program: r0 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000040)={0x2}) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x4, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="e8a75c4e4252ca9f000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b70300002bb91a008500000008000000bc090000000000004509010000200000950000000000000085000000cd000000bf98000000000000560900000000000085000000a4000000b7000000000000009500000000000000"], &(0x7f0000000980)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x10, 0x0, 0x7fff7ffc}]}) r4 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080fa0904"], 0x0) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io(r4, 0x0, 0x0) mkdir(&(0x7f0000000100)='./mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./mnt\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0) syz_usb_control_io$cdc_ncm(r4, 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0) write(r5, &(0x7f0000000a00)='stm32g0-typec 0x3', 0x11) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io(r4, 0x0, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) ioctl$VT_RESIZEX(r5, 0x560a, &(0x7f0000000000)={0xfa, 0x7ff, 0xff, 0x7f, 0x401}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000080), 0x84080, 0x0) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000300)={0xffffffffffffffff}, 0x2, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r5, &(0x7f00000001c0)={0x18, 0x110, 0xfa00, {r8, 0x7fffffff, 0x12, 0x0, 0x0, @in={0x2, 0x4e20, @remote}, @in6={0xa, 0x4e22, 0x2, @mcast2, 0x2}}}, 0x118) write$RDMA_USER_CM_CMD_MIGRATE_ID(r6, &(0x7f0000000180)={0x12, 0x10, 0xfa00, {&(0x7f0000000140), r8, r2}}, 0x18) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7) mmap$IORING_OFF_SQES(0x0, 0x1000, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000) r9 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0) ioctl$COMEDI_DEVCONFIG(r9, 0x40946400, &(0x7f0000000080)={'dt2815\x00', [0x3c4, 0x8, 0x2, 0x3, 0x14000000, 0x0, 0xfffffffc, 0x2, 0xffd, 0x7ffe, 0x3, 0x723, 0x400, 0x2, 0x13, 0x100, 0xffffffa7, 0x9, 0x34d, 0x1, 0x3ff, 0x9, 0x200, 0xe2df, 0xaa14, 0x1, 0x4, 0x0, 0x7, 0x2, 0x6]}) ioctl$COMEDI_INSN(r9, 0x8028640c, &(0x7f0000000000)={0x4000000, 0x92, 0x0, 0x0, 0x80000000}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) [ 94.241373][ T4642] Bluetooth: hci0: command tx timeout [ 94.704939][ T5302] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 94.856149][ T5302] usb 5-1: New USB device found, idVendor=0403, idProduct=c631, bcdDevice= 1.00 [ 94.862542][ T5302] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 94.884176][ T5302] i2c-tiny-usb 5-1:1.0: version 1.00 found at bus 005 address 002 [ 95.276209][ T5302] (null): failure reading functionality [ 95.286857][ T5302] i2c i2c-2: failure reading functionality [ 95.333187][ T5302] i2c i2c-2: connected i2c-tiny-usb device [ 95.556291][ T5317] i2c i2c-2: failure reading status [ 95.562758][ T5302] usb 5-1: USB disconnect, device number 2 [ 95.575483][ T5317] ucsi-stm32g0-i2c 2-0003: i2c read 03, 00 error: -5 [ 95.592702][ T5317] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000028: 0000 [#1] SMP KASAN NOPTI [ 95.598632][ T5317] KASAN: null-ptr-deref in range [0x0000000000000140-0x0000000000000147] [ 95.602178][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.605448][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.609715][ T5317] RIP: 0010:kasan_byte_accessible+0x12/0x30 [ 95.612263][ T5317] Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 e9 80 96 9f 09 cc 66 66 66 66 66 66 2e [ 95.620523][ T5317] RSP: 0018:ffffc9000e127400 EFLAGS: 00010206 [ 95.623084][ T5317] RAX: dffffc0000000000 RBX: ffffffff81a25d4d RCX: 0000000080000001 [ 95.626352][ T5317] RDX: 0000000000000000 RSI: ffffffff81a25d4d RDI: 0000000000000028 [ 95.629686][ T5317] RBP: ffffffff82569bda R08: 0000000000000001 R09: 0000000000000000 [ 95.632942][ T5317] R10: dffffc0000000000 R11: ffffed100263be4c R12: 0000000000000000 [ 95.636328][ T5317] R13: 0000000000000140 R14: 0000000000000140 R15: 0000000000000001 [ 95.639627][ T5317] FS: 00007f617a0ab6c0(0000) GS:ffff88808c549000(0000) knlGS:0000000000000000 [ 95.643225][ T5317] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.646022][ T5317] CR2: 000055e849ab6458 CR3: 000000000e6fe000 CR4: 0000000000352ef0 [ 95.648989][ T5317] Call Trace: [ 95.650163][ T5317] [ 95.651214][ T5317] __kasan_check_byte+0x12/0x40 [ 95.652981][ T5317] lock_acquire+0x84/0x350 [ 95.654666][ T5317] down_write_nested+0x9d/0x210 [ 95.656710][ T5317] ? __simple_recursive_removal+0x9a/0x520 [ 95.659208][ T5317] ? __pfx_down_write_nested+0x10/0x10 [ 95.661448][ T5317] ? do_raw_spin_unlock+0x4d/0x210 [ 95.663610][ T5317] __simple_recursive_removal+0x9a/0x520 [ 95.665942][ T5317] ? mntput+0x65/0xc0 [ 95.667719][ T5317] ? __pfx_remove_one+0x10/0x10 [ 95.669865][ T5317] debugfs_remove+0x5b/0x70 [ 95.671685][ T5317] i2c_device_probe+0x8dc/0xbf0 [ 95.673726][ T5317] ? __pfx_i2c_device_probe+0x10/0x10 [ 95.675918][ T5317] ? sysfs_do_create_link_sd+0xe0/0x110 [ 95.678191][ T5317] ? driver_sysfs_add+0x1fe/0x210 [ 95.680195][ T5317] ? __pfx_i2c_device_probe+0x10/0x10 [ 95.682357][ T5317] really_probe+0x254/0xae0 [ 95.684158][ T5317] __driver_probe_device+0x1e8/0x360 [ 95.686305][ T5317] driver_probe_device+0x4f/0x240 [ 95.688427][ T5317] __device_attach_driver+0x270/0x410 [ 95.690578][ T5317] bus_for_each_drv+0x258/0x2f0 [ 95.692600][ T5317] ? __pfx___device_attach_driver+0x10/0x10 [ 95.695048][ T5317] ? __pfx_bus_for_each_drv+0x10/0x10 [ 95.697336][ T5317] ? lockdep_hardirqs_on+0x7a/0x110 [ 95.699372][ T5317] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 95.701770][ T5317] __device_attach+0x2c4/0x450 [ 95.703873][ T5317] ? __pfx___device_attach+0x10/0x10 [ 95.706025][ T5317] ? do_raw_spin_unlock+0x4d/0x210 [ 95.708169][ T5317] ? _raw_spin_unlock+0x28/0x50 [ 95.710385][ T5317] device_initial_probe+0xa1/0xd0 [ 95.712515][ T5317] bus_probe_device+0x12a/0x220 [ 95.714500][ T5317] device_add+0x7d7/0xb80 [ 95.716264][ T5317] i2c_new_client_device+0xa29/0x1130 [ 95.718684][ T5317] ? __pfx_i2c_new_client_device+0x10/0x10 [ 95.721090][ T5317] ? __mutex_lock+0x30d/0x1550 [ 95.723112][ T5317] ? new_device_store+0x132/0x530 [ 95.725134][ T5317] new_device_store+0x24b/0x530 [ 95.727195][ T5317] ? sysfs_file_kobj+0x1a/0x230 [ 95.729035][ T5317] ? sysfs_file_kobj+0x1a/0x230 [ 95.730985][ T5317] ? __pfx_new_device_store+0x10/0x10 [ 95.733344][ T5317] ? sysfs_file_kobj+0x1a/0x230 [ 95.735338][ T5317] ? sysfs_file_kobj+0x1a/0x230 [ 95.737293][ T5317] ? sysfs_file_kobj+0x1e4/0x230 [ 95.739256][ T5317] ? sysfs_kf_write+0x166/0x260 [ 95.741354][ T5317] ? __pfx_sysfs_kf_write+0x10/0x10 [ 95.743539][ T5317] kernfs_fop_write_iter+0x3a4/0x540 [ 95.745683][ T5317] vfs_write+0x612/0xba0 [ 95.747490][ T5317] ? __pfx_vfs_write+0x10/0x10 [ 95.749477][ T5317] ? __fget_files+0x2a/0x420 [ 95.751552][ T5317] ksys_write+0x150/0x270 [ 95.753394][ T5317] ? __pfx_ksys_write+0x10/0x10 [ 95.755601][ T5317] ? __secure_computing+0xe7/0x2b0 [ 95.757913][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.761144][ T5317] do_syscall_64+0x174/0x580 [ 95.763372][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.766008][ T5317] ? clear_bhb_loop+0x70/0xc0 [ 95.768047][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.770657][ T5317] RIP: 0033:0x7f617919e0d9 [ 95.772561][ T5317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.780462][ T5317] RSP: 002b:00007f617a0aafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 95.783921][ T5317] RAX: ffffffffffffffda RBX: 00007f6179425fa0 RCX: 00007f617919e0d9 [ 95.787215][ T5317] RDX: 0000000000000011 RSI: 0000200000000a00 RDI: 0000000000000007 [ 95.790412][ T5317] RBP: 00007f6179235024 R08: 0000000000000000 R09: 0000000000000000 [ 95.793495][ T5317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.796506][ T5317] R13: 00007f6179426038 R14: 00007f6179425fa0 R15: 00007ffc35392c18 [ 95.799819][ T5317] [ 95.801177][ T5317] Modules linked in: [ 95.803522][ T5317] ---[ end trace 0000000000000000 ]--- [ 95.820016][ T5317] RIP: 0010:kasan_byte_accessible+0x12/0x30 [ 95.822474][ T5317] Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 e9 80 96 9f 09 cc 66 66 66 66 66 66 2e [ 95.830817][ T5317] RSP: 0018:ffffc9000e127400 EFLAGS: 00010206 [ 95.833779][ T5317] RAX: dffffc0000000000 RBX: ffffffff81a25d4d RCX: 0000000080000001 [ 95.837678][ T5317] RDX: 0000000000000000 RSI: ffffffff81a25d4d RDI: 0000000000000028 [ 95.841174][ T5317] RBP: ffffffff82569bda R08: 0000000000000001 R09: 0000000000000000 [ 95.844586][ T5317] R10: dffffc0000000000 R11: ffffed100263be4c R12: 0000000000000000 [ 95.848437][ T5317] R13: 0000000000000140 R14: 0000000000000140 R15: 0000000000000001 [ 95.852602][ T5317] FS: 00007f617a0ab6c0(0000) GS:ffff88808c549000(0000) knlGS:0000000000000000 [ 95.856870][ T5317] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.859547][ T5317] CR2: 00007f61792e6360 CR3: 000000000e6fe000 CR4: 0000000000352ef0 [ 95.862935][ T5317] Kernel panic - not syncing: Fatal exception [ 95.865736][ T5317] Kernel Offset: disabled [ 95.867607][ T5317] Rebooting in 86400 seconds..