program:
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write$FUSE_DIRENT(r0, &(0x7f00000024c0)={0x10}, 0x10)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x19)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17)
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
write(r0, &(0x7f0000000280)="a90db3636c2b305f4e4ad25e641cefef152d68e1bb7c9af85f6cdc687361c44507a78ff5e8d87d8c27da344b984a26eef5247e9ac1a676e027a50a1d63eea96219a2145ec290e9a07123a5631e304e05e92dc6d132800d65d84e30aa380ed4051eec0fafb7f09eadc5561f97ed8882680b5e5492a203f6fa20d33a8d014e30212daf5b4262d3903943dce1c8cfeca849cab4d846b6ccaf57980a6f232c5a37fb88bb967580e425188ed0", 0xaa)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000000)=0x6)
ioctl$TIOCL_SETSEL(r1, 0x541c, &(0x7f00000000c0)={0x2, {0x2, 0x0, 0x300, 0x1, 0x101, 0x300}})
mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000000)=0x9, 0x8, 0x3)
[ 93.471423][ T5289] Bluetooth: hci0: command tx timeout
[ 93.489528][ T10] cfg80211: failed to load regulatory.db
[ 93.754456][ T24] audit: type=1800 audit(1785581603.823:2): pid=5331 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="p_srate" dev="configfs" ino=4258 res=0 errno=0
[ 93.764600][ T5331] ==================================================================
[ 93.768000][ T5331] BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x225/0x2b0
[ 93.771378][ T5331] Free of addr ffff888043313b9d by task syz.0.0/5331
[ 93.774017][ T5331]
[ 93.775070][ T5331] CPU: 0 UID: 0 PID: 5331 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 93.775084][ T5331] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 93.775091][ T5331] Call Trace:
[ 93.775099][ T5331]
[ 93.775105][ T5331] dump_stack_lvl+0xe8/0x150
[ 93.775124][ T5331] print_address_description+0x55/0x1e0
[ 93.775141][ T5331] print_report+0x58/0x70
[ 93.775153][ T5331] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 93.775166][ T5331] kasan_report_invalid_free+0xea/0x110
[ 93.775180][ T5331] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 93.775193][ T5331] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 93.775204][ T5331] __kasan_slab_pre_free+0x104/0x120
[ 93.775217][ T5331] kfree+0x173/0x640
[ 93.775226][ T5331] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 93.775238][ T5331] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 93.775252][ T5331] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 93.775267][ T5331] ? down_read+0x2be/0x330
[ 93.775281][ T5331] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 93.775294][ T5331] configfs_write_iter+0x337/0x430
[ 93.775309][ T5331] vfs_write+0x612/0xba0
[ 93.775325][ T5331] ? __pfx_vfs_write+0x10/0x10
[ 93.775339][ T5331] ? __fget_files+0x2a/0x420
[ 93.775352][ T5331] ksys_write+0x150/0x270
[ 93.775366][ T5331] ? __pfx_ksys_write+0x10/0x10
[ 93.775382][ T5331] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.775392][ T5331] do_syscall_64+0x174/0x580
[ 93.775404][ T5331] ? trace_irq_disable+0x3b/0x140
[ 93.775417][ T5331] ? clear_bhb_loop+0x40/0x90
[ 93.775428][ T5331] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.775438][ T5331] RIP: 0033:0x7fdb7199e019
[ 93.775448][ T5331] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 93.775457][ T5331] RSP: 002b:00007fdb7278cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 93.775470][ T5331] RAX: ffffffffffffffda RBX: 00007fdb71c26090 RCX: 00007fdb7199e019
[ 93.775478][ T5331] RDX: 00000000000000aa RSI: 0000200000000280 RDI: 0000000000000003
[ 93.775485][ T5331] RBP: 00007fdb71a3500c R08: 0000000000000000 R09: 0000000000000000
[ 93.775491][ T5331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 93.775497][ T5331] R13: 00007fdb71c26128 R14: 00007fdb71c26090 R15: 00007ffc3b5b4808
[ 93.775510][ T5331]
[ 93.775513][ T5331]
[ 93.872972][ T5331] Allocated by task 5331:
[ 93.874741][ T5331] kasan_save_track+0x3e/0x80
[ 93.876637][ T5331] __kasan_kmalloc+0x93/0xb0
[ 93.878525][ T5331] __kmalloc_node_track_caller_noprof+0x4c3/0x730
[ 93.881113][ T5331] kstrdup+0x42/0x100
[ 93.882770][ T5331] f_uac2_opts_p_srate_store+0x11f/0x2b0
[ 93.885115][ T5331] configfs_write_iter+0x337/0x430
[ 93.887288][ T5331] vfs_write+0x612/0xba0
[ 93.889108][ T5331] ksys_write+0x150/0x270
[ 93.890947][ T5331] do_syscall_64+0x174/0x580
[ 93.892841][ T5331] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.895198][ T5331]
[ 93.896177][ T5331] The buggy address belongs to the object at ffff888043313b00
[ 93.896177][ T5331] which belongs to the cache kmalloc-192 of size 192
[ 93.901847][ T5331] The buggy address is located 157 bytes inside of
[ 93.901847][ T5331] 171-byte region [ffff888043313b00, ffff888043313bab)
[ 93.907199][ T5331]
[ 93.908181][ T5331] The buggy address belongs to the physical page:
[ 93.910760][ T5331] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x43313
[ 93.914247][ T5331] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 93.917153][ T5331] page_type: f5(slab)
[ 93.918849][ T5331] raw: 04fff00000000000 ffff88801b0413c0 dead000000000100 dead000000000122
[ 93.923112][ T5331] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
[ 93.927444][ T5331] page dumped because: kasan: bad access detected
[ 93.929923][ T5331] page_owner tracks the page as allocated
[ 93.932768][ T5331] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5288, tgid 5288 (syz-executor), ts 91259013417, free_ts 91222218207
[ 93.941543][ T5331] post_alloc_hook+0x1f9/0x250
[ 93.944047][ T5331] get_page_from_freelist+0x21fa/0x2270
[ 93.947011][ T5331] __alloc_frozen_pages_noprof+0x18d/0x380
[ 93.949425][ T5331] allocate_slab+0x79/0x5e0
[ 93.951431][ T5331] refill_objects+0x2d5/0x350
[ 93.953423][ T5331] __pcs_replace_empty_main+0x2bf/0x6b0
[ 93.955720][ T5331] __kmalloc_cache_noprof+0x3a7/0x660
[ 93.957905][ T5331] netdevice_event+0x3aa/0x8a0
[ 93.959969][ T5331] notifier_call_chain+0x1a5/0x3d0
[ 93.962132][ T5331] netif_set_mac_address+0x393/0x4d0
[ 93.964394][ T5331] do_setlink+0x9ad/0x4670
[ 93.966301][ T5331] rtnl_newlink+0x15c2/0x1bd0
[ 93.968353][ T5331] rtnetlink_rcv_msg+0x802/0xc00
[ 93.970411][ T5331] netlink_rcv_skb+0x226/0x4a0
[ 93.972475][ T5331] netlink_unicast+0x7bb/0x940
[ 93.974485][ T5331] netlink_sendmsg+0x813/0xb40
[ 93.976456][ T5331] page last free pid 69 tgid 69 stack trace:
[ 93.978891][ T5331] __free_frozen_pages+0xc1e/0xd10
[ 93.980877][ T5331] rcu_core+0x78b/0x10a0
[ 93.982582][ T5331] handle_softirqs+0x225/0x840
[ 93.984598][ T5331] do_softirq+0x76/0xd0
[ 93.986394][ T5331] __local_bh_enable_ip+0xf8/0x130
[ 93.988722][ T5331] scomp_acomp_comp_decomp+0x79c/0xab0
[ 93.991078][ T5331] crypto_acomp_compress+0x4c7/0xbd0
[ 93.993221][ T5331] zswap_store+0xe3a/0x2050
[ 93.995143][ T5331] swap_writeout+0x96a/0x14d0
[ 93.997123][ T5331] shrink_folio_list+0x35bd/0x5330
[ 93.999245][ T5331] evict_folios+0x3821/0x49e0
[ 94.001180][ T5331] try_to_shrink_lruvec+0xb4f/0xed0
[ 94.003381][ T5331] shrink_one+0x233/0x730
[ 94.005273][ T5331] shrink_node+0x3303/0x3b60
[ 94.007269][ T5331] kswapd+0x17b6/0x31c0
[ 94.009130][ T5331] kthread+0x388/0x470
[ 94.010951][ T5331]
[ 94.012010][ T5331] Memory state around the buggy address:
[ 94.014374][ T5331] ffff888043313a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.017793][ T5331] ffff888043313b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 94.021283][ T5331] >ffff888043313b80: 00 00 00 00 00 03 fc fc fc fc fc fc fc fc fc fc
[ 94.024538][ T5331] ^
[ 94.026525][ T5331] ffff888043313c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 94.029728][ T5331] ffff888043313c80: 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.033035][ T5331] ==================================================================
[ 94.156658][ T5331] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 94.159865][ T5331] CPU: 0 UID: 0 PID: 5331 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.163526][ T5331] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.167946][ T5331] Call Trace:
[ 94.169350][ T5331]
[ 94.170630][ T5331] vpanic+0x56c/0xa60
[ 94.172352][ T5331] ? __pfx_vpanic+0x10/0x10
[ 94.174295][ T5331] ? __pfx___schedule+0x10/0x10
[ 94.176347][ T5331] panic+0xc5/0xd0
[ 94.177865][ T5331] ? __pfx_panic+0x10/0x10
[ 94.179761][ T5331] ? preempt_schedule_common+0x82/0xd0
[ 94.182110][ T5331] check_panic_on_warn+0x89/0xb0
[ 94.184227][ T5331] end_report+0x73/0x170
[ 94.185726][ T5331] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.188044][ T5331] kasan_report_invalid_free+0xfa/0x110
[ 94.190257][ T5331] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.192601][ T5331] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.194928][ T5331] __kasan_slab_pre_free+0x104/0x120
[ 94.197147][ T5331] kfree+0x173/0x640
[ 94.198839][ T5331] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.201230][ T5331] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.203565][ T5331] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 94.206143][ T5331] ? down_read+0x2be/0x330
[ 94.207983][ T5331] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 94.210487][ T5331] configfs_write_iter+0x337/0x430
[ 94.212656][ T5331] vfs_write+0x612/0xba0
[ 94.214373][ T5331] ? __pfx_vfs_write+0x10/0x10
[ 94.216265][ T5331] ? __fget_files+0x2a/0x420
[ 94.218205][ T5331] ksys_write+0x150/0x270
[ 94.220232][ T5331] ? __pfx_ksys_write+0x10/0x10
[ 94.222944][ T5331] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.225885][ T5331] do_syscall_64+0x174/0x580
[ 94.227841][ T5331] ? trace_irq_disable+0x3b/0x140
[ 94.229888][ T5331] ? clear_bhb_loop+0x40/0x90
[ 94.232049][ T5331] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.234697][ T5331] RIP: 0033:0x7fdb7199e019
[ 94.236630][ T5331] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.244729][ T5331] RSP: 002b:00007fdb7278cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 94.248392][ T5331] RAX: ffffffffffffffda RBX: 00007fdb71c26090 RCX: 00007fdb7199e019
[ 94.251709][ T5331] RDX: 00000000000000aa RSI: 0000200000000280 RDI: 0000000000000003
[ 94.255136][ T5331] RBP: 00007fdb71a3500c R08: 0000000000000000 R09: 0000000000000000
[ 94.258652][ T5331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.262074][ T5331] R13: 00007fdb71c26128 R14: 00007fdb71c26090 R15: 00007ffc3b5b4808
[ 94.265585][ T5331]
[ 94.267501][ T5331] Kernel Offset: disabled
[ 94.269456][ T5331] Rebooting in 86400 seconds..