program:
close(0x3)
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='config/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000640)="466f9a82302c39deb5e107a85258a5798909e2874689bc0ce7966d3fdf0efc5654ca7916810045f9cc4977d7948099e153006f3841f07c4e2dcfff85612728c17bb460329fe894e1608cb095c098920456c0326a68b22ba698e7f3d2e19ae61a5de2f877a7b6adfaa9fed3787134724ea51f2b4e69f129745c2aad193745147ee4cdeb756c47917c155325c743d942c9ff8738ddbbcd3c091bdf9770dbbe55cd15087c105b6a071b163355b1f2b209117471c74dd669af1f54bc1e3b0300e9adc3c503c3b040406c422f442a03e0e3f22a21abb472cb9e420929802910499b7c509d3317b94081f26035a8af1f9128b413838d995568706ed834bd45b4e16c7e5b5a54637a9fcff652b97ef248404422e6457af13f33d3bfb0f2a90258b046405a1d65a492a8d7d27bf34c3f885af3", 0x12f)
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
close(0x3) (async)
mkdir(&(0x7f0000000000)='config\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) (async)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff) (async)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) (async)
openat(0xffffffffffffff9c, &(0x7f0000000600)='config/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0) (async)
write(r0, &(0x7f0000000640)="466f9a82302c39deb5e107a85258a5798909e2874689bc0ce7966d3fdf0efc5654ca7916810045f9cc4977d7948099e153006f3841f07c4e2dcfff85612728c17bb460329fe894e1608cb095c098920456c0326a68b22ba698e7f3d2e19ae61a5de2f877a7b6adfaa9fed3787134724ea51f2b4e69f129745c2aad193745147ee4cdeb756c47917c155325c743d942c9ff8738ddbbcd3c091bdf9770dbbe55cd15087c105b6a071b163355b1f2b209117471c74dd669af1f54bc1e3b0300e9adc3c503c3b040406c422f442a03e0e3f22a21abb472cb9e420929802910499b7c509d3317b94081f26035a8af1f9128b413838d995568706ed834bd45b4e16c7e5b5a54637a9fcff652b97ef248404422e6457af13f33d3bfb0f2a90258b046405a1d65a492a8d7d27bf34c3f885af3", 0x12f) (async)
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') (async)
[ 107.108669][ T4653] Bluetooth: hci0: command tx timeout
[ 107.199366][ T5332] ==================================================================
[ 107.202826][ T5332] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0
[ 107.206219][ T5332] Free of addr ffff88803ed9ff06 by task syz.0.0/5332
[ 107.208738][ T5332]
[ 107.209731][ T5332] CPU: 0 UID: 0 PID: 5332 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 107.209744][ T5332] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 107.209751][ T5332] Call Trace:
[ 107.209758][ T5332]
[ 107.209763][ T5332] dump_stack_lvl+0xe8/0x150
[ 107.209781][ T5332] print_address_description+0x55/0x1e0
[ 107.209797][ T5332] print_report+0x58/0x70
[ 107.209809][ T5332] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 107.209822][ T5332] kasan_report_invalid_free+0xea/0x110
[ 107.209836][ T5332] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 107.209849][ T5332] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 107.209861][ T5332] __kasan_slab_pre_free+0x104/0x120
[ 107.209873][ T5332] kfree+0x173/0x640
[ 107.209883][ T5332] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 107.209896][ T5332] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 107.209908][ T5332] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 107.209921][ T5332] ? down_read+0x2be/0x330
[ 107.209934][ T5332] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 107.209946][ T5332] configfs_write_iter+0x337/0x430
[ 107.209961][ T5332] vfs_write+0x612/0xba0
[ 107.209977][ T5332] ? __pfx_vfs_write+0x10/0x10
[ 107.209992][ T5332] ? __fget_files+0x2a/0x420
[ 107.210006][ T5332] ksys_write+0x150/0x270
[ 107.210020][ T5332] ? __pfx_ksys_write+0x10/0x10
[ 107.210035][ T5332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 107.210046][ T5332] do_syscall_64+0x174/0x580
[ 107.210056][ T5332] ? trace_irq_disable+0x3b/0x140
[ 107.210069][ T5332] ? clear_bhb_loop+0x40/0x90
[ 107.210080][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 107.210091][ T5332] RIP: 0033:0x7f4ad339df99
[ 107.210101][ T5332] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 107.210109][ T5332] RSP: 002b:00007f4ad41bcfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 107.210121][ T5332] RAX: ffffffffffffffda RBX: 00007f4ad3625fa0 RCX: 00007f4ad339df99
[ 107.210129][ T5332] RDX: 000000000000012f RSI: 0000200000000640 RDI: 0000000000000003
[ 107.210135][ T5332] RBP: 00007f4ad3434ec4 R08: 0000000000000000 R09: 0000000000000000
[ 107.210141][ T5332] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 107.210147][ T5332] R13: 00007f4ad3626038 R14: 00007f4ad3625fa0 R15: 00007ffd65cffd48
[ 107.210158][ T5332]
[ 107.210162][ T5332]
[ 107.306196][ T5332] Allocated by task 5332:
[ 107.308045][ T5332] kasan_save_track+0x3e/0x80
[ 107.310149][ T5332] __kasan_kmalloc+0x93/0xb0
[ 107.312182][ T5332] __kmalloc_node_track_caller_noprof+0x4c3/0x730
[ 107.314826][ T5332] kstrdup+0x42/0x100
[ 107.316339][ T5332] f_uac2_opts_c_srate_store+0x11f/0x2b0
[ 107.318489][ T5332] configfs_write_iter+0x337/0x430
[ 107.320836][ T5332] vfs_write+0x612/0xba0
[ 107.322685][ T5332] ksys_write+0x150/0x270
[ 107.324588][ T5332] do_syscall_64+0x174/0x580
[ 107.326584][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 107.329140][ T5332]
[ 107.330206][ T5332] The buggy address belongs to the object at ffff88803ed9ff00
[ 107.330206][ T5332] which belongs to the cache kmalloc-64 of size 64
[ 107.336140][ T5332] The buggy address is located 6 bytes inside of
[ 107.336140][ T5332] 38-byte region [ffff88803ed9ff00, ffff88803ed9ff26)
[ 107.341604][ T5332]
[ 107.342661][ T5332] The buggy address belongs to the physical page:
[ 107.345340][ T5332] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803ed9fa00 pfn:0x3ed9f
[ 107.349500][ T5332] flags: 0x4fff00000000200(workingset|node=1|zone=1|lastcpupid=0x7ff)
[ 107.352849][ T5332] page_type: f5(slab)
[ 107.354594][ T5332] raw: 04fff00000000200 ffff88801b0418c0 ffff888030400588 ffffea0000d556d0
[ 107.358036][ T5332] raw: ffff88803ed9fa00 000000080020001c 00000000f5000000 0000000000000000
[ 107.361766][ T5332] page dumped because: kasan: bad access detected
[ 107.364371][ T5332] page_owner tracks the page as allocated
[ 107.366848][ T5332] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 2, tgid 2 (kthreadd), ts 27794907484, free_ts 27794896874
[ 107.373780][ T5332] post_alloc_hook+0x1f9/0x250
[ 107.375645][ T5332] get_page_from_freelist+0x21fa/0x2270
[ 107.377822][ T5332] __alloc_frozen_pages_noprof+0x18d/0x380
[ 107.380117][ T5332] allocate_slab+0x79/0x5e0
[ 107.381901][ T5332] ___slab_alloc+0x16a/0x950
[ 107.383838][ T5332] __kmalloc_node_noprof+0x2e6/0x740
[ 107.386098][ T5332] __vmalloc_node_range_noprof+0x5d9/0x1730
[ 107.388520][ T5332] __vmalloc_node_noprof+0xc2/0x100
[ 107.390672][ T5332] dup_task_struct+0x2a0/0x8e0
[ 107.392629][ T5332] copy_process+0x820/0x4390
[ 107.394553][ T5332] kernel_clone+0x2d7/0x940
[ 107.396502][ T5332] kernel_thread+0x13f/0x1b0
[ 107.398360][ T5332] kthreadd+0x4ec/0x6e0
[ 107.400010][ T5332] ret_from_fork+0x514/0xb70
[ 107.401931][ T5332] ret_from_fork_asm+0x1a/0x30
[ 107.403940][ T5332] page last free pid 2 tgid 2 stack trace:
[ 107.406502][ T5332] __free_frozen_pages+0xc1e/0xd10
[ 107.408550][ T5332] __kasan_populate_vmalloc+0x1a8/0x1c0
[ 107.410849][ T5332] alloc_vmap_area+0xd1a/0x1420
[ 107.412904][ T5332] __get_vm_area_node+0x1f2/0x300
[ 107.415005][ T5332] __vmalloc_node_range_noprof+0x358/0x1730
[ 107.417401][ T5332] __vmalloc_node_noprof+0xc2/0x100
[ 107.419723][ T5332] dup_task_struct+0x2a0/0x8e0
[ 107.422256][ T5332] copy_process+0x820/0x4390
[ 107.424714][ T5332] kernel_clone+0x2d7/0x940
[ 107.427126][ T5332] kernel_thread+0x13f/0x1b0
[ 107.429567][ T5332] kthreadd+0x4ec/0x6e0
[ 107.431856][ T5332] ret_from_fork+0x514/0xb70
[ 107.434266][ T5332] ret_from_fork_asm+0x1a/0x30
[ 107.436483][ T5332]
[ 107.437495][ T5332] Memory state around the buggy address:
[ 107.439831][ T5332] ffff88803ed9fe00: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[ 107.443280][ T5332] ffff88803ed9fe80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[ 107.446549][ T5332] >ffff88803ed9ff00: 00 00 00 00 06 fc fc fc fc fc fc fc fc fc fc fc
[ 107.449748][ T5332] ^
[ 107.451421][ T5332] ffff88803ed9ff80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[ 107.454602][ T5332] ffff88803eda0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 107.457852][ T5332] ==================================================================
[ 107.479400][ T5332] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 107.482461][ T5332] CPU: 0 UID: 0 PID: 5332 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 107.486097][ T5332] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 107.490313][ T5332] Call Trace:
[ 107.491627][ T5332]
[ 107.492857][ T5332] vpanic+0x56c/0xa60
[ 107.494530][ T5332] ? __pfx_vpanic+0x10/0x10
[ 107.496469][ T5332] ? __pfx___schedule+0x10/0x10
[ 107.498467][ T5332] panic+0xc5/0xd0
[ 107.500054][ T5332] ? __pfx_panic+0x10/0x10
[ 107.501900][ T5332] ? preempt_schedule_common+0x82/0xd0
[ 107.504171][ T5332] check_panic_on_warn+0x89/0xb0
[ 107.506252][ T5332] end_report+0x73/0x170
[ 107.508027][ T5332] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 107.510597][ T5332] kasan_report_invalid_free+0xfa/0x110
[ 107.512942][ T5332] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 107.515391][ T5332] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 107.517800][ T5332] __kasan_slab_pre_free+0x104/0x120
[ 107.520010][ T5332] kfree+0x173/0x640
[ 107.521674][ T5332] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 107.524167][ T5332] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 107.526473][ T5332] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 107.529187][ T5332] ? down_read+0x2be/0x330
[ 107.531498][ T5332] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 107.534285][ T5332] configfs_write_iter+0x337/0x430
[ 107.536410][ T5332] vfs_write+0x612/0xba0
[ 107.538272][ T5332] ? __pfx_vfs_write+0x10/0x10
[ 107.540729][ T5332] ? __fget_files+0x2a/0x420
[ 107.542707][ T5332] ksys_write+0x150/0x270
[ 107.544528][ T5332] ? __pfx_ksys_write+0x10/0x10
[ 107.546654][ T5332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 107.549297][ T5332] do_syscall_64+0x174/0x580
[ 107.551327][ T5332] ? trace_irq_disable+0x3b/0x140
[ 107.553439][ T5332] ? clear_bhb_loop+0x40/0x90
[ 107.555430][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 107.557859][ T5332] RIP: 0033:0x7f4ad339df99
[ 107.559759][ T5332] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 107.567562][ T5332] RSP: 002b:00007f4ad41bcfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 107.570928][ T5332] RAX: ffffffffffffffda RBX: 00007f4ad3625fa0 RCX: 00007f4ad339df99
[ 107.574215][ T5332] RDX: 000000000000012f RSI: 0000200000000640 RDI: 0000000000000003
[ 107.577405][ T5332] RBP: 00007f4ad3434ec4 R08: 0000000000000000 R09: 0000000000000000
[ 107.580632][ T5332] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 107.583957][ T5332] R13: 00007f4ad3626038 R14: 00007f4ad3625fa0 R15: 00007ffd65cffd48
[ 107.587321][ T5332]
[ 107.589053][ T5332] Kernel Offset: disabled
[ 107.590989][ T5332] Rebooting in 86400 seconds..