program:
r0 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0)
r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
setsockopt$sock_int(r1, 0x1, 0x10, &(0x7f0000000080)=0x9, 0x4)
bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x2}, 0x6)
recvmmsg(r1, &(0x7f0000000380)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000080)={'c6xdigio\x00', [0x401, 0x181, 0x2, 0xa, 0x14000000, 0x0, 0xfffffffc, 0x2, 0xffd, 0x7ffa, 0x3, 0x723, 0x400, 0x2, 0x13, 0x100, 0xffffffa7, 0x9, 0x34d, 0x1, 0x3fd, 0x4000009, 0x200, 0xe2df, 0x9, 0x1, 0x4, 0x40000, 0x7, 0xf58, 0x6]})
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000540)='binfmt_misc\x00', 0x0, 0x0)
mount(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x100020, 0x0)
r2 = openat$comedi(0xffffffffffffff9c, &(0x7f000000b200)='/dev/comedi1\x00', 0x8040, 0x0)
ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, &(0x7f0000000100)={'c6xdigio\x00', [0xb, 0xf, 0x6, 0x8, 0xfffffffb, 0x3ff, 0x4d7, 0x2, 0x4, 0x4, 0x0, 0x401, 0x3, 0x47, 0x9, 0x7ff, 0xa, 0x0, 0x1f29, 0x5, 0x8000, 0x8c, 0x6, 0x6, 0x54, 0x10001, 0x101, 0x5, 0x10001, 0x8, 0x1]})
openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0) (async)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async)
setsockopt$sock_int(r1, 0x1, 0x10, &(0x7f0000000080)=0x9, 0x4) (async)
bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) (async)
recvmmsg(r1, &(0x7f0000000380)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) (async)
ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000080)={'c6xdigio\x00', [0x401, 0x181, 0x2, 0xa, 0x14000000, 0x0, 0xfffffffc, 0x2, 0xffd, 0x7ffa, 0x3, 0x723, 0x400, 0x2, 0x13, 0x100, 0xffffffa7, 0x9, 0x34d, 0x1, 0x3fd, 0x4000009, 0x200, 0xe2df, 0x9, 0x1, 0x4, 0x40000, 0x7, 0xf58, 0x6]}) (async)
mkdir(&(0x7f0000000040)='./file0\x00', 0x0) (async)
mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000540)='binfmt_misc\x00', 0x0, 0x0) (async)
mount(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x100020, 0x0) (async)
openat$comedi(0xffffffffffffff9c, &(0x7f000000b200)='/dev/comedi1\x00', 0x8040, 0x0) (async)
ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, &(0x7f0000000100)={'c6xdigio\x00', [0xb, 0xf, 0x6, 0x8, 0xfffffffb, 0x3ff, 0x4d7, 0x2, 0x4, 0x4, 0x0, 0x401, 0x3, 0x47, 0x9, 0x7ff, 0xa, 0x0, 0x1f29, 0x5, 0x8000, 0x8c, 0x6, 0x6, 0x54, 0x10001, 0x101, 0x5, 0x10001, 0x8, 0x1]}) (async)

[   77.087334][ T1314] ieee802154 phy0 wpan0: encryption failed: -22
[   77.090116][ T1314] ieee802154 phy1 wpan1: encryption failed: -22
[   77.093577][ T5299] Bluetooth: hci0: command tx timeout
[   77.173678][ T5322] comedi comedi1: c6xdigio: I/O port conflict (0xb,3)
[   77.207497][ T5323] comedi comedi1: c6xdigio: I/O port conflict (0xb,3)
[   77.210482][ T5323] ==================================================================
[   77.213966][ T5323] BUG: KASAN: slab-use-after-free in sysfs_remove_file_ns+0x3d/0x70
[   77.217576][ T5323] Read of size 8 at addr ffff88801104e630 by task syz.0.0/5323
[   77.220940][ T5323] 
[   77.222071][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
[   77.222085][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[   77.222092][ T5323] Call Trace:
[   77.222100][ T5323]  <TASK>
[   77.222106][ T5323]  dump_stack_lvl+0x189/0x250
[   77.222126][ T5323]  ? __virt_addr_valid+0x1c8/0x5c0
[   77.222143][ T5323]  ? rcu_is_watching+0x15/0xb0
[   77.222155][ T5323]  ? __pfx_dump_stack_lvl+0x10/0x10
[   77.222169][ T5323]  ? rcu_is_watching+0x15/0xb0
[   77.222181][ T5323]  ? lock_release+0x4b/0x3e0
[   77.222193][ T5323]  ? _raw_spin_lock_irqsave+0xb3/0xf0
[   77.222251][ T5323]  ? __virt_addr_valid+0x1c8/0x5c0
[   77.222266][ T5323]  ? __virt_addr_valid+0x4a5/0x5c0
[   77.222281][ T5323]  print_report+0xca/0x240
[   77.222295][ T5323]  ? sysfs_remove_file_ns+0x3d/0x70
[   77.222311][ T5323]  kasan_report+0x118/0x150
[   77.222328][ T5323]  ? sysfs_remove_file_ns+0x3d/0x70
[   77.222346][ T5323]  sysfs_remove_file_ns+0x3d/0x70
[   77.222362][ T5323]  bus_remove_driver+0x198/0x2f0
[   77.222379][ T5323]  comedi_device_detach_locked+0x178/0x750
[   77.222400][ T5323]  comedi_device_attach+0x5d4/0x720
[   77.222413][ T5323]  comedi_unlocked_ioctl+0x5ff/0x1020
[   77.222429][ T5323]  ? kasan_quarantine_put+0xdd/0x220
[   77.222443][ T5323]  ? __pfx_comedi_unlocked_ioctl+0x10/0x10
[   77.222460][ T5323]  ? __might_fault+0xb0/0x130
[   77.222479][ T5323]  ? __fget_files+0x2a/0x420
[   77.222497][ T5323]  ? __fget_files+0x3a0/0x420
[   77.222512][ T5323]  ? __fget_files+0x2a/0x420
[   77.222528][ T5323]  ? bpf_lsm_file_ioctl+0x9/0x20
[   77.222539][ T5323]  ? __pfx_comedi_unlocked_ioctl+0x10/0x10
[   77.222554][ T5323]  __se_sys_ioctl+0xfc/0x170
[   77.222567][ T5323]  do_syscall_64+0xfa/0xfa0
[   77.222581][ T5323]  ? lockdep_hardirqs_on+0x9c/0x150
[   77.222593][ T5323]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   77.222604][ T5323]  ? clear_bhb_loop+0x60/0xb0
[   77.222617][ T5323]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   77.222628][ T5323] RIP: 0033:0x7f956c78efc9
[   77.222640][ T5323] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   77.222655][ T5323] RSP: 002b:00007f956d637038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[   77.222669][ T5323] RAX: ffffffffffffffda RBX: 00007f956c9e6090 RCX: 00007f956c78efc9
[   77.222677][ T5323] RDX: 0000200000000100 RSI: 0000000040946400 RDI: 0000000000000004
[   77.222685][ T5323] RBP: 00007f956c811f91 R08: 0000000000000000 R09: 0000000000000000
[   77.222693][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   77.222699][ T5323] R13: 00007f956c9e6128 R14: 00007f956c9e6090 R15: 00007ffd0be0f438
[   77.222712][ T5323]  </TASK>
[   77.222717][ T5323] 
[   77.338189][ T5323] Allocated by task 5322:
[   77.340157][ T5323]  kasan_save_track+0x3e/0x80
[   77.342296][ T5323]  __kasan_kmalloc+0x93/0xb0
[   77.344402][ T5323]  __kmalloc_cache_noprof+0x3d5/0x6f0
[   77.346832][ T5323]  bus_add_driver+0x162/0x640
[   77.348958][ T5323]  driver_register+0x23a/0x320
[   77.351085][ T5323]  c6xdigio_attach+0x94/0x890
[   77.353092][ T5323]  comedi_device_attach+0x51f/0x720
[   77.355380][ T5323]  comedi_unlocked_ioctl+0x5ff/0x1020
[   77.357717][ T5323]  __se_sys_ioctl+0xfc/0x170
[   77.359719][ T5323]  do_syscall_64+0xfa/0xfa0
[   77.361646][ T5323]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   77.363978][ T5323] 
[   77.364901][ T5323] Freed by task 5322:
[   77.366501][ T5323]  kasan_save_track+0x3e/0x80
[   77.368380][ T5323]  __kasan_save_free_info+0x46/0x50
[   77.370593][ T5323]  __kasan_slab_free+0x5c/0x80
[   77.372642][ T5323]  kfree+0x19a/0x6d0
[   77.374153][ T5323]  kobject_put+0x22b/0x480
[   77.375963][ T5323]  bus_remove_driver+0x245/0x2f0
[   77.378159][ T5323]  comedi_device_detach_locked+0x178/0x750
[   77.380722][ T5323]  comedi_device_attach+0x5d4/0x720
[   77.382908][ T5323]  comedi_unlocked_ioctl+0x5ff/0x1020
[   77.385191][ T5323]  __se_sys_ioctl+0xfc/0x170
[   77.387254][ T5323]  do_syscall_64+0xfa/0xfa0
[   77.389182][ T5323]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   77.391666][ T5323] 
[   77.392520][ T5323] The buggy address belongs to the object at ffff88801104e600
[   77.392520][ T5323]  which belongs to the cache kmalloc-256 of size 256
[   77.398277][ T5323] The buggy address is located 48 bytes inside of
[   77.398277][ T5323]  freed 256-byte region [ffff88801104e600, ffff88801104e700)
[   77.404022][ T5323] 
[   77.405083][ T5323] The buggy address belongs to the physical page:
[   77.407890][ T5323] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1104e
[   77.411602][ T5323] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[   77.414571][ T5323] page_type: f5(slab)
[   77.416250][ T5323] raw: 00fff00000000000 ffff88801a041b40 dead000000000100 dead000000000122
[   77.419980][ T5323] raw: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000
[   77.423270][ T5323] page dumped because: kasan: bad access detected
[   77.425894][ T5323] page_owner tracks the page as allocated
[   77.428160][ T5323] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5298, tgid 5298 (syz-executor), ts 75303771232, free_ts 75303321968
[   77.436379][ T5323]  post_alloc_hook+0x240/0x2a0
[   77.438745][ T5323]  get_page_from_freelist+0x2365/0x2440
[   77.441531][ T5323]  __alloc_frozen_pages_noprof+0x181/0x370
[   77.444247][ T5323]  alloc_pages_mpol+0x232/0x4a0
[   77.446432][ T5323]  allocate_slab+0x96/0x3a0
[   77.448540][ T5323]  ___slab_alloc+0xe94/0x18a0
[   77.450710][ T5323]  __slab_alloc+0x65/0x100
[   77.452725][ T5323]  __kmalloc_node_track_caller_noprof+0x5c7/0x800
[   77.455577][ T5323]  kmemdup_array+0x3f/0x80
[   77.457609][ T5323]  ip6t_register_table+0x286/0x7d0
[   77.459841][ T5323]  ip6table_filter_table_init+0x75/0xb0
[   77.461936][ T5323]  xt_find_table_lock+0x30c/0x3e0
[   77.463998][ T5323]  xt_request_find_table_lock+0x26/0x100
[   77.466373][ T5323]  do_ip6t_get_ctl+0x730/0x1180
[   77.468476][ T5323]  nf_getsockopt+0x26e/0x290
[   77.470477][ T5323]  ipv6_getsockopt+0x1ed/0x290
[   77.472539][ T5323] page last free pid 5298 tgid 5298 stack trace:
[   77.475358][ T5323]  __free_frozen_pages+0xbc4/0xd30
[   77.477632][ T5323]  kasan_populate_vmalloc+0x1db/0x270
[   77.479960][ T5323]  alloc_vmap_area+0xd7a/0x14c0
[   77.482143][ T5323]  __get_vm_area_node+0x1f8/0x300
[   77.484362][ T5323]  __vmalloc_node_range_noprof+0x30c/0x12d0
[   77.486787][ T5323]  vzalloc_noprof+0xb2/0xf0
[   77.488942][ T5323]  alloc_counters+0xd3/0x6d0
[   77.490880][ T5323]  do_ipt_get_ctl+0xaac/0x1180
[   77.492810][ T5323]  nf_getsockopt+0x26e/0x290
[   77.494751][ T5323]  ip_getsockopt+0x1c4/0x220
[   77.496758][ T5323]  do_sock_getsockopt+0x360/0x650
[   77.498821][ T5323]  __x64_sys_getsockopt+0x1a5/0x250
[   77.500952][ T5323]  do_syscall_64+0xfa/0xfa0
[   77.502947][ T5323]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   77.505443][ T5323] 
[   77.506453][ T5323] Memory state around the buggy address:
[   77.508580][ T5323]  ffff88801104e500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   77.511607][ T5323]  ffff88801104e580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   77.514629][ T5323] >ffff88801104e600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   77.517745][ T5323]                                      ^
[   77.520232][ T5323]  ffff88801104e680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   77.523320][ T5323]  ffff88801104e700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   77.526428][ T5323] ==================================================================
[   77.648878][ T5323] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   77.652423][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
[   77.655911][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[   77.660098][ T5323] Call Trace:
[   77.661287][ T5323]  <TASK>
[   77.662536][ T5323]  dump_stack_lvl+0x99/0x250
[   77.664449][ T5323]  ? __asan_memcpy+0x40/0x70
[   77.666450][ T5323]  ? __pfx_dump_stack_lvl+0x10/0x10
[   77.668542][ T5323]  ? __pfx__printk+0x10/0x10
[   77.670452][ T5323]  vpanic+0x237/0x6d0
[   77.672033][ T5323]  ? __pfx_vpanic+0x10/0x10
[   77.673786][ T5323]  ? preempt_schedule+0xae/0xc0
[   77.675841][ T5323]  ? __pfx_preempt_schedule+0x10/0x10
[   77.678101][ T5323]  panic+0xb9/0xc0
[   77.679684][ T5323]  ? __pfx_panic+0x10/0x10
[   77.681484][ T5323]  ? _raw_spin_unlock_irqrestore+0xfd/0x110
[   77.683935][ T5323]  ? is_module_address+0x17/0xf0
[   77.685955][ T5323]  ? sysfs_remove_file_ns+0x3d/0x70
[   77.688085][ T5323]  check_panic_on_warn+0x89/0xb0
[   77.690218][ T5323]  ? sysfs_remove_file_ns+0x3d/0x70
[   77.692545][ T5323]  end_report+0x78/0x160
[   77.694550][ T5323]  kasan_report+0x129/0x150
[   77.696809][ T5323]  ? sysfs_remove_file_ns+0x3d/0x70
[   77.699082][ T5323]  sysfs_remove_file_ns+0x3d/0x70
[   77.701204][ T5323]  bus_remove_driver+0x198/0x2f0
[   77.703301][ T5323]  comedi_device_detach_locked+0x178/0x750
[   77.705869][ T5323]  comedi_device_attach+0x5d4/0x720
[   77.708083][ T5323]  comedi_unlocked_ioctl+0x5ff/0x1020
[   77.710312][ T5323]  ? kasan_quarantine_put+0xdd/0x220
[   77.712534][ T5323]  ? __pfx_comedi_unlocked_ioctl+0x10/0x10
[   77.715004][ T5323]  ? __might_fault+0xb0/0x130
[   77.717029][ T5323]  ? __fget_files+0x2a/0x420
[   77.719041][ T5323]  ? __fget_files+0x3a0/0x420
[   77.721073][ T5323]  ? __fget_files+0x2a/0x420
[   77.723104][ T5323]  ? bpf_lsm_file_ioctl+0x9/0x20
[   77.725189][ T5323]  ? __pfx_comedi_unlocked_ioctl+0x10/0x10
[   77.727794][ T5323]  __se_sys_ioctl+0xfc/0x170
[   77.729895][ T5323]  do_syscall_64+0xfa/0xfa0
[   77.732277][ T5323]  ? lockdep_hardirqs_on+0x9c/0x150
[   77.734791][ T5323]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   77.737391][ T5323]  ? clear_bhb_loop+0x60/0xb0
[   77.739455][ T5323]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   77.742022][ T5323] RIP: 0033:0x7f956c78efc9
[   77.744046][ T5323] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   77.751988][ T5323] RSP: 002b:00007f956d637038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[   77.755426][ T5323] RAX: ffffffffffffffda RBX: 00007f956c9e6090 RCX: 00007f956c78efc9
[   77.758887][ T5323] RDX: 0000200000000100 RSI: 0000000040946400 RDI: 0000000000000004
[   77.762778][ T5323] RBP: 00007f956c811f91 R08: 0000000000000000 R09: 0000000000000000
[   77.767182][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   77.771485][ T5323] R13: 00007f956c9e6128 R14: 00007f956c9e6090 R15: 00007ffd0be0f438
[   77.775822][ T5323]  </TASK>
[   77.777736][ T5323] Kernel Offset: disabled
[   77.779801][ T5323] Rebooting in 86400 seconds..