program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000440)="34343130302c3438303039363030302c31b7363430302c3139323030302c3335323830302c3338343030302c370000000000000000", 0x35)
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
[ 93.845640][ T4648] Bluetooth: hci0: command tx timeout
[ 93.996724][ T5324] ==================================================================
[ 94.000132][ T5324] BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.003488][ T5324] Free of addr ffff888013052917 by task syz.0.0/5324
[ 94.006362][ T5324]
[ 94.007454][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.007471][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.007479][ T5324] Call Trace:
[ 94.007486][ T5324]
[ 94.007492][ T5324] dump_stack_lvl+0xe8/0x150
[ 94.007515][ T5324] print_address_description+0x55/0x1e0
[ 94.007533][ T5324] print_report+0x58/0x70
[ 94.007546][ T5324] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.007560][ T5324] kasan_report_invalid_free+0xea/0x110
[ 94.007577][ T5324] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.007591][ T5324] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.007604][ T5324] __kasan_slab_pre_free+0x104/0x120
[ 94.007619][ T5324] kfree+0x173/0x640
[ 94.007629][ T5324] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.007643][ T5324] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.007657][ T5324] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 94.007671][ T5324] ? down_read+0x2be/0x330
[ 94.007685][ T5324] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 94.007699][ T5324] configfs_write_iter+0x337/0x430
[ 94.007718][ T5324] vfs_write+0x612/0xba0
[ 94.007736][ T5324] ? __pfx_vfs_write+0x10/0x10
[ 94.007753][ T5324] ? __fget_files+0x2a/0x420
[ 94.007768][ T5324] ksys_write+0x150/0x270
[ 94.007783][ T5324] ? __pfx_ksys_write+0x10/0x10
[ 94.007800][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.007811][ T5324] do_syscall_64+0x174/0x580
[ 94.007825][ T5324] ? trace_irq_disable+0x3b/0x140
[ 94.007840][ T5324] ? clear_bhb_loop+0x40/0x90
[ 94.007852][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.007863][ T5324] RIP: 0033:0x7f9fd159e019
[ 94.007876][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.007885][ T5324] RSP: 002b:00007f9fd2380fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 94.007899][ T5324] RAX: ffffffffffffffda RBX: 00007f9fd1825fa0 RCX: 00007f9fd159e019
[ 94.007907][ T5324] RDX: 0000000000000035 RSI: 0000200000000440 RDI: 0000000000000003
[ 94.007915][ T5324] RBP: 00007f9fd163500c R08: 0000000000000000 R09: 0000000000000000
[ 94.007922][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.007930][ T5324] R13: 00007f9fd1826038 R14: 00007f9fd1825fa0 R15: 00007ffce09283a8
[ 94.007943][ T5324]
[ 94.007948][ T5324]
[ 94.102173][ T5324] Allocated by task 5324:
[ 94.103908][ T5324] kasan_save_track+0x3e/0x80
[ 94.105857][ T5324] __kasan_kmalloc+0x93/0xb0
[ 94.107699][ T5324] __kmalloc_node_track_caller_noprof+0x4c3/0x730
[ 94.110286][ T5324] kstrdup+0x42/0x100
[ 94.111856][ T5324] f_uac2_opts_p_srate_store+0x11f/0x2b0
[ 94.114215][ T5324] configfs_write_iter+0x337/0x430
[ 94.116162][ T5324] vfs_write+0x612/0xba0
[ 94.117951][ T5324] ksys_write+0x150/0x270
[ 94.119836][ T5324] do_syscall_64+0x174/0x580
[ 94.121892][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.124261][ T5324]
[ 94.125286][ T5324] The buggy address belongs to the object at ffff888013052900
[ 94.125286][ T5324] which belongs to the cache kmalloc-64 of size 64
[ 94.131157][ T5324] The buggy address is located 23 bytes inside of
[ 94.131157][ T5324] 46-byte region [ffff888013052900, ffff88801305292e)
[ 94.136730][ T5324]
[ 94.137828][ T5324] The buggy address belongs to the physical page:
[ 94.141125][ T5324] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13052
[ 94.145246][ T5324] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 94.148021][ T5324] page_type: f5(slab)
[ 94.149751][ T5324] raw: 00fff00000000000 ffff88801b0418c0 dead000000000100 dead000000000122
[ 94.153444][ T5324] raw: 0000000000000000 0000000800200020 00000000f5000000 0000000000000000
[ 94.156429][ T5324] page dumped because: kasan: bad access detected
[ 94.158660][ T5324] page_owner tracks the page as allocated
[ 94.161356][ T5324] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 5284, tgid 5284 (syz-executor), ts 91880315230, free_ts 91860105271
[ 94.168875][ T5324] post_alloc_hook+0x1f9/0x250
[ 94.170793][ T5324] get_page_from_freelist+0x21fa/0x2270
[ 94.173012][ T5324] __alloc_frozen_pages_noprof+0x18d/0x380
[ 94.175345][ T5324] allocate_slab+0x79/0x5e0
[ 94.177198][ T5324] ___slab_alloc+0x16a/0x950
[ 94.179072][ T5324] __kmalloc_flags_noprof+0x347/0x800
[ 94.181201][ T5324] alloc_slab_obj_exts+0x4d/0x170
[ 94.182952][ T5324] __memcg_slab_post_alloc_hook+0x5d3/0xf10
[ 94.184966][ T5324] __kvmalloc_node_noprof+0x61c/0x860
[ 94.186865][ T5324] xt_alloc_table_info+0x40/0xb0
[ 94.188874][ T5324] arpt_register_table+0xe0/0x440
[ 94.191059][ T5324] arptable_filter_table_init+0x41/0x70
[ 94.193478][ T5324] xt_find_table_lock+0x311/0x400
[ 94.195636][ T5324] xt_request_find_table_lock+0x26/0x100
[ 94.198056][ T5324] do_arpt_get_ctl+0x719/0x1190
[ 94.200217][ T5324] nf_getsockopt+0x26e/0x290
[ 94.202192][ T5324] page last free pid 15 tgid 15 stack trace:
[ 94.204685][ T5324] __free_frozen_pages+0xc1e/0xd10
[ 94.207043][ T5324] tlb_remove_table_rcu+0x85/0x100
[ 94.209318][ T5324] rcu_core+0x78b/0x10a0
[ 94.211271][ T5324] handle_softirqs+0x225/0x840
[ 94.213363][ T5324] __irq_exit_rcu+0xca/0x220
[ 94.215411][ T5324] irq_exit_rcu+0x9/0x30
[ 94.217184][ T5324] sysvec_apic_timer_interrupt+0xa6/0xc0
[ 94.219403][ T5324] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 94.221856][ T5324]
[ 94.222900][ T5324] Memory state around the buggy address:
[ 94.225331][ T5324] ffff888013052800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.228683][ T5324] ffff888013052880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.232046][ T5324] >ffff888013052900: 00 00 00 00 00 06 fc fc fc fc fc fc fc fc fc fc
[ 94.235387][ T5324] ^
[ 94.237346][ T5324] ffff888013052980: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 94.240763][ T5324] ffff888013052a00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 94.244139][ T5324] ==================================================================
[ 94.361779][ T5324] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 94.364726][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.368233][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.372610][ T5324] Call Trace:
[ 94.374165][ T5324]
[ 94.375419][ T5324] vpanic+0x56c/0xa60
[ 94.377187][ T5324] ? __pfx_vpanic+0x10/0x10
[ 94.379116][ T5324] ? __pfx___schedule+0x10/0x10
[ 94.381301][ T5324] panic+0xc5/0xd0
[ 94.382951][ T5324] ? __pfx_panic+0x10/0x10
[ 94.384869][ T5324] ? preempt_schedule_common+0x82/0xd0
[ 94.387056][ T5324] check_panic_on_warn+0x89/0xb0
[ 94.388719][ T5324] end_report+0x73/0x170
[ 94.390269][ T5324] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.392461][ T5324] kasan_report_invalid_free+0xfa/0x110
[ 94.394638][ T5324] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.396913][ T5324] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.399099][ T5324] __kasan_slab_pre_free+0x104/0x120
[ 94.400894][ T5324] kfree+0x173/0x640
[ 94.402222][ T5324] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.404107][ T5324] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.405934][ T5324] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 94.407949][ T5324] ? down_read+0x2be/0x330
[ 94.409833][ T5324] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 94.412469][ T5324] configfs_write_iter+0x337/0x430
[ 94.414587][ T5324] vfs_write+0x612/0xba0
[ 94.416253][ T5324] ? __pfx_vfs_write+0x10/0x10
[ 94.418313][ T5324] ? __fget_files+0x2a/0x420
[ 94.420258][ T5324] ksys_write+0x150/0x270
[ 94.421926][ T5324] ? __pfx_ksys_write+0x10/0x10
[ 94.423905][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.426364][ T5324] do_syscall_64+0x174/0x580
[ 94.428141][ T5324] ? trace_irq_disable+0x3b/0x140
[ 94.430303][ T5324] ? clear_bhb_loop+0x40/0x90
[ 94.432288][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.434824][ T5324] RIP: 0033:0x7f9fd159e019
[ 94.436720][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.444501][ T5324] RSP: 002b:00007f9fd2380fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 94.448065][ T5324] RAX: ffffffffffffffda RBX: 00007f9fd1825fa0 RCX: 00007f9fd159e019
[ 94.451476][ T5324] RDX: 0000000000000035 RSI: 0000200000000440 RDI: 0000000000000003
[ 94.454888][ T5324] RBP: 00007f9fd163500c R08: 0000000000000000 R09: 0000000000000000
[ 94.458294][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.462254][ T5324] R13: 00007f9fd1826038 R14: 00007f9fd1825fa0 R15: 00007ffce09283a8
[ 94.465510][ T5324]
[ 94.467224][ T5324] Kernel Offset: disabled
[ 94.469446][ T5324] Rebooting in 86400 seconds..