program:
close(0x3)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/net/ipv4/ip_forward\x00', 0x1, 0x0)
write(r1, &(0x7f0000000100)='1', 0x1)
setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, 0x0, 0x13)
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='config/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write$binfmt_script(r2, &(0x7f0000000140)={'#! ', 'config', [{0x20, '\\'}], 0xa, "37572ce3dc9714f6ecf7d5ad06b19319b1f6de1c022807dc2ec81f0223eefe9b9ee149bbbaa43cb55601dc1761ecde432e9c45d53a3a6180dfde536962d3f245697684fcf135ccfae800e988d6dbc62cf1997a7ed40379d7e5df9a5323260eb9c75b4fd3f852b4605ad6ad119f9014c971daf534905e7608"}, 0x84)
bpf$BPF_PROG_QUERY(0x10, &(0x7f00000002c0)={@map=r2, 0x2e, 0x0, 0x2, &(0x7f0000000040)=[0x0], 0x1, 0x0, &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0]}, 0x40)
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
[ 92.496821][ T5312] ==================================================================
[ 92.500396][ T5312] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0
[ 92.503710][ T5312] Free of addr ffff888012a1568f by task syz.0.0/5312
[ 92.506574][ T5312]
[ 92.507599][ T5312] CPU: 0 UID: 0 PID: 5312 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 92.507614][ T5312] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 92.507621][ T5312] Call Trace:
[ 92.507628][ T5312]
[ 92.507634][ T5312] dump_stack_lvl+0xe8/0x150
[ 92.507655][ T5312] print_address_description+0x55/0x1e0
[ 92.507669][ T5312] print_report+0x58/0x70
[ 92.507676][ T5312] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 92.507684][ T5312] kasan_report_invalid_free+0xea/0x110
[ 92.507692][ T5312] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 92.507700][ T5312] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 92.507706][ T5312] __kasan_slab_pre_free+0x104/0x120
[ 92.507714][ T5312] kfree+0x173/0x640
[ 92.507729][ T5312] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 92.507741][ T5312] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 92.507753][ T5312] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 92.507765][ T5312] ? down_read+0x2be/0x330
[ 92.507778][ T5312] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 92.507790][ T5312] configfs_write_iter+0x337/0x430
[ 92.507805][ T5312] vfs_write+0x612/0xba0
[ 92.507819][ T5312] ? __pfx_vfs_write+0x10/0x10
[ 92.507834][ T5312] ? __fget_files+0x2a/0x420
[ 92.507848][ T5312] ksys_write+0x150/0x270
[ 92.507859][ T5312] ? __pfx_ksys_write+0x10/0x10
[ 92.507872][ T5312] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 92.507883][ T5312] do_syscall_64+0x174/0x580
[ 92.507896][ T5312] ? trace_irq_disable+0x3b/0x140
[ 92.507908][ T5312] ? clear_bhb_loop+0x70/0xc0
[ 92.507919][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 92.507930][ T5312] RIP: 0033:0x7fb39b39e0d9
[ 92.507942][ T5312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 92.507951][ T5312] RSP: 002b:00007fb39c1affe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 92.507964][ T5312] RAX: ffffffffffffffda RBX: 00007fb39b625fa0 RCX: 00007fb39b39e0d9
[ 92.507971][ T5312] RDX: 0000000000000084 RSI: 0000200000000140 RDI: 0000000000000003
[ 92.507978][ T5312] RBP: 00007fb39b435024 R08: 0000000000000000 R09: 0000000000000000
[ 92.507984][ T5312] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 92.507990][ T5312] R13: 00007fb39b626038 R14: 00007fb39b625fa0 R15: 00007ffea05af3a8
[ 92.508001][ T5312]
[ 92.508005][ T5312]
[ 92.602002][ T5312] Allocated by task 5312:
[ 92.603856][ T5312] kasan_save_track+0x3e/0x80
[ 92.605780][ T5312] __kasan_kmalloc+0x93/0xb0
[ 92.607691][ T5312] __kmalloc_node_track_caller_noprof+0x4c3/0x730
[ 92.610374][ T5312] kstrdup+0x42/0x100
[ 92.612038][ T5312] f_uac2_opts_c_srate_store+0x11f/0x2b0
[ 92.614359][ T5312] configfs_write_iter+0x337/0x430
[ 92.616319][ T5312] vfs_write+0x612/0xba0
[ 92.617842][ T5312] ksys_write+0x150/0x270
[ 92.619559][ T5312] do_syscall_64+0x174/0x580
[ 92.621442][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 92.623744][ T5312]
[ 92.624592][ T5312] The buggy address belongs to the object at ffff888012a15680
[ 92.624592][ T5312] which belongs to the cache kmalloc-96 of size 96
[ 92.629254][ T5312] The buggy address is located 15 bytes inside of
[ 92.629254][ T5312] 86-byte region [ffff888012a15680, ffff888012a156d6)
[ 92.634181][ T5312]
[ 92.635160][ T5312] The buggy address belongs to the physical page:
[ 92.637693][ T5312] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12a15
[ 92.640891][ T5312] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 92.643554][ T5312] page_type: f5(slab)
[ 92.645088][ T5312] raw: 00fff00000000000 ffff88801b041280 dead000000000100 dead000000000122
[ 92.648434][ T5312] raw: 0000000000000000 0000000800200020 00000000f5000000 0000000000000000
[ 92.652055][ T5312] page dumped because: kasan: bad access detected
[ 92.654693][ T5312] page_owner tracks the page as allocated
[ 92.656961][ T5312] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 5312, tgid 5311 (syz.0.0), ts 92441733988, free_ts 92441291601
[ 92.664813][ T5312] post_alloc_hook+0x1f9/0x250
[ 92.666923][ T5312] get_page_from_freelist+0x21fa/0x2270
[ 92.669271][ T5312] __alloc_frozen_pages_noprof+0x18d/0x380
[ 92.671838][ T5312] allocate_slab+0x79/0x5e0
[ 92.673741][ T5312] ___slab_alloc+0x16a/0x950
[ 92.675741][ T5312] __kmalloc_flags_noprof+0x347/0x800
[ 92.677942][ T5312] alloc_slab_obj_exts+0x4d/0x170
[ 92.679831][ T5312] __memcg_slab_post_alloc_hook+0x5d3/0xf10
[ 92.682076][ T5312] kmem_cache_alloc_lru_noprof+0x358/0x5f0
[ 92.684220][ T5312] sock_alloc_inode+0x2c/0x1a0
[ 92.686050][ T5312] alloc_inode+0x6a/0x1b0
[ 92.687668][ T5312] __sock_create+0x12d/0x9d0
[ 92.689427][ T5312] __sys_socket+0xd6/0x1b0
[ 92.691211][ T5312] __x64_sys_socket+0x7a/0x90
[ 92.692993][ T5312] do_syscall_64+0x174/0x580
[ 92.694878][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 92.697146][ T5312] page last free pid 5317 tgid 5317 stack trace:
[ 92.699710][ T5312] __free_frozen_pages+0xc1e/0xd10
[ 92.701793][ T5312] tlb_finish_mmu+0x13e/0x220
[ 92.704292][ T5312] unmap_region+0x2a5/0x330
[ 92.706654][ T5312] vms_complete_munmap_vmas+0x427/0xbe0
[ 92.708893][ T5312] do_vmi_align_munmap+0x3b7/0x4b0
[ 92.711077][ T5312] do_vmi_munmap+0x252/0x2d0
[ 92.713141][ T5312] __vm_munmap+0x241/0x3e0
[ 92.715049][ T5312] __x64_sys_munmap+0x60/0x70
[ 92.716959][ T5312] do_syscall_64+0x174/0x580
[ 92.718911][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 92.721301][ T5312]
[ 92.722289][ T5312] Memory state around the buggy address:
[ 92.724555][ T5312] ffff888012a15580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 92.727771][ T5312] ffff888012a15600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 92.731087][ T5312] >ffff888012a15680: 00 00 00 00 00 00 00 00 00 00 06 fc fc fc fc fc
[ 92.734322][ T5312] ^
[ 92.735968][ T5312] ffff888012a15700: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[ 92.738980][ T5312] ffff888012a15780: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[ 92.741933][ T5312] ==================================================================
[ 92.755889][ T4640] Bluetooth: hci0: command tx timeout
[ 92.776150][ T5312] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 92.779290][ T5312] CPU: 0 UID: 0 PID: 5312 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 92.783127][ T5312] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 92.787424][ T5312] Call Trace:
[ 92.789244][ T5312]
[ 92.790709][ T5312] vpanic+0x56c/0xa60
[ 92.792537][ T5312] ? __pfx_vpanic+0x10/0x10
[ 92.794512][ T5312] ? __pfx___schedule+0x10/0x10
[ 92.796658][ T5312] panic+0xc5/0xd0
[ 92.798332][ T5312] ? __pfx_panic+0x10/0x10
[ 92.800288][ T5312] ? preempt_schedule_common+0x82/0xd0
[ 92.802562][ T5312] check_panic_on_warn+0x89/0xb0
[ 92.804665][ T5312] end_report+0x73/0x170
[ 92.806461][ T5312] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 92.808987][ T5312] kasan_report_invalid_free+0xfa/0x110
[ 92.811147][ T5312] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 92.813505][ T5312] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 92.816039][ T5312] __kasan_slab_pre_free+0x104/0x120
[ 92.818287][ T5312] kfree+0x173/0x640
[ 92.819994][ T5312] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 92.822512][ T5312] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 92.824865][ T5312] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 92.827504][ T5312] ? down_read+0x2be/0x330
[ 92.829459][ T5312] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 92.832205][ T5312] configfs_write_iter+0x337/0x430
[ 92.834455][ T5312] vfs_write+0x612/0xba0
[ 92.836353][ T5312] ? __pfx_vfs_write+0x10/0x10
[ 92.838463][ T5312] ? __fget_files+0x2a/0x420
[ 92.840455][ T5312] ksys_write+0x150/0x270
[ 92.842329][ T5312] ? __pfx_ksys_write+0x10/0x10
[ 92.844451][ T5312] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 92.847087][ T5312] do_syscall_64+0x174/0x580
[ 92.849084][ T5312] ? trace_irq_disable+0x3b/0x140
[ 92.851227][ T5312] ? clear_bhb_loop+0x70/0xc0
[ 92.853179][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 92.855684][ T5312] RIP: 0033:0x7fb39b39e0d9
[ 92.857599][ T5312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 92.865468][ T5312] RSP: 002b:00007fb39c1affe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 92.868922][ T5312] RAX: ffffffffffffffda RBX: 00007fb39b625fa0 RCX: 00007fb39b39e0d9
[ 92.872134][ T5312] RDX: 0000000000000084 RSI: 0000200000000140 RDI: 0000000000000003
[ 92.875085][ T5312] RBP: 00007fb39b435024 R08: 0000000000000000 R09: 0000000000000000
[ 92.878322][ T5312] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 92.881642][ T5312] R13: 00007fb39b626038 R14: 00007fb39b625fa0 R15: 00007ffea05af3a8
[ 92.884957][ T5312]
[ 92.886750][ T5312] Kernel Offset: disabled
[ 92.888650][ T5312] Rebooting in 86400 seconds..