000000000000000
[ 102.558517][ T5315] page dumped because: kasan: bad access detected
[ 102.561201][ T5315] page_owner tracks the page as allocated
[ 102.563571][ T5315] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4450, tgid 4450 (kworker/u4:4), ts 29184506835, free_ts 29184249110
[ 102.571557][ T5315] post_alloc_hook+0x1f9/0x250
[ 102.573706][ T5315] get_page_from_freelist+0x21fa/0x2270
[ 102.576443][ T5315] __alloc_frozen_pages_noprof+0x18d/0x380
[ 102.579117][ T5315] allocate_slab+0x79/0x5e0
[ 102.581151][ T5315] refill_objects+0x2d5/0x350
[ 102.583195][ T5315] __pcs_replace_empty_main+0x2bf/0x6b0
[ 102.585548][ T5315] __kmalloc_cache_noprof+0x3a7/0x660
[ 102.587813][ T5315] kmem_cache_free+0x156/0x650
[ 102.589933][ T5315] __fput_deferred+0x2a3/0x380
[ 102.592012][ T5315] fput_close+0x11f/0x240
[ 102.593816][ T5315] path_openat+0x30b9/0x3830
[ 102.595819][ T5315] do_file_open+0x23e/0x4a0
[ 102.597754][ T5315] do_open_execat+0x12b/0x590
[ 102.599909][ T5315] alloc_bprm+0x24/0x640
[ 102.601870][ T5315] kernel_execve+0x85/0x9c0
[ 102.603755][ T5315] call_usermodehelper_exec_async+0x20f/0x360
[ 102.606352][ T5315] page last free pid 61 tgid 61 stack trace:
[ 102.608883][ T5315] __free_frozen_pages+0xc1e/0xd10
[ 102.611100][ T5315] __kasan_populate_vmalloc+0x1a8/0x1c0
[ 102.613354][ T5315] alloc_vmap_area+0xd1a/0x1420
[ 102.615410][ T5315] __get_vm_area_node+0x1f2/0x300
[ 102.617800][ T5315] __vmalloc_node_range_noprof+0x358/0x1730
[ 102.620404][ T5315] __vmalloc_node_noprof+0xc2/0x100
[ 102.622613][ T5315] dup_task_struct+0x2a0/0x8e0
[ 102.624595][ T5315] copy_process+0x820/0x4390
[ 102.626473][ T5315] kernel_clone+0x2d7/0x940
[ 102.628328][ T5315] user_mode_thread+0x110/0x180
[ 102.630295][ T5315] call_usermodehelper_exec_work+0x5c/0x230
[ 102.632617][ T5315] process_scheduled_works+0xa8e/0x14e0
[ 102.634744][ T5315] worker_thread+0xa47/0xfb0
[ 102.636561][ T5315] kthread+0x388/0x470
[ 102.638183][ T5315] ret_from_fork+0x514/0xb70
[ 102.640057][ T5315] ret_from_fork_asm+0x1a/0x30
[ 102.641905][ T5315]
[ 102.642892][ T5315] Memory state around the buggy address:
[ 102.645085][ T5315] ffff88803d798d80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[ 102.648281][ T5315] ffff88803d798e00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[ 102.651428][ T5315] >ffff88803d798e80: 00 00 00 00 fc fc fc fc 00 00 04 fc fc fc fc fc
[ 102.654564][ T5315] ^
[ 102.657199][ T5315] ffff88803d798f00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[ 102.660173][ T5315] ffff88803d798f80: fa fb fb fb fc fc fc fc 00 00 00 00 fc fc fc fc
[ 102.663472][ T5315] ==================================================================
[ 102.688514][ T5315] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 102.691649][ T5315] CPU: 0 UID: 0 PID: 5315 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 102.696245][ T5315] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 102.700541][ T5315] Call Trace:
[ 102.702021][ T5315]
[ 102.703291][ T5315] vpanic+0x56c/0xa60
[ 102.705024][ T5315] ? __pfx_vpanic+0x10/0x10
[ 102.706900][ T5315] ? __pfx___schedule+0x10/0x10
[ 102.709066][ T5315] panic+0xc5/0xd0
[ 102.710834][ T5315] ? __pfx_panic+0x10/0x10
[ 102.712862][ T5315] ? preempt_schedule_common+0x82/0xd0
[ 102.715347][ T5315] check_panic_on_warn+0x89/0xb0
[ 102.717434][ T5315] end_report+0x73/0x170
[ 102.719183][ T5315] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 102.721556][ T5315] kasan_report_invalid_free+0xfa/0x110
[ 102.723790][ T5315] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 102.726245][ T5315] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 102.728643][ T5315] __kasan_slab_pre_free+0x104/0x120
[ 102.730842][ T5315] kfree+0x173/0x640
[ 102.732540][ T5315] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 102.735028][ T5315] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 102.737516][ T5315] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 102.740118][ T5315] ? down_read+0x2be/0x330
[ 102.742014][ T5315] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 102.744402][ T5315] configfs_write_iter+0x337/0x430
[ 102.746472][ T5315] vfs_write+0x612/0xba0
[ 102.748171][ T5315] ? __pfx_vfs_write+0x10/0x10
[ 102.750235][ T5315] ? __fget_files+0x2a/0x420
[ 102.752389][ T5315] ksys_write+0x150/0x270
[ 102.754310][ T5315] ? __pfx_ksys_write+0x10/0x10
[ 102.756304][ T5315] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.758774][ T5315] do_syscall_64+0x174/0x580
[ 102.760640][ T5315] ? trace_irq_disable+0x3b/0x140
[ 102.762684][ T5315] ? clear_bhb_loop+0x70/0xc0
[ 102.764724][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.767216][ T5315] RIP: 0033:0x7f86dc19e0d9
[ 102.769066][ T5315] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 102.777528][ T5315] RSP: 002b:00007f86dd084fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 102.781285][ T5315] RAX: ffffffffffffffda RBX: 00007f86dc425fa0 RCX: 00007f86dc19e0d9
[ 102.784582][ T5315] RDX: 0000000000000013 RSI: 00002000000004c0 RDI: 0000000000000003
[ 102.788350][ T5315] RBP: 00007f86dc235024 R08: 0000000000000000 R09: 0000000000000000
[ 102.792385][ T5315] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 102.796851][ T5315] R13: 00007f86dc426038 R14: 00007f86dc425fa0 R15: 00007ffcd7bb1308
[ 102.800692][ T5315]
[ 102.802444][ T5315] Kernel Offset: disabled
[ 102.804320][ T5315] Rebooting in 86400 seconds..