program:
syz_mount_image$vfat(&(0x7f00000000c0), &(0x7f0000000040)='./file0\x00', 0x381081a, &(0x7f00000010c0)=ANY=[], 0xfc, 0x2d5, &(0x7f0000000400)="$eJzs3T9rZFUUAPDzZiaTFy0miI0i+EALq7DR0iZRVhBSCWNjY3BnQWaGhSwMuKJxq/0CWi6Cn8LWztpvIGgp2GWLyJP3L5PnzoTHhiQSfr8mN/fec+959w6T6p18/sZ8eu9BEo9Pfo80TaK3F3vxLInt6EXjuzgJAOD2eJbn8XceERvV70nnyEHv6rICAK5S9fe/ctO5AADX48+f3vtm/+Dg7idZlsZroyeLcRIR8yeLcTW+fz++jFlM4k6M4jQiP1O1P/r44G4MssJ2vD0/XowXrfX3/4qtMn43RrG9On43q9Tx44ji50a8FFns399olhrFq6vj310RH+NhvPPWufx3YhS/fREPYhb3oohdxn+7m2Uf5j+cfP1ZsU0Rn/RivFnOq21F5P1ruxQAAAAAAAAAAAAAAAAAAAAAAG69nSxLqvI9Zf2eoquuv9M/Lcd3ssZ2uz5PFX9WL7iqD5RHXaLnOI+nTX2dO1mW5fXEZfwgXh/E4GaeGgAAAAAAAAAAAAAAAAAAAP5fHn71aHo4m02OXrwxf1otNT2cNdUAmtf6X3TlvUkvmp4349H0sL9+wc3ue52vNlDkeuHkGAziMsfSuRG/bBX5rJnzY51v3dPvfqqby8v9tA5vLuaSOaetj80rH5xlmNVzmkOeHibVXutzTpuhn88PDaNzPknS6invdjY5ysuDOs3bd5q2DnM5NFy3xfdJ+cHucizF1QxfXjn0T57n3R7n/T+qO6p7krLERrfb2agbKx+waKTP3/uv6xdc+5XRv9QXDgAAAAAAAAAAAAAAAAAAsFb7xen/eHxhaO/KkgIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAa7b8//9NI42Ids9zjeM6+KI5dWMYRw/bO27dxGMCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwy/0bAAD///9/QUk=")
syz_mount_image$vfat(&(0x7f0000000340), &(0x7f00000002c0)='./bus/file0\x00', 0x0, 0x0, 0x1, 0x0, &(0x7f0000000180))
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0)
openat2$dir(0xffffffffffffff9c, 0x0, &(0x7f0000004200)={0x6000, 0x40, 0x2}, 0x18)
mkdirat(r0, &(0x7f0000000000)='./bus/file0\x00', 0x0)
renameat2(r0, &(0x7f0000000240)='./bus/file0\x00', r0, &(0x7f0000000380)='./file0\x00', 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)="34343130302c34383038302c9d686d7af5234d075b4587e1ce38383230522c393630302bcdbe00", 0x27)
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
rename(&(0x7f0000000180)='./myconfig\x00', &(0x7f0000000280)='./bus\x00')
ioctl$XFS_IOC_GETBMAPX(r1, 0xc0205838, &(0x7f0000000080)={0x4, 0xad79, 0x0, 0xbb5, 0x4, 0x1, 0x2})
[ 86.161520][ T5269] Bluetooth: hci0: command tx timeout
[ 86.229143][ T5306] loop0: detected capacity change from 0 to 256
[ 86.384257][ T5306] ==================================================================
[ 86.387494][ T5306] BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.390841][ T5306] Free of addr ffff888042dcef9f by task syz.0.0/5306
[ 86.393612][ T5306]
[ 86.394679][ T5306] CPU: 0 UID: 0 PID: 5306 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 86.394694][ T5306] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.394707][ T5306] Call Trace:
[ 86.394714][ T5306]
[ 86.394720][ T5306] dump_stack_lvl+0xe8/0x150
[ 86.394740][ T5306] print_address_description+0x55/0x1e0
[ 86.394755][ T5306] print_report+0x58/0x70
[ 86.394767][ T5306] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.394782][ T5306] kasan_report_invalid_free+0xea/0x110
[ 86.394796][ T5306] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.394809][ T5306] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.394820][ T5306] __kasan_slab_pre_free+0x104/0x120
[ 86.394832][ T5306] kfree+0x173/0x640
[ 86.394847][ T5306] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.394860][ T5306] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.394871][ T5306] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 86.394884][ T5306] ? down_read+0x2be/0x330
[ 86.394896][ T5306] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 86.394908][ T5306] configfs_write_iter+0x337/0x430
[ 86.394922][ T5306] vfs_write+0x612/0xba0
[ 86.394937][ T5306] ? __pfx_vfs_write+0x10/0x10
[ 86.394952][ T5306] ? __fget_files+0x2a/0x420
[ 86.394965][ T5306] ksys_write+0x150/0x270
[ 86.394978][ T5306] ? __pfx_ksys_write+0x10/0x10
[ 86.394992][ T5306] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.395003][ T5306] do_syscall_64+0x174/0x580
[ 86.395014][ T5306] ? trace_irq_disable+0x3b/0x140
[ 86.395026][ T5306] ? clear_bhb_loop+0x70/0xc0
[ 86.395038][ T5306] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.395049][ T5306] RIP: 0033:0x7fef3d39e0d9
[ 86.395061][ T5306] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 86.395070][ T5306] RSP: 002b:00007fef3e1eafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 86.395083][ T5306] RAX: ffffffffffffffda RBX: 00007fef3d625fa0 RCX: 00007fef3d39e0d9
[ 86.395092][ T5306] RDX: 0000000000000027 RSI: 0000200000000300 RDI: 0000000000000005
[ 86.395099][ T5306] RBP: 00007fef3d435024 R08: 0000000000000000 R09: 0000000000000000
[ 86.395107][ T5306] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 86.395114][ T5306] R13: 00007fef3d626038 R14: 00007fef3d625fa0 R15: 00007ffef3dc8da8
[ 86.395125][ T5306]
[ 86.395129][ T5306]
[ 86.493320][ T5306] Allocated by task 5306:
[ 86.495336][ T5306] kasan_save_track+0x3e/0x80
[ 86.497375][ T5306] __kasan_kmalloc+0x93/0xb0
[ 86.499293][ T5306] __kmalloc_node_track_caller_noprof+0x4c3/0x730
[ 86.501924][ T5306] kstrdup+0x42/0x100
[ 86.503640][ T5306] f_uac2_opts_p_srate_store+0x11f/0x2b0
[ 86.506034][ T5306] configfs_write_iter+0x337/0x430
[ 86.508286][ T5306] vfs_write+0x612/0xba0
[ 86.510185][ T5306] ksys_write+0x150/0x270
[ 86.512057][ T5306] do_syscall_64+0x174/0x580
[ 86.514049][ T5306] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.516662][ T5306]
[ 86.517713][ T5306] The buggy address belongs to the object at ffff888042dcef80
[ 86.517713][ T5306] which belongs to the cache kmalloc-64 of size 64
[ 86.523640][ T5306] The buggy address is located 31 bytes inside of
[ 86.523640][ T5306] 39-byte region [ffff888042dcef80, ffff888042dcefa7)
[ 86.529011][ T5306]
[ 86.530049][ T5306] The buggy address belongs to the physical page:
[ 86.532784][ T5306] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x42dce
[ 86.536577][ T5306] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 86.540342][ T5306] page_type: f5(slab)
[ 86.542276][ T5306] raw: 04fff00000000000 ffff88801b0418c0 dead000000000100 dead000000000122
[ 86.545954][ T5306] raw: 0000000000000000 0000000800200020 00000000f5000000 0000000000000000
[ 86.549497][ T5306] page dumped because: kasan: bad access detected
[ 86.552033][ T5306] page_owner tracks the page as allocated
[ 86.554521][ T5306] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4989, tgid 4989 (mkdir), ts 56892209316, free_ts 56874062788
[ 86.563367][ T5306] post_alloc_hook+0x1f9/0x250
[ 86.565512][ T5306] get_page_from_freelist+0x21fa/0x2270
[ 86.567902][ T5306] __alloc_frozen_pages_noprof+0x18d/0x380
[ 86.570546][ T5306] allocate_slab+0x79/0x5e0
[ 86.572676][ T5306] refill_objects+0x2d5/0x350
[ 86.574800][ T5306] __pcs_replace_empty_main+0x2bf/0x6b0
[ 86.577141][ T5306] __kmalloc_noprof+0x485/0x720
[ 86.579200][ T5306] tomoyo_supervisor+0xc53/0x1560
[ 86.581332][ T5306] tomoyo_path_permission+0x262/0x3b0
[ 86.583666][ T5306] tomoyo_check_open_permission+0x2b2/0x470
[ 86.586289][ T5306] security_file_open+0xa9/0x240
[ 86.588305][ T5306] do_dentry_open+0x4a0/0x1380
[ 86.590265][ T5306] vfs_open+0x3b/0x340
[ 86.591906][ T5306] path_openat+0x2e44/0x3830
[ 86.593895][ T5306] do_file_open+0x23e/0x4a0
[ 86.595812][ T5306] do_sys_openat2+0x115/0x200
[ 86.597571][ T5306] page last free pid 15 tgid 15 stack trace:
[ 86.600005][ T5306] __free_frozen_pages+0xc1e/0xd10
[ 86.602199][ T5306] tlb_remove_table_rcu+0x85/0x100
[ 86.604409][ T5306] rcu_core+0x78b/0x10a0
[ 86.606116][ T5306] handle_softirqs+0x225/0x840
[ 86.607961][ T5306] run_ksoftirqd+0x36/0x60
[ 86.609716][ T5306] smpboot_thread_fn+0x57c/0xa80
[ 86.611752][ T5306] kthread+0x388/0x470
[ 86.613405][ T5306] ret_from_fork+0x514/0xb70
[ 86.615503][ T5306] ret_from_fork_asm+0x1a/0x30
[ 86.617475][ T5306]
[ 86.618500][ T5306] Memory state around the buggy address:
[ 86.620819][ T5306] ffff888042dcee80: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
[ 86.624185][ T5306] ffff888042dcef00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 86.627536][ T5306] >ffff888042dcef80: 00 00 00 00 07 fc fc fc fc fc fc fc fc fc fc fc
[ 86.630947][ T5306] ^
[ 86.633067][ T5306] ffff888042dcf000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 86.636484][ T5306] ffff888042dcf080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 86.639865][ T5306] ==================================================================
[ 86.663587][ T5306] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 86.666650][ T5306] CPU: 0 UID: 0 PID: 5306 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 86.670282][ T5306] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.674242][ T5306] Call Trace:
[ 86.675631][ T5306]
[ 86.676863][ T5306] vpanic+0x56c/0xa60
[ 86.678539][ T5306] ? __pfx_vpanic+0x10/0x10
[ 86.680420][ T5306] ? __pfx___schedule+0x10/0x10
[ 86.682616][ T5306] panic+0xc5/0xd0
[ 86.684386][ T5306] ? __pfx_panic+0x10/0x10
[ 86.686066][ T5306] ? preempt_schedule_common+0x82/0xd0
[ 86.688193][ T5306] check_panic_on_warn+0x89/0xb0
[ 86.690288][ T5306] end_report+0x73/0x170
[ 86.691989][ T5306] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.694329][ T5306] kasan_report_invalid_free+0xfa/0x110
[ 86.696737][ T5306] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.699123][ T5306] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.701574][ T5306] __kasan_slab_pre_free+0x104/0x120
[ 86.703649][ T5306] kfree+0x173/0x640
[ 86.705291][ T5306] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.707676][ T5306] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.709999][ T5306] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 86.712712][ T5306] ? down_read+0x2be/0x330
[ 86.714539][ T5306] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 86.716941][ T5306] configfs_write_iter+0x337/0x430
[ 86.719031][ T5306] vfs_write+0x612/0xba0
[ 86.720950][ T5306] ? __pfx_vfs_write+0x10/0x10
[ 86.723076][ T5306] ? __fget_files+0x2a/0x420
[ 86.725101][ T5306] ksys_write+0x150/0x270
[ 86.726828][ T5306] ? __pfx_ksys_write+0x10/0x10
[ 86.728811][ T5306] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.731167][ T5306] do_syscall_64+0x174/0x580
[ 86.733031][ T5306] ? trace_irq_disable+0x3b/0x140
[ 86.735086][ T5306] ? clear_bhb_loop+0x70/0xc0
[ 86.737045][ T5306] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.739451][ T5306] RIP: 0033:0x7fef3d39e0d9
[ 86.741257][ T5306] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 86.748927][ T5306] RSP: 002b:00007fef3e1eafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 86.752379][ T5306] RAX: ffffffffffffffda RBX: 00007fef3d625fa0 RCX: 00007fef3d39e0d9
[ 86.755658][ T5306] RDX: 0000000000000027 RSI: 0000200000000300 RDI: 0000000000000005
[ 86.759121][ T5306] RBP: 00007fef3d435024 R08: 0000000000000000 R09: 0000000000000000
[ 86.762480][ T5306] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 86.765793][ T5306] R13: 00007fef3d626038 R14: 00007fef3d625fa0 R15: 00007ffef3dc8da8
[ 86.768976][ T5306]
[ 86.770695][ T5306] Kernel Offset: disabled
[ 86.772550][ T5306] Rebooting in 86400 seconds..