program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
syz_emit_ethernet(0x82, &(0x7f0000000040)={@link_local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x80}, @val={@void}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f53a04", 0x48, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x500, {0x0, 0x6, "508359", 0x0, 0x0, 0x0, @private1, @mcast1={0xff, 0x0, '\x00', 0x0}, [@hopopts={0x3a, 0x1, '\x00', [@calipso={0x7, 0x8}]}]}}}}}}}, 0x0)
syz_emit_ethernet(0x376, &(0x7f00000003c0)={@link_local, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "0300", 0x340, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbfb23b48, 0x0, [{0x0, 0xa, "a78ce54006598080a8030003004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af0502"}, {0x0, 0x1, "000005000000000026000400"}, {0x0, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0x0, 0x1d, "06aa85616177c61bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee4df24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000"}, {0x0, 0xb, "17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b303f4f003"}, {0x19, 0x7, "b8a3e10000a3e1030000000900fff5ffff00000000600000ff0bc0fe000000000000000000000000d9a0274400"/55}, {0x0, 0x11, "3f14f0e74d2d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e2eeb1d18065daa7628cf9ef083611c9f6ae2e1eb3d8bf9c6ab2642c4808288e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c676d8800871a6aa54155dea2d995cb22c9924e0ad38c6967052cc7786d779b8353aac33a57d79b05"}]}}}}}}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='e100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='0000:00:03.0\x00', 0xc)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/e100/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='0000:00:03.0\x00', 0xc)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r3, &(0x7f0000000740)="7434313013a934383130302c38383230302c3936070000ee3068b3756c54042c7d4c2b607e081af0e33026951013a80e001ca491fcb741e51f0ddc92e5f8a18b72c053258a7ffb0f000000000000ddc32e887cc4555d998e34048e83124b47525ad46d0d5cab85d0c4496e06ca1d45ffc074b626c33642c57c7b2b4f6b706a52ef6ea5e08009ab066a2d1659b1dd19c6e3c73b07b47ae08d94e0368d78d9584de56ddf516218d26b9e3c15ae09202f21c75d882020023dcf3cdc1baf86aabfd858509283173c75329c12bb83ea85", 0xce)
symlinkat(&(0x7f0000000580)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./myconfig/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r4, &(0x7f0000000640)='usbip-vudc.0', 0xc)
[ 124.408110][ T4641] Bluetooth: hci0: command tx timeout
[ 124.670656][ T5321] 0000:00:03.0 (uninitialized): Cannot find proper PCI device base address, aborting
[ 124.693002][ T5320] ==================================================================
[ 124.696518][ T5320] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0
[ 124.699701][ T5320] Free of addr ffff888042cb6e4c by task syz.0.0/5320
[ 124.702617][ T5320]
[ 124.703573][ T5320] CPU: 0 UID: 0 PID: 5320 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 124.703588][ T5320] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 124.703596][ T5320] Call Trace:
[ 124.703602][ T5320]
[ 124.703607][ T5320] dump_stack_lvl+0xe8/0x150
[ 124.703625][ T5320] print_address_description+0x55/0x1e0
[ 124.703638][ T5320] print_report+0x58/0x70
[ 124.703659][ T5320] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 124.703672][ T5320] kasan_report_invalid_free+0xea/0x110
[ 124.703688][ T5320] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 124.703701][ T5320] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 124.703713][ T5320] __kasan_slab_pre_free+0x104/0x120
[ 124.703725][ T5320] kfree+0x173/0x640
[ 124.703735][ T5320] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 124.703747][ T5320] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 124.703760][ T5320] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 124.703772][ T5320] ? down_read+0x2be/0x330
[ 124.703785][ T5320] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 124.703798][ T5320] configfs_write_iter+0x337/0x430
[ 124.703811][ T5320] vfs_write+0x612/0xba0
[ 124.703829][ T5320] ? __pfx_vfs_write+0x10/0x10
[ 124.703841][ T5320] ? __fget_files+0x2a/0x420
[ 124.703851][ T5320] ksys_write+0x150/0x270
[ 124.703858][ T5320] ? __pfx_ksys_write+0x10/0x10
[ 124.703873][ T5320] do_syscall_64+0x166/0x520
[ 124.703885][ T5320] ? trace_irq_disable+0x3b/0x140
[ 124.703897][ T5320] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 124.703909][ T5320] ? clear_bhb_loop+0x70/0xc0
[ 124.703921][ T5320] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 124.703932][ T5320] RIP: 0033:0x7fed3bb9e0d9
[ 124.703943][ T5320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 124.703952][ T5320] RSP: 002b:00007fed3caacfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 124.703964][ T5320] RAX: ffffffffffffffda RBX: 00007fed3be25fa0 RCX: 00007fed3bb9e0d9
[ 124.703971][ T5320] RDX: 00000000000000ce RSI: 0000200000000740 RDI: 0000000000000006
[ 124.704009][ T5320] RBP: 00007fed3bc35024 R08: 0000000000000000 R09: 0000000000000000
[ 124.704017][ T5320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 124.704024][ T5320] R13: 00007fed3be26038 R14: 00007fed3be25fa0 R15: 00007ffe4726a698
[ 124.704037][ T5320]
[ 124.704040][ T5320]
[ 124.800203][ T5320] Allocated by task 5320:
[ 124.802068][ T5320] kasan_save_track+0x3e/0x80
[ 124.804078][ T5320] __kasan_kmalloc+0x93/0xb0
[ 124.806049][ T5320] __kmalloc_node_track_caller_noprof+0x4c7/0x740
[ 124.809309][ T5320] kstrdup+0x42/0x100
[ 124.810986][ T5320] f_uac2_opts_c_srate_store+0x11f/0x2b0
[ 124.813435][ T5320] configfs_write_iter+0x337/0x430
[ 124.815602][ T5320] vfs_write+0x612/0xba0
[ 124.817309][ T5320] ksys_write+0x150/0x270
[ 124.819060][ T5320] do_syscall_64+0x166/0x520
[ 124.821006][ T5320] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 124.823442][ T5320]
[ 124.824475][ T5320] The buggy address belongs to the object at ffff888042cb6e40
[ 124.824475][ T5320] which belongs to the cache kmalloc-32 of size 32
[ 124.830103][ T5320] The buggy address is located 12 bytes inside of
[ 124.830103][ T5320] 22-byte region [ffff888042cb6e40, ffff888042cb6e56)
[ 124.835443][ T5320]
[ 124.836537][ T5320] The buggy address belongs to the physical page:
[ 124.839219][ T5320] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x42cb6
[ 124.842858][ T5320] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 124.845824][ T5320] page_type: f5(slab)
[ 124.847636][ T5320] raw: 04fff00000000000 ffff88801b041780 dead000000000100 dead000000000122
[ 124.851257][ T5320] raw: 0000000000000000 0000000800400040 00000000f5000000 0000000000000000
[ 124.854859][ T5320] page dumped because: kasan: bad access detected
[ 124.857570][ T5320] page_owner tracks the page as allocated
[ 124.860015][ T5320] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5204, tgid 5204 (rm), ts 104096724759
[ 124.867340][ T5320] post_alloc_hook+0x1f9/0x250
[ 124.869345][ T5320] get_page_from_freelist+0x2209/0x2280
[ 124.871632][ T5320] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 124.874185][ T5320] allocate_slab+0x7c/0x5e0
[ 124.876153][ T5320] refill_objects+0x2d5/0x350
[ 124.878589][ T5320] __pcs_replace_empty_main+0x2c3/0x6b0
[ 124.881561][ T5320] __kmalloc_noprof+0x489/0x720
[ 124.884206][ T5320] tomoyo_encode+0x2ad/0x570
[ 124.886409][ T5320] tomoyo_realpath_from_path+0x5fa/0x640
[ 124.888792][ T5320] tomoyo_path_perm+0x283/0x560
[ 124.890832][ T5320] security_inode_getattr+0x12b/0x310
[ 124.893190][ T5320] __x64_sys_newfstat+0x133/0x270
[ 124.895263][ T5320] do_syscall_64+0x166/0x520
[ 124.897186][ T5320] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 124.899728][ T5320] page last free pid 15 tgid 15 ts 104089780438 stack trace:
[ 124.902817][ T5320] __free_frozen_pages+0xc93/0xd90
[ 124.904977][ T5320] tlb_remove_table_rcu+0x85/0x100
[ 124.907098][ T5320] rcu_core+0x794/0x10b0
[ 124.909094][ T5320] handle_softirqs+0x226/0x860
[ 124.911381][ T5320] run_ksoftirqd+0x36/0x60
[ 124.913507][ T5320] smpboot_thread_fn+0x565/0xa70
[ 124.915870][ T5320] kthread+0x38b/0x480
[ 124.917814][ T5320] ret_from_fork+0x514/0xb70
[ 124.920037][ T5320] ret_from_fork_asm+0x1a/0x30
[ 124.921882][ T5320]
[ 124.923063][ T5320] Memory state around the buggy address:
[ 124.925464][ T5320] ffff888042cb6d00: fa fb fb fb fc fc fc fc 00 00 00 00 fc fc fc fc
[ 124.928598][ T5320] ffff888042cb6d80: 00 00 00 00 fc fc fc fc fa fb fb fb fc fc fc fc
[ 124.931922][ T5320] >ffff888042cb6e00: fa fb fb fb fc fc fc fc 00 00 06 fc fc fc fc fc
[ 124.936080][ T5320] ^
[ 124.938823][ T5320] ffff888042cb6e80: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc
[ 124.942139][ T5320] ffff888042cb6f00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[ 124.945329][ T5320] ==================================================================
[ 124.999640][ T5320] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 125.002743][ T5320] CPU: 0 UID: 0 PID: 5320 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 125.006395][ T5320] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 125.010476][ T5320] Call Trace:
[ 125.012143][ T5320]
[ 125.013333][ T5320] vpanic+0x56d/0xa60
[ 125.014983][ T5320] ? __pfx_vpanic+0x10/0x10
[ 125.016968][ T5320] ? __pfx___schedule+0x10/0x10
[ 125.019060][ T5320] panic+0xc5/0xd0
[ 125.020723][ T5320] ? __pfx_panic+0x10/0x10
[ 125.022655][ T5320] ? preempt_schedule_common+0x7f/0xd0
[ 125.025032][ T5320] check_panic_on_warn+0x89/0xb0
[ 125.027155][ T5320] end_report+0x73/0x170
[ 125.029036][ T5320] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 125.031550][ T5320] kasan_report_invalid_free+0xfa/0x110
[ 125.034029][ T5320] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 125.036419][ T5320] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 125.038960][ T5320] __kasan_slab_pre_free+0x104/0x120
[ 125.041456][ T5320] kfree+0x173/0x640
[ 125.043300][ T5320] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 125.045908][ T5320] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 125.048337][ T5320] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 125.051014][ T5320] ? down_read+0x2be/0x330
[ 125.053047][ T5320] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 125.055728][ T5320] configfs_write_iter+0x337/0x430
[ 125.057987][ T5320] vfs_write+0x612/0xba0
[ 125.059836][ T5320] ? __pfx_vfs_write+0x10/0x10
[ 125.062983][ T5320] ? __fget_files+0x2a/0x420
[ 125.065141][ T5320] ksys_write+0x150/0x270
[ 125.067022][ T5320] ? __pfx_ksys_write+0x10/0x10
[ 125.069230][ T5320] do_syscall_64+0x166/0x520
[ 125.071328][ T5320] ? trace_irq_disable+0x3b/0x140
[ 125.073439][ T5320] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 125.076068][ T5320] ? clear_bhb_loop+0x70/0xc0
[ 125.078025][ T5320] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 125.080499][ T5320] RIP: 0033:0x7fed3bb9e0d9
[ 125.082540][ T5320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 125.090546][ T5320] RSP: 002b:00007fed3caacfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 125.094136][ T5320] RAX: ffffffffffffffda RBX: 00007fed3be25fa0 RCX: 00007fed3bb9e0d9
[ 125.097528][ T5320] RDX: 00000000000000ce RSI: 0000200000000740 RDI: 0000000000000006
[ 125.100917][ T5320] RBP: 00007fed3bc35024 R08: 0000000000000000 R09: 0000000000000000
[ 125.104360][ T5320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 125.107793][ T5320] R13: 00007fed3be26038 R14: 00007fed3be25fa0 R15: 00007ffe4726a698
[ 125.111176][ T5320]
[ 125.112947][ T5320] Kernel Offset: disabled
[ 125.114786][ T5320] Rebooting in 86400 seconds..