program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
close(r0)
socket$inet6_mptcp(0xa, 0x1, 0x106)
connect$inet6(r0, &(0x7f0000000240)={0xa, 0x4e23, 0xa4e4, @remote, 0x3}, 0x1c)
setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='mnt/ttyUSB0\x00', 0x2, 0x0)
ioctl$TCSBRKP(r1, 0x541e, 0x4)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x10, 0x4, &(0x7f0000000a00)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400d2f6f27000950000005bcb1512cf4bfb58f0297f27a944abf098d223bc119c88483dd83c5b21923dd9d98d140b891b10a20f53a25a8edee8f1d238c7b329c03fb1f846fa017f0b0e9be54b725dbba7f2c669c28bda929768ca69ff793b8459277fb62878d91344c803a29bd9d259efc296edf4a2199ed791e9616771c4098e472fe06877db13bba5d8d1bf177772fa13fbc9c80223121bb42114610084f00fba0c8634ad2e12cb181bc74138477117fd"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r1}, 0x94)
close(r2)
r3 = socket(0x28, 0x5, 0x0)
r4 = socket(0x28, 0x5, 0x0)
bind$vsock_stream(r4, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10)
listen(r4, 0x4)
connect$vsock_stream(r4, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10)
r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r5}, &(0x7f0000000000), &(0x7f0000000080)=r2}, 0x20)
shutdown(r3, 0x0)
recvfrom$inet(r3, 0x0, 0x0, 0x10000, 0x0, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write$binfmt_misc(r6, &(0x7f0000000100)="20b8d2bd6912259b3cea08e41033c23fd9c2138c5b73e87e0f839e985602b9d3cfd291122af4d77cc7ed83ddcf263e7477ef", 0x32)
write(r6, &(0x7f0000000180)="3434312f98be27d830302c34383030302c3838323030a416b853a780d7542c3936307230302c3137363430302cffff323030302c3335323830302c", 0x3b)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000980)={r6, 0x0, 0xd1, 0x87, &(0x7f0000000680)="8343d48bde059ba12a148e39b1bffac9f9bacd02ec8dfcb34727f3f453280749632951deb670546890165fd7b84ac70257d04b2bebcf03a15153ae254cc40eabfe528641e9bdf1e8d2a8c0d2677f4b12c1f9571cb6a5cbf12b282dbd32332fe3c7c72c580b73f26f0b097d5fea3ebd6696f674b7886e4a52f3b5f04cf3df3c64366b2a6bdb2c51864f41176f532a663941b8dc0e6f15dfe55e2549f07919958c4a04aac8612cbe7e30bd99b4068092a5972ef0df855d3e54d88c21d50f410c938d35db12cfcee43811ddc16bb24462ca1a", &(0x7f0000000780)=""/135, 0x0, 0x0, 0xc0, 0x6a, &(0x7f0000000840)="f4fd1c7eee754100f55d0858f269406b23c6caa7224fae9cc59f0e6af36703b691e9e1c3ae76265b48be0d996e2f590a538c23c6790085ae938a0334a973c0477a857cb2d75cb4dfbe977b88f3c63e5c1f48565a270136e6baf0dc0b905399fb6f0b7a89a1c56a5da79ed44e1225efeb05270597de7e8f64b035c039b9d6558690f8a5f3c3016a744d99ce760c8a1fc9640724d5f8179905d5fdbdcbe5ad31034807ce43ede62cea96737b85fa389e140a061d3cbea5e4251c009172446a4aa8", &(0x7f0000000900)="5eaf1cc87eb01da4b448e963998d43261b24175a995265c82032de9fa937973c60ed959e6e776fcc93964fe0975e9f9c7c5476be9b7a980b9462115eccb6feadc38176a2d4b5612125f669642ea41ccf3cf20ae7e0cd64119fa6334c0e14da09780488c1ade9204864de", 0x2, 0x0, 0x6}, 0x50)
symlinkat(&(0x7f0000000580)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00')
open_tree(0xffffffffffffff9c, &(0x7f0000000340)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x80800)
sendto(r3, &(0x7f0000000280)="c933d13ea8a5b158f33d26f9cba7e3042f8095f322bbf217afe5ab5f19ba2a5d8141aebaf194b645f3e4fb67f0af173348e287c6d30e359f690404734452ad028f8a1095a89d67f3735f6feb9de335df5af0073f8690463658fb080a3dca8d3b47e230669f863bc57ed94ceef492fa7e1eab88d29cd9b3ce7e799b00e428d120731c719fcd6eb3974d40e3cea9b742ae5c6572ff4d5aa855744d066e665d46c5ca4b", 0xa2, 0x40010, &(0x7f0000000400)=@pppol2tpv3={0x18, 0x1, {0x0, r4, {0x2, 0x5, @multicast1}, 0x3, 0x4, 0x2, 0x2}}, 0x80)
[ 111.458095][ T4643] Bluetooth: hci0: command tx timeout
[ 111.778262][ T5318] ==================================================================
[ 111.782050][ T5318] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0
[ 111.786042][ T5318] Free of addr ffff88803341ff8b by task syz.0.0/5318
[ 111.789148][ T5318]
[ 111.790366][ T5318] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 111.790391][ T5318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 111.790401][ T5318] Call Trace:
[ 111.790414][ T5318]
[ 111.790423][ T5318] dump_stack_lvl+0xe8/0x150
[ 111.790456][ T5318] print_address_description+0x55/0x1e0
[ 111.790482][ T5318] print_report+0x58/0x70
[ 111.790501][ T5318] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 111.790516][ T5318] kasan_report_invalid_free+0xea/0x110
[ 111.790543][ T5318] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 111.790561][ T5318] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 111.790577][ T5318] __kasan_slab_pre_free+0x104/0x120
[ 111.790595][ T5318] kfree+0x173/0x640
[ 111.790623][ T5318] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 111.790640][ T5318] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 111.790665][ T5318] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 111.790687][ T5318] ? down_read+0x2be/0x330
[ 111.790707][ T5318] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 111.790721][ T5318] configfs_write_iter+0x337/0x430
[ 111.790740][ T5318] vfs_write+0x612/0xba0
[ 111.790764][ T5318] ? __pfx_vfs_write+0x10/0x10
[ 111.790788][ T5318] ? __fget_files+0x2a/0x420
[ 111.790805][ T5318] ksys_write+0x150/0x270
[ 111.790824][ T5318] ? __pfx_ksys_write+0x10/0x10
[ 111.790847][ T5318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 111.790859][ T5318] do_syscall_64+0x174/0x580
[ 111.790879][ T5318] ? trace_irq_disable+0x3b/0x140
[ 111.790900][ T5318] ? clear_bhb_loop+0x70/0xc0
[ 111.790916][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 111.790931][ T5318] RIP: 0033:0x7f9cd519e0d9
[ 111.790946][ T5318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 111.790958][ T5318] RSP: 002b:00007f9cd60cafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 111.790980][ T5318] RAX: ffffffffffffffda RBX: 00007f9cd5426090 RCX: 00007f9cd519e0d9
[ 111.790991][ T5318] RDX: 000000000000003b RSI: 0000200000000180 RDI: 0000000000000006
[ 111.791000][ T5318] RBP: 00007f9cd5235024 R08: 0000000000000000 R09: 0000000000000000
[ 111.791008][ T5318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 111.791016][ T5318] R13: 00007f9cd5426128 R14: 00007f9cd5426090 R15: 00007ffd8d620008
[ 111.791031][ T5318]
[ 111.791037][ T5318]
[ 111.913091][ T5318] Allocated by task 5318:
[ 111.915972][ T5318] kasan_save_track+0x3e/0x80
[ 111.918407][ T5318] __kasan_kmalloc+0x93/0xb0
[ 111.920695][ T5318] __kmalloc_node_track_caller_noprof+0x4c3/0x730
[ 111.923758][ T5318] kstrdup+0x42/0x100
[ 111.925712][ T5318] f_uac2_opts_c_srate_store+0x11f/0x2b0
[ 111.928689][ T5318] configfs_write_iter+0x337/0x430
[ 111.931530][ T5318] vfs_write+0x612/0xba0
[ 111.933945][ T5318] ksys_write+0x150/0x270
[ 111.936382][ T5318] do_syscall_64+0x174/0x580
[ 111.938880][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 111.942165][ T5318]
[ 111.943489][ T5318] The buggy address belongs to the object at ffff88803341ff80
[ 111.943489][ T5318] which belongs to the cache kmalloc-64 of size 64
[ 111.950647][ T5318] The buggy address is located 11 bytes inside of
[ 111.950647][ T5318] 60-byte region [ffff88803341ff80, ffff88803341ffbc)
[ 111.957705][ T5318]
[ 111.959043][ T5318] The buggy address belongs to the physical page:
[ 111.962455][ T5318] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3341f
[ 111.967430][ T5318] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 111.971230][ T5318] page_type: f5(slab)
[ 111.973388][ T5318] raw: 04fff00000000000 ffff88801b0418c0 dead000000000100 dead000000000122
[ 111.977932][ T5318] raw: 0000000000000000 0000000800200020 00000000f5000000 0000000000000000
[ 111.982000][ T5318] page dumped because: kasan: bad access detected
[ 111.985029][ T5318] page_owner tracks the page as allocated
[ 111.987785][ T5318] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 27627832451, free_ts 26122492345
[ 111.997856][ T5318] post_alloc_hook+0x1f9/0x250
[ 112.000146][ T5318] get_page_from_freelist+0x21fa/0x2270
[ 112.003048][ T5318] __alloc_frozen_pages_noprof+0x18d/0x380
[ 112.006630][ T5318] allocate_slab+0x79/0x5e0
[ 112.009312][ T5318] refill_objects+0x2d5/0x350
[ 112.011693][ T5318] __pcs_replace_empty_main+0x2bf/0x6b0
[ 112.014172][ T5318] __kmalloc_noprof+0x485/0x720
[ 112.016435][ T5318] kobj_map+0x76/0x5b0
[ 112.018358][ T5318] cdev_device_add+0x130/0x380
[ 112.021284][ T5318] cec_register_adapter+0x2db/0x680
[ 112.024671][ T5318] vivid_create_devnodes+0xa54/0x2c60
[ 112.027332][ T5318] vivid_probe+0x5038/0x70c0
[ 112.029494][ T5318] platform_probe+0xf9/0x190
[ 112.031682][ T5318] really_probe+0x254/0xae0
[ 112.034333][ T5318] __driver_probe_device+0x1e8/0x360
[ 112.037659][ T5318] driver_probe_device+0x4f/0x240
[ 112.040348][ T5318] page last free pid 9 tgid 9 stack trace:
[ 112.043312][ T5318] __free_frozen_pages+0xc1e/0xd10
[ 112.045906][ T5318] kasan_depopulate_vmalloc_pte+0x6d/0x90
[ 112.048937][ T5318] __apply_to_page_range+0xbd8/0x1420
[ 112.051923][ T5318] __kasan_release_vmalloc+0xa2/0xd0
[ 112.055042][ T5318] purge_vmap_node+0x220/0x960
[ 112.057626][ T5318] __purge_vmap_area_lazy+0x783/0xb40
[ 112.060374][ T5318] drain_vmap_area_work+0x27/0x40
[ 112.063011][ T5318] process_scheduled_works+0xa8e/0x14e0
[ 112.065991][ T5318] worker_thread+0xa47/0xfb0
[ 112.069003][ T5318] kthread+0x388/0x470
[ 112.070964][ T5318] ret_from_fork+0x514/0xb70
[ 112.073305][ T5318] ret_from_fork_asm+0x1a/0x30
[ 112.075807][ T5318]
[ 112.077239][ T5318] Memory state around the buggy address:
[ 112.080793][ T5318] ffff88803341fe80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[ 112.085184][ T5318] ffff88803341ff00: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
[ 112.089399][ T5318] >ffff88803341ff80: 00 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc
[ 112.093710][ T5318] ^
[ 112.096061][ T5318] ffff888033420000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 112.100330][ T5318] ffff888033420080: fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc
[ 112.104470][ T5318] ==================================================================
[ 112.142124][ T5318] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 112.146016][ T5318] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 112.151162][ T5318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 112.156405][ T5318] Call Trace:
[ 112.158174][ T5318]
[ 112.159796][ T5318] vpanic+0x56c/0xa60
[ 112.161889][ T5318] ? __pfx_vpanic+0x10/0x10
[ 112.164408][ T5318] ? __pfx___schedule+0x10/0x10
[ 112.167276][ T5318] panic+0xc5/0xd0
[ 112.169583][ T5318] ? __pfx_panic+0x10/0x10
[ 112.172109][ T5318] ? preempt_schedule_common+0x82/0xd0
[ 112.175020][ T5318] check_panic_on_warn+0x89/0xb0
[ 112.177412][ T5318] end_report+0x73/0x170
[ 112.179865][ T5318] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 112.183261][ T5318] kasan_report_invalid_free+0xfa/0x110
[ 112.186659][ T5318] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 112.189686][ T5318] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 112.192661][ T5318] __kasan_slab_pre_free+0x104/0x120
[ 112.195499][ T5318] kfree+0x173/0x640
[ 112.197617][ T5318] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 112.200797][ T5318] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 112.203890][ T5318] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 112.207241][ T5318] ? down_read+0x2be/0x330
[ 112.209695][ T5318] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 112.212904][ T5318] configfs_write_iter+0x337/0x430
[ 112.215672][ T5318] vfs_write+0x612/0xba0
[ 112.218015][ T5318] ? __pfx_vfs_write+0x10/0x10
[ 112.220638][ T5318] ? __fget_files+0x2a/0x420
[ 112.223185][ T5318] ksys_write+0x150/0x270
[ 112.225701][ T5318] ? __pfx_ksys_write+0x10/0x10
[ 112.228473][ T5318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 112.231531][ T5318] do_syscall_64+0x174/0x580
[ 112.233898][ T5318] ? trace_irq_disable+0x3b/0x140
[ 112.237138][ T5318] ? clear_bhb_loop+0x70/0xc0
[ 112.239584][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 112.242677][ T5318] RIP: 0033:0x7f9cd519e0d9
[ 112.245160][ T5318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 112.255893][ T5318] RSP: 002b:00007f9cd60cafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 112.260237][ T5318] RAX: ffffffffffffffda RBX: 00007f9cd5426090 RCX: 00007f9cd519e0d9
[ 112.264584][ T5318] RDX: 000000000000003b RSI: 0000200000000180 RDI: 0000000000000006
[ 112.269267][ T5318] RBP: 00007f9cd5235024 R08: 0000000000000000 R09: 0000000000000000
[ 112.273200][ T5318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 112.277376][ T5318] R13: 00007f9cd5426128 R14: 00007f9cd5426090 R15: 00007ffd8d620008
[ 112.282142][ T5318]
[ 112.284478][ T5318] Kernel Offset: disabled
[ 112.286927][ T5318] Rebooting in 86400 seconds..