program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x0)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r0, &(0x7f00000004c0)='44100,48000,88200,9', 0x13)
symlinkat(&(0x7f0000000080)='./myconfig\x00', r0, &(0x7f00000000c0)='./myconfig/usb_gadget/g1/file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./myconfig/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)="893e917b921a544123741c7996fcf85a7ae61c089d6038fec80aa911df6ba0d66efc893d6edf606586bbdf2e34d04a5a3ab074325ccfb95bf05ed34d46f402d52b2c6523a76787e8b6b8621068833610a4c8ec66d1beb2d47b82b24f2f062f4d25a026e9d0b881a388daaa4cdbfda0bd01ca0882f7530c37c7cd8195c2d82e62e6be59115b18c7e2a67bf90f57526f35fb61af46f78662190c58a93856c6a5e36d3a6a73067f7a1b0fe771c2fa5b9fe128264863a984c14cbce811c462dbbaef3d2f9f5cd52ccd0a16e53fbf83a2f3030775fe72e7729af324d078c8b80866690ebe94bb019bdd186b4a9c2cd4f34e9fa56fef6dae872621041c7a27", 0xfc)
open$dir(&(0x7f0000000000)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00', 0x8000, 0xa)
write(r1, &(0x7f00000005c0)='usbip-vudc.0', 0xc)
[ 87.322700][ T5278] Bluetooth: hci0: command tx timeout
[ 87.408585][ T5313] ==================================================================
[ 87.413095][ T5313] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0
[ 87.416540][ T5313] Free of addr ffff888043ff8a42 by task syz.0.0/5313
[ 87.419340][ T5313]
[ 87.420415][ T5313] CPU: 0 UID: 0 PID: 5313 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 87.420429][ T5313] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 87.420437][ T5313] Call Trace:
[ 87.420445][ T5313]
[ 87.420450][ T5313] dump_stack_lvl+0xe8/0x150
[ 87.420471][ T5313] print_address_description+0x55/0x1e0
[ 87.420486][ T5313] print_report+0x58/0x70
[ 87.420498][ T5313] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 87.420519][ T5313] kasan_report_invalid_free+0xea/0x110
[ 87.420535][ T5313] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 87.420549][ T5313] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 87.420562][ T5313] __kasan_slab_pre_free+0x104/0x120
[ 87.420576][ T5313] kfree+0x173/0x640
[ 87.420585][ T5313] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 87.420598][ T5313] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 87.420612][ T5313] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 87.420627][ T5313] ? down_read+0x2be/0x330
[ 87.420643][ T5313] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 87.420655][ T5313] configfs_write_iter+0x337/0x430
[ 87.420668][ T5313] vfs_write+0x612/0xba0
[ 87.420689][ T5313] ? __pfx_vfs_write+0x10/0x10
[ 87.420706][ T5313] ? __fget_files+0x2a/0x420
[ 87.420722][ T5313] ksys_write+0x150/0x270
[ 87.420731][ T5313] ? __pfx_ksys_write+0x10/0x10
[ 87.420749][ T5313] do_syscall_64+0x166/0x520
[ 87.420762][ T5313] ? trace_irq_disable+0x3b/0x140
[ 87.420776][ T5313] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.420787][ T5313] ? clear_bhb_loop+0x70/0xc0
[ 87.420798][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.420809][ T5313] RIP: 0033:0x7fb1b519e0d9
[ 87.420821][ T5313] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 87.420831][ T5313] RSP: 002b:00007fb1b15f4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 87.420844][ T5313] RAX: ffffffffffffffda RBX: 00007fb1b5425fa0 RCX: 00007fb1b519e0d9
[ 87.420851][ T5313] RDX: 00000000000000fc RSI: 0000200000000280 RDI: 0000000000000003
[ 87.420857][ T5313] RBP: 00007fb1b5235024 R08: 0000000000000000 R09: 0000000000000000
[ 87.420864][ T5313] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 87.420870][ T5313] R13: 00007fb1b5426038 R14: 00007fb1b5425fa0 R15: 00007ffdbd2b10e8
[ 87.420881][ T5313]
[ 87.420885][ T5313]
[ 87.517629][ T5313] Allocated by task 5313:
[ 87.519364][ T5313] kasan_save_track+0x3e/0x80
[ 87.521308][ T5313] __kasan_kmalloc+0x93/0xb0
[ 87.523199][ T5313] __kmalloc_node_track_caller_noprof+0x4c7/0x740
[ 87.525868][ T5313] kstrdup+0x42/0x100
[ 87.527600][ T5313] f_uac2_opts_c_srate_store+0x11f/0x2b0
[ 87.529794][ T5313] configfs_write_iter+0x337/0x430
[ 87.531889][ T5313] vfs_write+0x612/0xba0
[ 87.533669][ T5313] ksys_write+0x150/0x270
[ 87.535470][ T5313] do_syscall_64+0x166/0x520
[ 87.537438][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.540069][ T5313]
[ 87.541143][ T5313] The buggy address belongs to the object at ffff888043ff8a00
[ 87.541143][ T5313] which belongs to the cache kmalloc-256 of size 256
[ 87.547815][ T5313] The buggy address is located 66 bytes inside of
[ 87.547815][ T5313] 253-byte region [ffff888043ff8a00, ffff888043ff8afd)
[ 87.553892][ T5313]
[ 87.554967][ T5313] The buggy address belongs to the physical page:
[ 87.557646][ T5313] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x43ff8
[ 87.561070][ T5313] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 87.564220][ T5313] page_type: f5(slab)
[ 87.566002][ T5313] raw: 04fff00000000000 ffff88801b041b40 dead000000000122 0000000000000000
[ 87.569723][ T5313] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[ 87.573359][ T5313] page dumped because: kasan: bad access detected
[ 87.576116][ T5313] page_owner tracks the page as allocated
[ 87.578429][ T5313] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5277, tgid 5277 (syz-executor), ts 85316499503
[ 87.586084][ T5313] post_alloc_hook+0x1f9/0x250
[ 87.588215][ T5313] get_page_from_freelist+0x2209/0x2280
[ 87.590619][ T5313] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 87.593199][ T5313] allocate_slab+0x7c/0x5e0
[ 87.595230][ T5313] refill_objects+0x2d5/0x350
[ 87.596873][ T5313] __pcs_replace_empty_main+0x2c3/0x6b0
[ 87.598928][ T5313] __kmalloc_noprof+0x489/0x720
[ 87.600799][ T5313] __list_lru_init+0xba/0x5d0
[ 87.602909][ T5313] sget_fc+0xf41/0x1a40
[ 87.604684][ T5313] get_tree_nodev+0x2a/0x150
[ 87.606691][ T5313] vfs_get_tree+0x92/0x2a0
[ 87.608681][ T5313] do_new_mount+0x319/0xdc0
[ 87.610701][ T5313] __se_sys_mount+0x31d/0x420
[ 87.612753][ T5313] do_syscall_64+0x166/0x520
[ 87.614738][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.617334][ T5313] page last free pid 5310 tgid 5310 ts 84829149370 stack trace:
[ 87.620534][ T5313] __free_frozen_pages+0xc93/0xd90
[ 87.622731][ T5313] __slab_free+0x274/0x2c0
[ 87.624676][ T5313] qlist_free_all+0x99/0x100
[ 87.626794][ T5313] kasan_quarantine_reduce+0x148/0x160
[ 87.629212][ T5313] __kasan_slab_alloc+0x22/0x80
[ 87.631439][ T5313] kmem_cache_alloc_noprof+0x2a4/0x5f0
[ 87.633906][ T5313] vm_area_dup+0x28/0x670
[ 87.635756][ T5313] __split_vma+0x1f3/0xbf0
[ 87.637412][ T5313] vms_gather_munmap_vmas+0x322/0x1370
[ 87.639559][ T5313] mmap_region+0x8f9/0x2230
[ 87.641353][ T5313] do_mmap+0xe0a/0x1300
[ 87.642959][ T5313] vm_mmap_pgoff+0x272/0x4e0
[ 87.644793][ T5313] ksys_mmap_pgoff+0x4dc/0x760
[ 87.646706][ T5313] do_syscall_64+0x166/0x520
[ 87.648614][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.651194][ T5313]
[ 87.652286][ T5313] Memory state around the buggy address:
[ 87.654721][ T5313] ffff888043ff8900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 87.658169][ T5313] ffff888043ff8980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 87.661520][ T5313] >ffff888043ff8a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 87.664925][ T5313] ^
[ 87.667604][ T5313] ffff888043ff8a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05
[ 87.671070][ T5313] ffff888043ff8b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 87.674381][ T5313] ==================================================================
[ 87.701160][ T5314] Config c/1 of g1 needs at least one function.
[ 87.706481][ T5314] udc usbip-vudc.0: failed to start g1: -22
[ 87.708778][ T5314] configfs-gadget.g1 gadget.1: probe with driver configfs-gadget.g1 failed with error -22
[ 87.720340][ T5314] UDC core: g1: couldn't find an available UDC or it's busy
[ 87.734166][ T5313] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 87.737262][ T5313] CPU: 0 UID: 0 PID: 5313 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 87.741047][ T5313] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 87.745228][ T5313] Call Trace:
[ 87.746693][ T5313]
[ 87.747948][ T5313] vpanic+0x56d/0xa60
[ 87.749612][ T5313] ? __pfx_vpanic+0x10/0x10
[ 87.751462][ T5313] ? __pfx___schedule+0x10/0x10
[ 87.753468][ T5313] panic+0xc5/0xd0
[ 87.755006][ T5313] ? __pfx_panic+0x10/0x10
[ 87.756885][ T5313] ? preempt_schedule_common+0x7f/0xd0
[ 87.759239][ T5313] check_panic_on_warn+0x89/0xb0
[ 87.761444][ T5313] end_report+0x73/0x170
[ 87.763367][ T5313] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 87.765797][ T5313] kasan_report_invalid_free+0xfa/0x110
[ 87.767945][ T5313] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 87.770328][ T5313] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 87.772706][ T5313] __kasan_slab_pre_free+0x104/0x120
[ 87.774731][ T5313] kfree+0x173/0x640
[ 87.776334][ T5313] ? f_uac2_opts_c_srate_store+0x225/0x2b0
[ 87.778717][ T5313] f_uac2_opts_c_srate_store+0x225/0x2b0
[ 87.781006][ T5313] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 87.783571][ T5313] ? down_read+0x2be/0x330
[ 87.785427][ T5313] ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[ 87.787945][ T5313] configfs_write_iter+0x337/0x430
[ 87.790053][ T5313] vfs_write+0x612/0xba0
[ 87.791829][ T5313] ? __pfx_vfs_write+0x10/0x10
[ 87.793745][ T5313] ? __fget_files+0x2a/0x420
[ 87.795739][ T5313] ksys_write+0x150/0x270
[ 87.797432][ T5313] ? __pfx_ksys_write+0x10/0x10
[ 87.799401][ T5313] do_syscall_64+0x166/0x520
[ 87.801243][ T5313] ? trace_irq_disable+0x3b/0x140
[ 87.803239][ T5313] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.805555][ T5313] ? clear_bhb_loop+0x70/0xc0
[ 87.807483][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.809842][ T5313] RIP: 0033:0x7fb1b519e0d9
[ 87.811671][ T5313] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 87.819113][ T5313] RSP: 002b:00007fb1b15f4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 87.822486][ T5313] RAX: ffffffffffffffda RBX: 00007fb1b5425fa0 RCX: 00007fb1b519e0d9
[ 87.825525][ T5313] RDX: 00000000000000fc RSI: 0000200000000280 RDI: 0000000000000003
[ 87.828725][ T5313] RBP: 00007fb1b5235024 R08: 0000000000000000 R09: 0000000000000000
[ 87.831962][ T5313] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 87.835145][ T5313] R13: 00007fb1b5426038 R14: 00007fb1b5425fa0 R15: 00007ffdbd2b10e8
[ 87.838331][ T5313]
[ 87.839984][ T5313] Kernel Offset: disabled
[ 87.841766][ T5313] Rebooting in 86400 seconds..