program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)="34e09e30e1b357c4ffae0a302c34383030302c38383230302c39363030302c31373634303c2cfc70ba313907000000000000003830302c3338343030302c378b8ad5e7010000000000000071f47720ce56eb18aa1c811a3489fa816e7790d26f680210f4a16057f6708d5ba8a203b1355803e08ade02a81b495f804ea23c73eb5cf3c10a57b6b1e28031ecb579498df0ee2699", 0x7a)
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
[ 94.391586][ T4635] Bluetooth: hci0: command tx timeout
[ 94.506401][ T5305] ==================================================================
[ 94.509690][ T5305] BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.513147][ T5305] Free of addr ffff888012e1d60d by task syz.0.0/5305
[ 94.516005][ T5305]
[ 94.517303][ T5305] CPU: 0 UID: 0 PID: 5305 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.517319][ T5305] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.517327][ T5305] Call Trace:
[ 94.517334][ T5305]
[ 94.517339][ T5305] dump_stack_lvl+0xe8/0x150
[ 94.517362][ T5305] print_address_description+0x55/0x1e0
[ 94.517380][ T5305] print_report+0x58/0x70
[ 94.517396][ T5305] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.517412][ T5305] kasan_report_invalid_free+0xea/0x110
[ 94.517429][ T5305] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.517441][ T5305] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.517452][ T5305] __kasan_slab_pre_free+0x104/0x120
[ 94.517465][ T5305] kfree+0x173/0x640
[ 94.517481][ T5305] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.517494][ T5305] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.517506][ T5305] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 94.517519][ T5305] ? down_read+0x2be/0x330
[ 94.517533][ T5305] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 94.517545][ T5305] configfs_write_iter+0x337/0x430
[ 94.517563][ T5305] vfs_write+0x612/0xba0
[ 94.517580][ T5305] ? __pfx_vfs_write+0x10/0x10
[ 94.517595][ T5305] ? __fget_files+0x2a/0x420
[ 94.517611][ T5305] ksys_write+0x150/0x270
[ 94.517625][ T5305] ? __pfx_ksys_write+0x10/0x10
[ 94.517641][ T5305] do_syscall_64+0x166/0x520
[ 94.517663][ T5305] ? trace_irq_disable+0x3b/0x140
[ 94.517680][ T5305] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.517691][ T5305] ? clear_bhb_loop+0x70/0xc0
[ 94.517703][ T5305] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.517715][ T5305] RIP: 0033:0x7fe51839e0d9
[ 94.517727][ T5305] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.517736][ T5305] RSP: 002b:00007fe51930cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 94.517748][ T5305] RAX: ffffffffffffffda RBX: 00007fe518625fa0 RCX: 00007fe51839e0d9
[ 94.517757][ T5305] RDX: 000000000000007a RSI: 0000200000000280 RDI: 0000000000000003
[ 94.517765][ T5305] RBP: 00007fe518435024 R08: 0000000000000000 R09: 0000000000000000
[ 94.517774][ T5305] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.517781][ T5305] R13: 00007fe518626038 R14: 00007fe518625fa0 R15: 00007ffe5c852b48
[ 94.517793][ T5305]
[ 94.517798][ T5305]
[ 94.614322][ T5305] Allocated by task 5305:
[ 94.616125][ T5305] kasan_save_track+0x3e/0x80
[ 94.618197][ T5305] __kasan_kmalloc+0x93/0xb0
[ 94.620205][ T5305] __kmalloc_node_track_caller_noprof+0x4c7/0x740
[ 94.622974][ T5305] kstrdup+0x42/0x100
[ 94.624589][ T5305] f_uac2_opts_p_srate_store+0x11f/0x2b0
[ 94.627011][ T5305] configfs_write_iter+0x337/0x430
[ 94.629205][ T5305] vfs_write+0x612/0xba0
[ 94.631291][ T5305] ksys_write+0x150/0x270
[ 94.633168][ T5305] do_syscall_64+0x166/0x520
[ 94.635121][ T5305] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.637551][ T5305]
[ 94.638520][ T5305] The buggy address belongs to the object at ffff888012e1d600
[ 94.638520][ T5305] which belongs to the cache kmalloc-64 of size 64
[ 94.644011][ T5305] The buggy address is located 13 bytes inside of
[ 94.644011][ T5305] 45-byte region [ffff888012e1d600, ffff888012e1d62d)
[ 94.649410][ T5305]
[ 94.650667][ T5305] The buggy address belongs to the physical page:
[ 94.653371][ T5305] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12e1d
[ 94.657049][ T5305] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 94.660033][ T5305] page_type: f5(slab)
[ 94.661726][ T5305] raw: 00fff00000000000 ffff88801b0418c0 dead000000000100 dead000000000122
[ 94.665393][ T5305] raw: 0000000000000000 0000000800200020 00000000f5000000 0000000000000000
[ 94.668965][ T5305] page dumped because: kasan: bad access detected
[ 94.671608][ T5305] page_owner tracks the page as allocated
[ 94.674260][ T5305] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5282, tgid 5282 (modprobe), ts 90242242207, free_ts 32061669900
[ 94.682654][ T5305] post_alloc_hook+0x1f9/0x250
[ 94.684629][ T5305] get_page_from_freelist+0x21fe/0x2270
[ 94.686943][ T5305] __alloc_frozen_pages_noprof+0x18d/0x380
[ 94.689396][ T5305] allocate_slab+0x79/0x5e0
[ 94.691407][ T5305] refill_objects+0x2d5/0x350
[ 94.693392][ T5305] __pcs_replace_empty_main+0x2c3/0x6b0
[ 94.695644][ T5305] __kmalloc_noprof+0x489/0x720
[ 94.697677][ T5305] tomoyo_encode+0x2ad/0x570
[ 94.699655][ T5305] tomoyo_realpath_from_path+0x5fa/0x640
[ 94.702010][ T5305] tomoyo_check_open_permission+0x229/0x470
[ 94.704494][ T5305] security_file_open+0xa9/0x240
[ 94.706592][ T5305] do_dentry_open+0x4a0/0x1380
[ 94.708707][ T5305] vfs_open+0x3b/0x340
[ 94.710443][ T5305] path_openat+0x1443/0x1d60
[ 94.712431][ T5305] do_file_open+0x23e/0x4a0
[ 94.714346][ T5305] do_sys_openat2+0x115/0x200
[ 94.716375][ T5305] page last free pid 4686 tgid 4686 stack trace:
[ 94.719207][ T5305] __free_frozen_pages+0xc22/0xd20
[ 94.721394][ T5305] __slab_free+0x274/0x2c0
[ 94.723055][ T5305] qlist_free_all+0x99/0x100
[ 94.724942][ T5305] kasan_quarantine_reduce+0x148/0x160
[ 94.727181][ T5305] __kasan_slab_alloc+0x22/0x80
[ 94.729166][ T5305] kmem_cache_alloc_noprof+0x2a4/0x5f0
[ 94.731425][ T5305] do_getname+0x2e/0x250
[ 94.733142][ T5305] do_sys_openat2+0xcc/0x200
[ 94.734991][ T5305] __x64_sys_openat+0x138/0x170
[ 94.737080][ T5305] do_syscall_64+0x166/0x520
[ 94.739071][ T5305] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.741588][ T5305]
[ 94.742569][ T5305] Memory state around the buggy address:
[ 94.744888][ T5305] ffff888012e1d500: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[ 94.748111][ T5305] ffff888012e1d580: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[ 94.751189][ T5305] >ffff888012e1d600: 00 00 00 00 00 05 fc fc fc fc fc fc fc fc fc fc
[ 94.754550][ T5305] ^
[ 94.756346][ T5305] ffff888012e1d680: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 94.759588][ T5305] ffff888012e1d700: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
[ 94.762921][ T5305] ==================================================================
[ 94.815161][ T5305] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 94.818066][ T5305] CPU: 0 UID: 0 PID: 5305 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.821740][ T5305] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.825927][ T5305] Call Trace:
[ 94.827305][ T5305]
[ 94.828609][ T5305] vpanic+0x56d/0xa60
[ 94.830357][ T5305] ? __pfx_vpanic+0x10/0x10
[ 94.832297][ T5305] ? __pfx___schedule+0x10/0x10
[ 94.834236][ T5305] panic+0xc5/0xd0
[ 94.835695][ T5305] ? __pfx_panic+0x10/0x10
[ 94.837490][ T5305] ? preempt_schedule_common+0x7f/0xd0
[ 94.839747][ T5305] check_panic_on_warn+0x89/0xb0
[ 94.842273][ T5305] end_report+0x73/0x170
[ 94.844068][ T5305] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.846498][ T5305] kasan_report_invalid_free+0xfa/0x110
[ 94.848661][ T5305] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.850816][ T5305] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.853132][ T5305] __kasan_slab_pre_free+0x104/0x120
[ 94.855109][ T5305] kfree+0x173/0x640
[ 94.856718][ T5305] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.859066][ T5305] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.861301][ T5305] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 94.863742][ T5305] ? down_read+0x2be/0x330
[ 94.865739][ T5305] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 94.868404][ T5305] configfs_write_iter+0x337/0x430
[ 94.870707][ T5305] vfs_write+0x612/0xba0
[ 94.872498][ T5305] ? __pfx_vfs_write+0x10/0x10
[ 94.874529][ T5305] ? __fget_files+0x2a/0x420
[ 94.876511][ T5305] ksys_write+0x150/0x270
[ 94.878399][ T5305] ? __pfx_ksys_write+0x10/0x10
[ 94.880509][ T5305] do_syscall_64+0x166/0x520
[ 94.882454][ T5305] ? trace_irq_disable+0x3b/0x140
[ 94.884538][ T5305] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.887069][ T5305] ? clear_bhb_loop+0x70/0xc0
[ 94.888983][ T5305] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.891450][ T5305] RIP: 0033:0x7fe51839e0d9
[ 94.893418][ T5305] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.902198][ T5305] RSP: 002b:00007fe51930cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 94.905821][ T5305] RAX: ffffffffffffffda RBX: 00007fe518625fa0 RCX: 00007fe51839e0d9
[ 94.909135][ T5305] RDX: 000000000000007a RSI: 0000200000000280 RDI: 0000000000000003
[ 94.912506][ T5305] RBP: 00007fe518435024 R08: 0000000000000000 R09: 0000000000000000
[ 94.915746][ T5305] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.918918][ T5305] R13: 00007fe518626038 R14: 00007fe518625fa0 R15: 00007ffe5c852b48
[ 94.922062][ T5305]
[ 94.923730][ T5305] Kernel Offset: disabled
[ 94.925369][ T5305] Rebooting in 86400 seconds..