program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x6)
r1 = syz_open_dev$media(&(0x7f0000001a80), 0x4, 0x20000)
ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc0287c02, 0x0)
write(r0, &(0x7f0000000680)="34c5313030e8727f472c34383030302c38383230302c3936303430302c3139323030302c33d95c480edaea7558873b8f2196dd2b1e2ca416bc7a91fdd3acf3ccafff44da00a95934a0519a618b152fe2c99c7b4d26350da9401aa85d5f90d97dfdfc721810c11f7d1ddc3a1189c26eacfef493cd1cf402c4a87fca4e0808bd9c772911642af810f3fc4d82a63c81dd1910aeeb00491624d349059d8886cda239ab0946f5e3275ff435d56c15f14f870657eb3a6d3357a5c6360926e43e8e988e0fc225096e1f7e756006c8113e7c315303668b955ed070df1eddbe25096c238f0a0144e72fa7bcc49d7b5a51ed87d570c7ab5fe63c5966f5d2cd6ebfff07726529ca8e4d400aebb2c1fe3cf8d1675f1f506130c315dbddb17d32157e85164829f206ab4ef913f6b57b70cca7753135f6ddf715dd663d67af9cf44c", 0x13b)
symlinkat(&(0x7f0000000580)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./myconfig/usb_gadget/g1/UDC\x00', 0x801, 0x48)
write(r2, &(0x7f0000000640)='usbip-vudc.0', 0xc)
[ 86.842631][ T5277] Bluetooth: hci0: command tx timeout
[ 86.853498][ T5313] ==================================================================
[ 86.856493][ T5313] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0
[ 86.860736][ T5313] Free of addr ffff888012cc228a by task syz.0.0/5313
[ 86.863726][ T5313]
[ 86.864824][ T5313] CPU: 0 UID: 0 PID: 5313 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 86.864839][ T5313] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.864847][ T5313] Call Trace:
[ 86.864854][ T5313]
[ 86.864859][ T5313] dump_stack_lvl+0xe8/0x150
[ 86.864878][ T5313] print_address_description+0x55/0x1e0
[ 86.864894][ T5313] print_report+0x58/0x70
[ 86.864906][ T5313] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 86.864919][ T5313] kasan_report_invalid_free+0xea/0x110
[ 86.864933][ T5313] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 86.864949][ T5313] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 86.864963][ T5313] __kasan_slab_pre_free+0x104/0x120
[ 86.864979][ T5313] kfree+0x173/0x640
[ 86.864991][ T5313] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 86.865004][ T5313] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 86.865020][ T5313] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 86.865033][ T5313] ? down_read+0x2be/0x330
[ 86.865049][ T5313] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 86.865062][ T5313] configfs_write_iter+0x337/0x430
[ 86.865076][ T5313] vfs_write+0x612/0xba0
[ 86.865095][ T5313] ? __pfx_vfs_write+0x10/0x10
[ 86.865114][ T5313] ? __fget_files+0x2a/0x420
[ 86.865132][ T5313] ksys_write+0x150/0x270
[ 86.865141][ T5313] ? __pfx_ksys_write+0x10/0x10
[ 86.865159][ T5313] do_syscall_64+0x166/0x520
[ 86.865171][ T5313] ? trace_irq_disable+0x3b/0x140
[ 86.865185][ T5313] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.865199][ T5313] ? clear_bhb_loop+0x70/0xc0
[ 86.865213][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.865227][ T5313] RIP: 0033:0x7f426ed9e0d9
[ 86.865240][ T5313] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 86.865249][ T5313] RSP: 002b:00007f426b1f4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 86.865262][ T5313] RAX: ffffffffffffffda RBX: 00007f426f025fa0 RCX: 00007f426ed9e0d9
[ 86.865270][ T5313] RDX: 000000000000013b RSI: 0000200000000680 RDI: 0000000000000003
[ 86.865276][ T5313] RBP: 00007f426ee35024 R08: 0000000000000000 R09: 0000000000000000
[ 86.865283][ T5313] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 86.865290][ T5313] R13: 00007f426f026038 R14: 00007f426f025fa0 R15: 00007ffeac09b318
[ 86.865301][ T5313]
[ 86.865305][ T5313]
[ 86.966262][ T5313] Allocated by task 5313:
[ 86.967783][ T5313] kasan_save_track+0x3e/0x80
[ 86.969778][ T5313] __kasan_kmalloc+0x93/0xb0
[ 86.971756][ T5313] __kmalloc_node_track_caller_noprof+0x4c7/0x740
[ 86.974801][ T5313] kstrdup+0x42/0x100
[ 86.976849][ T5313] f_uac2_opts_c_srate_store+0x11f/0x2b0
[ 86.979754][ T5313] configfs_write_iter+0x337/0x430
[ 86.982359][ T5313] vfs_write+0x612/0xba0
[ 86.984598][ T5313] ksys_write+0x150/0x270
[ 86.986962][ T5313] do_syscall_64+0x166/0x520
[ 86.989505][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.992866][ T5313]
[ 86.994284][ T5313] The buggy address belongs to the object at ffff888012cc2280
[ 86.994284][ T5313] which belongs to the cache kmalloc-96 of size 96
[ 87.000299][ T5313] The buggy address is located 10 bytes inside of
[ 87.000299][ T5313] 69-byte region [ffff888012cc2280, ffff888012cc22c5)
[ 87.006548][ T5313]
[ 87.007920][ T5313] The buggy address belongs to the physical page:
[ 87.010987][ T5313] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12cc2
[ 87.014695][ T5313] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 87.017678][ T5313] page_type: f5(slab)
[ 87.019413][ T5313] raw: 00fff00000000000 ffff88801b041280 dead000000000122 0000000000000000
[ 87.023090][ T5313] raw: 0000000000000000 0000000800200020 00000000f5000000 0000000000000000
[ 87.026683][ T5313] page dumped because: kasan: bad access detected
[ 87.029529][ T5313] page_owner tracks the page as allocated
[ 87.032075][ T5313] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 13, tgid 13 (kworker/u4:1), ts 86822524914
[ 87.039998][ T5313] post_alloc_hook+0x1f9/0x250
[ 87.042108][ T5313] get_page_from_freelist+0x2209/0x2280
[ 87.044445][ T5313] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 87.047005][ T5313] allocate_slab+0x7c/0x5e0
[ 87.048966][ T5313] refill_objects+0x2d5/0x350
[ 87.051027][ T5313] __pcs_replace_empty_main+0x2c3/0x6b0
[ 87.053524][ T5313] __kmalloc_cache_noprof+0x3ab/0x660
[ 87.055857][ T5313] nsim_fib_event_nb+0x185/0x11d0
[ 87.058098][ T5313] notifier_call_chain+0x1a5/0x3d0
[ 87.060321][ T5313] atomic_notifier_call_chain+0xda/0x180
[ 87.062810][ T5313] call_fib_notifiers+0x31/0x60
[ 87.064988][ T5313] fib6_add_rt2node+0x15f3/0x3940
[ 87.067169][ T5313] fib6_add+0x9ae/0x1a20
[ 87.068939][ T5313] ip6_ins_rt+0xd6/0x140
[ 87.070787][ T5313] __ipv6_ifa_notify+0x4e8/0xc60
[ 87.072915][ T5313] addrconf_dad_completed+0x1a1/0xe60
[ 87.075256][ T5313] page last free pid 13 tgid 13 ts 86816336229 stack trace:
[ 87.078438][ T5313] __free_frozen_pages+0xc93/0xd90
[ 87.080654][ T5313] __slab_free+0x274/0x2c0
[ 87.082706][ T5313] qlist_free_all+0x99/0x100
[ 87.084749][ T5313] kasan_quarantine_reduce+0x148/0x160
[ 87.087118][ T5313] __kasan_slab_alloc+0x22/0x80
[ 87.089245][ T5313] kmem_cache_alloc_node_noprof+0x359/0x620
[ 87.091907][ T5313] __alloc_skb+0x1db/0x7a0
[ 87.093933][ T5313] mld_newpack+0x165/0xcb0
[ 87.095879][ T5313] add_grec+0x119f/0x19d0
[ 87.097881][ T5313] mld_send_initial_cr+0x288/0x550
[ 87.100145][ T5313] ipv6_mc_dad_complete+0x87/0x410
[ 87.102408][ T5313] addrconf_dad_completed+0x8af/0xe60
[ 87.104759][ T5313] addrconf_dad_work+0xcf8/0x15c0
[ 87.107017][ T5313] process_scheduled_works+0xc3d/0x1630
[ 87.109386][ T5313] worker_thread+0xa47/0xfb0
[ 87.111342][ T5313] kthread+0x38b/0x480
[ 87.113048][ T5313]
[ 87.114095][ T5313] Memory state around the buggy address:
[ 87.116461][ T5313] ffff888012cc2180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 87.119802][ T5313] ffff888012cc2200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 87.123220][ T5313] >ffff888012cc2280: 00 00 00 00 00 00 00 00 05 fc fc fc fc fc fc fc
[ 87.126697][ T5313] ^
[ 87.128532][ T5313] ffff888012cc2300: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[ 87.132032][ T5313] ffff888012cc2380: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[ 87.135558][ T5313] ==================================================================
[ 87.168479][ T5313] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 87.171594][ T5313] CPU: 0 UID: 0 PID: 5313 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 87.175471][ T5313] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 87.179860][ T5313] Call Trace:
[ 87.181335][ T5313]
[ 87.182715][ T5313] vpanic+0x56d/0xa60
[ 87.184502][ T5313] ? __pfx_vpanic+0x10/0x10
[ 87.186537][ T5313] ? __pfx___schedule+0x10/0x10
[ 87.188606][ T5313] panic+0xc5/0xd0
[ 87.190355][ T5313] ? __pfx_panic+0x10/0x10
[ 87.192344][ T5313] ? preempt_schedule_common+0x7f/0xd0
[ 87.194733][ T5313] check_panic_on_warn+0x89/0xb0
[ 87.196916][ T5313] end_report+0x73/0x170
[ 87.198707][ T5313] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 87.201235][ T5313] kasan_report_invalid_free+0xfa/0x110
[ 87.203583][ T5313] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 87.206080][ T5313] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 87.208592][ T5313] __kasan_slab_pre_free+0x104/0x120
[ 87.210932][ T5313] kfree+0x173/0x640
[ 87.212698][ T5313] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 87.215257][ T5313] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 87.217596][ T5313] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 87.220218][ T5313] ? down_read+0x2be/0x330
[ 87.222213][ T5313] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 87.224878][ T5313] configfs_write_iter+0x337/0x430
[ 87.227063][ T5313] vfs_write+0x612/0xba0
[ 87.228959][ T5313] ? __pfx_vfs_write+0x10/0x10
[ 87.231091][ T5313] ? __fget_files+0x2a/0x420
[ 87.233147][ T5313] ksys_write+0x150/0x270
[ 87.235086][ T5313] ? __pfx_ksys_write+0x10/0x10
[ 87.237247][ T5313] do_syscall_64+0x166/0x520
[ 87.239281][ T5313] ? trace_irq_disable+0x3b/0x140
[ 87.241547][ T5313] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.244152][ T5313] ? clear_bhb_loop+0x70/0xc0
[ 87.246216][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.248440][ T5313] RIP: 0033:0x7f426ed9e0d9
[ 87.250199][ T5313] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 87.258687][ T5313] RSP: 002b:00007f426b1f4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 87.262192][ T5313] RAX: ffffffffffffffda RBX: 00007f426f025fa0 RCX: 00007f426ed9e0d9
[ 87.265599][ T5313] RDX: 000000000000013b RSI: 0000200000000680 RDI: 0000000000000003
[ 87.268936][ T5313] RBP: 00007f426ee35024 R08: 0000000000000000 R09: 0000000000000000
[ 87.272312][ T5313] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 87.275376][ T5313] R13: 00007f426f026038 R14: 00007f426f025fa0 R15: 00007ffeac09b318
[ 87.278647][ T5313]
[ 87.280320][ T5313] Kernel Offset: disabled
[ 87.282104][ T5313] Rebooting in 86400 seconds..