program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./myconfig\x00', 0x1ff)
mount(0x0, &(0x7f0000000280)='./myconfig\x00', &(0x7f00000002c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)="34343e303034b83030302c3838603230302c39363030302c3100c783b90e072b7e44d1e9766f7699188329c008d59d66fcbc363632e7c79e218258ec26837dd8a743e228e1104746457d83e168999ce7a6549a2c2a4b510810a97f8f72c84b2d2135a0b3816da49172079d6daa58af3fc9de3855b42d916bb20111a304ee5b29baa2f83768ce1c08c53489ed61a713a39e63bf44bfc31faa17c2b96ff9f7288e", 0xa0)
symlinkat(&(0x7f00000005c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./myconfig/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r1, &(0x7f0000000680)='usbip-vudc.0', 0xc)
[ 86.445631][ T5312] ==================================================================
[ 86.448720][ T5312] BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.451681][ T5312] Free of addr ffff888033d59bcb by task syz.0.0/5312
[ 86.454064][ T5312]
[ 86.454979][ T5312] CPU: 0 UID: 0 PID: 5312 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 86.454995][ T5312] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.455003][ T5312] Call Trace:
[ 86.455010][ T5312]
[ 86.455016][ T5312] dump_stack_lvl+0xe8/0x150
[ 86.455038][ T5312] print_address_description+0x55/0x1e0
[ 86.455055][ T5312] print_report+0x58/0x70
[ 86.455068][ T5312] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.455082][ T5312] kasan_report_invalid_free+0xea/0x110
[ 86.455100][ T5312] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.455113][ T5312] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.455148][ T5312] __kasan_slab_pre_free+0x104/0x120
[ 86.455166][ T5312] kfree+0x173/0x640
[ 86.455175][ T5312] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.455187][ T5312] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.455199][ T5312] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 86.455213][ T5312] ? down_read+0x2be/0x330
[ 86.455226][ T5312] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 86.455238][ T5312] configfs_write_iter+0x337/0x430
[ 86.455252][ T5312] vfs_write+0x612/0xba0
[ 86.455272][ T5312] ? __pfx_vfs_write+0x10/0x10
[ 86.455290][ T5312] ? __fget_files+0x2a/0x420
[ 86.455307][ T5312] ksys_write+0x150/0x270
[ 86.455324][ T5312] ? __pfx_ksys_write+0x10/0x10
[ 86.455342][ T5312] do_syscall_64+0x166/0x520
[ 86.455354][ T5312] ? trace_irq_disable+0x3b/0x140
[ 86.455370][ T5312] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.455380][ T5312] ? clear_bhb_loop+0x70/0xc0
[ 86.455393][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.455406][ T5312] RIP: 0033:0x7f44d279e0d9
[ 86.455417][ T5312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 86.455428][ T5312] RSP: 002b:00007f44d36c2fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 86.455440][ T5312] RAX: ffffffffffffffda RBX: 00007f44d2a25fa0 RCX: 00007f44d279e0d9
[ 86.455449][ T5312] RDX: 00000000000000a0 RSI: 00002000000000c0 RDI: 0000000000000003
[ 86.455456][ T5312] RBP: 00007f44d2835024 R08: 0000000000000000 R09: 0000000000000000
[ 86.455462][ T5312] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 86.455469][ T5312] R13: 00007f44d2a26038 R14: 00007f44d2a25fa0 R15: 00007ffdb2777368
[ 86.455481][ T5312]
[ 86.455485][ T5312]
[ 86.550479][ T5312] Allocated by task 5312:
[ 86.552348][ T5312] kasan_save_track+0x3e/0x80
[ 86.554380][ T5312] __kasan_kmalloc+0x93/0xb0
[ 86.556442][ T5312] __kmalloc_node_track_caller_noprof+0x4c7/0x740
[ 86.559163][ T5312] kstrdup+0x42/0x100
[ 86.561073][ T5312] f_uac2_opts_p_srate_store+0x11f/0x2b0
[ 86.563589][ T5312] configfs_write_iter+0x337/0x430
[ 86.565858][ T5312] vfs_write+0x612/0xba0
[ 86.567709][ T5312] ksys_write+0x150/0x270
[ 86.569589][ T5312] do_syscall_64+0x166/0x520
[ 86.571591][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.573979][ T5312]
[ 86.575032][ T5312] The buggy address belongs to the object at ffff888033d59bc0
[ 86.575032][ T5312] which belongs to the cache kmalloc-32 of size 32
[ 86.580725][ T5312] The buggy address is located 11 bytes inside of
[ 86.580725][ T5312] 26-byte region [ffff888033d59bc0, ffff888033d59bda)
[ 86.586554][ T5312]
[ 86.587467][ T5312] The buggy address belongs to the physical page:
[ 86.590073][ T5312] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x33d59
[ 86.593643][ T5312] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 86.596572][ T5312] page_type: f5(slab)
[ 86.598273][ T5312] raw: 04fff00000000000 ffff88801b041780 dead000000000100 dead000000000122
[ 86.601769][ T5312] raw: 0000000000000000 0000000800400040 00000000f5000000 0000000000000000
[ 86.605258][ T5312] page dumped because: kasan: bad access detected
[ 86.607952][ T5312] page_owner tracks the page as allocated
[ 86.610254][ T5312] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 10610959996, free_ts 10610496650
[ 86.618334][ T5312] post_alloc_hook+0x1f9/0x250
[ 86.620384][ T5312] get_page_from_freelist+0x21fe/0x2270
[ 86.622710][ T5312] __alloc_frozen_pages_noprof+0x18d/0x380
[ 86.625147][ T5312] allocate_slab+0x79/0x5e0
[ 86.627028][ T5312] refill_objects+0x2d5/0x350
[ 86.628927][ T5312] __pcs_replace_empty_main+0x2c3/0x6b0
[ 86.631189][ T5312] __kmalloc_noprof+0x489/0x720
[ 86.633217][ T5312] kobject_get_path+0xc5/0x2f0
[ 86.635184][ T5312] kobject_uevent_env+0x29e/0x9e0
[ 86.637213][ T5312] tty_register_device_attr+0x573/0x950
[ 86.639528][ T5312] tty_register_driver+0x82c/0xdf0
[ 86.641724][ T5312] legacy_pty_init+0x3a2/0x5d0
[ 86.643837][ T5312] pty_init+0x9/0x20
[ 86.645505][ T5312] do_one_initcall+0x250/0x870
[ 86.647529][ T5312] do_initcall_level+0x10a/0x1a0
[ 86.649484][ T5312] do_initcalls+0x59/0xa0
[ 86.651240][ T5312] page last free pid 261 tgid 261 stack trace:
[ 86.653688][ T5312] __free_frozen_pages+0xc22/0xd20
[ 86.655886][ T5312] __kasan_populate_vmalloc+0x1a8/0x1c0
[ 86.658052][ T5312] alloc_vmap_area+0xd1a/0x1420
[ 86.660157][ T5312] __get_vm_area_node+0x200/0x2f0
[ 86.662636][ T5312] __vmalloc_node_range_noprof+0x358/0x1730
[ 86.665416][ T5312] __vmalloc_node_noprof+0xc2/0x100
[ 86.667642][ T5312] dup_task_struct+0x2c1/0xa20
[ 86.669739][ T5312] copy_process+0x820/0x43e0
[ 86.671709][ T5312] kernel_clone+0x2d7/0x940
[ 86.673619][ T5312] user_mode_thread+0x115/0x180
[ 86.675785][ T5312] call_usermodehelper_exec_work+0x5c/0x230
[ 86.678234][ T5312] process_scheduled_works+0xa88/0x14c0
[ 86.680516][ T5312] worker_thread+0xa47/0xfb0
[ 86.682406][ T5312] kthread+0x38b/0x480
[ 86.683991][ T5312] ret_from_fork+0x514/0xb70
[ 86.685896][ T5312] ret_from_fork_asm+0x1a/0x30
[ 86.687909][ T5312]
[ 86.688953][ T5312] Memory state around the buggy address:
[ 86.691280][ T5312] ffff888033d59a80: 00 00 00 00 fc fc fc fc fa fb fb fb fc fc fc fc
[ 86.694628][ T5312] ffff888033d59b00: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc
[ 86.697921][ T5312] >ffff888033d59b80: fa fb fb fb fc fc fc fc 00 00 00 02 fc fc fc fc
[ 86.701229][ T5312] ^
[ 86.703932][ T5312] ffff888033d59c00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[ 86.707272][ T5312] ffff888033d59c80: 00 00 00 00 fc fc fc fc fa fb fb fb fc fc fc fc
[ 86.710638][ T5312] ==================================================================
[ 86.731796][ T5277] Bluetooth: hci0: command tx timeout
[ 86.737812][ T9] cfg80211: failed to load regulatory.db
[ 86.783283][ T5312] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 86.786302][ T5312] CPU: 0 UID: 0 PID: 5312 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 86.789942][ T5312] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.794107][ T5312] Call Trace:
[ 86.795601][ T5312]
[ 86.796857][ T5312] vpanic+0x56d/0xa60
[ 86.798508][ T5312] ? __pfx_vpanic+0x10/0x10
[ 86.800408][ T5312] ? __pfx___schedule+0x10/0x10
[ 86.802425][ T5312] panic+0xc5/0xd0
[ 86.804032][ T5312] ? __pfx_panic+0x10/0x10
[ 86.805914][ T5312] ? preempt_schedule_common+0x7f/0xd0
[ 86.808201][ T5312] check_panic_on_warn+0x89/0xb0
[ 86.810207][ T5312] end_report+0x73/0x170
[ 86.811950][ T5312] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.814282][ T5312] kasan_report_invalid_free+0xfa/0x110
[ 86.816611][ T5312] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.819066][ T5312] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.821698][ T5312] __kasan_slab_pre_free+0x104/0x120
[ 86.824017][ T5312] kfree+0x173/0x640
[ 86.825659][ T5312] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.828156][ T5312] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.830426][ T5312] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 86.832945][ T5312] ? down_read+0x2be/0x330
[ 86.834866][ T5312] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 86.837542][ T5312] configfs_write_iter+0x337/0x430
[ 86.839804][ T5312] vfs_write+0x612/0xba0
[ 86.841608][ T5312] ? __pfx_vfs_write+0x10/0x10
[ 86.843696][ T5312] ? __fget_files+0x2a/0x420
[ 86.845678][ T5312] ksys_write+0x150/0x270
[ 86.847388][ T5312] ? __pfx_ksys_write+0x10/0x10
[ 86.849313][ T5312] do_syscall_64+0x166/0x520
[ 86.851053][ T5312] ? trace_irq_disable+0x3b/0x140
[ 86.853072][ T5312] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.855649][ T5312] ? clear_bhb_loop+0x70/0xc0
[ 86.857607][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.860052][ T5312] RIP: 0033:0x7f44d279e0d9
[ 86.861773][ T5312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 86.869632][ T5312] RSP: 002b:00007f44d36c2fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 86.872899][ T5312] RAX: ffffffffffffffda RBX: 00007f44d2a25fa0 RCX: 00007f44d279e0d9
[ 86.876062][ T5312] RDX: 00000000000000a0 RSI: 00002000000000c0 RDI: 0000000000000003
[ 86.879157][ T5312] RBP: 00007f44d2835024 R08: 0000000000000000 R09: 0000000000000000
[ 86.882314][ T5312] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 86.885552][ T5312] R13: 00007f44d2a26038 R14: 00007f44d2a25fa0 R15: 00007ffdb2777368
[ 86.888710][ T5312]
[ 86.890329][ T5312] Kernel Offset: disabled
[ 86.892181][ T5312] Rebooting in 86400 seconds..