program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./myconfig\x00', &(0x7f00000000c0)='configfs\x00', 0x10, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000040)="34343130302c34383030302c38383230302c3936308bca2c3135363430302c3139323030302c3335323830302c33", 0x2e)
symlinkat(&(0x7f0000000580)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./myconfig/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r1, &(0x7f0000000640)='usbip-vudc.0', 0xc)
[ 95.436444][ T4650] Bluetooth: hci0: command tx timeout
[ 95.543987][ T5328] ==================================================================
[ 95.547319][ T5328] BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x225/0x2b0
[ 95.550653][ T5328] Free of addr ffff888034b4bb18 by task syz.0.0/5328
[ 95.553427][ T5328]
[ 95.554443][ T5328] CPU: 0 UID: 0 PID: 5328 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 95.554453][ T5328] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.554458][ T5328] Call Trace:
[ 95.554463][ T5328]
[ 95.554467][ T5328] dump_stack_lvl+0xe8/0x150
[ 95.554487][ T5328] print_address_description+0x55/0x1e0
[ 95.554501][ T5328] print_report+0x58/0x70
[ 95.554513][ T5328] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 95.554527][ T5328] kasan_report_invalid_free+0xea/0x110
[ 95.554542][ T5328] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 95.554554][ T5328] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 95.554566][ T5328] __kasan_slab_pre_free+0x104/0x120
[ 95.554580][ T5328] kfree+0x173/0x640
[ 95.554589][ T5328] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 95.554601][ T5328] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 95.554613][ T5328] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 95.554625][ T5328] ? down_read+0x2be/0x330
[ 95.554636][ T5328] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 95.554648][ T5328] configfs_write_iter+0x337/0x430
[ 95.554665][ T5328] vfs_write+0x612/0xba0
[ 95.554681][ T5328] ? __pfx_vfs_write+0x10/0x10
[ 95.554697][ T5328] ? __fget_files+0x2a/0x420
[ 95.554710][ T5328] ksys_write+0x150/0x270
[ 95.554724][ T5328] ? __pfx_ksys_write+0x10/0x10
[ 95.554740][ T5328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.554752][ T5328] do_syscall_64+0x174/0x580
[ 95.554763][ T5328] ? trace_irq_disable+0x3b/0x140
[ 95.554776][ T5328] ? clear_bhb_loop+0x40/0x90
[ 95.554785][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.554793][ T5328] RIP: 0033:0x7f9275d9de99
[ 95.554804][ T5328] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 95.554812][ T5328] RSP: 002b:00007f9276b89fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 95.554824][ T5328] RAX: ffffffffffffffda RBX: 00007f9276025fa0 RCX: 00007f9275d9de99
[ 95.554833][ T5328] RDX: 000000000000002e RSI: 0000200000000040 RDI: 0000000000000003
[ 95.554869][ T5328] RBP: 00007f9275e33eaf R08: 0000000000000000 R09: 0000000000000000
[ 95.554877][ T5328] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 95.554884][ T5328] R13: 00007f9276026038 R14: 00007f9276025fa0 R15: 00007ffd0bac5298
[ 95.554894][ T5328]
[ 95.554897][ T5328]
[ 95.652078][ T5328] Allocated by task 5328:
[ 95.653716][ T5328] kasan_save_track+0x3e/0x80
[ 95.655666][ T5328] __kasan_kmalloc+0x93/0xb0
[ 95.657640][ T5328] __kmalloc_node_track_caller_noprof+0x4c3/0x730
[ 95.660372][ T5328] kstrdup+0x42/0x100
[ 95.662016][ T5328] f_uac2_opts_p_srate_store+0x11f/0x2b0
[ 95.664331][ T5328] configfs_write_iter+0x337/0x430
[ 95.666449][ T5328] vfs_write+0x612/0xba0
[ 95.668283][ T5328] ksys_write+0x150/0x270
[ 95.670087][ T5328] do_syscall_64+0x174/0x580
[ 95.672098][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.674500][ T5328]
[ 95.675504][ T5328] The buggy address belongs to the object at ffff888034b4bb00
[ 95.675504][ T5328] which belongs to the cache kmalloc-64 of size 64
[ 95.681062][ T5328] The buggy address is located 24 bytes inside of
[ 95.681062][ T5328] 47-byte region [ffff888034b4bb00, ffff888034b4bb2f)
[ 95.686243][ T5328]
[ 95.687268][ T5328] The buggy address belongs to the physical page:
[ 95.689812][ T5328] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34b4b
[ 95.693243][ T5328] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 95.696389][ T5328] page_type: f5(slab)
[ 95.698417][ T5328] raw: 04fff00000000000 ffff88801b0418c0 dead000000000100 dead000000000122
[ 95.702512][ T5328] raw: 0000000000000000 0000000800200020 00000000f5000000 0000000000000000
[ 95.705965][ T5328] page dumped because: kasan: bad access detected
[ 95.708805][ T5328] page_owner tracks the page as allocated
[ 95.711790][ T5328] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 14633757372, free_ts 14632691901
[ 95.719879][ T5328] post_alloc_hook+0x1f9/0x250
[ 95.721919][ T5328] get_page_from_freelist+0x21fa/0x2270
[ 95.724208][ T5328] __alloc_frozen_pages_noprof+0x18d/0x380
[ 95.726637][ T5328] allocate_slab+0x79/0x5e0
[ 95.728551][ T5328] refill_objects+0x2d5/0x350
[ 95.730559][ T5328] __pcs_replace_empty_main+0x2bf/0x6b0
[ 95.732887][ T5328] __kmalloc_noprof+0x485/0x720
[ 95.734961][ T5328] kobject_get_path+0xc5/0x2f0
[ 95.736917][ T5328] kobject_uevent_env+0x29e/0x9e0
[ 95.738980][ T5328] net_rx_queue_update_kobjects+0x3fe/0x780
[ 95.741409][ T5328] netdev_register_kobject+0x21f/0x310
[ 95.743566][ T5328] register_netdevice+0x1433/0x1eb0
[ 95.745596][ T5328] cfg80211_register_netdevice+0x138/0x2d0
[ 95.747880][ T5328] ieee80211_if_add+0x108d/0x1600
[ 95.749821][ T5328] ieee80211_register_hw+0x3e79/0x4a50
[ 95.752228][ T5328] mac80211_hwsim_new_radio+0x3238/0x5680
[ 95.754549][ T5328] page last free pid 24 tgid 24 stack trace:
[ 95.756905][ T5328] __free_frozen_pages+0xc1e/0xd10
[ 95.759010][ T5328] __kasan_populate_vmalloc+0x12d/0x1c0
[ 95.761410][ T5328] alloc_vmap_area+0xd1a/0x1420
[ 95.763455][ T5328] __get_vm_area_node+0x1f2/0x300
[ 95.765518][ T5328] __vmalloc_node_range_noprof+0x358/0x1730
[ 95.767927][ T5328] __vmalloc_node_noprof+0xc2/0x100
[ 95.770081][ T5328] dup_task_struct+0x2a0/0x8e0
[ 95.772065][ T5328] copy_process+0x820/0x4390
[ 95.773946][ T5328] kernel_clone+0x2d7/0x940
[ 95.775813][ T5328] user_mode_thread+0x110/0x180
[ 95.777791][ T5328] call_usermodehelper_exec_work+0x5c/0x230
[ 95.780324][ T5328] process_scheduled_works+0xa8e/0x14e0
[ 95.782662][ T5328] worker_thread+0xa47/0xfb0
[ 95.784667][ T5328] kthread+0x388/0x470
[ 95.786402][ T5328] ret_from_fork+0x514/0xb70
[ 95.788384][ T5328] ret_from_fork_asm+0x1a/0x30
[ 95.790340][ T5328]
[ 95.791369][ T5328] Memory state around the buggy address:
[ 95.793671][ T5328] ffff888034b4ba00: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
[ 95.796918][ T5328] ffff888034b4ba80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[ 95.800220][ T5328] >ffff888034b4bb00: 00 00 00 00 00 07 fc fc fc fc fc fc fc fc fc fc
[ 95.803481][ T5328] ^
[ 95.805483][ T5328] ffff888034b4bb80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[ 95.809005][ T5328] ffff888034b4bc00: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[ 95.812533][ T5328] ==================================================================
[ 95.934887][ T5328] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 95.937769][ T5328] CPU: 0 UID: 0 PID: 5328 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 95.941832][ T5328] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.946102][ T5328] Call Trace:
[ 95.947547][ T5328]
[ 95.948893][ T5328] vpanic+0x56c/0xa60
[ 95.950597][ T5328] ? __pfx_vpanic+0x10/0x10
[ 95.952568][ T5328] ? __pfx___schedule+0x10/0x10
[ 95.954677][ T5328] panic+0xc5/0xd0
[ 95.956638][ T5328] ? __pfx_panic+0x10/0x10
[ 95.958773][ T5328] ? preempt_schedule_common+0x82/0xd0
[ 95.961086][ T5328] check_panic_on_warn+0x89/0xb0
[ 95.963184][ T5328] end_report+0x73/0x170
[ 95.964959][ T5328] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 95.967362][ T5328] kasan_report_invalid_free+0xfa/0x110
[ 95.969586][ T5328] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 95.972038][ T5328] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 95.974878][ T5328] __kasan_slab_pre_free+0x104/0x120
[ 95.977381][ T5328] kfree+0x173/0x640
[ 95.979004][ T5328] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 95.981388][ T5328] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 95.983726][ T5328] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 95.986237][ T5328] ? down_read+0x2be/0x330
[ 95.988135][ T5328] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 95.990717][ T5328] configfs_write_iter+0x337/0x430
[ 95.992815][ T5328] vfs_write+0x612/0xba0
[ 95.994623][ T5328] ? __pfx_vfs_write+0x10/0x10
[ 95.996696][ T5328] ? __fget_files+0x2a/0x420
[ 95.998621][ T5328] ksys_write+0x150/0x270
[ 96.000484][ T5328] ? __pfx_ksys_write+0x10/0x10
[ 96.002497][ T5328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 96.004998][ T5328] do_syscall_64+0x174/0x580
[ 96.006919][ T5328] ? trace_irq_disable+0x3b/0x140
[ 96.008962][ T5328] ? clear_bhb_loop+0x40/0x90
[ 96.010920][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 96.013349][ T5328] RIP: 0033:0x7f9275d9de99
[ 96.015200][ T5328] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 96.023029][ T5328] RSP: 002b:00007f9276b89fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 96.026530][ T5328] RAX: ffffffffffffffda RBX: 00007f9276025fa0 RCX: 00007f9275d9de99
[ 96.029739][ T5328] RDX: 000000000000002e RSI: 0000200000000040 RDI: 0000000000000003
[ 96.033019][ T5328] RBP: 00007f9275e33eaf R08: 0000000000000000 R09: 0000000000000000
[ 96.036233][ T5328] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 96.039419][ T5328] R13: 00007f9276026038 R14: 00007f9276025fa0 R15: 00007ffd0bac5298
[ 96.042655][ T5328]
[ 96.044347][ T5328] Kernel Offset: disabled
[ 96.046151][ T5328] Rebooting in 86400 seconds..