program:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080fa0904"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
mkdir(&(0x7f0000000100)='./mnt\x00', 0x1ff)
mount(0x0, &(0x7f0000000300)='./mnt\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
r2 = syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x0)
ioctl$CEC_S_MODE(r2, 0x40046109, &(0x7f00000000c0)=0x31)
close(0x3)
write(r1, &(0x7f0000000a00)='stm32g0-typec 0x3', 0x11)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000280)={0x1c, &(0x7f0000000180)={0x40, 0x30, 0x4, "9574cab3"}, 0x0, 0x0})
syz_usb_control_io$printer(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x20, 0x24, 0x28, {0x28, 0x9, "ff5e7a95ac437f304301385b303ccb31f62eeed1a9fcbba568e519fb12ffdfdf55b658375f96"}}, &(0x7f0000000080)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x41e}}}, &(0x7f0000000580)={0x34, &(0x7f00000001c0)={0x20, 0x9, 0x95, "e421355fbd7df80280d911b92ab847320f2bb26048e0327b55d4c7b6cd4f833b2bef5a03c1b708aa0c8050cdc7d490502c3b1118d516e835cd723b9801c296fae3bb6a8a6a848821b6a550acb29b628e79d75b098e677aaa6a8350289bb7088e45a9667655cf78921be4b79249e1c722d3c28fbfe7110d9dd6ef7bbe13d3f3aa72de606ce6bc08dc7586988dd390d2bc7c0a839caa"}, &(0x7f00000002c0)={0x0, 0xa, 0x1}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000440)={0x20, 0x0, 0xb4, {0xb2, "cc7e204f21f5434883726a8c7cfb20bc230850acbbfd449d1807c45c45dc5a76766c5f02dd793cbc168823ba081bcd02c71a103918a845fe4b6f725ac4a8c41410d98051f9634f808f333c62f6ef18fb0462519de1fe6c9ce7e99b83b560e456fb5ea5da35e85e3fb09fee4780ffbafbbd0f5c34e3741541e22f919dfef4fba8d2a12253a487f9425093348794eb9441122cd7d7dc04dea5372bcb418d679da65e81aa3a88ebafa36767bb9225f8ed152dd2"}}, &(0x7f0000000500)={0x20, 0x1, 0x1, 0x7}, &(0x7f0000000540)={0x20, 0x0, 0x1, 0x35}})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080fa0904"], 0x0) (async)
syz_usb_control_io(r0, 0x0, 0x0) (async)
syz_usb_control_io(r0, 0x0, 0x0) (async)
mkdir(&(0x7f0000000100)='./mnt\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000300)='./mnt\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0) (async)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f0000000900)='./mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0) (async)
syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x0) (async)
ioctl$CEC_S_MODE(r2, 0x40046109, &(0x7f00000000c0)=0x31) (async)
close(0x3) (async)
write(r1, &(0x7f0000000a00)='stm32g0-typec 0x3', 0x11) (async)
syz_usb_control_io(r0, 0x0, 0x0) (async)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000280)={0x1c, &(0x7f0000000180)={0x40, 0x30, 0x4, "9574cab3"}, 0x0, 0x0}) (async)
syz_usb_control_io$printer(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x20, 0x24, 0x28, {0x28, 0x9, "ff5e7a95ac437f304301385b303ccb31f62eeed1a9fcbba568e519fb12ffdfdf55b658375f96"}}, &(0x7f0000000080)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x41e}}}, &(0x7f0000000580)={0x34, &(0x7f00000001c0)={0x20, 0x9, 0x95, "e421355fbd7df80280d911b92ab847320f2bb26048e0327b55d4c7b6cd4f833b2bef5a03c1b708aa0c8050cdc7d490502c3b1118d516e835cd723b9801c296fae3bb6a8a6a848821b6a550acb29b628e79d75b098e677aaa6a8350289bb7088e45a9667655cf78921be4b79249e1c722d3c28fbfe7110d9dd6ef7bbe13d3f3aa72de606ce6bc08dc7586988dd390d2bc7c0a839caa"}, &(0x7f00000002c0)={0x0, 0xa, 0x1}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000440)={0x20, 0x0, 0xb4, {0xb2, "cc7e204f21f5434883726a8c7cfb20bc230850acbbfd449d1807c45c45dc5a76766c5f02dd793cbc168823ba081bcd02c71a103918a845fe4b6f725ac4a8c41410d98051f9634f808f333c62f6ef18fb0462519de1fe6c9ce7e99b83b560e456fb5ea5da35e85e3fb09fee4780ffbafbbd0f5c34e3741541e22f919dfef4fba8d2a12253a487f9425093348794eb9441122cd7d7dc04dea5372bcb418d679da65e81aa3a88ebafa36767bb9225f8ed152dd2"}}, &(0x7f0000000500)={0x20, 0x1, 0x1, 0x7}, &(0x7f0000000540)={0x20, 0x0, 0x1, 0x35}}) (async)
syz_usb_control_io(r0, 0x0, 0x0) (async)
[ 86.495974][ T5278] Bluetooth: hci0: command tx timeout
[ 86.785862][ T1365] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 86.936723][ T1365] usb 5-1: New USB device found, idVendor=0403, idProduct=c631, bcdDevice= 1.00
[ 86.943601][ T1365] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 86.977394][ T1365] i2c-tiny-usb 5-1:1.0: version 1.00 found at bus 005 address 002
[ 87.365594][ T1365] (null): failure reading functionality
[ 87.380516][ T1365] i2c i2c-2: failure reading functionality
[ 87.400346][ T1365] i2c i2c-2: connected i2c-tiny-usb device
[ 87.435259][ T5314] i2c i2c-2: failure writing data
[ 87.438976][ T1365] usb 5-1: USB disconnect, device number 2
[ 87.457357][ T5314] ucsi-stm32g0-i2c 2-0003: i2c read 03, 00 error: -5
[ 87.486774][ T5314] ==================================================================
[ 87.490116][ T5314] BUG: KASAN: slab-use-after-free in _raw_spin_lock+0x2e/0x40
[ 87.495217][ T5314] Read of size 1 at addr ffff88801325ec90 by task syz.0.0/5314
[ 87.498431][ T5314]
[ 87.499499][ T5314] CPU: 0 UID: 0 PID: 5314 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 87.499512][ T5314] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 87.499518][ T5314] Call Trace:
[ 87.499525][ T5314]
[ 87.499530][ T5314] dump_stack_lvl+0xe8/0x150
[ 87.499548][ T5314] print_address_description+0x55/0x1e0
[ 87.499563][ T5314] ? _raw_spin_lock+0x2e/0x40
[ 87.499576][ T5314] print_report+0x58/0x70
[ 87.499588][ T5314] kasan_report+0x117/0x150
[ 87.499602][ T5314] ? _raw_spin_lock+0x2e/0x40
[ 87.499617][ T5314] ? lockref_get+0x15/0x60
[ 87.499675][ T5314] __kasan_check_byte+0x2a/0x40
[ 87.499687][ T5314] lock_acquire+0x84/0x350
[ 87.499701][ T5314] ? do_raw_spin_lock+0x12b/0x2f0
[ 87.499712][ T5314] _raw_spin_lock+0x2e/0x40
[ 87.499726][ T5314] ? lockref_get+0x15/0x60
[ 87.499736][ T5314] lockref_get+0x15/0x60
[ 87.499747][ T5314] __simple_recursive_removal+0x33/0x520
[ 87.499758][ T5314] ? mntput+0x65/0xc0
[ 87.499771][ T5314] ? __pfx_remove_one+0x10/0x10
[ 87.499785][ T5314] debugfs_remove+0x5b/0x70
[ 87.499797][ T5314] i2c_device_probe+0x8dc/0xbf0
[ 87.499809][ T5314] ? __pfx_i2c_device_probe+0x10/0x10
[ 87.499819][ T5314] ? sysfs_do_create_link_sd+0xe0/0x110
[ 87.499832][ T5314] ? driver_sysfs_add+0x1fe/0x210
[ 87.499843][ T5314] ? __pfx_i2c_device_probe+0x10/0x10
[ 87.499852][ T5314] really_probe+0x254/0xae0
[ 87.499866][ T5314] __driver_probe_device+0x1e8/0x360
[ 87.499877][ T5314] driver_probe_device+0x4f/0x240
[ 87.499887][ T5314] __device_attach_driver+0x270/0x410
[ 87.499897][ T5314] bus_for_each_drv+0x258/0x2f0
[ 87.499910][ T5314] ? __pfx___device_attach_driver+0x10/0x10
[ 87.499921][ T5314] ? __pfx_bus_for_each_drv+0x10/0x10
[ 87.499933][ T5314] ? lockdep_hardirqs_on+0x7a/0x110
[ 87.499944][ T5314] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 87.499959][ T5314] __device_attach+0x2c4/0x450
[ 87.499969][ T5314] ? __pfx___device_attach+0x10/0x10
[ 87.499978][ T5314] ? do_raw_spin_unlock+0x4d/0x210
[ 87.499989][ T5314] ? _raw_spin_unlock+0x28/0x50
[ 87.500004][ T5314] device_initial_probe+0xa1/0xd0
[ 87.500015][ T5314] bus_probe_device+0x12a/0x220
[ 87.500027][ T5314] device_add+0x7d7/0xb80
[ 87.500043][ T5314] i2c_new_client_device+0xa29/0x1130
[ 87.500056][ T5314] ? __pfx_i2c_new_client_device+0x10/0x10
[ 87.500067][ T5314] ? __mutex_lock+0x30d/0x1550
[ 87.500077][ T5314] ? new_device_store+0x132/0x530
[ 87.500090][ T5314] new_device_store+0x24b/0x530
[ 87.500102][ T5314] ? sysfs_file_kobj+0x1a/0x230
[ 87.500112][ T5314] ? sysfs_file_kobj+0x1a/0x230
[ 87.500122][ T5314] ? __pfx_new_device_store+0x10/0x10
[ 87.500133][ T5314] ? sysfs_file_kobj+0x1a/0x230
[ 87.500141][ T5314] ? sysfs_file_kobj+0x1a/0x230
[ 87.500149][ T5314] ? sysfs_file_kobj+0x1e4/0x230
[ 87.500159][ T5314] ? sysfs_kf_write+0x166/0x260
[ 87.500171][ T5314] ? __pfx_sysfs_kf_write+0x10/0x10
[ 87.500181][ T5314] kernfs_fop_write_iter+0x3a4/0x540
[ 87.500197][ T5314] vfs_write+0x612/0xba0
[ 87.500211][ T5314] ? __pfx_vfs_write+0x10/0x10
[ 87.500225][ T5314] ? __fget_files+0x2a/0x420
[ 87.500238][ T5314] ksys_write+0x150/0x270
[ 87.500251][ T5314] ? __pfx_ksys_write+0x10/0x10
[ 87.500265][ T5314] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.500275][ T5314] do_syscall_64+0x174/0x580
[ 87.500285][ T5314] ? trace_irq_disable+0x3b/0x140
[ 87.500297][ T5314] ? clear_bhb_loop+0x70/0xc0
[ 87.500308][ T5314] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.500318][ T5314] RIP: 0033:0x7f6aa199e0d9
[ 87.500328][ T5314] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 87.500337][ T5314] RSP: 002b:00007f6aa28f7fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 87.500349][ T5314] RAX: ffffffffffffffda RBX: 00007f6aa1c25fa0 RCX: 00007f6aa199e0d9
[ 87.500357][ T5314] RDX: 0000000000000011 RSI: 0000200000000a00 RDI: 0000000000000004
[ 87.500364][ T5314] RBP: 00007f6aa1a35024 R08: 0000000000000000 R09: 0000000000000000
[ 87.500369][ T5314] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 87.500375][ T5314] R13: 00007f6aa1c26038 R14: 00007f6aa1c25fa0 R15: 00007fff8d7310e8
[ 87.500391][ T5314]
[ 87.500395][ T5314]
[ 87.667549][ T5314] Allocated by task 5314:
[ 87.669857][ T5314] kasan_save_track+0x3e/0x80
[ 87.672437][ T5314] __kasan_slab_alloc+0x6c/0x80
[ 87.675151][ T5314] kmem_cache_alloc_lru_noprof+0x2aa/0x5f0
[ 87.677737][ T5314] __d_alloc+0x37/0x6f0
[ 87.679345][ T5314] d_alloc+0x4b/0x190
[ 87.680904][ T5314] lookup_one_qstr_excl+0xd8/0x360
[ 87.682979][ T5314] start_dirop+0x5c/0x90
[ 87.684549][ T5314] simple_start_creating+0xcc/0x110
[ 87.686562][ T5314] debugfs_start_creating+0xdb/0x1a0
[ 87.688626][ T5314] debugfs_create_dir+0x24/0x350
[ 87.690430][ T5314] i2c_device_probe+0x814/0xbf0
[ 87.692467][ T5314] really_probe+0x254/0xae0
[ 87.694436][ T5314] __driver_probe_device+0x1e8/0x360
[ 87.696674][ T5314] driver_probe_device+0x4f/0x240
[ 87.698853][ T5314] __device_attach_driver+0x270/0x410
[ 87.701131][ T5314] bus_for_each_drv+0x258/0x2f0
[ 87.703661][ T5314] __device_attach+0x2c4/0x450
[ 87.705711][ T5314] device_initial_probe+0xa1/0xd0
[ 87.707862][ T5314] bus_probe_device+0x12a/0x220
[ 87.709971][ T5314] device_add+0x7d7/0xb80
[ 87.711789][ T5314] i2c_new_client_device+0xa29/0x1130
[ 87.713987][ T5314] new_device_store+0x24b/0x530
[ 87.716047][ T5314] kernfs_fop_write_iter+0x3a4/0x540
[ 87.718300][ T5314] vfs_write+0x612/0xba0
[ 87.720148][ T5314] ksys_write+0x150/0x270
[ 87.722069][ T5314] do_syscall_64+0x174/0x580
[ 87.724030][ T5314] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.726496][ T5314]
[ 87.727534][ T5314] Freed by task 1365:
[ 87.729233][ T5314] kasan_save_track+0x3e/0x80
[ 87.731313][ T5314] kasan_save_free_info+0x40/0x50
[ 87.733474][ T5314] __kasan_slab_free+0x5c/0x80
[ 87.735563][ T5314] kmem_cache_free+0x182/0x650
[ 87.737588][ T5314] rcu_core+0x78b/0x10a0
[ 87.739421][ T5314] handle_softirqs+0x225/0x840
[ 87.741476][ T5314] __irq_exit_rcu+0xca/0x220
[ 87.743446][ T5314] irq_exit_rcu+0x9/0x30
[ 87.745420][ T5314] sysvec_apic_timer_interrupt+0xa6/0xc0
[ 87.747913][ T5314] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 87.750672][ T5314]
[ 87.751776][ T5314] Last potentially related work creation:
[ 87.754431][ T5314] kasan_save_stack+0x3e/0x60
[ 87.756483][ T5314] kasan_record_aux_stack+0xbd/0xd0
[ 87.758649][ T5314] call_rcu+0xee/0x8b0
[ 87.760354][ T5314] dentry_kill+0x4d3/0x880
[ 87.762202][ T5314] finish_dput+0x1a/0x260
[ 87.763959][ T5314] find_next_child+0x1e7/0x250
[ 87.765987][ T5314] __simple_recursive_removal+0x10b/0x520
[ 87.768402][ T5314] debugfs_remove+0x5b/0x70
[ 87.770336][ T5314] i2c_del_adapter+0x229/0x430
[ 87.772262][ T5314] i2c_tiny_usb_disconnect+0x49/0xd0
[ 87.774396][ T5314] usb_unbind_interface+0x295/0x9f0
[ 87.776454][ T5314] device_release_driver_internal+0x4f5/0x880
[ 87.778978][ T5314] bus_remove_device+0x444/0x560
[ 87.781107][ T5314] device_del+0x524/0x8f0
[ 87.782988][ T5314] usb_disable_device+0x3d4/0x8d0
[ 87.785121][ T5314] usb_disconnect+0x346/0x9a0
[ 87.787092][ T5314] hub_event+0x1bbb/0x4d30
[ 87.788914][ T5314] process_scheduled_works+0xa8e/0x14e0
[ 87.791261][ T5314] worker_thread+0xa47/0xfb0
[ 87.793248][ T5314] kthread+0x388/0x470
[ 87.795025][ T5314] ret_from_fork+0x514/0xb70
[ 87.796959][ T5314] ret_from_fork_asm+0x1a/0x30
[ 87.799000][ T5314]
[ 87.800012][ T5314] The buggy address belongs to the object at ffff88801325ebc0
[ 87.800012][ T5314] which belongs to the cache dentry of size 312
[ 87.805512][ T5314] The buggy address is located 208 bytes inside of
[ 87.805512][ T5314] freed 312-byte region [ffff88801325ebc0, ffff88801325ecf8)
[ 87.811069][ T5314]
[ 87.812114][ T5314] The buggy address belongs to the physical page:
[ 87.814808][ T5314] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1325e
[ 87.818444][ T5314] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 87.821857][ T5314] memcg:ffff88801325fed9
[ 87.823653][ T5314] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 87.826743][ T5314] page_type: f5(slab)
[ 87.828517][ T5314] raw: 00fff00000000040 ffff888030414280 dead000000000100 dead000000000122
[ 87.831861][ T5314] raw: 0000000000000000 0000000800150015 00000000f5000000 ffff88801325fed9
[ 87.835477][ T5314] head: 00fff00000000040 ffff888030414280 dead000000000100 dead000000000122
[ 87.839290][ T5314] head: 0000000000000000 0000000800150015 00000000f5000000 ffff88801325fed9
[ 87.842493][ T5314] head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
[ 87.846135][ T5314] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[ 87.849652][ T5314] page dumped because: kasan: bad access detected
[ 87.852323][ T5314] page_owner tracks the page as allocated
[ 87.854634][ T5314] page last allocated via order 1, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_RECLAIMABLE|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5273, tgid 5273 (udevd), ts 86560869171, free_ts 40842068267
[ 87.863307][ T5314] post_alloc_hook+0x1f9/0x250
[ 87.865239][ T5314] get_page_from_freelist+0x21fa/0x2270
[ 87.867590][ T5314] __alloc_frozen_pages_noprof+0x18d/0x380
[ 87.870062][ T5314] allocate_slab+0x79/0x5e0
[ 87.872026][ T5314] refill_objects+0x2d5/0x350
[ 87.874152][ T5314] __pcs_replace_empty_main+0x2bf/0x6b0
[ 87.876423][ T5314] kmem_cache_alloc_lru_noprof+0x389/0x5f0
[ 87.878726][ T5314] __d_alloc+0x37/0x6f0
[ 87.880345][ T5314] d_alloc+0x4b/0x190
[ 87.881992][ T5314] lookup_one_qstr_excl+0xd8/0x360
[ 87.884035][ T5314] filename_unlinkat+0x2ba/0x610
[ 87.886057][ T5314] __se_sys_unlink+0x2e/0x140
[ 87.887900][ T5314] do_syscall_64+0x174/0x580
[ 87.889618][ T5314] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.892240][ T5314] page last free pid 4698 tgid 4698 stack trace:
[ 87.895387][ T5314] __free_frozen_pages+0xc1e/0xd10
[ 87.897563][ T5314] __slab_free+0x274/0x2c0
[ 87.899459][ T5314] qlist_free_all+0x99/0x100
[ 87.901497][ T5314] kasan_quarantine_reduce+0x148/0x160
[ 87.903834][ T5314] __kasan_slab_alloc+0x22/0x80
[ 87.906093][ T5314] kmem_cache_alloc_noprof+0x2a0/0x5f0
[ 87.908444][ T5314] do_getname+0x2e/0x250
[ 87.910300][ T5314] do_sys_openat2+0xcc/0x200
[ 87.912288][ T5314] __x64_sys_openat+0x138/0x170
[ 87.914417][ T5314] do_syscall_64+0x174/0x580
[ 87.916352][ T5314] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.918950][ T5314]
[ 87.920054][ T5314] Memory state around the buggy address:
[ 87.922483][ T5314] ffff88801325eb80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 87.925754][ T5314] ffff88801325ec00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 87.929074][ T5314] >ffff88801325ec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc
[ 87.932555][ T5314] ^
[ 87.934571][ T5314] ffff88801325ed00: fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb fb
[ 87.938019][ T5314] ffff88801325ed80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 87.941249][ T5314] ==================================================================
[ 87.945702][ T5314] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 87.948835][ T5314] CPU: 0 UID: 0 PID: 5314 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 87.952355][ T5314] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 87.956670][ T5314] Call Trace:
[ 87.958151][ T5314]
[ 87.959435][ T5314] vpanic+0x56c/0xa60
[ 87.961170][ T5314] ? __pfx_vpanic+0x10/0x10
[ 87.963112][ T5314] panic+0xc5/0xd0
[ 87.964692][ T5314] ? __pfx_panic+0x10/0x10
[ 87.966622][ T5314] ? _raw_spin_lock+0x2e/0x40
[ 87.968635][ T5314] ? _raw_spin_lock+0x2e/0x40
[ 87.970676][ T5314] check_panic_on_warn+0x89/0xb0
[ 87.972775][ T5314] ? _raw_spin_lock+0x2e/0x40
[ 87.974948][ T5314] end_report+0x73/0x170
[ 87.976823][ T5314] ? _raw_spin_lock+0x2e/0x40
[ 87.978896][ T5314] kasan_report+0x128/0x150
[ 87.980907][ T5314] ? _raw_spin_lock+0x2e/0x40
[ 87.982860][ T5314] ? lockref_get+0x15/0x60
[ 87.984714][ T5314] __kasan_check_byte+0x2a/0x40
[ 87.986785][ T5314] lock_acquire+0x84/0x350
[ 87.988685][ T5314] ? do_raw_spin_lock+0x12b/0x2f0
[ 87.990835][ T5314] _raw_spin_lock+0x2e/0x40
[ 87.992706][ T5314] ? lockref_get+0x15/0x60
[ 87.994685][ T5314] lockref_get+0x15/0x60
[ 87.996383][ T5314] __simple_recursive_removal+0x33/0x520
[ 87.998859][ T5314] ? mntput+0x65/0xc0
[ 88.000558][ T5314] ? __pfx_remove_one+0x10/0x10
[ 88.002545][ T5314] debugfs_remove+0x5b/0x70
[ 88.004459][ T5314] i2c_device_probe+0x8dc/0xbf0
[ 88.006491][ T5314] ? __pfx_i2c_device_probe+0x10/0x10
[ 88.008744][ T5314] ? sysfs_do_create_link_sd+0xe0/0x110
[ 88.011075][ T5314] ? driver_sysfs_add+0x1fe/0x210
[ 88.013153][ T5314] ? __pfx_i2c_device_probe+0x10/0x10
[ 88.015418][ T5314] really_probe+0x254/0xae0
[ 88.017361][ T5314] __driver_probe_device+0x1e8/0x360
[ 88.019639][ T5314] driver_probe_device+0x4f/0x240
[ 88.021856][ T5314] __device_attach_driver+0x270/0x410
[ 88.024249][ T5314] bus_for_each_drv+0x258/0x2f0
[ 88.026440][ T5314] ? __pfx___device_attach_driver+0x10/0x10
[ 88.028826][ T5314] ? __pfx_bus_for_each_drv+0x10/0x10
[ 88.031158][ T5314] ? lockdep_hardirqs_on+0x7a/0x110
[ 88.033428][ T5314] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 88.035798][ T5314] __device_attach+0x2c4/0x450
[ 88.037632][ T5314] ? __pfx___device_attach+0x10/0x10
[ 88.039712][ T5314] ? do_raw_spin_unlock+0x4d/0x210
[ 88.041676][ T5314] ? _raw_spin_unlock+0x28/0x50
[ 88.043721][ T5314] device_initial_probe+0xa1/0xd0
[ 88.045787][ T5314] bus_probe_device+0x12a/0x220
[ 88.047743][ T5314] device_add+0x7d7/0xb80
[ 88.049604][ T5314] i2c_new_client_device+0xa29/0x1130
[ 88.051949][ T5314] ? __pfx_i2c_new_client_device+0x10/0x10
[ 88.054513][ T5314] ? __mutex_lock+0x30d/0x1550
[ 88.056648][ T5314] ? new_device_store+0x132/0x530
[ 88.058691][ T5314] new_device_store+0x24b/0x530
[ 88.060834][ T5314] ? sysfs_file_kobj+0x1a/0x230
[ 88.062890][ T5314] ? sysfs_file_kobj+0x1a/0x230
[ 88.064952][ T5314] ? __pfx_new_device_store+0x10/0x10
[ 88.067200][ T5314] ? sysfs_file_kobj+0x1a/0x230
[ 88.069228][ T5314] ? sysfs_file_kobj+0x1a/0x230
[ 88.071351][ T5314] ? sysfs_file_kobj+0x1e4/0x230
[ 88.073515][ T5314] ? sysfs_kf_write+0x166/0x260
[ 88.075477][ T5314] ? __pfx_sysfs_kf_write+0x10/0x10
[ 88.077587][ T5314] kernfs_fop_write_iter+0x3a4/0x540
[ 88.079870][ T5314] vfs_write+0x612/0xba0
[ 88.081716][ T5314] ? __pfx_vfs_write+0x10/0x10
[ 88.083761][ T5314] ? __fget_files+0x2a/0x420
[ 88.085736][ T5314] ksys_write+0x150/0x270
[ 88.087534][ T5314] ? __pfx_ksys_write+0x10/0x10
[ 88.089399][ T5314] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.091654][ T5314] do_syscall_64+0x174/0x580
[ 88.093556][ T5314] ? trace_irq_disable+0x3b/0x140
[ 88.095670][ T5314] ? clear_bhb_loop+0x70/0xc0
[ 88.097945][ T5314] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.100871][ T5314] RIP: 0033:0x7f6aa199e0d9
[ 88.102917][ T5314] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 88.111045][ T5314] RSP: 002b:00007f6aa28f7fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 88.114575][ T5314] RAX: ffffffffffffffda RBX: 00007f6aa1c25fa0 RCX: 00007f6aa199e0d9
[ 88.117581][ T5314] RDX: 0000000000000011 RSI: 0000200000000a00 RDI: 0000000000000004
[ 88.120922][ T5314] RBP: 00007f6aa1a35024 R08: 0000000000000000 R09: 0000000000000000
[ 88.123891][ T5314] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 88.127147][ T5314] R13: 00007f6aa1c26038 R14: 00007f6aa1c25fa0 R15: 00007fff8d7310e8
[ 88.130531][ T5314]
[ 88.132247][ T5314] Kernel Offset: disabled
[ 88.134262][ T5314] Rebooting in 86400 seconds..