program:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f"], 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x100, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x29}]}, @NFT_MSG_NEWSETELEM={0x68, 0x1e, 0xa, 0x105, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x3c, 0x3, 0x0, 0x1, [{0x38, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x34, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x2d, 0x1, "fefe807eb37bc2a7a6110a370abbe10adf32aa848edc90232d4665de2ae1583b710c20da833679ebe6"}]}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xec}}, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60)
r5 = eventfd2(0x3, 0x1)
ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000240)={r5, 0x7fc, 0x2, r5})
ioctl$KVM_SET_IRQCHIP(r3, 0xae64, 0x0)
ioctl$KVM_SET_PIT2(r3, 0xae71, &(0x7f00000002c0)={[{0x10000, 0x6, 0x0, 0x0, 0x0, 0x2, 0x0, 0xff, 0x80, 0x1, 0x0, 0x0, 0x100000000000000}, {0xffffffff, 0x0, 0x80, 0x0, 0x2, 0x0, 0x0, 0x0, 0x2, 0x2, 0x0, 0x10, 0xc}, {0x10003, 0x0, 0xfd, 0x0, 0xfd, 0x0, 0x21, 0x5, 0xfd, 0x0, 0xfe, 0x0, 0x800}]})
syz_usb_control_io$hid(r1, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000300)={0x0, 0x22, 0x10, {[@global=@item_012={0x0, 0x1, 0x2}, @local=@item_4={0x3, 0x2, 0x0, "45501821"}, @global=@item_012={0x1, 0x1, 0xb, "f5"}, @local=@item_012={0x2, 0x2, 0x8, "00ae"}, @main=@item_4={0x3, 0x0, 0x8, "9e3ce079"}]}}, 0x0}, 0x0)
r6 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000240)='\x00')
read$hiddev(r6, &(0x7f0000000280)=""/52, 0x34)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r7 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r7, &(0x7f0000000500)='44100,48000,88200,96000,1', 0x19)
write(r7, &(0x7f0000000000)="67b6159b4337db12cbcb93dfd72fade0b30a9279abbc9028e6b483fe869aee713cc2a492c4eb407cb03d13b84fd4967212cb98558e8afddb64a1b429015583a9844ef3019e5f36f02d6c8e4f0c8ca35670d7ba78ed21cb31f3c9319ff02c7f5884ed33ab72c82e83374a788a1995c35fd47b1ee1f3b9003179aed80a38730ce26ef2c34326c6b402f4e4de291f609c9f72c4a52225ccd465df894ce61c7f7577b7f6db02dac2b1c7eaaf3c0c15f510fa8982529aaa72f4637270612dbc942321ffb1", 0xc2)
r8 = openat$null(0xffffffffffffff9c, &(0x7f0000000100), 0x200000, 0x0)
fanotify_mark(r8, 0x8, 0x48000010, r7, &(0x7f0000000180)='./myconfig/usb_gadget/g1/UDC\x00')
symlinkat(&(0x7f0000000580)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00')
r9 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./myconfig/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r9, &(0x7f0000000640)='usbip-vudc.0', 0xc)
[ 93.776646][ T44] Bluetooth: hci0: command tx timeout
[ 94.054628][ T5308] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 94.207534][ T5308] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 94.212248][ T5308] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40
[ 94.216785][ T5308] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 94.226431][ T5308] usb 5-1: config 0 descriptor??
[ 94.447748][ T5308] usbhid 5-1:0.0: can't add hid device: -71
[ 94.452730][ T5308] usbhid 5-1:0.0: probe with driver usbhid failed with error -71
[ 94.466403][ T5308] usb 5-1: USB disconnect, device number 2
[ 94.953524][ T5308] usb 5-1: new high-speed USB device number 3 using dummy_hcd
[ 95.106167][ T5308] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 95.110724][ T5308] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[ 95.116343][ T5308] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[ 95.120299][ T5308] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 95.131061][ T5308] usb 5-1: config 0 descriptor??
[ 95.602036][ T5308] plantronics 0003:047F:FFFF.0002: global environment stack underflow
[ 95.606880][ T5308] plantronics 0003:047F:FFFF.0002: item 0 1 1 11 parsing failed
[ 95.611708][ T5308] plantronics 0003:047F:FFFF.0002: parse failed
[ 95.615659][ T5308] plantronics 0003:047F:FFFF.0002: probe with driver plantronics failed with error -22
[ 95.804097][ T44] Bluetooth: hci0: command tx timeout
[ 96.000386][ T5333] ==================================================================
[ 96.003859][ T5333] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0
[ 96.007100][ T5333] Free of addr ffff88805267075e by task syz.0.0/5333
[ 96.009758][ T5333]
[ 96.010748][ T5333] CPU: 0 UID: 0 PID: 5333 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 96.010759][ T5333] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 96.010765][ T5333] Call Trace:
[ 96.010772][ T5333]
[ 96.010777][ T5333] dump_stack_lvl+0xe8/0x150
[ 96.010799][ T5333] print_address_description+0x55/0x1e0
[ 96.010816][ T5333] print_report+0x58/0x70
[ 96.010829][ T5333] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 96.010842][ T5333] kasan_report_invalid_free+0xea/0x110
[ 96.010857][ T5333] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 96.010872][ T5333] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 96.010886][ T5333] __kasan_slab_pre_free+0x104/0x120
[ 96.010901][ T5333] kfree+0x173/0x640
[ 96.010909][ T5333] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 96.010917][ T5333] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 96.010927][ T5333] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 96.010936][ T5333] ? down_read+0x2be/0x330
[ 96.010944][ T5333] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 96.010952][ T5333] configfs_write_iter+0x337/0x430
[ 96.010961][ T5333] vfs_write+0x612/0xba0
[ 96.010972][ T5333] ? __pfx_vfs_write+0x10/0x10
[ 96.010982][ T5333] ? __fget_files+0x2a/0x420
[ 96.010991][ T5333] ksys_write+0x150/0x270
[ 96.011001][ T5333] ? __pfx_ksys_write+0x10/0x10
[ 96.011011][ T5333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 96.011018][ T5333] do_syscall_64+0x174/0x580
[ 96.011026][ T5333] ? clear_bhb_loop+0x40/0x90
[ 96.011033][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 96.011040][ T5333] RIP: 0033:0x7f852419de99
[ 96.011048][ T5333] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 96.011054][ T5333] RSP: 002b:00007f8524f87fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 96.011064][ T5333] RAX: ffffffffffffffda RBX: 00007f8524425fa0 RCX: 00007f852419de99
[ 96.011077][ T5333] RDX: 00000000000000c2 RSI: 0000200000000000 RDI: 0000000000000008
[ 96.011084][ T5333] RBP: 00007f8524233eaf R08: 0000000000000000 R09: 0000000000000000
[ 96.011090][ T5333] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 96.011097][ T5333] R13: 00007f8524426038 R14: 00007f8524425fa0 R15: 00007ffd9e0ba168
[ 96.011108][ T5333]
[ 96.011112][ T5333]
[ 96.103059][ T5333] Allocated by task 5333:
[ 96.104689][ T5333] kasan_save_track+0x3e/0x80
[ 96.106529][ T5333] __kasan_kmalloc+0x93/0xb0
[ 96.108610][ T5333] __kmalloc_node_track_caller_noprof+0x4c3/0x730
[ 96.111400][ T5333] kstrdup+0x42/0x100
[ 96.113044][ T5333] f_uac2_opts_c_srate_store+0x11f/0x2b0
[ 96.115372][ T5333] configfs_write_iter+0x337/0x430
[ 96.117461][ T5333] vfs_write+0x612/0xba0
[ 96.119294][ T5333] ksys_write+0x150/0x270
[ 96.121182][ T5333] do_syscall_64+0x174/0x580
[ 96.123306][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 96.125848][ T5333]
[ 96.126917][ T5333] The buggy address belongs to the object at ffff888052670700
[ 96.126917][ T5333] which belongs to the cache kmalloc-128 of size 128
[ 96.132897][ T5333] The buggy address is located 94 bytes inside of
[ 96.132897][ T5333] 119-byte region [ffff888052670700, ffff888052670777)
[ 96.137893][ T5333]
[ 96.138766][ T5333] The buggy address belongs to the physical page:
[ 96.141071][ T5333] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888052670d00 pfn:0x52670
[ 96.145230][ T5333] flags: 0x4fff00000000200(workingset|node=1|zone=1|lastcpupid=0x7ff)
[ 96.148581][ T5333] page_type: f5(slab)
[ 96.150761][ T5333] raw: 04fff00000000200 ffff88801b041a00 ffffea0000db8c50 ffff888030400648
[ 96.154866][ T5333] raw: ffff888052670d00 000000080010000d 00000000f5000000 0000000000000000
[ 96.158800][ T5333] page dumped because: kasan: bad access detected
[ 96.161854][ T5333] page_owner tracks the page as allocated
[ 96.164335][ T5333] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5286, tgid 5286 (udevd), ts 95627941054, free_ts 95626685290
[ 96.172596][ T5333] post_alloc_hook+0x1f9/0x250
[ 96.174695][ T5333] get_page_from_freelist+0x21fa/0x2270
[ 96.177109][ T5333] __alloc_frozen_pages_noprof+0x18d/0x380
[ 96.179724][ T5333] allocate_slab+0x79/0x5e0
[ 96.181682][ T5333] refill_objects+0x2d5/0x350
[ 96.183665][ T5333] __pcs_replace_empty_main+0x2bf/0x6b0
[ 96.185982][ T5333] __kmalloc_cache_noprof+0x3a7/0x660
[ 96.188248][ T5333] kernfs_fop_open+0x7e6/0xce0
[ 96.190352][ T5333] do_dentry_open+0x816/0x1380
[ 96.192374][ T5333] vfs_open+0x3b/0x340
[ 96.194094][ T5333] path_openat+0x2e44/0x3830
[ 96.196045][ T5333] do_file_open+0x23e/0x4a0
[ 96.198085][ T5333] do_sys_openat2+0x115/0x200
[ 96.200261][ T5333] __x64_sys_openat+0x138/0x170
[ 96.202379][ T5333] do_syscall_64+0x174/0x580
[ 96.204284][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 96.206772][ T5333] page last free pid 5286 tgid 5286 stack trace:
[ 96.209558][ T5333] __free_frozen_pages+0xc1e/0xd10
[ 96.211724][ T5333] __slab_free+0x274/0x2c0
[ 96.213631][ T5333] qlist_free_all+0x99/0x100
[ 96.215666][ T5333] kasan_quarantine_reduce+0x148/0x160
[ 96.218001][ T5333] __kasan_slab_alloc+0x22/0x80
[ 96.220033][ T5333] kmem_cache_alloc_node_noprof+0x355/0x610
[ 96.222562][ T5333] __alloc_skb+0x1d7/0x7a0
[ 96.224483][ T5333] netlink_sendmsg+0x5d4/0xb40
[ 96.226535][ T5333] sock_sendmsg_nosec+0x13a/0x180
[ 96.228744][ T5333] ____sys_sendmsg+0x54e/0x850
[ 96.230729][ T5333] ___sys_sendmsg+0x2a5/0x360
[ 96.232684][ T5333] __x64_sys_sendmsg+0x1b1/0x290
[ 96.234797][ T5333] do_syscall_64+0x174/0x580
[ 96.236742][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 96.239157][ T5333]
[ 96.240198][ T5333] Memory state around the buggy address:
[ 96.242552][ T5333] ffff888052670600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 96.245834][ T5333] ffff888052670680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 96.249248][ T5333] >ffff888052670700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 fc
[ 96.252661][ T5333] ^
[ 96.255767][ T5333] ffff888052670780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 96.259209][ T5333] ffff888052670800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 96.262581][ T5333] ==================================================================
[ 96.283124][ T5333] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 96.286136][ T5333] CPU: 0 UID: 0 PID: 5333 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 96.290716][ T5333] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 96.295102][ T5333] Call Trace:
[ 96.296898][ T5333]
[ 96.298316][ T5333] vpanic+0x56c/0xa60
[ 96.299990][ T5333] ? __pfx_vpanic+0x10/0x10
[ 96.301842][ T5333] ? __pfx___schedule+0x10/0x10
[ 96.303924][ T5333] panic+0xc5/0xd0
[ 96.305466][ T5333] ? __pfx_panic+0x10/0x10
[ 96.307208][ T5333] ? preempt_schedule_common+0x82/0xd0
[ 96.309333][ T5333] check_panic_on_warn+0x89/0xb0
[ 96.311295][ T5333] end_report+0x73/0x170
[ 96.313065][ T5333] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 96.315527][ T5333] kasan_report_invalid_free+0xfa/0x110
[ 96.317978][ T5333] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 96.320521][ T5333] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 96.323159][ T5333] __kasan_slab_pre_free+0x104/0x120
[ 96.325419][ T5333] kfree+0x173/0x640
[ 96.327128][ T5333] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 96.329509][ T5333] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 96.331829][ T5333] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 96.334332][ T5333] ? down_read+0x2be/0x330
[ 96.336166][ T5333] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 96.338693][ T5333] configfs_write_iter+0x337/0x430
[ 96.340620][ T5333] vfs_write+0x612/0xba0
[ 96.342206][ T5333] ? __pfx_vfs_write+0x10/0x10
[ 96.343887][ T5333] ? __fget_files+0x2a/0x420
[ 96.345362][ T5333] ksys_write+0x150/0x270
[ 96.346727][ T5333] ? __pfx_ksys_write+0x10/0x10
[ 96.348444][ T5333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 96.350769][ T5333] do_syscall_64+0x174/0x580
[ 96.352612][ T5333] ? clear_bhb_loop+0x40/0x90
[ 96.354537][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 96.356828][ T5333] RIP: 0033:0x7f852419de99
[ 96.358837][ T5333] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 96.367474][ T5333] RSP: 002b:00007f8524f87fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 96.371308][ T5333] RAX: ffffffffffffffda RBX: 00007f8524425fa0 RCX: 00007f852419de99
[ 96.374629][ T5333] RDX: 00000000000000c2 RSI: 0000200000000000 RDI: 0000000000000008
[ 96.377740][ T5333] RBP: 00007f8524233eaf R08: 0000000000000000 R09: 0000000000000000
[ 96.380838][ T5333] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 96.384018][ T5333] R13: 00007f8524426038 R14: 00007f8524425fa0 R15: 00007ffd9e0ba168
[ 96.387377][ T5333]
[ 96.388948][ T5333] Kernel Offset: disabled
[ 96.390663][ T5333] Rebooting in 86400 seconds..