program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
swapon(&(0x7f0000000000)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x20000)
mount(&(0x7f0000000040)=@sg0, &(0x7f0000000080)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', &(0x7f0000000100)='omfs\x00', 0x908000, &(0x7f0000000180)='fd/3\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)="67a8eb086858bc03b374992441a9928087bdc26faf0333e8961558d85544d0a8ec4c7388b462ee79cb09af08e646b80b904b2ecccbd851ed563ceda9ce01582df2e4c47836a666743b0ea73fe99dc9a76d3a09013f8c81f9fea1260a30f4e2942be6e1c0b1dae3051293fe9ba74069ee646eed7b9dc943998fb176a2a68441cb51620c1f3cf934488ae4dded96a74b7fdb9ae0f27e0b7d37dd0ef4fe3e66eea087c020f3217567dbd999b37e869c19fd7649568a12391785b9f8a031fd114f5aacd63808e0904c8b8c6918b42c6722b2adaec61da745d94154", 0xd9)
write(r0, &(0x7f0000000440)='44100,4', 0x7)
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
[ 93.859635][ T5272] Bluetooth: hci0: command tx timeout
[ 93.995943][ T5313] ==================================================================
[ 93.999477][ T5313] BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.002919][ T5313] Free of addr ffff888012bcbccd by task syz.0.0/5313
[ 94.005772][ T5313]
[ 94.006796][ T5313] CPU: 0 UID: 0 PID: 5313 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.006811][ T5313] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.006818][ T5313] Call Trace:
[ 94.006824][ T5313]
[ 94.006830][ T5313] dump_stack_lvl+0xe8/0x150
[ 94.006850][ T5313] print_address_description+0x55/0x1e0
[ 94.006863][ T5313] print_report+0x58/0x70
[ 94.006873][ T5313] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.006881][ T5313] kasan_report_invalid_free+0xea/0x110
[ 94.006890][ T5313] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.006898][ T5313] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.006905][ T5313] __kasan_slab_pre_free+0x104/0x120
[ 94.006913][ T5313] kfree+0x173/0x640
[ 94.006919][ T5313] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.006927][ T5313] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.006934][ T5313] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 94.006943][ T5313] ? down_read+0x2be/0x330
[ 94.006951][ T5313] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 94.006958][ T5313] configfs_write_iter+0x337/0x430
[ 94.006967][ T5313] vfs_write+0x612/0xba0
[ 94.006978][ T5313] ? __pfx_vfs_write+0x10/0x10
[ 94.006988][ T5313] ? __fget_files+0x2a/0x420
[ 94.006999][ T5313] ksys_write+0x150/0x270
[ 94.007009][ T5313] ? __pfx_ksys_write+0x10/0x10
[ 94.007025][ T5313] do_syscall_64+0x166/0x520
[ 94.007036][ T5313] ? trace_irq_disable+0x3b/0x140
[ 94.007049][ T5313] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.007060][ T5313] ? clear_bhb_loop+0x70/0xc0
[ 94.007071][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.007082][ T5313] RIP: 0033:0x7f270db9e0d9
[ 94.007092][ T5313] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.007101][ T5313] RSP: 002b:00007f270eacdfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 94.007113][ T5313] RAX: ffffffffffffffda RBX: 00007f270de25fa0 RCX: 00007f270db9e0d9
[ 94.007121][ T5313] RDX: 00000000000000d9 RSI: 0000200000000280 RDI: 0000000000000003
[ 94.007127][ T5313] RBP: 00007f270dc35024 R08: 0000000000000000 R09: 0000000000000000
[ 94.007133][ T5313] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.007140][ T5313] R13: 00007f270de26038 R14: 00007f270de25fa0 R15: 00007ffe7e122908
[ 94.007153][ T5313]
[ 94.007157][ T5313]
[ 94.101842][ T5313] Allocated by task 5313:
[ 94.103520][ T5313] kasan_save_track+0x3e/0x80
[ 94.105368][ T5313] __kasan_kmalloc+0x93/0xb0
[ 94.107322][ T5313] __kmalloc_node_track_caller_noprof+0x4c7/0x740
[ 94.109946][ T5313] kstrdup+0x42/0x100
[ 94.111671][ T5313] f_uac2_opts_p_srate_store+0x11f/0x2b0
[ 94.114002][ T5313] configfs_write_iter+0x337/0x430
[ 94.116001][ T5313] vfs_write+0x612/0xba0
[ 94.117583][ T5313] ksys_write+0x150/0x270
[ 94.119314][ T5313] do_syscall_64+0x166/0x520
[ 94.121207][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.123712][ T5313]
[ 94.124771][ T5313] The buggy address belongs to the object at ffff888012bcbc00
[ 94.124771][ T5313] which belongs to the cache kmalloc-256 of size 256
[ 94.130443][ T5313] The buggy address is located 205 bytes inside of
[ 94.130443][ T5313] 218-byte region [ffff888012bcbc00, ffff888012bcbcda)
[ 94.135906][ T5313]
[ 94.136938][ T5313] The buggy address belongs to the physical page:
[ 94.139529][ T5313] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12bcb
[ 94.142995][ T5313] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 94.146043][ T5313] page_type: f5(slab)
[ 94.147763][ T5313] raw: 00fff00000000000 ffff88801b041b40 dead000000000122 0000000000000000
[ 94.151394][ T5313] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[ 94.154712][ T5313] page dumped because: kasan: bad access detected
[ 94.157234][ T5313] page_owner tracks the page as allocated
[ 94.159647][ T5313] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5271, tgid 5271 (syz-executor), ts 92005963824
[ 94.170899][ T5313] post_alloc_hook+0x1f9/0x250
[ 94.173754][ T5313] get_page_from_freelist+0x2209/0x2280
[ 94.177699][ T5313] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 94.180907][ T5313] allocate_slab+0x7c/0x5e0
[ 94.183639][ T5313] refill_objects+0x2d5/0x350
[ 94.186402][ T5313] __pcs_replace_empty_main+0x2c3/0x6b0
[ 94.189343][ T5313] __kmalloc_node_track_caller_noprof+0x55b/0x740
[ 94.192357][ T5313] kmemdup_array+0x3f/0x80
[ 94.194755][ T5313] xt_register_table+0xac/0xa40
[ 94.196782][ T5313] ipt_register_table+0x16e/0x310
[ 94.198716][ T5313] iptable_security_table_init+0x41/0x70
[ 94.201705][ T5313] xt_find_table_lock+0x311/0x400
[ 94.204686][ T5313] xt_request_find_table_lock+0x26/0x100
[ 94.209022][ T5313] do_ipt_get_ctl+0x77f/0x1300
[ 94.212062][ T5313] nf_getsockopt+0x26e/0x290
[ 94.215004][ T5313] ip_getsockopt+0x19e/0x230
[ 94.217960][ T5313] page last free pid 5311 tgid 5311 ts 91982652952 stack trace:
[ 94.222671][ T5313] __free_frozen_pages+0xc93/0xd90
[ 94.226292][ T5313] tlb_finish_mmu+0x13e/0x220
[ 94.228844][ T5313] exit_mmap+0x4b2/0x9f0
[ 94.230935][ T5313] __mmput+0x118/0x420
[ 94.233536][ T5313] exit_mm+0x221/0x2d0
[ 94.235511][ T5313] do_exit+0x6cd/0x2360
[ 94.237484][ T5313] do_group_exit+0x22d/0x2f0
[ 94.239434][ T5313] __x64_sys_exit_group+0x3f/0x40
[ 94.242370][ T5313] x64_sys_call+0x18c6/0x18d0
[ 94.245297][ T5313] do_syscall_64+0x166/0x520
[ 94.248189][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.252826][ T5313]
[ 94.254781][ T5313] Memory state around the buggy address:
[ 94.257737][ T5313] ffff888012bcbb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.262405][ T5313] ffff888012bcbc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 94.266720][ T5313] >ffff888012bcbc80: 00 00 00 00 00 00 00 00 00 00 00 02 fc fc fc fc
[ 94.270696][ T5313] ^
[ 94.274325][ T5313] ffff888012bcbd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.279160][ T5313] ffff888012bcbd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.284393][ T5313] ==================================================================
[ 94.351308][ T5313] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 94.354537][ T5313] CPU: 0 UID: 0 PID: 5313 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.358735][ T5313] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.362966][ T5313] Call Trace:
[ 94.364284][ T5313]
[ 94.365467][ T5313] vpanic+0x56d/0xa60
[ 94.367070][ T5313] ? __pfx_vpanic+0x10/0x10
[ 94.369201][ T5313] ? __pfx___schedule+0x10/0x10
[ 94.371075][ T5313] panic+0xc5/0xd0
[ 94.372515][ T5313] ? __pfx_panic+0x10/0x10
[ 94.374210][ T5313] ? preempt_schedule_common+0x7f/0xd0
[ 94.376344][ T5313] check_panic_on_warn+0x89/0xb0
[ 94.378363][ T5313] end_report+0x73/0x170
[ 94.380142][ T5313] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.382704][ T5313] kasan_report_invalid_free+0xfa/0x110
[ 94.385074][ T5313] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.387617][ T5313] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.390133][ T5313] __kasan_slab_pre_free+0x104/0x120
[ 94.392288][ T5313] kfree+0x173/0x640
[ 94.394006][ T5313] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.396576][ T5313] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.398989][ T5313] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 94.401788][ T5313] ? down_read+0x2be/0x330
[ 94.403651][ T5313] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 94.406280][ T5313] configfs_write_iter+0x337/0x430
[ 94.408413][ T5313] vfs_write+0x612/0xba0
[ 94.410362][ T5313] ? __pfx_vfs_write+0x10/0x10
[ 94.412326][ T5313] ? __fget_files+0x2a/0x420
[ 94.414231][ T5313] ksys_write+0x150/0x270
[ 94.416002][ T5313] ? __pfx_ksys_write+0x10/0x10
[ 94.418109][ T5313] do_syscall_64+0x166/0x520
[ 94.420041][ T5313] ? trace_irq_disable+0x3b/0x140
[ 94.422148][ T5313] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.424573][ T5313] ? clear_bhb_loop+0x70/0xc0
[ 94.426434][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.428742][ T5313] RIP: 0033:0x7f270db9e0d9
[ 94.430596][ T5313] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.438587][ T5313] RSP: 002b:00007f270eacdfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 94.442060][ T5313] RAX: ffffffffffffffda RBX: 00007f270de25fa0 RCX: 00007f270db9e0d9
[ 94.445088][ T5313] RDX: 00000000000000d9 RSI: 0000200000000280 RDI: 0000000000000003
[ 94.448319][ T5313] RBP: 00007f270dc35024 R08: 0000000000000000 R09: 0000000000000000
[ 94.451629][ T5313] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.454907][ T5313] R13: 00007f270de26038 R14: 00007f270de25fa0 R15: 00007ffe7e122908
[ 94.458265][ T5313]
[ 94.460013][ T5313] Kernel Offset: disabled
[ 94.461912][ T5313] Rebooting in 86400 seconds..