program:
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x801)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/i2c-dev/i2c-0/device/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='usb3503 0x08\n\x00', 0xd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r2, &(0x7f00000002c0)="34347130302c343827d0270430302c38383230302c39361375c266180adac00fc4fd21d4603000"/52, 0x34)
openat(r3, &(0x7f0000000180)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x48000, 0x100)
symlinkat(&(0x7f0000000500)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./myconfig/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r4, &(0x7f00000005c0)='usbip-vudc.0', 0xc)
ioctl$DRM_IOCTL_MODE_CURSOR2(r1, 0xc02464bb, &(0x7f0000000080)={0x0, 0x0, 0x6, 0x5, 0x1, 0x0, 0x7ff, 0x8001, 0x3})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
mbind(&(0x7f0000a47000/0x3000)=nil, 0x3000, 0x8000, 0x0, 0x4, 0x2)
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xa, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x5, 0x73, 0x11, 0x22}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @jmp={0x5, 0x0, 0x2, 0x2, 0x3, 0xffffffffffffffe0, 0x8}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000040)='GPL\x00', 0x8, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x94)
[ 93.471915][ T4653] Bluetooth: hci0: command tx timeout
[ 93.577880][ T10] cfg80211: failed to load regulatory.db
[ 93.731283][ T5333] ==================================================================
[ 93.734829][ T5333] BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x225/0x2b0
[ 93.738731][ T5333] Free of addr ffff88801fb20e06 by task syz.0.0/5333
[ 93.743231][ T5333]
[ 93.744566][ T5333] CPU: 0 UID: 0 PID: 5333 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 93.744588][ T5333] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 93.744599][ T5333] Call Trace:
[ 93.744609][ T5333]
[ 93.744618][ T5333] dump_stack_lvl+0xe8/0x150
[ 93.744647][ T5333] print_address_description+0x55/0x1e0
[ 93.744670][ T5333] print_report+0x58/0x70
[ 93.744685][ T5333] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 93.744701][ T5333] kasan_report_invalid_free+0xea/0x110
[ 93.744724][ T5333] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 93.744741][ T5333] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 93.744756][ T5333] __kasan_slab_pre_free+0x104/0x120
[ 93.744773][ T5333] kfree+0x173/0x640
[ 93.744787][ T5333] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 93.744804][ T5333] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 93.744820][ T5333] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 93.744837][ T5333] ? down_read+0x2be/0x330
[ 93.744855][ T5333] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 93.744870][ T5333] configfs_write_iter+0x337/0x430
[ 93.744889][ T5333] vfs_write+0x612/0xba0
[ 93.744909][ T5333] ? __pfx_vfs_write+0x10/0x10
[ 93.744930][ T5333] ? __fget_files+0x2a/0x420
[ 93.744947][ T5333] ksys_write+0x150/0x270
[ 93.744964][ T5333] ? __pfx_ksys_write+0x10/0x10
[ 93.744983][ T5333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.744996][ T5333] do_syscall_64+0x174/0x580
[ 93.745012][ T5333] ? trace_irq_disable+0x3b/0x140
[ 93.745029][ T5333] ? clear_bhb_loop+0x40/0x90
[ 93.745044][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.745056][ T5333] RIP: 0033:0x7f1a4079e019
[ 93.745071][ T5333] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 93.745081][ T5333] RSP: 002b:00007f1a41608fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 93.745098][ T5333] RAX: ffffffffffffffda RBX: 00007f1a40a25fa0 RCX: 00007f1a4079e019
[ 93.745107][ T5333] RDX: 0000000000000034 RSI: 00002000000002c0 RDI: 0000000000000004
[ 93.745117][ T5333] RBP: 00007f1a4083500c R08: 0000000000000000 R09: 0000000000000000
[ 93.745134][ T5333] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 93.745142][ T5333] R13: 00007f1a40a26038 R14: 00007f1a40a25fa0 R15: 00007ffca01bc3e8
[ 93.745157][ T5333]
[ 93.745162][ T5333]
[ 93.851907][ T5333] Allocated by task 5333:
[ 93.853849][ T5333] kasan_save_track+0x3e/0x80
[ 93.855882][ T5333] __kasan_kmalloc+0x93/0xb0
[ 93.857943][ T5333] __kmalloc_node_track_caller_noprof+0x4c3/0x730
[ 93.860624][ T5333] kstrdup+0x42/0x100
[ 93.862283][ T5333] f_uac2_opts_p_srate_store+0x11f/0x2b0
[ 93.864561][ T5333] configfs_write_iter+0x337/0x430
[ 93.866736][ T5333] vfs_write+0x612/0xba0
[ 93.868480][ T5333] ksys_write+0x150/0x270
[ 93.870315][ T5333] do_syscall_64+0x174/0x580
[ 93.872232][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.874689][ T5333]
[ 93.875741][ T5333] The buggy address belongs to the object at ffff88801fb20e00
[ 93.875741][ T5333] which belongs to the cache kmalloc-64 of size 64
[ 93.881463][ T5333] The buggy address is located 6 bytes inside of
[ 93.881463][ T5333] 39-byte region [ffff88801fb20e00, ffff88801fb20e27)
[ 93.886605][ T5333]
[ 93.887620][ T5333] The buggy address belongs to the physical page:
[ 93.890212][ T5333] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1fb20
[ 93.893741][ T5333] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 93.896759][ T5333] page_type: f5(slab)
[ 93.898416][ T5333] raw: 00fff00000000000 ffff88801b0418c0 dead000000000100 dead000000000122
[ 93.901900][ T5333] raw: 0000000000000000 0000000800200020 00000000f5000000 0000000000000000
[ 93.905514][ T5333] page dumped because: kasan: bad access detected
[ 93.908101][ T5333] page_owner tracks the page as allocated
[ 93.910382][ T5333] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 5289, tgid 5289 (syz-executor), ts 91614031546, free_ts 91567698732
[ 93.918320][ T5333] post_alloc_hook+0x1f9/0x250
[ 93.920123][ T5333] get_page_from_freelist+0x21fa/0x2270
[ 93.922246][ T5333] __alloc_frozen_pages_noprof+0x18d/0x380
[ 93.924499][ T5333] allocate_slab+0x79/0x5e0
[ 93.926376][ T5333] ___slab_alloc+0x16a/0x950
[ 93.928279][ T5333] __kmalloc_flags_noprof+0x347/0x800
[ 93.930636][ T5333] alloc_slab_obj_exts+0x4d/0x170
[ 93.933209][ T5333] __memcg_slab_post_alloc_hook+0x5d3/0xf10
[ 93.935892][ T5333] __kvmalloc_node_noprof+0x61c/0x860
[ 93.938143][ T5333] xt_alloc_table_info+0x40/0xb0
[ 93.940345][ T5333] ip6t_register_table+0xcd/0x320
[ 93.942665][ T5333] ip6table_nat_table_init+0x42/0x300
[ 93.945049][ T5333] xt_find_table_lock+0x311/0x400
[ 93.947492][ T5333] xt_request_find_table_lock+0x26/0x100
[ 93.950519][ T5333] do_ip6t_get_ctl+0x77b/0x12f0
[ 93.952940][ T5333] nf_getsockopt+0x26e/0x290
[ 93.955070][ T5333] page last free pid 69 tgid 69 stack trace:
[ 93.958761][ T5333] free_unref_folios+0xd84/0x14a0
[ 93.962217][ T5333] shrink_folio_list+0x4b16/0x5330
[ 93.964644][ T5333] evict_folios+0x3821/0x49e0
[ 93.966778][ T5333] try_to_shrink_lruvec+0xb4f/0xed0
[ 93.969113][ T5333] shrink_one+0x233/0x730
[ 93.971101][ T5333] shrink_node+0x3303/0x3b60
[ 93.973946][ T5333] kswapd+0x17b6/0x31c0
[ 93.977166][ T5333] kthread+0x388/0x470
[ 93.980368][ T5333] ret_from_fork+0x514/0xb70
[ 93.983552][ T5333] ret_from_fork_asm+0x1a/0x30
[ 93.986453][ T5333]
[ 93.988061][ T5333] Memory state around the buggy address:
[ 93.992278][ T5333] ffff88801fb20d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 93.997172][ T5333] ffff88801fb20d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.000541][ T5333] >ffff88801fb20e00: 00 00 00 00 07 fc fc fc fc fc fc fc fc fc fc fc
[ 94.004543][ T5333] ^
[ 94.007083][ T5333] ffff88801fb20e80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 94.011306][ T5333] ffff88801fb20f00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 94.015126][ T5333] ==================================================================
[ 94.046444][ T5334] Need at least one configuration in g1.
[ 94.051798][ T5334] udc usbip-vudc.0: failed to start g1: -22
[ 94.055098][ T5334] configfs-gadget.g1 gadget.1: probe with driver configfs-gadget.g1 failed with error -22
[ 94.064421][ T5334] UDC core: g1: couldn't find an available UDC or it's busy
[ 94.075023][ T5333] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 94.078101][ T5333] CPU: 0 UID: 0 PID: 5333 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.081720][ T5333] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.085861][ T5333] Call Trace:
[ 94.087432][ T5333]
[ 94.088821][ T5333] vpanic+0x56c/0xa60
[ 94.090598][ T5333] ? __pfx_vpanic+0x10/0x10
[ 94.092571][ T5333] ? __pfx___schedule+0x10/0x10
[ 94.094663][ T5333] panic+0xc5/0xd0
[ 94.096227][ T5333] ? __pfx_panic+0x10/0x10
[ 94.098096][ T5333] ? preempt_schedule_common+0x82/0xd0
[ 94.100328][ T5333] check_panic_on_warn+0x89/0xb0
[ 94.102432][ T5333] end_report+0x73/0x170
[ 94.104342][ T5333] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.106904][ T5333] kasan_report_invalid_free+0xfa/0x110
[ 94.109208][ T5333] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.111515][ T5333] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.113715][ T5333] __kasan_slab_pre_free+0x104/0x120
[ 94.115642][ T5333] kfree+0x173/0x640
[ 94.117171][ T5333] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.119408][ T5333] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 94.121602][ T5333] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 94.124126][ T5333] ? down_read+0x2be/0x330
[ 94.126057][ T5333] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 94.128567][ T5333] configfs_write_iter+0x337/0x430
[ 94.130699][ T5333] vfs_write+0x612/0xba0
[ 94.132528][ T5333] ? __pfx_vfs_write+0x10/0x10
[ 94.134546][ T5333] ? __fget_files+0x2a/0x420
[ 94.136472][ T5333] ksys_write+0x150/0x270
[ 94.138296][ T5333] ? __pfx_ksys_write+0x10/0x10
[ 94.140370][ T5333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.142933][ T5333] do_syscall_64+0x174/0x580
[ 94.144899][ T5333] ? trace_irq_disable+0x3b/0x140
[ 94.146971][ T5333] ? clear_bhb_loop+0x40/0x90
[ 94.148918][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.151346][ T5333] RIP: 0033:0x7f1a4079e019
[ 94.153224][ T5333] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.160747][ T5333] RSP: 002b:00007f1a41608fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 94.164036][ T5333] RAX: ffffffffffffffda RBX: 00007f1a40a25fa0 RCX: 00007f1a4079e019
[ 94.167294][ T5333] RDX: 0000000000000034 RSI: 00002000000002c0 RDI: 0000000000000004
[ 94.170405][ T5333] RBP: 00007f1a4083500c R08: 0000000000000000 R09: 0000000000000000
[ 94.173487][ T5333] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.176322][ T5333] R13: 00007f1a40a26038 R14: 00007f1a40a25fa0 R15: 00007ffca01bc3e8
[ 94.179209][ T5333]
[ 94.180732][ T5333] Kernel Offset: disabled
[ 94.182243][ T5333] Rebooting in 86400 seconds..