program:
close(0x3)
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='config/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)="4560d9c382a6a5e8c215ef984ab73f4885c181b50af0648858942acd3e3402f9fdc97c08339f3a8321aeb4f39d0537104ea104b8c78ff46dccf1175a829819bd2cc0a71922cb8adec919457e3132c8f95aa924562a4a9bf79af98f7c1da6c5add67900ae7a3812dbab0130971e10b7b4df3a4a735b64f7c509532f8d7a00d4ec827c00daf0cf0e", 0x87)
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
[ 91.495000][ T5309] ==================================================================
[ 91.498333][ T5309] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0
[ 91.501691][ T5309] Free of addr ffff88803eedde41 by task syz.0.0/5309
[ 91.504503][ T5309]
[ 91.505566][ T5309] CPU: 0 UID: 0 PID: 5309 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 91.505583][ T5309] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 91.505592][ T5309] Call Trace:
[ 91.505598][ T5309]
[ 91.505604][ T5309] dump_stack_lvl+0xe8/0x150
[ 91.505626][ T5309] print_address_description+0x55/0x1e0
[ 91.505643][ T5309] print_report+0x58/0x70
[ 91.505656][ T5309] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 91.505670][ T5309] kasan_report_invalid_free+0xea/0x110
[ 91.505686][ T5309] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 91.505699][ T5309] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 91.505712][ T5309] __kasan_slab_pre_free+0x104/0x120
[ 91.505725][ T5309] kfree+0x173/0x640
[ 91.505742][ T5309] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 91.505756][ T5309] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 91.505768][ T5309] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 91.505782][ T5309] ? down_read+0x2be/0x330
[ 91.505799][ T5309] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 91.505812][ T5309] configfs_write_iter+0x337/0x430
[ 91.505828][ T5309] vfs_write+0x612/0xba0
[ 91.505848][ T5309] ? __pfx_vfs_write+0x10/0x10
[ 91.505863][ T5309] ? __fget_files+0x2a/0x420
[ 91.505878][ T5309] ksys_write+0x150/0x270
[ 91.505892][ T5309] ? __pfx_ksys_write+0x10/0x10
[ 91.505908][ T5309] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 91.505920][ T5309] do_syscall_64+0x174/0x580
[ 91.505936][ T5309] ? trace_irq_disable+0x3b/0x140
[ 91.505951][ T5309] ? clear_bhb_loop+0x70/0xc0
[ 91.505963][ T5309] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 91.505977][ T5309] RIP: 0033:0x7ff5b879e0d9
[ 91.505990][ T5309] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 91.506000][ T5309] RSP: 002b:00007ff5b9725fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 91.506014][ T5309] RAX: ffffffffffffffda RBX: 00007ff5b8a25fa0 RCX: 00007ff5b879e0d9
[ 91.506022][ T5309] RDX: 0000000000000087 RSI: 0000200000000140 RDI: 0000000000000003
[ 91.506030][ T5309] RBP: 00007ff5b8835024 R08: 0000000000000000 R09: 0000000000000000
[ 91.506037][ T5309] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 91.506044][ T5309] R13: 00007ff5b8a26038 R14: 00007ff5b8a25fa0 R15: 00007ffeb38efd38
[ 91.506057][ T5309]
[ 91.506061][ T5309]
[ 91.600706][ T5309] Allocated by task 5309:
[ 91.602344][ T5309] kasan_save_track+0x3e/0x80
[ 91.604246][ T5309] __kasan_kmalloc+0x93/0xb0
[ 91.606066][ T5309] __kmalloc_node_track_caller_noprof+0x4c3/0x730
[ 91.608529][ T5309] kstrdup+0x42/0x100
[ 91.610095][ T5309] f_uac2_opts_c_srate_store+0x11f/0x2b0
[ 91.612279][ T5309] configfs_write_iter+0x337/0x430
[ 91.614235][ T5309] vfs_write+0x612/0xba0
[ 91.615843][ T5309] ksys_write+0x150/0x270
[ 91.617446][ T5309] do_syscall_64+0x174/0x580
[ 91.619143][ T5309] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 91.621591][ T5309]
[ 91.622566][ T5309] The buggy address belongs to the object at ffff88803eedde00
[ 91.622566][ T5309] which belongs to the cache kmalloc-128 of size 128
[ 91.627801][ T5309] The buggy address is located 65 bytes inside of
[ 91.627801][ T5309] 99-byte region [ffff88803eedde00, ffff88803eedde63)
[ 91.632511][ T5309]
[ 91.633548][ T5309] The buggy address belongs to the physical page:
[ 91.636105][ T5309] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3eedd
[ 91.639696][ T5309] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 91.642466][ T5309] page_type: f5(slab)
[ 91.643878][ T5309] raw: 04fff00000000000 ffff88801b041a00 dead000000000100 dead000000000122
[ 91.647189][ T5309] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
[ 91.650569][ T5309] page dumped because: kasan: bad access detected
[ 91.653215][ T5309] page_owner tracks the page as allocated
[ 91.655554][ T5309] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4696, tgid 4696 (udevd), ts 38546546105, free_ts 38539819636
[ 91.663670][ T5309] post_alloc_hook+0x1f9/0x250
[ 91.665706][ T5309] get_page_from_freelist+0x21fa/0x2270
[ 91.668040][ T5309] __alloc_frozen_pages_noprof+0x18d/0x380
[ 91.670482][ T5309] allocate_slab+0x79/0x5e0
[ 91.672480][ T5309] refill_objects+0x2d5/0x350
[ 91.674510][ T5309] __pcs_replace_empty_main+0x2bf/0x6b0
[ 91.676857][ T5309] __kmalloc_noprof+0x485/0x720
[ 91.678875][ T5309] tomoyo_encode+0x2ad/0x570
[ 91.680775][ T5309] tomoyo_realpath_from_path+0x5fa/0x640
[ 91.683119][ T5309] tomoyo_path_perm+0x283/0x560
[ 91.684999][ T5309] security_inode_getattr+0x12b/0x310
[ 91.686946][ T5309] __x64_sys_newfstat+0x133/0x270
[ 91.688959][ T5309] do_syscall_64+0x174/0x580
[ 91.690888][ T5309] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 91.693617][ T5309] page last free pid 4700 tgid 4700 stack trace:
[ 91.696738][ T5309] __free_frozen_pages+0xc1e/0xd10
[ 91.699386][ T5309] rcu_core+0x78b/0x10a0
[ 91.701294][ T5309] handle_softirqs+0x225/0x840
[ 91.703531][ T5309] do_softirq+0x76/0xd0
[ 91.705618][ T5309] __local_bh_enable_ip+0xf8/0x130
[ 91.707777][ T5309] __alloc_skb+0x1ad/0x7a0
[ 91.709615][ T5309] alloc_uevent_skb+0x7d/0x230
[ 91.711534][ T5309] kobject_uevent_net_broadcast+0x2fa/0x560
[ 91.713460][ T5309] kobject_uevent_env+0x566/0x9e0
[ 91.715142][ T5309] kobject_synth_uevent+0x45e/0x950
[ 91.717052][ T5309] uevent_store+0x26/0x70
[ 91.718590][ T5309] kernfs_fop_write_iter+0x3a4/0x540
[ 91.720600][ T5309] vfs_write+0x612/0xba0
[ 91.722188][ T5309] ksys_write+0x150/0x270
[ 91.723804][ T5309] do_syscall_64+0x174/0x580
[ 91.725555][ T5309] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 91.727851][ T5309]
[ 91.728884][ T5309] Memory state around the buggy address:
[ 91.731259][ T5309] ffff88803eeddd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07
[ 91.734419][ T5309] ffff88803eeddd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 91.737473][ T5309] >ffff88803eedde00: 00 00 00 00 00 00 00 00 00 00 00 00 03 fc fc fc
[ 91.740475][ T5309] ^
[ 91.742763][ T5309] ffff88803eedde80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 91.745993][ T5309] ffff88803eeddf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
[ 91.749405][ T5309] ==================================================================
[ 91.796213][ T5309] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 91.799130][ T5309] CPU: 0 UID: 0 PID: 5309 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 91.802727][ T5309] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 91.806737][ T5309] Call Trace:
[ 91.808227][ T5309]
[ 91.809486][ T5309] vpanic+0x56c/0xa60
[ 91.811200][ T5309] ? __pfx_vpanic+0x10/0x10
[ 91.813205][ T5309] ? __pfx___schedule+0x10/0x10
[ 91.815290][ T5309] panic+0xc5/0xd0
[ 91.816920][ T5309] ? __pfx_panic+0x10/0x10
[ 91.818812][ T5309] ? preempt_schedule_common+0x82/0xd0
[ 91.821234][ T5309] check_panic_on_warn+0x89/0xb0
[ 91.823351][ T5309] end_report+0x73/0x170
[ 91.825180][ T5309] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 91.827678][ T5309] kasan_report_invalid_free+0xfa/0x110
[ 91.830092][ T5309] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 91.832566][ T5309] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 91.835101][ T5309] __kasan_slab_pre_free+0x104/0x120
[ 91.837357][ T5309] kfree+0x173/0x640
[ 91.838927][ T5309] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 91.841273][ T5309] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 91.843355][ T5309] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 91.845961][ T5309] ? down_read+0x2be/0x330
[ 91.847934][ T5309] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 91.850611][ T5309] configfs_write_iter+0x337/0x430
[ 91.852793][ T5309] vfs_write+0x612/0xba0
[ 91.854571][ T5309] ? __pfx_vfs_write+0x10/0x10
[ 91.856673][ T5309] ? __fget_files+0x2a/0x420
[ 91.858710][ T5309] ksys_write+0x150/0x270
[ 91.860754][ T5309] ? __pfx_ksys_write+0x10/0x10
[ 91.862867][ T5309] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 91.865463][ T5309] do_syscall_64+0x174/0x580
[ 91.867313][ T5309] ? trace_irq_disable+0x3b/0x140
[ 91.869305][ T5309] ? clear_bhb_loop+0x70/0xc0
[ 91.871175][ T5309] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 91.873526][ T5309] RIP: 0033:0x7ff5b879e0d9
[ 91.875376][ T5309] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 91.883780][ T5309] RSP: 002b:00007ff5b9725fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 91.887789][ T5309] RAX: ffffffffffffffda RBX: 00007ff5b8a25fa0 RCX: 00007ff5b879e0d9
[ 91.892052][ T5309] RDX: 0000000000000087 RSI: 0000200000000140 RDI: 0000000000000003
[ 91.895460][ T5309] RBP: 00007ff5b8835024 R08: 0000000000000000 R09: 0000000000000000
[ 91.898959][ T5309] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 91.902287][ T5309] R13: 00007ff5b8a26038 R14: 00007ff5b8a25fa0 R15: 00007ffeb38efd38
[ 91.905717][ T5309]
[ 91.907478][ T5309] Kernel Offset: disabled
[ 91.909316][ T5309] Rebooting in 86400 seconds..