program:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)={0x14, 0x3, 0x8, 0x101, 0x0, 0x0, {0x0, 0x0, 0x4}}, 0x14}}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
r1 = openat$ndctl0(0xffffffffffffff9c, &(0x7f0000000000), 0x8082, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x14, r3, 0x301, 0x70bd2a, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x840)
ioctl$DRM_IOCTL_GEM_FLINK(r1, 0xc008640a, &(0x7f0000000180))
fcntl$F_GET_FILE_RW_HINT(r1, 0x40d, &(0x7f00000006c0))
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r4 = syz_mount_image$fuse(&(0x7f0000000100), &(0x7f0000000180)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1040, &(0x7f0000000700)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id', 0x3d, 0xffffffffffffffff}, 0x2c, {'group_id', 0x3d, 0xee00}, 0x2c, {[{@allow_other}, {@default_permissions}, {@max_read={'max_read', 0x3d, 0x7}}], [{@fsuuid={'fsuuid', 0x3d, {[0x2, 0x37, 0x62, 0x38, 0x62, 0x34, 0x36, 0x32], 0x2d, [0x64, 0x66, 0x33, 0x37], 0x2d, [0x65, 0x32, 0x34, 0x32], 0x2d, [0x39, 0x32, 0x66, 0x34], 0x2d, [0x37, 0x61, 0x0, 0x39, 0x32, 0x61, 0x38, 0x30]}}}, {@dont_hash}, {@fowner_lt}, {@subj_type={'subj_type', 0x3d, 'fd/3\x00'}}, {@mask={'mask', 0x3d, 'MAY_APPEND'}}]}}, 0x0, 0x0, &(0x7f0000000580)="d55dd47d286d0301562c21877352fbf1f35fe3e821dc39932d7a60ed3f85a99ffde49de0bf0322250880cf0e1edb0619923c9cf384d897bd6d715f43144a9e49e9f74c1931e3522e97026d188e1f734d741b3df33be13af98b3b1d2e7e1360d4ae496c6b5ef269fdbcc0ed7fb02637928444d512178038b540539e0eb7367ec09abf7285b9379a333ad381485148337273e6c2061c71784927832dbe2e7a530698f68edca3264664")
move_mount(r4, &(0x7f0000000640)='./myconfig\x00', 0xffffffffffffffff, &(0x7f0000000680)='./myconfig/usb_gadget/g1\x00', 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r5, &(0x7f0000000440)="34343130302c3438303030129a6fd555592c3838571dcc5b3b9aed8c405c5c23e32b8578163081796326eb0e1544a677cbcd321c4396ce9c9bcf7ab2444685ce1e366c0f4226e72ab3cc4ba189c210fe84d35a4645fe36faf727c56b327642e401000000000000e05fdd881707a4150174db18b08518a9d7ab3b88a43ed7906f0d2e2dd4dd9ab59777876fd6dc703e14b89f5d3ce166d85459a242d1d3ce9a1762ecffd97da37ec7fd0e00000000000000e326af335311056e30c2922f9780ed24b4eb5301ea6a2670bfae7b34f23a94919d636f75a48454b04854c7f34bfc7a75ae41365fe3e33f5883f94e911a6d1c4388f233c95272a463cfcd0800000000000000dd37054365e43df0f7508cc356b742ca5391ce815652b83b736f2e4b61f8f040219afda14eb08e101a63c4d6a72da0e349c1beab", 0x137)
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r6 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000040), 0x90200, 0x0)
ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f00000001c0)={0xc, 0x4006, 0x9a})
ioctl$KVM_CREATE_DEVICE(r5, 0xc00caee0, &(0x7f0000000080)={0x4, 0xffffffffffffffff, 0x1})
[ 92.388191][ T5325] ==================================================================
[ 92.391732][ T5325] BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x225/0x2b0
[ 92.395194][ T5325] Free of addr ffff888043595e12 by task syz.0.0/5325
[ 92.397966][ T5325]
[ 92.399092][ T5325] CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 92.399109][ T5325] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 92.399116][ T5325] Call Trace:
[ 92.399123][ T5325]
[ 92.399130][ T5325] dump_stack_lvl+0xe8/0x150
[ 92.399153][ T5325] print_address_description+0x55/0x1e0
[ 92.399170][ T5325] print_report+0x58/0x70
[ 92.399184][ T5325] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 92.399196][ T5325] kasan_report_invalid_free+0xea/0x110
[ 92.399208][ T5325] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 92.399216][ T5325] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 92.399225][ T5325] __kasan_slab_pre_free+0x104/0x120
[ 92.399234][ T5325] kfree+0x173/0x640
[ 92.399243][ T5325] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 92.399255][ T5325] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 92.399268][ T5325] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 92.399281][ T5325] ? down_read+0x2be/0x330
[ 92.399294][ T5325] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 92.399306][ T5325] configfs_write_iter+0x337/0x430
[ 92.399323][ T5325] vfs_write+0x612/0xba0
[ 92.399340][ T5325] ? __pfx_vfs_write+0x10/0x10
[ 92.399355][ T5325] ? __fget_files+0x2a/0x420
[ 92.399370][ T5325] ksys_write+0x150/0x270
[ 92.399383][ T5325] ? __pfx_ksys_write+0x10/0x10
[ 92.399399][ T5325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 92.399410][ T5325] do_syscall_64+0x174/0x580
[ 92.399422][ T5325] ? trace_irq_disable+0x3b/0x140
[ 92.399435][ T5325] ? clear_bhb_loop+0x40/0x90
[ 92.399447][ T5325] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 92.399457][ T5325] RIP: 0033:0x7f0f1259e019
[ 92.399469][ T5325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 92.399485][ T5325] RSP: 002b:00007f0f13423fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 92.399501][ T5325] RAX: ffffffffffffffda RBX: 00007f0f12825fa0 RCX: 00007f0f1259e019
[ 92.399509][ T5325] RDX: 0000000000000137 RSI: 0000200000000440 RDI: 0000000000000006
[ 92.399516][ T5325] RBP: 00007f0f1263500c R08: 0000000000000000 R09: 0000000000000000
[ 92.399523][ T5325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 92.399530][ T5325] R13: 00007f0f12826038 R14: 00007f0f12825fa0 R15: 00007ffc930fa848
[ 92.399543][ T5325]
[ 92.399547][ T5325]
[ 92.507232][ T5325] Allocated by task 5325:
[ 92.509112][ T5325] kasan_save_track+0x3e/0x80
[ 92.511111][ T5325] __kasan_kmalloc+0x93/0xb0
[ 92.513083][ T5325] __kmalloc_node_track_caller_noprof+0x4c3/0x730
[ 92.515724][ T5325] kstrdup+0x42/0x100
[ 92.517442][ T5325] f_uac2_opts_p_srate_store+0x11f/0x2b0
[ 92.519825][ T5325] configfs_write_iter+0x337/0x430
[ 92.521936][ T5325] vfs_write+0x612/0xba0
[ 92.523643][ T5325] ksys_write+0x150/0x270
[ 92.525457][ T5325] do_syscall_64+0x174/0x580
[ 92.527386][ T5325] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 92.529900][ T5325]
[ 92.530914][ T5325] The buggy address belongs to the object at ffff888043595e00
[ 92.530914][ T5325] which belongs to the cache kmalloc-128 of size 128
[ 92.536311][ T5325] The buggy address is located 18 bytes inside of
[ 92.536311][ T5325] 98-byte region [ffff888043595e00, ffff888043595e62)
[ 92.541444][ T5325]
[ 92.542467][ T5325] The buggy address belongs to the physical page:
[ 92.545051][ T5325] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x43595
[ 92.548687][ T5325] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 92.551608][ T5325] page_type: f5(slab)
[ 92.553302][ T5325] raw: 04fff00000000000 ffff88801b041a00 dead000000000122 0000000000000000
[ 92.556909][ T5325] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
[ 92.560943][ T5325] page dumped because: kasan: bad access detected
[ 92.563562][ T5325] page_owner tracks the page as allocated
[ 92.565984][ T5325] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5286, tgid 5286 (syz-executor), ts 90417776812, free_ts 89614783124
[ 92.574202][ T5325] post_alloc_hook+0x1f9/0x250
[ 92.576077][ T5325] get_page_from_freelist+0x21fa/0x2270
[ 92.578279][ T5325] __alloc_frozen_pages_noprof+0x18d/0x380
[ 92.580659][ T5325] allocate_slab+0x79/0x5e0
[ 92.582554][ T5325] refill_objects+0x2d5/0x350
[ 92.584501][ T5325] __pcs_replace_empty_main+0x2bf/0x6b0
[ 92.586683][ T5325] __kmalloc_flags_noprof+0x5be/0x800
[ 92.588756][ T5325] __alloc_empty_sheaf+0x28/0x40
[ 92.590774][ T5325] __pcs_replace_empty_main+0x430/0x6b0
[ 92.593067][ T5325] kmem_cache_alloc_noprof+0x382/0x5f0
[ 92.595319][ T5325] sched_create_group+0x1d/0x80
[ 92.597396][ T5325] cpu_cgroup_css_alloc+0xe/0x40
[ 92.599461][ T5325] cgroup_apply_control_enable+0x5bb/0xda0
[ 92.601833][ T5325] cgroup_mkdir+0xd2c/0xf90
[ 92.603699][ T5325] kernfs_iop_mkdir+0x213/0x360
[ 92.605647][ T5325] vfs_mkdir+0x406/0x620
[ 92.607314][ T5325] page last free pid 5314 tgid 5314 stack trace:
[ 92.609908][ T5325] __free_frozen_pages+0xc1e/0xd10
[ 92.612250][ T5325] __slab_free+0x274/0x2c0
[ 92.614413][ T5325] qlist_free_all+0x99/0x100
[ 92.616369][ T5325] kasan_quarantine_reduce+0x148/0x160
[ 92.618880][ T5325] __kasan_slab_alloc+0x22/0x80
[ 92.621475][ T5325] kmem_cache_alloc_noprof+0x2a0/0x5f0
[ 92.624053][ T5325] vm_area_dup+0x28/0x670
[ 92.626032][ T5325] __split_vma+0x1dc/0xa50
[ 92.627972][ T5325] vms_gather_munmap_vmas+0x4e3/0x1370
[ 92.630249][ T5325] mmap_region+0x8f9/0x2310
[ 92.632224][ T5325] do_mmap+0xc3b/0x10c0
[ 92.634025][ T5325] vm_mmap_pgoff+0x272/0x4e0
[ 92.635968][ T5325] ksys_mmap_pgoff+0x4dc/0x760
[ 92.638104][ T5325] do_syscall_64+0x174/0x580
[ 92.640122][ T5325] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 92.642656][ T5325]
[ 92.643712][ T5325] Memory state around the buggy address:
[ 92.646095][ T5325] ffff888043595d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 92.649283][ T5325] ffff888043595d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 92.652614][ T5325] >ffff888043595e00: 00 00 00 00 00 00 00 00 00 00 00 00 02 fc fc fc
[ 92.655971][ T5325] ^
[ 92.657911][ T5325] ffff888043595e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 92.661238][ T5325] ffff888043595f00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 92.664341][ T5325] ==================================================================
[ 92.669037][ T5325] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 92.672199][ T5325] CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 92.676025][ T5325] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 92.680238][ T5325] Call Trace:
[ 92.681715][ T5325]
[ 92.682970][ T5325] vpanic+0x56c/0xa60
[ 92.684730][ T5325] ? __pfx_vpanic+0x10/0x10
[ 92.686741][ T5325] ? __pfx___schedule+0x10/0x10
[ 92.688859][ T5325] panic+0xc5/0xd0
[ 92.690526][ T5325] ? __pfx_panic+0x10/0x10
[ 92.692497][ T5325] ? preempt_schedule_common+0x82/0xd0
[ 92.694935][ T5325] check_panic_on_warn+0x89/0xb0
[ 92.697132][ T5325] end_report+0x73/0x170
[ 92.698947][ T5325] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 92.700996][ T5325] kasan_report_invalid_free+0xfa/0x110
[ 92.703235][ T5325] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 92.705415][ T5325] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 92.707645][ T5325] __kasan_slab_pre_free+0x104/0x120
[ 92.709756][ T5325] kfree+0x173/0x640
[ 92.711250][ T5325] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 92.713735][ T5325] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 92.716220][ T5325] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 92.718805][ T5325] ? down_read+0x2be/0x330
[ 92.720683][ T5325] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 92.723312][ T5325] configfs_write_iter+0x337/0x430
[ 92.725546][ T5325] vfs_write+0x612/0xba0
[ 92.727389][ T5325] ? __pfx_vfs_write+0x10/0x10
[ 92.729370][ T5325] ? __fget_files+0x2a/0x420
[ 92.731314][ T5325] ksys_write+0x150/0x270
[ 92.733199][ T5325] ? __pfx_ksys_write+0x10/0x10
[ 92.735224][ T5325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 92.737838][ T5325] do_syscall_64+0x174/0x580
[ 92.739890][ T5325] ? trace_irq_disable+0x3b/0x140
[ 92.741988][ T5325] ? clear_bhb_loop+0x40/0x90
[ 92.743829][ T5325] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 92.746248][ T5325] RIP: 0033:0x7f0f1259e019
[ 92.748091][ T5325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 92.756023][ T5325] RSP: 002b:00007f0f13423fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 92.759513][ T5325] RAX: ffffffffffffffda RBX: 00007f0f12825fa0 RCX: 00007f0f1259e019
[ 92.762861][ T5325] RDX: 0000000000000137 RSI: 0000200000000440 RDI: 0000000000000006
[ 92.766255][ T5325] RBP: 00007f0f1263500c R08: 0000000000000000 R09: 0000000000000000
[ 92.769311][ T5325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 92.772763][ T5325] R13: 00007f0f12826038 R14: 00007f0f12825fa0 R15: 00007ffc930fa848
[ 92.776142][ T5325]
[ 92.777825][ T5325] Kernel Offset: disabled
[ 92.779609][ T5325] Rebooting in 86400 seconds..