program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000040)="052c562c8b2187d4c538003030a1e88fbd697b426980f29a3ffa86a42c26c2ab345c67846e753f420779b4a27971458b44fa3ea82ce51991bd9648cce37699d05da975a5322082f1e249273aafa9fa851bfe75b854412361c4ba44a84302a3f6191031b8cfd2fd9fd10e4504f5a3220024ab2c4e8bd9c722", 0xfffffc8e)
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
[ 86.291040][ T5276] Bluetooth: hci0: command tx timeout
[ 86.396796][ T5312] ==================================================================
[ 86.400192][ T5312] BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.403506][ T5312] Free of addr ffff888012e23ce2 by task syz.0.0/5312
[ 86.406220][ T5312]
[ 86.407270][ T5312] CPU: 0 UID: 0 PID: 5312 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 86.407283][ T5312] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.407289][ T5312] Call Trace:
[ 86.407296][ T5312]
[ 86.407303][ T5312] dump_stack_lvl+0xe8/0x150
[ 86.407323][ T5312] print_address_description+0x55/0x1e0
[ 86.407337][ T5312] print_report+0x58/0x70
[ 86.407349][ T5312] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.407360][ T5312] kasan_report_invalid_free+0xea/0x110
[ 86.407375][ T5312] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.407387][ T5312] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.407398][ T5312] __kasan_slab_pre_free+0x104/0x120
[ 86.407418][ T5312] kfree+0x173/0x640
[ 86.407434][ T5312] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.407446][ T5312] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.407459][ T5312] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 86.407472][ T5312] ? down_read+0x2be/0x330
[ 86.407485][ T5312] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 86.407496][ T5312] configfs_write_iter+0x337/0x430
[ 86.407512][ T5312] vfs_write+0x612/0xba0
[ 86.407529][ T5312] ? __pfx_vfs_write+0x10/0x10
[ 86.407543][ T5312] ? __fget_files+0x2a/0x420
[ 86.407557][ T5312] ksys_write+0x150/0x270
[ 86.407569][ T5312] ? __pfx_ksys_write+0x10/0x10
[ 86.407581][ T5312] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.407591][ T5312] do_syscall_64+0x174/0x580
[ 86.407603][ T5312] ? trace_irq_disable+0x3b/0x140
[ 86.407615][ T5312] ? clear_bhb_loop+0x70/0xc0
[ 86.407626][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.407637][ T5312] RIP: 0033:0x7f3f14d9e0d9
[ 86.407648][ T5312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 86.407657][ T5312] RSP: 002b:00007f3f15cacfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 86.407669][ T5312] RAX: ffffffffffffffda RBX: 00007f3f15025fa0 RCX: 00007f3f14d9e0d9
[ 86.407677][ T5312] RDX: 00000000fffffc8e RSI: 0000200000000040 RDI: 0000000000000003
[ 86.407683][ T5312] RBP: 00007f3f14e35024 R08: 0000000000000000 R09: 0000000000000000
[ 86.407690][ T5312] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 86.407696][ T5312] R13: 00007f3f15026038 R14: 00007f3f15025fa0 R15: 00007ffdb5c6edf8
[ 86.407707][ T5312]
[ 86.407711][ T5312]
[ 86.503747][ T5312] Allocated by task 5312:
[ 86.505557][ T5312] kasan_save_track+0x3e/0x80
[ 86.507564][ T5312] __kasan_kmalloc+0x93/0xb0
[ 86.509553][ T5312] __kmalloc_node_track_caller_noprof+0x4c3/0x730
[ 86.512293][ T5312] kstrdup+0x42/0x100
[ 86.514041][ T5312] f_uac2_opts_p_srate_store+0x11f/0x2b0
[ 86.516489][ T5312] configfs_write_iter+0x337/0x430
[ 86.518635][ T5312] vfs_write+0x612/0xba0
[ 86.520396][ T5312] ksys_write+0x150/0x270
[ 86.522194][ T5312] do_syscall_64+0x174/0x580
[ 86.524246][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.526700][ T5312]
[ 86.527738][ T5312] The buggy address belongs to the object at ffff888012e23ce0
[ 86.527738][ T5312] which belongs to the cache kmalloc-16 of size 16
[ 86.533321][ T5312] The buggy address is located 2 bytes inside of
[ 86.533321][ T5312] 11-byte region [ffff888012e23ce0, ffff888012e23ceb)
[ 86.538569][ T5312]
[ 86.539683][ T5312] The buggy address belongs to the physical page:
[ 86.542350][ T5312] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888012e23f20 pfn:0x12e23
[ 86.546374][ T5312] flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
[ 86.549613][ T5312] page_type: f5(slab)
[ 86.551268][ T5312] raw: 00fff00000000200 ffff88801b041640 ffff88801b040408 ffff88801b040408
[ 86.554693][ T5312] raw: ffff888012e23f20 0000000800800079 00000000f5000000 0000000000000000
[ 86.558207][ T5312] page dumped because: kasan: bad access detected
[ 86.560820][ T5312] page_owner tracks the page as allocated
[ 86.563265][ T5312] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 5275, tgid 5275 (syz-executor), ts 84568936750, free_ts 84558572255
[ 86.571167][ T5312] post_alloc_hook+0x1f9/0x250
[ 86.573159][ T5312] get_page_from_freelist+0x21fa/0x2270
[ 86.575405][ T5312] __alloc_frozen_pages_noprof+0x18d/0x380
[ 86.577796][ T5312] allocate_slab+0x79/0x5e0
[ 86.579595][ T5312] ___slab_alloc+0x16a/0x950
[ 86.581460][ T5312] __kmalloc_cache_node_noprof+0x1d5/0x630
[ 86.583905][ T5312] hugetlb_cgroup_css_alloc+0x175/0xb20
[ 86.586373][ T5312] cgroup_apply_control_enable+0x5bb/0xda0
[ 86.588947][ T5312] cgroup_mkdir+0xd2c/0xf90
[ 86.590955][ T5312] kernfs_iop_mkdir+0x213/0x360
[ 86.593126][ T5312] vfs_mkdir+0x406/0x620
[ 86.595021][ T5312] filename_mkdirat+0x285/0x510
[ 86.597218][ T5312] __se_sys_mkdirat+0x35/0x150
[ 86.599219][ T5312] do_syscall_64+0x174/0x580
[ 86.601134][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.603747][ T5312] page last free pid 5275 tgid 5275 stack trace:
[ 86.606484][ T5312] __free_frozen_pages+0xc1e/0xd10
[ 86.608684][ T5312] __slab_free+0x274/0x2c0
[ 86.610658][ T5312] qlist_free_all+0x99/0x100
[ 86.612754][ T5312] kasan_quarantine_reduce+0x148/0x160
[ 86.615063][ T5312] __kasan_slab_alloc+0x22/0x80
[ 86.617161][ T5312] __kmalloc_noprof+0x311/0x720
[ 86.619238][ T5312] cgroup_mkdir+0x288/0xf90
[ 86.621168][ T5312] kernfs_iop_mkdir+0x213/0x360
[ 86.623219][ T5312] vfs_mkdir+0x406/0x620
[ 86.624946][ T5312] filename_mkdirat+0x285/0x510
[ 86.627053][ T5312] __se_sys_mkdirat+0x35/0x150
[ 86.629096][ T5312] do_syscall_64+0x174/0x580
[ 86.631162][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.633783][ T5312]
[ 86.634794][ T5312] Memory state around the buggy address:
[ 86.637140][ T5312] ffff888012e23b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 86.640555][ T5312] ffff888012e23c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 86.643937][ T5312] >ffff888012e23c80: fc fc fc fc fc fc fc fc fc fc fc fc 00 03 fc fc
[ 86.647314][ T5312] ^
[ 86.650365][ T5312] ffff888012e23d00: 00 00 fc fc 00 00 fc fc 00 00 fc fc 00 00 fc fc
[ 86.653795][ T5312] ffff888012e23d80: 00 00 fc fc fa fb fc fc 00 00 fc fc 00 00 fc fc
[ 86.657255][ T5312] ==================================================================
[ 86.703675][ T5312] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 86.706904][ T5312] CPU: 0 UID: 0 PID: 5312 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 86.710610][ T5312] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.714718][ T5312] Call Trace:
[ 86.716170][ T5312]
[ 86.717451][ T5312] vpanic+0x56c/0xa60
[ 86.719187][ T5312] ? __pfx_vpanic+0x10/0x10
[ 86.721126][ T5312] ? __pfx___schedule+0x10/0x10
[ 86.723240][ T5312] panic+0xc5/0xd0
[ 86.724842][ T5312] ? __pfx_panic+0x10/0x10
[ 86.726672][ T5312] ? preempt_schedule_common+0x82/0xd0
[ 86.728887][ T5312] check_panic_on_warn+0x89/0xb0
[ 86.730982][ T5312] end_report+0x73/0x170
[ 86.732820][ T5312] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.735190][ T5312] kasan_report_invalid_free+0xfa/0x110
[ 86.737389][ T5312] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.739849][ T5312] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.742216][ T5312] __kasan_slab_pre_free+0x104/0x120
[ 86.744533][ T5312] kfree+0x173/0x640
[ 86.746141][ T5312] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.748544][ T5312] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 86.750845][ T5312] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 86.753370][ T5312] ? down_read+0x2be/0x330
[ 86.755288][ T5312] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 86.757786][ T5312] configfs_write_iter+0x337/0x430
[ 86.759954][ T5312] vfs_write+0x612/0xba0
[ 86.761806][ T5312] ? __pfx_vfs_write+0x10/0x10
[ 86.763770][ T5312] ? __fget_files+0x2a/0x420
[ 86.765674][ T5312] ksys_write+0x150/0x270
[ 86.767449][ T5312] ? __pfx_ksys_write+0x10/0x10
[ 86.769480][ T5312] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.772116][ T5312] do_syscall_64+0x174/0x580
[ 86.774078][ T5312] ? trace_irq_disable+0x3b/0x140
[ 86.776238][ T5312] ? clear_bhb_loop+0x70/0xc0
[ 86.778350][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.780909][ T5312] RIP: 0033:0x7f3f14d9e0d9
[ 86.782903][ T5312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 86.791112][ T5312] RSP: 002b:00007f3f15cacfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 86.794714][ T5312] RAX: ffffffffffffffda RBX: 00007f3f15025fa0 RCX: 00007f3f14d9e0d9
[ 86.798183][ T5312] RDX: 00000000fffffc8e RSI: 0000200000000040 RDI: 0000000000000003
[ 86.801592][ T5312] RBP: 00007f3f14e35024 R08: 0000000000000000 R09: 0000000000000000
[ 86.804961][ T5312] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 86.808385][ T5312] R13: 00007f3f15026038 R14: 00007f3f15025fa0 R15: 00007ffdb5c6edf8
[ 86.811847][ T5312]
[ 86.813691][ T5312] Kernel Offset: disabled
[ 86.815569][ T5312] Rebooting in 86400 seconds..