Extracting prog: 58.992983822s
Minimizing prog: 24m18.068000469s
Simplifying prog options: 0s
Extracting C: 35.438284708s
Simplifying C: 3m33.307874167s


extracting reproducer from 75 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdirat-mount-mkdirat-mkdirat-bpf$PROG_LOAD-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-socket$nl_xfrm-sendmsg$nl_xfrm-io_uring_setup-openat-io_uring_register$IORING_REGISTER_EVENTFD_ASYNC-openat-write-read$FUSE-mmap-open-ioctl$VFAT_IOCTL_READDIR_SHORT
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000040)='./file1\x00', 0x8000, &(0x7f0000000c00)=ANY=[], 0xf, 0x2b1, &(0x7f0000000480)="$eJzs3TFre1UUAPDzkjSJOqSIi+LwQAen0rq6NEoFsZMSQR002BYkCYUWAlY0duoncPR7+BFcXPwGgqvg1g6VJy/vvSa1SVtqrNL/7zed3nvPfSf3lrRLTj5/dTTYO0zi9PzXaLeTqG3HdlwksR61qHwXjQAAno6LLIvWgzIbtZUXAwA8ivzv/x9Z4a61D/s/AQD4v/nw40/e7+7u7nyQpu14uXM27iURMTob94r57kF8GcPYj83oxGVEdqWI331vdycaaW49Xh9Nxr08c/TZz+X+3d8jpvlb0Yn1xflbaeEq//mqujS6B2vVD514aXH+m3/Pj9Ekes1447W5+jeiE798EYcxjL3Ic2f5326l6TvZ9+dff5o/Js9PatFrTdfNZPVHuhIAAAAAAAAAAAAAAAAAAAAAAJ4BG2maFO17pv178qFp/5xxr345nd9IK/P9fSZVf6Ck2qjoD5RF2aJnksUPVX+dzTRNs3LhLL8RrzR8sQAAAAAAAAAAAAAAAAAAAADkjr86GfSHw/2jlQRVN4DqY/0P3Wd7NrIWEYN+ffmGrYjaPZ81320gr/XWxdFoxIqO5a7gubyele/cml3uR1EE1cXsJyt81otvF5ueDPppOVUd8qCf3HWG7erifpyfasY/LSyb/kpcZuXIN5Ffd7SvSr2e1VzRaTRfWDj1Z5Zl99vnrd+KOypHkmmLjfs9fa0MFr7APGjfvIuflm+49C2jvqr3HgAAAAAAAAAAAAAAAAAA4LrZh34XTJ7emlr714oCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEc2+/7/KmhHxPWRG8GkyE0iYumaMmjG0fF//RoBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4+v4KAAD//8HoSHM=")
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig\x00', 0x13c)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x22d3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=<r0=>0xffffffffffffffff, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0x7}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000838500000004"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=@getspdinfo={0x14, 0x28, 0x1, 0x70bd2d, 0x25dfdbfb, 0x7}, 0x14}, 0x1, 0x0, 0x0, 0x2400c845}, 0x4004050)
r3 = io_uring_setup(0x4c54, &(0x7f0000000680)={0x0, 0x274f, 0x40, 0x3, 0x27d})
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0)
io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r3, 0x7, &(0x7f0000000000)=r4, 0x1)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3)
write(r5, &(0x7f00000004c0)="347499acee446f81aa92302c38383230302ca6452692469d66e0", 0x1a)
read$FUSE(r5, &(0x7f00000005c0)={0x2020}, 0x2020)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000)
r6 = open(&(0x7f0000000000)='./file1\x00', 0x8000, 0x112)
ioctl$VFAT_IOCTL_READDIR_SHORT(r6, 0x82307202, &(0x7f0000006080)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}])

program crashed: KASAN: invalid-free in f_uac2_opts_c_srate_store
single: successfully extracted reproducer
found reproducer with 21 syscalls
minimizing guilty program
testing program (duration=34.308466693s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdirat-mount-mkdirat-mkdirat-bpf$PROG_LOAD-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-socket$nl_xfrm-sendmsg$nl_xfrm-io_uring_setup-openat-io_uring_register$IORING_REGISTER_EVENTFD_ASYNC-openat-write-read$FUSE-mmap-open
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000040)='./file1\x00', 0x8000, &(0x7f0000000c00)=ANY=[], 0xf, 0x2b1, &(0x7f0000000480)="$eJzs3TFre1UUAPDzkjSJOqSIi+LwQAen0rq6NEoFsZMSQR002BYkCYUWAlY0duoncPR7+BFcXPwGgqvg1g6VJy/vvSa1SVtqrNL/7zed3nvPfSf3lrRLTj5/dTTYO0zi9PzXaLeTqG3HdlwksR61qHwXjQAAno6LLIvWgzIbtZUXAwA8ivzv/x9Z4a61D/s/AQD4v/nw40/e7+7u7nyQpu14uXM27iURMTob94r57kF8GcPYj83oxGVEdqWI331vdycaaW49Xh9Nxr08c/TZz+X+3d8jpvlb0Yn1xflbaeEq//mqujS6B2vVD514aXH+m3/Pj9Ekes1447W5+jeiE798EYcxjL3Ic2f5326l6TvZ9+dff5o/Js9PatFrTdfNZPVHuhIAAAAAAAAAAAAAAAAAAAAAAJ4BG2maFO17pv178qFp/5xxr345nd9IK/P9fSZVf6Ck2qjoD5RF2aJnksUPVX+dzTRNs3LhLL8RrzR8sQAAAAAAAAAAAAAAAAAAAADkjr86GfSHw/2jlQRVN4DqY/0P3Wd7NrIWEYN+ffmGrYjaPZ81320gr/XWxdFoxIqO5a7gubyele/cml3uR1EE1cXsJyt81otvF5ueDPppOVUd8qCf3HWG7erifpyfasY/LSyb/kpcZuXIN5Ffd7SvSr2e1VzRaTRfWDj1Z5Zl99vnrd+KOypHkmmLjfs9fa0MFr7APGjfvIuflm+49C2jvqr3HgAAAAAAAAAAAAAAAAAA4LrZh34XTJ7emlr714oCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEc2+/7/KmhHxPWRG8GkyE0iYumaMmjG0fF//RoBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4+v4KAAD//8HoSHM=")
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig\x00', 0x13c)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x22d3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=<r0=>0xffffffffffffffff, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0x7}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000838500000004"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=@getspdinfo={0x14, 0x28, 0x1, 0x70bd2d, 0x25dfdbfb, 0x7}, 0x14}, 0x1, 0x0, 0x0, 0x2400c845}, 0x4004050)
r3 = io_uring_setup(0x4c54, &(0x7f0000000680)={0x0, 0x274f, 0x40, 0x3, 0x27d})
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0)
io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r3, 0x7, &(0x7f0000000000)=r4, 0x1)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3)
write(r5, &(0x7f00000004c0)="347499acee446f81aa92302c38383230302ca6452692469d66e0", 0x1a)
read$FUSE(r5, &(0x7f00000005c0)={0x2020}, 0x2020)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000)
open(&(0x7f0000000000)='./file1\x00', 0x8000, 0x112)

program crashed: KASAN: invalid-free in f_uac2_opts_c_srate_store
testing program (duration=34.308466693s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdirat-mount-mkdirat-mkdirat-bpf$PROG_LOAD-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-socket$nl_xfrm-sendmsg$nl_xfrm-io_uring_setup-openat-io_uring_register$IORING_REGISTER_EVENTFD_ASYNC-openat-write-read$FUSE-mmap
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000040)='./file1\x00', 0x8000, &(0x7f0000000c00)=ANY=[], 0xf, 0x2b1, &(0x7f0000000480)="$eJzs3TFre1UUAPDzkjSJOqSIi+LwQAen0rq6NEoFsZMSQR002BYkCYUWAlY0duoncPR7+BFcXPwGgqvg1g6VJy/vvSa1SVtqrNL/7zed3nvPfSf3lrRLTj5/dTTYO0zi9PzXaLeTqG3HdlwksR61qHwXjQAAno6LLIvWgzIbtZUXAwA8ivzv/x9Z4a61D/s/AQD4v/nw40/e7+7u7nyQpu14uXM27iURMTob94r57kF8GcPYj83oxGVEdqWI331vdycaaW49Xh9Nxr08c/TZz+X+3d8jpvlb0Yn1xflbaeEq//mqujS6B2vVD514aXH+m3/Pj9Ekes1447W5+jeiE798EYcxjL3Ic2f5326l6TvZ9+dff5o/Js9PatFrTdfNZPVHuhIAAAAAAAAAAAAAAAAAAAAAAJ4BG2maFO17pv178qFp/5xxr345nd9IK/P9fSZVf6Ck2qjoD5RF2aJnksUPVX+dzTRNs3LhLL8RrzR8sQAAAAAAAAAAAAAAAAAAAADkjr86GfSHw/2jlQRVN4DqY/0P3Wd7NrIWEYN+ffmGrYjaPZ81320gr/XWxdFoxIqO5a7gubyele/cml3uR1EE1cXsJyt81otvF5ueDPppOVUd8qCf3HWG7erifpyfasY/LSyb/kpcZuXIN5Ffd7SvSr2e1VzRaTRfWDj1Z5Zl99vnrd+KOypHkmmLjfs9fa0MFr7APGjfvIuflm+49C2jvqr3HgAAAAAAAAAAAAAAAAAA4LrZh34XTJ7emlr714oCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEc2+/7/KmhHxPWRG8GkyE0iYumaMmjG0fF//RoBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4+v4KAAD//8HoSHM=")
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig\x00', 0x13c)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x22d3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=<r0=>0xffffffffffffffff, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0x7}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000838500000004"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=@getspdinfo={0x14, 0x28, 0x1, 0x70bd2d, 0x25dfdbfb, 0x7}, 0x14}, 0x1, 0x0, 0x0, 0x2400c845}, 0x4004050)
r3 = io_uring_setup(0x4c54, &(0x7f0000000680)={0x0, 0x274f, 0x40, 0x3, 0x27d})
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0)
io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r3, 0x7, &(0x7f0000000000)=r4, 0x1)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3)
write(r5, &(0x7f00000004c0)="347499acee446f81aa92302c38383230302ca6452692469d66e0", 0x1a)
read$FUSE(r5, &(0x7f00000005c0)={0x2020}, 0x2020)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000)

program crashed: KASAN: invalid-free in f_uac2_opts_c_srate_store
testing program (duration=34.308466693s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdirat-mount-mkdirat-mkdirat-bpf$PROG_LOAD-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-socket$nl_xfrm-sendmsg$nl_xfrm-io_uring_setup-openat-io_uring_register$IORING_REGISTER_EVENTFD_ASYNC-openat-write-read$FUSE
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000040)='./file1\x00', 0x8000, &(0x7f0000000c00)=ANY=[], 0xf, 0x2b1, &(0x7f0000000480)="$eJzs3TFre1UUAPDzkjSJOqSIi+LwQAen0rq6NEoFsZMSQR002BYkCYUWAlY0duoncPR7+BFcXPwGgqvg1g6VJy/vvSa1SVtqrNL/7zed3nvPfSf3lrRLTj5/dTTYO0zi9PzXaLeTqG3HdlwksR61qHwXjQAAno6LLIvWgzIbtZUXAwA8ivzv/x9Z4a61D/s/AQD4v/nw40/e7+7u7nyQpu14uXM27iURMTob94r57kF8GcPYj83oxGVEdqWI331vdycaaW49Xh9Nxr08c/TZz+X+3d8jpvlb0Yn1xflbaeEq//mqujS6B2vVD514aXH+m3/Pj9Ekes1447W5+jeiE798EYcxjL3Ic2f5326l6TvZ9+dff5o/Js9PatFrTdfNZPVHuhIAAAAAAAAAAAAAAAAAAAAAAJ4BG2maFO17pv178qFp/5xxr345nd9IK/P9fSZVf6Ck2qjoD5RF2aJnksUPVX+dzTRNs3LhLL8RrzR8sQAAAAAAAAAAAAAAAAAAAADkjr86GfSHw/2jlQRVN4DqY/0P3Wd7NrIWEYN+ffmGrYjaPZ81320gr/XWxdFoxIqO5a7gubyele/cml3uR1EE1cXsJyt81otvF5ueDPppOVUd8qCf3HWG7erifpyfasY/LSyb/kpcZuXIN5Ffd7SvSr2e1VzRaTRfWDj1Z5Zl99vnrd+KOypHkmmLjfs9fa0MFr7APGjfvIuflm+49C2jvqr3HgAAAAAAAAAAAAAAAAAA4LrZh34XTJ7emlr714oCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEc2+/7/KmhHxPWRG8GkyE0iYumaMmjG0fF//RoBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4+v4KAAD//8HoSHM=")
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig\x00', 0x13c)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x22d3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=<r0=>0xffffffffffffffff, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0x7}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000838500000004"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=@getspdinfo={0x14, 0x28, 0x1, 0x70bd2d, 0x25dfdbfb, 0x7}, 0x14}, 0x1, 0x0, 0x0, 0x2400c845}, 0x4004050)
r3 = io_uring_setup(0x4c54, &(0x7f0000000680)={0x0, 0x274f, 0x40, 0x3, 0x27d})
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0)
io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r3, 0x7, &(0x7f0000000000)=r4, 0x1)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3)
write(r5, &(0x7f00000004c0)="347499acee446f81aa92302c38383230302ca6452692469d66e0", 0x1a)
read$FUSE(r5, &(0x7f00000005c0)={0x2020}, 0x2020)

program crashed: KASAN: invalid-free in f_uac2_opts_c_srate_store
testing program (duration=34.308466693s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdirat-mount-mkdirat-mkdirat-bpf$PROG_LOAD-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-socket$nl_xfrm-sendmsg$nl_xfrm-io_uring_setup-openat-io_uring_register$IORING_REGISTER_EVENTFD_ASYNC-openat-write
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000040)='./file1\x00', 0x8000, &(0x7f0000000c00)=ANY=[], 0xf, 0x2b1, &(0x7f0000000480)="$eJzs3TFre1UUAPDzkjSJOqSIi+LwQAen0rq6NEoFsZMSQR002BYkCYUWAlY0duoncPR7+BFcXPwGgqvg1g6VJy/vvSa1SVtqrNL/7zed3nvPfSf3lrRLTj5/dTTYO0zi9PzXaLeTqG3HdlwksR61qHwXjQAAno6LLIvWgzIbtZUXAwA8ivzv/x9Z4a61D/s/AQD4v/nw40/e7+7u7nyQpu14uXM27iURMTob94r57kF8GcPYj83oxGVEdqWI331vdycaaW49Xh9Nxr08c/TZz+X+3d8jpvlb0Yn1xflbaeEq//mqujS6B2vVD514aXH+m3/Pj9Ekes1447W5+jeiE798EYcxjL3Ic2f5326l6TvZ9+dff5o/Js9PatFrTdfNZPVHuhIAAAAAAAAAAAAAAAAAAAAAAJ4BG2maFO17pv178qFp/5xxr345nd9IK/P9fSZVf6Ck2qjoD5RF2aJnksUPVX+dzTRNs3LhLL8RrzR8sQAAAAAAAAAAAAAAAAAAAADkjr86GfSHw/2jlQRVN4DqY/0P3Wd7NrIWEYN+ffmGrYjaPZ81320gr/XWxdFoxIqO5a7gubyele/cml3uR1EE1cXsJyt81otvF5ueDPppOVUd8qCf3HWG7erifpyfasY/LSyb/kpcZuXIN5Ffd7SvSr2e1VzRaTRfWDj1Z5Zl99vnrd+KOypHkmmLjfs9fa0MFr7APGjfvIuflm+49C2jvqr3HgAAAAAAAAAAAAAAAAAA4LrZh34XTJ7emlr714oCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEc2+/7/KmhHxPWRG8GkyE0iYumaMmjG0fF//RoBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4+v4KAAD//8HoSHM=")
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig\x00', 0x13c)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x22d3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=<r0=>0xffffffffffffffff, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0x7}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000838500000004"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=@getspdinfo={0x14, 0x28, 0x1, 0x70bd2d, 0x25dfdbfb, 0x7}, 0x14}, 0x1, 0x0, 0x0, 0x2400c845}, 0x4004050)
r3 = io_uring_setup(0x4c54, &(0x7f0000000680)={0x0, 0x274f, 0x40, 0x3, 0x27d})
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0)
io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r3, 0x7, &(0x7f0000000000)=r4, 0x1)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3)
write(r5, &(0x7f00000004c0)="347499acee446f81aa92302c38383230302ca6452692469d66e0", 0x1a)

program crashed: KASAN: invalid-free in f_uac2_opts_c_srate_store
testing program (duration=34.308466693s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdirat-mount-mkdirat-mkdirat-bpf$PROG_LOAD-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-socket$nl_xfrm-sendmsg$nl_xfrm-io_uring_setup-openat-io_uring_register$IORING_REGISTER_EVENTFD_ASYNC-openat
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000040)='./file1\x00', 0x8000, &(0x7f0000000c00)=ANY=[], 0xf, 0x2b1, &(0x7f0000000480)="$eJzs3TFre1UUAPDzkjSJOqSIi+LwQAen0rq6NEoFsZMSQR002BYkCYUWAlY0duoncPR7+BFcXPwGgqvg1g6VJy/vvSa1SVtqrNL/7zed3nvPfSf3lrRLTj5/dTTYO0zi9PzXaLeTqG3HdlwksR61qHwXjQAAno6LLIvWgzIbtZUXAwA8ivzv/x9Z4a61D/s/AQD4v/nw40/e7+7u7nyQpu14uXM27iURMTob94r57kF8GcPYj83oxGVEdqWI331vdycaaW49Xh9Nxr08c/TZz+X+3d8jpvlb0Yn1xflbaeEq//mqujS6B2vVD514aXH+m3/Pj9Ekes1447W5+jeiE798EYcxjL3Ic2f5326l6TvZ9+dff5o/Js9PatFrTdfNZPVHuhIAAAAAAAAAAAAAAAAAAAAAAJ4BG2maFO17pv178qFp/5xxr345nd9IK/P9fSZVf6Ck2qjoD5RF2aJnksUPVX+dzTRNs3LhLL8RrzR8sQAAAAAAAAAAAAAAAAAAAADkjr86GfSHw/2jlQRVN4DqY/0P3Wd7NrIWEYN+ffmGrYjaPZ81320gr/XWxdFoxIqO5a7gubyele/cml3uR1EE1cXsJyt81otvF5ueDPppOVUd8qCf3HWG7erifpyfasY/LSyb/kpcZuXIN5Ffd7SvSr2e1VzRaTRfWDj1Z5Zl99vnrd+KOypHkmmLjfs9fa0MFr7APGjfvIuflm+49C2jvqr3HgAAAAAAAAAAAAAAAAAA4LrZh34XTJ7emlr714oCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEc2+/7/KmhHxPWRG8GkyE0iYumaMmjG0fF//RoBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4+v4KAAD//8HoSHM=")
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig\x00', 0x13c)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x22d3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=<r0=>0xffffffffffffffff, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0x7}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000838500000004"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=@getspdinfo={0x14, 0x28, 0x1, 0x70bd2d, 0x25dfdbfb, 0x7}, 0x14}, 0x1, 0x0, 0x0, 0x2400c845}, 0x4004050)
r3 = io_uring_setup(0x4c54, &(0x7f0000000680)={0x0, 0x274f, 0x40, 0x3, 0x27d})
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0)
io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r3, 0x7, &(0x7f0000000000)=r4, 0x1)
openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3)

program did not crash
testing program (duration=34.308466693s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdirat-mount-mkdirat-mkdirat-bpf$PROG_LOAD-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-socket$nl_xfrm-sendmsg$nl_xfrm-io_uring_setup-openat-io_uring_register$IORING_REGISTER_EVENTFD_ASYNC-write
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000040)='./file1\x00', 0x8000, &(0x7f0000000c00)=ANY=[], 0xf, 0x2b1, &(0x7f0000000480)="$eJzs3TFre1UUAPDzkjSJOqSIi+LwQAen0rq6NEoFsZMSQR002BYkCYUWAlY0duoncPR7+BFcXPwGgqvg1g6VJy/vvSa1SVtqrNL/7zed3nvPfSf3lrRLTj5/dTTYO0zi9PzXaLeTqG3HdlwksR61qHwXjQAAno6LLIvWgzIbtZUXAwA8ivzv/x9Z4a61D/s/AQD4v/nw40/e7+7u7nyQpu14uXM27iURMTob94r57kF8GcPYj83oxGVEdqWI331vdycaaW49Xh9Nxr08c/TZz+X+3d8jpvlb0Yn1xflbaeEq//mqujS6B2vVD514aXH+m3/Pj9Ekes1447W5+jeiE798EYcxjL3Ic2f5326l6TvZ9+dff5o/Js9PatFrTdfNZPVHuhIAAAAAAAAAAAAAAAAAAAAAAJ4BG2maFO17pv178qFp/5xxr345nd9IK/P9fSZVf6Ck2qjoD5RF2aJnksUPVX+dzTRNs3LhLL8RrzR8sQAAAAAAAAAAAAAAAAAAAADkjr86GfSHw/2jlQRVN4DqY/0P3Wd7NrIWEYN+ffmGrYjaPZ81320gr/XWxdFoxIqO5a7gubyele/cml3uR1EE1cXsJyt81otvF5ueDPppOVUd8qCf3HWG7erifpyfasY/LSyb/kpcZuXIN5Ffd7SvSr2e1VzRaTRfWDj1Z5Zl99vnrd+KOypHkmmLjfs9fa0MFr7APGjfvIuflm+49C2jvqr3HgAAAAAAAAAAAAAAAAAA4LrZh34XTJ7emlr714oCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEc2+/7/KmhHxPWRG8GkyE0iYumaMmjG0fF//RoBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4+v4KAAD//8HoSHM=")
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig\x00', 0x13c)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x22d3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=<r0=>0xffffffffffffffff, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0x7}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000838500000004"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=@getspdinfo={0x14, 0x28, 0x1, 0x70bd2d, 0x25dfdbfb, 0x7}, 0x14}, 0x1, 0x0, 0x0, 0x2400c845}, 0x4004050)
r3 = io_uring_setup(0x4c54, &(0x7f0000000680)={0x0, 0x274f, 0x40, 0x3, 0x27d})
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0)
io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r3, 0x7, &(0x7f0000000000)=r4, 0x1)
write(0xffffffffffffffff, &(0x7f00000004c0)="347499acee446f81aa92302c38383230302ca6452692469d66e0", 0x1a)

program did not crash
testing program (duration=34.308466693s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdirat-mount-mkdirat-mkdirat-bpf$PROG_LOAD-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-socket$nl_xfrm-sendmsg$nl_xfrm-io_uring_setup-openat-openat-write
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000040)='./file1\x00', 0x8000, &(0x7f0000000c00)=ANY=[], 0xf, 0x2b1, &(0x7f0000000480)="$eJzs3TFre1UUAPDzkjSJOqSIi+LwQAen0rq6NEoFsZMSQR002BYkCYUWAlY0duoncPR7+BFcXPwGgqvg1g6VJy/vvSa1SVtqrNL/7zed3nvPfSf3lrRLTj5/dTTYO0zi9PzXaLeTqG3HdlwksR61qHwXjQAAno6LLIvWgzIbtZUXAwA8ivzv/x9Z4a61D/s/AQD4v/nw40/e7+7u7nyQpu14uXM27iURMTob94r57kF8GcPYj83oxGVEdqWI331vdycaaW49Xh9Nxr08c/TZz+X+3d8jpvlb0Yn1xflbaeEq//mqujS6B2vVD514aXH+m3/Pj9Ekes1447W5+jeiE798EYcxjL3Ic2f5326l6TvZ9+dff5o/Js9PatFrTdfNZPVHuhIAAAAAAAAAAAAAAAAAAAAAAJ4BG2maFO17pv178qFp/5xxr345nd9IK/P9fSZVf6Ck2qjoD5RF2aJnksUPVX+dzTRNs3LhLL8RrzR8sQAAAAAAAAAAAAAAAAAAAADkjr86GfSHw/2jlQRVN4DqY/0P3Wd7NrIWEYN+ffmGrYjaPZ81320gr/XWxdFoxIqO5a7gubyele/cml3uR1EE1cXsJyt81otvF5ueDPppOVUd8qCf3HWG7erifpyfasY/LSyb/kpcZuXIN5Ffd7SvSr2e1VzRaTRfWDj1Z5Zl99vnrd+KOypHkmmLjfs9fa0MFr7APGjfvIuflm+49C2jvqr3HgAAAAAAAAAAAAAAAAAA4LrZh34XTJ7emlr714oCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEc2+/7/KmhHxPWRG8GkyE0iYumaMmjG0fF//RoBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4+v4KAAD//8HoSHM=")
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig\x00', 0x13c)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x22d3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=<r0=>0xffffffffffffffff, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0x7}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000838500000004"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=@getspdinfo={0x14, 0x28, 0x1, 0x70bd2d, 0x25dfdbfb, 0x7}, 0x14}, 0x1, 0x0, 0x0, 0x2400c845}, 0x4004050)
io_uring_setup(0x4c54, &(0x7f0000000680)={0x0, 0x274f, 0x40, 0x3, 0x27d})
openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3)
write(r3, &(0x7f00000004c0)="347499acee446f81aa92302c38383230302ca6452692469d66e0", 0x1a)

program crashed: KASAN: invalid-free in f_uac2_opts_c_srate_store
testing program (duration=34.308466693s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdirat-mount-mkdirat-mkdirat-bpf$PROG_LOAD-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-socket$nl_xfrm-sendmsg$nl_xfrm-io_uring_setup-openat-write
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000040)='./file1\x00', 0x8000, &(0x7f0000000c00)=ANY=[], 0xf, 0x2b1, &(0x7f0000000480)="$eJzs3TFre1UUAPDzkjSJOqSIi+LwQAen0rq6NEoFsZMSQR002BYkCYUWAlY0duoncPR7+BFcXPwGgqvg1g6VJy/vvSa1SVtqrNL/7zed3nvPfSf3lrRLTj5/dTTYO0zi9PzXaLeTqG3HdlwksR61qHwXjQAAno6LLIvWgzIbtZUXAwA8ivzv/x9Z4a61D/s/AQD4v/nw40/e7+7u7nyQpu14uXM27iURMTob94r57kF8GcPYj83oxGVEdqWI331vdycaaW49Xh9Nxr08c/TZz+X+3d8jpvlb0Yn1xflbaeEq//mqujS6B2vVD514aXH+m3/Pj9Ekes1447W5+jeiE798EYcxjL3Ic2f5326l6TvZ9+dff5o/Js9PatFrTdfNZPVHuhIAAAAAAAAAAAAAAAAAAAAAAJ4BG2maFO17pv178qFp/5xxr345nd9IK/P9fSZVf6Ck2qjoD5RF2aJnksUPVX+dzTRNs3LhLL8RrzR8sQAAAAAAAAAAAAAAAAAAAADkjr86GfSHw/2jlQRVN4DqY/0P3Wd7NrIWEYN+ffmGrYjaPZ81320gr/XWxdFoxIqO5a7gubyele/cml3uR1EE1cXsJyt81otvF5ueDPppOVUd8qCf3HWG7erifpyfasY/LSyb/kpcZuXIN5Ffd7SvSr2e1VzRaTRfWDj1Z5Zl99vnrd+KOypHkmmLjfs9fa0MFr7APGjfvIuflm+49C2jvqr3HgAAAAAAAAAAAAAAAAAA4LrZh34XTJ7emlr714oCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEc2+/7/KmhHxPWRG8GkyE0iYumaMmjG0fF//RoBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4+v4KAAD//8HoSHM=")
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig\x00', 0x13c)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x22d3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=<r0=>0xffffffffffffffff, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0x7}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000838500000004"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=@getspdinfo={0x14, 0x28, 0x1, 0x70bd2d, 0x25dfdbfb, 0x7}, 0x14}, 0x1, 0x0, 0x0, 0x2400c845}, 0x4004050)
io_uring_setup(0x4c54, &(0x7f0000000680)={0x0, 0x274f, 0x40, 0x3, 0x27d})
r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3)
write(r3, &(0x7f00000004c0)="347499acee446f81aa92302c38383230302ca6452692469d66e0", 0x1a)

program crashed: KASAN: invalid-free in f_uac2_opts_c_srate_store
testing program (duration=34.308466693s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdirat-mount-mkdirat-mkdirat-bpf$PROG_LOAD-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-socket$nl_xfrm-sendmsg$nl_xfrm-openat-write
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000040)='./file1\x00', 0x8000, &(0x7f0000000c00)=ANY=[], 0xf, 0x2b1, &(0x7f0000000480)="$eJzs3TFre1UUAPDzkjSJOqSIi+LwQAen0rq6NEoFsZMSQR002BYkCYUWAlY0duoncPR7+BFcXPwGgqvg1g6VJy/vvSa1SVtqrNL/7zed3nvPfSf3lrRLTj5/dTTYO0zi9PzXaLeTqG3HdlwksR61qHwXjQAAno6LLIvWgzIbtZUXAwA8ivzv/x9Z4a61D/s/AQD4v/nw40/e7+7u7nyQpu14uXM27iURMTob94r57kF8GcPYj83oxGVEdqWI331vdycaaW49Xh9Nxr08c/TZz+X+3d8jpvlb0Yn1xflbaeEq//mqujS6B2vVD514aXH+m3/Pj9Ekes1447W5+jeiE798EYcxjL3Ic2f5326l6TvZ9+dff5o/Js9PatFrTdfNZPVHuhIAAAAAAAAAAAAAAAAAAAAAAJ4BG2maFO17pv178qFp/5xxr345nd9IK/P9fSZVf6Ck2qjoD5RF2aJnksUPVX+dzTRNs3LhLL8RrzR8sQAAAAAAAAAAAAAAAAAAAADkjr86GfSHw/2jlQRVN4DqY/0P3Wd7NrIWEYN+ffmGrYjaPZ81320gr/XWxdFoxIqO5a7gubyele/cml3uR1EE1cXsJyt81otvF5ueDPppOVUd8qCf3HWG7erifpyfasY/LSyb/kpcZuXIN5Ffd7SvSr2e1VzRaTRfWDj1Z5Zl99vnrd+KOypHkmmLjfs9fa0MFr7APGjfvIuflm+49C2jvqr3HgAAAAAAAAAAAAAAAAAA4LrZh34XTJ7emlr714oCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEc2+/7/KmhHxPWRG8GkyE0iYumaMmjG0fF//RoBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4+v4KAAD//8HoSHM=")
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig\x00', 0x13c)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x22d3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=<r0=>0xffffffffffffffff, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0x7}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000838500000004"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=@getspdinfo={0x14, 0x28, 0x1, 0x70bd2d, 0x25dfdbfb, 0x7}, 0x14}, 0x1, 0x0, 0x0, 0x2400c845}, 0x4004050)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3)
write(r3, &(0x7f00000004c0)="347499acee446f81aa92302c38383230302ca6452692469d66e0", 0x1a)

program crashed: KASAN: invalid-free in f_uac2_opts_c_srate_store
testing program (duration=34.308466693s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdirat-mount-mkdirat-mkdirat-bpf$PROG_LOAD-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-socket$nl_xfrm-openat-write
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000040)='./file1\x00', 0x8000, &(0x7f0000000c00)=ANY=[], 0xf, 0x2b1, &(0x7f0000000480)="$eJzs3TFre1UUAPDzkjSJOqSIi+LwQAen0rq6NEoFsZMSQR002BYkCYUWAlY0duoncPR7+BFcXPwGgqvg1g6VJy/vvSa1SVtqrNL/7zed3nvPfSf3lrRLTj5/dTTYO0zi9PzXaLeTqG3HdlwksR61qHwXjQAAno6LLIvWgzIbtZUXAwA8ivzv/x9Z4a61D/s/AQD4v/nw40/e7+7u7nyQpu14uXM27iURMTob94r57kF8GcPYj83oxGVEdqWI331vdycaaW49Xh9Nxr08c/TZz+X+3d8jpvlb0Yn1xflbaeEq//mqujS6B2vVD514aXH+m3/Pj9Ekes1447W5+jeiE798EYcxjL3Ic2f5326l6TvZ9+dff5o/Js9PatFrTdfNZPVHuhIAAAAAAAAAAAAAAAAAAAAAAJ4BG2maFO17pv178qFp/5xxr345nd9IK/P9fSZVf6Ck2qjoD5RF2aJnksUPVX+dzTRNs3LhLL8RrzR8sQAAAAAAAAAAAAAAAAAAAADkjr86GfSHw/2jlQRVN4DqY/0P3Wd7NrIWEYN+ffmGrYjaPZ81320gr/XWxdFoxIqO5a7gubyele/cml3uR1EE1cXsJyt81otvF5ueDPppOVUd8qCf3HWG7erifpyfasY/LSyb/kpcZuXIN5Ffd7SvSr2e1VzRaTRfWDj1Z5Zl99vnrd+KOypHkmmLjfs9fa0MFr7APGjfvIuflm+49C2jvqr3HgAAAAAAAAAAAAAAAAAA4LrZh34XTJ7emlr714oCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEc2+/7/KmhHxPWRG8GkyE0iYumaMmjG0fF//RoBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4+v4KAAD//8HoSHM=")
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig\x00', 0x13c)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x22d3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=<r0=>0xffffffffffffffff, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0x7}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000838500000004"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc)
socket$nl_xfrm(0x10, 0x3, 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3)
write(r2, &(0x7f00000004c0)="347499acee446f81aa92302c38383230302ca6452692469d66e0", 0x1a)

program crashed: KASAN: invalid-free in f_uac2_opts_c_srate_store
testing program (duration=34.308466693s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdirat-mount-mkdirat-mkdirat-bpf$PROG_LOAD-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-openat-write
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000040)='./file1\x00', 0x8000, &(0x7f0000000c00)=ANY=[], 0xf, 0x2b1, &(0x7f0000000480)="$eJzs3TFre1UUAPDzkjSJOqSIi+LwQAen0rq6NEoFsZMSQR002BYkCYUWAlY0duoncPR7+BFcXPwGgqvg1g6VJy/vvSa1SVtqrNL/7zed3nvPfSf3lrRLTj5/dTTYO0zi9PzXaLeTqG3HdlwksR61qHwXjQAAno6LLIvWgzIbtZUXAwA8ivzv/x9Z4a61D/s/AQD4v/nw40/e7+7u7nyQpu14uXM27iURMTob94r57kF8GcPYj83oxGVEdqWI331vdycaaW49Xh9Nxr08c/TZz+X+3d8jpvlb0Yn1xflbaeEq//mqujS6B2vVD514aXH+m3/Pj9Ekes1447W5+jeiE798EYcxjL3Ic2f5326l6TvZ9+dff5o/Js9PatFrTdfNZPVHuhIAAAAAAAAAAAAAAAAAAAAAAJ4BG2maFO17pv178qFp/5xxr345nd9IK/P9fSZVf6Ck2qjoD5RF2aJnksUPVX+dzTRNs3LhLL8RrzR8sQAAAAAAAAAAAAAAAAAAAADkjr86GfSHw/2jlQRVN4DqY/0P3Wd7NrIWEYN+ffmGrYjaPZ81320gr/XWxdFoxIqO5a7gubyele/cml3uR1EE1cXsJyt81otvF5ueDPppOVUd8qCf3HWG7erifpyfasY/LSyb/kpcZuXIN5Ffd7SvSr2e1VzRaTRfWDj1Z5Zl99vnrd+KOypHkmmLjfs9fa0MFr7APGjfvIuflm+49C2jvqr3HgAAAAAAAAAAAAAAAAAA4LrZh34XTJ7emlr714oCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEc2+/7/KmhHxPWRG8GkyE0iYumaMmjG0fF//RoBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4+v4KAAD//8HoSHM=")
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig\x00', 0x13c)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x22d3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=<r0=>0xffffffffffffffff, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0x7}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000838500000004"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3)
write(r2, &(0x7f00000004c0)="347499acee446f81aa92302c38383230302ca6452692469d66e0", 0x1a)

program crashed: KASAN: invalid-free in f_uac2_opts_c_srate_store
testing program (duration=34.308466693s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdirat-mount-mkdirat-mkdirat-bpf$PROG_LOAD-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_LOAD-openat-write
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000040)='./file1\x00', 0x8000, &(0x7f0000000c00)=ANY=[], 0xf, 0x2b1, &(0x7f0000000480)="$eJzs3TFre1UUAPDzkjSJOqSIi+LwQAen0rq6NEoFsZMSQR002BYkCYUWAlY0duoncPR7+BFcXPwGgqvg1g6VJy/vvSa1SVtqrNL/7zed3nvPfSf3lrRLTj5/dTTYO0zi9PzXaLeTqG3HdlwksR61qHwXjQAAno6LLIvWgzIbtZUXAwA8ivzv/x9Z4a61D/s/AQD4v/nw40/e7+7u7nyQpu14uXM27iURMTob94r57kF8GcPYj83oxGVEdqWI331vdycaaW49Xh9Nxr08c/TZz+X+3d8jpvlb0Yn1xflbaeEq//mqujS6B2vVD514aXH+m3/Pj9Ekes1447W5+jeiE798EYcxjL3Ic2f5326l6TvZ9+dff5o/Js9PatFrTdfNZPVHuhIAAAAAAAAAAAAAAAAAAAAAAJ4BG2maFO17pv178qFp/5xxr345nd9IK/P9fSZVf6Ck2qjoD5RF2aJnksUPVX+dzTRNs3LhLL8RrzR8sQAAAAAAAAAAAAAAAAAAAADkjr86GfSHw/2jlQRVN4DqY/0P3Wd7NrIWEYN+ffmGrYjaPZ81320gr/XWxdFoxIqO5a7gubyele/cml3uR1EE1cXsJyt81otvF5ueDPppOVUd8qCf3HWG7erifpyfasY/LSyb/kpcZuXIN5Ffd7SvSr2e1VzRaTRfWDj1Z5Zl99vnrd+KOypHkmmLjfs9fa0MFr7APGjfvIuflm+49C2jvqr3HgAAAAAAAAAAAAAAAAAA4LrZh34XTJ7emlr714oCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEc2+/7/KmhHxPWRG8GkyE0iYumaMmjG0fF//RoBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4+v4KAAD//8HoSHM=")
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig\x00', 0x13c)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x22d3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=<r0=>0xffffffffffffffff, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0x7}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000838500000004"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3)
write(r1, &(0x7f00000004c0)="347499acee446f81aa92302c38383230302ca6452692469d66e0", 0x1a)

program crashed: KASAN: invalid-free in f_uac2_opts_c_srate_store
testing program (duration=34.308466693s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdirat-mount-mkdirat-mkdirat-bpf$PROG_LOAD-bpf$MAP_CREATE-bpf$PROG_LOAD-openat-write
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000040)='./file1\x00', 0x8000, &(0x7f0000000c00)=ANY=[], 0xf, 0x2b1, &(0x7f0000000480)="$eJzs3TFre1UUAPDzkjSJOqSIi+LwQAen0rq6NEoFsZMSQR002BYkCYUWAlY0duoncPR7+BFcXPwGgqvg1g6VJy/vvSa1SVtqrNL/7zed3nvPfSf3lrRLTj5/dTTYO0zi9PzXaLeTqG3HdlwksR61qHwXjQAAno6LLIvWgzIbtZUXAwA8ivzv/x9Z4a61D/s/AQD4v/nw40/e7+7u7nyQpu14uXM27iURMTob94r57kF8GcPYj83oxGVEdqWI331vdycaaW49Xh9Nxr08c/TZz+X+3d8jpvlb0Yn1xflbaeEq//mqujS6B2vVD514aXH+m3/Pj9Ekes1447W5+jeiE798EYcxjL3Ic2f5326l6TvZ9+dff5o/Js9PatFrTdfNZPVHuhIAAAAAAAAAAAAAAAAAAAAAAJ4BG2maFO17pv178qFp/5xxr345nd9IK/P9fSZVf6Ck2qjoD5RF2aJnksUPVX+dzTRNs3LhLL8RrzR8sQAAAAAAAAAAAAAAAAAAAADkjr86GfSHw/2jlQRVN4DqY/0P3Wd7NrIWEYN+ffmGrYjaPZ81320gr/XWxdFoxIqO5a7gubyele/cml3uR1EE1cXsJyt81otvF5ueDPppOVUd8qCf3HWG7erifpyfasY/LSyb/kpcZuXIN5Ffd7SvSr2e1VzRaTRfWDj1Z5Zl99vnrd+KOypHkmmLjfs9fa0MFr7APGjfvIuflm+49C2jvqr3HgAAAAAAAAAAAAAAAAAA4LrZh34XTJ7emlr714oCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEc2+/7/KmhHxPWRG8GkyE0iYumaMmjG0fF//RoBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4+v4KAAD//8HoSHM=")
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig\x00', 0x13c)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x22d3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=<r0=>0xffffffffffffffff, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0x7}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3)
write(r1, &(0x7f00000004c0)="347499acee446f81aa92302c38383230302ca6452692469d66e0", 0x1a)

program crashed: KASAN: invalid-free in f_uac2_opts_c_srate_store
testing program (duration=34.308466693s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdirat-mount-mkdirat-mkdirat-bpf$PROG_LOAD-bpf$MAP_CREATE-openat-write
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000040)='./file1\x00', 0x8000, &(0x7f0000000c00)=ANY=[], 0xf, 0x2b1, &(0x7f0000000480)="$eJzs3TFre1UUAPDzkjSJOqSIi+LwQAen0rq6NEoFsZMSQR002BYkCYUWAlY0duoncPR7+BFcXPwGgqvg1g6VJy/vvSa1SVtqrNL/7zed3nvPfSf3lrRLTj5/dTTYO0zi9PzXaLeTqG3HdlwksR61qHwXjQAAno6LLIvWgzIbtZUXAwA8ivzv/x9Z4a61D/s/AQD4v/nw40/e7+7u7nyQpu14uXM27iURMTob94r57kF8GcPYj83oxGVEdqWI331vdycaaW49Xh9Nxr08c/TZz+X+3d8jpvlb0Yn1xflbaeEq//mqujS6B2vVD514aXH+m3/Pj9Ekes1447W5+jeiE798EYcxjL3Ic2f5326l6TvZ9+dff5o/Js9PatFrTdfNZPVHuhIAAAAAAAAAAAAAAAAAAAAAAJ4BG2maFO17pv178qFp/5xxr345nd9IK/P9fSZVf6Ck2qjoD5RF2aJnksUPVX+dzTRNs3LhLL8RrzR8sQAAAAAAAAAAAAAAAAAAAADkjr86GfSHw/2jlQRVN4DqY/0P3Wd7NrIWEYN+ffmGrYjaPZ81320gr/XWxdFoxIqO5a7gubyele/cml3uR1EE1cXsJyt81otvF5ueDPppOVUd8qCf3HWG7erifpyfasY/LSyb/kpcZuXIN5Ffd7SvSr2e1VzRaTRfWDj1Z5Zl99vnrd+KOypHkmmLjfs9fa0MFr7APGjfvIuflm+49C2jvqr3HgAAAAAAAAAAAAAAAAAA4LrZh34XTJ7emlr714oCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEc2+/7/KmhHxPWRG8GkyE0iYumaMmjG0fF//RoBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4+v4KAAD//8HoSHM=")
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig\x00', 0x13c)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x22d3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0x7}, 0x48)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3)
write(r0, &(0x7f00000004c0)="347499acee446f81aa92302c38383230302ca6452692469d66e0", 0x1a)

VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying
program crashed: KASAN: invalid-free in f_uac2_opts_c_srate_store
testing program (duration=34.308466693s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdirat-mount-mkdirat-mkdirat-bpf$PROG_LOAD-openat-write
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000040)='./file1\x00', 0x8000, &(0x7f0000000c00)=ANY=[], 0xf, 0x2b1, &(0x7f0000000480)="$eJzs3TFre1UUAPDzkjSJOqSIi+LwQAen0rq6NEoFsZMSQR002BYkCYUWAlY0duoncPR7+BFcXPwGgqvg1g6VJy/vvSa1SVtqrNL/7zed3nvPfSf3lrRLTj5/dTTYO0zi9PzXaLeTqG3HdlwksR61qHwXjQAAno6LLIvWgzIbtZUXAwA8ivzv/x9Z4a61D/s/AQD4v/nw40/e7+7u7nyQpu14uXM27iURMTob94r57kF8GcPYj83oxGVEdqWI331vdycaaW49Xh9Nxr08c/TZz+X+3d8jpvlb0Yn1xflbaeEq//mqujS6B2vVD514aXH+m3/Pj9Ekes1447W5+jeiE798EYcxjL3Ic2f5326l6TvZ9+dff5o/Js9PatFrTdfNZPVHuhIAAAAAAAAAAAAAAAAAAAAAAJ4BG2maFO17pv178qFp/5xxr345nd9IK/P9fSZVf6Ck2qjoD5RF2aJnksUPVX+dzTRNs3LhLL8RrzR8sQAAAAAAAAAAAAAAAAAAAADkjr86GfSHw/2jlQRVN4DqY/0P3Wd7NrIWEYN+ffmGrYjaPZ81320gr/XWxdFoxIqO5a7gubyele/cml3uR1EE1cXsJyt81otvF5ueDPppOVUd8qCf3HWG7erifpyfasY/LSyb/kpcZuXIN5Ffd7SvSr2e1VzRaTRfWDj1Z5Zl99vnrd+KOypHkmmLjfs9fa0MFr7APGjfvIuflm+49C2jvqr3HgAAAAAAAAAAAAAAAAAA4LrZh34XTJ7emlr714oCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEc2+/7/KmhHxPWRG8GkyE0iYumaMmjG0fF//RoBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4+v4KAAD//8HoSHM=")
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig\x00', 0x13c)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x22d3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3)
write(r0, &(0x7f00000004c0)="347499acee446f81aa92302c38383230302ca6452692469d66e0", 0x1a)

program crashed: lost connection to test machine
ignore low priority crash: lost connection to test machine
testing program (duration=34.308466693s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdirat-mount-mkdirat-mkdirat-bpf$MAP_CREATE-openat-write
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000040)='./file1\x00', 0x8000, &(0x7f0000000c00)=ANY=[], 0xf, 0x2b1, &(0x7f0000000480)="$eJzs3TFre1UUAPDzkjSJOqSIi+LwQAen0rq6NEoFsZMSQR002BYkCYUWAlY0duoncPR7+BFcXPwGgqvg1g6VJy/vvSa1SVtqrNL/7zed3nvPfSf3lrRLTj5/dTTYO0zi9PzXaLeTqG3HdlwksR61qHwXjQAAno6LLIvWgzIbtZUXAwA8ivzv/x9Z4a61D/s/AQD4v/nw40/e7+7u7nyQpu14uXM27iURMTob94r57kF8GcPYj83oxGVEdqWI331vdycaaW49Xh9Nxr08c/TZz+X+3d8jpvlb0Yn1xflbaeEq//mqujS6B2vVD514aXH+m3/Pj9Ekes1447W5+jeiE798EYcxjL3Ic2f5326l6TvZ9+dff5o/Js9PatFrTdfNZPVHuhIAAAAAAAAAAAAAAAAAAAAAAJ4BG2maFO17pv178qFp/5xxr345nd9IK/P9fSZVf6Ck2qjoD5RF2aJnksUPVX+dzTRNs3LhLL8RrzR8sQAAAAAAAAAAAAAAAAAAAADkjr86GfSHw/2jlQRVN4DqY/0P3Wd7NrIWEYN+ffmGrYjaPZ81320gr/XWxdFoxIqO5a7gubyele/cml3uR1EE1cXsJyt81otvF5ueDPppOVUd8qCf3HWG7erifpyfasY/LSyb/kpcZuXIN5Ffd7SvSr2e1VzRaTRfWDj1Z5Zl99vnrd+KOypHkmmLjfs9fa0MFr7APGjfvIuflm+49C2jvqr3HgAAAAAAAAAAAAAAAAAA4LrZh34XTJ7emlr714oCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEc2+/7/KmhHxPWRG8GkyE0iYumaMmjG0fF//RoBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4+v4KAAD//8HoSHM=")
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig\x00', 0x13c)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0x7}, 0x48)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3)
write(r0, &(0x7f00000004c0)="347499acee446f81aa92302c38383230302ca6452692469d66e0", 0x1a)

program crashed: KASAN: invalid-free in f_uac2_opts_c_srate_store
testing program (duration=34.308466693s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdirat-mount-mkdirat-bpf$MAP_CREATE-openat-write
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000040)='./file1\x00', 0x8000, &(0x7f0000000c00)=ANY=[], 0xf, 0x2b1, &(0x7f0000000480)="$eJzs3TFre1UUAPDzkjSJOqSIi+LwQAen0rq6NEoFsZMSQR002BYkCYUWAlY0duoncPR7+BFcXPwGgqvg1g6VJy/vvSa1SVtqrNL/7zed3nvPfSf3lrRLTj5/dTTYO0zi9PzXaLeTqG3HdlwksR61qHwXjQAAno6LLIvWgzIbtZUXAwA8ivzv/x9Z4a61D/s/AQD4v/nw40/e7+7u7nyQpu14uXM27iURMTob94r57kF8GcPYj83oxGVEdqWI331vdycaaW49Xh9Nxr08c/TZz+X+3d8jpvlb0Yn1xflbaeEq//mqujS6B2vVD514aXH+m3/Pj9Ekes1447W5+jeiE798EYcxjL3Ic2f5326l6TvZ9+dff5o/Js9PatFrTdfNZPVHuhIAAAAAAAAAAAAAAAAAAAAAAJ4BG2maFO17pv178qFp/5xxr345nd9IK/P9fSZVf6Ck2qjoD5RF2aJnksUPVX+dzTRNs3LhLL8RrzR8sQAAAAAAAAAAAAAAAAAAAADkjr86GfSHw/2jlQRVN4DqY/0P3Wd7NrIWEYN+ffmGrYjaPZ81320gr/XWxdFoxIqO5a7gubyele/cml3uR1EE1cXsJyt81otvF5ueDPppOVUd8qCf3HWG7erifpyfasY/LSyb/kpcZuXIN5Ffd7SvSr2e1VzRaTRfWDj1Z5Zl99vnrd+KOypHkmmLjfs9fa0MFr7APGjfvIuflm+49C2jvqr3HgAAAAAAAAAAAAAAAAAA4LrZh34XTJ7emlr714oCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEc2+/7/KmhHxPWRG8GkyE0iYumaMmjG0fF//RoBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4+v4KAAD//8HoSHM=")
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig\x00', 0x13c)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0x7}, 0x48)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3)
write(r0, &(0x7f00000004c0)="347499acee446f81aa92302c38383230302ca6452692469d66e0", 0x1a)

program did not crash
testing program (duration=34.308466693s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdirat-mount-mkdirat-bpf$MAP_CREATE-openat-write
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000040)='./file1\x00', 0x8000, &(0x7f0000000c00)=ANY=[], 0xf, 0x2b1, &(0x7f0000000480)="$eJzs3TFre1UUAPDzkjSJOqSIi+LwQAen0rq6NEoFsZMSQR002BYkCYUWAlY0duoncPR7+BFcXPwGgqvg1g6VJy/vvSa1SVtqrNL/7zed3nvPfSf3lrRLTj5/dTTYO0zi9PzXaLeTqG3HdlwksR61qHwXjQAAno6LLIvWgzIbtZUXAwA8ivzv/x9Z4a61D/s/AQD4v/nw40/e7+7u7nyQpu14uXM27iURMTob94r57kF8GcPYj83oxGVEdqWI331vdycaaW49Xh9Nxr08c/TZz+X+3d8jpvlb0Yn1xflbaeEq//mqujS6B2vVD514aXH+m3/Pj9Ekes1447W5+jeiE798EYcxjL3Ic2f5326l6TvZ9+dff5o/Js9PatFrTdfNZPVHuhIAAAAAAAAAAAAAAAAAAAAAAJ4BG2maFO17pv178qFp/5xxr345nd9IK/P9fSZVf6Ck2qjoD5RF2aJnksUPVX+dzTRNs3LhLL8RrzR8sQAAAAAAAAAAAAAAAAAAAADkjr86GfSHw/2jlQRVN4DqY/0P3Wd7NrIWEYN+ffmGrYjaPZ81320gr/XWxdFoxIqO5a7gubyele/cml3uR1EE1cXsJyt81otvF5ueDPppOVUd8qCf3HWG7erifpyfasY/LSyb/kpcZuXIN5Ffd7SvSr2e1VzRaTRfWDj1Z5Zl99vnrd+KOypHkmmLjfs9fa0MFr7APGjfvIuflm+49C2jvqr3HgAAAAAAAAAAAAAAAAAA4LrZh34XTJ7emlr714oCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEc2+/7/KmhHxPWRG8GkyE0iYumaMmjG0fF//RoBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4+v4KAAD//8HoSHM=")
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig\x00', 0x13c)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0x7}, 0x48)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3)
write(r0, &(0x7f00000004c0)="347499acee446f81aa92302c38383230302ca6452692469d66e0", 0x1a)

program did not crash
testing program (duration=34.308466693s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdirat-mkdirat-mkdirat-bpf$MAP_CREATE-openat-write
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000040)='./file1\x00', 0x8000, &(0x7f0000000c00)=ANY=[], 0xf, 0x2b1, &(0x7f0000000480)="$eJzs3TFre1UUAPDzkjSJOqSIi+LwQAen0rq6NEoFsZMSQR002BYkCYUWAlY0duoncPR7+BFcXPwGgqvg1g6VJy/vvSa1SVtqrNL/7zed3nvPfSf3lrRLTj5/dTTYO0zi9PzXaLeTqG3HdlwksR61qHwXjQAAno6LLIvWgzIbtZUXAwA8ivzv/x9Z4a61D/s/AQD4v/nw40/e7+7u7nyQpu14uXM27iURMTob94r57kF8GcPYj83oxGVEdqWI331vdycaaW49Xh9Nxr08c/TZz+X+3d8jpvlb0Yn1xflbaeEq//mqujS6B2vVD514aXH+m3/Pj9Ekes1447W5+jeiE798EYcxjL3Ic2f5326l6TvZ9+dff5o/Js9PatFrTdfNZPVHuhIAAAAAAAAAAAAAAAAAAAAAAJ4BG2maFO17pv178qFp/5xxr345nd9IK/P9fSZVf6Ck2qjoD5RF2aJnksUPVX+dzTRNs3LhLL8RrzR8sQAAAAAAAAAAAAAAAAAAAADkjr86GfSHw/2jlQRVN4DqY/0P3Wd7NrIWEYN+ffmGrYjaPZ81320gr/XWxdFoxIqO5a7gubyele/cml3uR1EE1cXsJyt81otvF5ueDPppOVUd8qCf3HWG7erifpyfasY/LSyb/kpcZuXIN5Ffd7SvSr2e1VzRaTRfWDj1Z5Zl99vnrd+KOypHkmmLjfs9fa0MFr7APGjfvIuflm+49C2jvqr3HgAAAAAAAAAAAAAAAAAA4LrZh34XTJ7emlr714oCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEc2+/7/KmhHxPWRG8GkyE0iYumaMmjG0fF//RoBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4+v4KAAD//8HoSHM=")
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig\x00', 0x13c)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0x7}, 0x48)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3)
write(r0, &(0x7f00000004c0)="347499acee446f81aa92302c38383230302ca6452692469d66e0", 0x1a)

program did not crash
testing program (duration=34.308466693s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mount-mkdirat-mkdirat-bpf$MAP_CREATE-openat-write
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000040)='./file1\x00', 0x8000, &(0x7f0000000c00)=ANY=[], 0xf, 0x2b1, &(0x7f0000000480)="$eJzs3TFre1UUAPDzkjSJOqSIi+LwQAen0rq6NEoFsZMSQR002BYkCYUWAlY0duoncPR7+BFcXPwGgqvg1g6VJy/vvSa1SVtqrNL/7zed3nvPfSf3lrRLTj5/dTTYO0zi9PzXaLeTqG3HdlwksR61qHwXjQAAno6LLIvWgzIbtZUXAwA8ivzv/x9Z4a61D/s/AQD4v/nw40/e7+7u7nyQpu14uXM27iURMTob94r57kF8GcPYj83oxGVEdqWI331vdycaaW49Xh9Nxr08c/TZz+X+3d8jpvlb0Yn1xflbaeEq//mqujS6B2vVD514aXH+m3/Pj9Ekes1447W5+jeiE798EYcxjL3Ic2f5326l6TvZ9+dff5o/Js9PatFrTdfNZPVHuhIAAAAAAAAAAAAAAAAAAAAAAJ4BG2maFO17pv178qFp/5xxr345nd9IK/P9fSZVf6Ck2qjoD5RF2aJnksUPVX+dzTRNs3LhLL8RrzR8sQAAAAAAAAAAAAAAAAAAAADkjr86GfSHw/2jlQRVN4DqY/0P3Wd7NrIWEYN+ffmGrYjaPZ81320gr/XWxdFoxIqO5a7gubyele/cml3uR1EE1cXsJyt81otvF5ueDPppOVUd8qCf3HWG7erifpyfasY/LSyb/kpcZuXIN5Ffd7SvSr2e1VzRaTRfWDj1Z5Zl99vnrd+KOypHkmmLjfs9fa0MFr7APGjfvIuflm+49C2jvqr3HgAAAAAAAAAAAAAAAAAA4LrZh34XTJ7emlr714oCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEc2+/7/KmhHxPWRG8GkyE0iYumaMmjG0fF//RoBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4+v4KAAD//8HoSHM=")
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0x7}, 0x48)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3)
write(r0, &(0x7f00000004c0)="347499acee446f81aa92302c38383230302ca6452692469d66e0", 0x1a)

program did not crash
testing program (duration=34.308466693s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-bpf$MAP_CREATE-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig\x00', 0x13c)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0x7}, 0x48)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3)
write(r0, &(0x7f00000004c0)="347499acee446f81aa92302c38383230302ca6452692469d66e0", 0x1a)

program crashed: KASAN: invalid-free in f_uac2_opts_c_srate_store
testing program (duration=34.308466693s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-bpf$MAP_CREATE-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x13c)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0x7}, 0x48)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3)
write(r0, &(0x7f00000004c0)="347499acee446f81aa92302c38383230302ca6452692469d66e0", 0x1a)

program did not crash
testing program (duration=34.308466693s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-bpf$MAP_CREATE-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig\x00', 0x13c)
mount(0x0, 0x0, &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0x7}, 0x48)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3)
write(r0, &(0x7f00000004c0)="347499acee446f81aa92302c38383230302ca6452692469d66e0", 0x1a)

program did not crash
testing program (duration=34.308466693s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-bpf$MAP_CREATE-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig\x00', 0x13c)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0x7}, 0x48)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3)
write(r0, &(0x7f00000004c0)="347499acee446f81aa92302c38383230302ca6452692469d66e0", 0x1a)

program did not crash
testing program (duration=34.308466693s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-bpf$MAP_CREATE-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig\x00', 0x13c)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0x7}, 0x48)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3)
write(r0, &(0x7f00000004c0)="347499acee446f81aa92302c38383230302ca6452692469d66e0", 0x1a)

program did not crash
testing program (duration=34.308466693s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-bpf$MAP_CREATE-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig\x00', 0x13c)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0x7}, 0x48)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3)
write(r0, &(0x7f00000004c0)="347499acee446f81aa92302c38383230302ca6452692469d66e0", 0x1a)

program did not crash
testing program (duration=34.308466693s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-bpf$MAP_CREATE-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig\x00', 0x13c)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3)
write(r0, &(0x7f00000004c0)="347499acee446f81aa92302c38383230302ca6452692469d66e0", 0x1a)

program crashed: KASAN: invalid-free in f_uac2_opts_c_srate_store
testing program (duration=34.308466693s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-bpf$MAP_CREATE-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig\x00', 0x13c)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0xe8202, 0x1c3)
write(r0, &(0x7f00000004c0)="347499acee446f81aa92302c38383230302ca6452692469d66e0", 0x1a)

program did not crash
testing program (duration=34.308466693s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-bpf$MAP_CREATE-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig\x00', 0x13c)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3)
write(r0, 0x0, 0x0)

program did not crash
testing program (duration=34.308466693s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-bpf$MAP_CREATE-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig\x00', 0x13c)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3)
write(r0, &(0x7f00000004c0), 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=34.308466693s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-bpf$MAP_CREATE-openat-write
program crashed: KASAN: invalid-free in f_uac2_opts_c_srate_store
simplifying C reproducer
testing compiled C program (duration=34.308466693s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-bpf$MAP_CREATE-openat-write
program crashed: KASAN: invalid-free in f_uac2_opts_c_srate_store
testing compiled C program (duration=34.308466693s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-bpf$MAP_CREATE-openat-write
program crashed: KASAN: invalid-free in f_uac2_opts_c_srate_store
testing compiled C program (duration=34.308466693s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-bpf$MAP_CREATE-openat-write
program crashed: KASAN: invalid-free in f_uac2_opts_c_srate_store
testing compiled C program (duration=34.308466693s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-bpf$MAP_CREATE-openat-write
program crashed: KASAN: invalid-free in f_uac2_opts_c_srate_store
testing compiled C program (duration=34.308466693s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-bpf$MAP_CREATE-openat-write
program crashed: KASAN: invalid-free in f_uac2_opts_c_srate_store
testing compiled C program (duration=34.308466693s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-bpf$MAP_CREATE-openat-write
program crashed: KASAN: invalid-free in f_uac2_opts_c_srate_store
testing program (duration=34.308466693s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-bpf$MAP_CREATE-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig\x00', 0x13c)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3)
write(r0, &(0x7f00000004c0)="347499acee446f81aa92302c38383230302ca6452692469d66e0", 0x1a)

program crashed: KASAN: invalid-free in f_uac2_opts_c_srate_store
validation run: crashed=true
testing program (duration=34.308466693s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-bpf$MAP_CREATE-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig\x00', 0x13c)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3)
write(r0, &(0x7f00000004c0)="347499acee446f81aa92302c38383230302ca6452692469d66e0", 0x1a)

program crashed: KASAN: invalid-free in f_uac2_opts_c_srate_store
validation run: crashed=true
testing program (duration=34.308466693s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-bpf$MAP_CREATE-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig\x00', 0x13c)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0xe8202, 0x1c3)
write(r0, &(0x7f00000004c0)="347499acee446f81aa92302c38383230302ca6452692469d66e0", 0x1a)

program crashed: KASAN: invalid-free in f_uac2_opts_c_srate_store
validation run: crashed=true
reproducing took 30m53.070871261s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: invalid-free in slab_free mm/slub.c:3712 [inline]
BUG: KASAN: invalid-free in __kmem_cache_free+0xb7/0x1b0 mm/slub.c:3728
Free of addr ffff88811535164c by task syz.2.17/371

CPU: 1 PID: 371 Comm: syz.2.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 __dump_stack+0x21/0x24 lib/dump_stack.c:88
 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
 print_address_description+0x71/0x200 mm/kasan/report.c:316
 print_report+0x4a/0x60 mm/kasan/report.c:420
 kasan_report_invalid_free+0xd5/0xf0 mm/kasan/report.c:489
 ____kasan_slab_free+0x14f/0x180 mm/kasan/common.c:-1
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:250
 kasan_slab_free include/linux/kasan.h:178 [inline]
 slab_free_hook mm/slub.c:1750 [inline]
 slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1776
 slab_free mm/slub.c:3712 [inline]
 __kmem_cache_free+0xb7/0x1b0 mm/slub.c:3728
 kfree+0x6f/0xf0 mm/slab_common.c:990
 f_uac2_opts_c_srate_store+0x220/0x2a0 drivers/usb/gadget/function/f_uac2.c:2082
 flush_write_buffer fs/configfs/file.c:207 [inline]
 configfs_write_iter+0x323/0x410 fs/configfs/file.c:229
 call_write_iter include/linux/fs.h:2282 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x5ef/0xd00 fs/read_write.c:584
 ksys_write+0x14a/0x260 fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __x64_sys_write+0x7b/0x90 fs/read_write.c:646
 x64_sys_call+0x27b/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fa1ab99e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff20c946a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fa1abc25fa0 RCX: 00007fa1ab99e0d9
RDX: 000000000000001a RSI: 00002000000004c0 RDI: 0000000000000003
RBP: 00007fa1aba35024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa1abc25fac R14: 00007fa1abc25fa0 R15: 00007fa1abc25fa0
 </TASK>

Allocated by task 371:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
 kasan_save_alloc_info+0x1f/0x30 mm/kasan/generic.c:505
 ____kasan_kmalloc mm/kasan/common.c:380 [inline]
 __kasan_kmalloc+0x95/0xb0 mm/kasan/common.c:389
 kasan_kmalloc include/linux/kasan.h:212 [inline]
 __do_kmalloc_node mm/slab_common.c:938 [inline]
 __kmalloc_node_track_caller+0xb1/0x1e0 mm/slab_common.c:958
 kstrdup+0x3b/0x80 mm/util.c:66
 f_uac2_opts_c_srate_store+0x11a/0x2a0 drivers/usb/gadget/function/f_uac2.c:2082
 flush_write_buffer fs/configfs/file.c:207 [inline]
 configfs_write_iter+0x323/0x410 fs/configfs/file.c:229
 call_write_iter include/linux/fs.h:2282 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x5ef/0xd00 fs/read_write.c:584
 ksys_write+0x14a/0x260 fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __x64_sys_write+0x7b/0x90 fs/read_write.c:646
 x64_sys_call+0x27b/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

The buggy address belongs to the object at ffff888115351640
 which belongs to the cache kmalloc-32 of size 32
The buggy address is located 12 bytes inside of
 32-byte region [ffff888115351640, ffff888115351660)

The buggy address belongs to the physical page:
page:ffffea000454d440 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115351
flags: 0x4000000000000200(slab|zone=1)
raw: 4000000000000200 ffffea0004541700 dead000000000003 ffff888100042600
raw: 0000000000000000 0000000080400040 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 117, tgid 117 (udevadm), ts 4185514328, free_ts 0
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x1f5/0x210 mm/page_alloc.c:2672
 prep_new_page+0x1c/0x110 mm/page_alloc.c:2679
 get_page_from_freelist+0x2ca9/0x2d20 mm/page_alloc.c:4586
 __alloc_pages+0x1fa/0x610 mm/page_alloc.c:5930
 alloc_slab_page+0x6e/0xf0 include/linux/gfp.h:-1
 allocate_slab mm/slub.c:1967 [inline]
 new_slab+0x98/0x3e0 mm/slub.c:2020
 ___slab_alloc+0x70f/0xb70 mm/slub.c:3177
 __slab_alloc+0x5e/0xa0 mm/slub.c:3263
 slab_alloc_node mm/slub.c:3348 [inline]
 __kmem_cache_alloc_node+0x204/0x2d0 mm/slub.c:3423
 __do_kmalloc_node mm/slab_common.c:937 [inline]
 __kmalloc+0xa4/0x1e0 mm/slab_common.c:951
 kmalloc include/linux/slab.h:568 [inline]
 kzalloc include/linux/slab.h:699 [inline]
 kobject_get_path+0xbf/0x200 lib/kobject.c:152
 kobject_uevent_env+0x29f/0x720 lib/kobject_uevent.c:544
 kobject_synth_uevent+0x457/0x940 lib/kobject_uevent.c:208
 uevent_store+0x25/0x70 drivers/base/core.c:2690
 dev_attr_store+0x6c/0x90 drivers/base/core.c:2389
 sysfs_kf_write+0x137/0x150 fs/sysfs/file.c:136
page_owner free stack trace missing

Memory state around the buggy address:
 ffff888115351500: fa fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
 ffff888115351580: fa fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
>ffff888115351600: fb fb fb fb fc fc fc fc 00 00 00 03 fc fc fc fc
                                              ^
 ffff888115351680: fb fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
 ffff888115351700: 00 00 01 fc fc fc fc fc fb fb fb fb fc fc fc fc
==================================================================

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: invalid-free in slab_free mm/slub.c:3712 [inline]
BUG: KASAN: invalid-free in __kmem_cache_free+0xb7/0x1b0 mm/slub.c:3728
Free of addr ffff88811535164c by task syz.2.17/371

CPU: 1 PID: 371 Comm: syz.2.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 __dump_stack+0x21/0x24 lib/dump_stack.c:88
 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
 print_address_description+0x71/0x200 mm/kasan/report.c:316
 print_report+0x4a/0x60 mm/kasan/report.c:420
 kasan_report_invalid_free+0xd5/0xf0 mm/kasan/report.c:489
 ____kasan_slab_free+0x14f/0x180 mm/kasan/common.c:-1
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:250
 kasan_slab_free include/linux/kasan.h:178 [inline]
 slab_free_hook mm/slub.c:1750 [inline]
 slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1776
 slab_free mm/slub.c:3712 [inline]
 __kmem_cache_free+0xb7/0x1b0 mm/slub.c:3728
 kfree+0x6f/0xf0 mm/slab_common.c:990
 f_uac2_opts_c_srate_store+0x220/0x2a0 drivers/usb/gadget/function/f_uac2.c:2082
 flush_write_buffer fs/configfs/file.c:207 [inline]
 configfs_write_iter+0x323/0x410 fs/configfs/file.c:229
 call_write_iter include/linux/fs.h:2282 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x5ef/0xd00 fs/read_write.c:584
 ksys_write+0x14a/0x260 fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __x64_sys_write+0x7b/0x90 fs/read_write.c:646
 x64_sys_call+0x27b/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fa1ab99e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff20c946a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fa1abc25fa0 RCX: 00007fa1ab99e0d9
RDX: 000000000000001a RSI: 00002000000004c0 RDI: 0000000000000003
RBP: 00007fa1aba35024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa1abc25fac R14: 00007fa1abc25fa0 R15: 00007fa1abc25fa0
 </TASK>

Allocated by task 371:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
 kasan_save_alloc_info+0x1f/0x30 mm/kasan/generic.c:505
 ____kasan_kmalloc mm/kasan/common.c:380 [inline]
 __kasan_kmalloc+0x95/0xb0 mm/kasan/common.c:389
 kasan_kmalloc include/linux/kasan.h:212 [inline]
 __do_kmalloc_node mm/slab_common.c:938 [inline]
 __kmalloc_node_track_caller+0xb1/0x1e0 mm/slab_common.c:958
 kstrdup+0x3b/0x80 mm/util.c:66
 f_uac2_opts_c_srate_store+0x11a/0x2a0 drivers/usb/gadget/function/f_uac2.c:2082
 flush_write_buffer fs/configfs/file.c:207 [inline]
 configfs_write_iter+0x323/0x410 fs/configfs/file.c:229
 call_write_iter include/linux/fs.h:2282 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x5ef/0xd00 fs/read_write.c:584
 ksys_write+0x14a/0x260 fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __x64_sys_write+0x7b/0x90 fs/read_write.c:646
 x64_sys_call+0x27b/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

The buggy address belongs to the object at ffff888115351640
 which belongs to the cache kmalloc-32 of size 32
The buggy address is located 12 bytes inside of
 32-byte region [ffff888115351640, ffff888115351660)

The buggy address belongs to the physical page:
page:ffffea000454d440 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115351
flags: 0x4000000000000200(slab|zone=1)
raw: 4000000000000200 ffffea0004541700 dead000000000003 ffff888100042600
raw: 0000000000000000 0000000080400040 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 117, tgid 117 (udevadm), ts 4185514328, free_ts 0
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x1f5/0x210 mm/page_alloc.c:2672
 prep_new_page+0x1c/0x110 mm/page_alloc.c:2679
 get_page_from_freelist+0x2ca9/0x2d20 mm/page_alloc.c:4586
 __alloc_pages+0x1fa/0x610 mm/page_alloc.c:5930
 alloc_slab_page+0x6e/0xf0 include/linux/gfp.h:-1
 allocate_slab mm/slub.c:1967 [inline]
 new_slab+0x98/0x3e0 mm/slub.c:2020
 ___slab_alloc+0x70f/0xb70 mm/slub.c:3177
 __slab_alloc+0x5e/0xa0 mm/slub.c:3263
 slab_alloc_node mm/slub.c:3348 [inline]
 __kmem_cache_alloc_node+0x204/0x2d0 mm/slub.c:3423
 __do_kmalloc_node mm/slab_common.c:937 [inline]
 __kmalloc+0xa4/0x1e0 mm/slab_common.c:951
 kmalloc include/linux/slab.h:568 [inline]
 kzalloc include/linux/slab.h:699 [inline]
 kobject_get_path+0xbf/0x200 lib/kobject.c:152
 kobject_uevent_env+0x29f/0x720 lib/kobject_uevent.c:544
 kobject_synth_uevent+0x457/0x940 lib/kobject_uevent.c:208
 uevent_store+0x25/0x70 drivers/base/core.c:2690
 dev_attr_store+0x6c/0x90 drivers/base/core.c:2389
 sysfs_kf_write+0x137/0x150 fs/sysfs/file.c:136
page_owner free stack trace missing

Memory state around the buggy address:
 ffff888115351500: fa fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
 ffff888115351580: fa fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
>ffff888115351600: fb fb fb fb fc fc fc fc 00 00 00 03 fc fc fc fc
                                              ^
 ffff888115351680: fb fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
 ffff888115351700: 00 00 01 fc fc fc fc fc fb fb fb fb fc fc fc fc
==================================================================