program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12013f00000000407f04ffff00000000000109022d000100000000090400001503000000092140000001220f00090581", @ANYRES8], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, &(0x7f0000000b00)={0x2c, &(0x7f0000000440)=ANY=[@ANYBLOB="00000f02000009013dfc0e3c369197d09647190890"], 0x0, 0x0, 0x0, 0x0}, 0x0)
r1 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0)
ioctl$HIDIOCGUSAGE(r1, 0x501c4814, &(0x7f0000000000)={0x2, 0xffffffff, 0x2, 0x401, 0x0, 0xfffffffc})
r2 = socket$rds(0x15, 0x5, 0x0)
bind$rds(r2, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10)
sendmsg$rds(r2, &(0x7f00000009c0)={&(0x7f0000000540)={0x2, 0x0, @loopback}, 0x10, &(0x7f0000000900)=[{&(0x7f0000000580)=""/149, 0x100000}], 0x1, &(0x7f0000005d40)=[@rdma_args={0x48, 0x114, 0x1, {{}, {0x0}, &(0x7f00000002c0)=[{&(0x7f0000005cc0)=""/78, 0x4e}], 0x1}}], 0x48}, 0x0)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
sendmsg$rds(r2, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000080)=""/129, 0x81}], 0x1, &(0x7f0000000680)=[@fadd={0x58, 0x114, 0x6, {{0x1, 0x7}, &(0x7f0000000280)=0xe7, &(0x7f0000000300)=0x1ff, 0x8000000000000, 0xfffffffffffffffe, 0xfffffffffffffe00, 0x9, 0x0, 0x81}}, @zcopy_cookie={0x18, 0x114, 0xc, 0x1099}, @mask_cswp={0x58, 0x114, 0x9, {{0x3ff, 0x1}, &(0x7f0000000340)=0xc8, &(0x7f0000000480)=0x6, 0x100, 0xa7fe, 0x101, 0xec, 0x7d, 0x35}}, @rdma_dest={0x18, 0x114, 0x2, {0x8, 0x4}}], 0xe0, 0x10}, 0x4040080)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c)
listen(r3, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000080)={@in6={{0xa, 0x4e24, 0x8000, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x1}}, 0x0, 0x0, 0x3, 0x0, "9ecf3315567f14d56a87d134cc409e2a652dbbf6c50480937c6fa85af81bc6fc54b71f03985ac33e31d612d976a6efcda8853b8a4430503621f06679995d916cb4361795dd7dbae51d07384b7c2e6949"}, 0xd8)
syz_emit_ethernet(0x5e, &(0x7f00000009c0)={@local, @dev, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00@\x00', 0x28, 0x6, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @local, {[], {{0x4e24, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, {[@md5sig={0x13, 0x12, "d4c466fb19f71e96642faa2300"}]}}}}}}}}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0)
ioctl$FS_IOC_GETFSMAP(r4, 0xc0c0583b, &(0x7f0000000240)={0x0, 0x2904c, 0x0, 0x10003, '\x00', [{0x700, 0xb6, 0x200000, 0x5800000004}, {0x700, 0x0, 0x8000000000000}]})
mkdirat(r4, &(0x7f00000004c0)='./myconfig/usb_gadget/g1\x00', 0x1df)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r5, &(0x7f0000000440)="3434f0c959ed635964b6302c38383230302c3936303044bdb783fcff31452c3139323015a5200667187630302c3335323830302c33", 0x35)
symlinkat(&(0x7f0000000580)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00')
r6 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./myconfig/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r6, &(0x7f0000000640)='usbip-vudc.0', 0xc)
perf_event_open(&(0x7f0000000000)={0x7, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x90900, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x89}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
[ 146.802506][ T4647] Bluetooth: hci0: command tx timeout
[ 147.071375][ T5305] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 147.224130][ T5305] usb 5-1: config index 0 descriptor too short (expected 45, got 36)
[ 147.227508][ T5305] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 147.231889][ T5305] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[ 147.235820][ T5305] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[ 147.240419][ T5305] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[ 147.244428][ T5305] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 147.254580][ T5305] usb 5-1: config 0 descriptor??
[ 147.674738][ T5305] plantronics 0003:047F:FFFF.0002: reserved main item tag 0xd
[ 147.697433][ T5305] plantronics 0003:047F:FFFF.0002: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0
[ 147.948182][ T5318] ==================================================================
[ 147.951237][ T5318] BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x225/0x2b0
[ 147.954163][ T5318] Free of addr ffff88801262368c by task syz.0.0/5318
[ 147.956437][ T5318]
[ 147.957358][ T5318] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 147.957369][ T5318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 147.957375][ T5318] Call Trace:
[ 147.957382][ T5318]
[ 147.957387][ T5318] dump_stack_lvl+0xe8/0x150
[ 147.957407][ T5318] print_address_description+0x55/0x1e0
[ 147.957423][ T5318] print_report+0x58/0x70
[ 147.957436][ T5318] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 147.957449][ T5318] kasan_report_invalid_free+0xea/0x110
[ 147.957462][ T5318] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 147.957471][ T5318] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 147.957479][ T5318] __kasan_slab_pre_free+0x104/0x120
[ 147.957487][ T5318] kfree+0x173/0x640
[ 147.957493][ T5318] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 147.957501][ T5318] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 147.957509][ T5318] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 147.957517][ T5318] ? down_read+0x2be/0x330
[ 147.957525][ T5318] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 147.957533][ T5318] configfs_write_iter+0x337/0x430
[ 147.957543][ T5318] vfs_write+0x612/0xba0
[ 147.957553][ T5318] ? __pfx_vfs_write+0x10/0x10
[ 147.957563][ T5318] ? __fget_files+0x2a/0x420
[ 147.957572][ T5318] ksys_write+0x150/0x270
[ 147.957581][ T5318] ? __pfx_ksys_write+0x10/0x10
[ 147.957591][ T5318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 147.957598][ T5318] do_syscall_64+0x174/0x580
[ 147.957607][ T5318] ? trace_irq_disable+0x3b/0x140
[ 147.957617][ T5318] ? clear_bhb_loop+0x40/0x90
[ 147.957624][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 147.957631][ T5318] RIP: 0033:0x7f071439de99
[ 147.957639][ T5318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 147.957645][ T5318] RSP: 002b:00007f071521bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 147.957654][ T5318] RAX: ffffffffffffffda RBX: 00007f0714625fa0 RCX: 00007f071439de99
[ 147.957660][ T5318] RDX: 0000000000000035 RSI: 0000200000000440 RDI: 0000000000000008
[ 147.957664][ T5318] RBP: 00007f0714433eaf R08: 0000000000000000 R09: 0000000000000000
[ 147.957669][ T5318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 147.957674][ T5318] R13: 00007f0714626038 R14: 00007f0714625fa0 R15: 00007ffd6eed0308
[ 147.957683][ T5318]
[ 147.957685][ T5318]
[ 148.044734][ T5318] Allocated by task 5318:
[ 148.046449][ T5318] kasan_save_track+0x3e/0x80
[ 148.048377][ T5318] __kasan_kmalloc+0x93/0xb0
[ 148.050087][ T5318] __kmalloc_node_track_caller_noprof+0x4c3/0x730
[ 148.052188][ T5318] kstrdup+0x42/0x100
[ 148.053533][ T5318] f_uac2_opts_p_srate_store+0x11f/0x2b0
[ 148.055355][ T5318] configfs_write_iter+0x337/0x430
[ 148.057078][ T5318] vfs_write+0x612/0xba0
[ 148.058519][ T5318] ksys_write+0x150/0x270
[ 148.060021][ T5318] do_syscall_64+0x174/0x580
[ 148.061592][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 148.063603][ T5318]
[ 148.064445][ T5318] The buggy address belongs to the object at ffff888012623680
[ 148.064445][ T5318] which belongs to the cache kmalloc-64 of size 64
[ 148.069008][ T5318] The buggy address is located 12 bytes inside of
[ 148.069008][ T5318] 54-byte region [ffff888012623680, ffff8880126236b6)
[ 148.073446][ T5318]
[ 148.074319][ T5318] The buggy address belongs to the physical page:
[ 148.076535][ T5318] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12623
[ 148.079536][ T5318] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 148.081874][ T5318] page_type: f5(slab)
[ 148.083220][ T5318] raw: 00fff00000000000 ffff88801b0418c0 dead000000000100 dead000000000122
[ 148.086173][ T5318] raw: 0000000000000000 0000000800200020 00000000f5000000 0000000000000000
[ 148.089285][ T5318] page dumped because: kasan: bad access detected
[ 148.091672][ T5318] page_owner tracks the page as allocated
[ 148.093992][ T5318] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5281, tgid 5281 (syz-executor), ts 143273116300, free_ts 60712961598
[ 148.101124][ T5318] post_alloc_hook+0x1f9/0x250
[ 148.102855][ T5318] get_page_from_freelist+0x21fa/0x2270
[ 148.104859][ T5318] __alloc_frozen_pages_noprof+0x18d/0x380
[ 148.106934][ T5318] allocate_slab+0x79/0x5e0
[ 148.108563][ T5318] refill_objects+0x2d5/0x350
[ 148.110263][ T5318] __pcs_replace_empty_main+0x2bf/0x6b0
[ 148.112222][ T5318] __kmalloc_noprof+0x485/0x720
[ 148.113972][ T5318] kobject_get_path+0xc5/0x2f0
[ 148.115622][ T5318] kobject_uevent_env+0x29e/0x9e0
[ 148.117388][ T5318] net_rx_queue_update_kobjects+0x3fe/0x780
[ 148.119446][ T5318] netdev_register_kobject+0x21f/0x310
[ 148.121292][ T5318] register_netdevice+0x1433/0x1eb0
[ 148.123104][ T5318] veth_newlink+0x676/0xb70
[ 148.124772][ T5318] rtnl_newlink_create+0x310/0xb00
[ 148.126504][ T5318] rtnl_newlink+0x167f/0x1bd0
[ 148.128099][ T5318] rtnetlink_rcv_msg+0x802/0xc00
[ 148.129840][ T5318] page last free pid 4698 tgid 4698 stack trace:
[ 148.132097][ T5318] __free_frozen_pages+0xc1e/0xd10
[ 148.133956][ T5318] __slab_free+0x274/0x2c0
[ 148.135496][ T5318] qlist_free_all+0x99/0x100
[ 148.137175][ T5318] kasan_quarantine_reduce+0x148/0x160
[ 148.139077][ T5318] __kasan_slab_alloc+0x22/0x80
[ 148.140754][ T5318] kmem_cache_alloc_noprof+0x2a0/0x5f0
[ 148.142736][ T5318] do_getname+0x2e/0x250
[ 148.144567][ T5318] do_readlinkat+0xc8/0x510
[ 148.146436][ T5318] __x64_sys_readlink+0x7f/0x90
[ 148.148388][ T5318] do_syscall_64+0x174/0x580
[ 148.150333][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 148.152588][ T5318]
[ 148.153515][ T5318] Memory state around the buggy address:
[ 148.155635][ T5318] ffff888012623580: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[ 148.159070][ T5318] ffff888012623600: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
[ 148.162458][ T5318] >ffff888012623680: 00 00 00 00 00 00 06 fc fc fc fc fc fc fc fc fc
[ 148.165844][ T5318] ^
[ 148.167690][ T5318] ffff888012623700: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 148.171632][ T5318] ffff888012623780: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 148.174740][ T5318] ==================================================================
[ 148.216972][ T5319] Need at least one configuration in g1.
[ 148.232855][ T5318] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 148.235993][ T5318] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 148.239563][ T5318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 148.243446][ T5318] Call Trace:
[ 148.244848][ T5318]
[ 148.246143][ T5318] vpanic+0x56c/0xa60
[ 148.247895][ T5318] ? __pfx_vpanic+0x10/0x10
[ 148.249737][ T5318] ? __pfx___schedule+0x10/0x10
[ 148.251780][ T5318] panic+0xc5/0xd0
[ 148.253404][ T5318] ? __pfx_panic+0x10/0x10
[ 148.255145][ T5318] ? preempt_schedule_common+0x82/0xd0
[ 148.257468][ T5318] check_panic_on_warn+0x89/0xb0
[ 148.259614][ T5318] end_report+0x73/0x170
[ 148.261448][ T5318] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 148.263931][ T5318] kasan_report_invalid_free+0xfa/0x110
[ 148.266262][ T5318] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 148.268747][ T5318] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 148.271310][ T5318] __kasan_slab_pre_free+0x104/0x120
[ 148.273816][ T5318] kfree+0x173/0x640
[ 148.275353][ T5318] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 148.277663][ T5318] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 148.279954][ T5318] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 148.282413][ T5318] ? down_read+0x2be/0x330
[ 148.284234][ T5318] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 148.286900][ T5318] configfs_write_iter+0x337/0x430
[ 148.289135][ T5318] vfs_write+0x612/0xba0
[ 148.290999][ T5318] ? __pfx_vfs_write+0x10/0x10
[ 148.293070][ T5318] ? __fget_files+0x2a/0x420
[ 148.295063][ T5318] ksys_write+0x150/0x270
[ 148.296945][ T5318] ? __pfx_ksys_write+0x10/0x10
[ 148.298917][ T5318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 148.301201][ T5318] do_syscall_64+0x174/0x580
[ 148.302961][ T5318] ? trace_irq_disable+0x3b/0x140
[ 148.304888][ T5318] ? clear_bhb_loop+0x40/0x90
[ 148.306939][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 148.309454][ T5318] RIP: 0033:0x7f071439de99
[ 148.311361][ T5318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 148.318561][ T5318] RSP: 002b:00007f071521bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 148.321691][ T5318] RAX: ffffffffffffffda RBX: 00007f0714625fa0 RCX: 00007f071439de99
[ 148.324996][ T5318] RDX: 0000000000000035 RSI: 0000200000000440 RDI: 0000000000000008
[ 148.328196][ T5318] RBP: 00007f0714433eaf R08: 0000000000000000 R09: 0000000000000000
[ 148.331332][ T5318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 148.334619][ T5318] R13: 00007f0714626038 R14: 00007f0714625fa0 R15: 00007ffd6eed0308
[ 148.337764][ T5318]
[ 148.339261][ T5318] Kernel Offset: disabled
[ 148.340821][ T5318] Rebooting in 86400 seconds..