program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000680)="34343130e69fe44aeb886cda8e0d302c34383030302c38383230302c3936303430506f8de29737d2c5ea7eb1e348a743f702051de4c7740bff111aec57b42da8197d2625159dfae0a8f1d2d5df2c4643cf3d9246999d6b9f751ccee232759ef1d032046fd953c62ef68100000000000000d814a3207124f2d824447f627b7a235e195d6cd4ceaace6022f4ce921e311d4a4e4a503e335d77bc3f2afd06447279f4e949c5696856976e4c12f40fc00e3a789730aa458bceec87c18555ec1a3e19c7edbfe9da0509564b535c6d4119071b106e8fe342fd975a71f4163efe0c0351188dfb5d8fa9926ee7f83824172010efe4471af8d1f6e968e73ce33eceec939d404669d26722ce58494899c1290a6780318f4184587073c95716939ab96307ae893be82bb5915eb2c37d6f743f151d8880bb55a3939a8079d60ed1c0e4b5f93ed30f595fd65b810be29e13731dc8", 0x14e)
symlinkat(&(0x7f0000000580)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00')
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0)
r2 = dup(r1)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r2, 0x0)
io_uring_register$IORING_REGISTER_NAPI(r2, 0x1b, &(0x7f0000000080)={0x5, 0x0, 0x2, '\x00', 0x7}, 0x1)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./myconfig/usb_gadget/g1/UDC\x00', 0x1, 0x0)
mkdir(&(0x7f0000000000)='proc_dir\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='proc_dir\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0)
setfsuid(0x0)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001})
r4 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1})
ioctl$sock_inet_SIOCSIFADDR(r4, 0x8916, &(0x7f0000000200)={'syzkaller1\x00', {0x2, 0x0, @dev={0xac, 0x14, 0x0, 0x1}}})
bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e20, @dev={0xac, 0x14, 0x0, 0x1}}, 0x10)
r5 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r5, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10)
fcntl$setstatus(r5, 0x4, 0x40800)
connect$inet(r5, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10)
setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x25, &(0x7f00000002c0)=0x80, 0x4)
r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0)
ftruncate(r6, 0x2000009)
sendfile(0xffffffffffffffff, r6, 0x0, 0x7ffff004)
[ 124.003367][ T5321] ==================================================================
[ 124.007028][ T5321] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0
[ 124.010497][ T5321] Free of addr ffff88803fc96d10 by task syz.0.0/5321
[ 124.013462][ T5321]
[ 124.014495][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 124.014511][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 124.014519][ T5321] Call Trace:
[ 124.014526][ T5321]
[ 124.014532][ T5321] dump_stack_lvl+0xe8/0x150
[ 124.014553][ T5321] print_address_description+0x55/0x1e0
[ 124.014570][ T5321] print_report+0x58/0x70
[ 124.014584][ T5321] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 124.014598][ T5321] kasan_report_invalid_free+0xea/0x110
[ 124.014613][ T5321] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 124.014629][ T5321] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 124.014642][ T5321] __kasan_slab_pre_free+0x104/0x120
[ 124.014657][ T5321] kfree+0x173/0x640
[ 124.014667][ T5321] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 124.014680][ T5321] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 124.014693][ T5321] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 124.014707][ T5321] ? down_read+0x2be/0x330
[ 124.014720][ T5321] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 124.014732][ T5321] configfs_write_iter+0x337/0x430
[ 124.014745][ T5321] vfs_write+0x612/0xba0
[ 124.014763][ T5321] ? __pfx_vfs_write+0x10/0x10
[ 124.014780][ T5321] ? __fget_files+0x2a/0x420
[ 124.014796][ T5321] ksys_write+0x150/0x270
[ 124.014805][ T5321] ? __pfx_ksys_write+0x10/0x10
[ 124.014823][ T5321] do_syscall_64+0x166/0x520
[ 124.014836][ T5321] ? trace_irq_disable+0x3b/0x140
[ 124.014850][ T5321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 124.014861][ T5321] ? clear_bhb_loop+0x70/0xc0
[ 124.014873][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 124.014884][ T5321] RIP: 0033:0x7f07dcf9e0d9
[ 124.014897][ T5321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 124.014906][ T5321] RSP: 002b:00007f07dde37fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 124.014948][ T5321] RAX: ffffffffffffffda RBX: 00007f07dd225fa0 RCX: 00007f07dcf9e0d9
[ 124.014956][ T5321] RDX: 000000000000014e RSI: 0000200000000680 RDI: 0000000000000003
[ 124.014963][ T5321] RBP: 00007f07dd035024 R08: 0000000000000000 R09: 0000000000000000
[ 124.014968][ T5321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 124.014974][ T5321] R13: 00007f07dd226038 R14: 00007f07dd225fa0 R15: 00007ffc6589e808
[ 124.014986][ T5321]
[ 124.014990][ T5321]
[ 124.111141][ T5321] Allocated by task 5321:
[ 124.112889][ T5321] kasan_save_track+0x3e/0x80
[ 124.114814][ T5321] __kasan_kmalloc+0x93/0xb0
[ 124.116756][ T5321] __kmalloc_node_track_caller_noprof+0x4c7/0x740
[ 124.119364][ T5321] kstrdup+0x42/0x100
[ 124.120966][ T5321] f_uac2_opts_c_srate_store+0x11f/0x2b0
[ 124.123266][ T5321] configfs_write_iter+0x337/0x430
[ 124.125457][ T5321] vfs_write+0x612/0xba0
[ 124.127250][ T5321] ksys_write+0x150/0x270
[ 124.129141][ T5321] do_syscall_64+0x166/0x520
[ 124.131028][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 124.133387][ T5321]
[ 124.134376][ T5321] The buggy address belongs to the object at ffff88803fc96d00
[ 124.134376][ T5321] which belongs to the cache kmalloc-128 of size 128
[ 124.139700][ T5321] The buggy address is located 16 bytes inside of
[ 124.139700][ T5321] 107-byte region [ffff88803fc96d00, ffff88803fc96d6b)
[ 124.145047][ T5321]
[ 124.146038][ T5321] The buggy address belongs to the physical page:
[ 124.148441][ T5321] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3fc96
[ 124.152167][ T5321] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 124.155042][ T5321] page_type: f5(slab)
[ 124.156472][ T5321] raw: 04fff00000000000 ffff88801b041a00 dead000000000100 dead000000000122
[ 124.159821][ T5321] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
[ 124.163000][ T5321] page dumped because: kasan: bad access detected
[ 124.165482][ T5321] page_owner tracks the page as allocated
[ 124.167577][ T5321] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4702, tgid 4702 (udevd), ts 66322231936
[ 124.174194][ T5321] post_alloc_hook+0x1f9/0x250
[ 124.176306][ T5321] get_page_from_freelist+0x2209/0x2280
[ 124.179232][ T5321] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 124.182346][ T5321] allocate_slab+0x7c/0x5e0
[ 124.184329][ T5321] refill_objects+0x2d5/0x350
[ 124.186269][ T5321] __pcs_replace_empty_main+0x2c3/0x6b0
[ 124.188609][ T5321] __kmalloc_noprof+0x489/0x720
[ 124.190633][ T5321] tomoyo_encode+0x2ad/0x570
[ 124.192435][ T5321] tomoyo_realpath_from_path+0x5fa/0x640
[ 124.194613][ T5321] tomoyo_path_perm+0x283/0x560
[ 124.196685][ T5321] security_inode_getattr+0x12b/0x310
[ 124.198908][ T5321] vfs_getattr+0x23/0x70
[ 124.200688][ T5321] vfs_statx_path+0x2b/0x230
[ 124.202454][ T5321] vfs_statx+0x12e/0x200
[ 124.204207][ T5321] vfs_fstatat+0x11b/0x170
[ 124.206103][ T5321] __x64_sys_newfstatat+0x151/0x200
[ 124.208352][ T5321] page last free pid 4701 tgid 4701 ts 66318794279 stack trace:
[ 124.211848][ T5321] __free_frozen_pages+0xc93/0xd90
[ 124.213866][ T5321] rcu_core+0x794/0x10b0
[ 124.215542][ T5321] handle_softirqs+0x226/0x860
[ 124.217389][ T5321] __irq_exit_rcu+0xcb/0x220
[ 124.219374][ T5321] irq_exit_rcu+0x9/0x30
[ 124.221188][ T5321] sysvec_apic_timer_interrupt+0xa6/0xc0
[ 124.223553][ T5321] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 124.226225][ T5321]
[ 124.227299][ T5321] Memory state around the buggy address:
[ 124.229763][ T5321] ffff88803fc96c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
[ 124.233191][ T5321] ffff88803fc96c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 124.236496][ T5321] >ffff88803fc96d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc fc
[ 124.239839][ T5321] ^
[ 124.241878][ T5321] ffff88803fc96d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 124.245407][ T5321] ffff88803fc96e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
[ 124.248912][ T5321] ==================================================================
[ 124.294305][ T5285] Bluetooth: hci0: command tx timeout
[ 124.398166][ T5321] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 124.401072][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 124.404912][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 124.408926][ T5321] Call Trace:
[ 124.410257][ T5321]
[ 124.411478][ T5321] vpanic+0x56d/0xa60
[ 124.413071][ T5321] ? __pfx_vpanic+0x10/0x10
[ 124.414952][ T5321] ? __pfx___schedule+0x10/0x10
[ 124.416997][ T5321] panic+0xc5/0xd0
[ 124.418514][ T5321] ? __pfx_panic+0x10/0x10
[ 124.420437][ T5321] ? preempt_schedule_common+0x7f/0xd0
[ 124.422703][ T5321] check_panic_on_warn+0x89/0xb0
[ 124.424811][ T5321] end_report+0x73/0x170
[ 124.426507][ T5321] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 124.428921][ T5321] kasan_report_invalid_free+0xfa/0x110
[ 124.433649][ T5321] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 124.435900][ T5321] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 124.438229][ T5321] __kasan_slab_pre_free+0x104/0x120
[ 124.440485][ T5321] kfree+0x173/0x640
[ 124.442181][ T5321] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 124.444817][ T5321] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 124.447179][ T5321] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 124.449798][ T5321] ? down_read+0x2be/0x330
[ 124.451608][ T5321] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 124.454142][ T5321] configfs_write_iter+0x337/0x430
[ 124.456259][ T5321] vfs_write+0x612/0xba0
[ 124.458186][ T5321] ? __pfx_vfs_write+0x10/0x10
[ 124.460263][ T5321] ? __fget_files+0x2a/0x420
[ 124.462177][ T5321] ksys_write+0x150/0x270
[ 124.464030][ T5321] ? __pfx_ksys_write+0x10/0x10
[ 124.466085][ T5321] do_syscall_64+0x166/0x520
[ 124.468024][ T5321] ? trace_irq_disable+0x3b/0x140
[ 124.470175][ T5321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 124.472534][ T5321] ? clear_bhb_loop+0x70/0xc0
[ 124.474463][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 124.476814][ T5321] RIP: 0033:0x7f07dcf9e0d9
[ 124.478597][ T5321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 124.486432][ T5321] RSP: 002b:00007f07dde37fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 124.490041][ T5321] RAX: ffffffffffffffda RBX: 00007f07dd225fa0 RCX: 00007f07dcf9e0d9
[ 124.493364][ T5321] RDX: 000000000000014e RSI: 0000200000000680 RDI: 0000000000000003
[ 124.496574][ T5321] RBP: 00007f07dd035024 R08: 0000000000000000 R09: 0000000000000000
[ 124.499754][ T5321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 124.502865][ T5321] R13: 00007f07dd226038 R14: 00007f07dd225fa0 R15: 00007ffc6589e808
[ 124.505900][ T5321]
[ 124.507510][ T5321] Kernel Offset: disabled
[ 124.509285][ T5321] Rebooting in 86400 seconds..