program:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080fa0904"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
mkdir(&(0x7f0000000100)='./mnt\x00', 0x20)
mount(0x0, &(0x7f0000000300)='./mnt\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000a00)='stm32g0-typec 0x3', 0x11)
r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]})
syz_mount_image$udf(&(0x7f0000000080), &(0x7f00000000c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x4040, &(0x7f00000015c0)=ANY=[], 0x2, 0xc2d, &(0x7f00000001c0)="$eJzs3U9sHNd9B/DfGy3FldxWTOwoThoXm7ZIZcVy9S+mYhXuqqbZBpBlIhRzC8AVSakLUyRBUo1spAXTSw89BCiKHnIi0BoFUjQwmiLokWldILn4UOTUE9HCRlD0wBYBcgoYzOxbcUmRNi2KEmV9Pjb13Z19b+a9eesZWdCbFwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAxB+8cun0mfSwWwEAPEhXRr96+qz7PwA8Vq76/38AAAAAAAAAAAAAADjoUhTxZKSYu7KWxqv3HfXL7b5bt8eGhrevdiRVNQ9V5cuf+pmz585/6YXBC9283J75gPr322fjtdGrlxovz96cm59aWJiabIzNtCdmJ6d2vYe91t/qZHUCGjdfvzV5/fpC4+zz5zZ9fHvg/f4njg9cHHz21DPdsmNDw8OjG0XqveVr99yQjp1meByOIk5Fiue+99PUiogi9n4u6g927Lc6UnXiZNWJsaHhqiPT7dbMYvnhSPdEFBGNnkrN7jnafiyi1vdA+7CzZsRS2fyywSfL7o3OteZb16anGiOt+cX2Ynt2ZiR1Wlv2pxFFXEgRyxGx2n/37vqiiFqk+M6xtXQtIg51z8MXq4nBO7ej2Mc+7kLZzkZfxHLxCIzZAdYfRbwaKX72zomYyNeZ6lrzhYhXy/xBxFtlvhSRyi/G+Yj3tvke8WiqRRF/WY7/xbU0WV0PuteVy19rfGXm+mxP2e515SPeH+66Ujyk+8ORLflgHPBrUz2KaFVX/LV077/ZAQAAAAAAAAAAAAAAAOB+OxJFfCZSvPIff1LNK45qXvqxi4N/OPCrvXPGn/6Q/ZRln4+IpWJ3c3IP54mBI2kkpYc8l/hxVo8i/jTP//vWw24MAAAAAAAAAAAAAAAAAADAY62In0SKF989kZajd03x9syNxtXWtenOqrDdtX+7a6avr6+vN1InmznHcy7lXM65knM1ZxS5fs5mzvGcSzmXc67kXM0Zh3L9nM2c4zmXci7nXMm5mjNquX7OZs7xnEs5l3Ou5FzNGQdk7V4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgI+TIor4RaT49jfWUqSIaEaMRydX+h926wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAUn8q4vuRovFHzTvbahGRqn87TpS/nI/m4TI/Gc3BMl+K5qWcrSprzW89hPazN32piB9Hiv7623cGPI9/X+fdna9BvPXNjXefrXXyUPfDgff7nzh+7OLg8G88vdPrtF0DTl5uz9y63RgbGh4e7dlcy0f/ZM+2gXzc4v50nYhYeOPN11vT01Pz9/6i/Arsofoj9CLVHpeeelG9iNqBaMbD6TuPgfL+/16k+N13/7N7w+/c/+vxK513d+7w8fM/27j/v7h1R7u8/9e21sv3//Kevt39/8mebS/m34301SLqizfn+o5H1BfeePNU+2brxtSNqZnzp09/eXDwy+dO9x2OqF9vT0/1vLovpwsAAAAAAAAAAAAAAADgwUlF/H6kaP14LTUi4nY1X2vg4uCzp545FIeq+Vab5m2/Nnr1UuPl2Ztz81MLC1OTjbGZ9sTs5NRuD1evpnuNDQ3vS2c+1JF9bv+R+suzc2/Mt2/88eK2nx+tX7q2sDjfmtj+4zgSRUSzd8vJqsFjQ8NVo6fbrZmq6si2k+k/ur5UxH9FionzjfT5vC3P/986w3/T/P+lrTvap/n/n+jZVh4zpSJ+Hil+56+ejs9X7Twad52zXO7vIsXJC5/L5eJwWa7bhs5zBTozA8uy/xcp/ukXm8t250M+uVH2zK5P7COiHP9jkeL7f/Hd+M28bfPzH7Yf/6Nbd7RP4/9Uz7ajm55XsOeuk8f/VKR46cm347fytg96/kf32RsncuE7z+fYp/H/VM+2gXzc374/XQcAAAAAAAAAAHik9aUi/j5S/HC4ll7I23bz9/8mt+5on/7+16d7tk3en/WKPvTFnk8qAAAAABwQfamIn0SKG4tv35lDvXn+d8/8z9/bmP85lLZ8Wv05369Vzw24n3/+12sgH3d8790GAAAAAAAAAAAAAAAAAACAAyWlIl7I66mPV/P5J3dcT30lUrzyP8/lcul4Wa67DvxA9Wv9yuzMqUvT07MTrcXWtempxuhca2KqrPtUpFj728/lukW1vnp3vfnOGu8ba7HPR4rhf+iW7azF3l2b/KmNsmfKsp+IFP/9j5vLdtex/tRG2bNl2b+JFF//l+3LHt8oe64s+91I8aOvN7plj5Zlu89H/fRG2ecnZot9GBUAAAAAAAAAAAAAAAAAAAAeN32piD+PFP97c/nOXP68/n9fz9vKW9/sWe9/i9vVOv8D1fr/O72+l/X/q+cKLO10VAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+HhKUcSbkWLuylpa6S/fd9Qvt2du3R4bGt6+2pFU1TxUlS9/6mfOnjv/pRcGL3Tzg+vfb5+J10avXmq8PHtzbn5qYWFqsjE2056YnZza9R72Wn+rk9UJaNx8/dbk9esLjbPPn9v08e2B9/ufOD5wcfDZU890y44NDQ+P9pSp9d3z0e+Sdth+OIr460jx3Pd+mn7YH1HE3s/Fh3x39tuRqhMnq06MDQ1XHZlut2YWyw9HuieiiGj0VGp2z9EDGIs9aUYslc0vG3yy7N7oXGu+dW16qjHSml9sL7ZnZ0ZSp7VlfxpRxIUUsRwRq/13764ving9Unzn2Fr61/6IQ93z8MUro189fXbndhT72MddKNvZ6ItYLh6BMTvA+qOIf44UP3vnRPxbf0QtOj/xhYhXy/xBxFvRGe9UfjHOR7y3zfeIR1Mtivj/cvwvrqV3+svrQfe6cvlrja/MXJ/tKdu9rjzy94cH6YBfm+pRxI+qK/5a+nf/XQMAAAAAAAAAAAAAAAAcIEX8eqR48d0TqZoffGdOcXvmRuNq69p0Z1pfd+5fd870+vr6eiN1splzPOdSzuWcKzlXc0aR6+dslllfXx/P75dyLudcybmaMw7l+jmbOcdzLuVczrmSczVn1HL9nM2c4zmXci7nXMm5mjMOyNw9AAAAAAAAAAAAAAAAAADg46Wo/knx7W+spfX+zvrS49HJFeuBfuz9MgAA//8hX/ir")
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/syz1\x00', 0x200002, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x40d, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MAX_AGE={0x8, 0x3, 0x25}]}}}]}, 0x3c}}, 0x0)
r4 = getpid()
r5 = syz_pidfd_open(r4, 0x0)
setns(r5, 0x24020000)
umount2(&(0x7f0000000040)='.\x00', 0x2)
close_range(r2, 0xffffffffffffffff, 0x200000000000000)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000280)={0x1c, &(0x7f0000000180)={0x40, 0x30, 0x1, "95"}, 0x0, 0x0})
syz_usb_control_io$uac1(r0, &(0x7f00000005c0)={0x14, &(0x7f0000000440)={0x40, 0x24, 0x2, {0x2, 0x22}}, 0x0}, 0x0)
sendmsg$nl_generic(r1, &(0x7f0000001140)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4b00000}, 0xc, &(0x7f0000001100)={&(0x7f0000000e00)=ANY=[@ANYBLOB="f40200001a0080032bbd7000ffdbdf2501000000d002398060003b002a9f2feaf02df9e99f2421aa3105698eed6992f49a971ebec7d106f0095ce244fe1cb71cd53ae1f6bf922fa6df4ed97ebdfa0faec80ecf5db9ed55411eff546289390a469a730acaf7963bc1d14d7df8b7ef67ccdc900c63440c593f95f51f502a9e33c7dd7bc1d18a41ccd9a6a26a54d894a1dea334dda4888c46eefde9b3cbbc0ef69c6029f1227a17ce3e5379159b62d78f2fe787109fd771506c94a6e91d50d494f01f82aa92187a846391781f2c205cb9fe631843b22e4e28731fb4fb0e7b19257429dc9bc04a0604e6afebbedab95d91d7b906567d1b6517aa2addc34c0a88fe41c9acd8c9d6fa85fe5a1122f2146bfafd43f97f5582fdc49feb34082f142ab3ea480c0a8c66e57e8b0481cfcdce5de763433843fd4c8df9aa584f39077496969a8bd527f6323dbbe9a50400238014001200fe8000000000000000000000000000bb3cd3d39e66e26a5afd692c834e142b4a3c0bdc8cc0ac4a5be7f1e5f2960c38cd398692fed9020749c7ca7326761144497d2aca10125a7d531fd421fd3082813cec2884b297e1cdc54c1f31b004b0b0176d06550b2f381d75bf50f809084c32c184890270cb1c7978dc34b8e74eae17436194efbf5cad7ea4b74654f3c3fcc82f55fdd008803be0c6c2b59f5cd8696d89c95317fae347628517a43b877408007100", @ANYRES32=r1, @ANYRES64=r4], 0x2f4}}, 0x44000)
syz_usb_control_io(r0, 0x0, 0x0)
swapoff(&(0x7f0000000040)='./mnt\x00')
[ 93.467986][ T4644] Bluetooth: hci0: command tx timeout
[ 93.495748][ T9] cfg80211: failed to load regulatory.db
[ 93.833592][ T4694] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 93.985181][ T4694] usb 5-1: New USB device found, idVendor=0403, idProduct=c631, bcdDevice= 1.00
[ 93.991457][ T4694] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 94.019113][ T4694] i2c-tiny-usb 5-1:1.0: version 1.00 found at bus 005 address 002
[ 94.416610][ T4694] (null): failure reading functionality
[ 94.431215][ T4694] i2c i2c-2: failure reading functionality
[ 94.482487][ T4694] i2c i2c-2: connected i2c-tiny-usb device
[ 94.526980][ T5318] loop0: detected capacity change from 0 to 2048
[ 94.553177][ T5318] =======================================================
[ 94.553177][ T5318] WARNING: The mand mount option has been deprecated and
[ 94.553177][ T5318] and is ignored by this kernel. Remove the mand
[ 94.553177][ T5318] option from the mount to silence this warning.
[ 94.553177][ T5318] =======================================================
[ 94.630247][ T5318] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000)
[ 94.760477][ T9] usb 5-1: USB disconnect, device number 2
[ 94.771742][ T5317] i2c i2c-2: failure writing data
[ 94.779919][ T5317] ucsi-stm32g0-i2c 2-0003: i2c read 03, 00 error: -5
[ 94.787764][ T5317] ==================================================================
[ 94.787794][ T5317] BUG: KASAN: slab-use-after-free in _raw_spin_lock+0x2e/0x40
[ 94.787885][ T5317] Read of size 1 at addr ffff8880123a8248 by task syz.0.0/5317
[ 94.787897][ T5317]
[ 94.787903][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.787917][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.787925][ T5317] Call Trace:
[ 94.787930][ T5317]
[ 94.787952][ T5317] dump_stack_lvl+0xe8/0x150
[ 94.787974][ T5317] print_address_description+0x55/0x1e0
[ 94.787989][ T5317] ? _raw_spin_lock+0x2e/0x40
[ 94.788001][ T5317] print_report+0x58/0x70
[ 94.788015][ T5317] kasan_report+0x117/0x150
[ 94.788029][ T5317] ? _raw_spin_lock+0x2e/0x40
[ 94.788044][ T5317] __kasan_check_byte+0x2a/0x40
[ 94.788055][ T5317] lock_acquire+0x7d/0x350
[ 94.788069][ T5317] ? do_raw_spin_lock+0x12b/0x2f0
[ 94.788084][ T5317] _raw_spin_lock+0x2e/0x40
[ 94.788095][ T5317] ? lockref_get+0x15/0x60
[ 94.788141][ T5317] lockref_get+0x15/0x60
[ 94.788157][ T5317] __simple_recursive_removal+0x33/0x520
[ 94.788168][ T5317] ? mntput+0x65/0xc0
[ 94.788177][ T5317] ? __pfx_remove_one+0x10/0x10
[ 94.788191][ T5317] debugfs_remove+0x5b/0x70
[ 94.788202][ T5317] i2c_device_probe+0x8dc/0xbf0
[ 94.788217][ T5317] ? __pfx_i2c_device_probe+0x10/0x10
[ 94.788230][ T5317] ? sysfs_do_create_link_sd+0xe0/0x110
[ 94.788246][ T5317] ? driver_sysfs_add+0x1fe/0x210
[ 94.788264][ T5317] ? __pfx_i2c_device_probe+0x10/0x10
[ 94.788275][ T5317] really_probe+0x254/0xae0
[ 94.788291][ T5317] __driver_probe_device+0x1e8/0x360
[ 94.788308][ T5317] driver_probe_device+0x4f/0x240
[ 94.788324][ T5317] __device_attach_driver+0x270/0x410
[ 94.788341][ T5317] bus_for_each_drv+0x258/0x2f0
[ 94.788353][ T5317] ? __pfx___device_attach_driver+0x10/0x10
[ 94.788368][ T5317] ? __pfx_bus_for_each_drv+0x10/0x10
[ 94.788380][ T5317] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 94.788396][ T5317] __device_attach+0x2c4/0x450
[ 94.788412][ T5317] ? __pfx___device_attach+0x10/0x10
[ 94.788426][ T5317] ? do_raw_spin_unlock+0x4d/0x200
[ 94.788440][ T5317] ? _raw_spin_unlock+0x28/0x50
[ 94.788454][ T5317] device_initial_probe+0xa1/0xd0
[ 94.788469][ T5317] bus_probe_device+0x12a/0x220
[ 94.788480][ T5317] device_add+0x7d7/0xb80
[ 94.788500][ T5317] i2c_new_client_device+0xa29/0x1130
[ 94.788514][ T5317] ? __pfx_i2c_new_client_device+0x10/0x10
[ 94.788527][ T5317] ? __mutex_lock+0x30b/0x1550
[ 94.788542][ T5317] ? new_device_store+0x132/0x530
[ 94.788557][ T5317] new_device_store+0x24b/0x530
[ 94.788573][ T5317] ? lock_acquire+0x115/0x350
[ 94.788591][ T5317] ? sysfs_file_kobj+0x1a/0x230
[ 94.788606][ T5317] ? __pfx_new_device_store+0x10/0x10
[ 94.788623][ T5317] ? sysfs_file_kobj+0x1a/0x230
[ 94.788634][ T5317] ? sysfs_file_kobj+0x1a/0x230
[ 94.788646][ T5317] ? sysfs_file_kobj+0x1e4/0x230
[ 94.788658][ T5317] ? sysfs_kf_write+0x166/0x260
[ 94.788672][ T5317] ? __pfx_sysfs_kf_write+0x10/0x10
[ 94.788685][ T5317] kernfs_fop_write_iter+0x3a4/0x540
[ 94.788698][ T5317] vfs_write+0x612/0xba0
[ 94.788713][ T5317] ? __pfx_vfs_write+0x10/0x10
[ 94.788727][ T5317] ? __fget_files+0x2a/0x420
[ 94.788740][ T5317] ksys_write+0x150/0x270
[ 94.788754][ T5317] ? __pfx_ksys_write+0x10/0x10
[ 94.788770][ T5317] do_syscall_64+0x166/0x520
[ 94.788784][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.788799][ T5317] ? clear_bhb_loop+0x70/0xc0
[ 94.788811][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.788823][ T5317] RIP: 0033:0x7f168cf9e159
[ 94.788836][ T5317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.788845][ T5317] RSP: 002b:00007f168de35fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 94.788859][ T5317] RAX: ffffffffffffffda RBX: 00007f168d225fa0 RCX: 00007f168cf9e159
[ 94.788870][ T5317] RDX: 0000000000000011 RSI: 0000200000000a00 RDI: 0000000000000004
[ 94.788878][ T5317] RBP: 00007f168d035024 R08: 0000000000000000 R09: 0000000000000000
[ 94.788886][ T5317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.788893][ T5317] R13: 00007f168d226038 R14: 00007f168d225fa0 R15: 00007ffde32c8e98
[ 94.788907][ T5317]
[ 94.788911][ T5317]
[ 94.788914][ T5317] Allocated by task 5317:
[ 94.788920][ T5317] kasan_save_track+0x3e/0x80
[ 94.788937][ T5317] __kasan_slab_alloc+0x6c/0x80
[ 94.788952][ T5317] kmem_cache_alloc_lru_noprof+0x2a3/0x5f0
[ 94.788966][ T5317] __d_alloc+0x37/0x6f0
[ 94.788978][ T5317] d_alloc+0x4b/0x190
[ 94.788990][ T5317] lookup_one_qstr_excl+0xd8/0x360
[ 94.789002][ T5317] start_dirop+0x5c/0x90
[ 94.789013][ T5317] simple_start_creating+0xcc/0x110
[ 94.789026][ T5317] debugfs_start_creating+0xca/0x1b0
[ 94.789038][ T5317] debugfs_create_dir+0x24/0x350
[ 94.789048][ T5317] i2c_device_probe+0x814/0xbf0
[ 94.789059][ T5317] really_probe+0x254/0xae0
[ 94.789075][ T5317] __driver_probe_device+0x1e8/0x360
[ 94.789088][ T5317] driver_probe_device+0x4f/0x240
[ 94.789103][ T5317] __device_attach_driver+0x270/0x410
[ 94.789118][ T5317] bus_for_each_drv+0x258/0x2f0
[ 94.789130][ T5317] __device_attach+0x2c4/0x450
[ 94.789143][ T5317] device_initial_probe+0xa1/0xd0
[ 94.789157][ T5317] bus_probe_device+0x12a/0x220
[ 94.789168][ T5317] device_add+0x7d7/0xb80
[ 94.789179][ T5317] i2c_new_client_device+0xa29/0x1130
[ 94.789191][ T5317] new_device_store+0x24b/0x530
[ 94.789203][ T5317] kernfs_fop_write_iter+0x3a4/0x540
[ 94.789212][ T5317] vfs_write+0x612/0xba0
[ 94.789224][ T5317] ksys_write+0x150/0x270
[ 94.789235][ T5317] do_syscall_64+0x166/0x520
[ 94.789248][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.789258][ T5317]
[ 94.789261][ T5317] Freed by task 15:
[ 94.789266][ T5317] kasan_save_track+0x3e/0x80
[ 94.789279][ T5317] kasan_save_free_info+0x40/0x50
[ 94.789291][ T5317] __kasan_slab_free+0x5c/0x80
[ 94.789306][ T5317] kmem_cache_free+0x182/0x650
[ 94.789320][ T5317] rcu_core+0x926/0x1260
[ 94.789330][ T5317] handle_softirqs+0x226/0x860
[ 94.789343][ T5317] run_ksoftirqd+0x36/0x60
[ 94.789356][ T5317] smpboot_thread_fn+0x565/0xa70
[ 94.789372][ T5317] kthread+0x38b/0x480
[ 94.789381][ T5317] ret_from_fork+0x514/0xb70
[ 94.789392][ T5317] ret_from_fork_asm+0x1a/0x30
[ 94.789407][ T5317]
[ 94.789410][ T5317] Last potentially related work creation:
[ 94.789414][ T5317] kasan_save_stack+0x3e/0x60
[ 94.789427][ T5317] kasan_record_aux_stack+0xbd/0xd0
[ 94.789439][ T5317] call_rcu+0xee/0x8b0
[ 94.789450][ T5317] dentry_kill+0x4d3/0x880
[ 94.789464][ T5317] finish_dput+0x1a/0x260
[ 94.789475][ T5317] find_next_child+0x1e7/0x250
[ 94.789484][ T5317] __simple_recursive_removal+0x10b/0x520
[ 94.789495][ T5317] debugfs_remove+0x5b/0x70
[ 94.789506][ T5317] i2c_del_adapter+0x229/0x430
[ 94.789518][ T5317] i2c_tiny_usb_disconnect+0x49/0xd0
[ 94.789530][ T5317] usb_unbind_interface+0x295/0x9f0
[ 94.789547][ T5317] device_release_driver_internal+0x4f5/0x880
[ 94.789563][ T5317] bus_remove_device+0x444/0x560
[ 94.789574][ T5317] device_del+0x524/0x8f0
[ 94.789595][ T5317] usb_disable_device+0x3d4/0x8d0
[ 94.789610][ T5317] usb_disconnect+0x346/0x9a0
[ 94.789622][ T5317] hub_event+0x1bbb/0x4d30
[ 94.789635][ T5317] process_scheduled_works+0xc3d/0x1630
[ 94.789653][ T5317] worker_thread+0xa47/0xfb0
[ 94.789665][ T5317] kthread+0x38b/0x480
[ 94.789674][ T5317] ret_from_fork+0x514/0xb70
[ 94.789684][ T5317] ret_from_fork_asm+0x1a/0x30
[ 94.789700][ T5317]
[ 94.789703][ T5317] The buggy address belongs to the object at ffff8880123a8178
[ 94.789703][ T5317] which belongs to the cache dentry of size 312
[ 94.789713][ T5317] The buggy address is located 208 bytes inside of
[ 94.789713][ T5317] freed 312-byte region [ffff8880123a8178, ffff8880123a82b0)
[ 94.789725][ T5317]
[ 94.789728][ T5317] The buggy address belongs to the physical page:
[ 94.789735][ T5317] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x123a8
[ 94.789747][ T5317] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 94.789755][ T5317] memcg:ffff8880126cc001
[ 94.789760][ T5317] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 94.789771][ T5317] page_type: f5(slab)
[ 94.789783][ T5317] raw: 00fff00000000040 ffff88801c6e88c0 dead000000000100 dead000000000122
[ 94.789794][ T5317] raw: 0000000000000000 0000000200150015 00000000f5000000 ffff8880126cc001
[ 94.789803][ T5317] head: 00fff00000000040 ffff88801c6e88c0 dead000000000100 dead000000000122
[ 94.789813][ T5317] head: 0000000000000000 0000000200150015 00000000f5000000 ffff8880126cc001
[ 94.789823][ T5317] head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
[ 94.789833][ T5317] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[ 94.789839][ T5317] page dumped because: kasan: bad access detected
[ 94.789846][ T5317] page_owner tracks the page as allocated
[ 94.789850][ T5317] page last allocated via order 1, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_RECLAIMABLE|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4696, tgid 4696 (udevadm), ts 35997582296
[ 94.789868][ T5317] post_alloc_hook+0x1f9/0x250
[ 94.789882][ T5317] get_page_from_freelist+0x2209/0x2280
[ 94.789897][ T5317] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 94.789911][ T5317] allocate_slab+0x7d/0x620
[ 94.789922][ T5317] refill_objects+0x2d5/0x350
[ 94.789932][ T5317] __pcs_replace_empty_main+0x2c8/0x6c0
[ 94.789942][ T5317] kmem_cache_alloc_lru_noprof+0x383/0x5f0
[ 94.789955][ T5317] __d_alloc+0x37/0x6f0
[ 94.789967][ T5317] d_alloc_parallel+0xde/0x16b0
[ 94.789980][ T5317] lookup_open+0x2c7/0x1a40
[ 94.789992][ T5317] path_openat+0x677/0x1d60
[ 94.790005][ T5317] do_file_open+0x23e/0x4a0
[ 94.790022][ T5317] do_sys_openat2+0x115/0x200
[ 94.790031][ T5317] __x64_sys_openat+0x138/0x170
[ 94.790041][ T5317] do_syscall_64+0x166/0x520
[ 94.790055][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.790066][ T5317] page last free pid 1 tgid 1 ts 29842755707 stack trace:
[ 94.790074][ T5317] __free_frozen_pages+0xc93/0xd90
[ 94.790086][ T5317] free_reserved_area+0x204/0x2e0
[ 94.790100][ T5317] free_kernel_image_pages+0xa2/0x100
[ 94.790114][ T5317] kernel_init+0x36/0x1d0
[ 94.790125][ T5317] ret_from_fork+0x514/0xb70
[ 94.790133][ T5317] ret_from_fork_asm+0x1a/0x30
[ 94.790150][ T5317]
[ 94.790152][ T5317] Memory state around the buggy address:
[ 94.790158][ T5317] ffff8880123a8100: fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc fa
[ 94.790166][ T5317] ffff8880123a8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 94.790174][ T5317] >ffff8880123a8200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 94.790179][ T5317] ^
[ 94.790186][ T5317] ffff8880123a8280: fb fb fb fb fb fb fc fc fc fc fc fc fc fc 00 00
[ 94.790193][ T5317] ffff8880123a8300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 94.790199][ T5317] ==================================================================
[ 94.790302][ T5317] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 95.250474][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 95.254384][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.258652][ T5317] Call Trace:
[ 95.260146][ T5317]
[ 95.261434][ T5317] vpanic+0x56d/0xa60
[ 95.263159][ T5317] ? rcu_is_watching+0x16/0xb0
[ 95.265225][ T5317] ? __pfx_vpanic+0x10/0x10
[ 95.267214][ T5317] panic+0xc5/0xd0
[ 95.268913][ T5317] ? __pfx_panic+0x10/0x10
[ 95.270855][ T5317] ? _raw_spin_lock+0x2e/0x40
[ 95.272841][ T5317] ? _raw_spin_lock+0x2e/0x40
[ 95.274777][ T5317] check_panic_on_warn+0x89/0xb0
[ 95.276901][ T5317] ? _raw_spin_lock+0x2e/0x40
[ 95.278933][ T5317] end_report+0x73/0x170
[ 95.280920][ T5317] ? _raw_spin_lock+0x2e/0x40
[ 95.282939][ T5317] kasan_report+0x128/0x150
[ 95.284987][ T5317] ? _raw_spin_lock+0x2e/0x40
[ 95.287209][ T5317] __kasan_check_byte+0x2a/0x40
[ 95.289154][ T5317] lock_acquire+0x7d/0x350
[ 95.291046][ T5317] ? do_raw_spin_lock+0x12b/0x2f0
[ 95.293169][ T5317] _raw_spin_lock+0x2e/0x40
[ 95.295048][ T5317] ? lockref_get+0x15/0x60
[ 95.296928][ T5317] lockref_get+0x15/0x60
[ 95.298858][ T5317] __simple_recursive_removal+0x33/0x520
[ 95.301283][ T5317] ? mntput+0x65/0xc0
[ 95.303052][ T5317] ? __pfx_remove_one+0x10/0x10
[ 95.305167][ T5317] debugfs_remove+0x5b/0x70
[ 95.307163][ T5317] i2c_device_probe+0x8dc/0xbf0
[ 95.309354][ T5317] ? __pfx_i2c_device_probe+0x10/0x10
[ 95.311773][ T5317] ? sysfs_do_create_link_sd+0xe0/0x110
[ 95.314124][ T5317] ? driver_sysfs_add+0x1fe/0x210
[ 95.316290][ T5317] ? __pfx_i2c_device_probe+0x10/0x10
[ 95.318555][ T5317] really_probe+0x254/0xae0
[ 95.320563][ T5317] __driver_probe_device+0x1e8/0x360
[ 95.322894][ T5317] driver_probe_device+0x4f/0x240
[ 95.325098][ T5317] __device_attach_driver+0x270/0x410
[ 95.327372][ T5317] bus_for_each_drv+0x258/0x2f0
[ 95.329482][ T5317] ? __pfx___device_attach_driver+0x10/0x10
[ 95.332060][ T5317] ? __pfx_bus_for_each_drv+0x10/0x10
[ 95.334392][ T5317] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 95.336977][ T5317] __device_attach+0x2c4/0x450
[ 95.339150][ T5317] ? __pfx___device_attach+0x10/0x10
[ 95.341549][ T5317] ? do_raw_spin_unlock+0x4d/0x200
[ 95.343842][ T5317] ? _raw_spin_unlock+0x28/0x50
[ 95.346026][ T5317] device_initial_probe+0xa1/0xd0
[ 95.348320][ T5317] bus_probe_device+0x12a/0x220
[ 95.350375][ T5317] device_add+0x7d7/0xb80
[ 95.352248][ T5317] i2c_new_client_device+0xa29/0x1130
[ 95.354494][ T5317] ? __pfx_i2c_new_client_device+0x10/0x10
[ 95.356936][ T5317] ? __mutex_lock+0x30b/0x1550
[ 95.358767][ T5317] ? new_device_store+0x132/0x530
[ 95.360559][ T5317] new_device_store+0x24b/0x530
[ 95.362663][ T5317] ? lock_acquire+0x115/0x350
[ 95.364974][ T5317] ? sysfs_file_kobj+0x1a/0x230
[ 95.367050][ T5317] ? __pfx_new_device_store+0x10/0x10
[ 95.369516][ T5317] ? sysfs_file_kobj+0x1a/0x230
[ 95.371663][ T5317] ? sysfs_file_kobj+0x1a/0x230
[ 95.373688][ T5317] ? sysfs_file_kobj+0x1e4/0x230
[ 95.375650][ T5317] ? sysfs_kf_write+0x166/0x260
[ 95.377637][ T5317] ? __pfx_sysfs_kf_write+0x10/0x10
[ 95.379891][ T5317] kernfs_fop_write_iter+0x3a4/0x540
[ 95.382190][ T5317] vfs_write+0x612/0xba0
[ 95.384018][ T5317] ? __pfx_vfs_write+0x10/0x10
[ 95.386084][ T5317] ? __fget_files+0x2a/0x420
[ 95.388077][ T5317] ksys_write+0x150/0x270
[ 95.389908][ T5317] ? __pfx_ksys_write+0x10/0x10
[ 95.392066][ T5317] do_syscall_64+0x166/0x520
[ 95.394034][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.396559][ T5317] ? clear_bhb_loop+0x70/0xc0
[ 95.398556][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.401107][ T5317] RIP: 0033:0x7f168cf9e159
[ 95.402983][ T5317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 95.411000][ T5317] RSP: 002b:00007f168de35fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 95.414526][ T5317] RAX: ffffffffffffffda RBX: 00007f168d225fa0 RCX: 00007f168cf9e159
[ 95.417919][ T5317] RDX: 0000000000000011 RSI: 0000200000000a00 RDI: 0000000000000004
[ 95.421244][ T5317] RBP: 00007f168d035024 R08: 0000000000000000 R09: 0000000000000000
[ 95.424672][ T5317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 95.428130][ T5317] R13: 00007f168d226038 R14: 00007f168d225fa0 R15: 00007ffde32c8e98
[ 95.431870][ T5317]
[ 95.433498][ T5317] Kernel Offset: disabled
[ 95.435347][ T5317] Rebooting in 86400 seconds..