program:
mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000000), &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000a00)={0x84, &(0x7f0000000b00)={0x40, 0x3, 0x4, "01010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000a00))
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, &(0x7f00000000c0)={0x24, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x22, 0x22, {[@global=@item_012={0x2, 0x1, 0x9, "231b"}, @global=@item_012={0x2, 0x1, 0x2, "e53f"}, @global=@item_4={0x3, 0x1, 0x0, "0100"}, @local=@item_012={0x2, 0x2, 0x2, "9006"}, @main=@item_4={0x3, 0x0, 0x8, "749e821d"}, @local=@item_4={0x3, 0x2, 0xa, "8b923659"}, @local=@item_4={0x3, 0x2, 0x2, "000400"}, @main=@item_4={0x3, 0x0, 0x8, "9b9043d6"}]}}, 0x0}, 0x0)
syz_usb_control_io$hid(r1, &(0x7f0000000640)={0x24, &(0x7f00000004c0)={0x40, 0xc, 0x12, {0x12, 0xf, "fd876adddba68f82f3da703c0776f96e"}}, &(0x7f0000000540)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x424}}, &(0x7f0000000580)={0x0, 0x22, 0x17, {[@global=@item_4={0x3, 0x1, 0x5, "5dd1a210"}, @global=@item_012={0x1, 0x1, 0xb, '['}, @main=@item_4={0x3, 0x0, 0x8, "867a2a70"}, @local, @main=@item_4={0x3, 0x0, 0xc, "39df4962"}, @local=@item_4={0x3, 0x2, 0x2, "d881f583"}]}}, &(0x7f00000005c0)={0x0, 0x21, 0x9, {0x9, 0x21, 0x7, 0x48, 0x1, {0x22, 0x857}}}}, &(0x7f0000000840)={0x2c, &(0x7f0000000680)={0x0, 0x30, 0x34, "29da87edc66f9fb28793222fc94c3ef2114e80efd72c599ae577fd1ad07ffa127d310814a69c9ecdb100dc9bc9620b4c62b137e7"}, &(0x7f00000006c0)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000000740)={0x0, 0x8, 0x1, 0xf9}, &(0x7f0000000780)={0x20, 0x1, 0x2b, "1cc4b20a737e3582a88857ef86ded10fbff723bc182381bdb66aad0e2c04f0d276d3156579e95306f1e929"}, &(0x7f00000007c0)={0x20, 0x3, 0x1}})
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='tahvo 2', 0x7)
r3 = open(&(0x7f00000005c0)='./bus\x00', 0x147842, 0x0)
preadv2(r3, &(0x7f0000000040)=[{&(0x7f0000001200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x18)
syz_usb_control_io(r0, 0x0, &(0x7f0000000a00))
syz_usb_control_io(r0, 0x0, &(0x7f0000000a00)={0x84, &(0x7f0000000000), &(0x7f0000000000)={0x0, 0xa, 0x1}, &(0x7f0000000000)={0x0, 0x8, 0x1}, &(0x7f0000000000)={0x20, 0x0, 0x4}, &(0x7f0000000000)={0x20, 0x0, 0x4, {0x100}}, &(0x7f0000000000)={0x40, 0x7, 0x2}, &(0x7f0000000000)={0x40, 0x9, 0x1}, &(0x7f0000000000)={0x40, 0xb, 0x2, '\x00!'}, &(0x7f0000000000)={0x40, 0xf, 0x2}, &(0x7f0000000000)={0x40, 0x13, 0x6}, &(0x7f0000000000)={0x40, 0x17, 0x6}, &(0x7f0000000000)={0x40, 0x19, 0x2}, &(0x7f0000000000)={0x40, 0x1a, 0x2}, &(0x7f0000000000)={0x40, 0x1c, 0x1}, &(0x7f0000000000)={0x40, 0x1e, 0x1}, &(0x7f0000000000)={0x40, 0x21, 0x1}})
syz_usb_control_io(r0, 0x0, &(0x7f0000000a00)={0x84, &(0x7f0000000440)={0x0, 0x0, 0x6c, "4aeb441ee4b3449ad577ecad8336d8f3c02b83a74a3b1fb0154fe6d73f4f2de9ca3db0c6403c909b84016e4567b088baa1240722333896636d0a14e316669b9fd4da588ae76641aa062d45966f90eae5042c7ee16579a3d16d8d81328f9a95e9b41587811fdbcb68db277fdc"}, &(0x7f0000000000)={0x0, 0xa, 0x1}, &(0x7f0000000000)={0x0, 0x8, 0x1}, &(0x7f0000000000)={0x20, 0x0, 0x4}, &(0x7f0000000000)={0x20, 0x0, 0x4}, &(0x7f0000000000)={0x40, 0x7, 0x2}, &(0x7f0000000000)={0x40, 0x9, 0x1}, &(0x7f0000000000)={0x40, 0xb, 0x2}, &(0x7f0000000000)={0x40, 0xf, 0x2, 0xfffd}, &(0x7f0000000000)={0x40, 0x13, 0x6}, &(0x7f0000000000)={0x40, 0x17, 0x6}, &(0x7f0000000000)={0x40, 0x19, 0x2}, &(0x7f0000000000)={0x40, 0x1a, 0x2}, &(0x7f0000000000)={0x40, 0x1c, 0x1}, &(0x7f0000000000)={0x40, 0x1e, 0x1}, &(0x7f0000000000)={0x40, 0x21, 0x1}})
nanosleep(&(0x7f0000000700)={0x0, 0x5f5e100}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/bus/platform/devices/tahvo-usb.2-0002\x00', 0x20000, 0x0)
setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0xa02000000000000, 0x60, &(0x7f0000000000)={'filter\x00', 0xb001, 0x4, 0x3e8, 0x300, 0x0, 0x0, 0x300, 0x300, 0x300, 0x7fffffe, 0x0, {[{{@arp={@local, @empty, 0x0, 0x0, 0x0, 0x0, {@empty, {[0xff]}}, {@mac=@local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'pimreg\x00', 'veth0_to_bridge\x00'}, 0xc0, 0x130}, @unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "f67b23ffdfa27f907a03732da3acbc6518e62a77ca06f258762e88c0d9f9d2f413b94a105f4bdf01425ce81c5d000000000000000500ffffffff00"}}}, {{@arp={@multicast2, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth0_to_team\x00', 'ip6tnl0\x00'}, 0xc0, 0xe8}, @unspec=@CLASSIFY={0x28}}, {{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x0, 0x10}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x438)
syz_usb_connect$printer(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="0d01000009000008250592d20700006a3b010902241700fa0074980904e4ff11070103000905010200ffe00000090582"], 0x0)
close(0x3)
r4 = syz_usb_connect$uac1(0x0, 0x71, &(0x7f0000000200)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0xff, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5f, 0x3, 0x1, 0x4, 0x0, 0x2}}]}}, 0x0)
syz_usb_control_io$uac1(r4, 0x0, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
[ 93.085673][ T5272] Bluetooth: hci0: command tx timeout
[ 93.160686][ T803] cfg80211: failed to load regulatory.db
[ 93.456145][ T5310] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 93.610253][ T5310] usb 5-1: New USB device found, idVendor=0403, idProduct=c631, bcdDevice= 1.00
[ 93.614123][ T5310] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 93.641255][ T5310] i2c-tiny-usb 5-1:1.0: version 1.00 found at bus 005 address 002
[ 94.033793][ T5310] (null): failure reading functionality
[ 94.293813][ T5315] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 94.304489][ T5315] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 94.388486][ T5310] i2c i2c-2: failure reading functionality
[ 94.483771][ T5310] i2c i2c-2: connected i2c-tiny-usb device
[ 95.047222][ T5318] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 95.055331][ T5318] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 95.064622][ T5310] usb 5-1: USB disconnect, device number 2
[ 95.068061][ T5315] i2c i2c-2: failure reading data
[ 95.075191][ T5315] retu-mfd 2-0002: could not read Tahvo revision: -5
[ 95.095701][ T5315] ==================================================================
[ 95.099093][ T5315] BUG: KASAN: slab-use-after-free in _raw_spin_lock+0x2e/0x40
[ 95.102010][ T5315] Read of size 1 at addr ffff88801f4ac248 by task syz.0.0/5315
[ 95.105275][ T5315]
[ 95.106316][ T5315] CPU: 0 UID: 0 PID: 5315 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 95.106331][ T5315] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.106339][ T5315] Call Trace:
[ 95.106344][ T5315]
[ 95.106348][ T5315] dump_stack_lvl+0xe8/0x150
[ 95.106364][ T5315] print_address_description+0x55/0x1e0
[ 95.106375][ T5315] ? _raw_spin_lock+0x2e/0x40
[ 95.106383][ T5315] print_report+0x58/0x70
[ 95.106392][ T5315] kasan_report+0x117/0x150
[ 95.106403][ T5315] ? _raw_spin_lock+0x2e/0x40
[ 95.106412][ T5315] ? lockref_get+0x15/0x60
[ 95.106469][ T5315] __kasan_check_byte+0x2a/0x40
[ 95.106484][ T5315] lock_acquire+0x84/0x350
[ 95.106500][ T5315] ? do_raw_spin_lock+0x12b/0x2f0
[ 95.106514][ T5315] _raw_spin_lock+0x2e/0x40
[ 95.106524][ T5315] ? lockref_get+0x15/0x60
[ 95.106533][ T5315] lockref_get+0x15/0x60
[ 95.106543][ T5315] __simple_recursive_removal+0x33/0x520
[ 95.106556][ T5315] ? mntput+0x65/0xc0
[ 95.106572][ T5315] ? __pfx_remove_one+0x10/0x10
[ 95.106587][ T5315] debugfs_remove+0x5b/0x70
[ 95.106601][ T5315] i2c_device_probe+0x8dc/0xbf0
[ 95.106610][ T5315] ? __pfx_i2c_device_probe+0x10/0x10
[ 95.106616][ T5315] ? sysfs_do_create_link_sd+0xe0/0x110
[ 95.106625][ T5315] ? driver_sysfs_add+0x1fe/0x210
[ 95.106635][ T5315] ? __pfx_i2c_device_probe+0x10/0x10
[ 95.106641][ T5315] really_probe+0x254/0xae0
[ 95.106649][ T5315] __driver_probe_device+0x1e8/0x360
[ 95.106659][ T5315] driver_probe_device+0x4f/0x240
[ 95.106669][ T5315] __device_attach_driver+0x270/0x410
[ 95.106680][ T5315] bus_for_each_drv+0x258/0x2f0
[ 95.106692][ T5315] ? __pfx___device_attach_driver+0x10/0x10
[ 95.106703][ T5315] ? __pfx_bus_for_each_drv+0x10/0x10
[ 95.106715][ T5315] ? lockdep_hardirqs_on+0x7a/0x110
[ 95.106727][ T5315] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 95.106739][ T5315] __device_attach+0x2c4/0x450
[ 95.106754][ T5315] ? __pfx___device_attach+0x10/0x10
[ 95.106770][ T5315] ? do_raw_spin_unlock+0x4d/0x210
[ 95.106780][ T5315] ? _raw_spin_unlock+0x28/0x50
[ 95.106797][ T5315] device_initial_probe+0xa1/0xd0
[ 95.106807][ T5315] bus_probe_device+0x12a/0x220
[ 95.106815][ T5315] device_add+0x7d7/0xb80
[ 95.106824][ T5315] i2c_new_client_device+0xa29/0x1130
[ 95.106833][ T5315] ? __pfx_i2c_new_client_device+0x10/0x10
[ 95.106841][ T5315] ? __mutex_lock+0x30d/0x1550
[ 95.106853][ T5315] ? new_device_store+0x132/0x530
[ 95.106871][ T5315] new_device_store+0x24b/0x530
[ 95.106883][ T5315] ? irqentry_exit+0x218/0x8f0
[ 95.106899][ T5315] ? lockdep_hardirqs_on+0x7a/0x110
[ 95.106912][ T5315] ? __pfx_new_device_store+0x10/0x10
[ 95.106925][ T5315] ? __pfx_sysfs_kf_write+0x10/0x10
[ 95.106936][ T5315] ? __pfx_new_device_store+0x10/0x10
[ 95.106948][ T5315] ? dev_attr_store+0x4f/0x90
[ 95.106960][ T5315] ? __pfx_sysfs_kf_write+0x10/0x10
[ 95.106971][ T5315] kernfs_fop_write_iter+0x3a4/0x540
[ 95.106988][ T5315] vfs_write+0x612/0xba0
[ 95.107003][ T5315] ? __pfx_vfs_write+0x10/0x10
[ 95.107013][ T5315] ? __fget_files+0x2a/0x420
[ 95.107021][ T5315] ksys_write+0x150/0x270
[ 95.107029][ T5315] ? __pfx_ksys_write+0x10/0x10
[ 95.107040][ T5315] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.107051][ T5315] do_syscall_64+0x174/0x580
[ 95.107063][ T5315] ? trace_irq_disable+0x3b/0x140
[ 95.107080][ T5315] ? clear_bhb_loop+0x70/0xc0
[ 95.107092][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.107103][ T5315] RIP: 0033:0x7f3bd099e0d9
[ 95.107114][ T5315] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 95.107124][ T5315] RSP: 002b:00007f3bd18c2fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 95.107136][ T5315] RAX: ffffffffffffffda RBX: 00007f3bd0c26090 RCX: 00007f3bd099e0d9
[ 95.107141][ T5315] RDX: 0000000000000007 RSI: 0000200000000600 RDI: 0000000000000005
[ 95.107146][ T5315] RBP: 00007f3bd0a35024 R08: 0000000000000000 R09: 0000000000000000
[ 95.107153][ T5315] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 95.107159][ T5315] R13: 00007f3bd0c26128 R14: 00007f3bd0c26090 R15: 00007ffd1757cdf8
[ 95.107169][ T5315]
[ 95.107173][ T5315]
[ 95.277248][ T5315] Allocated by task 5315:
[ 95.279165][ T5315] kasan_save_track+0x3e/0x80
[ 95.281196][ T5315] __kasan_slab_alloc+0x6c/0x80
[ 95.283595][ T5315] kmem_cache_alloc_lru_noprof+0x2aa/0x5f0
[ 95.286659][ T5315] __d_alloc+0x37/0x6f0
[ 95.288406][ T5315] d_alloc+0x4b/0x190
[ 95.290031][ T5315] lookup_one_qstr_excl+0xd8/0x360
[ 95.292263][ T5315] start_dirop+0x5c/0x90
[ 95.294034][ T5315] simple_start_creating+0xcc/0x110
[ 95.296233][ T5315] debugfs_start_creating+0xdb/0x1a0
[ 95.298450][ T5315] debugfs_create_dir+0x24/0x350
[ 95.300590][ T5315] i2c_device_probe+0x814/0xbf0
[ 95.302786][ T5315] really_probe+0x254/0xae0
[ 95.304737][ T5315] __driver_probe_device+0x1e8/0x360
[ 95.306942][ T5315] driver_probe_device+0x4f/0x240
[ 95.309002][ T5315] __device_attach_driver+0x270/0x410
[ 95.311381][ T5315] bus_for_each_drv+0x258/0x2f0
[ 95.313811][ T5315] __device_attach+0x2c4/0x450
[ 95.316184][ T5315] device_initial_probe+0xa1/0xd0
[ 95.318364][ T5315] bus_probe_device+0x12a/0x220
[ 95.320487][ T5315] device_add+0x7d7/0xb80
[ 95.322374][ T5315] i2c_new_client_device+0xa29/0x1130
[ 95.324738][ T5315] new_device_store+0x24b/0x530
[ 95.326872][ T5315] kernfs_fop_write_iter+0x3a4/0x540
[ 95.329070][ T5315] vfs_write+0x612/0xba0
[ 95.331049][ T5315] ksys_write+0x150/0x270
[ 95.332963][ T5315] do_syscall_64+0x174/0x580
[ 95.334968][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.337560][ T5315]
[ 95.338626][ T5315] Freed by task 15:
[ 95.340079][ T5315] kasan_save_track+0x3e/0x80
[ 95.341890][ T5315] kasan_save_free_info+0x40/0x50
[ 95.344119][ T5315] __kasan_slab_free+0x5c/0x80
[ 95.346197][ T5315] kmem_cache_free+0x182/0x650
[ 95.348282][ T5315] rcu_core+0x78b/0x10a0
[ 95.350015][ T5315] handle_softirqs+0x225/0x840
[ 95.351976][ T5315] run_ksoftirqd+0x36/0x60
[ 95.353895][ T5315] smpboot_thread_fn+0x57c/0xa80
[ 95.355992][ T5315] kthread+0x388/0x470
[ 95.357781][ T5315] ret_from_fork+0x514/0xb70
[ 95.359763][ T5315] ret_from_fork_asm+0x1a/0x30
[ 95.361934][ T5315]
[ 95.362985][ T5315] Last potentially related work creation:
[ 95.365393][ T5315] kasan_save_stack+0x3e/0x60
[ 95.367506][ T5315] kasan_record_aux_stack+0xbd/0xd0
[ 95.369736][ T5315] call_rcu+0xee/0x8b0
[ 95.371545][ T5315] dentry_kill+0x4d3/0x880
[ 95.373185][ T5315] finish_dput+0x1a/0x260
[ 95.375617][ T5315] find_next_child+0x1e7/0x250
[ 95.377470][ T5315] __simple_recursive_removal+0x10b/0x520
[ 95.379575][ T5315] debugfs_remove+0x5b/0x70
[ 95.381346][ T5315] i2c_del_adapter+0x229/0x430
[ 95.383231][ T5315] i2c_tiny_usb_disconnect+0x49/0xd0
[ 95.385371][ T5315] usb_unbind_interface+0x295/0x9f0
[ 95.387573][ T5315] device_release_driver_internal+0x4f5/0x880
[ 95.390105][ T5315] bus_remove_device+0x444/0x560
[ 95.392010][ T5315] device_del+0x524/0x8f0
[ 95.393556][ T5315] usb_disable_device+0x3d4/0x8d0
[ 95.395541][ T5315] usb_disconnect+0x346/0x9a0
[ 95.397523][ T5315] hub_event+0x1bbb/0x4d30
[ 95.399316][ T5315] process_scheduled_works+0xa8e/0x14e0
[ 95.401613][ T5315] worker_thread+0xa47/0xfb0
[ 95.403589][ T5315] kthread+0x388/0x470
[ 95.405367][ T5315] ret_from_fork+0x514/0xb70
[ 95.407318][ T5315] ret_from_fork_asm+0x1a/0x30
[ 95.409277][ T5315]
[ 95.410351][ T5315] The buggy address belongs to the object at ffff88801f4ac178
[ 95.410351][ T5315] which belongs to the cache dentry of size 312
[ 95.415465][ T5315] The buggy address is located 208 bytes inside of
[ 95.415465][ T5315] freed 312-byte region [ffff88801f4ac178, ffff88801f4ac2b0)
[ 95.420443][ T5315]
[ 95.421396][ T5315] The buggy address belongs to the physical page:
[ 95.423894][ T5315] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88801f4ac000 pfn:0x1f4ac
[ 95.427935][ T5315] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 95.431242][ T5315] memcg:ffff888012e2d601
[ 95.432991][ T5315] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff)
[ 95.436577][ T5315] page_type: f5(slab)
[ 95.438284][ T5315] raw: 00fff00000000240 ffff888030414280 ffffea00007d3010 ffffea00007d2690
[ 95.441834][ T5315] raw: ffff88801f4ac000 0000000800150007 00000000f5000000 ffff888012e2d601
[ 95.445325][ T5315] head: 00fff00000000240 ffff888030414280 ffffea00007d3010 ffffea00007d2690
[ 95.448861][ T5315] head: ffff88801f4ac000 0000000800150007 00000000f5000000 ffff888012e2d601
[ 95.452402][ T5315] head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
[ 95.455779][ T5315] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[ 95.459106][ T5315] page dumped because: kasan: bad access detected
[ 95.461683][ T5315] page_owner tracks the page as allocated
[ 95.463945][ T5315] page last allocated via order 1, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_RECLAIMABLE|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4698, tgid 4698 (udevadm), ts 35153854837, free_ts 0
[ 95.472471][ T5315] post_alloc_hook+0x1f9/0x250
[ 95.474449][ T5315] get_page_from_freelist+0x21fa/0x2270
[ 95.476581][ T5315] __alloc_frozen_pages_noprof+0x18d/0x380
[ 95.478782][ T5315] allocate_slab+0x79/0x5e0
[ 95.480518][ T5315] refill_objects+0x2d5/0x350
[ 95.482343][ T5315] __pcs_replace_empty_main+0x2bf/0x6b0
[ 95.484540][ T5315] kmem_cache_alloc_lru_noprof+0x389/0x5f0
[ 95.486875][ T5315] __d_alloc+0x37/0x6f0
[ 95.488651][ T5315] d_alloc_parallel+0xde/0x16a0
[ 95.490648][ T5315] __lookup_slow+0x82/0x2f0
[ 95.492396][ T5315] lookup_slow+0x53/0x70
[ 95.494114][ T5315] path_lookupat+0x3f5/0x8c0
[ 95.495979][ T5315] filename_lookup+0x265/0x5d0
[ 95.498024][ T5315] vfs_statx+0xfc/0x200
[ 95.499752][ T5315] vfs_fstatat+0x11b/0x170
[ 95.501546][ T5315] __x64_sys_newfstatat+0x151/0x200
[ 95.503673][ T5315] page_owner free stack trace missing
[ 95.505936][ T5315]
[ 95.506950][ T5315] Memory state around the buggy address:
[ 95.509318][ T5315] ffff88801f4ac100: fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc fa
[ 95.512491][ T5315] ffff88801f4ac180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 95.515958][ T5315] >ffff88801f4ac200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 95.519151][ T5315] ^
[ 95.521830][ T5315] ffff88801f4ac280: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fa fb
[ 95.525016][ T5315] ffff88801f4ac300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 95.528213][ T5315] ==================================================================
[ 95.534400][ T5315] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 95.537351][ T5315] CPU: 0 UID: 0 PID: 5315 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 95.540812][ T5315] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.544886][ T5315] Call Trace:
[ 95.546307][ T5315]
[ 95.547569][ T5315] vpanic+0x56c/0xa60
[ 95.549260][ T5315] ? __pfx_vpanic+0x10/0x10
[ 95.551146][ T5315] panic+0xc5/0xd0
[ 95.552694][ T5315] ? __pfx_panic+0x10/0x10
[ 95.554863][ T5315] ? _raw_spin_lock+0x2e/0x40
[ 95.557261][ T5315] ? _raw_spin_lock+0x2e/0x40
[ 95.559763][ T5315] check_panic_on_warn+0x89/0xb0
[ 95.561784][ T5315] ? _raw_spin_lock+0x2e/0x40
[ 95.563440][ T5315] end_report+0x73/0x170
[ 95.564998][ T5315] ? _raw_spin_lock+0x2e/0x40
[ 95.566894][ T5315] kasan_report+0x128/0x150
[ 95.568818][ T5315] ? _raw_spin_lock+0x2e/0x40
[ 95.570768][ T5315] ? lockref_get+0x15/0x60
[ 95.572578][ T5315] __kasan_check_byte+0x2a/0x40
[ 95.574872][ T5315] lock_acquire+0x84/0x350
[ 95.576744][ T5315] ? do_raw_spin_lock+0x12b/0x2f0
[ 95.579085][ T5315] _raw_spin_lock+0x2e/0x40
[ 95.580915][ T5315] ? lockref_get+0x15/0x60
[ 95.582761][ T5315] lockref_get+0x15/0x60
[ 95.584538][ T5315] __simple_recursive_removal+0x33/0x520
[ 95.586820][ T5315] ? mntput+0x65/0xc0
[ 95.588440][ T5315] ? __pfx_remove_one+0x10/0x10
[ 95.590492][ T5315] debugfs_remove+0x5b/0x70
[ 95.592163][ T5315] i2c_device_probe+0x8dc/0xbf0
[ 95.594114][ T5315] ? __pfx_i2c_device_probe+0x10/0x10
[ 95.596376][ T5315] ? sysfs_do_create_link_sd+0xe0/0x110
[ 95.598683][ T5315] ? driver_sysfs_add+0x1fe/0x210
[ 95.600761][ T5315] ? __pfx_i2c_device_probe+0x10/0x10
[ 95.602878][ T5315] really_probe+0x254/0xae0
[ 95.604710][ T5315] __driver_probe_device+0x1e8/0x360
[ 95.606906][ T5315] driver_probe_device+0x4f/0x240
[ 95.609049][ T5315] __device_attach_driver+0x270/0x410
[ 95.611187][ T5315] bus_for_each_drv+0x258/0x2f0
[ 95.613176][ T5315] ? __pfx___device_attach_driver+0x10/0x10
[ 95.615583][ T5315] ? __pfx_bus_for_each_drv+0x10/0x10
[ 95.617783][ T5315] ? lockdep_hardirqs_on+0x7a/0x110
[ 95.619929][ T5315] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 95.622454][ T5315] __device_attach+0x2c4/0x450
[ 95.624486][ T5315] ? __pfx___device_attach+0x10/0x10
[ 95.626698][ T5315] ? do_raw_spin_unlock+0x4d/0x210
[ 95.628849][ T5315] ? _raw_spin_unlock+0x28/0x50
[ 95.630875][ T5315] device_initial_probe+0xa1/0xd0
[ 95.632884][ T5315] bus_probe_device+0x12a/0x220
[ 95.634910][ T5315] device_add+0x7d7/0xb80
[ 95.636685][ T5315] i2c_new_client_device+0xa29/0x1130
[ 95.638899][ T5315] ? __pfx_i2c_new_client_device+0x10/0x10
[ 95.641219][ T5315] ? __mutex_lock+0x30d/0x1550
[ 95.643047][ T5315] ? new_device_store+0x132/0x530
[ 95.645023][ T5315] new_device_store+0x24b/0x530
[ 95.646991][ T5315] ? irqentry_exit+0x218/0x8f0
[ 95.648750][ T5315] ? lockdep_hardirqs_on+0x7a/0x110
[ 95.650799][ T5315] ? __pfx_new_device_store+0x10/0x10
[ 95.652836][ T5315] ? __pfx_sysfs_kf_write+0x10/0x10
[ 95.654949][ T5315] ? __pfx_new_device_store+0x10/0x10
[ 95.657120][ T5315] ? dev_attr_store+0x4f/0x90
[ 95.659230][ T5315] ? __pfx_sysfs_kf_write+0x10/0x10
[ 95.661086][ T5315] kernfs_fop_write_iter+0x3a4/0x540
[ 95.663256][ T5315] vfs_write+0x612/0xba0
[ 95.665183][ T5315] ? __pfx_vfs_write+0x10/0x10
[ 95.667099][ T5315] ? __fget_files+0x2a/0x420
[ 95.669023][ T5315] ksys_write+0x150/0x270
[ 95.670806][ T5315] ? __pfx_ksys_write+0x10/0x10
[ 95.672779][ T5315] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.675325][ T5315] do_syscall_64+0x174/0x580
[ 95.677090][ T5315] ? trace_irq_disable+0x3b/0x140
[ 95.679116][ T5315] ? clear_bhb_loop+0x70/0xc0
[ 95.680985][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.683190][ T5315] RIP: 0033:0x7f3bd099e0d9
[ 95.684986][ T5315] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 95.692270][ T5315] RSP: 002b:00007f3bd18c2fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 95.695710][ T5315] RAX: ffffffffffffffda RBX: 00007f3bd0c26090 RCX: 00007f3bd099e0d9
[ 95.698826][ T5315] RDX: 0000000000000007 RSI: 0000200000000600 RDI: 0000000000000005
[ 95.702021][ T5315] RBP: 00007f3bd0a35024 R08: 0000000000000000 R09: 0000000000000000
[ 95.705377][ T5315] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 95.708541][ T5315] R13: 00007f3bd0c26128 R14: 00007f3bd0c26090 R15: 00007ffd1757cdf8
[ 95.711773][ T5315]
[ 95.713421][ T5315] Kernel Offset: disabled
[ 95.715409][ T5315] Rebooting in 86400 seconds..