program: openat$sndtimer(0xffffffffffffff9c, 0x0, 0x2) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) unlinkat(0xffffffffffffff9c, 0x0, 0x0) getpid() r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r1, 0x0, 0x8008000000010, &(0x7f00000000c0)="17000000020001000003be8c5ee17688a2003208030300ecff3f0000000300000a0000000098fc5ad9485bbb6a880000d6c8db0000dba67e06000000e28900000200df018000000000f50607bdff59100ac45761547a681f009cee4a5acb3da400001fb700674f00c88ebbf9315033bf79ac2dff060115003901000000000000ea000000000000000002ffff02dfccebf6ba000840024f0298e9e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e0", 0xb8) r2 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)={0x2, 0x16, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)=ANY=[@ANYBLOB="15cf34001600ffffffff7010fedbdf25"], 0x10}}, 0x84) sendmsg$key(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="0212000002"], 0x10}}, 0x0) r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080fa0904"], 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, &(0x7f0000001000)={0x84, &(0x7f0000001100)={0x40, 0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mkdir(&(0x7f0000000100)='./mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./mnt\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0) write(r4, &(0x7f0000000a00)='stm32g0-typec 0x3', 0x11) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, &(0x7f0000001600)={0x84, &(0x7f0000001700)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r3, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) timer_create(0x3, &(0x7f0000000100)={0x0, 0xc, 0x0, @thr={&(0x7f0000000240)="debc10b9f06a9a644c130f3755e0e4ff2a7aed3f25be21fa393fe72212d509c6d01f99c075f01382c551f4d3928270da696fedecef0e07dd5f4e1d0ab2b8f0c3caedb962a6bafff9f42808a30d43e7ed855e6a648a761618e11136ece4e561ef7e990a7923a084161c1ec7d2f349296734a0359a0da9a21d27c300a9ed94cbf0e321f287924753de3b286a880c67d2ece64990e9385853a9d085dc21414672d7ae32f7d0f6f84e64e8f60ee14b64203b08edabcd28616de70491f38c", &(0x7f00000004c0)="1b8bba8df57925d55ced3c5f6070dd09a3b36607cc79fbcbbb668933aebad04701063807e4fd120e4de9ad7c6e81d13c9bb813d0c1bd286eb429a8984facd6eeb3f0f449f04946d80d8b04c48f4985eee0dc45f26307ce540de538e94a6b9dff34828da1c298aeeffa53342149b4a6bfed5bec3da2d1034a8d64e43e6676"}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x2}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r5, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xfc778000) [ 95.422168][ T5289] Bluetooth: hci0: command tx timeout [ 95.821923][ T9] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 95.973569][ T9] usb 5-1: New USB device found, idVendor=0403, idProduct=c631, bcdDevice= 1.00 [ 95.978290][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 96.005189][ T9] i2c-tiny-usb 5-1:1.0: version 1.00 found at bus 005 address 002 [ 96.399946][ T9] (null): failure reading functionality [ 96.658706][ T9] i2c i2c-2: failure reading functionality [ 96.678676][ T9] i2c i2c-2: connected i2c-tiny-usb device [ 97.067624][ T5307] usb 5-1: USB disconnect, device number 2 [ 97.070141][ T5327] i2c i2c-2: failure reading data [ 97.075471][ T5327] ucsi-stm32g0-i2c 2-0003: i2c read 03, 00 error: -5 [ 97.093016][ T5327] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000028: 0000 [#1] SMP KASAN NOPTI [ 97.098283][ T5327] KASAN: null-ptr-deref in range [0x0000000000000140-0x0000000000000147] [ 97.102299][ T5327] CPU: 0 UID: 0 PID: 5327 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 97.105887][ T5327] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 97.109912][ T5327] RIP: 0010:kasan_byte_accessible+0x12/0x30 [ 97.112531][ T5327] Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 e9 80 9d 9f 09 cc 66 66 66 66 66 66 2e [ 97.120292][ T5327] RSP: 0018:ffffc9000df17400 EFLAGS: 00010206 [ 97.122685][ T5327] RAX: dffffc0000000000 RBX: ffffffff81a25add RCX: 0000000080000001 [ 97.125724][ T5327] RDX: 0000000000000000 RSI: ffffffff81a25add RDI: 0000000000000028 [ 97.128859][ T5327] RBP: ffffffff8256826a R08: 0000000000000001 R09: 0000000000000000 [ 97.132098][ T5327] R10: dffffc0000000000 R11: ffffed1003f12ed9 R12: 0000000000000000 [ 97.135348][ T5327] R13: 0000000000000140 R14: 0000000000000140 R15: 0000000000000001 [ 97.138862][ T5327] FS: 00007f4338ff16c0(0000) GS:ffff88808c545000(0000) knlGS:0000000000000000 [ 97.142775][ T5327] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 97.145588][ T5327] CR2: 000055eebf3a9574 CR3: 00000000401d5000 CR4: 0000000000352ef0 [ 97.149077][ T5327] Call Trace: [ 97.150547][ T5327] [ 97.151874][ T5327] __kasan_check_byte+0x12/0x40 [ 97.153933][ T5327] lock_acquire+0x84/0x350 [ 97.155694][ T5327] down_write_nested+0x9d/0x210 [ 97.157595][ T5327] ? __simple_recursive_removal+0x9a/0x520 [ 97.159736][ T5327] ? __pfx_down_write_nested+0x10/0x10 [ 97.161847][ T5327] ? do_raw_spin_unlock+0x4d/0x210 [ 97.163961][ T5327] __simple_recursive_removal+0x9a/0x520 [ 97.166118][ T5327] ? mntput+0x65/0xc0 [ 97.167820][ T5327] ? __pfx_remove_one+0x10/0x10 [ 97.169960][ T5327] debugfs_remove+0x5b/0x70 [ 97.171959][ T5327] i2c_device_probe+0x8dc/0xbf0 [ 97.173988][ T5327] ? __pfx_i2c_device_probe+0x10/0x10 [ 97.176085][ T5327] ? sysfs_do_create_link_sd+0xe0/0x110 [ 97.178440][ T5327] ? driver_sysfs_add+0x1fe/0x210 [ 97.180563][ T5327] ? __pfx_i2c_device_probe+0x10/0x10 [ 97.182992][ T5327] really_probe+0x254/0xae0 [ 97.185050][ T5327] __driver_probe_device+0x1e8/0x360 [ 97.187443][ T5327] driver_probe_device+0x4f/0x240 [ 97.189589][ T5327] __device_attach_driver+0x270/0x410 [ 97.191897][ T5327] bus_for_each_drv+0x258/0x2f0 [ 97.193987][ T5327] ? __pfx___device_attach_driver+0x10/0x10 [ 97.196417][ T5327] ? __pfx_bus_for_each_drv+0x10/0x10 [ 97.198763][ T5327] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 97.201212][ T5327] __device_attach+0x2c4/0x450 [ 97.203176][ T5327] ? __pfx___device_attach+0x10/0x10 [ 97.205432][ T5327] ? do_raw_spin_unlock+0x4d/0x210 [ 97.207538][ T5327] ? _raw_spin_unlock+0x28/0x50 [ 97.209442][ T5327] device_initial_probe+0xa1/0xd0 [ 97.211452][ T5327] bus_probe_device+0x12a/0x220 [ 97.213496][ T5327] device_add+0x7d7/0xb80 [ 97.215238][ T5327] i2c_new_client_device+0xa29/0x1130 [ 97.217556][ T5327] ? __pfx_i2c_new_client_device+0x10/0x10 [ 97.220043][ T5327] ? __mutex_lock+0x321/0x1550 [ 97.222132][ T5327] ? new_device_store+0x132/0x530 [ 97.224227][ T5327] new_device_store+0x24b/0x530 [ 97.226286][ T5327] ? sysfs_file_kobj+0x1a/0x230 [ 97.228368][ T5327] ? sysfs_file_kobj+0x1a/0x230 [ 97.230425][ T5327] ? __pfx_new_device_store+0x10/0x10 [ 97.232846][ T5327] ? sysfs_file_kobj+0x1a/0x230 [ 97.235556][ T5327] ? sysfs_file_kobj+0x1a/0x230 [ 97.238332][ T5327] ? sysfs_file_kobj+0x1e4/0x230 [ 97.241076][ T5327] ? sysfs_kf_write+0x166/0x260 [ 97.243189][ T5327] ? __pfx_sysfs_kf_write+0x10/0x10 [ 97.245461][ T5327] kernfs_fop_write_iter+0x3a4/0x540 [ 97.247826][ T5327] vfs_write+0x612/0xba0 [ 97.249618][ T5327] ? __pfx_vfs_write+0x10/0x10 [ 97.251766][ T5327] ? __fget_files+0x2a/0x420 [ 97.253972][ T5327] ksys_write+0x150/0x270 [ 97.255952][ T5327] ? __pfx_ksys_write+0x10/0x10 [ 97.258171][ T5327] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.260837][ T5327] do_syscall_64+0x174/0x580 [ 97.262711][ T5327] ? trace_irq_disable+0x3b/0x140 [ 97.264752][ T5327] ? clear_bhb_loop+0x40/0x90 [ 97.266738][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.269303][ T5327] RIP: 0033:0x7f433819de99 [ 97.271222][ T5327] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 97.279313][ T5327] RSP: 002b:00007f4338ff0fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 97.282865][ T5327] RAX: ffffffffffffffda RBX: 00007f4338425fa0 RCX: 00007f433819de99 [ 97.286238][ T5327] RDX: 0000000000000011 RSI: 0000200000000a00 RDI: 0000000000000008 [ 97.290400][ T5327] RBP: 00007f4338233eaf R08: 0000000000000000 R09: 0000000000000000 [ 97.293852][ T5327] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 97.297226][ T5327] R13: 00007f4338426038 R14: 00007f4338425fa0 R15: 00007ffcc2136c08 [ 97.300657][ T5327] [ 97.302037][ T5327] Modules linked in: [ 97.305814][ T5327] ---[ end trace 0000000000000000 ]--- [ 97.317646][ T5327] RIP: 0010:kasan_byte_accessible+0x12/0x30 [ 97.320569][ T5327] Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 e9 80 9d 9f 09 cc 66 66 66 66 66 66 2e [ 97.328928][ T5327] RSP: 0018:ffffc9000df17400 EFLAGS: 00010206 [ 97.332247][ T5327] RAX: dffffc0000000000 RBX: ffffffff81a25add RCX: 0000000080000001 [ 97.335530][ T5327] RDX: 0000000000000000 RSI: ffffffff81a25add RDI: 0000000000000028 [ 97.338880][ T5327] RBP: ffffffff8256826a R08: 0000000000000001 R09: 0000000000000000 [ 97.342795][ T5327] R10: dffffc0000000000 R11: ffffed1003f12ed9 R12: 0000000000000000 [ 97.345919][ T5327] R13: 0000000000000140 R14: 0000000000000140 R15: 0000000000000001 [ 97.349188][ T5327] FS: 00007f4338ff16c0(0000) GS:ffff88808c545000(0000) knlGS:0000000000000000 [ 97.353234][ T5327] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 97.356062][ T5327] CR2: 0000200000000058 CR3: 00000000401d5000 CR4: 0000000000352ef0 [ 97.359490][ T5327] Kernel panic - not syncing: Fatal exception [ 97.362431][ T5327] Kernel Offset: disabled [ 97.364321][ T5327] Rebooting in 86400 seconds..