program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)="34343130302c34383030302c38383230302c39360ba21ce20a99a37015766b1bb722123b0c1b81395920ec200326a2090c590985f6399c147304d50a5ee6e417015a8b9912fbc2d52daaee2deb4fa86a968097d197f4b667c8b478a5196ff0d8b94a8fa30abeb0bb1b0f63b3b8ef1ec6b25c41724c129696d65fd28abc3e3d45e1975bf33d3c71d6a22ca2e69d918f1e8040fc80f9e60a792645a22b6564df07c9dab95b2178943880882c71da695cbaf06ca8b7c8d87270a362184b08c98a9cfb9d2842bb73b7fcc075f9ef15ff8f50ccc233ca", 0xd4)
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
[ 93.861345][ T5277] Bluetooth: hci0: command tx timeout
[ 93.970755][ T5318] ==================================================================
[ 93.974107][ T5318] BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x225/0x2b0
[ 93.978090][ T5318] Free of addr ffff88803f99f68a by task syz.0.0/5318
[ 93.981246][ T5318]
[ 93.982360][ T5318] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 93.982376][ T5318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 93.982383][ T5318] Call Trace:
[ 93.982390][ T5318]
[ 93.982396][ T5318] dump_stack_lvl+0xe8/0x150
[ 93.982417][ T5318] print_address_description+0x55/0x1e0
[ 93.982434][ T5318] print_report+0x58/0x70
[ 93.982447][ T5318] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 93.982460][ T5318] kasan_report_invalid_free+0xea/0x110
[ 93.982475][ T5318] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 93.982488][ T5318] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 93.982501][ T5318] __kasan_slab_pre_free+0x104/0x120
[ 93.982515][ T5318] kfree+0x173/0x640
[ 93.982531][ T5318] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 93.982544][ T5318] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 93.982557][ T5318] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 93.982571][ T5318] ? down_read+0x2be/0x330
[ 93.982585][ T5318] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 93.982597][ T5318] configfs_write_iter+0x337/0x430
[ 93.982613][ T5318] vfs_write+0x612/0xba0
[ 93.982631][ T5318] ? __pfx_vfs_write+0x10/0x10
[ 93.982647][ T5318] ? __fget_files+0x2a/0x420
[ 93.982660][ T5318] ksys_write+0x150/0x270
[ 93.982675][ T5318] ? __pfx_ksys_write+0x10/0x10
[ 93.982691][ T5318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.982702][ T5318] do_syscall_64+0x174/0x580
[ 93.982714][ T5318] ? trace_irq_disable+0x3b/0x140
[ 93.982728][ T5318] ? clear_bhb_loop+0x70/0xc0
[ 93.982740][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.982751][ T5318] RIP: 0033:0x7f266199e0d9
[ 93.982763][ T5318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 93.982773][ T5318] RSP: 002b:00007f266279ffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 93.982786][ T5318] RAX: ffffffffffffffda RBX: 00007f2661c25fa0 RCX: 00007f266199e0d9
[ 93.982794][ T5318] RDX: 00000000000000d4 RSI: 0000200000000280 RDI: 0000000000000003
[ 93.982802][ T5318] RBP: 00007f2661a35024 R08: 0000000000000000 R09: 0000000000000000
[ 93.982810][ T5318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 93.982817][ T5318] R13: 00007f2661c26038 R14: 00007f2661c25fa0 R15: 00007ffe3d164ae8
[ 93.982829][ T5318]
[ 93.982833][ T5318]
[ 94.080809][ T5318] Allocated by task 5318:
[ 94.082618][ T5318] kasan_save_track+0x3e/0x80
[ 94.084398][ T5318] __kasan_kmalloc+0x93/0xb0
[ 94.086477][ T5318] __kmalloc_node_track_caller_noprof+0x4c3/0x730
[ 94.089257][ T5318] kstrdup+0x42/0x100
[ 94.091034][ T5318] f_uac2_opts_p_srate_store+0x11f/0x2b0
[ 94.093422][ T5318] configfs_write_iter+0x337/0x430
[ 94.095698][ T5318] vfs_write+0x612/0xba0
[ 94.097472][ T5318] ksys_write+0x150/0x270
[ 94.099332][ T5318] do_syscall_64+0x174/0x580
[ 94.101327][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.103825][ T5318]
[ 94.104856][ T5318] The buggy address belongs to the object at ffff88803f99f600
[ 94.104856][ T5318] which belongs to the cache kmalloc-256 of size 256
[ 94.110396][ T5318] The buggy address is located 138 bytes inside of
[ 94.110396][ T5318] 213-byte region [ffff88803f99f600, ffff88803f99f6d5)
[ 94.115974][ T5318]
[ 94.117130][ T5318] The buggy address belongs to the physical page:
[ 94.120315][ T5318] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3f99f
[ 94.124472][ T5318] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 94.127816][ T5318] page_type: f5(slab)
[ 94.130041][ T5318] raw: 04fff00000000000 ffff88801b041b40 dead000000000122 0000000000000000
[ 94.133993][ T5318] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[ 94.137667][ T5318] page dumped because: kasan: bad access detected
[ 94.140389][ T5318] page_owner tracks the page as allocated
[ 94.142816][ T5318] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5276, tgid 5276 (syz-executor), ts 91922291437, free_ts 91912455424
[ 94.150999][ T5318] post_alloc_hook+0x1f9/0x250
[ 94.152978][ T5318] get_page_from_freelist+0x21fa/0x2270
[ 94.155268][ T5318] __alloc_frozen_pages_noprof+0x18d/0x380
[ 94.157760][ T5318] allocate_slab+0x79/0x5e0
[ 94.159646][ T5318] refill_objects+0x2d5/0x350
[ 94.161679][ T5318] __pcs_replace_empty_main+0x2bf/0x6b0
[ 94.163776][ T5318] __kmalloc_cache_noprof+0x3a7/0x660
[ 94.166017][ T5318] ____ip_mc_inc_group+0x518/0xdb0
[ 94.168083][ T5318] ip_mc_up+0x115/0x2e0
[ 94.169776][ T5318] inetdev_event+0xfca/0x15e0
[ 94.171697][ T5318] notifier_call_chain+0x1a5/0x3d0
[ 94.173866][ T5318] __dev_notify_flags+0x1aa/0x310
[ 94.175956][ T5318] netif_change_flags+0xde/0x1b0
[ 94.178080][ T5318] dev_change_flags+0x128/0x260
[ 94.180044][ T5318] devinet_ioctl+0x966/0x1c50
[ 94.182020][ T5318] inet_ioctl+0x42a/0x560
[ 94.183885][ T5318] page last free pid 15 tgid 15 stack trace:
[ 94.186354][ T5318] __free_frozen_pages+0xc1e/0xd10
[ 94.188360][ T5318] rcu_core+0x78b/0x10a0
[ 94.190094][ T5318] handle_softirqs+0x225/0x840
[ 94.192058][ T5318] run_ksoftirqd+0x36/0x60
[ 94.193945][ T5318] smpboot_thread_fn+0x57c/0xa80
[ 94.195999][ T5318] kthread+0x388/0x470
[ 94.197746][ T5318] ret_from_fork+0x514/0xb70
[ 94.199684][ T5318] ret_from_fork_asm+0x1a/0x30
[ 94.201657][ T5318]
[ 94.202611][ T5318] Memory state around the buggy address:
[ 94.204869][ T5318] ffff88803f99f580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.208664][ T5318] ffff88803f99f600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 94.212546][ T5318] >ffff88803f99f680: 00 00 00 00 00 00 00 00 00 00 05 fc fc fc fc fc
[ 94.215949][ T5318] ^
[ 94.217819][ T5318] ffff88803f99f700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.221112][ T5318] ffff88803f99f780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.224468][ T5318] ==================================================================
[ 94.263966][ T5318] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 94.267021][ T5318] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.270665][ T5318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.274920][ T5318] Call Trace:
[ 94.276331][ T5318]
[ 94.277657][ T5318] vpanic+0x56c/0xa60
[ 94.279394][ T5318] ? __pfx_vpanic+0x10/0x10
[ 94.281354][ T5318] ? __pfx___schedule+0x10/0x10
[ 94.283515][ T5318] panic+0xc5/0xd0
[ 94.285098][ T5318] ? __pfx_panic+0x10/0x10
[ 94.286974][ T5318] ? preempt_schedule_common+0x82/0xd0
[ 94.289205][ T5318] check_panic_on_warn+0x89/0xb0
[ 94.291334][ T5318] end_report+0x73/0x170
[ 94.293165][ T5318] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.295655][ T5318] kasan_report_invalid_free+0xfa/0x110
[ 94.297996][ T5318] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.300398][ T5318] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.302942][ T5318] __kasan_slab_pre_free+0x104/0x120
[ 94.305156][ T5318] kfree+0x173/0x640
[ 94.306840][ T5318] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.309171][ T5318] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.311492][ T5318] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 94.314019][ T5318] ? down_read+0x2be/0x330
[ 94.315784][ T5318] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 94.318436][ T5318] configfs_write_iter+0x337/0x430
[ 94.320650][ T5318] vfs_write+0x612/0xba0
[ 94.322527][ T5318] ? __pfx_vfs_write+0x10/0x10
[ 94.324577][ T5318] ? __fget_files+0x2a/0x420
[ 94.326623][ T5318] ksys_write+0x150/0x270
[ 94.328521][ T5318] ? __pfx_ksys_write+0x10/0x10
[ 94.330618][ T5318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.333228][ T5318] do_syscall_64+0x174/0x580
[ 94.335317][ T5318] ? trace_irq_disable+0x3b/0x140
[ 94.337564][ T5318] ? clear_bhb_loop+0x70/0xc0
[ 94.339664][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.342243][ T5318] RIP: 0033:0x7f266199e0d9
[ 94.344138][ T5318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.352027][ T5318] RSP: 002b:00007f266279ffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 94.355319][ T5318] RAX: ffffffffffffffda RBX: 00007f2661c25fa0 RCX: 00007f266199e0d9
[ 94.358587][ T5318] RDX: 00000000000000d4 RSI: 0000200000000280 RDI: 0000000000000003
[ 94.361758][ T5318] RBP: 00007f2661a35024 R08: 0000000000000000 R09: 0000000000000000
[ 94.364703][ T5318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.367951][ T5318] R13: 00007f2661c26038 R14: 00007f2661c25fa0 R15: 00007ffe3d164ae8
[ 94.371237][ T5318]
[ 94.372850][ T5318] Kernel Offset: disabled
[ 94.374768][ T5318] Rebooting in 86400 seconds..