Extracting prog: 28.204038658s
Minimizing prog: 23m51.905363659s
Simplifying prog options: 0s
Extracting C: 21.09301933s
Simplifying C: 3m36.157006166s


extracting reproducer from 38 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-socket$nl_generic-syz_genetlink_get_family_id$ethtool-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MCE-ioctl$KVM_X86_SET_MCE-sendmsg$ETHTOOL_MSG_COALESCE_SET-mkdir-openat$cuse-openat$cgroup_root-readv-pipe2-splice-mq_open-mq_notify-mq_timedsend-openat-write-lremovexattr-openat-sendfile-write-symlink-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000400)='config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000a80), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000280)={0xc780000000000000, 0x5000, 0x6, 0x2})
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000100)={0xc680000000000000, 0xf7e83000, 0x3ff})
sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f00000000c0)={0x0, 0xfffffffffffffcc9, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="ee14c5000000bb000000000000", @ANYRES16=r1, @ANYRES16=r4], 0x1c}, 0x1, 0x0, 0x0, 0x8011}, 0x44004)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r5 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2842, 0x0)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup/syz0\x00', 0x200002, 0x0)
readv(r5, &(0x7f0000003040), 0x0)
pipe2(&(0x7f0000000000)={0xffffffffffffffff, <r6=>0xffffffffffffffff}, 0x800)
splice(r5, 0x0, r6, 0x0, 0x40000004, 0xb)
r7 = mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x8c\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x1, 0x0)
mq_notify(r7, &(0x7f0000000200)={0x0, 0x16})
mq_timedsend(r7, 0x0, 0x0, 0x9, 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000600)='config/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r8, &(0x7f0000000700)='44100,48000,96000\x00', 0x11)
lremovexattr(&(0x7f0000000340)='config/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', &(0x7f0000000380)=@known='trusted.overlay.upper\x00')
r9 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00000002c0)=0xffffffffffffff01, 0x8)
write(r9, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)
symlink(&(0x7f0000000a00)='config/usb_gadget/g1/functions/uac2.usb0\x00', &(0x7f0000000b00)='config/usb_gadget/g1/configs/c.1/uac2.usb0\x00')
r10 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r10, &(0x7f0000000d00)='dummy_udc.0\x00', 0xb)

program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
single: successfully extracted reproducer
found reproducer with 30 syscalls
minimizing guilty program
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-socket$nl_generic-syz_genetlink_get_family_id$ethtool-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MCE-ioctl$KVM_X86_SET_MCE-sendmsg$ETHTOOL_MSG_COALESCE_SET-mkdir-openat$cuse-openat$cgroup_root-readv-pipe2-splice-mq_open-mq_notify-mq_timedsend-openat-write-lremovexattr-openat-sendfile-write-symlink-openat
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000400)='config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000a80), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000280)={0xc780000000000000, 0x5000, 0x6, 0x2})
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000100)={0xc680000000000000, 0xf7e83000, 0x3ff})
sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f00000000c0)={0x0, 0xfffffffffffffcc9, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="ee14c5000000bb000000000000", @ANYRES16=r1, @ANYRES16=r4], 0x1c}, 0x1, 0x0, 0x0, 0x8011}, 0x44004)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r5 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2842, 0x0)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup/syz0\x00', 0x200002, 0x0)
readv(r5, &(0x7f0000003040), 0x0)
pipe2(&(0x7f0000000000)={0xffffffffffffffff, <r6=>0xffffffffffffffff}, 0x800)
splice(r5, 0x0, r6, 0x0, 0x40000004, 0xb)
r7 = mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x8c\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x1, 0x0)
mq_notify(r7, &(0x7f0000000200)={0x0, 0x16})
mq_timedsend(r7, 0x0, 0x0, 0x9, 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000600)='config/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r8, &(0x7f0000000700)='44100,48000,96000\x00', 0x11)
lremovexattr(&(0x7f0000000340)='config/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', &(0x7f0000000380)=@known='trusted.overlay.upper\x00')
r9 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00000002c0)=0xffffffffffffff01, 0x8)
write(r9, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)
symlink(&(0x7f0000000a00)='config/usb_gadget/g1/functions/uac2.usb0\x00', &(0x7f0000000b00)='config/usb_gadget/g1/configs/c.1/uac2.usb0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000c00)='config/usb_gadget/g1/UDC\x00', 0x1, 0x0)

program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-socket$nl_generic-syz_genetlink_get_family_id$ethtool-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MCE-ioctl$KVM_X86_SET_MCE-sendmsg$ETHTOOL_MSG_COALESCE_SET-mkdir-openat$cuse-openat$cgroup_root-readv-pipe2-splice-mq_open-mq_notify-mq_timedsend-openat-write-lremovexattr-openat-sendfile-write-symlink
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000400)='config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000a80), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000280)={0xc780000000000000, 0x5000, 0x6, 0x2})
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000100)={0xc680000000000000, 0xf7e83000, 0x3ff})
sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f00000000c0)={0x0, 0xfffffffffffffcc9, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="ee14c5000000bb000000000000", @ANYRES16=r1, @ANYRES16=r4], 0x1c}, 0x1, 0x0, 0x0, 0x8011}, 0x44004)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r5 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2842, 0x0)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup/syz0\x00', 0x200002, 0x0)
readv(r5, &(0x7f0000003040), 0x0)
pipe2(&(0x7f0000000000)={0xffffffffffffffff, <r6=>0xffffffffffffffff}, 0x800)
splice(r5, 0x0, r6, 0x0, 0x40000004, 0xb)
r7 = mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x8c\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x1, 0x0)
mq_notify(r7, &(0x7f0000000200)={0x0, 0x16})
mq_timedsend(r7, 0x0, 0x0, 0x9, 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000600)='config/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r8, &(0x7f0000000700)='44100,48000,96000\x00', 0x11)
lremovexattr(&(0x7f0000000340)='config/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', &(0x7f0000000380)=@known='trusted.overlay.upper\x00')
r9 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00000002c0)=0xffffffffffffff01, 0x8)
write(r9, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)
symlink(&(0x7f0000000a00)='config/usb_gadget/g1/functions/uac2.usb0\x00', &(0x7f0000000b00)='config/usb_gadget/g1/configs/c.1/uac2.usb0\x00')

program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-socket$nl_generic-syz_genetlink_get_family_id$ethtool-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MCE-ioctl$KVM_X86_SET_MCE-sendmsg$ETHTOOL_MSG_COALESCE_SET-mkdir-openat$cuse-openat$cgroup_root-readv-pipe2-splice-mq_open-mq_notify-mq_timedsend-openat-write-lremovexattr-openat-sendfile-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000400)='config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000a80), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000280)={0xc780000000000000, 0x5000, 0x6, 0x2})
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000100)={0xc680000000000000, 0xf7e83000, 0x3ff})
sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f00000000c0)={0x0, 0xfffffffffffffcc9, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="ee14c5000000bb000000000000", @ANYRES16=r1, @ANYRES16=r4], 0x1c}, 0x1, 0x0, 0x0, 0x8011}, 0x44004)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r5 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2842, 0x0)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup/syz0\x00', 0x200002, 0x0)
readv(r5, &(0x7f0000003040), 0x0)
pipe2(&(0x7f0000000000)={0xffffffffffffffff, <r6=>0xffffffffffffffff}, 0x800)
splice(r5, 0x0, r6, 0x0, 0x40000004, 0xb)
r7 = mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x8c\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x1, 0x0)
mq_notify(r7, &(0x7f0000000200)={0x0, 0x16})
mq_timedsend(r7, 0x0, 0x0, 0x9, 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000600)='config/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r8, &(0x7f0000000700)='44100,48000,96000\x00', 0x11)
lremovexattr(&(0x7f0000000340)='config/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', &(0x7f0000000380)=@known='trusted.overlay.upper\x00')
r9 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00000002c0)=0xffffffffffffff01, 0x8)
write(r9, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-socket$nl_generic-syz_genetlink_get_family_id$ethtool-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MCE-ioctl$KVM_X86_SET_MCE-sendmsg$ETHTOOL_MSG_COALESCE_SET-mkdir-openat$cuse-openat$cgroup_root-readv-pipe2-splice-mq_open-mq_notify-mq_timedsend-openat-write-lremovexattr-openat-sendfile
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000400)='config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000a80), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000280)={0xc780000000000000, 0x5000, 0x6, 0x2})
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000100)={0xc680000000000000, 0xf7e83000, 0x3ff})
sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f00000000c0)={0x0, 0xfffffffffffffcc9, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="ee14c5000000bb000000000000", @ANYRES16=r1, @ANYRES16=r4], 0x1c}, 0x1, 0x0, 0x0, 0x8011}, 0x44004)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r5 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2842, 0x0)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup/syz0\x00', 0x200002, 0x0)
readv(r5, &(0x7f0000003040), 0x0)
pipe2(&(0x7f0000000000)={0xffffffffffffffff, <r6=>0xffffffffffffffff}, 0x800)
splice(r5, 0x0, r6, 0x0, 0x40000004, 0xb)
r7 = mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x8c\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x1, 0x0)
mq_notify(r7, &(0x7f0000000200)={0x0, 0x16})
mq_timedsend(r7, 0x0, 0x0, 0x9, 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000600)='config/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r8, &(0x7f0000000700)='44100,48000,96000\x00', 0x11)
lremovexattr(&(0x7f0000000340)='config/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', &(0x7f0000000380)=@known='trusted.overlay.upper\x00')
openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00000002c0)=0xffffffffffffff01, 0x8)

program did not crash
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-socket$nl_generic-syz_genetlink_get_family_id$ethtool-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MCE-ioctl$KVM_X86_SET_MCE-sendmsg$ETHTOOL_MSG_COALESCE_SET-mkdir-openat$cuse-openat$cgroup_root-readv-pipe2-splice-mq_open-mq_notify-mq_timedsend-openat-write-lremovexattr-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000400)='config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000a80), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000280)={0xc780000000000000, 0x5000, 0x6, 0x2})
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000100)={0xc680000000000000, 0xf7e83000, 0x3ff})
sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f00000000c0)={0x0, 0xfffffffffffffcc9, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="ee14c5000000bb000000000000", @ANYRES16=r1, @ANYRES16=r4], 0x1c}, 0x1, 0x0, 0x0, 0x8011}, 0x44004)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r5 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2842, 0x0)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup/syz0\x00', 0x200002, 0x0)
readv(r5, &(0x7f0000003040), 0x0)
pipe2(&(0x7f0000000000)={0xffffffffffffffff, <r6=>0xffffffffffffffff}, 0x800)
splice(r5, 0x0, r6, 0x0, 0x40000004, 0xb)
r7 = mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x8c\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x1, 0x0)
mq_notify(r7, &(0x7f0000000200)={0x0, 0x16})
mq_timedsend(r7, 0x0, 0x0, 0x9, 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000600)='config/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r8, &(0x7f0000000700)='44100,48000,96000\x00', 0x11)
lremovexattr(&(0x7f0000000340)='config/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', &(0x7f0000000380)=@known='trusted.overlay.upper\x00')
r9 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r9, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-socket$nl_generic-syz_genetlink_get_family_id$ethtool-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MCE-ioctl$KVM_X86_SET_MCE-sendmsg$ETHTOOL_MSG_COALESCE_SET-mkdir-openat$cuse-openat$cgroup_root-readv-pipe2-splice-mq_open-mq_notify-mq_timedsend-openat-write-lremovexattr-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000400)='config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000a80), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000280)={0xc780000000000000, 0x5000, 0x6, 0x2})
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000100)={0xc680000000000000, 0xf7e83000, 0x3ff})
sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f00000000c0)={0x0, 0xfffffffffffffcc9, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="ee14c5000000bb000000000000", @ANYRES16=r1, @ANYRES16=r4], 0x1c}, 0x1, 0x0, 0x0, 0x8011}, 0x44004)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r5 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2842, 0x0)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup/syz0\x00', 0x200002, 0x0)
readv(r5, &(0x7f0000003040), 0x0)
pipe2(&(0x7f0000000000)={0xffffffffffffffff, <r6=>0xffffffffffffffff}, 0x800)
splice(r5, 0x0, r6, 0x0, 0x40000004, 0xb)
r7 = mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x8c\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x1, 0x0)
mq_notify(r7, &(0x7f0000000200)={0x0, 0x16})
mq_timedsend(r7, 0x0, 0x0, 0x9, 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000600)='config/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r8, &(0x7f0000000700)='44100,48000,96000\x00', 0x11)
lremovexattr(&(0x7f0000000340)='config/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', &(0x7f0000000380)=@known='trusted.overlay.upper\x00')
write(0xffffffffffffffff, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program did not crash
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-socket$nl_generic-syz_genetlink_get_family_id$ethtool-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MCE-ioctl$KVM_X86_SET_MCE-sendmsg$ETHTOOL_MSG_COALESCE_SET-mkdir-openat$cuse-openat$cgroup_root-readv-pipe2-splice-mq_open-mq_notify-mq_timedsend-openat-write-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000400)='config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000a80), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000280)={0xc780000000000000, 0x5000, 0x6, 0x2})
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000100)={0xc680000000000000, 0xf7e83000, 0x3ff})
sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f00000000c0)={0x0, 0xfffffffffffffcc9, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="ee14c5000000bb000000000000", @ANYRES16=r1, @ANYRES16=r4], 0x1c}, 0x1, 0x0, 0x0, 0x8011}, 0x44004)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r5 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2842, 0x0)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup/syz0\x00', 0x200002, 0x0)
readv(r5, &(0x7f0000003040), 0x0)
pipe2(&(0x7f0000000000)={0xffffffffffffffff, <r6=>0xffffffffffffffff}, 0x800)
splice(r5, 0x0, r6, 0x0, 0x40000004, 0xb)
r7 = mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x8c\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x1, 0x0)
mq_notify(r7, &(0x7f0000000200)={0x0, 0x16})
mq_timedsend(r7, 0x0, 0x0, 0x9, 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000600)='config/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r8, &(0x7f0000000700)='44100,48000,96000\x00', 0x11)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r9, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-socket$nl_generic-syz_genetlink_get_family_id$ethtool-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MCE-ioctl$KVM_X86_SET_MCE-sendmsg$ETHTOOL_MSG_COALESCE_SET-mkdir-openat$cuse-openat$cgroup_root-readv-pipe2-splice-mq_open-mq_notify-mq_timedsend-openat-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000400)='config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000a80), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000280)={0xc780000000000000, 0x5000, 0x6, 0x2})
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000100)={0xc680000000000000, 0xf7e83000, 0x3ff})
sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f00000000c0)={0x0, 0xfffffffffffffcc9, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="ee14c5000000bb000000000000", @ANYRES16=r1, @ANYRES16=r4], 0x1c}, 0x1, 0x0, 0x0, 0x8011}, 0x44004)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r5 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2842, 0x0)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup/syz0\x00', 0x200002, 0x0)
readv(r5, &(0x7f0000003040), 0x0)
pipe2(&(0x7f0000000000)={0xffffffffffffffff, <r6=>0xffffffffffffffff}, 0x800)
splice(r5, 0x0, r6, 0x0, 0x40000004, 0xb)
r7 = mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x8c\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x1, 0x0)
mq_notify(r7, &(0x7f0000000200)={0x0, 0x16})
mq_timedsend(r7, 0x0, 0x0, 0x9, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='config/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r8, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-socket$nl_generic-syz_genetlink_get_family_id$ethtool-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MCE-ioctl$KVM_X86_SET_MCE-sendmsg$ETHTOOL_MSG_COALESCE_SET-mkdir-openat$cuse-openat$cgroup_root-readv-pipe2-splice-mq_open-mq_notify-mq_timedsend-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000400)='config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000a80), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000280)={0xc780000000000000, 0x5000, 0x6, 0x2})
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000100)={0xc680000000000000, 0xf7e83000, 0x3ff})
sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f00000000c0)={0x0, 0xfffffffffffffcc9, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="ee14c5000000bb000000000000", @ANYRES16=r1, @ANYRES16=r4], 0x1c}, 0x1, 0x0, 0x0, 0x8011}, 0x44004)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r5 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2842, 0x0)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup/syz0\x00', 0x200002, 0x0)
readv(r5, &(0x7f0000003040), 0x0)
pipe2(&(0x7f0000000000)={0xffffffffffffffff, <r6=>0xffffffffffffffff}, 0x800)
splice(r5, 0x0, r6, 0x0, 0x40000004, 0xb)
r7 = mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x8c\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x1, 0x0)
mq_notify(r7, &(0x7f0000000200)={0x0, 0x16})
mq_timedsend(r7, 0x0, 0x0, 0x9, 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r8, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-socket$nl_generic-syz_genetlink_get_family_id$ethtool-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MCE-ioctl$KVM_X86_SET_MCE-sendmsg$ETHTOOL_MSG_COALESCE_SET-mkdir-openat$cuse-openat$cgroup_root-readv-pipe2-splice-mq_open-mq_notify-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000400)='config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000a80), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000280)={0xc780000000000000, 0x5000, 0x6, 0x2})
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000100)={0xc680000000000000, 0xf7e83000, 0x3ff})
sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f00000000c0)={0x0, 0xfffffffffffffcc9, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="ee14c5000000bb000000000000", @ANYRES16=r1, @ANYRES16=r4], 0x1c}, 0x1, 0x0, 0x0, 0x8011}, 0x44004)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r5 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2842, 0x0)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup/syz0\x00', 0x200002, 0x0)
readv(r5, &(0x7f0000003040), 0x0)
pipe2(&(0x7f0000000000)={0xffffffffffffffff, <r6=>0xffffffffffffffff}, 0x800)
splice(r5, 0x0, r6, 0x0, 0x40000004, 0xb)
r7 = mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x8c\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x1, 0x0)
mq_notify(r7, &(0x7f0000000200)={0x0, 0x16})
r8 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r8, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-socket$nl_generic-syz_genetlink_get_family_id$ethtool-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MCE-ioctl$KVM_X86_SET_MCE-sendmsg$ETHTOOL_MSG_COALESCE_SET-mkdir-openat$cuse-openat$cgroup_root-readv-pipe2-splice-mq_open-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000400)='config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000a80), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000280)={0xc780000000000000, 0x5000, 0x6, 0x2})
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000100)={0xc680000000000000, 0xf7e83000, 0x3ff})
sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f00000000c0)={0x0, 0xfffffffffffffcc9, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="ee14c5000000bb000000000000", @ANYRES16=r1, @ANYRES16=r4], 0x1c}, 0x1, 0x0, 0x0, 0x8011}, 0x44004)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r5 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2842, 0x0)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup/syz0\x00', 0x200002, 0x0)
readv(r5, &(0x7f0000003040), 0x0)
pipe2(&(0x7f0000000000)={0xffffffffffffffff, <r6=>0xffffffffffffffff}, 0x800)
splice(r5, 0x0, r6, 0x0, 0x40000004, 0xb)
mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x8c\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x1, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r7, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-socket$nl_generic-syz_genetlink_get_family_id$ethtool-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MCE-ioctl$KVM_X86_SET_MCE-sendmsg$ETHTOOL_MSG_COALESCE_SET-mkdir-openat$cuse-openat$cgroup_root-readv-pipe2-splice-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000400)='config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000a80), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000280)={0xc780000000000000, 0x5000, 0x6, 0x2})
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000100)={0xc680000000000000, 0xf7e83000, 0x3ff})
sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f00000000c0)={0x0, 0xfffffffffffffcc9, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="ee14c5000000bb000000000000", @ANYRES16=r1, @ANYRES16=r4], 0x1c}, 0x1, 0x0, 0x0, 0x8011}, 0x44004)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r5 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2842, 0x0)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup/syz0\x00', 0x200002, 0x0)
readv(r5, &(0x7f0000003040), 0x0)
pipe2(&(0x7f0000000000)={0xffffffffffffffff, <r6=>0xffffffffffffffff}, 0x800)
splice(r5, 0x0, r6, 0x0, 0x40000004, 0xb)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r7, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-socket$nl_generic-syz_genetlink_get_family_id$ethtool-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MCE-ioctl$KVM_X86_SET_MCE-sendmsg$ETHTOOL_MSG_COALESCE_SET-mkdir-openat$cuse-openat$cgroup_root-readv-pipe2-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000400)='config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000a80), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000280)={0xc780000000000000, 0x5000, 0x6, 0x2})
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000100)={0xc680000000000000, 0xf7e83000, 0x3ff})
sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f00000000c0)={0x0, 0xfffffffffffffcc9, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="ee14c5000000bb000000000000", @ANYRES16=r1, @ANYRES16=r4], 0x1c}, 0x1, 0x0, 0x0, 0x8011}, 0x44004)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r5 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2842, 0x0)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup/syz0\x00', 0x200002, 0x0)
readv(r5, &(0x7f0000003040), 0x0)
pipe2(&(0x7f0000000000), 0x800)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r6, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-socket$nl_generic-syz_genetlink_get_family_id$ethtool-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MCE-ioctl$KVM_X86_SET_MCE-sendmsg$ETHTOOL_MSG_COALESCE_SET-mkdir-openat$cuse-openat$cgroup_root-readv-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000400)='config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000a80), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000280)={0xc780000000000000, 0x5000, 0x6, 0x2})
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000100)={0xc680000000000000, 0xf7e83000, 0x3ff})
sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f00000000c0)={0x0, 0xfffffffffffffcc9, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="ee14c5000000bb000000000000", @ANYRES16=r1, @ANYRES16=r4], 0x1c}, 0x1, 0x0, 0x0, 0x8011}, 0x44004)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r5 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2842, 0x0)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup/syz0\x00', 0x200002, 0x0)
readv(r5, &(0x7f0000003040), 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r6, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-socket$nl_generic-syz_genetlink_get_family_id$ethtool-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MCE-ioctl$KVM_X86_SET_MCE-sendmsg$ETHTOOL_MSG_COALESCE_SET-mkdir-openat$cuse-openat$cgroup_root-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000400)='config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000a80), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000280)={0xc780000000000000, 0x5000, 0x6, 0x2})
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000100)={0xc680000000000000, 0xf7e83000, 0x3ff})
sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f00000000c0)={0x0, 0xfffffffffffffcc9, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="ee14c5000000bb000000000000", @ANYRES16=r1, @ANYRES16=r4], 0x1c}, 0x1, 0x0, 0x0, 0x8011}, 0x44004)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
openat$cuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2842, 0x0)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup/syz0\x00', 0x200002, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r5, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-socket$nl_generic-syz_genetlink_get_family_id$ethtool-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MCE-ioctl$KVM_X86_SET_MCE-sendmsg$ETHTOOL_MSG_COALESCE_SET-mkdir-openat$cuse-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000400)='config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000a80), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000280)={0xc780000000000000, 0x5000, 0x6, 0x2})
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000100)={0xc680000000000000, 0xf7e83000, 0x3ff})
sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f00000000c0)={0x0, 0xfffffffffffffcc9, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="ee14c5000000bb000000000000", @ANYRES16=r1, @ANYRES16=r4], 0x1c}, 0x1, 0x0, 0x0, 0x8011}, 0x44004)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
openat$cuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2842, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r5, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-socket$nl_generic-syz_genetlink_get_family_id$ethtool-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MCE-ioctl$KVM_X86_SET_MCE-sendmsg$ETHTOOL_MSG_COALESCE_SET-mkdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000400)='config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000a80), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000280)={0xc780000000000000, 0x5000, 0x6, 0x2})
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000100)={0xc680000000000000, 0xf7e83000, 0x3ff})
sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f00000000c0)={0x0, 0xfffffffffffffcc9, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="ee14c5000000bb000000000000", @ANYRES16=r1, @ANYRES16=r4], 0x1c}, 0x1, 0x0, 0x0, 0x8011}, 0x44004)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r5, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-socket$nl_generic-syz_genetlink_get_family_id$ethtool-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MCE-ioctl$KVM_X86_SET_MCE-sendmsg$ETHTOOL_MSG_COALESCE_SET-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000400)='config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000a80), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000280)={0xc780000000000000, 0x5000, 0x6, 0x2})
ioctl$KVM_X86_SET_MCE(r4, 0x4040ae9e, &(0x7f0000000100)={0xc680000000000000, 0xf7e83000, 0x3ff})
sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f00000000c0)={0x0, 0xfffffffffffffcc9, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="ee14c5000000bb000000000000", @ANYRES16=r1, @ANYRES16=r4], 0x1c}, 0x1, 0x0, 0x0, 0x8011}, 0x44004)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r5, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program did not crash
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-socket$nl_generic-syz_genetlink_get_family_id$ethtool-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MCE-ioctl$KVM_X86_SET_MCE-mkdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000400)='config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000a80), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
ioctl$KVM_X86_SET_MCE(r3, 0x4040ae9e, &(0x7f0000000280)={0xc780000000000000, 0x5000, 0x6, 0x2})
ioctl$KVM_X86_SET_MCE(r3, 0x4040ae9e, &(0x7f0000000100)={0xc680000000000000, 0xf7e83000, 0x3ff})
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r4, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-socket$nl_generic-syz_genetlink_get_family_id$ethtool-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MCE-mkdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000400)='config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000a80), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
ioctl$KVM_X86_SET_MCE(r3, 0x4040ae9e, &(0x7f0000000280)={0xc780000000000000, 0x5000, 0x6, 0x2})
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r4, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-socket$nl_generic-syz_genetlink_get_family_id$ethtool-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-mkdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000400)='config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000a80), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r3, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-socket$nl_generic-syz_genetlink_get_family_id$ethtool-openat$kvm-ioctl$KVM_CREATE_VM-mkdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000400)='config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000a80), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r2, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-socket$nl_generic-syz_genetlink_get_family_id$ethtool-openat$kvm-mkdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000400)='config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000a80), 0x0, 0x0)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r1, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-socket$nl_generic-syz_genetlink_get_family_id$ethtool-mkdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000400)='config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r1, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-socket$nl_generic-mkdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000400)='config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
socket$nl_generic(0x10, 0x3, 0x10)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-mkdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000400)='config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program did not crash
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mkdir-mkdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program did not crash
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-mkdir-mkdir-openat-write
detailed listing:
executing program 0:
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program did not crash
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-openat-write
detailed listing:
executing program 0:
mkdir(0x0, 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program did not crash
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program did not crash
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', 0x0, 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program did not crash
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(0x0, 0x1ff)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program did not crash
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(0x0, 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program did not crash
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program did not crash
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)

program did not crash
testing program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000d40), 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=32.966785177s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-openat-write
program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
simplifying C reproducer
testing compiled C program (duration=32.966785177s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-openat-write
program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
testing compiled C program (duration=32.966785177s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-openat-write
program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
testing compiled C program (duration=32.966785177s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-openat-write
program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
testing compiled C program (duration=32.966785177s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-openat-write
program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
testing compiled C program (duration=32.966785177s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-openat-write
program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
testing compiled C program (duration=32.966785177s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-openat-write
program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
testing compiled C program (duration=32.966785177s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-openat-write
program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
testing program (duration=32.966785177s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
validation run: crashed=true
testing program (duration=32.966785177s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
validation run: crashed=true
testing program (duration=32.966785177s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program did not crash
validation run: crashed=false
testing program (duration=32.966785177s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-mkdir-mkdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000000)='config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000500)='config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='config/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000d40)="343431301d4434383030302c393630303000b86e0484d7d827d3b9a91aed13fd06639e0ca6b206125fd78be687d55ce0d767f54f6f280a3700806c263bccc3fb66076e31ca486fe3822341671ac47abf010a3fe2c280815c5d4470f0c8cf3842020000000000000042da90088a4116ce6c3df607b4aa8279c55000041c0fc1dee2b808000000ead0182d51e8c76a74a1cbc22f9831d6df8c2652ef67436e4b10462abecb66e298e8b8ffb211dcf0ab6f5740162d6feac523e95080f6d7d5471990ea9dcfaa11ee90e46dbb558b2fe4d60016924a1b34df811717489bad20a009ca0d2d7157738048562ed2daed3146f59d14e700"/257, 0x101)

program crashed: KASAN: invalid-free in f_uac2_opts_p_srate_store
validation run: crashed=true
reproducing took 30m36.361749481s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x1d4/0x260 drivers/usb/gadget/function/f_uac2.c:2087
Free of addr ffff88803bf6018c by task syz.0.17/5919

CPU: 3 UID: 0 PID: 5919 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report_invalid_free+0xb8/0x190 mm/kasan/report.c:557
 check_slab_allocation+0xe1/0xf0 mm/kasan/common.c:230
 kasan_slab_pre_free include/linux/kasan.h:199 [inline]
 slab_free_hook mm/slub.c:2622 [inline]
 slab_free mm/slub.c:6377 [inline]
 kfree+0x1b6/0x6c0 mm/slub.c:6692
 f_uac2_opts_p_srate_store+0x1d4/0x260 drivers/usb/gadget/function/f_uac2.c:2087
 flush_write_buffer fs/configfs/file.c:207 [inline]
 configfs_write_iter+0x302/0x4e0 fs/configfs/file.c:229
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x6ac/0x1050 fs/read_write.c:687
 ksys_write+0x12a/0x250 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe025b9de99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc24f9d468 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fe025e25fa0 RCX: 00007fe025b9de99
RDX: 0000000000000101 RSI: 0000200000000d40 RDI: 0000000000000003
RBP: 00007fe025c33eaf R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fe025e25fac R14: 00007fe025e25fa0 R15: 00007fe025e25fa0
 </TASK>

Allocated by task 5919:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5334 [inline]
 __kmalloc_node_track_caller_noprof+0x331/0x830 mm/slub.c:5471
 __kmemdup_nul mm/util.c:64 [inline]
 kstrdup+0x51/0xe0 mm/util.c:84
 f_uac2_opts_p_srate_store+0x113/0x260 drivers/usb/gadget/function/f_uac2.c:2087
 flush_write_buffer fs/configfs/file.c:207 [inline]
 configfs_write_iter+0x302/0x4e0 fs/configfs/file.c:229
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x6ac/0x1050 fs/read_write.c:687
 ksys_write+0x12a/0x250 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff88803bf60180
 which belongs to the cache kmalloc-32 of size 32
The buggy address is located 12 bytes inside of
 18-byte region [ffff88803bf60180, ffff88803bf60192)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803bf60b00 pfn:0x3bf60
flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000200 ffff88801bc42780 ffff88801bc404c8 ffffea0000f67690
raw: ffff88803bf60b00 0000000800400030 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5155, tgid 5155 (udevd), ts 32147410261, free_ts 32146877552
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859
 prep_new_page mm/page_alloc.c:1867 [inline]
 get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304
 alloc_slab_page mm/slub.c:3266 [inline]
 allocate_slab mm/slub.c:3380 [inline]
 new_slab+0xa2/0x640 mm/slub.c:3426
 refill_objects+0xe3/0x410 mm/slub.c:7310
 refill_sheaf mm/slub.c:2804 [inline]
 __pcs_replace_empty_main+0x376/0x680 mm/slub.c:4675
 alloc_from_pcs mm/slub.c:4773 [inline]
 slab_alloc_node mm/slub.c:4905 [inline]
 __kmalloc_cache_noprof+0x479/0x6c0 mm/slub.c:5485
 _kmalloc_noprof include/linux/slab.h:988 [inline]
 slab_free_hook mm/slub.c:2629 [inline]
 slab_free mm/slub.c:6377 [inline]
 kmem_cache_free+0x412/0x6b0 mm/slub.c:6504
 tear_down_vmas+0x2a5/0x600 mm/mmap.c:1262
 exit_mmap+0x469/0xa00 mm/mmap.c:1320
 __mmput+0x12a/0x410 kernel/fork.c:1187
 mmput+0x67/0x80 kernel/fork.c:1210
 exit_mm kernel/exit.c:615 [inline]
 do_exit+0x8b1/0x2ae0 kernel/exit.c:997
 do_group_exit+0xd5/0x2a0 kernel/exit.c:1152
 __do_sys_exit_group kernel/exit.c:1163 [inline]
 __se_sys_exit_group kernel/exit.c:1161 [inline]
 __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1161
 x64_sys_call+0x102c/0x1530 arch/x86/include/generated/asm/syscalls_64.h:232
page last free pid 5155 tgid 5155 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1406 [inline]
 __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950
 tlb_batch_list_free mm/mmu_gather.c:161 [inline]
 tlb_finish_mmu+0x27d/0x810 mm/mmu_gather.c:552
 exit_mmap+0x454/0xa00 mm/mmap.c:1313
 __mmput+0x12a/0x410 kernel/fork.c:1187
 mmput+0x67/0x80 kernel/fork.c:1210
 exit_mm kernel/exit.c:615 [inline]
 do_exit+0x8b1/0x2ae0 kernel/exit.c:997
 do_group_exit+0xd5/0x2a0 kernel/exit.c:1152
 __do_sys_exit_group kernel/exit.c:1163 [inline]
 __se_sys_exit_group kernel/exit.c:1161 [inline]
 __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1161
 x64_sys_call+0x102c/0x1530 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff88803bf60080: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
 ffff88803bf60100: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
>ffff88803bf60180: 00 00 02 fc fc fc fc fc fa fb fb fb fc fc fc fc
                      ^
 ffff88803bf60200: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
 ffff88803bf60280: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
==================================================================

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x1d4/0x260 drivers/usb/gadget/function/f_uac2.c:2087
Free of addr ffff88803bf6018c by task syz.0.17/5919

CPU: 3 UID: 0 PID: 5919 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report_invalid_free+0xb8/0x190 mm/kasan/report.c:557
 check_slab_allocation+0xe1/0xf0 mm/kasan/common.c:230
 kasan_slab_pre_free include/linux/kasan.h:199 [inline]
 slab_free_hook mm/slub.c:2622 [inline]
 slab_free mm/slub.c:6377 [inline]
 kfree+0x1b6/0x6c0 mm/slub.c:6692
 f_uac2_opts_p_srate_store+0x1d4/0x260 drivers/usb/gadget/function/f_uac2.c:2087
 flush_write_buffer fs/configfs/file.c:207 [inline]
 configfs_write_iter+0x302/0x4e0 fs/configfs/file.c:229
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x6ac/0x1050 fs/read_write.c:687
 ksys_write+0x12a/0x250 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe025b9de99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc24f9d468 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fe025e25fa0 RCX: 00007fe025b9de99
RDX: 0000000000000101 RSI: 0000200000000d40 RDI: 0000000000000003
RBP: 00007fe025c33eaf R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fe025e25fac R14: 00007fe025e25fa0 R15: 00007fe025e25fa0
 </TASK>

Allocated by task 5919:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5334 [inline]
 __kmalloc_node_track_caller_noprof+0x331/0x830 mm/slub.c:5471
 __kmemdup_nul mm/util.c:64 [inline]
 kstrdup+0x51/0xe0 mm/util.c:84
 f_uac2_opts_p_srate_store+0x113/0x260 drivers/usb/gadget/function/f_uac2.c:2087
 flush_write_buffer fs/configfs/file.c:207 [inline]
 configfs_write_iter+0x302/0x4e0 fs/configfs/file.c:229
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x6ac/0x1050 fs/read_write.c:687
 ksys_write+0x12a/0x250 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff88803bf60180
 which belongs to the cache kmalloc-32 of size 32
The buggy address is located 12 bytes inside of
 18-byte region [ffff88803bf60180, ffff88803bf60192)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803bf60b00 pfn:0x3bf60
flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000200 ffff88801bc42780 ffff88801bc404c8 ffffea0000f67690
raw: ffff88803bf60b00 0000000800400030 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5155, tgid 5155 (udevd), ts 32147410261, free_ts 32146877552
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859
 prep_new_page mm/page_alloc.c:1867 [inline]
 get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304
 alloc_slab_page mm/slub.c:3266 [inline]
 allocate_slab mm/slub.c:3380 [inline]
 new_slab+0xa2/0x640 mm/slub.c:3426
 refill_objects+0xe3/0x410 mm/slub.c:7310
 refill_sheaf mm/slub.c:2804 [inline]
 __pcs_replace_empty_main+0x376/0x680 mm/slub.c:4675
 alloc_from_pcs mm/slub.c:4773 [inline]
 slab_alloc_node mm/slub.c:4905 [inline]
 __kmalloc_cache_noprof+0x479/0x6c0 mm/slub.c:5485
 _kmalloc_noprof include/linux/slab.h:988 [inline]
 slab_free_hook mm/slub.c:2629 [inline]
 slab_free mm/slub.c:6377 [inline]
 kmem_cache_free+0x412/0x6b0 mm/slub.c:6504
 tear_down_vmas+0x2a5/0x600 mm/mmap.c:1262
 exit_mmap+0x469/0xa00 mm/mmap.c:1320
 __mmput+0x12a/0x410 kernel/fork.c:1187
 mmput+0x67/0x80 kernel/fork.c:1210
 exit_mm kernel/exit.c:615 [inline]
 do_exit+0x8b1/0x2ae0 kernel/exit.c:997
 do_group_exit+0xd5/0x2a0 kernel/exit.c:1152
 __do_sys_exit_group kernel/exit.c:1163 [inline]
 __se_sys_exit_group kernel/exit.c:1161 [inline]
 __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1161
 x64_sys_call+0x102c/0x1530 arch/x86/include/generated/asm/syscalls_64.h:232
page last free pid 5155 tgid 5155 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1406 [inline]
 __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950
 tlb_batch_list_free mm/mmu_gather.c:161 [inline]
 tlb_finish_mmu+0x27d/0x810 mm/mmu_gather.c:552
 exit_mmap+0x454/0xa00 mm/mmap.c:1313
 __mmput+0x12a/0x410 kernel/fork.c:1187
 mmput+0x67/0x80 kernel/fork.c:1210
 exit_mm kernel/exit.c:615 [inline]
 do_exit+0x8b1/0x2ae0 kernel/exit.c:997
 do_group_exit+0xd5/0x2a0 kernel/exit.c:1152
 __do_sys_exit_group kernel/exit.c:1163 [inline]
 __se_sys_exit_group kernel/exit.c:1161 [inline]
 __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1161
 x64_sys_call+0x102c/0x1530 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff88803bf60080: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
 ffff88803bf60100: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
>ffff88803bf60180: 00 00 02 fc fc fc fc fc fa fb fb fb fc fc fc fc
                      ^
 ffff88803bf60200: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
 ffff88803bf60280: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
==================================================================