program:
ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x54, 0x0, 0x0, {0x8, 0x1}, {0x200, 0x40}, @cond=[{0x0, 0x2, 0x2, 0x3ff, 0x105, 0x9}, {0x80, 0xfff7, 0x2, 0x6, 0x6, 0xffff}]})
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r2, &(0x7f0000000000)={0x1f, 0x8ef, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe)
syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYBLOB="02c80022001e00010004021a000200440a061008020000084000000f0000003ff2ffff0202ced4"], 0x27)
sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x20000054)
unshare(0x4020400)
mkdir(&(0x7f0000000080)='./file1\x00', 0x8)
mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota')
chdir(&(0x7f00000000c0)='./file1\x00')
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='blkio.bfq.sectors\x00', 0x275a, 0x0)
quotactl_fd$Q_SETQUOTA(r3, 0xffffffff80000802, 0x0, &(0x7f0000000340)={0x801, 0x5, 0x7fffffff, 0x3, 0x1, 0x6, 0x6, 0x2, 0x4})
r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
r5 = getpid()
r6 = syz_pidfd_open(r5, 0x0)
setns(r6, 0x24020000)
close_range(r4, 0xffffffffffffffff, 0x0)
ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(r1, 0x7a4, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000780)=@updpolicy={0x17c, 0x19, 0x2, 0x70bd2c, 0x0, {{@in=@loopback, @in=@private=0xa010100, 0x0, 0x0, 0x4e21, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x4, 0xfffffffffffffffc}, {}, 0x0, 0x0, 0x0, 0x0, 0x2}, [@tmpl={0xc4, 0x5, [{{@in=@multicast1, 0x0, 0x3c}, 0x0, @in=@multicast1, 0x4, 0x0, 0x3, 0x0, 0x800}, {{@in=@local, 0x7, 0x3c}, 0x0, @in6=@dev}, {{@in=@broadcast, 0x0, 0x6c}, 0x0, @in6=@mcast1, 0x0, 0x1}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x4004014}, 0x0)
r7 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="080100001900674c28bd700000000000ff0100000000000000000000000000000000000000000000fffe0000fffd00000a00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000044000500e0000001000000000000000000000000000000002b000000000000000000000000000000000000000000000000000000020000000000000000000000000000000a0010000100000000000000"], 0x108}}, 0x0)
sendmmsg$inet(r7, &(0x7f0000000400)=[{{&(0x7f0000000140)={0x2, 0x4e23, @multicast1}, 0xfffffffffffffe1d, &(0x7f0000000240)=[{&(0x7f0000000180)="2566eac4b8a29519055afba751cccea7c5c7ac52a7854e40ca2acf8fb882112b54ed92e248dff66e9f003f565cf4d26281952ac283348570", 0x38}], 0x1, &(0x7f0000000280)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0xfe}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x8}}, @ip_ttl={{0x14, 0x0, 0x2, 0xd8}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @empty, @loopback}}}], 0x68}}], 0x1, 0x90)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r8, &(0x7f0000000680)="34343130302c2a383030302c38383230302c39a4912433a6dc81e0e8b96556638484dbb97306852f5b1a5343a975a8be6108966a442ba7d32d1ac2ffa3f26e7d7e3afdcf21ed3d74dbc6d89654e28aef4467068441d02bebff76560cb849e5911c75a73e21e9f0ec02b996d86294faac214c7a7bd1635879e394ef2895471089fe21778a2032bf2b1d2fcfb01955e71fcfe0c3f68b32e34e355b01bada55c85f5bc7b709db3b1cbe6cf82a45ebefd700000000abefcfa2585288784fe252c029668a7d53ce847ea5d807974ab1b15446512dc5", 0xd3)
[ 70.285888][ T5286] Bluetooth: hci0: command tx timeout
[ 70.541492][ T5322] ==================================================================
[ 70.544878][ T5322] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0
[ 70.548361][ T5322] Free of addr ffff888042b0c40c by task syz.0.0/5322
[ 70.551227][ T5322]
[ 70.552349][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 70.552365][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 70.552373][ T5322] Call Trace:
[ 70.552380][ T5322]
[ 70.552386][ T5322] dump_stack_lvl+0xe8/0x150
[ 70.552408][ T5322] print_address_description+0x55/0x1e0
[ 70.552426][ T5322] print_report+0x58/0x70
[ 70.552440][ T5322] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 70.552453][ T5322] kasan_report_invalid_free+0xea/0x110
[ 70.552472][ T5322] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 70.552486][ T5322] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 70.552499][ T5322] __kasan_slab_pre_free+0x104/0x120
[ 70.552513][ T5322] kfree+0x173/0x640
[ 70.552524][ T5322] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 70.552539][ T5322] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 70.552555][ T5322] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 70.552570][ T5322] ? down_read+0x2be/0x330
[ 70.552584][ T5322] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 70.552599][ T5322] configfs_write_iter+0x337/0x430
[ 70.552616][ T5322] vfs_write+0x612/0xba0
[ 70.552633][ T5322] ? __pfx_vfs_write+0x10/0x10
[ 70.552658][ T5322] ? ktime_get+0x1f5/0x220
[ 70.552677][ T5322] ksys_write+0x150/0x270
[ 70.552694][ T5322] ? __pfx_ksys_write+0x10/0x10
[ 70.552711][ T5322] ? __secure_computing+0xe7/0x2b0
[ 70.552730][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 70.552742][ T5322] do_syscall_64+0x174/0x580
[ 70.552753][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 70.552765][ T5322] ? clear_bhb_loop+0x40/0x90
[ 70.552777][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 70.552789][ T5322] RIP: 0033:0x7fb255f9de99
[ 70.552801][ T5322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 70.552811][ T5322] RSP: 002b:00007fb256f3dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 70.552825][ T5322] RAX: ffffffffffffffda RBX: 00007fb256225fa0 RCX: 00007fb255f9de99
[ 70.552834][ T5322] RDX: 00000000000000d3 RSI: 0000200000000680 RDI: 0000000000000001
[ 70.552842][ T5322] RBP: 00007fb256033eaf R08: 0000000000000000 R09: 0000000000000000
[ 70.552849][ T5322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 70.552856][ T5322] R13: 00007fb256226038 R14: 00007fb256225fa0 R15: 00007fff77e818c8
[ 70.552868][ T5322]
[ 70.552872][ T5322]
[ 70.652399][ T5322] Allocated by task 5322:
[ 70.654246][ T5322] kasan_save_track+0x3e/0x80
[ 70.656167][ T5322] __kasan_kmalloc+0x93/0xb0
[ 70.657982][ T5322] __kmalloc_node_track_caller_noprof+0x4c3/0x730
[ 70.660674][ T5322] kstrdup+0x42/0x100
[ 70.662339][ T5322] f_uac2_opts_c_srate_store+0x11f/0x2b0
[ 70.664630][ T5322] configfs_write_iter+0x337/0x430
[ 70.666744][ T5322] vfs_write+0x612/0xba0
[ 70.668540][ T5322] ksys_write+0x150/0x270
[ 70.670320][ T5322] do_syscall_64+0x174/0x580
[ 70.672287][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 70.674745][ T5322]
[ 70.675783][ T5322] The buggy address belongs to the object at ffff888042b0c400
[ 70.675783][ T5322] which belongs to the cache kmalloc-192 of size 192
[ 70.681425][ T5322] The buggy address is located 12 bytes inside of
[ 70.681425][ T5322] 176-byte region [ffff888042b0c400, ffff888042b0c4b0)
[ 70.686665][ T5322]
[ 70.687729][ T5322] The buggy address belongs to the physical page:
[ 70.690317][ T5322] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x42b0c
[ 70.693829][ T5322] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 70.696770][ T5322] page_type: f5(slab)
[ 70.698513][ T5322] raw: 04fff00000000000 ffff88801b0413c0 dead000000000122 0000000000000000
[ 70.702066][ T5322] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
[ 70.705543][ T5322] page dumped because: kasan: bad access detected
[ 70.708225][ T5322] page_owner tracks the page as allocated
[ 70.710555][ T5322] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5321, tgid 5321 (syz-executor), ts 68601441447, free_ts 68016183699
[ 70.718747][ T5322] post_alloc_hook+0x1f9/0x250
[ 70.720733][ T5322] get_page_from_freelist+0x21fa/0x2270
[ 70.723006][ T5322] __alloc_frozen_pages_noprof+0x18d/0x380
[ 70.725456][ T5322] allocate_slab+0x79/0x5e0
[ 70.727397][ T5322] refill_objects+0x2d5/0x350
[ 70.729446][ T5322] __pcs_replace_empty_main+0x2bf/0x6b0
[ 70.731701][ T5322] __kmalloc_flags_noprof+0x5be/0x800
[ 70.733886][ T5322] alloc_slab_obj_exts+0x4d/0x170
[ 70.735969][ T5322] __memcg_slab_post_alloc_hook+0x5d3/0xf10
[ 70.738422][ T5322] kmem_cache_alloc_lru_noprof+0x358/0x5f0
[ 70.740859][ T5322] __d_alloc+0x37/0x6f0
[ 70.742586][ T5322] d_alloc_parallel+0xde/0x16a0
[ 70.744655][ T5322] __lookup_slow+0x82/0x2f0
[ 70.746536][ T5322] lookup_slow+0x53/0x70
[ 70.748312][ T5322] link_path_walk+0x12a5/0x1910
[ 70.750315][ T5322] path_openat+0x236/0x3830
[ 70.752209][ T5322] page last free pid 5310 tgid 5310 stack trace:
[ 70.754843][ T5322] __free_frozen_pages+0xc1e/0xd10
[ 70.756948][ T5322] __slab_free+0x274/0x2c0
[ 70.758827][ T5322] qlist_free_all+0x99/0x100
[ 70.760781][ T5322] kasan_quarantine_reduce+0x148/0x160
[ 70.763041][ T5322] __kasan_slab_alloc+0x22/0x80
[ 70.765047][ T5322] kmem_cache_alloc_node_noprof+0x355/0x610
[ 70.767458][ T5322] __alloc_skb+0x1d7/0x7a0
[ 70.769346][ T5322] mld_newpack+0x165/0xcb0
[ 70.771203][ T5322] add_grec+0x119f/0x19d0
[ 70.773003][ T5322] mld_ifc_work+0x6f1/0xd60
[ 70.774890][ T5322] process_scheduled_works+0xa8e/0x14e0
[ 70.777199][ T5322] worker_thread+0xa47/0xfb0
[ 70.779102][ T5322] kthread+0x388/0x470
[ 70.780850][ T5322] ret_from_fork+0x514/0xb70
[ 70.782796][ T5322] ret_from_fork_asm+0x1a/0x30
[ 70.784775][ T5322]
[ 70.785795][ T5322] Memory state around the buggy address:
[ 70.788192][ T5322] ffff888042b0c300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 70.791456][ T5322] ffff888042b0c380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 70.794706][ T5322] >ffff888042b0c400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 70.797846][ T5322] ^
[ 70.799732][ T5322] ffff888042b0c480: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[ 70.803096][ T5322] ffff888042b0c500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 70.806358][ T5322] ==================================================================
[ 70.822380][ T5322] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 70.825418][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 70.829157][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 70.833243][ T5322] Call Trace:
[ 70.834635][ T5322]
[ 70.835960][ T5322] vpanic+0x56c/0xa60
[ 70.837674][ T5322] ? __pfx_vpanic+0x10/0x10
[ 70.839628][ T5322] ? __pfx___schedule+0x10/0x10
[ 70.841714][ T5322] panic+0xc5/0xd0
[ 70.843334][ T5322] ? __pfx_panic+0x10/0x10
[ 70.845309][ T5322] ? preempt_schedule_common+0x82/0xd0
[ 70.847614][ T5322] check_panic_on_warn+0x89/0xb0
[ 70.849747][ T5322] end_report+0x73/0x170
[ 70.851563][ T5322] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 70.853977][ T5322] kasan_report_invalid_free+0xfa/0x110
[ 70.856332][ T5322] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 70.858780][ T5322] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 70.861199][ T5322] __kasan_slab_pre_free+0x104/0x120
[ 70.863450][ T5322] kfree+0x173/0x640
[ 70.865098][ T5322] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 70.867563][ T5322] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 70.869921][ T5322] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 70.872521][ T5322] ? down_read+0x2be/0x330
[ 70.874404][ T5322] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 70.876950][ T5322] configfs_write_iter+0x337/0x430
[ 70.879084][ T5322] vfs_write+0x612/0xba0
[ 70.880817][ T5322] ? __pfx_vfs_write+0x10/0x10
[ 70.882807][ T5322] ? ktime_get+0x1f5/0x220
[ 70.884755][ T5322] ksys_write+0x150/0x270
[ 70.886569][ T5322] ? __pfx_ksys_write+0x10/0x10
[ 70.888589][ T5322] ? __secure_computing+0xe7/0x2b0
[ 70.890692][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 70.893221][ T5322] do_syscall_64+0x174/0x580
[ 70.895130][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 70.897658][ T5322] ? clear_bhb_loop+0x40/0x90
[ 70.899613][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 70.902074][ T5322] RIP: 0033:0x7fb255f9de99
[ 70.903986][ T5322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 70.911943][ T5322] RSP: 002b:00007fb256f3dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 70.915333][ T5322] RAX: ffffffffffffffda RBX: 00007fb256225fa0 RCX: 00007fb255f9de99
[ 70.918602][ T5322] RDX: 00000000000000d3 RSI: 0000200000000680 RDI: 0000000000000001
[ 70.921895][ T5322] RBP: 00007fb256033eaf R08: 0000000000000000 R09: 0000000000000000
[ 70.925248][ T5322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 70.928441][ T5322] R13: 00007fb256226038 R14: 00007fb256225fa0 R15: 00007fff77e818c8
[ 70.931680][ T5322]
[ 70.933361][ T5322] Kernel Offset: disabled
[ 70.935175][ T5322] Rebooting in 86400 seconds..