program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000440)='44100,4', 0x7)
r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
pwritev(r1, &(0x7f0000000940)=[{&(0x7f0000000280)="b68f5ba3fbcbc4666786bf6d01e1934147db331cca8b73b155b137482745ca544361c02ded58f5162cb1560a45dbed75fe75c4a4489c1c2a64a36d8ccf7c7f62153e7c6bab6702f61e1e675a8edd742f0a84c40513368deaa7cdef80eae44029955c55a7492b70c153d2b0c92af1d9f2ea36e38866f951c7c70c672b4a23d778ce90c184da12bc8bd91d58c45ec5219db79f862035349edad356e3f9788dfd3648572beea3cb1a029e7ea2158788e5b47d65da84f0d3b755e0c8038d1332fefed63e090f9ab1ff", 0xc7}, {&(0x7f0000000480)="9c1d38913ead6dfc5b6331b1ad9fedf5ba82a78e220068e25acb0b74d06cad3e5f5e21984376fc3be4965940ce3f7b63578041d9dca56d57589e931264a48e5c7a66f5350b7600dedd3af3bc4c51b0cff5f08d9ccc67313ee7b2bcc87767384ea7c9cc8f758caeada381423583af7439ddaa7e41c2ce035169627deb953f12757bb86a1c40068bb44114a12d947c526d3dfeb3cdbcc14d962785aaa4672716195b2f71d713b197f692bf1bef1cac1088315296729cf32921610b3946bb7aa9b5e90f38b43a7f4b7f6dc8467faf4aa318a2e19806", 0xd4}, {&(0x7f0000000580)="af274f39f8d02d956d6b1973c5cb9cc1713629d8ac31be735146c51ed2c94d85dec400c34f89518cbdc3e3f2b35d68f921ff9e870aaa1bb6af64c8262b0e82069d502d585e945dd60079fb0a65e31ea148cf3d255162f625c91c1b94a2ab6a7d44b2dcabc89a619806cbedee338659ea7ac63e09c7b2f8239d4eb11295cf4eceb071b2e9786b2aee4c06a0ea64fca81db2c47d6ff02c96bfa4ade5380f518d155a0399846284ea08f43dd29aaaffec0baa62c6b0c48454b8bd44815f2de4f795e6573de06693fc0212da", 0xca}, {&(0x7f0000000680)="0f039c81b2f1111d55bcd94d6283743b2c5612582380181006495e6792772d84e89b69edc6aaa856711f1e1742b88bb71750bec7eb18304875ce680b7330bf0d3575838eb43a85", 0x47}, {&(0x7f0000000700)="fb85ed55feb4ef60f817188054486d8490241b71b7f7c5b48468672afa1517515df4e80d07ca2c2cf8baa6d9b1439683390f74c28d48c8c5228cbd8662f73867b4baf9f189089b2b76cc3772083f530075c8dea3a3795628cf57c8a2b0621e7a2a9c93de20ed315c98f48960ef081910ccc0bb87425042", 0x77}, {&(0x7f0000000780)="14a36496185920a8cfae2f0c64648a787ecff23f5cd9d51f02cf7e7b864ec9faf05dd953a2004d5f74", 0x29}, {&(0x7f00000007c0)="506c436449f5d9146813b0322439b76aa3e4d672214bf92db744cbf80367dcacae404284336eba88858e0b81172e12eac8da04b5d965b69cbf7a823b1110b8f053ebecd35044963d9583959acfadd4ccbea204ffdc8c46c4c5c73ba60926fe7cce830caa145edeeceff99156b45e2c116686578bd634", 0x76}, {&(0x7f0000000840)="7e0dc276b2e354ebefd6e574a071b590c006470321c2414977ac6682ec59608d399cdbf00cc8f947927449dcf77e3325ced41fd46db654a55d9cadf60f1f3afec752bc8dfc766cc6db0793588cf239b3ab38ee8086927e562a7e9793116a9a24d0c03088e1b250d349da9b576c01f8f4ef5999a3da13122b06ad59b6a420543681a2f23a967129e603927bd69b2673b53a06194d63b232d03be60aa352bd8b0d8cb1fee336ce87b8719548250ac46557a590d299edcbd855ccf30602a25fe61f4532b9674f3e6477dd34074f5ec83b87c86ec00eacbbb8dc5f964e9901081b924d41d91c2edab9c453895b3cbcf3d9c1c7d915e5e9", 0xf5}], 0x8, 0x4, 0xf)
[ 94.316086][ T5313] ==================================================================
[ 94.319212][ T5313] BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.322506][ T5313] Free of addr ffff888042facc29 by task syz.0.0/5313
[ 94.325245][ T5313]
[ 94.326297][ T5313] CPU: 0 UID: 0 PID: 5313 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.326319][ T5313] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.326326][ T5313] Call Trace:
[ 94.326333][ T5313]
[ 94.326338][ T5313] dump_stack_lvl+0xe8/0x150
[ 94.326359][ T5313] print_address_description+0x55/0x1e0
[ 94.326375][ T5313] print_report+0x58/0x70
[ 94.326389][ T5313] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.326401][ T5313] kasan_report_invalid_free+0xea/0x110
[ 94.326415][ T5313] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.326429][ T5313] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.326441][ T5313] __kasan_slab_pre_free+0x104/0x120
[ 94.326454][ T5313] kfree+0x173/0x640
[ 94.326463][ T5313] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.326476][ T5313] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.326489][ T5313] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 94.326502][ T5313] ? down_read+0x2be/0x330
[ 94.326516][ T5313] ? __pfx___futex_wait+0x10/0x10
[ 94.326531][ T5313] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 94.326545][ T5313] configfs_write_iter+0x337/0x430
[ 94.326557][ T5313] do_iter_readv_writev+0x612/0x8c0
[ 94.326569][ T5313] ? __pfx_do_iter_readv_writev+0x10/0x10
[ 94.326582][ T5313] vfs_writev+0x343/0x990
[ 94.326596][ T5313] ? __pfx_vfs_writev+0x10/0x10
[ 94.326612][ T5313] ? __fget_files+0x2a/0x420
[ 94.326627][ T5313] ? __fget_files+0x3a2/0x420
[ 94.326640][ T5313] ? __fget_files+0x2a/0x420
[ 94.326655][ T5313] __x64_sys_pwritev+0x19c/0x2b0
[ 94.326667][ T5313] ? __pfx___x64_sys_pwritev+0x10/0x10
[ 94.326681][ T5313] do_syscall_64+0x166/0x520
[ 94.326693][ T5313] ? trace_irq_disable+0x3b/0x140
[ 94.326705][ T5313] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.326716][ T5313] ? clear_bhb_loop+0x70/0xc0
[ 94.326728][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.326739][ T5313] RIP: 0033:0x7f107ed9e0d9
[ 94.326750][ T5313] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.326759][ T5313] RSP: 002b:00007f107fc1afe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000128
[ 94.326772][ T5313] RAX: ffffffffffffffda RBX: 00007f107f025fa0 RCX: 00007f107ed9e0d9
[ 94.326779][ T5313] RDX: 0000000000000008 RSI: 0000200000000940 RDI: 0000000000000004
[ 94.326786][ T5313] RBP: 00007f107ee35024 R08: 000000000000000f R09: 0000000000000000
[ 94.326793][ T5313] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000000
[ 94.326800][ T5313] R13: 00007f107f026038 R14: 00007f107f025fa0 R15: 00007fffc7329e28
[ 94.326812][ T5313]
[ 94.326816][ T5313]
[ 94.430553][ T5313] Allocated by task 5313:
[ 94.432356][ T5313] kasan_save_track+0x3e/0x80
[ 94.434321][ T5313] __kasan_kmalloc+0x93/0xb0
[ 94.436181][ T5313] __kmalloc_node_track_caller_noprof+0x4c7/0x740
[ 94.438689][ T5313] kstrdup+0x42/0x100
[ 94.440262][ T5313] f_uac2_opts_p_srate_store+0x11f/0x2b0
[ 94.442466][ T5313] configfs_write_iter+0x337/0x430
[ 94.444499][ T5313] do_iter_readv_writev+0x612/0x8c0
[ 94.446569][ T5313] vfs_writev+0x343/0x990
[ 94.448358][ T5313] __x64_sys_pwritev+0x19c/0x2b0
[ 94.450450][ T5313] do_syscall_64+0x166/0x520
[ 94.452354][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.454737][ T5313]
[ 94.456538][ T5313] The buggy address belongs to the object at ffff888042facc00
[ 94.456538][ T5313] which belongs to the cache kmalloc-256 of size 256
[ 94.462174][ T5313] The buggy address is located 41 bytes inside of
[ 94.462174][ T5313] 221-byte region [ffff888042facc00, ffff888042faccdd)
[ 94.467090][ T5313]
[ 94.468035][ T5313] The buggy address belongs to the physical page:
[ 94.470466][ T5313] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x42fac
[ 94.473654][ T5313] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 94.476354][ T5313] page_type: f5(slab)
[ 94.477810][ T5313] raw: 04fff00000000000 ffff88801b041b40 dead000000000122 0000000000000000
[ 94.480905][ T5313] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[ 94.484204][ T5313] page dumped because: kasan: bad access detected
[ 94.486585][ T5313] page_owner tracks the page as allocated
[ 94.488735][ T5313] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5272, tgid 5272 (syz-executor), ts 92330446659
[ 94.496342][ T5313] post_alloc_hook+0x1f9/0x250
[ 94.498366][ T5313] get_page_from_freelist+0x2209/0x2280
[ 94.500558][ T5313] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 94.503160][ T5313] allocate_slab+0x7c/0x5e0
[ 94.505105][ T5313] refill_objects+0x2d5/0x350
[ 94.507058][ T5313] __pcs_replace_empty_main+0x2c3/0x6b0
[ 94.509442][ T5313] __kmalloc_flags_noprof+0x5c2/0x810
[ 94.511716][ T5313] alloc_slab_obj_exts+0x4d/0x170
[ 94.513837][ T5313] __memcg_slab_post_alloc_hook+0x5d4/0xf10
[ 94.516356][ T5313] __kvmalloc_node_noprof+0x620/0x870
[ 94.518675][ T5313] nf_hook_entries_grow+0x287/0x740
[ 94.520883][ T5313] nf_hook_entries_insert_raw+0x4b/0x320
[ 94.523200][ T5313] nf_nat_register_fn+0x1e3/0x580
[ 94.525216][ T5313] iptable_nat_table_init+0x1a9/0x300
[ 94.527263][ T5313] xt_find_table_lock+0x311/0x400
[ 94.529332][ T5313] xt_request_find_table_lock+0x26/0x100
[ 94.531653][ T5313] page last free pid 5272 tgid 5272 ts 92329889524 stack trace:
[ 94.534622][ T5313] __free_frozen_pages+0xc93/0xd90
[ 94.536708][ T5313] __kasan_populate_vmalloc+0x12d/0x1c0
[ 94.538896][ T5313] alloc_vmap_area+0xd1a/0x1420
[ 94.540778][ T5313] __get_vm_area_node+0x200/0x2f0
[ 94.542888][ T5313] __vmalloc_node_range_noprof+0x34e/0x1560
[ 94.545398][ T5313] vzalloc_noprof+0xb2/0xe0
[ 94.547274][ T5313] alloc_counters+0x63/0x5c0
[ 94.549135][ T5313] do_ipt_get_ctl+0xb3c/0x1300
[ 94.551060][ T5313] nf_getsockopt+0x26e/0x290
[ 94.552920][ T5313] ip_getsockopt+0x19e/0x230
[ 94.554799][ T5313] do_sock_getsockopt+0x569/0xa70
[ 94.556787][ T5313] __x64_sys_getsockopt+0x1a4/0x240
[ 94.558545][ T5313] do_syscall_64+0x166/0x520
[ 94.560067][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.562096][ T5313]
[ 94.562895][ T5313] Memory state around the buggy address:
[ 94.564626][ T5313] ffff888042facb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.568388][ T5313] ffff888042facb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.570860][ T5313] >ffff888042facc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 94.573441][ T5313] ^
[ 94.575289][ T5313] ffff888042facc80: 00 00 00 00 00 00 00 00 00 00 00 05 fc fc fc fc
[ 94.578010][ T5313] ffff888042facd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.581340][ T5313] ==================================================================
[ 94.597774][ T25] audit: type=1800 audit(1787333059.006:2): pid=5313 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="p_srate" dev="configfs" ino=4268 res=0 errno=0
[ 94.612940][ T5273] Bluetooth: hci0: command tx timeout
[ 94.628663][ T5313] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 94.631734][ T5313] CPU: 0 UID: 0 PID: 5313 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.635319][ T5313] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.639336][ T5313] Call Trace:
[ 94.640750][ T5313]
[ 94.642075][ T5313] vpanic+0x56d/0xa60
[ 94.643747][ T5313] ? __pfx_vpanic+0x10/0x10
[ 94.645675][ T5313] ? __pfx___schedule+0x10/0x10
[ 94.647705][ T5313] panic+0xc5/0xd0
[ 94.649298][ T5313] ? __pfx_panic+0x10/0x10
[ 94.651222][ T5313] ? preempt_schedule_common+0x7f/0xd0
[ 94.653206][ T5313] check_panic_on_warn+0x89/0xb0
[ 94.655142][ T5313] end_report+0x73/0x170
[ 94.656691][ T5313] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.658879][ T5313] kasan_report_invalid_free+0xfa/0x110
[ 94.660946][ T5313] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.663370][ T5313] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.665963][ T5313] __kasan_slab_pre_free+0x104/0x120
[ 94.668255][ T5313] kfree+0x173/0x640
[ 94.669695][ T5313] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.671730][ T5313] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.674080][ T5313] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 94.676665][ T5313] ? down_read+0x2be/0x330
[ 94.678474][ T5313] ? __pfx___futex_wait+0x10/0x10
[ 94.680370][ T5313] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 94.682810][ T5313] configfs_write_iter+0x337/0x430
[ 94.684842][ T5313] do_iter_readv_writev+0x612/0x8c0
[ 94.686895][ T5313] ? __pfx_do_iter_readv_writev+0x10/0x10
[ 94.689088][ T5313] vfs_writev+0x343/0x990
[ 94.690856][ T5313] ? __pfx_vfs_writev+0x10/0x10
[ 94.692861][ T5313] ? __fget_files+0x2a/0x420
[ 94.694874][ T5313] ? __fget_files+0x3a2/0x420
[ 94.696907][ T5313] ? __fget_files+0x2a/0x420
[ 94.698901][ T5313] __x64_sys_pwritev+0x19c/0x2b0
[ 94.700973][ T5313] ? __pfx___x64_sys_pwritev+0x10/0x10
[ 94.703256][ T5313] do_syscall_64+0x166/0x520
[ 94.705110][ T5313] ? trace_irq_disable+0x3b/0x140
[ 94.707089][ T5313] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.709423][ T5313] ? clear_bhb_loop+0x70/0xc0
[ 94.711222][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.713469][ T5313] RIP: 0033:0x7f107ed9e0d9
[ 94.715186][ T5313] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.722524][ T5313] RSP: 002b:00007f107fc1afe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000128
[ 94.725477][ T5313] RAX: ffffffffffffffda RBX: 00007f107f025fa0 RCX: 00007f107ed9e0d9
[ 94.728678][ T5313] RDX: 0000000000000008 RSI: 0000200000000940 RDI: 0000000000000004
[ 94.731899][ T5313] RBP: 00007f107ee35024 R08: 000000000000000f R09: 0000000000000000
[ 94.735066][ T5313] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000000
[ 94.738377][ T5313] R13: 00007f107f026038 R14: 00007f107f025fa0 R15: 00007fffc7329e28
[ 94.741831][ T5313]
[ 94.743586][ T5313] Kernel Offset: disabled
[ 94.745444][ T5313] Rebooting in 86400 seconds..