program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000040)="34343130302c34383030302c38383230302c19363030302c31f39abd37363430302c3139323030302c3335323830", 0x1b)
symlinkat(&(0x7f0000000580)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./myconfig/usb_gadget/g1/UDC\x00', 0x1, 0x0)
r2 = socket$inet_sctp(0x2, 0x1, 0x84)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000040)={0x84, @dev={0xac, 0x14, 0x14, 0xb}, 0x815, 0x3, 'none\x00', 0x1, 0x1, 0x72}, 0x2c)
r3 = socket$inet_sctp(0x2, 0x1, 0x84)
r4 = socket$inet_sctp(0x2, 0x1, 0x84)
setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000000)={{0x84, @broadcast, 0x4e21, 0x3, 'fo\x00', 0x11, 0x3240, 0x3a}, {@loopback, 0x4e23, 0x4, 0xc3, 0x12d5c, 0x12d5c}}, 0x44)
setsockopt$IP_VS_SO_SET_DELDEST(r3, 0x0, 0x488, &(0x7f0000000280)={{0x84, @empty, 0x4e20, 0x3, 'lblc\x00', 0x1d, 0x2, 0x2a}, {@loopback, 0x4e23, 0x10000, 0xc24, 0x9, 0xfffffffb}}, 0x44)
write(r1, &(0x7f0000000640)='usbip-vudc.0', 0xc)
[ 93.039776][ T4648] Bluetooth: hci0: command tx timeout
[ 93.054729][ T939] cfg80211: failed to load regulatory.db
[ 93.135467][ T5321] ==================================================================
[ 93.138827][ T5321] BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x225/0x2b0
[ 93.142245][ T5321] Free of addr ffff8880441d1e98 by task syz.0.0/5321
[ 93.145025][ T5321]
[ 93.146132][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 93.146142][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 93.146147][ T5321] Call Trace:
[ 93.146151][ T5321]
[ 93.146155][ T5321] dump_stack_lvl+0xe8/0x150
[ 93.146170][ T5321] print_address_description+0x55/0x1e0
[ 93.146180][ T5321] print_report+0x58/0x70
[ 93.146189][ T5321] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 93.146199][ T5321] kasan_report_invalid_free+0xea/0x110
[ 93.146210][ T5321] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 93.146218][ T5321] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 93.146226][ T5321] __kasan_slab_pre_free+0x104/0x120
[ 93.146235][ T5321] kfree+0x173/0x640
[ 93.146241][ T5321] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 93.146249][ T5321] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 93.146257][ T5321] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 93.146265][ T5321] ? down_read+0x2be/0x330
[ 93.146273][ T5321] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 93.146280][ T5321] configfs_write_iter+0x337/0x430
[ 93.146290][ T5321] vfs_write+0x612/0xba0
[ 93.146301][ T5321] ? __pfx_vfs_write+0x10/0x10
[ 93.146311][ T5321] ? __fget_files+0x2a/0x420
[ 93.146324][ T5321] ksys_write+0x150/0x270
[ 93.146338][ T5321] ? __pfx_ksys_write+0x10/0x10
[ 93.146353][ T5321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.146364][ T5321] do_syscall_64+0x174/0x580
[ 93.146375][ T5321] ? trace_irq_disable+0x3b/0x140
[ 93.146389][ T5321] ? clear_bhb_loop+0x40/0x90
[ 93.146401][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.146412][ T5321] RIP: 0033:0x7f9aca99de99
[ 93.146424][ T5321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 93.146432][ T5321] RSP: 002b:00007f9acb784fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 93.146445][ T5321] RAX: ffffffffffffffda RBX: 00007f9acac25fa0 RCX: 00007f9aca99de99
[ 93.146452][ T5321] RDX: 000000000000001b RSI: 0000200000000040 RDI: 0000000000000003
[ 93.146460][ T5321] RBP: 00007f9acaa33eaf R08: 0000000000000000 R09: 0000000000000000
[ 93.146466][ T5321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 93.146472][ T5321] R13: 00007f9acac26038 R14: 00007f9acac25fa0 R15: 00007ffc43c0a108
[ 93.146484][ T5321]
[ 93.146488][ T5321]
[ 93.242630][ T5321] Allocated by task 5321:
[ 93.244432][ T5321] kasan_save_track+0x3e/0x80
[ 93.246483][ T5321] __kasan_kmalloc+0x93/0xb0
[ 93.248490][ T5321] __kmalloc_node_track_caller_noprof+0x4c3/0x730
[ 93.251270][ T5321] kstrdup+0x42/0x100
[ 93.252890][ T5321] f_uac2_opts_p_srate_store+0x11f/0x2b0
[ 93.255295][ T5321] configfs_write_iter+0x337/0x430
[ 93.257525][ T5321] vfs_write+0x612/0xba0
[ 93.259349][ T5321] ksys_write+0x150/0x270
[ 93.261248][ T5321] do_syscall_64+0x174/0x580
[ 93.263345][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.266005][ T5321]
[ 93.267078][ T5321] The buggy address belongs to the object at ffff8880441d1e80
[ 93.267078][ T5321] which belongs to the cache kmalloc-32 of size 32
[ 93.272885][ T5321] The buggy address is located 24 bytes inside of
[ 93.272885][ T5321] 28-byte region [ffff8880441d1e80, ffff8880441d1e9c)
[ 93.279126][ T5321]
[ 93.280383][ T5321] The buggy address belongs to the physical page:
[ 93.283134][ T5321] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x441d1
[ 93.286811][ T5321] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 93.289531][ T5321] page_type: f5(slab)
[ 93.291096][ T5321] raw: 04fff00000000000 ffff88801b041780 dead000000000100 dead000000000122
[ 93.294357][ T5321] raw: 0000000000000000 0000000800400040 00000000f5000000 0000000000000000
[ 93.297613][ T5321] page dumped because: kasan: bad access detected
[ 93.300092][ T5321] page_owner tracks the page as allocated
[ 93.302336][ T5321] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4994, tgid 4994 (dhcpcd), ts 67971713242, free_ts 67012635096
[ 93.310515][ T5321] post_alloc_hook+0x1f9/0x250
[ 93.312432][ T5321] get_page_from_freelist+0x21fa/0x2270
[ 93.314877][ T5321] __alloc_frozen_pages_noprof+0x18d/0x380
[ 93.317354][ T5321] allocate_slab+0x79/0x5e0
[ 93.319093][ T5321] refill_objects+0x2d5/0x350
[ 93.321136][ T5321] __pcs_replace_empty_main+0x2bf/0x6b0
[ 93.323502][ T5321] __kmalloc_noprof+0x485/0x720
[ 93.325559][ T5321] security_sk_alloc+0x52/0x360
[ 93.327689][ T5321] sk_prot_alloc+0x101/0x210
[ 93.329757][ T5321] sk_alloc+0x3a/0x390
[ 93.331591][ T5321] unix_create1+0xb0/0x7c0
[ 93.333640][ T5321] unix_create+0x14c/0x1d0
[ 93.335630][ T5321] __sock_create+0x4b3/0x9d0
[ 93.337723][ T5321] __sys_socketpair+0x239/0x560
[ 93.339978][ T5321] __x64_sys_socketpair+0x9b/0xb0
[ 93.342212][ T5321] do_syscall_64+0x174/0x580
[ 93.344253][ T5321] page last free pid 15 tgid 15 stack trace:
[ 93.346860][ T5321] __free_frozen_pages+0xc1e/0xd10
[ 93.348803][ T5321] tlb_remove_table_rcu+0x85/0x100
[ 93.350843][ T5321] rcu_core+0x78b/0x10a0
[ 93.352643][ T5321] handle_softirqs+0x225/0x840
[ 93.354739][ T5321] run_ksoftirqd+0x36/0x60
[ 93.356691][ T5321] smpboot_thread_fn+0x57c/0xa80
[ 93.358897][ T5321] kthread+0x388/0x470
[ 93.360643][ T5321] ret_from_fork+0x514/0xb70
[ 93.362630][ T5321] ret_from_fork_asm+0x1a/0x30
[ 93.364730][ T5321]
[ 93.365859][ T5321] Memory state around the buggy address:
[ 93.368284][ T5321] ffff8880441d1d80: fa fb fb fb fc fc fc fc 00 00 00 00 fc fc fc fc
[ 93.371603][ T5321] ffff8880441d1e00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[ 93.374853][ T5321] >ffff8880441d1e80: 00 00 00 04 fc fc fc fc fa fb fb fb fc fc fc fc
[ 93.378135][ T5321] ^
[ 93.380046][ T5321] ffff8880441d1f00: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc
[ 93.383253][ T5321] ffff8880441d1f80: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc
[ 93.386634][ T5321] ==================================================================
[ 93.430376][ T5321] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 93.433057][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 93.436481][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 93.440346][ T5321] Call Trace:
[ 93.441699][ T5321]
[ 93.442864][ T5321] vpanic+0x56c/0xa60
[ 93.444318][ T5321] ? __pfx_vpanic+0x10/0x10
[ 93.445919][ T5321] ? __pfx___schedule+0x10/0x10
[ 93.447671][ T5321] panic+0xc5/0xd0
[ 93.448980][ T5321] ? __pfx_panic+0x10/0x10
[ 93.450567][ T5321] ? preempt_schedule_common+0x82/0xd0
[ 93.452383][ T5321] check_panic_on_warn+0x89/0xb0
[ 93.454082][ T5321] end_report+0x73/0x170
[ 93.455460][ T5321] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 93.457438][ T5321] kasan_report_invalid_free+0xfa/0x110
[ 93.459366][ T5321] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 93.461435][ T5321] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 93.463721][ T5321] __kasan_slab_pre_free+0x104/0x120
[ 93.465829][ T5321] kfree+0x173/0x640
[ 93.467380][ T5321] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 93.469720][ T5321] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 93.471986][ T5321] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 93.474481][ T5321] ? down_read+0x2be/0x330
[ 93.476314][ T5321] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 93.478860][ T5321] configfs_write_iter+0x337/0x430
[ 93.481065][ T5321] vfs_write+0x612/0xba0
[ 93.482729][ T5321] ? __pfx_vfs_write+0x10/0x10
[ 93.484678][ T5321] ? __fget_files+0x2a/0x420
[ 93.486667][ T5321] ksys_write+0x150/0x270
[ 93.488542][ T5321] ? __pfx_ksys_write+0x10/0x10
[ 93.490621][ T5321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.493086][ T5321] do_syscall_64+0x174/0x580
[ 93.495083][ T5321] ? trace_irq_disable+0x3b/0x140
[ 93.497256][ T5321] ? clear_bhb_loop+0x40/0x90
[ 93.499301][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.501921][ T5321] RIP: 0033:0x7f9aca99de99
[ 93.503824][ T5321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 93.511802][ T5321] RSP: 002b:00007f9acb784fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 93.515091][ T5321] RAX: ffffffffffffffda RBX: 00007f9acac25fa0 RCX: 00007f9aca99de99
[ 93.518291][ T5321] RDX: 000000000000001b RSI: 0000200000000040 RDI: 0000000000000003
[ 93.521663][ T5321] RBP: 00007f9acaa33eaf R08: 0000000000000000 R09: 0000000000000000
[ 93.525053][ T5321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 93.528501][ T5321] R13: 00007f9acac26038 R14: 00007f9acac25fa0 R15: 00007ffc43c0a108
[ 93.532011][ T5321]
[ 93.533811][ T5321] Kernel Offset: disabled
[ 93.535786][ T5321] Rebooting in 86400 seconds..