program: ioctl$SNDRV_TIMER_IOCTL_CREATE(0xffffffffffffffff, 0xc02054a5, &(0x7f0000000000)={0x4, 0xffffffffffffffff, 'id0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/sys/net/ipv4/ping_group_range\x00', 0x40642, 0x0) write$cgroup_int(r1, &(0x7f0000000180)=0xffffffffffffffff, 0x12) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080fa0904"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) mkdir(&(0x7f0000000100)='./mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./mnt\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0) write(r3, &(0x7f0000000a00)='stm32g0-typec 0x3', 0x11) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$netlink(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r5, 0x10e, 0x4, 0x0, 0x0) sendmsg$nl_generic(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="180000002e00010026bdf000fcdbdf1b04000000040010"], 0x18}, 0x1, 0x0, 0x0, 0x4000d}, 0x20008004) close(0x3) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r2, 0x0, &(0x7f0000000280)={0x1c, &(0x7f0000000180)={0x40, 0x30, 0x4, "9574cab3"}, 0x0, 0x0}) syz_usb_control_io(r2, 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_CHANNEL_INFO(r1, 0x80184132, &(0x7f0000000100)) ioctl$F2FS_IOC_RELEASE_VOLATILE_WRITE(r0, 0xf504, 0x0) [ 93.741532][ T5272] Bluetooth: hci0: command tx timeout [ 94.164360][ T804] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 94.314929][ T804] usb 5-1: New USB device found, idVendor=0403, idProduct=c631, bcdDevice= 1.00 [ 94.320703][ T804] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 94.343142][ T804] i2c-tiny-usb 5-1:1.0: version 1.00 found at bus 005 address 002 qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x88000) [ 94.735609][ T804] (null): failure reading functionality [ 94.746554][ T804] i2c i2c-2: failure reading functionality [ 94.770763][ T804] i2c i2c-2: connected i2c-tiny-usb device [ 94.808526][ T5312] i2c i2c-2: failure writing data [ 94.812054][ T1232] usb 5-1: USB disconnect, device number 2 [ 94.826456][ T5312] ucsi-stm32g0-i2c 2-0003: i2c read 03, 00 error: -5 [ 94.838596][ T5312] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000028: 0000 [#1] SMP KASAN NOPTI [ 94.843499][ T5312] KASAN: null-ptr-deref in range [0x0000000000000140-0x0000000000000147] [ 94.847009][ T5312] CPU: 0 UID: 0 PID: 5312 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.850892][ T5312] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.855096][ T5312] RIP: 0010:kasan_byte_accessible+0x12/0x30 [ 94.857749][ T5312] Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cc cc cc cc 66 66 66 66 66 66 2e [ 94.866027][ T5312] RSP: 0000:ffffc9000eec7400 EFLAGS: 00010206 [ 94.868756][ T5312] RAX: dffffc0000000000 RBX: ffffffff81a25e8d RCX: 0000000080000001 [ 94.872193][ T5312] RDX: 0000000000000000 RSI: ffffffff81a25e8d RDI: 0000000000000028 [ 94.875591][ T5312] RBP: ffffffff8257119a R08: 0000000000000001 R09: 0000000000000000 [ 94.878859][ T5312] R10: dffffc0000000000 R11: ffffed1008810ca5 R12: 0000000000000000 [ 94.882055][ T5312] R13: 0000000000000140 R14: 0000000000000140 R15: 0000000000000001 [ 94.885283][ T5312] FS: 00007fa7441c96c0(0000) GS:ffff88808c534000(0000) knlGS:0000000000000000 [ 94.888915][ T5312] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.891738][ T5312] CR2: 000055a02cccb660 CR3: 0000000043117000 CR4: 0000000000352ef0 [ 94.895160][ T5312] Call Trace: [ 94.896630][ T5312] [ 94.897894][ T5312] __kasan_check_byte+0x12/0x40 [ 94.899949][ T5312] lock_acquire+0x84/0x350 [ 94.901960][ T5312] down_write_nested+0x9d/0x210 [ 94.904223][ T5312] ? __simple_recursive_removal+0x9a/0x520 [ 94.906840][ T5312] ? __pfx_down_write_nested+0x10/0x10 [ 94.909260][ T5312] ? do_raw_spin_unlock+0x4d/0x210 [ 94.911578][ T5312] __simple_recursive_removal+0x9a/0x520 [ 94.914021][ T5312] ? mntput+0x65/0xc0 [ 94.915800][ T5312] ? __pfx_remove_one+0x10/0x10 [ 94.917933][ T5312] debugfs_remove+0x5b/0x70 [ 94.919950][ T5312] i2c_device_probe+0x8dc/0xbf0 [ 94.922118][ T5312] ? __pfx_i2c_device_probe+0x10/0x10 [ 94.924451][ T5312] ? sysfs_do_create_link_sd+0xe0/0x110 [ 94.926856][ T5312] ? driver_sysfs_add+0x1fe/0x210 [ 94.929090][ T5312] ? __pfx_i2c_device_probe+0x10/0x10 [ 94.931480][ T5312] really_probe+0x254/0xae0 [ 94.933459][ T5312] __driver_probe_device+0x1e8/0x360 [ 94.935733][ T5312] driver_probe_device+0x4f/0x240 [ 94.937843][ T5312] __device_attach_driver+0x270/0x410 [ 94.940194][ T5312] bus_for_each_drv+0x258/0x2f0 [ 94.942344][ T5312] ? __pfx___device_attach_driver+0x10/0x10 [ 94.944947][ T5312] ? __pfx_bus_for_each_drv+0x10/0x10 [ 94.947291][ T5312] ? lockdep_hardirqs_on+0x7a/0x110 [ 94.949567][ T5312] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 94.952124][ T5312] __device_attach+0x2c4/0x450 [ 94.954142][ T5312] ? __pfx___device_attach+0x10/0x10 [ 94.956404][ T5312] ? do_raw_spin_unlock+0x4d/0x210 [ 94.958483][ T5312] ? _raw_spin_unlock+0x28/0x50 [ 94.960388][ T5312] device_initial_probe+0xa1/0xd0 [ 94.962253][ T5312] bus_probe_device+0x12a/0x220 [ 94.964226][ T5312] device_add+0x7d7/0xb80 [ 94.966139][ T5312] i2c_new_client_device+0xa29/0x1130 [ 94.968431][ T5312] ? __pfx_i2c_new_client_device+0x10/0x10 [ 94.970967][ T5312] ? __mutex_lock+0x30d/0x1550 [ 94.973106][ T5312] ? new_device_store+0x132/0x530 [ 94.975272][ T5312] new_device_store+0x24b/0x530 [ 94.977299][ T5312] ? sysfs_file_kobj+0x1a/0x230 [ 94.979272][ T5312] ? sysfs_file_kobj+0x1a/0x230 [ 94.981343][ T5312] ? __pfx_new_device_store+0x10/0x10 [ 94.983544][ T5312] ? sysfs_file_kobj+0x1a/0x230 [ 94.985505][ T5312] ? sysfs_file_kobj+0x1a/0x230 [ 94.987391][ T5312] ? sysfs_file_kobj+0x1e4/0x230 [ 94.989166][ T5312] ? sysfs_kf_write+0x166/0x260 [ 94.990929][ T5312] ? __pfx_sysfs_kf_write+0x10/0x10 [ 94.992819][ T5312] kernfs_fop_write_iter+0x3a4/0x540 [ 94.994692][ T5312] vfs_write+0x612/0xba0 [ 94.996220][ T5312] ? __pfx_vfs_write+0x10/0x10 [ 94.997950][ T5312] ? __fget_files+0x2a/0x420 [ 94.999615][ T5312] ksys_write+0x150/0x270 [ 95.001033][ T5312] ? __pfx_ksys_write+0x10/0x10 [ 95.002993][ T5312] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.005890][ T5312] do_syscall_64+0x174/0x580 [ 95.007940][ T5312] ? trace_irq_disable+0x3b/0x140 [ 95.010134][ T5312] ? clear_bhb_loop+0x70/0xc0 [ 95.012175][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.014691][ T5312] RIP: 0033:0x7fa74339e0d9 [ 95.016607][ T5312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.024679][ T5312] RSP: 002b:00007fa7441c8fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 95.028200][ T5312] RAX: ffffffffffffffda RBX: 00007fa743625fa0 RCX: 00007fa74339e0d9 [ 95.031598][ T5312] RDX: 0000000000000011 RSI: 0000200000000a00 RDI: 0000000000000004 [ 95.035057][ T5312] RBP: 00007fa743435024 R08: 0000000000000000 R09: 0000000000000000 [ 95.038559][ T5312] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.041881][ T5312] R13: 00007fa743626038 R14: 00007fa743625fa0 R15: 00007fff94b0f888 [ 95.045192][ T5312] [ 95.046480][ T5312] Modules linked in: [ 95.049247][ T5312] ---[ end trace 0000000000000000 ]--- [ 95.052684][ T1232] ------------[ cut here ]------------ [ 95.055094][ T1232] dentry=ffff888044086468 d_flags=0x4080 [ 95.057594][ T1232] WARNING: fs/dcache.c:437 at dentry_free+0x181/0x2e0, CPU#0: kworker/0:3/1232 [ 95.061508][ T1232] Modules linked in: [ 95.063262][ T1232] CPU: 0 UID: 0 PID: 1232 Comm: kworker/0:3 Tainted: G D syzkaller #0 PREEMPT(full) [ 95.068174][ T1232] Tainted: [D]=DIE [ 95.069842][ T1232] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.073823][ T1232] Workqueue: usb_hub_wq hub_event [ 95.075932][ T1232] RIP: 0010:dentry_free+0x19a/0x2e0 [ 95.077984][ T1232] Code: e9 ce fe ff ff e8 a6 cd 76 ff 48 8d 3d 7f ae 0d 0e 48 89 d8 48 c1 e8 03 42 0f b6 04 38 84 c0 0f 85 05 01 00 00 8b 13 48 89 de <67> 48 0f b9 3a e9 d7 fe ff ff e8 77 cd 76 ff 48 8d 3d 60 ae 0d 0e [ 95.085567][ T1232] RSP: 0018:ffffc90001c9f1d0 EFLAGS: 00010246 [ 95.088244][ T1232] RAX: 0000000000000000 RBX: ffff888044086468 RCX: ffff8880339ca580 [ 95.091776][ T1232] RDX: 0000000000004080 RSI: ffff888044086468 RDI: ffffffff905df410 [ 95.095407][ T1232] RBP: 00000000ffffff81 R08: ffff888044086523 R09: 1ffff11008810ca4 [ 95.098879][ T1232] R10: dffffc0000000000 R11: ffffed1008810ca5 R12: ffff888044086520 [ 95.102243][ T1232] R13: 0000000000000000 R14: ffff888044086560 R15: dffffc0000000000 [ 95.105812][ T1232] FS: 0000000000000000(0000) GS:ffff88808c534000(0000) knlGS:0000000000000000 [ 95.109301][ T1232] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.111927][ T1232] CR2: 000055a02ccab7a8 CR3: 000000001f64a000 CR4: 0000000000352ef0 [ 95.115314][ T1232] Call Trace: [ 95.116655][ T1232] [ 95.117925][ T1232] dentry_kill+0x4d3/0x880 [ 95.119848][ T1232] finish_dput+0x1a/0x260 [ 95.121693][ T1232] find_next_child+0x1e7/0x250 [ 95.123717][ T1232] __simple_recursive_removal+0x10b/0x520 [ 95.126251][ T1232] ? __pfx_remove_one+0x10/0x10 [ 95.128480][ T1232] debugfs_remove+0x5b/0x70 [ 95.130358][ T1232] i2c_del_adapter+0x229/0x430 [ 95.132361][ T1232] ? __pfx_rpm_resume+0x10/0x10 [ 95.134529][ T1232] ? __pfx_i2c_del_adapter+0x10/0x10 [ 95.136922][ T1232] ? usb_disable_interface+0x31d/0x350 [ 95.139239][ T1232] i2c_tiny_usb_disconnect+0x49/0xd0 [ 95.141425][ T1232] usb_unbind_interface+0x295/0x9f0 [ 95.143466][ T1232] ? kernfs_remove_by_name_ns+0x101/0x140 [ 95.145849][ T1232] ? kernfs_remove_by_name_ns+0x101/0x140 [ 95.148199][ T1232] ? __pfx_usb_unbind_interface+0x10/0x10 [ 95.150515][ T1232] device_release_driver_internal+0x4f5/0x880 [ 95.153048][ T1232] bus_remove_device+0x444/0x560 [ 95.155215][ T1232] ? __pfx_bus_remove_device+0x10/0x10 [ 95.157503][ T1232] ? kernfs_remove_by_name_ns+0x101/0x140 [ 95.159876][ T1232] device_del+0x524/0x8f0 [ 95.161729][ T1232] ? __pfx_device_del+0x10/0x10 [ 95.163934][ T1232] ? __pfx___mutex_lock+0x10/0x10 [ 95.166256][ T1232] usb_disable_device+0x3d4/0x8d0 [ 95.168508][ T1232] usb_disconnect+0x346/0x9a0 [ 95.170518][ T1232] hub_event+0x1bbb/0x4d30 [ 95.172425][ T1232] ? register_lock_class+0x31/0x2e0 [ 95.174710][ T1232] ? lockdep_hardirqs_on+0x7a/0x110 [ 95.176960][ T1232] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 95.179211][ T1232] ? __pfx_hub_event+0x10/0x10 [ 95.181074][ T1232] ? process_scheduled_works+0xa20/0x14e0 [ 95.183347][ T1232] ? rcu_is_watching+0x15/0xb0 [ 95.185307][ T1232] ? process_scheduled_works+0xa20/0x14e0 [ 95.187563][ T1232] process_scheduled_works+0xa8e/0x14e0 [ 95.189611][ T1232] ? __pfx_process_scheduled_works+0x10/0x10 [ 95.192155][ T1232] ? assign_work+0x3cf/0x5d0 [ 95.194453][ T1232] worker_thread+0xa47/0xfb0 [ 95.196472][ T1232] ? __kthread_parkme+0x71/0x1f0 [ 95.198683][ T1232] kthread+0x388/0x470 [ 95.200488][ T1232] ? __pfx_worker_thread+0x10/0x10 [ 95.202572][ T1232] ? __pfx_kthread+0x10/0x10 [ 95.204651][ T1232] ret_from_fork+0x514/0xb70 [ 95.206627][ T1232] ? __pfx_ret_from_fork+0x10/0x10 [ 95.208838][ T1232] ? __switch_to+0xc89/0x1420 [ 95.210819][ T1232] ? __pfx_kthread+0x10/0x10 [ 95.212802][ T1232] ret_from_fork_asm+0x1a/0x30 [ 95.214946][ T1232] [ 95.216272][ T1232] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 95.219710][ T1232] Kernel Offset: disabled [ 95.221526][ T1232] Rebooting in 86400 seconds..