program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./myconfig\x00', 0x1ff)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x3, 0x0, 0x0, {0x0, 0x0, 0x8}}, @NFT_MSG_DELCHAIN={0x20, 0x5, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x2000}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14}}, 0x7c}}, 0x0)
mount(0x0, &(0x7f0000000280)='./myconfig\x00', &(0x7f00000002c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
vmsplice(r1, &(0x7f0000000080)=[{&(0x7f0000000000)="9fb2966d50ffb7c8338df150613834cf78f305d5dd274364eb3c8fc1a245f6d94c718478c7821f86783b16452cb969c96f62a99b9ac5e1fa4cc8ba77cf1c5427b37afbed3ea242d7258b5533d2b8037ac4a16e0599f13ce13ebe66f627f836361f0cfc3074a10c624e024b1312caaa793c334c1fd268e7", 0x77}], 0x1, 0x0)
write(r1, &(0x7f0000000500)="34343130302c34163030302c38383230302c02000000302c3137", 0x1a)
symlinkat(&(0x7f00000005c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./myconfig/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000000680)='usbip-vudc.0', 0xc)
[ 86.237628][ T5272] Bluetooth: hci0: command tx timeout
[ 86.323647][ T5308] ==================================================================
[ 86.327249][ T5308] BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.330879][ T5308] Free of addr ffff888042f5654c by task syz.0.0/5308
[ 86.333771][ T5308]
[ 86.334808][ T5308] CPU: 0 UID: 0 PID: 5308 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 86.334824][ T5308] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.334831][ T5308] Call Trace:
[ 86.334838][ T5308]
[ 86.334844][ T5308] dump_stack_lvl+0xe8/0x150
[ 86.334864][ T5308] print_address_description+0x55/0x1e0
[ 86.334880][ T5308] print_report+0x58/0x70
[ 86.334891][ T5308] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.334905][ T5308] kasan_report_invalid_free+0xea/0x110
[ 86.334921][ T5308] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.334933][ T5308] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.334945][ T5308] __kasan_slab_pre_free+0x104/0x120
[ 86.334960][ T5308] kfree+0x173/0x640
[ 86.334970][ T5308] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.334983][ T5308] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.334997][ T5308] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 86.335011][ T5308] ? down_read+0x2be/0x330
[ 86.335024][ T5308] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 86.335036][ T5308] configfs_write_iter+0x337/0x430
[ 86.335050][ T5308] vfs_write+0x612/0xba0
[ 86.335069][ T5308] ? __pfx_vfs_write+0x10/0x10
[ 86.335086][ T5308] ? __fget_files+0x2a/0x420
[ 86.335101][ T5308] ksys_write+0x150/0x270
[ 86.335111][ T5308] ? __pfx_ksys_write+0x10/0x10
[ 86.335128][ T5308] do_syscall_64+0x166/0x520
[ 86.335141][ T5308] ? trace_irq_disable+0x3b/0x140
[ 86.335154][ T5308] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.335165][ T5308] ? clear_bhb_loop+0x70/0xc0
[ 86.335176][ T5308] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.335187][ T5308] RIP: 0033:0x7f42ba79e0d9
[ 86.335198][ T5308] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 86.335207][ T5308] RSP: 002b:00007f42bb5ddfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 86.335220][ T5308] RAX: ffffffffffffffda RBX: 00007f42baa25fa0 RCX: 00007f42ba79e0d9
[ 86.335228][ T5308] RDX: 000000000000001a RSI: 0000200000000500 RDI: 0000000000000004
[ 86.335235][ T5308] RBP: 00007f42ba835024 R08: 0000000000000000 R09: 0000000000000000
[ 86.335242][ T5308] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 86.335249][ T5308] R13: 00007f42baa26038 R14: 00007f42baa25fa0 R15: 00007ffeb08c23a8
[ 86.335260][ T5308]
[ 86.335265][ T5308]
[ 86.432260][ T5308] Allocated by task 5308:
[ 86.434058][ T5308] kasan_save_track+0x3e/0x80
[ 86.435987][ T5308] __kasan_kmalloc+0x93/0xb0
[ 86.437818][ T5308] __kmalloc_node_track_caller_noprof+0x4c7/0x740
[ 86.440619][ T5308] kstrdup+0x42/0x100
[ 86.442429][ T5308] f_uac2_opts_p_srate_store+0x11f/0x2b0
[ 86.444840][ T5308] configfs_write_iter+0x337/0x430
[ 86.447056][ T5308] vfs_write+0x612/0xba0
[ 86.448767][ T5308] ksys_write+0x150/0x270
[ 86.450649][ T5308] do_syscall_64+0x166/0x520
[ 86.452699][ T5308] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.455241][ T5308]
[ 86.456298][ T5308] The buggy address belongs to the object at ffff888042f56540
[ 86.456298][ T5308] which belongs to the cache kmalloc-32 of size 32
[ 86.462298][ T5308] The buggy address is located 12 bytes inside of
[ 86.462298][ T5308] 20-byte region [ffff888042f56540, ffff888042f56554)
[ 86.467860][ T5308]
[ 86.468885][ T5308] The buggy address belongs to the physical page:
[ 86.471553][ T5308] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888042f56e00 pfn:0x42f56
[ 86.475925][ T5308] flags: 0x4fff00000000200(workingset|node=1|zone=1|lastcpupid=0x7ff)
[ 86.479474][ T5308] page_type: f5(slab)
[ 86.481280][ T5308] raw: 04fff00000000200 ffff88801b041780 ffff8880304004c8 ffffea0001131b50
[ 86.485065][ T5308] raw: ffff888042f56e00 0000000800400037 00000000f5000000 0000000000000000
[ 86.488721][ T5308] page dumped because: kasan: bad access detected
[ 86.491408][ T5308] page_owner tracks the page as allocated
[ 86.493910][ T5308] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5118, tgid 5118 (cmp), ts 60310686504
[ 86.500987][ T5308] post_alloc_hook+0x1f9/0x250
[ 86.503126][ T5308] get_page_from_freelist+0x2209/0x2280
[ 86.505574][ T5308] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 86.508091][ T5308] allocate_slab+0x7c/0x5e0
[ 86.510061][ T5308] refill_objects+0x2d5/0x350
[ 86.512168][ T5308] __pcs_replace_empty_main+0x2c3/0x6b0
[ 86.514625][ T5308] __kmalloc_cache_noprof+0x3ab/0x660
[ 86.517003][ T5308] kmem_cache_free+0x156/0x650
[ 86.518987][ T5308] vms_complete_munmap_vmas+0x897/0xbe0
[ 86.521356][ T5308] __mmap_complete+0xab/0x4b0
[ 86.523460][ T5308] mmap_region+0x1182/0x2230
[ 86.525522][ T5308] do_mmap+0xe0a/0x1300
[ 86.527444][ T5308] vm_mmap_pgoff+0x272/0x4e0
[ 86.529954][ T5308] ksys_mmap_pgoff+0x4dc/0x760
[ 86.532550][ T5308] do_syscall_64+0x166/0x520
[ 86.535039][ T5308] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.538218][ T5308] page last free pid 15 tgid 15 ts 60309793253 stack trace:
[ 86.542041][ T5308] __free_frozen_pages+0xc93/0xd90
[ 86.544717][ T5308] rcu_core+0x794/0x10b0
[ 86.546675][ T5308] handle_softirqs+0x226/0x860
[ 86.548660][ T5308] run_ksoftirqd+0x36/0x60
[ 86.550780][ T5308] smpboot_thread_fn+0x565/0xa70
[ 86.553201][ T5308] kthread+0x38b/0x480
[ 86.555172][ T5308] ret_from_fork+0x514/0xb70
[ 86.557532][ T5308] ret_from_fork_asm+0x1a/0x30
[ 86.559947][ T5308]
[ 86.561099][ T5308] Memory state around the buggy address:
[ 86.563551][ T5308] ffff888042f56400: 00 00 00 00 fc fc fc fc fa fb fb fb fc fc fc fc
[ 86.567182][ T5308] ffff888042f56480: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[ 86.570542][ T5308] >ffff888042f56500: fa fb fb fb fc fc fc fc 00 00 04 fc fc fc fc fc
[ 86.574087][ T5308] ^
[ 86.576952][ T5308] ffff888042f56580: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[ 86.580355][ T5308] ffff888042f56600: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[ 86.584002][ T5308] ==================================================================
[ 86.606126][ T5308] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 86.609340][ T5308] CPU: 0 UID: 0 PID: 5308 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 86.613209][ T5308] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.617618][ T5308] Call Trace:
[ 86.619168][ T5308]
[ 86.620553][ T5308] vpanic+0x56d/0xa60
[ 86.622472][ T5308] ? __pfx_vpanic+0x10/0x10
[ 86.624521][ T5308] ? __pfx___schedule+0x10/0x10
[ 86.626649][ T5308] panic+0xc5/0xd0
[ 86.628340][ T5308] ? __pfx_panic+0x10/0x10
[ 86.630405][ T5308] ? preempt_schedule_common+0x7f/0xd0
[ 86.632858][ T5308] check_panic_on_warn+0x89/0xb0
[ 86.635137][ T5308] end_report+0x73/0x170
[ 86.637080][ T5308] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.639642][ T5308] kasan_report_invalid_free+0xfa/0x110
[ 86.642146][ T5308] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.644764][ T5308] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.647287][ T5308] __kasan_slab_pre_free+0x104/0x120
[ 86.649910][ T5308] kfree+0x173/0x640
[ 86.652078][ T5308] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.655279][ T5308] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.658077][ T5308] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 86.660708][ T5308] ? down_read+0x2be/0x330
[ 86.662642][ T5308] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 86.665304][ T5308] configfs_write_iter+0x337/0x430
[ 86.667528][ T5308] vfs_write+0x612/0xba0
[ 86.669359][ T5308] ? __pfx_vfs_write+0x10/0x10
[ 86.671415][ T5308] ? __fget_files+0x2a/0x420
[ 86.673480][ T5308] ksys_write+0x150/0x270
[ 86.675500][ T5308] ? __pfx_ksys_write+0x10/0x10
[ 86.678141][ T5308] do_syscall_64+0x166/0x520
[ 86.680402][ T5308] ? trace_irq_disable+0x3b/0x140
[ 86.682635][ T5308] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.685345][ T5308] ? clear_bhb_loop+0x70/0xc0
[ 86.687477][ T5308] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.690121][ T5308] RIP: 0033:0x7f42ba79e0d9
[ 86.692139][ T5308] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 86.700532][ T5308] RSP: 002b:00007f42bb5ddfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 86.704258][ T5308] RAX: ffffffffffffffda RBX: 00007f42baa25fa0 RCX: 00007f42ba79e0d9
[ 86.707776][ T5308] RDX: 000000000000001a RSI: 0000200000000500 RDI: 0000000000000004
[ 86.711208][ T5308] RBP: 00007f42ba835024 R08: 0000000000000000 R09: 0000000000000000
[ 86.714523][ T5308] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 86.717735][ T5308] R13: 00007f42baa26038 R14: 00007f42baa25fa0 R15: 00007ffeb08c23a8
[ 86.721069][ T5308]
[ 86.722712][ T5308] Kernel Offset: disabled
[ 86.724480][ T5308] Rebooting in 86400 seconds..