program:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r1, &(0x7f0000000440)='44100,48000,88200,96000,176400,192000,352800,384000,705600,7', 0x3c)
r2 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r2, &(0x7f00000000c0)="34343130302c34383030302c38383230302c39363030302c3137363430302ce365d714ffcbda5fc8d6c57b5e3139323030302c333532380d302c3338343030302c3730353630302c37", 0x49)
symlinkat(&(0x7f0000000580)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00')
r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./myconfig/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r3, &(0x7f0000000640)='usbip-vudc.0', 0xc)
sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000034c0)={0x14, 0x36, 0x107, 0x3, 0x0, {0x1, 0x7c}}, 0x14}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000)
r4 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0xd18c9b35, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030036000b05d25a806c8c6f94f90224fc60100005000a000200053582c137153e37000c0980fc0b10000300", 0x33fe0}], 0x1}, 0x0)
[ 93.143135][ T4652] Bluetooth: hci0: command tx timeout
[ 93.205101][ T9] cfg80211: failed to load regulatory.db
[ 93.269179][ T5329] ==================================================================
[ 93.272361][ T5329] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.275632][ T5329] Free of addr ffff8880128325b3 by task syz.0.0/5329
[ 93.278310][ T5329]
[ 93.279234][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 93.279246][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 93.279251][ T5329] Call Trace:
[ 93.279257][ T5329]
[ 93.279261][ T5329] dump_stack_lvl+0xe8/0x150
[ 93.279282][ T5329] print_address_description+0x55/0x1e0
[ 93.279297][ T5329] print_report+0x58/0x70
[ 93.279309][ T5329] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.279323][ T5329] kasan_report_invalid_free+0xea/0x110
[ 93.279339][ T5329] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.279352][ T5329] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.279365][ T5329] __kasan_slab_pre_free+0x104/0x120
[ 93.279375][ T5329] kfree+0x173/0x640
[ 93.279382][ T5329] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.279392][ T5329] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.279401][ T5329] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 93.279410][ T5329] ? down_read+0x2be/0x330
[ 93.279418][ T5329] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 93.279426][ T5329] configfs_write_iter+0x337/0x430
[ 93.279440][ T5329] vfs_write+0x612/0xba0
[ 93.279458][ T5329] ? __pfx_vfs_write+0x10/0x10
[ 93.279474][ T5329] ? __fget_files+0x2a/0x420
[ 93.279490][ T5329] ksys_write+0x150/0x270
[ 93.279505][ T5329] ? __pfx_ksys_write+0x10/0x10
[ 93.279522][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.279531][ T5329] do_syscall_64+0x174/0x580
[ 93.279542][ T5329] ? trace_irq_disable+0x3b/0x140
[ 93.279555][ T5329] ? clear_bhb_loop+0x40/0x90
[ 93.279567][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.279578][ T5329] RIP: 0033:0x7ff3c539de99
[ 93.279589][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 93.279599][ T5329] RSP: 002b:00007ff3c17f4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 93.279612][ T5329] RAX: ffffffffffffffda RBX: 00007ff3c5625fa0 RCX: 00007ff3c539de99
[ 93.279621][ T5329] RDX: 0000000000000049 RSI: 00002000000000c0 RDI: 0000000000000005
[ 93.279625][ T5329] RBP: 00007ff3c5433eaf R08: 0000000000000000 R09: 0000000000000000
[ 93.279629][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 93.279633][ T5329] R13: 00007ff3c5626038 R14: 00007ff3c5625fa0 R15: 00007ffefc5884d8
[ 93.279640][ T5329]
[ 93.279643][ T5329]
[ 93.371288][ T5329] Allocated by task 5329:
[ 93.373101][ T5329] kasan_save_track+0x3e/0x80
[ 93.375074][ T5329] __kasan_kmalloc+0x93/0xb0
[ 93.377173][ T5329] __kmalloc_node_track_caller_noprof+0x4c3/0x730
[ 93.380527][ T5329] kstrdup+0x42/0x100
[ 93.382703][ T5329] f_uac2_opts_c_srate_store+0x11f/0x2b0
[ 93.385174][ T5329] configfs_write_iter+0x337/0x430
[ 93.387572][ T5329] vfs_write+0x612/0xba0
[ 93.389670][ T5329] ksys_write+0x150/0x270
[ 93.391454][ T5329] do_syscall_64+0x174/0x580
[ 93.393272][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.395741][ T5329]
[ 93.396766][ T5329] The buggy address belongs to the object at ffff888012832580
[ 93.396766][ T5329] which belongs to the cache kmalloc-96 of size 96
[ 93.402476][ T5329] The buggy address is located 51 bytes inside of
[ 93.402476][ T5329] 74-byte region [ffff888012832580, ffff8880128325ca)
[ 93.408133][ T5329]
[ 93.409247][ T5329] The buggy address belongs to the physical page:
[ 93.411869][ T5329] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888012832c00 pfn:0x12832
[ 93.415866][ T5329] flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
[ 93.419078][ T5329] page_type: f5(slab)
[ 93.420578][ T5329] raw: 00fff00000000200 ffff88801b041280 ffff88801b0401c8 ffff88801b0401c8
[ 93.423791][ T5329] raw: ffff888012832c00 0000000800200018 00000000f5000000 0000000000000000
[ 93.426971][ T5329] page dumped because: kasan: bad access detected
[ 93.429409][ T5329] page_owner tracks the page as allocated
[ 93.431503][ T5329] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 103, tgid 103 (kworker/u4:5), ts 93264216207, free_ts 93255468368
[ 93.439284][ T5329] post_alloc_hook+0x1f9/0x250
[ 93.441760][ T5329] get_page_from_freelist+0x21fa/0x2270
[ 93.444380][ T5329] __alloc_frozen_pages_noprof+0x18d/0x380
[ 93.446856][ T5329] allocate_slab+0x79/0x5e0
[ 93.448808][ T5329] refill_objects+0x2d5/0x350
[ 93.450835][ T5329] __pcs_replace_empty_main+0x2bf/0x6b0
[ 93.453168][ T5329] __kmalloc_cache_noprof+0x3a7/0x660
[ 93.455381][ T5329] nsim_fib_event_nb+0x185/0x11d0
[ 93.457484][ T5329] notifier_call_chain+0x1a5/0x3d0
[ 93.459542][ T5329] atomic_notifier_call_chain+0xda/0x180
[ 93.461885][ T5329] call_fib_notifiers+0x31/0x60
[ 93.463981][ T5329] fib6_add_rt2node+0x15f3/0x3940
[ 93.466106][ T5329] fib6_add+0x952/0x1930
[ 93.467924][ T5329] ip6_ins_rt+0xd6/0x140
[ 93.469772][ T5329] __ipv6_ifa_notify+0x4e8/0xc60
[ 93.472420][ T5329] addrconf_dad_completed+0x1a1/0xe60
[ 93.474923][ T5329] page last free pid 4684 tgid 4684 stack trace:
[ 93.477576][ T5329] __free_frozen_pages+0xc1e/0xd10
[ 93.479795][ T5329] tlb_remove_table_rcu+0x85/0x100
[ 93.481923][ T5329] rcu_core+0x78b/0x10a0
[ 93.483698][ T5329] handle_softirqs+0x225/0x840
[ 93.485661][ T5329] __irq_exit_rcu+0xca/0x220
[ 93.487625][ T5329] irq_exit_rcu+0x9/0x30
[ 93.489479][ T5329] sysvec_apic_timer_interrupt+0x57/0xc0
[ 93.491897][ T5329] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 93.494456][ T5329]
[ 93.495500][ T5329] Memory state around the buggy address:
[ 93.497862][ T5329] ffff888012832480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 93.500972][ T5329] ffff888012832500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 93.504255][ T5329] >ffff888012832580: 00 00 00 00 00 00 00 00 00 02 fc fc fc fc fc fc
[ 93.507445][ T5329] ^
[ 93.509687][ T5329] ffff888012832600: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[ 93.512947][ T5329] ffff888012832680: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[ 93.516588][ T5329] ==================================================================
[ 93.561819][ T5329] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 93.565172][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 93.569428][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 93.573607][ T5329] Call Trace:
[ 93.575137][ T5329]
[ 93.576321][ T5329] vpanic+0x56c/0xa60
[ 93.578178][ T5329] ? __pfx_vpanic+0x10/0x10
[ 93.580642][ T5329] ? __pfx___schedule+0x10/0x10
[ 93.583305][ T5329] panic+0xc5/0xd0
[ 93.584810][ T5329] ? __pfx_panic+0x10/0x10
[ 93.586810][ T5329] ? preempt_schedule_common+0x82/0xd0
[ 93.589075][ T5329] check_panic_on_warn+0x89/0xb0
[ 93.591146][ T5329] end_report+0x73/0x170
[ 93.592797][ T5329] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.595243][ T5329] kasan_report_invalid_free+0xfa/0x110
[ 93.597502][ T5329] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.599840][ T5329] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.602174][ T5329] __kasan_slab_pre_free+0x104/0x120
[ 93.604301][ T5329] kfree+0x173/0x640
[ 93.605862][ T5329] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.608011][ T5329] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.610291][ T5329] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 93.612809][ T5329] ? down_read+0x2be/0x330
[ 93.614741][ T5329] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 93.617305][ T5329] configfs_write_iter+0x337/0x430
[ 93.619480][ T5329] vfs_write+0x612/0xba0
[ 93.621277][ T5329] ? __pfx_vfs_write+0x10/0x10
[ 93.623274][ T5329] ? __fget_files+0x2a/0x420
[ 93.625241][ T5329] ksys_write+0x150/0x270
[ 93.626908][ T5329] ? __pfx_ksys_write+0x10/0x10
[ 93.628871][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.631306][ T5329] do_syscall_64+0x174/0x580
[ 93.633003][ T5329] ? trace_irq_disable+0x3b/0x140
[ 93.634895][ T5329] ? clear_bhb_loop+0x40/0x90
[ 93.636846][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.639294][ T5329] RIP: 0033:0x7ff3c539de99
[ 93.641168][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 93.648814][ T5329] RSP: 002b:00007ff3c17f4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 93.652024][ T5329] RAX: ffffffffffffffda RBX: 00007ff3c5625fa0 RCX: 00007ff3c539de99
[ 93.655104][ T5329] RDX: 0000000000000049 RSI: 00002000000000c0 RDI: 0000000000000005
[ 93.658212][ T5329] RBP: 00007ff3c5433eaf R08: 0000000000000000 R09: 0000000000000000
[ 93.661332][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 93.664350][ T5329] R13: 00007ff3c5626038 R14: 00007ff3c5625fa0 R15: 00007ffefc5884d8
[ 93.667450][ T5329]
[ 93.668952][ T5329] Kernel Offset: disabled
[ 93.670618][ T5329] Rebooting in 86400 seconds..