program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000000)="34343130302c34383030302c3838322030b1bd90a22c393430", 0x19)
symlinkat(&(0x7f0000000580)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00')
socket$inet6(0xa, 0x3, 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./myconfig/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r1, &(0x7f0000000640)='usbip-vudc.0', 0xc)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff) (async)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff) (async)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) (async)
openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0) (async)
write(r0, &(0x7f0000000000)="34343130302c34383030302c3838322030b1bd90a22c393430", 0x19) (async)
symlinkat(&(0x7f0000000580)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00') (async)
socket$inet6(0xa, 0x3, 0x4) (async)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./myconfig/usb_gadget/g1/UDC\x00', 0x1, 0x0) (async)
write(r1, &(0x7f0000000640)='usbip-vudc.0', 0xc) (async)
[ 87.308964][ T4640] Bluetooth: hci0: command tx timeout
[ 87.397072][ T5313] ==================================================================
[ 87.399845][ T5313] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0
[ 87.402637][ T5313] Free of addr ffff88803ec53a56 by task syz.0.0/5313
[ 87.405284][ T5313]
[ 87.406302][ T5313] CPU: 0 UID: 0 PID: 5313 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 87.406314][ T5313] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 87.406320][ T5313] Call Trace:
[ 87.406326][ T5313]
[ 87.406330][ T5313] dump_stack_lvl+0xe8/0x150
[ 87.406347][ T5313] print_address_description+0x55/0x1e0
[ 87.406360][ T5313] print_report+0x58/0x70
[ 87.406369][ T5313] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 87.406380][ T5313] kasan_report_invalid_free+0xea/0x110
[ 87.406392][ T5313] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 87.406402][ T5313] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 87.406411][ T5313] __kasan_slab_pre_free+0x104/0x120
[ 87.406422][ T5313] kfree+0x173/0x640
[ 87.406435][ T5313] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 87.406445][ T5313] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 87.406455][ T5313] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 87.406466][ T5313] ? down_read+0x2be/0x330
[ 87.406477][ T5313] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 87.406487][ T5313] configfs_write_iter+0x337/0x430
[ 87.406500][ T5313] vfs_write+0x612/0xba0
[ 87.406513][ T5313] ? __pfx_vfs_write+0x10/0x10
[ 87.406525][ T5313] ? __fget_files+0x2a/0x420
[ 87.406537][ T5313] ksys_write+0x150/0x270
[ 87.406548][ T5313] ? __pfx_ksys_write+0x10/0x10
[ 87.406560][ T5313] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.406569][ T5313] do_syscall_64+0x174/0x580
[ 87.406581][ T5313] ? trace_irq_disable+0x3b/0x140
[ 87.406592][ T5313] ? clear_bhb_loop+0x70/0xc0
[ 87.406602][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.406610][ T5313] RIP: 0033:0x7f366859e0d9
[ 87.406621][ T5313] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 87.406629][ T5313] RSP: 002b:00007f36693c7fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 87.406640][ T5313] RAX: ffffffffffffffda RBX: 00007f3668825fa0 RCX: 00007f366859e0d9
[ 87.406646][ T5313] RDX: 0000000000000019 RSI: 0000200000000000 RDI: 0000000000000003
[ 87.406652][ T5313] RBP: 00007f3668635024 R08: 0000000000000000 R09: 0000000000000000
[ 87.406658][ T5313] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 87.406663][ T5313] R13: 00007f3668826038 R14: 00007f3668825fa0 R15: 00007ffd88e96f58
[ 87.406673][ T5313]
[ 87.406676][ T5313]
[ 87.501611][ T5313] Allocated by task 5313:
[ 87.503412][ T5313] kasan_save_track+0x3e/0x80
[ 87.505318][ T5313] __kasan_kmalloc+0x93/0xb0
[ 87.507200][ T5313] __kmalloc_node_track_caller_noprof+0x4c3/0x730
[ 87.509812][ T5313] kstrdup+0x42/0x100
[ 87.511499][ T5313] f_uac2_opts_c_srate_store+0x11f/0x2b0
[ 87.513811][ T5313] configfs_write_iter+0x337/0x430
[ 87.515966][ T5313] vfs_write+0x612/0xba0
[ 87.517794][ T5313] ksys_write+0x150/0x270
[ 87.519506][ T5313] do_syscall_64+0x174/0x580
[ 87.521437][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.523749][ T5313]
[ 87.524805][ T5313] The buggy address belongs to the object at ffff88803ec53a40
[ 87.524805][ T5313] which belongs to the cache kmalloc-32 of size 32
[ 87.531160][ T5313] The buggy address is located 22 bytes inside of
[ 87.531160][ T5313] 26-byte region [ffff88803ec53a40, ffff88803ec53a5a)
[ 87.537799][ T5313]
[ 87.538849][ T5313] The buggy address belongs to the physical page:
[ 87.541502][ T5313] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3ec53
[ 87.545036][ T5313] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 87.548045][ T5313] page_type: f5(slab)
[ 87.549686][ T5313] raw: 04fff00000000000 ffff88801b041780 dead000000000100 dead000000000122
[ 87.553227][ T5313] raw: 0000000000000000 0000000800400040 00000000f5000000 0000000000000000
[ 87.556644][ T5313] page dumped because: kasan: bad access detected
[ 87.559247][ T5313] page_owner tracks the page as allocated
[ 87.561616][ T5313] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5064, tgid 5064 (rcS), ts 58210011929, free_ts 58180645346
[ 87.569320][ T5313] post_alloc_hook+0x1f9/0x250
[ 87.571287][ T5313] get_page_from_freelist+0x21fa/0x2270
[ 87.573436][ T5313] __alloc_frozen_pages_noprof+0x18d/0x380
[ 87.575931][ T5313] allocate_slab+0x79/0x5e0
[ 87.577913][ T5313] refill_objects+0x2d5/0x350
[ 87.579856][ T5313] __pcs_replace_empty_main+0x2bf/0x6b0
[ 87.582197][ T5313] __kmalloc_noprof+0x485/0x720
[ 87.584296][ T5313] tomoyo_supervisor+0xc53/0x1560
[ 87.586663][ T5313] tomoyo_env_perm+0x151/0x1f0
[ 87.588725][ T5313] tomoyo_find_next_domain+0x1332/0x1a90
[ 87.591092][ T5313] tomoyo_bprm_check_security+0x11b/0x180
[ 87.593421][ T5313] security_bprm_check+0x85/0x240
[ 87.595499][ T5313] bprm_execve+0x918/0x1630
[ 87.597483][ T5313] do_execveat_common+0x4f4/0x670
[ 87.599615][ T5313] __x64_sys_execve+0x97/0xc0
[ 87.601561][ T5313] do_syscall_64+0x174/0x580
[ 87.603450][ T5313] page last free pid 4983 tgid 4983 stack trace:
[ 87.606141][ T5313] __free_frozen_pages+0xc1e/0xd10
[ 87.608334][ T5313] tlb_remove_table_rcu+0x85/0x100
[ 87.610543][ T5313] rcu_core+0x78b/0x10a0
[ 87.612399][ T5313] handle_softirqs+0x225/0x840
[ 87.614459][ T5313] do_softirq+0x76/0xd0
[ 87.616232][ T5313] __local_bh_enable_ip+0xf8/0x130
[ 87.618438][ T5313] copy_fpstate_to_sigframe+0x51e/0xd20
[ 87.620805][ T5313] get_sigframe+0x603/0x830
[ 87.622717][ T5313] x64_setup_rt_frame+0x163/0xc50
[ 87.624861][ T5313] arch_do_signal_or_restart+0x456/0x860
[ 87.627252][ T5313] exit_to_user_mode_loop+0x104/0x730
[ 87.629566][ T5313] do_syscall_64+0x353/0x580
[ 87.631484][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.633844][ T5313]
[ 87.634788][ T5313] Memory state around the buggy address:
[ 87.637030][ T5313] ffff88803ec53900: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[ 87.640215][ T5313] ffff88803ec53980: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[ 87.643607][ T5313] >ffff88803ec53a00: fa fb fb fb fc fc fc fc 00 00 00 02 fc fc fc fc
[ 87.647036][ T5313] ^
[ 87.649868][ T5313] ffff88803ec53a80: 00 00 03 fc fc fc fc fc fa fb fb fb fc fc fc fc
[ 87.653568][ T5313] ffff88803ec53b00: 00 00 00 00 fc fc fc fc fa fb fb fb fc fc fc fc
[ 87.657053][ T5313] ==================================================================
[ 87.738889][ T5313] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 87.741998][ T5313] CPU: 0 UID: 0 PID: 5313 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 87.745746][ T5313] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 87.750034][ T5313] Call Trace:
[ 87.751510][ T5313]
[ 87.752805][ T5313] vpanic+0x56c/0xa60
[ 87.754502][ T5313] ? __pfx_vpanic+0x10/0x10
[ 87.756396][ T5313] ? __pfx___schedule+0x10/0x10
[ 87.758473][ T5313] panic+0xc5/0xd0
[ 87.760139][ T5313] ? __pfx_panic+0x10/0x10
[ 87.762114][ T5313] ? preempt_schedule_common+0x82/0xd0
[ 87.764424][ T5313] check_panic_on_warn+0x89/0xb0
[ 87.766521][ T5313] end_report+0x73/0x170
[ 87.768427][ T5313] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 87.770887][ T5313] kasan_report_invalid_free+0xfa/0x110
[ 87.773221][ T5313] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 87.775681][ T5313] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 87.778195][ T5313] __kasan_slab_pre_free+0x104/0x120
[ 87.780459][ T5313] kfree+0x173/0x640
[ 87.782093][ T5313] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 87.784550][ T5313] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 87.786919][ T5313] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 87.789645][ T5313] ? down_read+0x2be/0x330
[ 87.791566][ T5313] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 87.794218][ T5313] configfs_write_iter+0x337/0x430
[ 87.796462][ T5313] vfs_write+0x612/0xba0
[ 87.798338][ T5313] ? __pfx_vfs_write+0x10/0x10
[ 87.800369][ T5313] ? __fget_files+0x2a/0x420
[ 87.802461][ T5313] ksys_write+0x150/0x270
[ 87.804402][ T5313] ? __pfx_ksys_write+0x10/0x10
[ 87.806475][ T5313] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.809155][ T5313] do_syscall_64+0x174/0x580
[ 87.811176][ T5313] ? trace_irq_disable+0x3b/0x140
[ 87.813383][ T5313] ? clear_bhb_loop+0x70/0xc0
[ 87.815437][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.817915][ T5313] RIP: 0033:0x7f366859e0d9
[ 87.819847][ T5313] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 87.827897][ T5313] RSP: 002b:00007f36693c7fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 87.831421][ T5313] RAX: ffffffffffffffda RBX: 00007f3668825fa0 RCX: 00007f366859e0d9
[ 87.834799][ T5313] RDX: 0000000000000019 RSI: 0000200000000000 RDI: 0000000000000003
[ 87.838050][ T5313] RBP: 00007f3668635024 R08: 0000000000000000 R09: 0000000000000000
[ 87.841424][ T5313] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 87.844702][ T5313] R13: 00007f3668826038 R14: 00007f3668825fa0 R15: 00007ffd88e96f58
[ 87.848043][ T5313]
[ 87.849738][ T5313] Kernel Offset: disabled
[ 87.851614][ T5313] Rebooting in 86400 seconds..