program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000000)="0a91b6db01cb48779d28c382a35f09d0b6395fcefd54a3e5333b130894f26b2c66ee69c24459c5f05019d6434c60b2cc484a193ac2f4421630452f804f20c946f1d7660e5db505db35e84108d61870294d0f33908db628de544ed889f254f749bf86e84b8fbc057c6d5c", 0x6a)
write(r0, &(0x7f0000000440)='44100,48000,88200,96000,176400,1', 0x20)
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
[ 135.045280][ T5330] ==================================================================
[ 135.049188][ T5330] BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x225/0x2b0
[ 135.052601][ T5330] Free of addr ffff888035271c20 by task syz.0.0/5330
[ 135.055391][ T5330]
[ 135.056485][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 135.056498][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 135.056505][ T5330] Call Trace:
[ 135.056511][ T5330]
[ 135.056516][ T5330] dump_stack_lvl+0xe8/0x150
[ 135.056533][ T5330] print_address_description+0x55/0x1e0
[ 135.056546][ T5330] print_report+0x58/0x70
[ 135.056556][ T5330] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 135.056567][ T5330] kasan_report_invalid_free+0xea/0x110
[ 135.056578][ T5330] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 135.056588][ T5330] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 135.056598][ T5330] __kasan_slab_pre_free+0x104/0x120
[ 135.056609][ T5330] kfree+0x173/0x640
[ 135.056617][ T5330] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 135.056627][ T5330] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 135.056636][ T5330] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 135.056646][ T5330] ? down_read+0x2be/0x330
[ 135.056656][ T5330] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 135.056665][ T5330] configfs_write_iter+0x337/0x430
[ 135.056676][ T5330] vfs_write+0x612/0xba0
[ 135.056692][ T5330] ? __pfx_vfs_write+0x10/0x10
[ 135.056710][ T5330] ? __fget_files+0x2a/0x420
[ 135.056726][ T5330] ksys_write+0x150/0x270
[ 135.056742][ T5330] ? __pfx_ksys_write+0x10/0x10
[ 135.056761][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 135.056773][ T5330] do_syscall_64+0x174/0x580
[ 135.056786][ T5330] ? trace_irq_disable+0x3b/0x140
[ 135.056796][ T5330] ? clear_bhb_loop+0x40/0x90
[ 135.056804][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 135.056812][ T5330] RIP: 0033:0x7f28cad9e019
[ 135.056821][ T5330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 135.056827][ T5330] RSP: 002b:00007f28cbd35fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 135.056837][ T5330] RAX: ffffffffffffffda RBX: 00007f28cb025fa0 RCX: 00007f28cad9e019
[ 135.056843][ T5330] RDX: 000000000000006a RSI: 0000200000000000 RDI: 0000000000000003
[ 135.056847][ T5330] RBP: 00007f28cae3500c R08: 0000000000000000 R09: 0000000000000000
[ 135.056852][ T5330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 135.056857][ T5330] R13: 00007f28cb026038 R14: 00007f28cb025fa0 R15: 00007ffc79044c88
[ 135.056865][ T5330]
[ 135.056868][ T5330]
[ 135.169485][ T5330] Allocated by task 5330:
[ 135.171622][ T5330] kasan_save_track+0x3e/0x80
[ 135.174015][ T5330] __kasan_kmalloc+0x93/0xb0
[ 135.176203][ T5330] __kmalloc_node_track_caller_noprof+0x4c3/0x730
[ 135.179211][ T5330] kstrdup+0x42/0x100
[ 135.181209][ T5330] f_uac2_opts_p_srate_store+0x11f/0x2b0
[ 135.184415][ T5330] configfs_write_iter+0x337/0x430
[ 135.187374][ T5330] vfs_write+0x612/0xba0
[ 135.189449][ T5330] ksys_write+0x150/0x270
[ 135.191320][ T5330] do_syscall_64+0x174/0x580
[ 135.193468][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 135.196712][ T5330]
[ 135.198070][ T5330] The buggy address belongs to the object at ffff888035271c00
[ 135.198070][ T5330] which belongs to the cache kmalloc-128 of size 128
[ 135.204755][ T5330] The buggy address is located 32 bytes inside of
[ 135.204755][ T5330] 107-byte region [ffff888035271c00, ffff888035271c6b)
[ 135.211521][ T5330]
[ 135.212838][ T5330] The buggy address belongs to the physical page:
[ 135.216114][ T5330] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x35271
[ 135.220548][ T5330] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 135.224023][ T5330] page_type: f5(slab)
[ 135.225769][ T5330] raw: 04fff00000000000 ffff88801b041a00 dead000000000100 dead000000000122
[ 135.229432][ T5330] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
[ 135.233176][ T5330] page dumped because: kasan: bad access detected
[ 135.236031][ T5330] page_owner tracks the page as allocated
[ 135.238481][ T5330] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5293, tgid 5293 (syz-executor), ts 132238899298, free_ts 131872537953
[ 135.247130][ T5330] post_alloc_hook+0x1f9/0x250
[ 135.249152][ T5330] get_page_from_freelist+0x21fa/0x2270
[ 135.251493][ T5330] __alloc_frozen_pages_noprof+0x18d/0x380
[ 135.253761][ T5330] allocate_slab+0x79/0x5e0
[ 135.255340][ T5330] refill_objects+0x2d5/0x350
[ 135.257278][ T5330] __pcs_replace_empty_main+0x2bf/0x6b0
[ 135.259596][ T5330] __kmalloc_noprof+0x485/0x720
[ 135.261747][ T5330] udp_init_sock+0x198/0x3b0
[ 135.263729][ T5330] inet_create+0xd02/0x1020
[ 135.265716][ T5330] __sock_create+0x4b3/0x9d0
[ 135.267896][ T5330] udp_sock_create4+0xc5/0x480
[ 135.269819][ T5330] geneve_sock_add+0x649/0xd70
[ 135.271809][ T5330] geneve_open+0xd3/0x140
[ 135.273619][ T5330] __dev_open+0x46f/0x850
[ 135.275462][ T5330] __dev_change_flags+0x329/0x820
[ 135.277613][ T5330] netif_change_flags+0x7c/0x1b0
[ 135.279674][ T5330] page last free pid 5323 tgid 5323 stack trace:
[ 135.282477][ T5330] __free_frozen_pages+0xc1e/0xd10
[ 135.284692][ T5330] __slab_free+0x274/0x2c0
[ 135.286522][ T5330] qlist_free_all+0x99/0x100
[ 135.288320][ T5330] kasan_quarantine_reduce+0x148/0x160
[ 135.290488][ T5330] __kasan_slab_alloc+0x22/0x80
[ 135.292451][ T5330] kmem_cache_alloc_noprof+0x2a0/0x5f0
[ 135.294790][ T5330] vm_area_dup+0x28/0x670
[ 135.296661][ T5330] __split_vma+0x1dc/0xa50
[ 135.298533][ T5330] vma_modify+0x93a/0x1c70
[ 135.300481][ T5330] vma_modify_flags+0x24b/0x330
[ 135.302547][ T5330] mprotect_fixup+0x624/0xb10
[ 135.304531][ T5330] do_mprotect_pkey+0x9d3/0xcd0
[ 135.306646][ T5330] __x64_sys_mprotect+0x80/0x90
[ 135.308733][ T5330] do_syscall_64+0x174/0x580
[ 135.310711][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 135.313158][ T5330]
[ 135.314152][ T5330] Memory state around the buggy address:
[ 135.316731][ T5330] ffff888035271b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 135.320877][ T5330] ffff888035271b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 135.324360][ T5330] >ffff888035271c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc fc
[ 135.328179][ T5330] ^
[ 135.331308][ T5330] ffff888035271c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 135.335484][ T5330] ffff888035271d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 135.339395][ T5330] ==================================================================
[ 135.345109][ T5330] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 135.348574][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 135.352957][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 135.357901][ T5330] Call Trace:
[ 135.359849][ T5330]
[ 135.361543][ T5330] vpanic+0x56c/0xa60
[ 135.363516][ T5330] ? __pfx_vpanic+0x10/0x10
[ 135.365844][ T5330] ? __pfx___schedule+0x10/0x10
[ 135.368936][ T5330] panic+0xc5/0xd0
[ 135.371120][ T5330] ? __pfx_panic+0x10/0x10
[ 135.373557][ T5330] ? preempt_schedule_common+0x82/0xd0
[ 135.376453][ T5330] check_panic_on_warn+0x89/0xb0
[ 135.379435][ T5330] end_report+0x73/0x170
[ 135.382078][ T5330] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 135.385064][ T5330] kasan_report_invalid_free+0xfa/0x110
[ 135.387559][ T5330] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 135.390562][ T5330] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 135.393856][ T5330] __kasan_slab_pre_free+0x104/0x120
[ 135.396694][ T5330] kfree+0x173/0x640
[ 135.398602][ T5330] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 135.401541][ T5330] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 135.404605][ T5330] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 135.407807][ T5330] ? down_read+0x2be/0x330
[ 135.409819][ T5330] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 135.412575][ T5330] configfs_write_iter+0x337/0x430
[ 135.415188][ T5330] vfs_write+0x612/0xba0
[ 135.418198][ T5330] ? __pfx_vfs_write+0x10/0x10
[ 135.420814][ T5330] ? __fget_files+0x2a/0x420
[ 135.422921][ T5330] ksys_write+0x150/0x270
[ 135.424785][ T5330] ? __pfx_ksys_write+0x10/0x10
[ 135.427295][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 135.430697][ T5330] do_syscall_64+0x174/0x580
[ 135.432950][ T5330] ? trace_irq_disable+0x3b/0x140
[ 135.435222][ T5330] ? clear_bhb_loop+0x40/0x90
[ 135.437337][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 135.440162][ T5330] RIP: 0033:0x7f28cad9e019
[ 135.442505][ T5330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 135.452079][ T5330] RSP: 002b:00007f28cbd35fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 135.455358][ T5330] RAX: ffffffffffffffda RBX: 00007f28cb025fa0 RCX: 00007f28cad9e019
[ 135.458162][ T5330] RDX: 000000000000006a RSI: 0000200000000000 RDI: 0000000000000003
[ 135.461204][ T5330] RBP: 00007f28cae3500c R08: 0000000000000000 R09: 0000000000000000
[ 135.464487][ T5330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 135.467970][ T5330] R13: 00007f28cb026038 R14: 00007f28cb025fa0 R15: 00007ffc79044c88
[ 135.470843][ T5330]
[ 135.472670][ T5330] Kernel Offset: disabled
[ 135.474845][ T5330] Rebooting in 86400 seconds..