program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./myconfig\x00', 0x1ff)
mount(0x0, &(0x7f0000000280)='./myconfig\x00', &(0x7f00000002c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r0, &(0x7f00000006c0)='445000,960I\b,1', 0xe)
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000100))
r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r3 = dup3(r2, r1, 0x0)
r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0x10a})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f0000000440)="42f7a85b"})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000540)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0xf0ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_THREAD_EXIT(r4, 0x40046208, 0x0)
syz_read_part_table(0x5e2, &(0x7f0000000b00)="$eJzs3L+rHFUUB/DvndlfD6LPP8DiQRpR8Al24sNY6DNdEO0EbS2eSCzEQnYXFcEff0Ba0cIohFhbKEgQ01mJ8NBCxN7CFIYrOzuzG1CrfSiBz6fYe+6de86Z4U47G+5udT+pJbnZzT5qu2HUJNNV8GvyzjhZvvhkv5CM+8SS5PmrTz198eBSmW7WVquL/up022XSj6Mc9NGXo3x49fjdLl6kZJ4+zPjzSUarvXWdd+XvN32rpO328D8bfVXXBzHJ9/kiyUlpV4c/TZb5JLkvs27fYZK21tod8yLZS9rNW7GDa0c3lk/08V76N228ns3fK/WR/to4tdbaZH5+yGyT+x8/vPxPRbv8Zfd4w1KtdXxuyG22F05uT4bw0W9/nmc521RPbbYlT/eSV0+ffbi7k7KuMd798QEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOGMPvPbg180wudD9lk38zKdptlsXyZ9DfDA7o/7Xjm7sv/X25SZvHL38wytv/nL8W35P0ubw+Fwy3ex7aT1cf78bRv1qu3P/k9vN5LOPv9nbLPSlS/Ld+R9v1aHDaT++/tgdyUfNzv0BAAAAAAAAAAAAAAAAAABg5XouHlxq8lxS8kK2n/vXzJJShuksqbXWP2pn+Ph/cuXePrr5U8oqKbXcWf1Csn9PUqcfPNT9rcA6sdY66lqU/+YZ+Xd/BQAA//8EFGMK")
r5 = syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x800)
ioctl$LOOP_SET_BLOCK_SIZE(r5, 0x4c09, 0x8000)
mount(&(0x7f0000000040)=@filename='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', &(0x7f0000001400)='./file0\x00', &(0x7f0000000000)='romfs\x00', 0x1010040, 0x0)
r6 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0)
ioctl$VHOST_SET_VRING_BASE(r6, 0xaf01, 0x0)
ioctl$VHOST_SET_VRING_ADDR(r6, 0x4028af11, &(0x7f0000000080)={0x0, 0x0, 0x0, &(0x7f0000000300)=""/54, 0x0})
ioctl$VHOST_SET_VRING_ADDR(r6, 0x4028af11, &(0x7f0000000040)={0x1, 0x0, 0x0, &(0x7f00000000c0)=""/87, 0x0, 0xf000})
ioctl$VHOST_SET_MEM_TABLE(r6, 0x4008af03, &(0x7f00000001c0)={0x1, 0x0, [{0x0, 0x8a, &(0x7f00000003c0)=""/138}]})
ioctl$VHOST_VSOCK_SET_RUNNING(r6, 0x4004af61, &(0x7f0000000500)=0x1)
ioctl$VHOST_SET_FEATURES(r6, 0x4008af00, &(0x7f00000002c0)=0x4000000)
[ 94.318591][ T4638] Bluetooth: hci0: command tx timeout
[ 94.491301][ T5315] ==================================================================
[ 94.494611][ T5315] BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.497793][ T5315] Free of addr ffff88801f0c7f0d by task syz.0.0/5315
[ 94.500434][ T5315]
[ 94.501445][ T5315] CPU: 0 UID: 0 PID: 5315 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.501463][ T5315] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.501472][ T5315] Call Trace:
[ 94.501478][ T5315]
[ 94.501484][ T5315] dump_stack_lvl+0xe8/0x150
[ 94.501503][ T5315] print_address_description+0x55/0x1e0
[ 94.501518][ T5315] print_report+0x58/0x70
[ 94.501533][ T5315] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.501546][ T5315] kasan_report_invalid_free+0xea/0x110
[ 94.501562][ T5315] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.501576][ T5315] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.501587][ T5315] __kasan_slab_pre_free+0x104/0x120
[ 94.501602][ T5315] kfree+0x173/0x640
[ 94.501612][ T5315] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.501625][ T5315] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.501636][ T5315] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 94.501677][ T5315] ? down_read+0x2be/0x330
[ 94.501694][ T5315] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 94.501707][ T5315] configfs_write_iter+0x337/0x430
[ 94.501721][ T5315] vfs_write+0x612/0xba0
[ 94.501739][ T5315] ? __pfx_vfs_write+0x10/0x10
[ 94.501756][ T5315] ? __fget_files+0x2a/0x420
[ 94.501773][ T5315] ksys_write+0x150/0x270
[ 94.501782][ T5315] ? __pfx_ksys_write+0x10/0x10
[ 94.501798][ T5315] do_syscall_64+0x166/0x520
[ 94.501810][ T5315] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.501821][ T5315] ? clear_bhb_loop+0x70/0xc0
[ 94.501832][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.501842][ T5315] RIP: 0033:0x7f581f39e159
[ 94.501854][ T5315] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.501864][ T5315] RSP: 002b:00007f5820186fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 94.501877][ T5315] RAX: ffffffffffffffda RBX: 00007f581f625fa0 RCX: 00007f581f39e159
[ 94.501885][ T5315] RDX: 000000000000000e RSI: 00002000000006c0 RDI: 0000000000000003
[ 94.501891][ T5315] RBP: 00007f581f435024 R08: 0000000000000000 R09: 0000000000000000
[ 94.501898][ T5315] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.501906][ T5315] R13: 00007f581f626038 R14: 00007f581f625fa0 R15: 00007ffe99fcde38
[ 94.501918][ T5315]
[ 94.501923][ T5315]
[ 94.598207][ T5315] Allocated by task 5315:
[ 94.600114][ T5315] kasan_save_track+0x3e/0x80
[ 94.602159][ T5315] __kasan_kmalloc+0x93/0xb0
[ 94.604194][ T5315] __kmalloc_node_track_caller_noprof+0x4c7/0x740
[ 94.606877][ T5315] kstrdup+0x42/0x100
[ 94.608598][ T5315] f_uac2_opts_p_srate_store+0x11f/0x2b0
[ 94.611015][ T5315] configfs_write_iter+0x337/0x430
[ 94.613213][ T5315] vfs_write+0x612/0xba0
[ 94.614915][ T5315] ksys_write+0x150/0x270
[ 94.616809][ T5315] do_syscall_64+0x166/0x520
[ 94.618837][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.621373][ T5315]
[ 94.622462][ T5315] The buggy address belongs to the object at ffff88801f0c7f00
[ 94.622462][ T5315] which belongs to the cache kmalloc-16 of size 16
[ 94.628072][ T5315] The buggy address is located 13 bytes inside of
[ 94.628072][ T5315] 15-byte region [ffff88801f0c7f00, ffff88801f0c7f0f)
[ 94.633396][ T5315]
[ 94.634427][ T5315] The buggy address belongs to the physical page:
[ 94.636980][ T5315] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88801f0c7f60 pfn:0x1f0c7
[ 94.640960][ T5315] flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
[ 94.644107][ T5315] page_type: f5(slab)
[ 94.645838][ T5315] raw: 00fff00000000200 ffff88801b041640 ffff88801b040408 ffff88801b040408
[ 94.650213][ T5315] raw: ffff88801f0c7f60 000000080080007b 00000000f5000000 0000000000000000
[ 94.653954][ T5315] page dumped because: kasan: bad access detected
[ 94.656918][ T5315] page_owner tracks the page as allocated
[ 94.659253][ T5315] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 5272, tgid 5272 (syz-executor), ts 92399520677
[ 94.666879][ T5315] post_alloc_hook+0x1f9/0x250
[ 94.668936][ T5315] get_page_from_freelist+0x2209/0x2280
[ 94.671240][ T5315] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 94.673717][ T5315] allocate_slab+0x7c/0x5e0
[ 94.675632][ T5315] ___slab_alloc+0x16a/0x950
[ 94.677580][ T5315] __kmalloc_cache_node_noprof+0x1d7/0x630
[ 94.680028][ T5315] hugetlb_cgroup_css_alloc+0x175/0xb20
[ 94.682367][ T5315] cgroup_apply_control_enable+0x5bb/0xda0
[ 94.684775][ T5315] cgroup_mkdir+0xd2c/0xf90
[ 94.686688][ T5315] kernfs_iop_mkdir+0x213/0x360
[ 94.688756][ T5315] vfs_mkdir+0x40c/0x620
[ 94.690631][ T5315] filename_mkdirat+0x285/0x510
[ 94.692751][ T5315] __se_sys_mkdirat+0x35/0x150
[ 94.694873][ T5315] do_syscall_64+0x166/0x520
[ 94.696924][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.699203][ T5315] page last free pid 5272 tgid 5272 ts 92378129175 stack trace:
[ 94.702254][ T5315] __free_frozen_pages+0xc93/0xd90
[ 94.704445][ T5315] __slab_free+0x274/0x2c0
[ 94.706239][ T5315] qlist_free_all+0x99/0x100
[ 94.708053][ T5315] kasan_quarantine_reduce+0x148/0x160
[ 94.710150][ T5315] __kasan_slab_alloc+0x22/0x80
[ 94.712013][ T5315] kmem_cache_alloc_noprof+0x2a4/0x5f0
[ 94.714047][ T5315] do_getname_kernel+0x54/0x230
[ 94.715898][ T5315] kern_path+0x25/0x150
[ 94.717422][ T5315] tomoyo_mount_permission+0x79e/0x9e0
[ 94.719531][ T5315] security_sb_mount+0xe4/0x320
[ 94.721401][ T5315] path_mount+0xbc/0x1050
[ 94.723123][ T5315] __se_sys_mount+0x31d/0x420
[ 94.725000][ T5315] do_syscall_64+0x166/0x520
[ 94.726838][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.729262][ T5315]
[ 94.730518][ T5315] Memory state around the buggy address:
[ 94.732908][ T5315] ffff88801f0c7e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.736246][ T5315] ffff88801f0c7e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.739538][ T5315] >ffff88801f0c7f00: 00 07 fc fc 00 00 fc fc fa fb fc fc fc fc fc fc
[ 94.742966][ T5315] ^
[ 94.744918][ T5315] ffff88801f0c7f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.748190][ T5315] ffff88801f0c8000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 94.751387][ T5315] ==================================================================
[ 94.837504][ T5315] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 94.840665][ T5315] CPU: 0 UID: 0 PID: 5315 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.844402][ T5315] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.848398][ T5315] Call Trace:
[ 94.849764][ T5315]
[ 94.850981][ T5315] vpanic+0x56d/0xa60
[ 94.852518][ T5315] ? __pfx_vpanic+0x10/0x10
[ 94.854313][ T5315] ? __pfx___schedule+0x10/0x10
[ 94.856294][ T5315] panic+0xc5/0xd0
[ 94.857906][ T5315] ? __pfx_panic+0x10/0x10
[ 94.859827][ T5315] ? preempt_schedule_common+0x7f/0xd0
[ 94.862141][ T5315] check_panic_on_warn+0x89/0xb0
[ 94.864270][ T5315] end_report+0x73/0x170
[ 94.866085][ T5315] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.868432][ T5315] kasan_report_invalid_free+0xfa/0x110
[ 94.870598][ T5315] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.872950][ T5315] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.875374][ T5315] __kasan_slab_pre_free+0x104/0x120
[ 94.877576][ T5315] kfree+0x173/0x640
[ 94.879252][ T5315] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.881685][ T5315] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.884062][ T5315] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 94.886603][ T5315] ? down_read+0x2be/0x330
[ 94.888503][ T5315] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 94.891053][ T5315] configfs_write_iter+0x337/0x430
[ 94.893244][ T5315] vfs_write+0x612/0xba0
[ 94.894994][ T5315] ? __pfx_vfs_write+0x10/0x10
[ 94.897102][ T5315] ? __fget_files+0x2a/0x420
[ 94.899069][ T5315] ksys_write+0x150/0x270
[ 94.900869][ T5315] ? __pfx_ksys_write+0x10/0x10
[ 94.903003][ T5315] do_syscall_64+0x166/0x520
[ 94.904952][ T5315] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.907445][ T5315] ? clear_bhb_loop+0x70/0xc0
[ 94.909346][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.911809][ T5315] RIP: 0033:0x7f581f39e159
[ 94.913741][ T5315] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.921834][ T5315] RSP: 002b:00007f5820186fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 94.925350][ T5315] RAX: ffffffffffffffda RBX: 00007f581f625fa0 RCX: 00007f581f39e159
[ 94.928796][ T5315] RDX: 000000000000000e RSI: 00002000000006c0 RDI: 0000000000000003
[ 94.932103][ T5315] RBP: 00007f581f435024 R08: 0000000000000000 R09: 0000000000000000
[ 94.935402][ T5315] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.938793][ T5315] R13: 00007f581f626038 R14: 00007f581f625fa0 R15: 00007ffe99fcde38
[ 94.942066][ T5315]
[ 94.943620][ T5315] Kernel Offset: disabled
[ 94.945487][ T5315] Rebooting in 86400 seconds..