program:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
syz_mount_image$ext4(&(0x7f00000002c0)='ext4\x00', &(0x7f0000000040)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x800700, &(0x7f00000000c0)={[{@journal_ioprio={'journal_ioprio', 0x3d, 0x7}}, {@discard}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x5c}}, {@prjquota}, {@bsdgroups}, {@oldalloc}, {@errors_continue}, {@nobarrier}, {@dax_inode}]}, 0x2, 0x45d, &(0x7f0000000ac0)="$eJzs3M1vFOUfAPDvzLaFH2/tD/EFRG1CDI0vLS2oHLxoNPGA0UQPeKzbQggLNbQmQohUY/BiYoh6Nh5N/Ce8GPVk4lXvhoQoF9BTzczOwHbZLSxddiv7+SQDz7PzdJ/n22eemWfm2W0AA2s8+yeJ2BYRv0XEaD27usB4/b/rV89X/756vprEyspbfyZ5uWtXz1fLouXPbS0yE2lE+klSVLLa4tlzJ2drtfkzRX5q6dR7U4tnzz174tTs8fnj86dnDh8+dHD6hednnutKnFlc1/Z8uLB392vvXHq9evTSuz99l7V3W7G/MY5uGc8C/2sl17zvyW5X1mfbG9LJUB8bQkcqEZF113A+/kejEjc7bzRe/bivjQPuqezatKn97uUV4D6WRL9bAPRHeaHP7n/LrUdTjw3hykv1G6As7uvFVt8zFGlRZrjp/rabxiPi6PI/X2db3KPnEAAAjT6rfnUknmk1/0vjoYZyO4o1lLGI+H9E7IyIByJiV0Q8GJGXfTgiHumw/ualoVvnP+nluwrsDmXzvxeLta3V879y9hdjlSK3PY9/ODl2ojZ/oPidTMTwpiw/vUYd37/y6+ft9jXO/7Itq7+cCxbtuDzU9IBubnZpNp+UdsGVjyL2DLWKP7mxEpBExO6I2NPZW+8oEyee+nZvu0K3j38NXVhnWvkmYn+9/5ejKf5Ssvb65NTmqM0fmCqPilv9/MvFN9vVv674uyDr/y2rj//mImNJ43rtYud1XPz907b3NHd7/I8kb+fno7KjPphdWjozHTGSHMlfHCnK5q/P3PzZMl+Wz+Kf2Nd6/O+MmxU8GhHZQfxYRDweEU8UbS+Pkn1rxP/jy+33bYT+n2t5/rtx/Df1f+eJyskfYnOb+u+s/w/lqYnilfz8dxt32sB1/fIAAADgPyLNPwOfpJM30mk6OVn/DP+u2JLWFhaXnj628P7pufpn5cdiOC2fdI02PA+dTpaLd6znZ4pnxeX+g8Vz4y8r/8vzk9WF2lyfY4dBt7XN+M/8Uel364B7rtU62sxIHxoC9Fzz+E9XZy+80cvGAD3l+9owuG4z/tNetQPoPdd/GFytxv+Fpry1ALg/uf7D4DL+YXAZ/zC4jH8YSOv5Xv8gJco/krpR2tP/RKQbohmdJcor3UZpT/cT+7+oR7juN+znWQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKB7/g0AAP//0TLrKA==")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='config/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x100, 0x1df)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r0, 0x80e8662d, &(0x7f00000004c0)={@id={0x2, 0x0, @b}})
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./tracing\x00', &(0x7f0000000200)='tracefs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracing/events/sched/filter\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='(o', 0x2)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1fb)
syz_emit_ethernet(0x2a, &(0x7f0000000000)=ANY=[@ANYBLOB="0180c2000002bade28b31df708004500001c00680000000190780a012101ac1414bbe000907800000000"], 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='config/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r2, &(0x7f0000000700)="34343130302cc5383030302c38383230302c39363030302331", 0x19)
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')

[   94.158055][ T4639] Bluetooth: hci0: command tx timeout
[   94.247107][ T5316] loop0: detected capacity change from 0 to 512
[   94.348635][ T5315] ==================================================================
[   94.351956][ T5315] BUG: KASAN: invalid-free in f_uac2_opts_c_srate_store+0x225/0x2b0
[   94.355455][ T5315] Free of addr ffff8880438abc8c by task syz.0.0/5315
[   94.358325][ T5315] 
[   94.359407][ T5315] CPU: 0 UID: 0 PID: 5315 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
[   94.359422][ T5315] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   94.359430][ T5315] Call Trace:
[   94.359438][ T5315]  <TASK>
[   94.359444][ T5315]  dump_stack_lvl+0xe8/0x150
[   94.359465][ T5315]  print_address_description+0x55/0x1e0
[   94.359481][ T5315]  print_report+0x58/0x70
[   94.359495][ T5315]  ? f_uac2_opts_c_srate_store+0x225/0x2b0
[   94.359507][ T5315]  kasan_report_invalid_free+0xea/0x110
[   94.359524][ T5315]  ? f_uac2_opts_c_srate_store+0x225/0x2b0
[   94.359537][ T5315]  ? f_uac2_opts_c_srate_store+0x225/0x2b0
[   94.359549][ T5315]  __kasan_slab_pre_free+0x104/0x120
[   94.359563][ T5315]  kfree+0x173/0x640
[   94.359574][ T5315]  ? f_uac2_opts_c_srate_store+0x225/0x2b0
[   94.359611][ T5315]  f_uac2_opts_c_srate_store+0x225/0x2b0
[   94.359626][ T5315]  ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[   94.359638][ T5315]  ? down_read+0x2be/0x330
[   94.359651][ T5315]  ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[   94.359665][ T5315]  configfs_write_iter+0x337/0x430
[   94.359677][ T5315]  vfs_write+0x612/0xba0
[   94.359696][ T5315]  ? __pfx_vfs_write+0x10/0x10
[   94.359713][ T5315]  ? __fget_files+0x2a/0x420
[   94.359729][ T5315]  ksys_write+0x150/0x270
[   94.359745][ T5315]  ? __pfx_ksys_write+0x10/0x10
[   94.359762][ T5315]  do_syscall_64+0x166/0x520
[   94.359773][ T5315]  ? trace_irq_disable+0x3b/0x140
[   94.359787][ T5315]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   94.359798][ T5315]  ? clear_bhb_loop+0x70/0xc0
[   94.359810][ T5315]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   94.359821][ T5315] RIP: 0033:0x7f0cce99e0d9
[   94.359834][ T5315] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[   94.359843][ T5315] RSP: 002b:00007f0ccf910fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[   94.359857][ T5315] RAX: ffffffffffffffda RBX: 00007f0ccec25fa0 RCX: 00007f0cce99e0d9
[   94.359867][ T5315] RDX: 0000000000000019 RSI: 0000200000000700 RDI: 0000000000000004
[   94.359875][ T5315] RBP: 00007f0ccea35024 R08: 0000000000000000 R09: 0000000000000000
[   94.359882][ T5315] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   94.359890][ T5315] R13: 00007f0ccec26038 R14: 00007f0ccec25fa0 R15: 00007ffdd7975ed8
[   94.359902][ T5315]  </TASK>
[   94.359906][ T5315] 
[   94.458129][ T5315] Allocated by task 5315:
[   94.459978][ T5315]  kasan_save_track+0x3e/0x80
[   94.461916][ T5315]  __kasan_kmalloc+0x93/0xb0
[   94.463887][ T5315]  __kmalloc_node_track_caller_noprof+0x4c7/0x740
[   94.466510][ T5315]  kstrdup+0x42/0x100
[   94.468299][ T5315]  f_uac2_opts_c_srate_store+0x11f/0x2b0
[   94.470620][ T5315]  configfs_write_iter+0x337/0x430
[   94.472883][ T5315]  vfs_write+0x612/0xba0
[   94.474749][ T5315]  ksys_write+0x150/0x270
[   94.476755][ T5315]  do_syscall_64+0x166/0x520
[   94.478981][ T5315]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   94.481544][ T5315] 
[   94.482618][ T5315] The buggy address belongs to the object at ffff8880438abc80
[   94.482618][ T5315]  which belongs to the cache kmalloc-32 of size 32
[   94.489115][ T5315] The buggy address is located 12 bytes inside of
[   94.489115][ T5315]  26-byte region [ffff8880438abc80, ffff8880438abc9a)
[   94.495066][ T5315] 
[   94.496094][ T5315] The buggy address belongs to the physical page:
[   94.498708][ T5315] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880438ab840 pfn:0x438ab
[   94.503291][ T5315] flags: 0x4fff00000000200(workingset|node=1|zone=1|lastcpupid=0x7ff)
[   94.507242][ T5315] page_type: f5(slab)
[   94.509155][ T5315] raw: 04fff00000000200 ffff88801b041780 ffff8880304004c8 ffffea0001107f10
[   94.512675][ T5315] raw: ffff8880438ab840 000000080040003f 00000000f5000000 0000000000000000
[   94.516160][ T5315] page dumped because: kasan: bad access detected
[   94.518755][ T5315] page_owner tracks the page as allocated
[   94.520887][ T5315] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5125, tgid 5125 (dhcpcd-run-hook), ts 62672412869, free_ts 62664720834
[   94.528919][ T5315]  post_alloc_hook+0x1f9/0x250
[   94.530923][ T5315]  get_page_from_freelist+0x21fe/0x2270
[   94.533466][ T5315]  __alloc_frozen_pages_noprof+0x18d/0x380
[   94.535913][ T5315]  allocate_slab+0x79/0x5e0
[   94.537753][ T5315]  refill_objects+0x2d5/0x350
[   94.539566][ T5315]  __pcs_replace_empty_main+0x2c3/0x6b0
[   94.541826][ T5315]  __kmalloc_cache_noprof+0x3ab/0x660
[   94.544083][ T5315]  kmem_cache_free+0x156/0x650
[   94.546062][ T5315]  vms_complete_munmap_vmas+0x897/0xbe0
[   94.548460][ T5315]  __mmap_complete+0xab/0x4b0
[   94.550553][ T5315]  mmap_region+0x119f/0x2310
[   94.552602][ T5315]  do_mmap+0xc3b/0x10c0
[   94.554594][ T5315]  vm_mmap_pgoff+0x272/0x4e0
[   94.556617][ T5315]  ksys_mmap_pgoff+0x4dc/0x760
[   94.558669][ T5315]  do_syscall_64+0x166/0x520
[   94.560668][ T5315]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   94.563015][ T5315] page last free pid 15 tgid 15 stack trace:
[   94.565404][ T5315]  __free_frozen_pages+0xc22/0xd20
[   94.567518][ T5315]  tlb_remove_table_rcu+0x85/0x100
[   94.569610][ T5315]  rcu_core+0x794/0x10b0
[   94.571378][ T5315]  handle_softirqs+0x226/0x860
[   94.573451][ T5315]  run_ksoftirqd+0x36/0x60
[   94.575320][ T5315]  smpboot_thread_fn+0x565/0xa70
[   94.577484][ T5315]  kthread+0x38b/0x480
[   94.579240][ T5315]  ret_from_fork+0x514/0xb70
[   94.581160][ T5315]  ret_from_fork_asm+0x1a/0x30
[   94.583248][ T5315] 
[   94.584322][ T5315] Memory state around the buggy address:
[   94.586730][ T5315]  ffff8880438abb80: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc
[   94.589888][ T5315]  ffff8880438abc00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[   94.593322][ T5315] >ffff8880438abc80: 00 00 00 02 fc fc fc fc 00 00 00 fc fc fc fc fc
[   94.596709][ T5315]                       ^
[   94.598567][ T5315]  ffff8880438abd00: 00 00 00 fc fc fc fc fc 00 00 00 fc fc fc fc fc
[   94.601826][ T5315]  ffff8880438abd80: 00 00 00 fc fc fc fc fc 00 00 00 fc fc fc fc fc
[   94.604918][ T5315] ==================================================================
[   94.693454][ T5315] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   94.696511][ T5315] CPU: 0 UID: 0 PID: 5315 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
[   94.700185][ T5315] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   94.704267][ T5315] Call Trace:
[   94.705696][ T5315]  <TASK>
[   94.707013][ T5315]  vpanic+0x56d/0xa60
[   94.708781][ T5315]  ? __pfx_vpanic+0x10/0x10
[   94.710767][ T5315]  ? __pfx___schedule+0x10/0x10
[   94.712886][ T5315]  panic+0xc5/0xd0
[   94.714517][ T5315]  ? __pfx_panic+0x10/0x10
[   94.716489][ T5315]  ? preempt_schedule_common+0x7f/0xd0
[   94.718889][ T5315]  check_panic_on_warn+0x89/0xb0
[   94.721009][ T5315]  end_report+0x73/0x170
[   94.722854][ T5315]  ? f_uac2_opts_c_srate_store+0x225/0x2b0
[   94.725225][ T5315]  kasan_report_invalid_free+0xfa/0x110
[   94.727456][ T5315]  ? f_uac2_opts_c_srate_store+0x225/0x2b0
[   94.729896][ T5315]  ? f_uac2_opts_c_srate_store+0x225/0x2b0
[   94.732424][ T5315]  __kasan_slab_pre_free+0x104/0x120
[   94.734596][ T5315]  kfree+0x173/0x640
[   94.736259][ T5315]  ? f_uac2_opts_c_srate_store+0x225/0x2b0
[   94.738777][ T5315]  f_uac2_opts_c_srate_store+0x225/0x2b0
[   94.741082][ T5315]  ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[   94.743748][ T5315]  ? down_read+0x2be/0x330
[   94.745649][ T5315]  ? __pfx_f_uac2_opts_c_srate_store+0x10/0x10
[   94.748981][ T5315]  configfs_write_iter+0x337/0x430
[   94.751284][ T5315]  vfs_write+0x612/0xba0
[   94.753359][ T5315]  ? __pfx_vfs_write+0x10/0x10
[   94.755394][ T5315]  ? __fget_files+0x2a/0x420
[   94.757297][ T5315]  ksys_write+0x150/0x270
[   94.759081][ T5315]  ? __pfx_ksys_write+0x10/0x10
[   94.761275][ T5315]  do_syscall_64+0x166/0x520
[   94.764124][ T5315]  ? trace_irq_disable+0x3b/0x140
[   94.766292][ T5315]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   94.769021][ T5315]  ? clear_bhb_loop+0x70/0xc0
[   94.771007][ T5315]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   94.773544][ T5315] RIP: 0033:0x7f0cce99e0d9
[   94.775374][ T5315] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[   94.783372][ T5315] RSP: 002b:00007f0ccf910fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[   94.786755][ T5315] RAX: ffffffffffffffda RBX: 00007f0ccec25fa0 RCX: 00007f0cce99e0d9
[   94.789982][ T5315] RDX: 0000000000000019 RSI: 0000200000000700 RDI: 0000000000000004
[   94.793381][ T5315] RBP: 00007f0ccea35024 R08: 0000000000000000 R09: 0000000000000000
[   94.796729][ T5315] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   94.799964][ T5315] R13: 00007f0ccec26038 R14: 00007f0ccec25fa0 R15: 00007ffdd7975ed8
[   94.803307][ T5315]  </TASK>
[   94.805063][ T5315] Kernel Offset: disabled
[   94.806818][ T5315] Rebooting in 86400 seconds..