program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000440)='44100,48000,88200,96000,176400,192000,352800,384000,705600,7', 0x3c)
r1 = syz_open_dev$dri(&(0x7f0000000240), 0x0, 0x0)
ioctl$DRM_IOCTL_GET_CLIENT(r1, 0xc02864cf, &(0x7f00000001c0)={0x0, 0x0, {}, {0xee00}})
r2 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r2, &(0x7f0000000000)="34343139363030302c31372c3335323830302c3338343030302c5630353630302c370000000000007c4768ee95a03ab05a0764f7e06ec56505367391c872a6611599028d081ab97e789a6a7e5dfb30eb742aae6ac1d0b4abe890759f6a0a", 0x5e)
symlinkat(&(0x7f0000000580)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00')
r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./myconfig/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r3, &(0x7f0000000640)='usbip-vudc.0', 0xc)
[ 122.640932][ T4648] Bluetooth: hci0: command tx timeout
[ 122.727758][ T5323] ==================================================================
[ 122.731394][ T5323] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0
[ 122.735029][ T5323] Free of addr ffff88801251d821 by task syz.0.0/5323
[ 122.737951][ T5323]
[ 122.738976][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 122.738991][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 122.738999][ T5323] Call Trace:
[ 122.739005][ T5323]
[ 122.739011][ T5323] dump_stack_lvl+0xe8/0x150
[ 122.739032][ T5323] print_address_description+0x55/0x1e0
[ 122.739048][ T5323] print_report+0x58/0x70
[ 122.739061][ T5323] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 122.739074][ T5323] kasan_report_invalid_free+0xea/0x110
[ 122.739090][ T5323] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 122.739101][ T5323] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 122.739115][ T5323] __kasan_slab_pre_free+0x104/0x120
[ 122.739128][ T5323] kfree+0x173/0x640
[ 122.739138][ T5323] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 122.739151][ T5323] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 122.739166][ T5323] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 122.739181][ T5323] ? down_read+0x2be/0x330
[ 122.739197][ T5323] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 122.739211][ T5323] configfs_write_iter+0x337/0x430
[ 122.739228][ T5323] vfs_write+0x612/0xba0
[ 122.739245][ T5323] ? __pfx_vfs_write+0x10/0x10
[ 122.739259][ T5323] ? __fget_files+0x2a/0x420
[ 122.739272][ T5323] ksys_write+0x150/0x270
[ 122.739288][ T5323] ? __pfx_ksys_write+0x10/0x10
[ 122.739305][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 122.739318][ T5323] do_syscall_64+0x174/0x580
[ 122.739331][ T5323] ? trace_irq_disable+0x3b/0x140
[ 122.739344][ T5323] ? clear_bhb_loop+0x40/0x90
[ 122.739356][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 122.739366][ T5323] RIP: 0033:0x7fe87899e019
[ 122.739377][ T5323] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 122.739387][ T5323] RSP: 002b:00007fe87994cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 122.739400][ T5323] RAX: ffffffffffffffda RBX: 00007fe878c25fa0 RCX: 00007fe87899e019
[ 122.739407][ T5323] RDX: 000000000000005e RSI: 0000200000000000 RDI: 0000000000000005
[ 122.739414][ T5323] RBP: 00007fe878a3500c R08: 0000000000000000 R09: 0000000000000000
[ 122.739421][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 122.739427][ T5323] R13: 00007fe878c26038 R14: 00007fe878c25fa0 R15: 00007fffa1160388
[ 122.739437][ T5323]
[ 122.739440][ T5323]
[ 122.838967][ T5323] Allocated by task 5323:
[ 122.841040][ T5323] kasan_save_track+0x3e/0x80
[ 122.843139][ T5323] __kasan_kmalloc+0x93/0xb0
[ 122.845205][ T5323] __kmalloc_node_track_caller_noprof+0x4c3/0x730
[ 122.847938][ T5323] kstrdup+0x42/0x100
[ 122.849640][ T5323] f_uac2_opts_c_srate_store+0x11f/0x2b0
[ 122.852017][ T5323] configfs_write_iter+0x337/0x430
[ 122.854171][ T5323] vfs_write+0x612/0xba0
[ 122.855940][ T5323] ksys_write+0x150/0x270
[ 122.857805][ T5323] do_syscall_64+0x174/0x580
[ 122.859700][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 122.862353][ T5323]
[ 122.863385][ T5323] The buggy address belongs to the object at ffff88801251d800
[ 122.863385][ T5323] which belongs to the cache kmalloc-64 of size 64
[ 122.869023][ T5323] The buggy address is located 33 bytes inside of
[ 122.869023][ T5323] 35-byte region [ffff88801251d800, ffff88801251d823)
[ 122.874600][ T5323]
[ 122.875642][ T5323] The buggy address belongs to the physical page:
[ 122.878250][ T5323] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1251d
[ 122.881960][ T5323] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 122.884928][ T5323] page_type: f5(slab)
[ 122.886697][ T5323] raw: 00fff00000000000 ffff88801b0418c0 dead000000000100 dead000000000122
[ 122.890280][ T5323] raw: 0000000000000000 0000000800200020 00000000f5000000 0000000000000000
[ 122.893738][ T5323] page dumped because: kasan: bad access detected
[ 122.896418][ T5323] page_owner tracks the page as allocated
[ 122.898914][ T5323] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5003, tgid 5003 (chmod), ts 92022660297, free_ts 92006650040
[ 122.907219][ T5323] post_alloc_hook+0x1f9/0x250
[ 122.909268][ T5323] get_page_from_freelist+0x21fa/0x2270
[ 122.911692][ T5323] __alloc_frozen_pages_noprof+0x18d/0x380
[ 122.914249][ T5323] allocate_slab+0x79/0x5e0
[ 122.916229][ T5323] refill_objects+0x2d5/0x350
[ 122.918266][ T5323] __pcs_replace_empty_main+0x2bf/0x6b0
[ 122.920631][ T5323] __kmalloc_noprof+0x485/0x720
[ 122.922765][ T5323] tomoyo_encode+0x2ad/0x570
[ 122.924856][ T5323] tomoyo_realpath_from_path+0x5fa/0x640
[ 122.927275][ T5323] tomoyo_check_open_permission+0x229/0x470
[ 122.929865][ T5323] security_file_open+0xa9/0x240
[ 122.932060][ T5323] do_dentry_open+0x4a0/0x1380
[ 122.934157][ T5323] vfs_open+0x3b/0x340
[ 122.935943][ T5323] path_openat+0x2e44/0x3830
[ 122.938016][ T5323] do_file_open+0x23e/0x4a0
[ 122.940054][ T5323] do_sys_openat2+0x115/0x200
[ 122.942194][ T5323] page last free pid 15 tgid 15 stack trace:
[ 122.944827][ T5323] __free_frozen_pages+0xc1e/0xd10
[ 122.947104][ T5323] tlb_remove_table_rcu+0x85/0x100
[ 122.949239][ T5323] rcu_core+0x78b/0x10a0
[ 122.950979][ T5323] handle_softirqs+0x225/0x840
[ 122.952979][ T5323] run_ksoftirqd+0x36/0x60
[ 122.954793][ T5323] smpboot_thread_fn+0x57c/0xa80
[ 122.956809][ T5323] kthread+0x388/0x470
[ 122.958493][ T5323] ret_from_fork+0x514/0xb70
[ 122.960392][ T5323] ret_from_fork_asm+0x1a/0x30
[ 122.962365][ T5323]
[ 122.963349][ T5323] Memory state around the buggy address:
[ 122.965735][ T5323] ffff88801251d700: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[ 122.969155][ T5323] ffff88801251d780: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 122.972604][ T5323] >ffff88801251d800: 00 00 00 00 03 fc fc fc fc fc fc fc fc fc fc fc
[ 122.976051][ T5323] ^
[ 122.978293][ T5323] ffff88801251d880: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 122.981810][ T5323] ffff88801251d900: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 122.985709][ T5323] ==================================================================
[ 123.021141][ T5323] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 123.024256][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 123.028117][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 123.032204][ T5323] Call Trace:
[ 123.033684][ T5323]
[ 123.035019][ T5323] vpanic+0x56c/0xa60
[ 123.036814][ T5323] ? __pfx_vpanic+0x10/0x10
[ 123.038887][ T5323] ? __pfx___schedule+0x10/0x10
[ 123.040923][ T5323] panic+0xc5/0xd0
[ 123.042730][ T5323] ? __pfx_panic+0x10/0x10
[ 123.044571][ T5323] ? preempt_schedule_common+0x82/0xd0
[ 123.046916][ T5323] check_panic_on_warn+0x89/0xb0
[ 123.049061][ T5323] end_report+0x73/0x170
[ 123.050917][ T5323] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 123.053274][ T5323] kasan_report_invalid_free+0xfa/0x110
[ 123.055584][ T5323] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 123.058067][ T5323] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 123.060404][ T5323] __kasan_slab_pre_free+0x104/0x120
[ 123.062629][ T5323] kfree+0x173/0x640
[ 123.064317][ T5323] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 123.066804][ T5323] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 123.069174][ T5323] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 123.071760][ T5323] ? down_read+0x2be/0x330
[ 123.073618][ T5323] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 123.076241][ T5323] configfs_write_iter+0x337/0x430
[ 123.078415][ T5323] vfs_write+0x612/0xba0
[ 123.080211][ T5323] ? __pfx_vfs_write+0x10/0x10
[ 123.082367][ T5323] ? __fget_files+0x2a/0x420
[ 123.084366][ T5323] ksys_write+0x150/0x270
[ 123.086240][ T5323] ? __pfx_ksys_write+0x10/0x10
[ 123.088335][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 123.091056][ T5323] do_syscall_64+0x174/0x580
[ 123.093043][ T5323] ? trace_irq_disable+0x3b/0x140
[ 123.095240][ T5323] ? clear_bhb_loop+0x40/0x90
[ 123.097242][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 123.099713][ T5323] RIP: 0033:0x7fe87899e019
[ 123.101626][ T5323] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 123.109261][ T5323] RSP: 002b:00007fe87994cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 123.112549][ T5323] RAX: ffffffffffffffda RBX: 00007fe878c25fa0 RCX: 00007fe87899e019
[ 123.115587][ T5323] RDX: 000000000000005e RSI: 0000200000000000 RDI: 0000000000000005
[ 123.118697][ T5323] RBP: 00007fe878a3500c R08: 0000000000000000 R09: 0000000000000000
[ 123.121960][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 123.125382][ T5323] R13: 00007fe878c26038 R14: 00007fe878c25fa0 R15: 00007fffa1160388
[ 123.128642][ T5323]
[ 123.130348][ T5323] Kernel Offset: disabled
[ 123.132188][ T5323] Rebooting in 86400 seconds..