program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)="34343130302c34383030302c18383230302c4e5703ad20b38834ab2ebad0d7585be812bd8644fc1d6a04457e0705d4da150c8fbfab210a8d69168dcb51a29f17a3824d76a0c9990d6c112f306a62b0883f8d5ff5c104832a0e0d8b2501aaf79f898989f8608f3acf801155547a7337742fcf50d477e9c117ad279a813eaff40ddd3f199ded06451a1496092be17bbb12882c09e8949e2e4bc8203f3b6583a8be98b076b68374fecd28940f4205ded89c7ae083ce092274f2c346d78e3e00b6bed0b51df64a09c6554e1a7bcb61f360db451bc473516c", 0xd6)
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') (async)
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
[ 132.171874][ T5301] Bluetooth: hci0: command tx timeout
[ 132.319042][ T5337] ==================================================================
[ 132.322344][ T5337] BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x225/0x2b0
[ 132.325610][ T5337] Free of addr ffff888012c33d12 by task syz.0.0/5337
[ 132.328303][ T5337]
[ 132.329393][ T5337] CPU: 0 UID: 0 PID: 5337 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 132.329408][ T5337] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 132.329414][ T5337] Call Trace:
[ 132.329428][ T5337]
[ 132.329434][ T5337] dump_stack_lvl+0xe8/0x150
[ 132.329455][ T5337] print_address_description+0x55/0x1e0
[ 132.329470][ T5337] print_report+0x58/0x70
[ 132.329483][ T5337] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 132.329497][ T5337] kasan_report_invalid_free+0xea/0x110
[ 132.329510][ T5337] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 132.329519][ T5337] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 132.329530][ T5337] __kasan_slab_pre_free+0x104/0x120
[ 132.329541][ T5337] kfree+0x173/0x640
[ 132.329551][ T5337] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 132.329564][ T5337] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 132.329578][ T5337] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 132.329593][ T5337] ? down_read+0x2be/0x330
[ 132.329607][ T5337] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 132.329620][ T5337] configfs_write_iter+0x337/0x430
[ 132.329636][ T5337] vfs_write+0x612/0xba0
[ 132.329653][ T5337] ? __pfx_vfs_write+0x10/0x10
[ 132.329669][ T5337] ? __fget_files+0x2a/0x420
[ 132.329685][ T5337] ksys_write+0x150/0x270
[ 132.329700][ T5337] ? __pfx_ksys_write+0x10/0x10
[ 132.329715][ T5337] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 132.329727][ T5337] do_syscall_64+0x174/0x580
[ 132.329740][ T5337] ? trace_irq_disable+0x3b/0x140
[ 132.329754][ T5337] ? clear_bhb_loop+0x40/0x90
[ 132.329766][ T5337] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 132.329777][ T5337] RIP: 0033:0x7f4034d9e019
[ 132.329788][ T5337] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 132.329798][ T5337] RSP: 002b:00007f4035bfafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 132.329811][ T5337] RAX: ffffffffffffffda RBX: 00007f4035025fa0 RCX: 00007f4034d9e019
[ 132.329819][ T5337] RDX: 00000000000000d6 RSI: 0000200000000280 RDI: 0000000000000003
[ 132.329826][ T5337] RBP: 00007f4034e3500c R08: 0000000000000000 R09: 0000000000000000
[ 132.329833][ T5337] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 132.329840][ T5337] R13: 00007f4035026038 R14: 00007f4035025fa0 R15: 00007fff54e0fe58
[ 132.329852][ T5337]
[ 132.329856][ T5337]
[ 132.425774][ T5337] Allocated by task 5337:
[ 132.427579][ T5337] kasan_save_track+0x3e/0x80
[ 132.429613][ T5337] __kasan_kmalloc+0x93/0xb0
[ 132.431554][ T5337] __kmalloc_node_track_caller_noprof+0x4c3/0x730
[ 132.434153][ T5337] kstrdup+0x42/0x100
[ 132.435795][ T5337] f_uac2_opts_p_srate_store+0x11f/0x2b0
[ 132.438024][ T5337] configfs_write_iter+0x337/0x430
[ 132.440010][ T5337] vfs_write+0x612/0xba0
[ 132.441712][ T5337] ksys_write+0x150/0x270
[ 132.443526][ T5337] do_syscall_64+0x174/0x580
[ 132.445419][ T5337] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 132.447840][ T5337]
[ 132.448851][ T5337] The buggy address belongs to the object at ffff888012c33d00
[ 132.448851][ T5337] which belongs to the cache kmalloc-192 of size 192
[ 132.454058][ T5337] The buggy address is located 18 bytes inside of
[ 132.454058][ T5337] 190-byte region [ffff888012c33d00, ffff888012c33dbe)
[ 132.459359][ T5337]
[ 132.460398][ T5337] The buggy address belongs to the physical page:
[ 132.463106][ T5337] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12c33
[ 132.466589][ T5337] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 132.469584][ T5337] page_type: f5(slab)
[ 132.471460][ T5337] raw: 00fff00000000000 ffff88801b0413c0 dead000000000100 dead000000000122
[ 132.475206][ T5337] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
[ 132.478626][ T5337] page dumped because: kasan: bad access detected
[ 132.481283][ T5337] page_owner tracks the page as allocated
[ 132.483657][ T5337] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5300, tgid 5300 (syz-executor), ts 129942587484, free_ts 129897118150
[ 132.491958][ T5337] post_alloc_hook+0x1f9/0x250
[ 132.494108][ T5337] get_page_from_freelist+0x21fa/0x2270
[ 132.496397][ T5337] __alloc_frozen_pages_noprof+0x18d/0x380
[ 132.498822][ T5337] allocate_slab+0x79/0x5e0
[ 132.500721][ T5337] refill_objects+0x2d5/0x350
[ 132.502642][ T5337] __pcs_replace_empty_main+0x2bf/0x6b0
[ 132.505008][ T5337] __kmalloc_node_track_caller_noprof+0x557/0x730
[ 132.507719][ T5337] kmemdup_noprof+0x2b/0x70
[ 132.509623][ T5337] neigh_parms_alloc+0x83/0x500
[ 132.511636][ T5337] inetdev_init+0x117/0x4d0
[ 132.513538][ T5337] inetdev_event+0x307/0x15e0
[ 132.515419][ T5337] notifier_call_chain+0x1a5/0x3d0
[ 132.517526][ T5337] register_netdevice+0x18a4/0x1eb0
[ 132.519734][ T5337] cfg80211_register_netdevice+0x138/0x2d0
[ 132.522207][ T5337] ieee80211_if_add+0x108d/0x1600
[ 132.524456][ T5337] ieee80211_register_hw+0x3e79/0x4a50
[ 132.526798][ T5337] page last free pid 5300 tgid 5300 stack trace:
[ 132.529394][ T5337] __free_frozen_pages+0xc1e/0xd10
[ 132.531496][ T5337] __slab_free+0x274/0x2c0
[ 132.533356][ T5337] qlist_free_all+0x99/0x100
[ 132.535298][ T5337] kasan_quarantine_reduce+0x148/0x160
[ 132.537513][ T5337] __kasan_slab_alloc+0x22/0x80
[ 132.539495][ T5337] kmem_cache_alloc_noprof+0x2a0/0x5f0
[ 132.541718][ T5337] __kernfs_new_node+0xe6/0x980
[ 132.543679][ T5337] kernfs_new_node+0xea/0x140
[ 132.545694][ T5337] kernfs_create_link+0xa7/0x200
[ 132.547808][ T5337] sysfs_do_create_link_sd+0x83/0x110
[ 132.550065][ T5337] device_add_class_symlinks+0x133/0x240
[ 132.552385][ T5337] device_add+0x467/0xb80
[ 132.554148][ T5337] rfkill_register+0x170/0x9b0
[ 132.555995][ T5337] wiphy_register+0x277d/0x2ff0
[ 132.557983][ T5337] ieee80211_register_hw+0x3d3d/0x4a50
[ 132.560276][ T5337] mac80211_hwsim_new_radio+0x3238/0x5680
[ 132.562604][ T5337]
[ 132.563710][ T5337] Memory state around the buggy address:
[ 132.566044][ T5337] ffff888012c33c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 132.569259][ T5337] ffff888012c33c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 132.572426][ T5337] >ffff888012c33d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 132.575677][ T5337] ^
[ 132.577664][ T5337] ffff888012c33d80: 00 00 00 00 00 00 00 06 fc fc fc fc fc fc fc fc
[ 132.581231][ T5337] ffff888012c33e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 132.584402][ T5337] ==================================================================
[ 132.624063][ T5337] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 132.627126][ T5337] CPU: 0 UID: 0 PID: 5337 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 132.630843][ T5337] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 132.634871][ T5337] Call Trace:
[ 132.636193][ T5337]
[ 132.637390][ T5337] vpanic+0x56c/0xa60
[ 132.639124][ T5337] ? __pfx_vpanic+0x10/0x10
[ 132.640871][ T5337] ? __pfx___schedule+0x10/0x10
[ 132.642894][ T5337] panic+0xc5/0xd0
[ 132.644500][ T5337] ? __pfx_panic+0x10/0x10
[ 132.646393][ T5337] ? preempt_schedule_common+0x82/0xd0
[ 132.648561][ T5337] check_panic_on_warn+0x89/0xb0
[ 132.650564][ T5337] end_report+0x73/0x170
[ 132.652318][ T5337] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 132.654617][ T5337] kasan_report_invalid_free+0xfa/0x110
[ 132.656817][ T5337] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 132.659201][ T5337] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 132.661543][ T5337] __kasan_slab_pre_free+0x104/0x120
[ 132.663504][ T5337] kfree+0x173/0x640
[ 132.665018][ T5337] ? f_uac2_opts_p_srate_store+0x225/0x2b0
[ 132.667053][ T5337] f_uac2_opts_p_srate_store+0x225/0x2b0
[ 132.669198][ T5337] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 132.671724][ T5337] ? down_read+0x2be/0x330
[ 132.673599][ T5337] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10
[ 132.676004][ T5337] configfs_write_iter+0x337/0x430
[ 132.678066][ T5337] vfs_write+0x612/0xba0
[ 132.679867][ T5337] ? __pfx_vfs_write+0x10/0x10
[ 132.681936][ T5337] ? __fget_files+0x2a/0x420
[ 132.683805][ T5337] ksys_write+0x150/0x270
[ 132.685607][ T5337] ? __pfx_ksys_write+0x10/0x10
[ 132.687615][ T5337] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 132.690020][ T5337] do_syscall_64+0x174/0x580
[ 132.691952][ T5337] ? trace_irq_disable+0x3b/0x140
[ 132.694083][ T5337] ? clear_bhb_loop+0x40/0x90
[ 132.696033][ T5337] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 132.698450][ T5337] RIP: 0033:0x7f4034d9e019
[ 132.700306][ T5337] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 132.707902][ T5337] RSP: 002b:00007f4035bfafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 132.711491][ T5337] RAX: ffffffffffffffda RBX: 00007f4035025fa0 RCX: 00007f4034d9e019
[ 132.714657][ T5337] RDX: 00000000000000d6 RSI: 0000200000000280 RDI: 0000000000000003
[ 132.717873][ T5337] RBP: 00007f4034e3500c R08: 0000000000000000 R09: 0000000000000000
[ 132.721228][ T5337] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 132.724563][ T5337] R13: 00007f4035026038 R14: 00007f4035025fa0 R15: 00007fff54e0fe58
[ 132.727756][ T5337]
[ 132.729386][ T5337] Kernel Offset: disabled
[ 132.731120][ T5337] Rebooting in 86400 seconds..