program:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001180), 0xc0040, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r3, 0x0)
ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f00000000c0)={[0x8, 0x1000005, 0x7fffffff, 0x0, 0x1, 0x0, 0x7fffffffff7fffff, 0xffffffffffffff70, 0xa, 0x7f, 0x0, 0x80, 0x3, 0x6, 0x1, 0x1], 0xeeee0000, 0x300})
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x6c}}, 0x8840)
write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x111, 0xf}}, 0x20)
sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, 0x0, 0x4800)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x88, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x5c, 0x4, 0x0, 0x1, [{0x58, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x48, 0x2, 0x0, 0x1, [@NFTA_TARGET_INFO={0x2c, 0x3, "9ac420002e00"/40}, @NFTA_TARGET_REV={0x8}, @NFTA_TARGET_NAME={0xe, 0x1, 'IDLETIMER\x00'}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xb0}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='config/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r4, &(0x7f0000000700)="29343130302c34384555e675c26893c8302c39", 0x13)
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
[ 101.757394][ T4639] Bluetooth: hci0: command tx timeout
[ 101.908457][ T5316] ==================================================================
[ 101.912053][ T5316] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0
[ 101.915678][ T5316] Free of addr ffff88800011ac86 by task syz.0.0/5316
[ 101.918961][ T5316]
[ 101.920143][ T5316] CPU: 0 UID: 0 PID: 5316 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 101.920160][ T5316] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 101.920187][ T5316] Call Trace:
[ 101.920195][ T5316]
[ 101.920202][ T5316] dump_stack_lvl+0xe8/0x150
[ 101.920224][ T5316] print_address_description+0x55/0x1e0
[ 101.920242][ T5316] print_report+0x58/0x70
[ 101.920256][ T5316] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 101.920270][ T5316] kasan_report_invalid_free+0xea/0x110
[ 101.920289][ T5316] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 101.920304][ T5316] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 101.920317][ T5316] __kasan_slab_pre_free+0x104/0x120
[ 101.920333][ T5316] kfree+0x173/0x640
[ 101.920345][ T5316] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 101.920359][ T5316] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 101.920371][ T5316] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 101.920386][ T5316] ? down_read+0x2be/0x330
[ 101.920397][ T5316] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 101.920410][ T5316] configfs_write_iter+0x337/0x430
[ 101.920423][ T5316] vfs_write+0x612/0xba0
[ 101.920441][ T5316] ? __pfx_vfs_write+0x10/0x10
[ 101.920458][ T5316] ? __fget_files+0x2a/0x420
[ 101.920476][ T5316] ksys_write+0x150/0x270
[ 101.920492][ T5316] ? __pfx_ksys_write+0x10/0x10
[ 101.920510][ T5316] do_syscall_64+0x166/0x520
[ 101.920526][ T5316] ? trace_irq_disable+0x3b/0x140
[ 101.920541][ T5316] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 101.920551][ T5316] ? clear_bhb_loop+0x70/0xc0
[ 101.920563][ T5316] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 101.920575][ T5316] RIP: 0033:0x7fe43ed9e0d9
[ 101.920588][ T5316] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 101.920597][ T5316] RSP: 002b:00007fe43fcecfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 101.920611][ T5316] RAX: ffffffffffffffda RBX: 00007fe43f025fa0 RCX: 00007fe43ed9e0d9
[ 101.920620][ T5316] RDX: 0000000000000013 RSI: 0000200000000700 RDI: 0000000000000007
[ 101.920628][ T5316] RBP: 00007fe43ee35024 R08: 0000000000000000 R09: 0000000000000000
[ 101.920636][ T5316] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 101.920643][ T5316] R13: 00007fe43f026038 R14: 00007fe43f025fa0 R15: 00007ffef5f7a8b8
[ 101.920655][ T5316]
[ 101.920666][ T5316]
[ 102.023677][ T5316] Allocated by task 5316:
[ 102.025583][ T5316] kasan_save_track+0x3e/0x80
[ 102.027695][ T5316] __kasan_kmalloc+0x93/0xb0
[ 102.029726][ T5316] __kmalloc_node_track_caller_noprof+0x4c7/0x740
[ 102.032531][ T5316] kstrdup+0x42/0x100
[ 102.034318][ T5316] f_uac2_opts_c_srate_store+0x11f/0x2b0
[ 102.036828][ T5316] configfs_write_iter+0x337/0x430
[ 102.039334][ T5316] vfs_write+0x612/0xba0
[ 102.041400][ T5316] ksys_write+0x150/0x270
[ 102.043371][ T5316] do_syscall_64+0x166/0x520
[ 102.045452][ T5316] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.047979][ T5316]
[ 102.049082][ T5316] The buggy address belongs to the object at ffff88800011ac80
[ 102.049082][ T5316] which belongs to the cache kmalloc-32 of size 32
[ 102.054926][ T5316] The buggy address is located 6 bytes inside of
[ 102.054926][ T5316] 20-byte region [ffff88800011ac80, ffff88800011ac94)
[ 102.060534][ T5316]
[ 102.061674][ T5316] The buggy address belongs to the physical page:
[ 102.064517][ T5316] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11a
[ 102.068152][ T5316] flags: 0x7ff00000000000(node=0|zone=0|lastcpupid=0x7ff)
[ 102.071132][ T5316] page_type: f5(slab)
[ 102.073023][ T5316] raw: 007ff00000000000 ffff88801b041780 dead000000000100 dead000000000122
[ 102.077175][ T5316] raw: 0000000000000000 0000000800400040 00000000f5000000 0000000000000000
[ 102.080892][ T5316] page dumped because: kasan: bad access detected
[ 102.083712][ T5316] page_owner tracks the page as allocated
[ 102.086192][ T5316] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 6942157156, free_ts 0
[ 102.094645][ T5316] post_alloc_hook+0x1f9/0x250
[ 102.097161][ T5316] get_page_from_freelist+0x21fe/0x2270
[ 102.099697][ T5316] __alloc_frozen_pages_noprof+0x18d/0x380
[ 102.102272][ T5316] allocate_slab+0x79/0x5e0
[ 102.104261][ T5316] refill_objects+0x2d5/0x350
[ 102.106348][ T5316] __pcs_replace_empty_main+0x2c3/0x6b0
[ 102.108688][ T5316] __kmalloc_node_track_caller_noprof+0x55b/0x740
[ 102.111442][ T5316] kvasprintf+0xeb/0x1a0
[ 102.113329][ T5316] kasprintf+0xe2/0x140
[ 102.115083][ T5316] alloc_workqueue_noprof+0x12e/0x210
[ 102.117404][ T5316] cgroup_writeback_init+0x1a/0x40
[ 102.119736][ T5316] do_one_initcall+0x250/0x870
[ 102.121834][ T5316] do_initcall_level+0x10a/0x1a0
[ 102.124044][ T5316] do_initcalls+0x59/0xa0
[ 102.126021][ T5316] kernel_init_freeable+0x29d/0x3e0
[ 102.128242][ T5316] kernel_init+0x22/0x1d0
[ 102.130220][ T5316] page_owner free stack trace missing
[ 102.132476][ T5316]
[ 102.133542][ T5316] Memory state around the buggy address:
[ 102.135983][ T5316] ffff88800011ab80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[ 102.139913][ T5316] ffff88800011ac00: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc
[ 102.143503][ T5316] >ffff88800011ac80: 00 00 04 fc fc fc fc fc 00 00 00 fc fc fc fc fc
[ 102.146981][ T5316] ^
[ 102.148775][ T5316] ffff88800011ad00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[ 102.152175][ T5316] ffff88800011ad80: 00 00 00 fc fc fc fc fc 00 00 00 00 fc fc fc fc
[ 102.156330][ T5316] ==================================================================
[ 102.179925][ T5316] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 102.183439][ T5316] CPU: 0 UID: 0 PID: 5316 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 102.187370][ T5316] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 102.191769][ T5316] Call Trace:
[ 102.193338][ T5316]
[ 102.194742][ T5316] vpanic+0x56d/0xa60
[ 102.196602][ T5316] ? __pfx_vpanic+0x10/0x10
[ 102.198735][ T5316] ? __pfx___schedule+0x10/0x10
[ 102.200935][ T5316] panic+0xc5/0xd0
[ 102.202641][ T5316] ? __pfx_panic+0x10/0x10
[ 102.204661][ T5316] ? preempt_schedule_common+0x7f/0xd0
[ 102.207372][ T5316] check_panic_on_warn+0x89/0xb0
[ 102.209775][ T5316] end_report+0x73/0x170
[ 102.211652][ T5316] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 102.214280][ T5316] kasan_report_invalid_free+0xfa/0x110
[ 102.216729][ T5316] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 102.219319][ T5316] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 102.221987][ T5316] __kasan_slab_pre_free+0x104/0x120
[ 102.224445][ T5316] kfree+0x173/0x640
[ 102.226334][ T5316] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 102.228718][ T5316] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 102.231102][ T5316] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 102.233578][ T5316] ? down_read+0x2be/0x330
[ 102.235411][ T5316] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 102.237858][ T5316] configfs_write_iter+0x337/0x430
[ 102.239885][ T5316] vfs_write+0x612/0xba0
[ 102.241668][ T5316] ? __pfx_vfs_write+0x10/0x10
[ 102.243716][ T5316] ? __fget_files+0x2a/0x420
[ 102.245717][ T5316] ksys_write+0x150/0x270
[ 102.247684][ T5316] ? __pfx_ksys_write+0x10/0x10
[ 102.249823][ T5316] do_syscall_64+0x166/0x520
[ 102.251838][ T5316] ? trace_irq_disable+0x3b/0x140
[ 102.254094][ T5316] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.256757][ T5316] ? clear_bhb_loop+0x70/0xc0
[ 102.258880][ T5316] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.261408][ T5316] RIP: 0033:0x7fe43ed9e0d9
[ 102.263383][ T5316] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 102.271771][ T5316] RSP: 002b:00007fe43fcecfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 102.275342][ T5316] RAX: ffffffffffffffda RBX: 00007fe43f025fa0 RCX: 00007fe43ed9e0d9
[ 102.278913][ T5316] RDX: 0000000000000013 RSI: 0000200000000700 RDI: 0000000000000007
[ 102.282039][ T5316] RBP: 00007fe43ee35024 R08: 0000000000000000 R09: 0000000000000000
[ 102.285254][ T5316] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 102.288611][ T5316] R13: 00007fe43f026038 R14: 00007fe43f025fa0 R15: 00007ffef5f7a8b8
[ 102.292348][ T5316]
[ 102.294267][ T5316] Kernel Offset: disabled
[ 102.296232][ T5316] Rebooting in 86400 seconds..