program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000400)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/functions/uac1_legacy.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
umount2(&(0x7f0000000040)='./config/usb_gadget/g1/functions/uac1_legacy.usb0\x00', 0x8)
symlinkat(&(0x7f0000000200)='./config/usb_gadget/g1/functions/uac1_legacy.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1/uac1_legacy.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0\n\x00', 0xc)
nanosleep(&(0x7f0000000500)={0x0, 0x2faf080}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000400)='configfs\x00', 0x0, 0x0) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/functions/uac1_legacy.usb0\x00', 0x1ff) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) (async)
umount2(&(0x7f0000000040)='./config/usb_gadget/g1/functions/uac1_legacy.usb0\x00', 0x8) (async)
symlinkat(&(0x7f0000000200)='./config/usb_gadget/g1/functions/uac1_legacy.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1/uac1_legacy.usb0\x00') (async)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) (async)
write(r0, &(0x7f0000000400)='dummy_udc.0\n\x00', 0xc) (async)
nanosleep(&(0x7f0000000500)={0x0, 0x2faf080}, 0x0) (async)
[ 94.232992][ T5286] Bluetooth: hci0: command tx timeout
[ 94.392552][ T5323] configfs-gadget.g1 gadget.0: Hardware params: access 3, format 2, channels 2, rate 48000
[ 94.399672][ T5323] udc dummy_udc.0: failed to start g1: -19
[ 94.408311][ T5323] UDC core: g1: couldn't find an available UDC or it's busy
[ 94.469265][ T5323] ==================================================================
[ 94.472488][ T5323] BUG: KASAN: slab-use-after-free in filp_flush+0x31/0x190
[ 94.475153][ T5323] Read of size 8 at addr ffff888034674698 by task syz.0.0/5323
[ 94.478204][ T5323]
[ 94.479151][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.479162][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.479167][ T5323] Call Trace:
[ 94.479172][ T5323]
[ 94.479176][ T5323] dump_stack_lvl+0xe8/0x150
[ 94.479190][ T5323] print_address_description+0x55/0x1e0
[ 94.479201][ T5323] ? filp_flush+0x31/0x190
[ 94.479209][ T5323] print_report+0x58/0x70
[ 94.479218][ T5323] kasan_report+0x117/0x150
[ 94.479227][ T5323] ? filp_flush+0x31/0x190
[ 94.479236][ T5323] kasan_check_range+0x264/0x2c0
[ 94.479248][ T5323] filp_flush+0x31/0x190
[ 94.479261][ T5323] filp_close+0x1d/0x40
[ 94.479274][ T5323] gaudio_cleanup+0x54/0xf0
[ 94.479329][ T5323] f_audio_bind+0x4a0/0x630
[ 94.479340][ T5323] ? __pfx_f_audio_bind+0x10/0x10
[ 94.479352][ T5323] ? rcu_is_watching+0x15/0xb0
[ 94.479364][ T5323] ? usb_gadget_set_selfpowered+0xf5/0x260
[ 94.479376][ T5323] usb_add_function+0x2e1/0x9f0
[ 94.479391][ T5323] ? check_remote_wakeup_config+0x58/0x1c0
[ 94.479408][ T5323] configfs_composite_bind+0xde0/0x1410
[ 94.479427][ T5323] ? __pfx_configfs_composite_bind+0x10/0x10
[ 94.479443][ T5323] gadget_bind_driver+0x2ca/0x9e0
[ 94.479458][ T5323] ? __pfx_gadget_bind_driver+0x10/0x10
[ 94.479471][ T5323] really_probe+0x254/0xae0
[ 94.479524][ T5323] __driver_probe_device+0x1e8/0x360
[ 94.479537][ T5323] driver_probe_device+0x4f/0x240
[ 94.479550][ T5323] __driver_attach+0x339/0x600
[ 94.479562][ T5323] bus_for_each_dev+0x23b/0x2c0
[ 94.479577][ T5323] ? __pfx___driver_attach+0x10/0x10
[ 94.479588][ T5323] ? __pfx_bus_for_each_dev+0x10/0x10
[ 94.479604][ T5323] ? do_raw_spin_unlock+0x4d/0x210
[ 94.479618][ T5323] bus_add_driver+0x345/0x670
[ 94.479633][ T5323] driver_register+0x23a/0x320
[ 94.479647][ T5323] usb_gadget_register_driver_owner+0xf9/0x270
[ 94.479661][ T5323] gadget_dev_desc_UDC_store+0x1c9/0x2f0
[ 94.479675][ T5323] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10
[ 94.479688][ T5323] configfs_write_iter+0x337/0x430
[ 94.479703][ T5323] vfs_write+0x612/0xba0
[ 94.479720][ T5323] ? __pfx_vfs_write+0x10/0x10
[ 94.479737][ T5323] ? __fget_files+0x2a/0x420
[ 94.479752][ T5323] ksys_write+0x150/0x270
[ 94.479767][ T5323] ? __pfx_ksys_write+0x10/0x10
[ 94.479782][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.479794][ T5323] do_syscall_64+0x174/0x580
[ 94.479808][ T5323] ? trace_irq_disable+0x3b/0x140
[ 94.479821][ T5323] ? clear_bhb_loop+0x40/0x90
[ 94.479834][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.479845][ T5323] RIP: 0033:0x7f510699e019
[ 94.479858][ T5323] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.479867][ T5323] RSP: 002b:00007f5107820fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 94.479879][ T5323] RAX: ffffffffffffffda RBX: 00007f5106c25fa0 RCX: 00007f510699e019
[ 94.479887][ T5323] RDX: 000000000000000c RSI: 0000200000000400 RDI: 0000000000000003
[ 94.479894][ T5323] RBP: 00007f5106a3500c R08: 0000000000000000 R09: 0000000000000000
[ 94.479901][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.479907][ T5323] R13: 00007f5106c26038 R14: 00007f5106c25fa0 R15: 00007ffd9b243a28
[ 94.479919][ T5323]
[ 94.479923][ T5323]
[ 94.612368][ T5323] Allocated by task 5323:
[ 94.614265][ T5323] kasan_save_track+0x3e/0x80
[ 94.616246][ T5323] __kasan_slab_alloc+0x6c/0x80
[ 94.618315][ T5323] kmem_cache_alloc_noprof+0x2a0/0x5f0
[ 94.620587][ T5323] alloc_empty_file+0x5b/0x1d0
[ 94.622542][ T5323] path_openat+0x8f/0x3830
[ 94.624374][ T5323] do_file_open+0x23e/0x4a0
[ 94.626233][ T5323] filp_open+0x16d/0x1d0
[ 94.628038][ T5323] gaudio_setup+0x11b/0xf10
[ 94.629964][ T5323] f_audio_bind+0x137/0x630
[ 94.632001][ T5323] usb_add_function+0x2e1/0x9f0
[ 94.634674][ T5323] configfs_composite_bind+0xde0/0x1410
[ 94.637513][ T5323] gadget_bind_driver+0x2ca/0x9e0
[ 94.639578][ T5323] really_probe+0x254/0xae0
[ 94.641462][ T5323] __driver_probe_device+0x1e8/0x360
[ 94.643702][ T5323] driver_probe_device+0x4f/0x240
[ 94.645791][ T5323] __driver_attach+0x339/0x600
[ 94.647848][ T5323] bus_for_each_dev+0x23b/0x2c0
[ 94.649860][ T5323] bus_add_driver+0x345/0x670
[ 94.651687][ T5323] driver_register+0x23a/0x320
[ 94.653619][ T5323] usb_gadget_register_driver_owner+0xf9/0x270
[ 94.656321][ T5323] gadget_dev_desc_UDC_store+0x1c9/0x2f0
[ 94.658798][ T5323] configfs_write_iter+0x337/0x430
[ 94.660820][ T5323] vfs_write+0x612/0xba0
[ 94.662454][ T5323] ksys_write+0x150/0x270
[ 94.664162][ T5323] do_syscall_64+0x174/0x580
[ 94.666152][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.668627][ T5323]
[ 94.669699][ T5323] Freed by task 0:
[ 94.671256][ T5323] kasan_save_track+0x3e/0x80
[ 94.673185][ T5323] kasan_save_free_info+0x40/0x50
[ 94.675942][ T5323] __kasan_slab_free+0x5c/0x80
[ 94.678455][ T5323] slab_free_after_rcu_debug+0x12a/0x220
[ 94.680798][ T5323] rcu_core+0x78b/0x10a0
[ 94.682535][ T5323] handle_softirqs+0x225/0x840
[ 94.684471][ T5323] __irq_exit_rcu+0xca/0x220
[ 94.686250][ T5323] irq_exit_rcu+0x9/0x30
[ 94.688099][ T5323] sysvec_apic_timer_interrupt+0xa6/0xc0
[ 94.690420][ T5323] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 94.692892][ T5323]
[ 94.693804][ T5323] Last potentially related work creation:
[ 94.696057][ T5323] kasan_save_stack+0x3e/0x60
[ 94.698130][ T5323] kasan_record_aux_stack+0xbd/0xd0
[ 94.700325][ T5323] kmem_cache_free+0x44f/0x650
[ 94.702399][ T5323] task_work_run+0x1d9/0x270
[ 94.704443][ T5323] exit_to_user_mode_loop+0x1fa/0x730
[ 94.706677][ T5323] do_syscall_64+0x353/0x580
[ 94.708621][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.711085][ T5323]
[ 94.712101][ T5323] Second to last potentially related work creation:
[ 94.714856][ T5323] kasan_save_stack+0x3e/0x60
[ 94.716796][ T5323] kasan_record_aux_stack+0xbd/0xd0
[ 94.719035][ T5323] task_work_add+0xae/0x420
[ 94.720948][ T5323] __fput_deferred+0x143/0x380
[ 94.722974][ T5323] fput_close+0x11f/0x240
[ 94.724748][ T5323] filp_close+0x27/0x40
[ 94.726544][ T5323] gaudio_cleanup+0x54/0xf0
[ 94.728462][ T5323] f_audio_bind+0x4a0/0x630
[ 94.730307][ T5323] usb_add_function+0x2e1/0x9f0
[ 94.733075][ T5323] configfs_composite_bind+0xde0/0x1410
[ 94.735356][ T5323] gadget_bind_driver+0x2ca/0x9e0
[ 94.737476][ T5323] really_probe+0x254/0xae0
[ 94.739406][ T5323] __driver_probe_device+0x1e8/0x360
[ 94.741694][ T5323] driver_probe_device+0x4f/0x240
[ 94.743911][ T5323] __driver_attach+0x339/0x600
[ 94.746008][ T5323] bus_for_each_dev+0x23b/0x2c0
[ 94.748126][ T5323] bus_add_driver+0x345/0x670
[ 94.750201][ T5323] driver_register+0x23a/0x320
[ 94.752268][ T5323] usb_gadget_register_driver_owner+0xf9/0x270
[ 94.754923][ T5323] gadget_dev_desc_UDC_store+0x1c9/0x2f0
[ 94.757360][ T5323] configfs_write_iter+0x337/0x430
[ 94.759563][ T5323] vfs_write+0x612/0xba0
[ 94.761209][ T5323] ksys_write+0x150/0x270
[ 94.763030][ T5323] do_syscall_64+0x174/0x580
[ 94.765037][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.767493][ T5323]
[ 94.768526][ T5323] The buggy address belongs to the object at ffff888034674540
[ 94.768526][ T5323] which belongs to the cache filp of size 352
[ 94.774179][ T5323] The buggy address is located 344 bytes inside of
[ 94.774179][ T5323] freed 352-byte region [ffff888034674540, ffff8880346746a0)
[ 94.780085][ T5323]
[ 94.781144][ T5323] The buggy address belongs to the physical page:
[ 94.783855][ T5323] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34674
[ 94.787525][ T5323] memcg:ffff888043dacf01
[ 94.789375][ T5323] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 94.792489][ T5323] page_type: f5(slab)
[ 94.794225][ T5323] raw: 04fff00000000000 ffff888030414500 dead000000000100 dead000000000122
[ 94.797902][ T5323] raw: 0000000000000000 0000000800090009 00000000f5000000 ffff888043dacf01
[ 94.801478][ T5323] page dumped because: kasan: bad access detected
[ 94.804276][ T5323] page_owner tracks the page as allocated
[ 94.806681][ T5323] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4703, tgid 4703 (udevd), ts 37333653627, free_ts 36665044654
[ 94.814891][ T5323] post_alloc_hook+0x1f9/0x250
[ 94.816992][ T5323] get_page_from_freelist+0x21fa/0x2270
[ 94.819410][ T5323] __alloc_frozen_pages_noprof+0x18d/0x380
[ 94.821883][ T5323] allocate_slab+0x79/0x5e0
[ 94.823807][ T5323] refill_objects+0x2d5/0x350
[ 94.825826][ T5323] __pcs_replace_empty_main+0x2bf/0x6b0
[ 94.828234][ T5323] kmem_cache_alloc_noprof+0x382/0x5f0
[ 94.830607][ T5323] alloc_empty_file+0x5b/0x1d0
[ 94.832770][ T5323] path_openat+0x8f/0x3830
[ 94.834668][ T5323] do_file_open+0x23e/0x4a0
[ 94.836524][ T5323] do_sys_openat2+0x115/0x200
[ 94.838450][ T5323] __x64_sys_openat+0x138/0x170
[ 94.840430][ T5323] do_syscall_64+0x174/0x580
[ 94.842333][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.844696][ T5323] page last free pid 4711 tgid 4711 stack trace:
[ 94.847244][ T5323] __free_frozen_pages+0xc1e/0xd10
[ 94.849345][ T5323] rcu_core+0x78b/0x10a0
[ 94.851276][ T5323] handle_softirqs+0x225/0x840
[ 94.853414][ T5323] __irq_exit_rcu+0xca/0x220
[ 94.855432][ T5323] irq_exit_rcu+0x9/0x30
[ 94.857268][ T5323] sysvec_apic_timer_interrupt+0xa6/0xc0
[ 94.859721][ T5323] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 94.862183][ T5323]
[ 94.863198][ T5323] Memory state around the buggy address:
[ 94.865471][ T5323] ffff888034674580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 94.868869][ T5323] ffff888034674600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 94.872195][ T5323] >ffff888034674680: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.875606][ T5323] ^
[ 94.877668][ T5323] ffff888034674700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 94.881026][ T5323] ffff888034674780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 94.884416][ T5323] ==================================================================
[ 94.928673][ T5323] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 94.931813][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.935665][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.939916][ T5323] Call Trace:
[ 94.941335][ T5323]
[ 94.942609][ T5323] vpanic+0x56c/0xa60
[ 94.944288][ T5323] ? __pfx_vpanic+0x10/0x10
[ 94.946152][ T5323] panic+0xc5/0xd0
[ 94.947765][ T5323] ? __pfx_panic+0x10/0x10
[ 94.949736][ T5323] ? preempt_schedule_thunk+0x16/0x40
[ 94.952078][ T5323] ? filp_flush+0x31/0x190
[ 94.953987][ T5323] ? preempt_schedule_thunk+0x16/0x40
[ 94.956202][ T5323] ? filp_flush+0x31/0x190
[ 94.958141][ T5323] check_panic_on_warn+0x89/0xb0
[ 94.960313][ T5323] ? filp_flush+0x31/0x190
[ 94.962171][ T5323] end_report+0x73/0x170
[ 94.963927][ T5323] ? filp_flush+0x31/0x190
[ 94.965852][ T5323] kasan_report+0x128/0x150
[ 94.967863][ T5323] ? filp_flush+0x31/0x190
[ 94.969803][ T5323] kasan_check_range+0x264/0x2c0
[ 94.971920][ T5323] filp_flush+0x31/0x190
[ 94.973758][ T5323] filp_close+0x1d/0x40
[ 94.975556][ T5323] gaudio_cleanup+0x54/0xf0
[ 94.977446][ T5323] f_audio_bind+0x4a0/0x630
[ 94.979361][ T5323] ? __pfx_f_audio_bind+0x10/0x10
[ 94.981471][ T5323] ? rcu_is_watching+0x15/0xb0
[ 94.983508][ T5323] ? usb_gadget_set_selfpowered+0xf5/0x260
[ 94.985968][ T5323] usb_add_function+0x2e1/0x9f0
[ 94.988062][ T5323] ? check_remote_wakeup_config+0x58/0x1c0
[ 94.990567][ T5323] configfs_composite_bind+0xde0/0x1410
[ 94.992832][ T5323] ? __pfx_configfs_composite_bind+0x10/0x10
[ 94.995352][ T5323] gadget_bind_driver+0x2ca/0x9e0
[ 94.997534][ T5323] ? __pfx_gadget_bind_driver+0x10/0x10
[ 94.999876][ T5323] really_probe+0x254/0xae0
[ 95.001794][ T5323] __driver_probe_device+0x1e8/0x360
[ 95.004027][ T5323] driver_probe_device+0x4f/0x240
[ 95.006074][ T5323] __driver_attach+0x339/0x600
[ 95.008122][ T5323] bus_for_each_dev+0x23b/0x2c0
[ 95.010237][ T5323] ? __pfx___driver_attach+0x10/0x10
[ 95.012441][ T5323] ? __pfx_bus_for_each_dev+0x10/0x10
[ 95.014760][ T5323] ? do_raw_spin_unlock+0x4d/0x210
[ 95.017054][ T5323] bus_add_driver+0x345/0x670
[ 95.019127][ T5323] driver_register+0x23a/0x320
[ 95.021149][ T5323] usb_gadget_register_driver_owner+0xf9/0x270
[ 95.023829][ T5323] gadget_dev_desc_UDC_store+0x1c9/0x2f0
[ 95.026216][ T5323] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10
[ 95.028861][ T5323] configfs_write_iter+0x337/0x430
[ 95.031080][ T5323] vfs_write+0x612/0xba0
[ 95.032887][ T5323] ? __pfx_vfs_write+0x10/0x10
[ 95.034949][ T5323] ? __fget_files+0x2a/0x420
[ 95.036947][ T5323] ksys_write+0x150/0x270
[ 95.038825][ T5323] ? __pfx_ksys_write+0x10/0x10
[ 95.040823][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.043400][ T5323] do_syscall_64+0x174/0x580
[ 95.045391][ T5323] ? trace_irq_disable+0x3b/0x140
[ 95.047612][ T5323] ? clear_bhb_loop+0x40/0x90
[ 95.049636][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.052192][ T5323] RIP: 0033:0x7f510699e019
[ 95.054143][ T5323] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 95.062209][ T5323] RSP: 002b:00007f5107820fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 95.065756][ T5323] RAX: ffffffffffffffda RBX: 00007f5106c25fa0 RCX: 00007f510699e019
[ 95.069216][ T5323] RDX: 000000000000000c RSI: 0000200000000400 RDI: 0000000000000003
[ 95.072610][ T5323] RBP: 00007f5106a3500c R08: 0000000000000000 R09: 0000000000000000
[ 95.075989][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 95.079369][ T5323] R13: 00007f5106c26038 R14: 00007f5106c25fa0 R15: 00007ffd9b243a28
[ 95.082630][ T5323]
[ 95.084391][ T5323] Kernel Offset: disabled
[ 95.086237][ T5323] Rebooting in 86400 seconds..