program: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080fa0904"], 0x0) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) close(0x4) syz_usb_control_io(r0, 0x0, 0x0) mprotect(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1000001) syz_usb_control_io(r0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x1b, &(0x7f0000000000)={@remote}, 0x20) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRES16], 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x0) r3 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) setsockopt$inet_msfilter(r3, 0x0, 0x29, &(0x7f0000000000)=ANY=[@ANYBLOB="e00000027fa80a010100000004"], 0x57) r4 = socket$netlink(0x10, 0x3, 0x0) close(0x3) writev(r4, &(0x7f00000003c0)=[{&(0x7f0000000380)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fdd411efc40800040000000000000000", 0x39}], 0x1) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x22, 0xf, {[@local=@item_4={0x3, 0x2, 0x0, "f896e404"}, @local=@item_012={0x1, 0x2, 0x0, 'e'}, @main=@item_012={0x2, 0x0, 0x9, "f792"}, @main=@item_4={0x3, 0x0, 0x0, "9ef12d19"}]}}, 0x0}, 0x0) r5 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) ioctl$HIDIOCGUSAGES(r5, 0xd01c4813, &(0x7f0000000800)={{0x2, 0x200, 0x100, 0x8, 0x7}, 0x171, [0x2, 0x2, 0x100, 0x1000, 0xaca7, 0x0, 0x3, 0x2, 0x3, 0x9, 0xce, 0xa5c, 0x7, 0x5, 0x9, 0x200, 0xdd, 0x5, 0x8, 0x4, 0x8, 0x8, 0x7f, 0x200800, 0x4, 0x7, 0x10, 0x1000, 0x6, 0x7, 0x1, 0x5, 0x669e, 0x2, 0x45800000, 0xf8e, 0x8, 0x5, 0xc8, 0x4, 0xfffffffb, 0x8, 0x3, 0x7, 0x8, 0x7, 0x8, 0x0, 0x2, 0x3fac221c, 0x0, 0x3, 0x46f, 0x3ff, 0x9, 0xfffffffa, 0x4, 0x2, 0x10001, 0x4, 0x20000, 0x170, 0x3, 0x3, 0x7b, 0xfffffff0, 0x200, 0x19, 0x5, 0x80, 0x0, 0xffff6712, 0xee, 0xb99, 0x9, 0x4000, 0x60ca, 0x10000, 0x3, 0x54, 0x1000, 0x2, 0x8001, 0x4, 0x3d2, 0xe, 0x3, 0xd, 0x4, 0x4, 0x3ff, 0x4, 0x3, 0x2, 0x0, 0x3, 0x2, 0x800, 0x7, 0x40, 0x3, 0x2, 0x8, 0xfffffb96, 0xffff, 0x7, 0xffffff53, 0x6, 0x4a, 0x8, 0xa6b6, 0x3, 0x0, 0x5, 0x0, 0x4, 0x0, 0x3, 0x90, 0x8, 0x5, 0xff, 0x6, 0x2, 0x6, 0x9f2, 0x4, 0x660b, 0x7cb, 0x0, 0x10, 0x9, 0x1, 0x9, 0x7, 0x2, 0xa48, 0xffff0001, 0x7, 0x25, 0xfffffeff, 0x63, 0x6, 0x80000000, 0x401, 0x10000, 0x0, 0xd5, 0x38000, 0x8428, 0x40, 0x4, 0x5, 0x3c0000, 0x1, 0x1, 0x6, 0x4, 0x9, 0x8, 0x3, 0x0, 0x100, 0x3, 0x7, 0x8, 0x1ce1, 0x9, 0xffffffff, 0x0, 0x0, 0x3ff, 0x0, 0x8, 0x5, 0x8, 0x1, 0x7, 0x80000001, 0x0, 0x9, 0x0, 0x5, 0x1, 0x7, 0x80, 0x10001, 0x7, 0x7, 0x2040000, 0x3, 0x1, 0xffff, 0x9, 0x1, 0x10000, 0x7d, 0x2, 0x68000000, 0x57, 0x1, 0x10000, 0xfffffffb, 0x5, 0xeda9, 0x4, 0x1, 0x7, 0x5, 0x10, 0x9, 0x400, 0x80000000, 0x9, 0x7, 0xdb56, 0x8000, 0x1, 0x7, 0xfff, 0x3, 0x5, 0x3, 0x2, 0x1, 0x7ff, 0x0, 0xfff, 0x80000000, 0x3, 0x3, 0x1, 0xdcd, 0x7f, 0xe0, 0xac, 0x6, 0xffff0000, 0x6, 0x4c360684, 0xb9, 0x520b, 0x3, 0x8, 0x1, 0x1, 0x2, 0x8, 0xc, 0x9, 0x9, 0x7, 0xb7e, 0xffff, 0x7ff, 0xffffffff, 0x84e, 0x0, 0x6, 0x1, 0x8001, 0x4, 0x8, 0x2, 0x6, 0x85, 0xfffffff9, 0x3, 0xa, 0x7, 0x9, 0x8, 0x200, 0x4, 0x0, 0x1000, 0x0, 0x4, 0x8, 0xdd85, 0x237, 0x8, 0x9, 0x4, 0x10000, 0x1, 0x1ff, 0xffffff53, 0x3, 0x1ff, 0x6, 0x5, 0xff, 0x1, 0x9, 0x6, 0x24000000, 0x8001, 0x0, 0x5, 0x9, 0x7fffffff, 0x7ff, 0x9, 0x5, 0x2, 0x2, 0x93, 0x200, 0x7, 0x1000, 0x8, 0xbc, 0x40, 0x81, 0x2, 0x1, 0x6, 0x3, 0x7f, 0xb, 0x8, 0xc1, 0x80000001, 0xfffffff3, 0x7, 0x2, 0x4, 0x7, 0x0, 0xffff, 0x0, 0x6, 0x8, 0x8, 0xffff, 0x5, 0x8001, 0x10, 0x518, 0x8, 0x3, 0x5, 0xffffffff, 0x8000, 0x1, 0x5, 0x7, 0xd4, 0x5033, 0xb7ec, 0xfffffff8, 0x0, 0x6, 0x5, 0x80, 0x2ad, 0x7, 0xfff, 0xfffffe00, 0xfff, 0x1ff, 0x5833392c, 0x1, 0x3, 0x1000, 0xb86e, 0x18, 0x4, 0x81, 0x362, 0x6, 0x7, 0x80000001, 0x4, 0xb, 0x4ed, 0x80, 0x56, 0x0, 0x9, 0xffffff7f, 0x5, 0xa3500000, 0x0, 0x8, 0xff, 0x5, 0x5, 0x0, 0x7ff, 0x9, 0x7, 0xe, 0xd0, 0x2, 0x5ac, 0x7, 0x0, 0x101, 0x2, 0x2, 0x8, 0x67, 0x7ff, 0x2, 0x300, 0x7, 0x7fffffff, 0x3, 0x0, 0x793, 0x1, 0x0, 0x720, 0x3, 0x9, 0xff000, 0x8, 0xf, 0xf5, 0x5, 0xfffffff9, 0xff, 0xfffffff7, 0x80000000, 0xb, 0x3, 0x327, 0xffff, 0x8, 0x6, 0x2, 0xb4, 0x7, 0x7, 0x5, 0x4, 0x47, 0x1, 0x80, 0xffff, 0x7fffffff, 0x3, 0x0, 0x483d, 0xa, 0x1, 0x7ff, 0x4, 0x3, 0x400, 0x9, 0x401, 0x6, 0x1, 0x4, 0x2, 0x401, 0x2, 0xcdd4, 0x7f, 0x7, 0x7fffffff, 0x57, 0x4, 0x457a, 0x9, 0xf, 0x7, 0xa, 0x8, 0x92e, 0x9, 0x1, 0x85, 0x7, 0x7, 0x8000, 0x213, 0x2, 0x2d, 0x6, 0x7f, 0xff, 0x0, 0x0, 0x8, 0x4, 0x5, 0xa, 0x3, 0x200, 0x2, 0x6, 0x35, 0x800, 0x3, 0x8, 0x8, 0x7fffffff, 0x2, 0x2, 0x400, 0x81, 0x2, 0x3, 0xe1, 0x8, 0x3, 0x6, 0x31, 0x40, 0x7, 0x5, 0xffffffff, 0xfc, 0x821, 0x2, 0x1, 0xb, 0x9, 0x6292ab8b, 0x2, 0x10001, 0xc4, 0xfffffff6, 0x50, 0x80, 0x96, 0x7, 0x8001, 0x7, 0x7, 0x4, 0x4, 0x7a0, 0x7, 0x1, 0xfffffff9, 0x9, 0xc, 0x3, 0x8000, 0x6, 0x6, 0x7, 0x8, 0x6, 0x81, 0x5, 0x5, 0xfffffff8, 0x4, 0x2, 0x9, 0x9, 0xff, 0x81, 0x800, 0x9, 0x1, 0x1000, 0x0, 0x6, 0x4, 0x0, 0xffff, 0x80000001, 0x3, 0x5, 0x1, 0x6, 0x200, 0x2e, 0xff, 0x3, 0xffff1377, 0xffffffff, 0x0, 0x6, 0xb142, 0x0, 0x6, 0x6, 0x2, 0x1, 0x8, 0xd, 0x1, 0xceb, 0x8, 0x9, 0x3, 0x1, 0x6, 0xfffffff9, 0x1, 0x4, 0x5, 0x7, 0x1ff, 0x8001, 0x8, 0x6, 0xc, 0xfc000000, 0x9, 0x9, 0x6, 0x7, 0x3, 0x5, 0x2, 0x10000, 0x2, 0x7, 0x7, 0x800, 0x3824, 0x6, 0x9, 0xa, 0x64c, 0x1, 0x92, 0x1, 0xd3d5, 0x6, 0xb4, 0xfffffff7, 0x0, 0x4, 0x2, 0x200, 0x3, 0x7, 0x6, 0xd, 0xd, 0x6ab, 0x2, 0x74f, 0x1, 0x800, 0x80, 0x7, 0x5, 0x7ff, 0xf, 0x4, 0xff56, 0xa04, 0x8, 0xffff8000, 0x7, 0xa09, 0x6, 0x6d, 0x6ae2348a, 0xfffffffe, 0x7f, 0x2, 0xa5d, 0x5, 0x0, 0x7, 0x5a2a, 0x2, 0x3, 0x0, 0x72f2, 0xd, 0x6, 0x4, 0x6, 0x101, 0x0, 0x10001, 0x9, 0x9, 0xf6e, 0x7, 0x32d, 0x2, 0x7, 0xfffffff9, 0x6ee568fd, 0x5, 0x4d6, 0xee3, 0x1, 0x8, 0x2, 0xfffffffe, 0x6, 0xc, 0x5, 0x10001, 0x2, 0x10000, 0x31, 0x0, 0x4, 0x3, 0x71, 0x5, 0x4ffd, 0x30, 0x4c41b35, 0x0, 0x2, 0x9e, 0x0, 0xffff, 0x8, 0x6, 0x2, 0x4, 0x3, 0x2, 0x7, 0x6, 0xa, 0x8, 0x80, 0x5, 0x9, 0x8, 0x1731, 0xe4, 0xb, 0x0, 0x2, 0x0, 0x25d, 0x8, 0x7, 0x64, 0xff, 0x4, 0x59, 0x100, 0x2, 0xffffffff, 0x7fff, 0x7, 0x1, 0xbd8, 0x1000, 0xd, 0xfffffffb, 0x863c, 0xbf, 0x9, 0x0, 0x7, 0x3, 0xffff, 0x8, 0x1, 0x8, 0xa6, 0x8, 0x4, 0x1ff, 0x80000001, 0x7, 0xf, 0x6, 0xd, 0x40, 0xb51c, 0x5, 0x80000001, 0xa0b, 0x1fe, 0x6, 0x0, 0x7, 0x7, 0xfff, 0x200, 0x101, 0xa72, 0x6, 0x2, 0x5, 0x1, 0xf, 0x8, 0x2, 0x3, 0x80, 0x8, 0xf, 0x4, 0x40, 0x6, 0x5, 0x8, 0x0, 0x2, 0x7, 0x6, 0x4, 0x7ff, 0xf5, 0x8, 0xe00000, 0x8, 0x8, 0x401, 0x40, 0xff, 0x9, 0x8, 0xfffffff5, 0x25c9, 0x6, 0x5, 0x8, 0x3, 0x5, 0x3b4, 0x2, 0x3, 0x5, 0x3, 0x468f, 0x8000, 0x8, 0x1, 0x7, 0xcd, 0x6, 0x5, 0x4, 0x1cf211cf, 0x9, 0x6, 0x4, 0x7f, 0x4, 0x80000000, 0x8, 0x6, 0xfffffffa, 0xeb, 0x3, 0x0, 0x1082, 0x4, 0x9, 0xc09, 0x2, 0xfff, 0x0, 0x8, 0x6, 0x9, 0xbcfc, 0x3, 0xb, 0x3ff, 0x1, 0x3, 0x375f, 0x6, 0x2, 0xc75, 0xf, 0x7, 0x9, 0x727, 0x4, 0x4, 0x80, 0x8, 0x3, 0x993, 0x6, 0x6, 0x8, 0x7, 0x0, 0x9, 0xfffff682, 0x1, 0xd, 0xfffff423, 0x510, 0x7, 0x2, 0x4, 0xa, 0x8, 0x8001, 0x9, 0x9, 0x1, 0x9, 0x2, 0x0, 0xff, 0xffffce5f, 0xe, 0xfffffffc, 0x7, 0x4dfe, 0x1, 0x7, 0x3, 0x1, 0xbf, 0xbbbd, 0x7fff, 0x0, 0x1, 0x8, 0xfffffff9, 0x34b, 0x6, 0x8, 0xffffffff, 0x280, 0x4fa0, 0x0, 0x200, 0x4, 0x4, 0x6b79, 0x3, 0x3ff, 0x4, 0x6, 0x81, 0x401, 0x6, 0x7, 0xfffffff8, 0x9, 0x9, 0x2000000, 0x0, 0xc7, 0x8, 0x4, 0x6, 0x3ff, 0x4, 0xfa0c, 0x14, 0x81, 0x1, 0x8, 0xffffff81, 0x9, 0x3, 0x80000000, 0x7fff, 0x9, 0xe, 0x80, 0x8001, 0x5, 0x0, 0xe, 0x6, 0xa, 0x6ea4, 0x2, 0x6fc, 0x2, 0x5, 0x3, 0x5d, 0x616b094e, 0x10000, 0xee5, 0x10000, 0x4, 0x7, 0x5, 0x101, 0x7, 0x7, 0x3, 0x9, 0x40c0, 0x88d9, 0x4, 0x1, 0x6, 0xd, 0x8000, 0x0, 0x0, 0x1, 0xf392, 0x6, 0x0, 0x611, 0xfffffffe, 0xf, 0x1, 0x7fff, 0x4, 0x3, 0x7ff, 0x6, 0x0, 0x4, 0x2, 0x1, 0x9, 0x5a24da07, 0x7, 0x5, 0x0, 0xff, 0x8, 0x74f, 0x81]}) syz_emit_ethernet(0x36, &(0x7f0000000240)={@local, @link_local, @void, {@ipv6={0x86dd, @generic={0x9, 0x6, "0c3f18", 0x0, 0x852dbfdc089a11b, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, @remote}}}}, 0x0) mkdir(&(0x7f0000000100)='./mnt\x00', 0x1ff) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000000040)={r1, 0x10, 0x3, 0x5}) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2400000002060181000000000000000001000002054decea000400030000000500050001"], 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x20048800) mount(0x0, &(0x7f0000000300)='./mnt\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0) syz_usb_control_io$lan78xx(r0, &(0x7f0000000440)={0x14, &(0x7f00000001c0)={0x40, 0x7, 0x3b, {0x3b, 0xe, "52e474425f6c40ac5164cb97cf8c791bb651d45e9426ad620370fcb26b7599c57f7139962e2dc27559520f2672ec9da990e2af2b224d1db743"}}, &(0x7f0000000340)={0x0, 0x3, 0x9b, @string={0x9b, 0x3, "73aaec0095b8fc935433f8adac632699de2d71bbe89370d6b0b137648bc47a5abd89cdd3b4fd991ac9ec16136873991ac086bd4d8718dd0eeb38c05a9626bba160e91157ea802ad84fcb0514f7f85a612155afc65bb485615b57c6eb852277b2f7cd1191d54248d4c1760605bfb5b136943fb2f908a17bf2268e68283da2499608eca8506983609d8c826e8d3460ca3d35dfe2d8920c6281aa"}}}, &(0x7f0000000640)={0x34, &(0x7f0000000480)={0x0, 0xe, 0x33, "331d257dbbad0f127dfb8debb5ed6e096325195233a6c77ee5149da681e34ee3e5719711fc90d78d46eeadd8411527aed87776"}, &(0x7f00000004c0)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000500)={0x0, 0x8, 0x1}, &(0x7f0000000540)={0xc0, 0xa1, 0x4, 0x348}, &(0x7f00000005c0)={0x40, 0xa0, 0x4, 0x12cb}, &(0x7f0000000600)={0xc0, 0xa2, 0x2f, "56e3421a3a74e497083001fee05aafc2ddde92b41d5f7bac5a91bba229454b940dec0257708520d28685b081949c2c"}}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0) write(r7, &(0x7f0000000a00)='stm32g0-typec 0x3', 0x11) syz_usb_control_io(r0, 0x0, 0x0) [ 104.027193][ T4654] Bluetooth: hci0: command tx timeout [ 104.355777][ T5324] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 104.508922][ T5324] usb 5-1: New USB device found, idVendor=0403, idProduct=c631, bcdDevice= 1.00 [ 104.512793][ T5324] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 104.549935][ T5324] i2c-tiny-usb 5-1:1.0: version 1.00 found at bus 005 address 002 [ 104.934575][ T5324] (null): failure reading functionality [ 104.952398][ T5326] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 104.961830][ T5326] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 104.970839][ T5324] i2c i2c-2: failure reading functionality [ 104.980218][ T5326] netlink: 'syz.0.0': attribute type 4 has an invalid length. [ 104.999151][ T5324] i2c i2c-2: connected i2c-tiny-usb device [ 105.025290][ T5324] usb 5-1: USB disconnect, device number 2 [ 105.077106][ T5326] ================================================================== [ 105.080802][ T5326] BUG: KASAN: slab-use-after-free in lookup_noperm_common+0x407/0x430 [ 105.084473][ T5326] Read of size 4 at addr ffff88804412d8f8 by task syz.0.0/5326 [ 105.087436][ T5326] [ 105.088428][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 105.088442][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 105.088450][ T5326] Call Trace: [ 105.088455][ T5326] [ 105.088460][ T5326] dump_stack_lvl+0xe8/0x150 [ 105.088475][ T5326] print_address_description+0x55/0x1e0 [ 105.088490][ T5326] ? lookup_noperm_common+0x407/0x430 [ 105.088503][ T5326] print_report+0x58/0x70 [ 105.088517][ T5326] kasan_report+0x117/0x150 [ 105.088532][ T5326] ? lookup_noperm_common+0x407/0x430 [ 105.088545][ T5326] lookup_noperm_common+0x407/0x430 [ 105.088558][ T5326] simple_start_creating+0x9c/0x110 [ 105.088573][ T5326] ? __pfx_simple_start_creating+0x10/0x10 [ 105.088587][ T5326] ? mntput+0x65/0xc0 [ 105.088598][ T5326] debugfs_start_creating+0xdb/0x1a0 [ 105.088657][ T5326] debugfs_create_dir+0x24/0x350 [ 105.088674][ T5326] i2c_device_probe+0x814/0xbf0 [ 105.088719][ T5326] ? __pfx_i2c_device_probe+0x10/0x10 [ 105.088732][ T5326] ? sysfs_do_create_link_sd+0xe0/0x110 [ 105.088746][ T5326] ? driver_sysfs_add+0x1fe/0x210 [ 105.088759][ T5326] ? __pfx_i2c_device_probe+0x10/0x10 [ 105.088771][ T5326] really_probe+0x254/0xae0 [ 105.088780][ T5326] __driver_probe_device+0x1e8/0x360 [ 105.088789][ T5326] driver_probe_device+0x4f/0x240 [ 105.088801][ T5326] __device_attach_driver+0x270/0x410 [ 105.088814][ T5326] bus_for_each_drv+0x258/0x2f0 [ 105.088827][ T5326] ? __pfx___device_attach_driver+0x10/0x10 [ 105.088838][ T5326] ? __pfx_bus_for_each_drv+0x10/0x10 [ 105.088851][ T5326] ? lockdep_hardirqs_on+0x7a/0x110 [ 105.088863][ T5326] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 105.088875][ T5326] __device_attach+0x2c4/0x450 [ 105.088886][ T5326] ? __pfx___device_attach+0x10/0x10 [ 105.088896][ T5326] ? do_raw_spin_unlock+0x4d/0x210 [ 105.088908][ T5326] ? _raw_spin_unlock+0x28/0x50 [ 105.088919][ T5326] device_initial_probe+0xa1/0xd0 [ 105.088930][ T5326] bus_probe_device+0x12a/0x220 [ 105.088944][ T5326] device_add+0x7d7/0xb80 [ 105.088963][ T5326] i2c_new_client_device+0xa29/0x1130 [ 105.088979][ T5326] ? __pfx_i2c_new_client_device+0x10/0x10 [ 105.088991][ T5326] ? __mutex_lock+0x30d/0x1550 [ 105.089005][ T5326] ? new_device_store+0x132/0x530 [ 105.089021][ T5326] new_device_store+0x24b/0x530 [ 105.089033][ T5326] ? sysfs_file_kobj+0x1a/0x230 [ 105.089040][ T5326] ? sysfs_file_kobj+0x1a/0x230 [ 105.089048][ T5326] ? __pfx_new_device_store+0x10/0x10 [ 105.089058][ T5326] ? sysfs_file_kobj+0x1a/0x230 [ 105.089065][ T5326] ? sysfs_file_kobj+0x1a/0x230 [ 105.089075][ T5326] ? sysfs_file_kobj+0x1e4/0x230 [ 105.089085][ T5326] ? sysfs_kf_write+0x166/0x260 [ 105.089096][ T5326] ? __pfx_sysfs_kf_write+0x10/0x10 [ 105.089107][ T5326] kernfs_fop_write_iter+0x3a4/0x540 [ 105.089125][ T5326] vfs_write+0x612/0xba0 [ 105.089140][ T5326] ? __pfx_vfs_write+0x10/0x10 [ 105.089156][ T5326] ? __fget_files+0x2a/0x420 [ 105.089170][ T5326] ksys_write+0x150/0x270 [ 105.089185][ T5326] ? __pfx_ksys_write+0x10/0x10 [ 105.089201][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.089212][ T5326] do_syscall_64+0x174/0x580 [ 105.089224][ T5326] ? clear_bhb_loop+0x40/0x90 [ 105.089235][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.089246][ T5326] RIP: 0033:0x7f5d5139e019 [ 105.089256][ T5326] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 105.089267][ T5326] RSP: 002b:00007f5d52266fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 105.089280][ T5326] RAX: ffffffffffffffda RBX: 00007f5d51625fa0 RCX: 00007f5d5139e019 [ 105.089288][ T5326] RDX: 0000000000000011 RSI: 0000200000000a00 RDI: 0000000000000003 [ 105.089295][ T5326] RBP: 00007f5d5143500c R08: 0000000000000000 R09: 0000000000000000 [ 105.089304][ T5326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 105.089310][ T5326] R13: 00007f5d51626038 R14: 00007f5d51625fa0 R15: 00007ffc8b3ed468 [ 105.089322][ T5326] [ 105.089326][ T5326] [ 105.252312][ T5326] Allocated by task 5324: [ 105.254427][ T5326] kasan_save_track+0x3e/0x80 [ 105.256751][ T5326] __kasan_slab_alloc+0x6c/0x80 [ 105.258937][ T5326] kmem_cache_alloc_lru_noprof+0x2aa/0x5f0 [ 105.262079][ T5326] __d_alloc+0x37/0x6f0 [ 105.264201][ T5326] d_alloc+0x4b/0x190 [ 105.265963][ T5326] lookup_one_qstr_excl+0xd8/0x360 [ 105.268193][ T5326] start_dirop+0x5c/0x90 [ 105.270014][ T5326] simple_start_creating+0xcc/0x110 [ 105.272303][ T5326] debugfs_start_creating+0xdb/0x1a0 [ 105.274553][ T5326] debugfs_create_dir+0x24/0x350 [ 105.276688][ T5326] i2c_register_adapter+0xc14/0x1400 [ 105.278996][ T5326] i2c_tiny_usb_probe+0x461/0x5d0 [ 105.281200][ T5326] usb_probe_interface+0x653/0xc60 [ 105.283339][ T5326] really_probe+0x254/0xae0 [ 105.285302][ T5326] __driver_probe_device+0x1e8/0x360 [ 105.287629][ T5326] driver_probe_device+0x4f/0x240 [ 105.289835][ T5326] __device_attach_driver+0x270/0x410 [ 105.292102][ T5326] bus_for_each_drv+0x258/0x2f0 [ 105.294198][ T5326] __device_attach+0x2c4/0x450 [ 105.296028][ T5326] device_initial_probe+0xa1/0xd0 [ 105.298003][ T5326] bus_probe_device+0x12a/0x220 [ 105.300019][ T5326] device_add+0x7d7/0xb80 [ 105.301750][ T5326] usb_set_configuration+0x1ad8/0x2180 [ 105.304130][ T5326] usb_generic_driver_probe+0x8d/0x150 [ 105.306310][ T5326] usb_probe_device+0x1c3/0x3b0 [ 105.308290][ T5326] really_probe+0x254/0xae0 [ 105.310128][ T5326] __driver_probe_device+0x1e8/0x360 [ 105.312237][ T5326] driver_probe_device+0x4f/0x240 [ 105.314116][ T5326] __device_attach_driver+0x270/0x410 [ 105.316113][ T5326] bus_for_each_drv+0x258/0x2f0 [ 105.318116][ T5326] __device_attach+0x2c4/0x450 [ 105.320286][ T5326] device_initial_probe+0xa1/0xd0 [ 105.322773][ T5326] bus_probe_device+0x12a/0x220 [ 105.324792][ T5326] device_add+0x7d7/0xb80 [ 105.326658][ T5326] usb_new_device+0x99d/0x1620 [ 105.328658][ T5326] hub_event+0x28e8/0x4d30 [ 105.330665][ T5326] process_scheduled_works+0xa8e/0x14e0 [ 105.333284][ T5326] worker_thread+0xa47/0xfb0 [ 105.335233][ T5326] kthread+0x388/0x470 [ 105.337228][ T5326] ret_from_fork+0x514/0xb70 [ 105.339284][ T5326] ret_from_fork_asm+0x1a/0x30 [ 105.341634][ T5326] [ 105.342910][ T5326] Freed by task 75: [ 105.345008][ T5326] kasan_save_track+0x3e/0x80 [ 105.347141][ T5326] kasan_save_free_info+0x40/0x50 [ 105.349047][ T5326] __kasan_slab_free+0x5c/0x80 [ 105.350769][ T5326] kmem_cache_free+0x182/0x650 [ 105.352717][ T5326] rcu_core+0x78b/0x10a0 [ 105.354383][ T5326] handle_softirqs+0x225/0x840 [ 105.356316][ T5326] do_softirq+0x76/0xd0 [ 105.358082][ T5326] __local_bh_enable_ip+0xf8/0x130 [ 105.360246][ T5326] scomp_acomp_comp_decomp+0x79c/0xab0 [ 105.362495][ T5326] crypto_acomp_compress+0x4c7/0xbd0 [ 105.364796][ T5326] zswap_store+0xe3a/0x2050 [ 105.366744][ T5326] swap_writeout+0x96a/0x14d0 [ 105.368622][ T5326] shrink_folio_list+0x35bd/0x5330 [ 105.370710][ T5326] evict_folios+0x3821/0x49e0 [ 105.372695][ T5326] try_to_shrink_lruvec+0xb4f/0xed0 [ 105.374790][ T5326] shrink_one+0x233/0x730 [ 105.376543][ T5326] shrink_node+0x3303/0x3b60 [ 105.378322][ T5326] kswapd+0x17b6/0x31c0 [ 105.379969][ T5326] kthread+0x388/0x470 [ 105.381687][ T5326] ret_from_fork+0x514/0xb70 [ 105.383646][ T5326] ret_from_fork_asm+0x1a/0x30 [ 105.385698][ T5326] [ 105.386709][ T5326] Last potentially related work creation: [ 105.389145][ T5326] kasan_save_stack+0x3e/0x60 [ 105.391134][ T5326] kasan_record_aux_stack+0xbd/0xd0 [ 105.393304][ T5326] call_rcu+0xee/0x8b0 [ 105.394974][ T5326] dentry_kill+0x4d3/0x880 [ 105.396845][ T5326] finish_dput+0x1a/0x260 [ 105.398787][ T5326] debugfs_remove+0x5b/0x70 [ 105.400774][ T5326] i2c_del_adapter+0x229/0x430 [ 105.402933][ T5326] i2c_tiny_usb_disconnect+0x49/0xd0 [ 105.405348][ T5326] usb_unbind_interface+0x295/0x9f0 [ 105.407661][ T5326] device_release_driver_internal+0x4f5/0x880 [ 105.410304][ T5326] bus_remove_device+0x444/0x560 [ 105.412535][ T5326] device_del+0x524/0x8f0 [ 105.414386][ T5326] usb_disable_device+0x3d4/0x8d0 [ 105.416667][ T5326] usb_disconnect+0x346/0x9a0 [ 105.418926][ T5326] hub_event+0x1bbb/0x4d30 [ 105.421108][ T5326] process_scheduled_works+0xa8e/0x14e0 [ 105.423787][ T5326] worker_thread+0xa47/0xfb0 [ 105.425873][ T5326] kthread+0x388/0x470 [ 105.427688][ T5326] ret_from_fork+0x514/0xb70 [ 105.429715][ T5326] ret_from_fork_asm+0x1a/0x30 [ 105.431768][ T5326] [ 105.432804][ T5326] The buggy address belongs to the object at ffff88804412d8f8 [ 105.432804][ T5326] which belongs to the cache dentry of size 312 [ 105.438489][ T5326] The buggy address is located 0 bytes inside of [ 105.438489][ T5326] freed 312-byte region [ffff88804412d8f8, ffff88804412da30) [ 105.444168][ T5326] [ 105.445253][ T5326] The buggy address belongs to the physical page: [ 105.448039][ T5326] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4412c [ 105.451517][ T5326] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 105.454822][ T5326] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 105.457836][ T5326] page_type: f5(slab) [ 105.459541][ T5326] raw: 04fff00000000040 ffff888030414280 dead000000000100 dead000000000122 [ 105.462936][ T5326] raw: 0000000000000000 0000000800150015 00000000f5000000 0000000000000000 [ 105.466601][ T5326] head: 04fff00000000040 ffff888030414280 dead000000000100 dead000000000122 [ 105.470026][ T5326] head: 0000000000000000 0000000800150015 00000000f5000000 0000000000000000 [ 105.473293][ T5326] head: 04fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 105.476741][ T5326] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 105.480131][ T5326] page dumped because: kasan: bad access detected [ 105.482814][ T5326] page_owner tracks the page as allocated [ 105.485194][ T5326] page last allocated via order 1, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_RECLAIMABLE|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4704, tgid 4704 (udevd), ts 97467798318, free_ts 0 [ 105.494036][ T5326] post_alloc_hook+0x1f9/0x250 [ 105.496166][ T5326] get_page_from_freelist+0x21fa/0x2270 [ 105.498498][ T5326] __alloc_frozen_pages_noprof+0x18d/0x380 [ 105.500908][ T5326] allocate_slab+0x79/0x5e0 [ 105.502818][ T5326] refill_objects+0x2d5/0x350 [ 105.504651][ T5326] __pcs_replace_empty_main+0x2bf/0x6b0 [ 105.507015][ T5326] kmem_cache_alloc_lru_noprof+0x389/0x5f0 [ 105.509534][ T5326] __d_alloc+0x37/0x6f0 [ 105.511387][ T5326] d_alloc_parallel+0xde/0x16a0 [ 105.513573][ T5326] path_openat+0xbea/0x3830 [ 105.515475][ T5326] do_file_open+0x23e/0x4a0 [ 105.517312][ T5326] do_sys_openat2+0x115/0x200 [ 105.519227][ T5326] __x64_sys_openat+0x138/0x170 [ 105.521327][ T5326] do_syscall_64+0x174/0x580 [ 105.523428][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.525468][ T5326] page_owner free stack trace missing [ 105.527326][ T5326] [ 105.528234][ T5326] Memory state around the buggy address: [ 105.530176][ T5326] ffff88804412d780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 105.533180][ T5326] ffff88804412d800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 105.536005][ T5326] >ffff88804412d880: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fa [ 105.539122][ T5326] ^ [ 105.542301][ T5326] ffff88804412d900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 105.545253][ T5326] ffff88804412d980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 105.548046][ T5326] ================================================================== [ 105.652995][ T5326] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 105.656237][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 105.660157][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 105.664539][ T5326] Call Trace: [ 105.665996][ T5326] [ 105.667336][ T5326] vpanic+0x56c/0xa60 [ 105.669120][ T5326] ? __pfx_vpanic+0x10/0x10 [ 105.671148][ T5326] panic+0xc5/0xd0 [ 105.672846][ T5326] ? __pfx_panic+0x10/0x10 [ 105.674807][ T5326] ? preempt_schedule_thunk+0x16/0x40 [ 105.677191][ T5326] ? lookup_noperm_common+0x407/0x430 [ 105.679230][ T5326] ? preempt_schedule_thunk+0x16/0x40 [ 105.681145][ T5326] ? lookup_noperm_common+0x407/0x430 [ 105.683140][ T5326] check_panic_on_warn+0x89/0xb0 [ 105.685342][ T5326] ? lookup_noperm_common+0x407/0x430 [ 105.687678][ T5326] end_report+0x73/0x170 [ 105.689540][ T5326] ? lookup_noperm_common+0x407/0x430 [ 105.691744][ T5326] kasan_report+0x128/0x150 [ 105.693424][ T5326] ? lookup_noperm_common+0x407/0x430 [ 105.695232][ T5326] lookup_noperm_common+0x407/0x430 [ 105.697136][ T5326] simple_start_creating+0x9c/0x110 [ 105.698867][ T5326] ? __pfx_simple_start_creating+0x10/0x10 [ 105.701125][ T5326] ? mntput+0x65/0xc0 [ 105.702916][ T5326] debugfs_start_creating+0xdb/0x1a0 [ 105.705270][ T5326] debugfs_create_dir+0x24/0x350 [ 105.707414][ T5326] i2c_device_probe+0x814/0xbf0 [ 105.709567][ T5326] ? __pfx_i2c_device_probe+0x10/0x10 [ 105.711902][ T5326] ? sysfs_do_create_link_sd+0xe0/0x110 [ 105.714141][ T5326] ? driver_sysfs_add+0x1fe/0x210 [ 105.716213][ T5326] ? __pfx_i2c_device_probe+0x10/0x10 [ 105.718383][ T5326] really_probe+0x254/0xae0 [ 105.720267][ T5326] __driver_probe_device+0x1e8/0x360 [ 105.722550][ T5326] driver_probe_device+0x4f/0x240 [ 105.724740][ T5326] __device_attach_driver+0x270/0x410 [ 105.727084][ T5326] bus_for_each_drv+0x258/0x2f0 [ 105.729191][ T5326] ? __pfx___device_attach_driver+0x10/0x10 [ 105.731651][ T5326] ? __pfx_bus_for_each_drv+0x10/0x10 [ 105.733884][ T5326] ? lockdep_hardirqs_on+0x7a/0x110 [ 105.736175][ T5326] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 105.738599][ T5326] __device_attach+0x2c4/0x450 [ 105.740581][ T5326] ? __pfx___device_attach+0x10/0x10 [ 105.742753][ T5326] ? do_raw_spin_unlock+0x4d/0x210 [ 105.744846][ T5326] ? _raw_spin_unlock+0x28/0x50 [ 105.746682][ T5326] device_initial_probe+0xa1/0xd0 [ 105.748900][ T5326] bus_probe_device+0x12a/0x220 [ 105.751012][ T5326] device_add+0x7d7/0xb80 [ 105.752910][ T5326] i2c_new_client_device+0xa29/0x1130 [ 105.755253][ T5326] ? __pfx_i2c_new_client_device+0x10/0x10 [ 105.757727][ T5326] ? __mutex_lock+0x30d/0x1550 [ 105.759868][ T5326] ? new_device_store+0x132/0x530 [ 105.762131][ T5326] new_device_store+0x24b/0x530 [ 105.764289][ T5326] ? sysfs_file_kobj+0x1a/0x230 [ 105.766343][ T5326] ? sysfs_file_kobj+0x1a/0x230 [ 105.768459][ T5326] ? __pfx_new_device_store+0x10/0x10 [ 105.770556][ T5326] ? sysfs_file_kobj+0x1a/0x230 [ 105.772617][ T5326] ? sysfs_file_kobj+0x1a/0x230 [ 105.774527][ T5326] ? sysfs_file_kobj+0x1e4/0x230 [ 105.776604][ T5326] ? sysfs_kf_write+0x166/0x260 [ 105.778701][ T5326] ? __pfx_sysfs_kf_write+0x10/0x10 [ 105.781038][ T5326] kernfs_fop_write_iter+0x3a4/0x540 [ 105.783259][ T5326] vfs_write+0x612/0xba0 [ 105.785013][ T5326] ? __pfx_vfs_write+0x10/0x10 [ 105.786987][ T5326] ? __fget_files+0x2a/0x420 [ 105.788852][ T5326] ksys_write+0x150/0x270 [ 105.790602][ T5326] ? __pfx_ksys_write+0x10/0x10 [ 105.792584][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.794813][ T5326] do_syscall_64+0x174/0x580 [ 105.796668][ T5326] ? clear_bhb_loop+0x40/0x90 [ 105.798749][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.801279][ T5326] RIP: 0033:0x7f5d5139e019 [ 105.803399][ T5326] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 105.811716][ T5326] RSP: 002b:00007f5d52266fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 105.815241][ T5326] RAX: ffffffffffffffda RBX: 00007f5d51625fa0 RCX: 00007f5d5139e019 [ 105.818675][ T5326] RDX: 0000000000000011 RSI: 0000200000000a00 RDI: 0000000000000003 [ 105.821827][ T5326] RBP: 00007f5d5143500c R08: 0000000000000000 R09: 0000000000000000 [ 105.825024][ T5326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 105.828268][ T5326] R13: 00007f5d51626038 R14: 00007f5d51625fa0 R15: 00007ffc8b3ed468 [ 105.831213][ T5326] [ 105.832840][ T5326] Kernel Offset: disabled [ 105.834775][ T5326] Rebooting in 86400 seconds..