program: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080fa0904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)={0x84, &(0x7f0000001100)={0x40, 0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2, 0x0, @loopback, 0x7}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0xfffffffd, @empty}, 0x1c) r2 = socket(0x10, 0x3, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="4c00000002060108000089af07d37ac1b9bb0000050001000600000005000400000000000900d7f438a37a3100000000070005000a4c1ad61cb59f3fb1101f46f1b94000000012000300686173683ae467c4a1259f79e0c26e65742c706f7274000000"], 0x4c}}, 0x2) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000004c0)=ANY=[@ANYBLOB="54000000090601010000000000000000070000000900020073797a310000000005000100070000002c0007801800018014000240fe8000000000000000000000000000bb060004400e1f000005000300d30000008db5372ce8a510c607e0e6aea1a9ae2cdd96b6a1053f7d0907cbc84bd873cd68931dee2a32a94152a880cbbdf2c334454c6d9fac81859d4f239b7ffaae30d932a39bc8a93f1926577b2a5b0d18143f54e14aa680423f9aa3d3dd024c2fcf08912db22c4fba771d68402e0cc37375cfd26048a8edf2eab93439a906214588d52db3057f850a8f4a9a77592a3f4f392350b68d5acc8ee78034dbbd9165c322ec9205ab847ac0e329"], 0x54}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000a40)=@newqdisc={0x43c, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r6, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x2}, {0x410, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x4, 0x41e, 0x10001, 0x3, 0x1, 0x4, 0x10bd, 0xf1, 0x0, 0xd, 0x7e, 0xf, 0x6, 0xf4, 0x9, 0x956, 0x0, 0x9, 0x6, 0x9, 0x9, 0x2, 0x0, 0x9, 0x6, 0x1b40, 0x0, 0x7, 0x9e55, 0x4, 0xf, 0x3, 0x7fff, 0x240, 0x8001, 0x7eac73e6, 0x0, 0x80, 0x8001, 0x8, 0x0, 0x101, 0xffff, 0x558c, 0x2, 0x2, 0x7ff, 0x3, 0x8, 0x1000, 0xf9, 0xb, 0x0, 0x3, 0x6, 0x200, 0x40, 0x3, 0x0, 0x6, 0xf2b0, 0x1ff, 0x7fffffff, 0xd, 0x8, 0x2, 0x9, 0x7, 0x0, 0x1, 0x8, 0xfffffffd, 0x7, 0x9, 0x5, 0xfffffff8, 0x5, 0x0, 0xe, 0x101, 0xf1, 0xffffffde, 0x6, 0x7, 0xfffffffa, 0xa27d, 0x1, 0x800, 0x3, 0x6, 0x5, 0x67a5d655, 0x2, 0xf1, 0x10001, 0xfffffc00, 0x80000000, 0x10000, 0x84b, 0xe, 0x6, 0x1, 0x8, 0x0, 0x2, 0xfffffff9, 0x2, 0x1, 0x1, 0x5eb6, 0x401, 0x7, 0xffff, 0x9, 0x6, 0x5, 0x3, 0x200, 0x1ff, 0x1baf, 0x3, 0x53, 0xffff0369, 0xffffffc0, 0x2f, 0x100, 0x0, 0x5, 0x8, 0x3, 0x8000, 0x7, 0x3, 0xb, 0x9, 0x0, 0x2, 0x6, 0x5, 0x7fff, 0x800, 0x9, 0x6ecc, 0x2e, 0xc, 0x7b, 0xe1, 0x2, 0x4, 0x3, 0xf, 0x4, 0x1, 0xa, 0xff, 0x286e, 0x800000, 0x1214, 0x5c4f, 0xfff, 0x1, 0x6, 0x80, 0x7, 0x9, 0xe, 0x0, 0x926, 0x0, 0x38, 0x8, 0xb88a, 0x2a7a5f70, 0x5, 0x7, 0x6, 0x1, 0x6b6, 0x5, 0xfffffff1, 0x9, 0x5, 0x1, 0x5718, 0x5, 0x5, 0x7, 0x8000, 0x6, 0x3, 0x800, 0x7, 0x6, 0x9, 0xffffffff, 0x5, 0x1, 0x8, 0x4e, 0x4, 0x80, 0x4, 0xdac, 0x8, 0x8, 0x1, 0xffffffff, 0x8ba, 0x8, 0xc7, 0x6, 0x2, 0x7, 0x6, 0x2, 0x5, 0x8, 0x3, 0x5, 0x2, 0x9328, 0x7f, 0x7, 0x5bb7, 0x5, 0xadb4, 0x79b, 0x3, 0x1, 0x7, 0x8000, 0x1, 0x40, 0x401, 0x3, 0x7fff, 0x7, 0xff, 0x2ea, 0x3, 0x2, 0xffff0000, 0x2, 0x6, 0x2, 0x9, 0x80000000, 0x3, 0xe694, 0xe, 0x2, 0xdc9, 0x2, 0xcf7b, 0x6, 0x7fff]}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x43c}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@newchain={0x34, 0x64, 0x8, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {0xf}, {0x5, 0x6}, {0x10, 0xffe0}}, [@TCA_CHAIN={0x8, 0xb, 0x4}, @TCA_RATE={0x6, 0x5, {0xa, 0xd0}}]}, 0x34}, 0x1, 0x0, 0x0, 0x55}, 0xc010) r7 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r7, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) listen(r7, 0xa) sendmsg(r7, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000100100000100000001000000000000001000000000000000100100000e"], 0x28}, 0x0) r8 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r8, &(0x7f0000000300)="12345678000001000000000100000001000000010101000000000001", 0x1c, 0x4008000, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10) sendto$inet(r8, 0x0, 0x0, 0x0, 0x0, 0x0) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) close_range(r9, 0xffffffffffffffff, 0x3f00000000000000) mkdir(&(0x7f0000000100)='./mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./mnt\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x3, &(0x7f0000000000)=@framed={{0xdb, 0xa, 0xa, 0xfe00, 0x40, 0x71, 0x10, 0x1a}}, &(0x7f0000000480)='syzkaller\x00', 0x5}, 0x90) r10 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0) write(r10, &(0x7f0000000a00)='stm32g0-typec 0x3', 0x11) [ 109.937710][ T4641] Bluetooth: hci0: command tx timeout [ 110.299968][ T9] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 110.461488][ T9] usb 5-1: New USB device found, idVendor=0403, idProduct=c631, bcdDevice= 1.00 [ 110.472072][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 110.505397][ T9] i2c-tiny-usb 5-1:1.0: version 1.00 found at bus 005 address 002 [ 110.898014][ T9] (null): failure reading functionality [ 111.120046][ T5321] netlink: 'syz.0.0': attribute type 5 has an invalid length. [ 111.128902][ T5321] netlink: 20 bytes leftover after parsing attributes in process `syz.0.0'. [ 111.144108][ T5321] netlink: 1048 bytes leftover after parsing attributes in process `syz.0.0'. [ 111.226145][ T9] i2c i2c-2: failure reading functionality [ 111.294095][ T9] i2c i2c-2: connected i2c-tiny-usb device [ 111.356220][ T9] usb 5-1: USB disconnect, device number 2 [ 111.376742][ T5321] i2c i2c-2: failure writing data [ 111.396244][ T5321] ucsi-stm32g0-i2c 2-0003: i2c read 03, 00 error: -5 [ 111.421534][ T5321] ================================================================== [ 111.425540][ T5321] BUG: KASAN: slab-use-after-free in _raw_spin_lock+0x2e/0x40 [ 111.429511][ T5321] Read of size 1 at addr ffff8880132853e8 by task syz.0.0/5321 [ 111.433220][ T5321] [ 111.434431][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 111.434457][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 111.434468][ T5321] Call Trace: [ 111.434479][ T5321] [ 111.434489][ T5321] dump_stack_lvl+0xe8/0x150 [ 111.434520][ T5321] print_address_description+0x55/0x1e0 [ 111.434543][ T5321] ? _raw_spin_lock+0x2e/0x40 [ 111.434559][ T5321] print_report+0x58/0x70 [ 111.434576][ T5321] kasan_report+0x117/0x150 [ 111.434596][ T5321] ? _raw_spin_lock+0x2e/0x40 [ 111.434614][ T5321] ? lockref_get+0x15/0x60 [ 111.434690][ T5321] __kasan_check_byte+0x2a/0x40 [ 111.434708][ T5321] lock_acquire+0x84/0x350 [ 111.434729][ T5321] ? do_raw_spin_lock+0x12b/0x2f0 [ 111.434747][ T5321] _raw_spin_lock+0x2e/0x40 [ 111.434762][ T5321] ? lockref_get+0x15/0x60 [ 111.434777][ T5321] lockref_get+0x15/0x60 [ 111.434792][ T5321] __simple_recursive_removal+0x33/0x520 [ 111.434806][ T5321] ? mntput+0x65/0xc0 [ 111.434826][ T5321] ? __pfx_remove_one+0x10/0x10 [ 111.434846][ T5321] debugfs_remove+0x5b/0x70 [ 111.434863][ T5321] i2c_device_probe+0x8dc/0xbf0 [ 111.434879][ T5321] ? __pfx_i2c_device_probe+0x10/0x10 [ 111.434926][ T5321] ? sysfs_do_create_link_sd+0xe0/0x110 [ 111.434946][ T5321] ? driver_sysfs_add+0x1fe/0x210 [ 111.434969][ T5321] ? __pfx_i2c_device_probe+0x10/0x10 [ 111.434983][ T5321] really_probe+0x254/0xae0 [ 111.435008][ T5321] __driver_probe_device+0x1e8/0x360 [ 111.435023][ T5321] driver_probe_device+0x4f/0x240 [ 111.435038][ T5321] __device_attach_driver+0x270/0x410 [ 111.435054][ T5321] bus_for_each_drv+0x258/0x2f0 [ 111.435074][ T5321] ? __pfx___device_attach_driver+0x10/0x10 [ 111.435089][ T5321] ? __pfx_bus_for_each_drv+0x10/0x10 [ 111.435107][ T5321] ? lockdep_hardirqs_on+0x7a/0x110 [ 111.435127][ T5321] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 111.435147][ T5321] __device_attach+0x2c4/0x450 [ 111.435162][ T5321] ? __pfx___device_attach+0x10/0x10 [ 111.435179][ T5321] ? do_raw_spin_unlock+0x4d/0x210 [ 111.435194][ T5321] ? _raw_spin_unlock+0x28/0x50 [ 111.435209][ T5321] device_initial_probe+0xa1/0xd0 [ 111.435223][ T5321] bus_probe_device+0x12a/0x220 [ 111.435241][ T5321] device_add+0x7d7/0xb80 [ 111.435261][ T5321] i2c_new_client_device+0xa29/0x1130 [ 111.435279][ T5321] ? __pfx_i2c_new_client_device+0x10/0x10 [ 111.435293][ T5321] ? __mutex_lock+0x30d/0x1550 [ 111.435309][ T5321] ? new_device_store+0x132/0x530 [ 111.435327][ T5321] new_device_store+0x24b/0x530 [ 111.435343][ T5321] ? sysfs_file_kobj+0x1a/0x230 [ 111.435357][ T5321] ? sysfs_file_kobj+0x1a/0x230 [ 111.435369][ T5321] ? __pfx_new_device_store+0x10/0x10 [ 111.435383][ T5321] ? sysfs_file_kobj+0x1a/0x230 [ 111.435394][ T5321] ? sysfs_file_kobj+0x1a/0x230 [ 111.435404][ T5321] ? sysfs_file_kobj+0x1e4/0x230 [ 111.435413][ T5321] ? sysfs_kf_write+0x166/0x260 [ 111.435424][ T5321] ? __pfx_sysfs_kf_write+0x10/0x10 [ 111.435433][ T5321] kernfs_fop_write_iter+0x3a4/0x540 [ 111.435453][ T5321] vfs_write+0x612/0xba0 [ 111.435468][ T5321] ? __pfx_vfs_write+0x10/0x10 [ 111.435482][ T5321] ? __fget_files+0x2a/0x420 [ 111.435495][ T5321] ksys_write+0x150/0x270 [ 111.435508][ T5321] ? __pfx_ksys_write+0x10/0x10 [ 111.435525][ T5321] ? __secure_computing+0xe7/0x2b0 [ 111.435552][ T5321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.435565][ T5321] do_syscall_64+0x174/0x580 [ 111.435579][ T5321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.435589][ T5321] ? clear_bhb_loop+0x70/0xc0 [ 111.435600][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.435613][ T5321] RIP: 0033:0x7fd8fdb9e0d9 [ 111.435629][ T5321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 111.435640][ T5321] RSP: 002b:00007fd8fe9d2fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 111.435657][ T5321] RAX: ffffffffffffffda RBX: 00007fd8fde25fa0 RCX: 00007fd8fdb9e0d9 [ 111.435668][ T5321] RDX: 0000000000000011 RSI: 0000200000000a00 RDI: 0000000000000001 [ 111.435676][ T5321] RBP: 00007fd8fdc35024 R08: 0000000000000000 R09: 0000000000000000 [ 111.435684][ T5321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 111.435691][ T5321] R13: 00007fd8fde26038 R14: 00007fd8fde25fa0 R15: 00007ffd00bb7f48 [ 111.435709][ T5321] [ 111.435715][ T5321] [ 111.639241][ T5321] Allocated by task 5321: [ 111.641242][ T5321] kasan_save_track+0x3e/0x80 [ 111.643371][ T5321] __kasan_slab_alloc+0x6c/0x80 [ 111.645772][ T5321] kmem_cache_alloc_lru_noprof+0x2aa/0x5f0 [ 111.648845][ T5321] __d_alloc+0x37/0x6f0 [ 111.650772][ T5321] d_alloc+0x4b/0x190 [ 111.652556][ T5321] lookup_one_qstr_excl+0xd8/0x360 [ 111.654769][ T5321] start_dirop+0x5c/0x90 [ 111.656808][ T5321] simple_start_creating+0xcc/0x110 [ 111.659429][ T5321] debugfs_start_creating+0xdb/0x1a0 [ 111.662152][ T5321] debugfs_create_dir+0x24/0x350 [ 111.664570][ T5321] i2c_device_probe+0x814/0xbf0 [ 111.666793][ T5321] really_probe+0x254/0xae0 [ 111.668916][ T5321] __driver_probe_device+0x1e8/0x360 [ 111.671321][ T5321] driver_probe_device+0x4f/0x240 [ 111.674091][ T5321] __device_attach_driver+0x270/0x410 [ 111.676871][ T5321] bus_for_each_drv+0x258/0x2f0 [ 111.679382][ T5321] __device_attach+0x2c4/0x450 [ 111.681559][ T5321] device_initial_probe+0xa1/0xd0 [ 111.683725][ T5321] bus_probe_device+0x12a/0x220 [ 111.685949][ T5321] device_add+0x7d7/0xb80 [ 111.688236][ T5321] i2c_new_client_device+0xa29/0x1130 [ 111.691001][ T5321] new_device_store+0x24b/0x530 [ 111.693512][ T5321] kernfs_fop_write_iter+0x3a4/0x540 [ 111.695957][ T5321] vfs_write+0x612/0xba0 [ 111.697903][ T5321] ksys_write+0x150/0x270 [ 111.699887][ T5321] do_syscall_64+0x174/0x580 [ 111.701887][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.704611][ T5321] [ 111.705720][ T5321] Freed by task 76: [ 111.707686][ T5321] kasan_save_track+0x3e/0x80 [ 111.709723][ T5321] kasan_save_free_info+0x40/0x50 [ 111.711757][ T5321] __kasan_slab_free+0x5c/0x80 [ 111.713637][ T5321] kmem_cache_free+0x182/0x650 [ 111.715727][ T5321] rcu_core+0x78b/0x10a0 [ 111.717644][ T5321] handle_softirqs+0x225/0x840 [ 111.719829][ T5321] __irq_exit_rcu+0xca/0x220 [ 111.722005][ T5321] irq_exit_rcu+0x9/0x30 [ 111.723995][ T5321] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 111.726527][ T5321] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 111.729127][ T5321] [ 111.730245][ T5321] Last potentially related work creation: [ 111.732892][ T5321] kasan_save_stack+0x3e/0x60 [ 111.735078][ T5321] kasan_record_aux_stack+0xbd/0xd0 [ 111.737731][ T5321] call_rcu+0xee/0x8b0 [ 111.739539][ T5321] dentry_kill+0x4d3/0x880 [ 111.741601][ T5321] finish_dput+0x1a/0x260 [ 111.743529][ T5321] find_next_child+0x1e7/0x250 [ 111.745689][ T5321] __simple_recursive_removal+0x10b/0x520 [ 111.748387][ T5321] debugfs_remove+0x5b/0x70 [ 111.750742][ T5321] i2c_del_adapter+0x229/0x430 [ 111.753191][ T5321] i2c_tiny_usb_disconnect+0x49/0xd0 [ 111.755834][ T5321] usb_unbind_interface+0x295/0x9f0 [ 111.758310][ T5321] device_release_driver_internal+0x4f5/0x880 [ 111.761156][ T5321] bus_remove_device+0x444/0x560 [ 111.763635][ T5321] device_del+0x524/0x8f0 [ 111.765695][ T5321] usb_disable_device+0x3d4/0x8d0 [ 111.768189][ T5321] usb_disconnect+0x346/0x9a0 [ 111.770658][ T5321] hub_event+0x1bbb/0x4d30 [ 111.773077][ T5321] process_scheduled_works+0xa8e/0x14e0 [ 111.775982][ T5321] worker_thread+0xa47/0xfb0 [ 111.778713][ T5321] kthread+0x388/0x470 [ 111.781323][ T5321] ret_from_fork+0x514/0xb70 [ 111.783806][ T5321] ret_from_fork_asm+0x1a/0x30 [ 111.786261][ T5321] [ 111.787481][ T5321] The buggy address belongs to the object at ffff888013285318 [ 111.787481][ T5321] which belongs to the cache dentry of size 312 [ 111.793378][ T5321] The buggy address is located 208 bytes inside of [ 111.793378][ T5321] freed 312-byte region [ffff888013285318, ffff888013285450) [ 111.799802][ T5321] [ 111.800903][ T5321] The buggy address belongs to the physical page: [ 111.803771][ T5321] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13284 [ 111.807905][ T5321] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 111.812078][ T5321] memcg:ffff888012903001 [ 111.814179][ T5321] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 111.817591][ T5321] page_type: f5(slab) [ 111.819707][ T5321] raw: 00fff00000000040 ffff888030414280 dead000000000100 dead000000000122 [ 111.824713][ T5321] raw: 0000000000000000 0000000800150015 00000000f5000000 ffff888012903001 [ 111.829427][ T5321] head: 00fff00000000040 ffff888030414280 dead000000000100 dead000000000122 [ 111.833700][ T5321] head: 0000000000000000 0000000800150015 00000000f5000000 ffff888012903001 [ 111.837700][ T5321] head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 111.841620][ T5321] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 111.845426][ T5321] page dumped because: kasan: bad access detected [ 111.848379][ T5321] page_owner tracks the page as allocated [ 111.851305][ T5321] page last allocated via order 1, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_RECLAIMABLE|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4694, tgid 4694 (udevd), ts 40193022476, free_ts 33710618932 [ 111.861490][ T5321] post_alloc_hook+0x1f9/0x250 [ 111.863784][ T5321] get_page_from_freelist+0x21fa/0x2270 [ 111.866358][ T5321] __alloc_frozen_pages_noprof+0x18d/0x380 [ 111.869018][ T5321] allocate_slab+0x79/0x5e0 [ 111.870860][ T5321] refill_objects+0x2d5/0x350 [ 111.872911][ T5321] __pcs_replace_empty_main+0x2bf/0x6b0 [ 111.875480][ T5321] kmem_cache_alloc_lru_noprof+0x389/0x5f0 [ 111.878388][ T5321] __d_alloc+0x37/0x6f0 [ 111.880454][ T5321] d_alloc_parallel+0xde/0x16a0 [ 111.882642][ T5321] __lookup_slow+0x82/0x2f0 [ 111.884665][ T5321] lookup_slow+0x53/0x70 [ 111.886734][ T5321] link_path_walk+0xd2a/0x1910 [ 111.889021][ T5321] __filename_parentat+0x287/0x6f0 [ 111.891540][ T5321] filename_unlinkat+0x104/0x610 [ 111.893746][ T5321] __se_sys_unlink+0x2e/0x140 [ 111.895836][ T5321] do_syscall_64+0x174/0x580 [ 111.897865][ T5321] page last free pid 1 tgid 1 stack trace: [ 111.900395][ T5321] __free_frozen_pages+0xc1e/0xd10 [ 111.902795][ T5321] free_reserved_page+0xce/0x120 [ 111.905216][ T5321] free_reserved_area+0x202/0x2e0 [ 111.907793][ T5321] free_kernel_image_pages+0xa2/0x100 [ 111.910151][ T5321] kernel_init+0x31/0x1d0 [ 111.912070][ T5321] ret_from_fork+0x514/0xb70 [ 111.914076][ T5321] ret_from_fork_asm+0x1a/0x30 [ 111.916206][ T5321] [ 111.917311][ T5321] Memory state around the buggy address: [ 111.919868][ T5321] ffff888013285280: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc [ 111.923614][ T5321] ffff888013285300: fc fc fc fa fb fb fb fb fb fb fb fb fb fb fb fb [ 111.927066][ T5321] >ffff888013285380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 111.930545][ T5321] ^ [ 111.933837][ T5321] ffff888013285400: fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc [ 111.937649][ T5321] ffff888013285480: fc fc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 111.940976][ T5321] ================================================================== [ 111.945468][ T5321] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 111.948376][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 111.952070][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 111.956302][ T5321] Call Trace: [ 111.957771][ T5321] [ 111.959153][ T5321] vpanic+0x56c/0xa60 [ 111.960940][ T5321] ? __pfx_vpanic+0x10/0x10 [ 111.963111][ T5321] panic+0xc5/0xd0 [ 111.965026][ T5321] ? __pfx_panic+0x10/0x10 [ 111.967205][ T5321] ? _raw_spin_lock+0x2e/0x40 [ 111.969240][ T5321] ? _raw_spin_lock+0x2e/0x40 [ 111.971237][ T5321] check_panic_on_warn+0x89/0xb0 [ 111.973355][ T5321] ? _raw_spin_lock+0x2e/0x40 [ 111.975361][ T5321] end_report+0x73/0x170 [ 111.977340][ T5321] ? _raw_spin_lock+0x2e/0x40 [ 111.979565][ T5321] kasan_report+0x128/0x150 [ 111.981747][ T5321] ? _raw_spin_lock+0x2e/0x40 [ 111.984163][ T5321] ? lockref_get+0x15/0x60 [ 111.986399][ T5321] __kasan_check_byte+0x2a/0x40 [ 111.988581][ T5321] lock_acquire+0x84/0x350 [ 111.990592][ T5321] ? do_raw_spin_lock+0x12b/0x2f0 [ 111.992702][ T5321] _raw_spin_lock+0x2e/0x40 [ 111.994687][ T5321] ? lockref_get+0x15/0x60 [ 111.996781][ T5321] lockref_get+0x15/0x60 [ 111.998796][ T5321] __simple_recursive_removal+0x33/0x520 [ 112.001412][ T5321] ? mntput+0x65/0xc0 [ 112.003203][ T5321] ? __pfx_remove_one+0x10/0x10 [ 112.005268][ T5321] debugfs_remove+0x5b/0x70 [ 112.007256][ T5321] i2c_device_probe+0x8dc/0xbf0 [ 112.009476][ T5321] ? __pfx_i2c_device_probe+0x10/0x10 [ 112.012149][ T5321] ? sysfs_do_create_link_sd+0xe0/0x110 [ 112.015028][ T5321] ? driver_sysfs_add+0x1fe/0x210 [ 112.017577][ T5321] ? __pfx_i2c_device_probe+0x10/0x10 [ 112.020009][ T5321] really_probe+0x254/0xae0 [ 112.022094][ T5321] __driver_probe_device+0x1e8/0x360 [ 112.024232][ T5321] driver_probe_device+0x4f/0x240 [ 112.026282][ T5321] __device_attach_driver+0x270/0x410 [ 112.028630][ T5321] bus_for_each_drv+0x258/0x2f0 [ 112.030919][ T5321] ? __pfx___device_attach_driver+0x10/0x10 [ 112.033628][ T5321] ? __pfx_bus_for_each_drv+0x10/0x10 [ 112.035975][ T5321] ? lockdep_hardirqs_on+0x7a/0x110 [ 112.038339][ T5321] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 112.040973][ T5321] __device_attach+0x2c4/0x450 [ 112.043149][ T5321] ? __pfx___device_attach+0x10/0x10 [ 112.046093][ T5321] ? do_raw_spin_unlock+0x4d/0x210 [ 112.048932][ T5321] ? _raw_spin_unlock+0x28/0x50 [ 112.051292][ T5321] device_initial_probe+0xa1/0xd0 [ 112.053402][ T5321] bus_probe_device+0x12a/0x220 [ 112.055589][ T5321] device_add+0x7d7/0xb80 [ 112.057584][ T5321] i2c_new_client_device+0xa29/0x1130 [ 112.059807][ T5321] ? __pfx_i2c_new_client_device+0x10/0x10 [ 112.062327][ T5321] ? __mutex_lock+0x30d/0x1550 [ 112.064343][ T5321] ? new_device_store+0x132/0x530 [ 112.066544][ T5321] new_device_store+0x24b/0x530 [ 112.068806][ T5321] ? sysfs_file_kobj+0x1a/0x230 [ 112.071025][ T5321] ? sysfs_file_kobj+0x1a/0x230 [ 112.073244][ T5321] ? __pfx_new_device_store+0x10/0x10 [ 112.075655][ T5321] ? sysfs_file_kobj+0x1a/0x230 [ 112.077490][ T5321] ? sysfs_file_kobj+0x1a/0x230 [ 112.079435][ T5321] ? sysfs_file_kobj+0x1e4/0x230 [ 112.081623][ T5321] ? sysfs_kf_write+0x166/0x260 [ 112.083862][ T5321] ? __pfx_sysfs_kf_write+0x10/0x10 [ 112.086515][ T5321] kernfs_fop_write_iter+0x3a4/0x540 [ 112.089030][ T5321] vfs_write+0x612/0xba0 [ 112.091099][ T5321] ? __pfx_vfs_write+0x10/0x10 [ 112.093182][ T5321] ? __fget_files+0x2a/0x420 [ 112.095166][ T5321] ksys_write+0x150/0x270 [ 112.097032][ T5321] ? __pfx_ksys_write+0x10/0x10 [ 112.099210][ T5321] ? __secure_computing+0xe7/0x2b0 [ 112.101531][ T5321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.104371][ T5321] do_syscall_64+0x174/0x580 [ 112.106726][ T5321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.109567][ T5321] ? clear_bhb_loop+0x70/0xc0 [ 112.111671][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.114306][ T5321] RIP: 0033:0x7fd8fdb9e0d9 [ 112.116302][ T5321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 112.125011][ T5321] RSP: 002b:00007fd8fe9d2fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 112.128813][ T5321] RAX: ffffffffffffffda RBX: 00007fd8fde25fa0 RCX: 00007fd8fdb9e0d9 [ 112.132225][ T5321] RDX: 0000000000000011 RSI: 0000200000000a00 RDI: 0000000000000001 [ 112.135711][ T5321] RBP: 00007fd8fdc35024 R08: 0000000000000000 R09: 0000000000000000 [ 112.139509][ T5321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 112.143105][ T5321] R13: 00007fd8fde26038 R14: 00007fd8fde25fa0 R15: 00007ffd00bb7f48 [ 112.146545][ T5321] [ 112.148373][ T5321] Kernel Offset: disabled [ 112.150372][ T5321] Rebooting in 86400 seconds..