program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000000)="34343130302c34383030302c38383230302c39363030302c3137363430302c31392b3030302c3335323830302c335aef29e945b6229c6864ba01e024cac87a17e47a7f695106795598af3c8afe8c2c7878e69c4b9f2117d94dcd30788e3c99a924e495d133b316d13baad5cd4a737f3c4b810629fd3856e6294317ac3aeef34a1df4fb263f9e735ca02830c9349628e30260997ab735ba7e7680384d", 0x9c)
symlinkat(&(0x7f0000000580)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./myconfig/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r1, &(0x7f0000000640)='usbip-vudc.0', 0xc)
[ 93.419524][ T4638] Bluetooth: hci0: command tx timeout
[ 93.502602][ T5318] ==================================================================
[ 93.505944][ T5318] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.510071][ T5318] Free of addr ffff888036125a26 by task syz.0.0/5318
[ 93.512770][ T5318]
[ 93.513842][ T5318] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 93.513858][ T5318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 93.513865][ T5318] Call Trace:
[ 93.513873][ T5318]
[ 93.513878][ T5318] dump_stack_lvl+0xe8/0x150
[ 93.513898][ T5318] print_address_description+0x55/0x1e0
[ 93.513915][ T5318] print_report+0x58/0x70
[ 93.513926][ T5318] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.513935][ T5318] kasan_report_invalid_free+0xea/0x110
[ 93.513944][ T5318] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.513952][ T5318] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.513963][ T5318] __kasan_slab_pre_free+0x104/0x120
[ 93.513974][ T5318] kfree+0x173/0x640
[ 93.513987][ T5318] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.513999][ T5318] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.514012][ T5318] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 93.514024][ T5318] ? down_read+0x2be/0x330
[ 93.514039][ T5318] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 93.514050][ T5318] configfs_write_iter+0x337/0x430
[ 93.514059][ T5318] vfs_write+0x612/0xba0
[ 93.514070][ T5318] ? __pfx_vfs_write+0x10/0x10
[ 93.514081][ T5318] ? __fget_files+0x2a/0x420
[ 93.514094][ T5318] ksys_write+0x150/0x270
[ 93.514106][ T5318] ? __pfx_ksys_write+0x10/0x10
[ 93.514120][ T5318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.514131][ T5318] do_syscall_64+0x174/0x580
[ 93.514144][ T5318] ? trace_irq_disable+0x3b/0x140
[ 93.514157][ T5318] ? clear_bhb_loop+0x70/0xc0
[ 93.514169][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.514177][ T5318] RIP: 0033:0x7f1c75f9e0d9
[ 93.514185][ T5318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 93.514192][ T5318] RSP: 002b:00007f1c76dbefe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 93.514202][ T5318] RAX: ffffffffffffffda RBX: 00007f1c76225fa0 RCX: 00007f1c75f9e0d9
[ 93.514208][ T5318] RDX: 000000000000009c RSI: 0000200000000000 RDI: 0000000000000003
[ 93.514212][ T5318] RBP: 00007f1c76035024 R08: 0000000000000000 R09: 0000000000000000
[ 93.514217][ T5318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 93.514221][ T5318] R13: 00007f1c76226038 R14: 00007f1c76225fa0 R15: 00007ffeb7975458
[ 93.514229][ T5318]
[ 93.514232][ T5318]
[ 93.609501][ T5318] Allocated by task 5318:
[ 93.611597][ T5318] kasan_save_track+0x3e/0x80
[ 93.613793][ T5318] __kasan_kmalloc+0x93/0xb0
[ 93.615871][ T5318] __kmalloc_node_track_caller_noprof+0x4c3/0x730
[ 93.618923][ T5318] kstrdup+0x42/0x100
[ 93.620670][ T5318] f_uac2_opts_c_srate_store+0x11f/0x2b0
[ 93.623141][ T5318] configfs_write_iter+0x337/0x430
[ 93.625350][ T5318] vfs_write+0x612/0xba0
[ 93.627115][ T5318] ksys_write+0x150/0x270
[ 93.628920][ T5318] do_syscall_64+0x174/0x580
[ 93.630847][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.633180][ T5318]
[ 93.634201][ T5318] The buggy address belongs to the object at ffff888036125a00
[ 93.634201][ T5318] which belongs to the cache kmalloc-192 of size 192
[ 93.639720][ T5318] The buggy address is located 38 bytes inside of
[ 93.639720][ T5318] 157-byte region [ffff888036125a00, ffff888036125a9d)
[ 93.645084][ T5318]
[ 93.646037][ T5318] The buggy address belongs to the physical page:
[ 93.648714][ T5318] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x36125
[ 93.652105][ T5318] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 93.654949][ T5318] page_type: f5(slab)
[ 93.656590][ T5318] raw: 04fff00000000000 ffff88801b0413c0 dead000000000100 dead000000000122
[ 93.659972][ T5318] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
[ 93.663346][ T5318] page dumped because: kasan: bad access detected
[ 93.666129][ T5318] page_owner tracks the page as allocated
[ 93.668417][ T5318] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 12312475155, free_ts 0
[ 93.675715][ T5318] post_alloc_hook+0x1f9/0x250
[ 93.677674][ T5318] get_page_from_freelist+0x21fa/0x2270
[ 93.679600][ T5318] __alloc_frozen_pages_noprof+0x18d/0x380
[ 93.681731][ T5318] allocate_slab+0x79/0x5e0
[ 93.683269][ T5318] refill_objects+0x2d5/0x350
[ 93.685165][ T5318] __pcs_replace_empty_main+0x2bf/0x6b0
[ 93.687371][ T5318] __kmalloc_cache_noprof+0x3a7/0x660
[ 93.689318][ T5318] call_usermodehelper_setup+0x8e/0x270
[ 93.691407][ T5318] kobject_uevent_env+0x662/0x9e0
[ 93.693390][ T5318] workqueue_sysfs_register+0x28f/0x300
[ 93.695729][ T5318] __alloc_workqueue+0x1c75/0x2060
[ 93.697706][ T5318] alloc_workqueue_noprof+0xe3/0x210
[ 93.699775][ T5318] scsi_host_alloc+0xbd6/0x11c0
[ 93.701792][ T5318] ata_scsi_add_hosts+0xa4/0x4b0
[ 93.703794][ T5318] ata_host_register+0x1c5/0x7d0
[ 93.705840][ T5318] ata_host_activate+0x33c/0x3c0
[ 93.707811][ T5318] page_owner free stack trace missing
[ 93.709847][ T5318]
[ 93.710796][ T5318] Memory state around the buggy address:
[ 93.713025][ T5318] ffff888036125900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 93.716280][ T5318] ffff888036125980: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[ 93.719705][ T5318] >ffff888036125a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 93.722809][ T5318] ^
[ 93.724940][ T5318] ffff888036125a80: 00 00 00 05 fc fc fc fc fc fc fc fc fc fc fc fc
[ 93.728348][ T5318] ffff888036125b00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 93.731802][ T5318] ==================================================================
[ 93.780383][ T5318] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 93.783143][ T5318] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 93.786651][ T5318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 93.790498][ T5318] Call Trace:
[ 93.791899][ T5318]
[ 93.792997][ T5318] vpanic+0x56c/0xa60
[ 93.794594][ T5318] ? __pfx_vpanic+0x10/0x10
[ 93.796425][ T5318] ? __pfx___schedule+0x10/0x10
[ 93.798342][ T5318] panic+0xc5/0xd0
[ 93.799725][ T5318] ? __pfx_panic+0x10/0x10
[ 93.801554][ T5318] ? preempt_schedule_common+0x82/0xd0
[ 93.803611][ T5318] check_panic_on_warn+0x89/0xb0
[ 93.805623][ T5318] end_report+0x73/0x170
[ 93.807435][ T5318] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.809758][ T5318] kasan_report_invalid_free+0xfa/0x110
[ 93.811966][ T5318] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.814281][ T5318] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.816595][ T5318] __kasan_slab_pre_free+0x104/0x120
[ 93.818783][ T5318] kfree+0x173/0x640
[ 93.820438][ T5318] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.822827][ T5318] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 93.825266][ T5318] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 93.827717][ T5318] ? down_read+0x2be/0x330
[ 93.829431][ T5318] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 93.831802][ T5318] configfs_write_iter+0x337/0x430
[ 93.833891][ T5318] vfs_write+0x612/0xba0
[ 93.835641][ T5318] ? __pfx_vfs_write+0x10/0x10
[ 93.837666][ T5318] ? __fget_files+0x2a/0x420
[ 93.839655][ T5318] ksys_write+0x150/0x270
[ 93.841557][ T5318] ? __pfx_ksys_write+0x10/0x10
[ 93.843570][ T5318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.845934][ T5318] do_syscall_64+0x174/0x580
[ 93.847745][ T5318] ? trace_irq_disable+0x3b/0x140
[ 93.849659][ T5318] ? clear_bhb_loop+0x70/0xc0
[ 93.851508][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.853846][ T5318] RIP: 0033:0x7f1c75f9e0d9
[ 93.855722][ T5318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 93.863914][ T5318] RSP: 002b:00007f1c76dbefe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 93.867384][ T5318] RAX: ffffffffffffffda RBX: 00007f1c76225fa0 RCX: 00007f1c75f9e0d9
[ 93.870609][ T5318] RDX: 000000000000009c RSI: 0000200000000000 RDI: 0000000000000003
[ 93.873588][ T5318] RBP: 00007f1c76035024 R08: 0000000000000000 R09: 0000000000000000
[ 93.876387][ T5318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 93.879305][ T5318] R13: 00007f1c76226038 R14: 00007f1c76225fa0 R15: 00007ffeb7975458
[ 93.882324][ T5318]
[ 93.884040][ T5318] Kernel Offset: disabled
[ 93.885845][ T5318] Rebooting in 86400 seconds..