program: mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000000), &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000a00)={0x84, &(0x7f0000000b00)={0x40, 0x3, 0x4, "01010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a00)) nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0) write(r1, &(0x7f0000000600)='tahvo 2', 0x7) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000001c0)={@cgroup, 0xffffffffffffffff, 0x3d, 0x20}, 0x20) syz_usb_control_io(r0, 0x0, &(0x7f0000000a00)) r2 = socket$inet_tcp(0x2, 0x1, 0x0) close(0x3) r3 = socket$unix(0x1, 0x2, 0x0) r4 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r4, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10) close(r3) listen(r4, 0x0) r5 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$sock_timeval(r5, 0x1, 0x43, &(0x7f0000001a40)={0x0, 0xea60}, 0x10) connect$vsock_stream(r5, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) sendto$inet(r2, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x11) syz_usb_control_io(r0, 0x0, &(0x7f0000000a00)) r6 = syz_open_dev$dri(&(0x7f0000000340), 0x2, 0x40502) r7 = memfd_create(&(0x7f0000000300)='\x00\xac=W[[\x87\x12\x04\xd5\xbc\x80K\x06\xcd]4(\xa2\xee2A7:n\x8c\xa7P\x1a\x87\xd9c\xecR\xd6\xe8\xf3Y\x12\"p^\xc1\x0f\x00\x00\x00\x00\x00\x00\x00t\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00\x19M\xc2N%\x93t[\xf3\xee\xa4\xb4\xfbf\x8dz7\\\x8e\xac\x18\x00\xfd\x89\xe1d\xfa\xcfb\xf3\xdc\xd4CY\x9a\xef\xa3\\\xa7\xa9^\xafL:[\x8e\x83U\xff\xfd\xff\xfa\xdaL\xa99\x9b\xcfA\xe4n\xa0^\n\x1c\x84\x04\xc5a\xdf\xe5\xd4Hyn\xba:/\xa5\xf4\xaa\xfa\xcd\xc7T\x83\xf5N^\xf2n\xd0=\xb9\t\xdd-F\xacb\xac \xd3\xccj\x13\xa2\x9fLu\'\xed\x91\x867\xaa\xf5\xa0]\xb6\xaa\xea\xfd\xde\xa6\xec\b\x16\x86l:;\xf9\xdb\xcf\x88\"\xca\xe0E\xdb\xec\xf9\xb3\xed\a\x00\x00\x00\x00\x00\x00\x00\xd6.\xf7\x92\xc42\xdf\xefE\xce}\x1b\xda\xdd?\n6\xe1\xb1\xd8Y\x960\xd1\x00\x00\x00\x00\x00\x00MW\x8f\xc6\x82\xe4\x15\xf7\xe9\xd8\xc5b\x0e\x91\xc5\xc76$\x18\xa4\xbe\xe8V\x8d-\xe3\x8fC\xd5\xf5\xd6L\xe3\xce\xa1\x8dz\xce\xa7\xa5\xc8\xcbhM\x1b\xf8\x98\xc4\xfbD6\x88\xfd\xe5i\x8a\xd8\xcfm\x81Z\x19\xf0\xef\xc15\xe8\xcb\xf5\t\t\x00\x17\xfa\x1fqb\xe7\"\xcb4\xb8\xe5/\xd52\x17\x12\x1d\xd8\x87\xb9|\x8d\x83\xea\xcc\x94\xebZ\xae\xaf\x19\xa4\xb2\xc6\xe1\x926B\xb6\x89Z\xa9\xb5/\xbb\x9d&\xeeO\xb3\xb3\xd4\bB\xa9f\x84\xad\t\x1a\xc2\xd5\x88\xbfo\x80V\x93\x9fl\xd7\xff\x03\xb7J\xed\x183\xe3\x7f\xfaq,\xca\x06\xb0\xc9\x92\x93\xa5I\x89\xb7\x85\x90\xb7\x1b0\xce\xd7!\x8fD\x96\xe1 ^>\x9f\x04\x89<\xb7S\x7f\x1a\x88\xab$\xd3y\xc2\xe1\x99\xbch\xd3\x83\xcd\x7f\xc5n\xb1\xc1X \x90\xbb\x1f\x01\x90\xb1O\x8d\x7f\xa8\xd4\xdbO\xef\x99\xf3\xd3M\x0f\t\x7f\n,\x84\x1f\xfa\xe2\xc8\x99\x97Oq\xae\x9b\x86h\xfa3\xb9\xfd\xbb\xd4^\xc0t\xa7]Y\xe9\x7f[\x11\xb1\xf3m\x17F\x9d\x18\xe2\xe1\x01\xb6f=-?\xbcI\xf2\xd9\xc4>-\xc0E\x9a\x82\xcc7S\xd4\xb6\'\xd2DY\xa5\x83,\xd1\xbc\xc7\xf6\xe0\x1f o\x06\xc2t\x14\xc2\xe0\x92\xc1\x8a\x85>@\xc9\xb0% \xc7\x13l\x8bJ\xe5\xec\x1dE\xf5\xc5\xe2\xe3\x10G7r#\xbc\x95&\x14\x1e\x97\xce\x83>Q@\xfb\xeb=\x1e\xb3\xd5H\x02\x86\xc6\xf3\xe1i\\\x1d\xf4\xc1\xacJC+\xc8}\x1b{\x86\x17\x00\n\"\xec\xa5x\xe6\xb1i\xeb\xb3\xb7I\x90\x9eai\xde\x01\xdc\xfeA\x05Sn\xe6\xe8^\xdf\x8c`\x17\xca\xbd\\QG\xb15\x82*=\xbd\xe9\xaf\x12<\xd7\xe1$\xa4\xdaU\xfb^\xd8!\xacxy\xd5X\xef\x03\xa7\x10\xa1C#S~\x0f\x17\t>X\\mv0\x9eZ\x89\xf4\xae\a\xc8\x16\xd2o\x16\xf3X%Q\xbd\xe9\x86V\xf2\x99^0\xe8xI(\xde-\x04s\x15\x06#2\xef\xef@\xa3t0d^^\xad\xf6\xad\xe0\x16\xf6\xa8\x99!\x0e\x9d+;D&\xebN\x94\x12\x04\x95o\xd6\x9fl\xcb\x16gc\xf5(\xaa_\xec\x9aiE\f\xd4\xc6\xf2\xae\x85n\x995\xcd\xa7\xbb\xf0pz\xff\x0f\x00\x00\x00\x00\x00\x00Li\r\x95Z\x89\"_\xe4\xba\xd4\x93\xab\xe1\xb9\xd8E[\xbb\xc9.M+\xbe\x81N\xd2\xae\xf4\x18\xd0\xe7\x98\x90,\xce\ft\xc4\xc7\x02\xaa\xc7\xeb1;\x86b)\x12{k#c\x1d@\xc31\x00\xd2}f\x8cX\xce\xed\xa4\xe4\xca\x00\x00\x00\x00\x00\x03\xfcWZ!<\x16a5ZL.\xe6\x15]\xebY\xaa\xbea\x8e\xdc\xc52r\"\xea\x9e\x03\x11&\xc3JU\xa7\xd6\x8a\xf8\xae>S\xde', 0x0) write(r7, &(0x7f0000000140)='/', 0x1) sendfile(r7, r7, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x100000c, 0x11, r7, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r6, 0xc01064c1, &(0x7f0000000040)) syz_usb_control_io(r0, 0x0, &(0x7f0000000a00)={0x84, &(0x7f0000000000)={0x40}, &(0x7f0000000000)={0x0, 0xa, 0x1}, &(0x7f0000000000)={0x0, 0x8, 0x1}, &(0x7f0000000000)={0x20, 0x0, 0x4}, &(0x7f0000000000)={0x20, 0x0, 0x4}, &(0x7f0000000180)={0x40, 0x7, 0x2}, &(0x7f0000000000)={0x40, 0x9, 0x1}, &(0x7f0000000000)={0x40, 0xb, 0x2}, &(0x7f0000000000)={0x40, 0xf, 0x2}, &(0x7f0000000000)={0x40, 0x13, 0x6, @broadcast}, &(0x7f0000000000)={0x40, 0x17, 0x6}, &(0x7f00000000c0)={0x40, 0x19, 0x2}, &(0x7f0000000000)={0x40, 0x1a, 0x2}, &(0x7f0000000000)={0x40, 0x1c, 0x1}, &(0x7f0000000000)={0x40, 0x1e, 0x1}, &(0x7f0000000000)={0x40, 0x21, 0x1}}) nanosleep(&(0x7f0000000700)={0x0, 0x5f5e100}, 0x0) [ 104.564324][ T4652] Bluetooth: hci0: command tx timeout [ 105.044968][ T10] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 105.207791][ T10] usb 5-1: New USB device found, idVendor=0403, idProduct=c631, bcdDevice= 1.00 [ 105.213875][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 105.260703][ T10] i2c-tiny-usb 5-1:1.0: version 1.00 found at bus 005 address 002 [ 105.640685][ T10] (null): failure reading functionality [ 105.965064][ T10] i2c i2c-2: failure reading functionality [ 105.978367][ T10] i2c i2c-2: connected i2c-tiny-usb device [ 106.171810][ T5326] i2c i2c-2: failure writing data [ 106.174955][ T10] usb 5-1: USB disconnect, device number 2 [ 106.188921][ T5326] retu-mfd 2-0002: could not read Tahvo revision: -5 [ 106.215200][ T5326] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000028: 0000 [#1] SMP KASAN NOPTI [ 106.220534][ T5326] KASAN: null-ptr-deref in range [0x0000000000000140-0x0000000000000147] [ 106.224245][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 106.228085][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 106.232314][ T5326] RIP: 0010:kasan_byte_accessible+0x12/0x30 [ 106.234980][ T5326] Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cc cc cc cc 66 66 66 66 66 66 2e [ 106.243147][ T5326] RSP: 0018:ffffc9000e617400 EFLAGS: 00010206 [ 106.245778][ T5326] RAX: dffffc0000000000 RBX: ffffffff81a26b4d RCX: 0000000080000001 [ 106.249046][ T5326] RDX: 0000000000000000 RSI: ffffffff81a26b4d RDI: 0000000000000028 [ 106.252495][ T5326] RBP: ffffffff82569e7a R08: 0000000000000001 R09: 0000000000000000 [ 106.255908][ T5326] R10: dffffc0000000000 R11: ffffed1003f02503 R12: 0000000000000000 [ 106.259313][ T5326] R13: 0000000000000140 R14: 0000000000000140 R15: 0000000000000001 [ 106.262681][ T5326] FS: 00007f7fbd02a6c0(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 106.266188][ T5326] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 106.268714][ T5326] CR2: 0000200000001a40 CR3: 00000000124b5000 CR4: 0000000000352ef0 [ 106.271804][ T5326] Call Trace: [ 106.273282][ T5326] [ 106.274672][ T5326] __kasan_check_byte+0x12/0x40 [ 106.276818][ T5326] lock_acquire+0x84/0x350 [ 106.279167][ T5326] down_write_nested+0x9d/0x210 [ 106.281402][ T5326] ? __simple_recursive_removal+0x9a/0x520 [ 106.283955][ T5326] ? __pfx_down_write_nested+0x10/0x10 [ 106.286315][ T5326] ? do_raw_spin_unlock+0x4d/0x210 [ 106.288391][ T5326] __simple_recursive_removal+0x9a/0x520 [ 106.290795][ T5326] ? mntput+0x65/0xc0 [ 106.292664][ T5326] ? __pfx_remove_one+0x10/0x10 [ 106.295269][ T5326] debugfs_remove+0x5b/0x70 [ 106.297705][ T5326] i2c_device_probe+0x8dc/0xbf0 [ 106.300124][ T5326] ? __pfx_i2c_device_probe+0x10/0x10 [ 106.302482][ T5326] ? sysfs_do_create_link_sd+0xe0/0x110 [ 106.304720][ T5326] ? driver_sysfs_add+0x1fe/0x210 [ 106.306872][ T5326] ? __pfx_i2c_device_probe+0x10/0x10 [ 106.309151][ T5326] really_probe+0x254/0xae0 [ 106.311172][ T5326] __driver_probe_device+0x1e8/0x360 [ 106.313409][ T5326] driver_probe_device+0x4f/0x240 [ 106.315566][ T5326] __device_attach_driver+0x270/0x410 [ 106.317813][ T5326] bus_for_each_drv+0x258/0x2f0 [ 106.319887][ T5326] ? __pfx___device_attach_driver+0x10/0x10 [ 106.322440][ T5326] ? __pfx_bus_for_each_drv+0x10/0x10 [ 106.324762][ T5326] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 106.327252][ T5326] __device_attach+0x2c4/0x450 [ 106.329265][ T5326] ? __pfx___device_attach+0x10/0x10 [ 106.331490][ T5326] ? do_raw_spin_unlock+0x4d/0x210 [ 106.333661][ T5326] ? _raw_spin_unlock+0x28/0x50 [ 106.335769][ T5326] device_initial_probe+0xa1/0xd0 [ 106.338168][ T5326] bus_probe_device+0x12a/0x220 [ 106.340846][ T5326] device_add+0x7d7/0xb80 [ 106.343436][ T5326] i2c_new_client_device+0xa29/0x1130 [ 106.346335][ T5326] ? __pfx_i2c_new_client_device+0x10/0x10 [ 106.349095][ T5326] ? __mutex_lock+0x321/0x1550 [ 106.351336][ T5326] ? new_device_store+0x132/0x530 [ 106.353633][ T5326] new_device_store+0x24b/0x530 [ 106.355951][ T5326] ? sysfs_file_kobj+0x1a/0x230 [ 106.358708][ T5326] ? sysfs_file_kobj+0x1a/0x230 [ 106.361656][ T5326] ? __pfx_new_device_store+0x10/0x10 [ 106.364096][ T5326] ? sysfs_file_kobj+0x1a/0x230 [ 106.366220][ T5326] ? sysfs_file_kobj+0x1a/0x230 [ 106.368556][ T5326] ? sysfs_file_kobj+0x1e4/0x230 [ 106.371607][ T5326] ? sysfs_kf_write+0x166/0x260 [ 106.374092][ T5326] ? __pfx_sysfs_kf_write+0x10/0x10 [ 106.376375][ T5326] kernfs_fop_write_iter+0x3a4/0x540 [ 106.378601][ T5326] vfs_write+0x612/0xba0 [ 106.380590][ T5326] ? __pfx_vfs_write+0x10/0x10 [ 106.383005][ T5326] ? __fget_files+0x2a/0x420 [ 106.385728][ T5326] ksys_write+0x150/0x270 [ 106.388588][ T5326] ? __pfx_ksys_write+0x10/0x10 [ 106.391448][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.394564][ T5326] do_syscall_64+0x174/0x580 [ 106.396853][ T5326] ? trace_irq_disable+0x3b/0x140 [ 106.399652][ T5326] ? clear_bhb_loop+0x40/0x90 [ 106.402413][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.405207][ T5326] RIP: 0033:0x7f7fbc19e019 [ 106.407380][ T5326] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 106.417689][ T5326] RSP: 002b:00007f7fbd029fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 106.421788][ T5326] RAX: ffffffffffffffda RBX: 00007f7fbc426090 RCX: 00007f7fbc19e019 [ 106.426372][ T5326] RDX: 0000000000000007 RSI: 0000200000000600 RDI: 0000000000000004 [ 106.431033][ T5326] RBP: 00007f7fbc23500c R08: 0000000000000000 R09: 0000000000000000 [ 106.434933][ T5326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 106.439210][ T5326] R13: 00007f7fbc426128 R14: 00007f7fbc426090 R15: 00007ffe2c5d1088 [ 106.443828][ T5326] [ 106.445391][ T5326] Modules linked in: [ 106.448667][ T5326] ---[ end trace 0000000000000000 ]--- [ 106.471823][ T5326] RIP: 0010:kasan_byte_accessible+0x12/0x30 [ 106.475527][ T5326] Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cc cc cc cc 66 66 66 66 66 66 2e [ 106.486972][ T5326] RSP: 0018:ffffc9000e617400 EFLAGS: 00010206 [ 106.489911][ T5326] RAX: dffffc0000000000 RBX: ffffffff81a26b4d RCX: 0000000080000001 [ 106.494869][ T5326] RDX: 0000000000000000 RSI: ffffffff81a26b4d RDI: 0000000000000028 [ 106.499716][ T5326] RBP: ffffffff82569e7a R08: 0000000000000001 R09: 0000000000000000 [ 106.504157][ T5326] R10: dffffc0000000000 R11: ffffed1003f02503 R12: 0000000000000000 [ 106.507938][ T5326] R13: 0000000000000140 R14: 0000000000000140 R15: 0000000000000001 [ 106.513005][ T5326] FS: 00007f7fbd02a6c0(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 106.517531][ T5326] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 106.520514][ T5326] CR2: 00007f7fbd008fe8 CR3: 00000000124b5000 CR4: 0000000000352ef0 [ 106.525077][ T5326] Kernel panic - not syncing: Fatal exception [ 106.528781][ T5326] Kernel Offset: disabled [ 106.530736][ T5326] Rebooting in 86400 seconds..