program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x50, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}]}, 0x50}}, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_LIST(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x1c, 0x7, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x1c}}, 0x0)
recvmmsg(r2, &(0x7f0000002680)=[{{0x0, 0x0, &(0x7f0000002780)=[{&(0x7f00000002c0)=""/127, 0x7f}, {&(0x7f00000004c0)=""/253, 0xfd}, {&(0x7f0000000440)=""/96, 0x60}, {&(0x7f0000002280)=""/176, 0xb0}, {&(0x7f0000000800)=""/4110, 0x100e}], 0x5}, 0x1}], 0x1, 0x20, 0x0)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r3, &(0x7f0000000280)="34346b30302c3438302c302c38383230302c399e04e682ca60e07000f76f22bf03de34d60698e11f968cb1395d0e58e594bbdc2f38b9b7bf99980473c8362c41e60d772720c31a97aa2a6b3509d1df2144b09a1309713903c1864919f28d6938b9fe32c9421db6423d67efb64ff1c86370888cbec00320bf260dc03370d395a660853463b297733f82a9cc5ed4d099bd29e6537b547e2c6b0d87cf01b1decc800e0e6148dec91c", 0x99)
symlinkat(&(0x7f0000000500)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./myconfig/usb_gadget/g1/UDC\x00', 0x1, 0x0)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="44000000100001060000000000000000000000000000000001000000010000000e00030076736f636b6d6f6e30000000140012800d00010076736f636b6d6f6e000000"], 0x44}}, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="30000000110001000000000000000000000000000000000000000000000000000e00030076736f636b6d6f6e30000000"], 0x30}}, 0x0)
write(r4, &(0x7f00000005c0)='usbip-vudc.0', 0xc)

[   75.796635][ T4642] Bluetooth: hci0: command tx timeout
[   76.089458][ T5316] ==================================================================
[   76.093550][ T5316] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0
[   76.096967][ T5316] Free of addr ffff88803663de06 by task syz.0.0/5316
[   76.099665][ T5316] 
[   76.100730][ T5316] CPU: 0 UID: 0 PID: 5316 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
[   76.100748][ T5316] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   76.100756][ T5316] Call Trace:
[   76.100764][ T5316]  <TASK>
[   76.100771][ T5316]  dump_stack_lvl+0xe8/0x150
[   76.100793][ T5316]  print_address_description+0x55/0x1e0
[   76.100809][ T5316]  print_report+0x58/0x70
[   76.100824][ T5316]  ? f_uac2_opts_c_srate_store+0x225/0x2b0
[   76.100840][ T5316]  kasan_report_invalid_free+0xea/0x110
[   76.100857][ T5316]  ? f_uac2_opts_c_srate_store+0x225/0x2b0
[   76.100870][ T5316]  ? f_uac2_opts_c_srate_store+0x225/0x2b0
[   76.100883][ T5316]  __kasan_slab_pre_free+0x104/0x120
[   76.100897][ T5316]  kfree+0x173/0x640
[   76.100913][ T5316]  ? f_uac2_opts_c_srate_store+0x225/0x2b0
[   76.100925][ T5316]  f_uac2_opts_c_srate_store+0x225/0x2b0
[   76.100938][ T5316]  ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[   76.100952][ T5316]  ? down_read+0x2be/0x330
[   76.100967][ T5316]  ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[   76.100980][ T5316]  configfs_write_iter+0x337/0x430
[   76.100998][ T5316]  vfs_write+0x612/0xba0
[   76.101016][ T5316]  ? __pfx_vfs_write+0x10/0x10
[   76.101033][ T5316]  ? __fget_files+0x2a/0x420
[   76.101048][ T5316]  ksys_write+0x150/0x270
[   76.101063][ T5316]  ? __pfx_ksys_write+0x10/0x10
[   76.101079][ T5316]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   76.101091][ T5316]  do_syscall_64+0x174/0x580
[   76.101104][ T5316]  ? trace_irq_disable+0x3b/0x140
[   76.101117][ T5316]  ? clear_bhb_loop+0x70/0xc0
[   76.101161][ T5316]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   76.101174][ T5316] RIP: 0033:0x7fa98379e0d9
[   76.101189][ T5316] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[   76.101199][ T5316] RSP: 002b:00007fa9845b3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[   76.101214][ T5316] RAX: ffffffffffffffda RBX: 00007fa983a26270 RCX: 00007fa98379e0d9
[   76.101223][ T5316] RDX: 0000000000000099 RSI: 0000200000000280 RDI: 0000000000000006
[   76.101231][ T5316] RBP: 00007fa983835024 R08: 0000000000000000 R09: 0000000000000000
[   76.101239][ T5316] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   76.101247][ T5316] R13: 00007fa983a26308 R14: 00007fa983a26270 R15: 00007ffd6f1459a8
[   76.101258][ T5316]  </TASK>
[   76.101263][ T5316] 
[   76.193377][ T5316] Allocated by task 5316:
[   76.195075][ T5316]  kasan_save_track+0x3e/0x80
[   76.196998][ T5316]  __kasan_kmalloc+0x93/0xb0
[   76.198801][ T5316]  __kmalloc_node_track_caller_noprof+0x4c3/0x730
[   76.201364][ T5316]  kstrdup+0x42/0x100
[   76.202976][ T5316]  f_uac2_opts_c_srate_store+0x11f/0x2b0
[   76.205268][ T5316]  configfs_write_iter+0x337/0x430
[   76.207369][ T5316]  vfs_write+0x612/0xba0
[   76.209182][ T5316]  ksys_write+0x150/0x270
[   76.210997][ T5316]  do_syscall_64+0x174/0x580
[   76.212905][ T5316]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   76.215260][ T5316] 
[   76.216277][ T5316] The buggy address belongs to the object at ffff88803663de00
[   76.216277][ T5316]  which belongs to the cache kmalloc-32 of size 32
[   76.221842][ T5316] The buggy address is located 6 bytes inside of
[   76.221842][ T5316]  28-byte region [ffff88803663de00, ffff88803663de1c)
[   76.226899][ T5316] 
[   76.227857][ T5316] The buggy address belongs to the physical page:
[   76.230387][ T5316] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803663d7c0 pfn:0x3663d
[   76.234215][ T5316] flags: 0x4fff00000000200(workingset|node=1|zone=1|lastcpupid=0x7ff)
[   76.237301][ T5316] page_type: f5(slab)
[   76.238897][ T5316] raw: 04fff00000000200 ffff88801b041780 ffffea0000cce390 ffffea00010d7510
[   76.242226][ T5316] raw: ffff88803663d7c0 000000080040003f 00000000f5000000 0000000000000000
[   76.245615][ T5316] page dumped because: kasan: bad access detected
[   76.248074][ T5316] page_owner tracks the page as allocated
[   76.250284][ T5316] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1531, tgid 1531 (kworker/u4:3), ts 14448868067, free_ts 14448493223
[   76.257802][ T5316]  post_alloc_hook+0x1f9/0x250
[   76.259789][ T5316]  get_page_from_freelist+0x21fa/0x2270
[   76.262044][ T5316]  __alloc_frozen_pages_noprof+0x18d/0x380
[   76.264343][ T5316]  allocate_slab+0x79/0x5e0
[   76.266174][ T5316]  refill_objects+0x2d5/0x350
[   76.268040][ T5316]  __pcs_replace_empty_main+0x2bf/0x6b0
[   76.270202][ T5316]  __kmalloc_cache_noprof+0x3a7/0x660
[   76.272191][ T5316]  kmem_cache_free+0x156/0x650
[   76.273905][ T5316]  release_task+0xfc5/0x16c0
[   76.275784][ T5316]  do_exit+0x168c/0x2360
[   76.277494][ T5316]  call_usermodehelper_exec_async+0x357/0x360
[   76.279843][ T5316]  ret_from_fork+0x514/0xb70
[   76.281667][ T5316]  ret_from_fork_asm+0x1a/0x30
[   76.283486][ T5316] page last free pid 42 tgid 42 stack trace:
[   76.285719][ T5316]  __free_frozen_pages+0xc1e/0xd10
[   76.287829][ T5316]  __kasan_populate_vmalloc+0x1a8/0x1c0
[   76.290109][ T5316]  alloc_vmap_area+0xd1a/0x1420
[   76.292112][ T5316]  __get_vm_area_node+0x1f2/0x300
[   76.294065][ T5316]  __vmalloc_node_range_noprof+0x358/0x1730
[   76.296316][ T5316]  __vmalloc_node_noprof+0xc2/0x100
[   76.298431][ T5316]  dup_task_struct+0x2a0/0x8e0
[   76.300399][ T5316]  copy_process+0x820/0x4390
[   76.302244][ T5316]  kernel_clone+0x2d7/0x940
[   76.304136][ T5316]  user_mode_thread+0x110/0x180
[   76.306154][ T5316]  call_usermodehelper_exec_work+0x5c/0x230
[   76.308564][ T5316]  process_scheduled_works+0xa8e/0x14e0
[   76.311007][ T5316]  worker_thread+0xa47/0xfb0
[   76.312981][ T5316]  kthread+0x388/0x470
[   76.314710][ T5316]  ret_from_fork+0x514/0xb70
[   76.316709][ T5316]  ret_from_fork_asm+0x1a/0x30
[   76.318719][ T5316] 
[   76.319785][ T5316] Memory state around the buggy address:
[   76.322128][ T5316]  ffff88803663dd00: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc
[   76.324891][ T5316]  ffff88803663dd80: 00 00 00 01 fc fc fc fc 00 00 00 fc fc fc fc fc
[   76.327894][ T5316] >ffff88803663de00: 00 00 00 04 fc fc fc fc 00 00 00 00 fc fc fc fc
[   76.331178][ T5316]                    ^
[   76.332681][ T5316]  ffff88803663de80: 00 00 00 00 fc fc fc fc 00 00 00 fc fc fc fc fc
[   76.335636][ T5316]  ffff88803663df00: 00 00 00 00 fc fc fc fc fa fb fb fb fc fc fc fc
[   76.338585][ T5316] ==================================================================
[   76.346685][ T1324] ieee802154 phy0 wpan0: encryption failed: -22
[   76.349379][ T1324] ieee802154 phy1 wpan1: encryption failed: -22
[   76.730094][ T5316] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   76.733740][ T5316] CPU: 0 UID: 0 PID: 5316 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
[   76.737564][ T5316] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   76.741845][ T5316] Call Trace:
[   76.743318][ T5316]  <TASK>
[   76.744644][ T5316]  vpanic+0x56c/0xa60
[   76.746439][ T5316]  ? __pfx_vpanic+0x10/0x10
[   76.748417][ T5316]  ? __pfx___schedule+0x10/0x10
[   76.750646][ T5316]  panic+0xc5/0xd0
[   76.752273][ T5316]  ? __pfx_panic+0x10/0x10
[   76.754067][ T5316]  ? preempt_schedule_common+0x82/0xd0
[   76.756231][ T5316]  check_panic_on_warn+0x89/0xb0
[   76.758294][ T5316]  end_report+0x73/0x170
[   76.760060][ T5316]  ? f_uac2_opts_c_srate_store+0x225/0x2b0
[   76.762426][ T5316]  kasan_report_invalid_free+0xfa/0x110
[   76.764610][ T5316]  ? f_uac2_opts_c_srate_store+0x225/0x2b0
[   76.767113][ T5316]  ? f_uac2_opts_c_srate_store+0x225/0x2b0
[   76.769623][ T5316]  __kasan_slab_pre_free+0x104/0x120
[   76.771899][ T5316]  kfree+0x173/0x640
[   76.773616][ T5316]  ? f_uac2_opts_c_srate_store+0x225/0x2b0
[   76.776145][ T5316]  f_uac2_opts_c_srate_store+0x225/0x2b0
[   76.778452][ T5316]  ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[   76.780898][ T5316]  ? down_read+0x2be/0x330
[   76.782796][ T5316]  ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[   76.785360][ T5316]  configfs_write_iter+0x337/0x430
[   76.787594][ T5316]  vfs_write+0x612/0xba0
[   76.789458][ T5316]  ? __pfx_vfs_write+0x10/0x10
[   76.791574][ T5316]  ? __fget_files+0x2a/0x420
[   76.793606][ T5316]  ksys_write+0x150/0x270
[   76.795517][ T5316]  ? __pfx_ksys_write+0x10/0x10
[   76.797810][ T5316]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   76.800458][ T5316]  do_syscall_64+0x174/0x580
[   76.802500][ T5316]  ? trace_irq_disable+0x3b/0x140
[   76.804702][ T5316]  ? clear_bhb_loop+0x70/0xc0
[   76.806805][ T5316]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   76.809357][ T5316] RIP: 0033:0x7fa98379e0d9
[   76.811338][ T5316] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[   76.818729][ T5316] RSP: 002b:00007fa9845b3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[   76.822031][ T5316] RAX: ffffffffffffffda RBX: 00007fa983a26270 RCX: 00007fa98379e0d9
[   76.825235][ T5316] RDX: 0000000000000099 RSI: 0000200000000280 RDI: 0000000000000006
[   76.828423][ T5316] RBP: 00007fa983835024 R08: 0000000000000000 R09: 0000000000000000
[   76.831546][ T5316] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   76.834510][ T5316] R13: 00007fa983a26308 R14: 00007fa983a26270 R15: 00007ffd6f1459a8
[   76.837405][ T5316]  </TASK>
[   76.838944][ T5316] Kernel Offset: disabled
[   76.840664][ T5316] Rebooting in 86400 seconds..