program:
r0 = syz_usb_connect(0x3, 0x2d, &(0x7f0000001080)=ANY=[@ANYBLOB="120100004898b610c2154500201f0102030109021b0001000500ea09040002018c78fd00090582f3c6"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$printer(0x2, 0x2d, &(0x7f00000010c0)=ANY=[], 0x0)
syz_usb_control_io$printer(r1, &(0x7f0000001100)={0x14, 0x0, &(0x7f0000001140)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
bpf$TOKEN_CREATE(0x24, 0x0, 0x0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000010c0), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0)
ioctl$KVM_GET_MSRS_cpu(r4, 0xc008ae88, &(0x7f0000001240)={0x2, 0x0, [{0x606, 0x0, 0x5}, {0x400, 0x0, 0x3}]})
r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000)
write$char_usb(r5, &(0x7f0000001180)="0bcde56ca9a62cbf", 0x8)
syz_usb_disconnect(r1)
bpf$MAP_CREATE(0x0, &(0x7f00000011c0)=@bloom_filter, 0x10)
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000040)='./file1\x00', 0x200000, &(0x7f0000000080)={[{@noinit_itable}]}, 0xfe, 0x596, &(0x7f0000000180)="$eJzs3d9rFNceAPDvbLLRGK9GELn3crkEfKhF3Jikthb6YB9LKxXadxuSNUg2rmQ3YlKh+lBf+lKkUEqF0j+g730q0n+gf4WlFaRIqAX7sGU2s7pJdvPL1azZzwdG58ycmXPOznxPzuzZZQPoWSPpP7mI/0TEl0nE4aZ9/ZHtHFnJt/zoxlS6JFGrffRHEkm2rZE/yf4fyhL/joifP484mVtfbmVxaXayVCrOZ+nR6tzV0cri0qnLc5MzxZnilfGJibNnJsbffuvNjrX19QuPv/nw3ntnvzi+/PUPD47cSeJcHMz2NbdjQ/s23HuzOTESI9lrko9zazKObafir4BktyvAjvRlcZ6PtA84HH1Z1AN732cRUdu+Jzs4Bug6yU7iH9gDGuOAxrP9lp+D94iH7648AK1vf7Ly3kjsrz8bHVhOVj0Zpc+7wx0oPy3jx9/v3kmX2M77EADP6eatiDjd39++/1vj79qWz316C3nWlqH/g5fnXjr++WkwYl38556Of6LF+GeoRezuxObxn3uwMgnVZKADBWfS8d87Lce/T4sc7stS/6qP+fLJpculYtq3HYqIE5Hfl6Y3ms85u3y/bafZPP5Ll7T8xlgwq8eD/jVzTtOT1cnnaXOzh7ci/rvJ+Ddpcf3T1+PCFss4Vrz7/3b7Nm//i1X7PuK1ltf/2YxWsvH85Gj9fhht3BXr/Xn72C/tyt/t9qfX/8DG7R9OmudrK9sv47v9T4rt9o0k2aTpNu//geTjes/U6AquT1ar82MRA8kH9fSq7ePPjm2kG/nT9p843jr+N7r/ByPiky22//bR222z1q//4d29/tPbuv4brzw+s3JQ867773/6bbvyt9b/vVFfO5Ft2Ur/17aCA6u37PiFAwAAAAAAgC6UG4g4GEmukM3pH4xcrlBY+XzH0TiQK5Ur1ZOXygtXpqP+XdnhyOcaM91DTZ+HGMuOb6THs8/HNtITEXEkIr7qG6ynC1Pl0vRuNx4AAAAAAAAAAAAAAAAAAAC6xFC0/v5/6re+3a4d8ML5yW/oXavif1+LDJ34pSegK/n7D71L/EPvEv/Qu8Q/9C7xD71L/EPv2ln8/+9QxysCvHT+/gMAAAAAAAAAAAAAAAAAAAAAAAAAAEBHXTh/Pl1qy49uTEXE/ri2uDBbvnZqupifLcwtTBWmyvNXCzPl8kypWJgqz212vlK5fHVsPBauj1aLlepoZXHp4lx54Ur14uW5yZnixWL+5TQLAAAAAAAAAAAAAAAAAAAAXimVxaXZyVKpON+dK/kOn/DXLmnXHlrp745qWJmvDEYHT7i6n/irVqvtVh8FAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP8EAAD//3hONlo=")
renameat2(0xffffffffffffff9c, &(0x7f0000000740)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./file1/file0\x00', 0x0)
r6 = syz_mount_image$ext4(&(0x7f00000007c0)='ext4\x00', &(0x7f0000000800)='./file0\x00', 0x2204f1a, &(0x7f0000000840)={[{@delalloc}]}, 0x82, 0x48f, &(0x7f0000000880)="$eJzs3M1vVFUfAODfvf3gffmsigpItEqMjR8tLags3Gg0cYHRRBeoq9oWQijU0JpYQqAagxsTQ6JrdWniX+DOjVFXJiaudG9IiLIBjYsx9869Mp12mKFOZwrzPMnQc+acO+ecnnvuPfccpgH0rOHsnyRia0T8EhE7qtHlGYarP65dOTv155WzU0lUKq/+nuT5rl45O1VmLY/bUkRG0oj0g6QoZLn5xTMnJmdnZ04X8bGFk2+PzS+eeeL4ycljM8dmTk0cOnTwwPjTT0082ZZ2Zu26uufc3N7dL75+8aWpIxff+v6rrL5bi/TadqzJ4Mq3hrOG/1HJ1ac9HP//T8VtNNtqwkl/FyvCTemLiKy7BrLxX6lUztek7YgX3m9y+JZ1rh6wjrJ706ZV3i/ui0uVhpIbpgK3giS6XQOgO8r7ffb8W746OP3ousvPVh+AsnZfK17VlP5IizwDdc+37TQcEUeW/vose0U71iEAAJr4aOrTw/H4avO/NO6pybe92EMZiog7IuLOiLgrInZGxN0Red57I2JXK4XWbBDUbw2tnP+kl9beuuay+d8zxd7W8vlfOfuLob4iti1v/0By9PjszP7idzISA5uy+PgNyvjm+Z8+bpRWO//LXln55VywqMel/roFuunJhcl8UtoGl9+L2NMff1cqlbr2J1H2UhIRuyNiz8199PYycPzRL/c2ytS8/Ss+7ro27DNVvoh4pNr/S1HX/lKycn9ycNv1/cmx/8XszP6x8qxY6YcfL7zSqPzW278+sv7fvPz8L1I+XywCQ2/W7tfOR4Ody60Ny7jw64cNn2nWev4PJq/l16Ny2/XdyYWF0+MRg8nhPL7s/Ynrx5bxMn/W/pF9WUrZ/vLINL/GRdH/90XE3mK/7P6IeKCo+4MR8VBE7GvY+ojvnmucthH6f7qm/5OoP/93nav+LPt/8aYDfSe+/bpR+a31/8E8NFK8k1//mmi1gmv/zQEAAMCtI81XbpJ09N9wmo6OVv9j787YnM7OzS88dnTunVPT1RWeoRhIy5WuHTXroePJUvGJ1fhEsVZcph8o1o0/6Ys8Pjo1Nzvd5bZDr9vSYPxnfuvrdu2AdbfaPtrEKl9oA24/9eM/XR49/3InKwN0lO9rQ+9qMv7TTtUD6Dz3f+hdq43/83VxewFwe3L/h95l/EPvMv6hd9WN/774uVs1ATpoDV/nFxCYXzwT6YaoRkuB1v8exHoH3tgY1Wgh0O0rEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQHv8EwAA//9gP+wr")
chdir(&(0x7f0000000d40)='./file0\x00')
openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./debug\x00', 0x14e)
mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000d80)='debugfs\x00', 0x0, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000dc0)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r7, &(0x7f0000000e00)='+p', 0x2)
mkdir(&(0x7f0000000e40)='./bus\x00', 0x49)
mkdirat(r6, &(0x7f0000000e80)='./bus\x00', 0x48)
mkdirat(0xffffffffffffff9c, &(0x7f0000000ec0)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f0000000f00)='./file0\x00', &(0x7f0000000f40), 0x8, &(0x7f0000000f80)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]})
mount$overlay(0x0, &(0x7f0000000fc0)='./bus\x00', &(0x7f0000001000), 0x100c010, &(0x7f0000001040)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './debug'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@index_off}]})
[ 93.409708][ T5283] Bluetooth: hci0: command tx timeout
[ 93.446510][ T9] cfg80211: failed to load regulatory.db
[ 93.814074][ T9] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 93.964076][ T9] usb 5-1: Using ep0 maxpacket: 16
[ 93.965690][ T9] usb 5-1: New USB device found, idVendor=15c2, idProduct=0045, bcdDevice=1f.20
[ 93.967482][ T9] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7
[ 93.967503][ T9] usb 5-1: config 0 interface 0 has no altsetting 0
[ 93.970419][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 93.970434][ T9] usb 5-1: Product: syz
[ 93.970442][ T9] usb 5-1: Manufacturer: syz
[ 93.970450][ T9] usb 5-1: SerialNumber: syz
[ 94.018791][ T9] usb 5-1: config 0 descriptor??
[ 94.249367][ C0] imon 5-1:0.0: imon usb_rx_callback_intf0: status(-71)
[ 94.280960][ T9] input: iMON Panel, Knob and Mouse(15c2:0045) as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/input/input5
[ 94.361697][ T9] imon:send_packet: packet tx failed (-71)
[ 94.374004][ T9] imon 5-1:0.0: panel buttons/knobs setup failed
[ 94.474049][ T9] rc_core: IR keymap rc-imon-pad not found
[ 94.474133][ T9] Registered IR keymap rc-empty
[ 94.474321][ T9] imon 5-1:0.0: Looks like you're trying to use an IR protocol this device does not support
[ 94.474331][ T9] imon 5-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol
[ 94.475333][ T9] imon:send_packet: packet tx failed (-71)
[ 94.507682][ T9] imon 5-1:0.0: remote input dev register failed
[ 94.507850][ T9] imon 5-1:0.0: imon_init_intf0: rc device setup failed
[ 94.560102][ T9] imon 5-1:0.0: unable to initialize intf0, err 0
[ 94.560118][ T9] imon:imon_probe: failed to initialize context!
[ 94.560125][ T9] imon 5-1:0.0: unable to register, err -19
[ 94.580287][ T9] usb 5-1: USB disconnect, device number 2
[ 94.914164][ T9] usb 5-1: new full-speed USB device number 3 using dummy_hcd
[ 95.064978][ T9] usb 5-1: New USB device found, idVendor=15c2, idProduct=0045, bcdDevice=1f.20
[ 95.066349][ T9] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 10
[ 95.066370][ T9] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid maxpacket 198, setting to 64
[ 95.066385][ T9] usb 5-1: config 0 interface 0 has no altsetting 0
[ 95.068769][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 95.068785][ T9] usb 5-1: Product: syz
[ 95.068794][ T9] usb 5-1: Manufacturer: syz
[ 95.068803][ T9] usb 5-1: SerialNumber: syz
[ 95.073708][ T9] usb 5-1: config 0 descriptor??
[ 95.104257][ T5323] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[ 95.323504][ C0] imon 5-1:0.0: imon usb_rx_callback_intf0: status(-71)
[ 95.337297][ T9] input: iMON Panel, Knob and Mouse(15c2:0045) as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/input/input7
[ 95.454469][ T5283] Bluetooth: hci0: command tx timeout
[ 95.604030][ T9] rc_core: IR keymap rc-imon-pad not found
[ 95.604051][ T9] Registered IR keymap rc-empty
[ 95.604124][ T9] imon 5-1:0.0: Looks like you're trying to use an IR protocol this device does not support
[ 95.604135][ T9] imon 5-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol
[ 95.749613][ T9] rc rc0: iMON Remote (15c2:0045) as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/rc/rc0
[ 95.751913][ T9] input: iMON Remote (15c2:0045) as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/rc/rc0/input8
[ 95.770570][ T9] imon 5-1:0.0: iMON device (15c2:0045, intf0) on usb<5:3> initialized
[ 96.035514][ T9] usb 5-1: USB disconnect, device number 3
[ 96.036205][ T5323] imon:send_packet: packet tx failed (-71)
[ 96.054466][ T5323] imon:lcd_write: send packet failed!
[ 96.252938][ T5323] loop0: detected capacity change from 0 to 1024
[ 96.336931][ T5323] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[ 96.378524][ T5323] EXT4-fs error (device loop0): ext4_generic_delete_entry:2675: inode #2: block 16: comm syz.0.0: bad entry in directory: inode out of bounds - offset=0, inode=1538, rec_len=12, size=1024 fake=1
[ 96.400532][ T5323] EXT4-fs error (device loop0) in ext4_delete_entry:2746: Corrupt filesystem
[ 96.401796][ T5323] EXT4-fs warning (device loop0): ext4_rename_delete:3741: inode #2: comm syz.0.0: Deleting old file: nlink 1, error=-117
[ 96.505501][ T5324] overlayfs: failed to resolve './file1': -2
[ 96.507059][ T5324] overlayfs: failed to resolve './file1': -2
[ 97.326190][ T5323] ==================================================================
[ 97.326204][ T5323] BUG: KASAN: slab-use-after-free in dev_driver_string+0x35/0xd0
[ 97.326310][ T5323] Read of size 8 at addr ffff888000dca0e0 by task syz.0.0/5323
[ 97.326322][ T5323]
[ 97.326332][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 97.326346][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 97.326354][ T5323] Call Trace:
[ 97.326361][ T5323]
[ 97.326368][ T5323] dump_stack_lvl+0xe8/0x150
[ 97.326401][ T5323] print_address_description+0x55/0x1e0
[ 97.326419][ T5323] ? dev_driver_string+0x35/0xd0
[ 97.326433][ T5323] print_report+0x58/0x70
[ 97.326449][ T5323] kasan_report+0x117/0x150
[ 97.326466][ T5323] ? dev_driver_string+0x35/0xd0
[ 97.326482][ T5323] dev_driver_string+0x35/0xd0
[ 97.326497][ T5323] __dynamic_dev_dbg+0x1ae/0x2e0
[ 97.326515][ T5323] ? __mutex_lock+0x30b/0x1550
[ 97.326574][ T5323] ? __pfx___dynamic_dev_dbg+0x10/0x10
[ 97.326590][ T5323] ? __pfx_ima_file_free+0x10/0x10
[ 97.326609][ T5323] ? __asan_memset+0x22/0x50
[ 97.326627][ T5323] ? __fsnotify_parent+0x267/0x620
[ 97.326640][ T5323] ? display_close+0x4b/0x240
[ 97.326665][ T5323] display_close+0x1f9/0x240
[ 97.326683][ T5323] ? __pfx_display_close+0x10/0x10
[ 97.326700][ T5323] __fput+0x40d/0xa50
[ 97.326718][ T5323] task_work_run+0x1d9/0x270
[ 97.326733][ T5323] ? __pfx_task_work_run+0x10/0x10
[ 97.326746][ T5323] ? do_raw_spin_unlock+0x4d/0x200
[ 97.326767][ T5323] do_exit+0x73a/0x2350
[ 97.326783][ T5323] ? __pfx_do_exit+0x10/0x10
[ 97.326804][ T5323] ? do_raw_spin_lock+0x12b/0x2f0
[ 97.326825][ T5323] do_group_exit+0x22d/0x2f0
[ 97.326837][ T5323] ? _raw_spin_unlock_irq+0x23/0x50
[ 97.326850][ T5323] get_signal+0x121b/0x12c0
[ 97.326872][ T5323] arch_do_signal_or_restart+0xbb/0x860
[ 97.326892][ T5323] ? __pfx_arch_do_signal_or_restart+0x10/0x10
[ 97.326914][ T5323] exit_to_user_mode_loop+0x10e/0x770
[ 97.326929][ T5323] ? rcu_is_watching+0x16/0xb0
[ 97.326947][ T5323] do_syscall_64+0x328/0x520
[ 97.326960][ T5323] ? trace_irq_disable+0x3b/0x140
[ 97.326975][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 97.326988][ T5323] ? clear_bhb_loop+0x70/0xc0
[ 97.327002][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 97.327015][ T5323] RIP: 0033:0x7f7a1bb9e559
[ 97.327027][ T5323] Code: Unable to access opcode bytes at 0x7f7a1bb9e52f.
[ 97.327034][ T5323] RSP: 002b:00007f7a1c9f00a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[ 97.327060][ T5323] RAX: fffffffffffffe00 RBX: 00007f7a1be25fa8 RCX: 00007f7a1bb9e559
[ 97.327070][ T5323] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f7a1be25fa8
[ 97.327079][ T5323] RBP: 00007f7a1be25fa0 R08: 0000000000000000 R09: 0000000000000000
[ 97.327087][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 97.327095][ T5323] R13: 00007f7a1be26038 R14: 00007ffdcc8054b0 R15: 00007ffdcc805598
[ 97.327120][ T5323]
[ 97.327125][ T5323]
[ 97.327129][ T5323] Allocated by task 9:
[ 97.327145][ T5323] kasan_save_track+0x3e/0x80
[ 97.327158][ T5323] __kasan_kmalloc+0x93/0xb0
[ 97.327170][ T5323] __kmalloc_cache_noprof+0x321/0x600
[ 97.327182][ T5323] usb_set_configuration+0x3c5/0x2260
[ 97.327198][ T5323] usb_generic_driver_probe+0x8d/0x150
[ 97.327214][ T5323] usb_probe_device+0x1c3/0x3b0
[ 97.327229][ T5323] really_probe+0x254/0xae0
[ 97.327245][ T5323] __driver_probe_device+0x1e8/0x360
[ 97.327260][ T5323] driver_probe_device+0x4f/0x240
[ 97.327275][ T5323] __device_attach_driver+0x270/0x410
[ 97.327291][ T5323] bus_for_each_drv+0x258/0x2f0
[ 97.327301][ T5323] __device_attach+0x2c4/0x450
[ 97.327315][ T5323] device_initial_probe+0xa1/0xd0
[ 97.327329][ T5323] bus_probe_device+0x12a/0x220
[ 97.327340][ T5323] device_add+0x7d7/0xb80
[ 97.327353][ T5323] usb_new_device+0x9aa/0x1690
[ 97.327366][ T5323] hub_event+0x28e8/0x4d30
[ 97.327380][ T5323] process_scheduled_works+0xc3d/0x1630
[ 97.327396][ T5323] worker_thread+0xa47/0xfb0
[ 97.327411][ T5323] kthread+0x38b/0x480
[ 97.327422][ T5323] ret_from_fork+0x514/0xb70
[ 97.327433][ T5323] ret_from_fork_asm+0x1a/0x30
[ 97.327444][ T5323]
[ 97.327447][ T5323] Freed by task 9:
[ 97.327453][ T5323] kasan_save_track+0x3e/0x80
[ 97.327464][ T5323] kasan_save_free_info+0x40/0x50
[ 97.327479][ T5323] __kasan_slab_free+0x5c/0x80
[ 97.327490][ T5323] kfree+0x1c5/0x650
[ 97.327504][ T5323] device_release+0xc4/0x1f0
[ 97.327518][ T5323] kobject_put+0x222/0x550
[ 97.327530][ T5323] usb_disable_device+0x611/0x8d0
[ 97.327544][ T5323] usb_disconnect+0x346/0x9a0
[ 97.327556][ T5323] hub_event+0x1bbb/0x4d30
[ 97.327568][ T5323] process_scheduled_works+0xc3d/0x1630
[ 97.327581][ T5323] worker_thread+0xa47/0xfb0
[ 97.327593][ T5323] kthread+0x38b/0x480
[ 97.327602][ T5323] ret_from_fork+0x514/0xb70
[ 97.327610][ T5323] ret_from_fork_asm+0x1a/0x30
[ 97.327618][ T5323]
[ 97.327621][ T5323] The buggy address belongs to the object at ffff888000dca000
[ 97.327621][ T5323] which belongs to the cache kmalloc-2k of size 2048
[ 97.327631][ T5323] The buggy address is located 224 bytes inside of
[ 97.327631][ T5323] freed 2048-byte region [ffff888000dca000, ffff888000dca800)
[ 97.327642][ T5323]
[ 97.327646][ T5323] The buggy address belongs to the physical page:
[ 97.327653][ T5323] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xdc8
[ 97.327663][ T5323] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 97.327672][ T5323] flags: 0x7ff00000000040(head|node=0|zone=0|lastcpupid=0x7ff)
[ 97.327683][ T5323] page_type: f5(slab)
[ 97.327692][ T5323] raw: 007ff00000000040 ffff88801c042000 dead000000000100 dead000000000122
[ 97.327701][ T5323] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 97.327712][ T5323] head: 007ff00000000040 ffff88801c042000 dead000000000100 dead000000000122
[ 97.327721][ T5323] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 97.327730][ T5323] head: 007ff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 97.327740][ T5323] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 97.327746][ T5323] page dumped because: kasan: bad access detected
[ 97.327762][ T5323] page_owner tracks the page as allocated
[ 97.327767][ T5323] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd28c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5282, tgid 5282 (syz-executor), ts 89546021261
[ 97.327786][ T5323] post_alloc_hook+0x1f9/0x250
[ 97.327807][ T5323] get_page_from_freelist+0x2209/0x2280
[ 97.327818][ T5323] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 97.327829][ T5323] allocate_slab+0x7d/0x620
[ 97.327842][ T5323] refill_objects+0x2d5/0x350
[ 97.327855][ T5323] __pcs_replace_empty_main+0x2c8/0x6c0
[ 97.327890][ T5323] __kmalloc_node_track_caller_noprof+0x548/0x720
[ 97.327901][ T5323] pskb_expand_head+0x22c/0x13a0
[ 97.327912][ T5323] netlink_trim+0x1b3/0x2c0
[ 97.327922][ T5323] netlink_broadcast_filtered+0x77/0x1070
[ 97.327932][ T5323] nlmsg_notify+0xe3/0x1a0
[ 97.327943][ T5323] netif_open+0xec/0x190
[ 97.327956][ T5323] dev_open+0x101/0x220
[ 97.327971][ T5323] bond_enslave+0xeb2/0x3b10
[ 97.327981][ T5323] do_set_master+0x563/0x720
[ 97.327991][ T5323] do_setlink+0xe7b/0x4670
[ 97.328000][ T5323] page last free pid 4701 tgid 4701 ts 33978839312 stack trace:
[ 97.328008][ T5323] __free_frozen_pages+0xc93/0xd90
[ 97.328023][ T5323] __slab_free+0x274/0x2c0
[ 97.328033][ T5323] qlist_free_all+0x99/0x100
[ 97.328043][ T5323] kasan_quarantine_reduce+0x148/0x160
[ 97.328053][ T5323] __kasan_slab_alloc+0x22/0x80
[ 97.328064][ T5323] kmem_cache_alloc_noprof+0x2b9/0x600
[ 97.328079][ T5323] do_getname+0x2e/0x250
[ 97.328091][ T5323] do_sys_openat2+0xcc/0x200
[ 97.328103][ T5323] __x64_sys_openat+0x138/0x170
[ 97.328115][ T5323] do_syscall_64+0x166/0x520
[ 97.328126][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 97.328136][ T5323]
[ 97.328139][ T5323] Memory state around the buggy address:
[ 97.328146][ T5323] ffff888000dc9f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 97.328153][ T5323] ffff888000dca000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 97.328161][ T5323] >ffff888000dca080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 97.328167][ T5323] ^
[ 97.328173][ T5323] ffff888000dca100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 97.328180][ T5323] ffff888000dca180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 97.328186][ T5323] ==================================================================
[ 97.328287][ T5323] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 97.691692][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 97.695591][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 97.699988][ T5323] Call Trace:
[ 97.701515][ T5323]
[ 97.702864][ T5323] vpanic+0x56d/0xa60
[ 97.704662][ T5323] ? __pfx_vpanic+0x10/0x10
[ 97.706695][ T5323] panic+0xc5/0xd0
[ 97.708398][ T5323] ? __pfx_panic+0x10/0x10
[ 97.710369][ T5323] ? preempt_schedule_thunk+0x16/0x40
[ 97.712640][ T5323] ? dev_driver_string+0x35/0xd0
[ 97.714769][ T5323] ? preempt_schedule_thunk+0x16/0x40
[ 97.717038][ T5323] ? dev_driver_string+0x35/0xd0
[ 97.719193][ T5323] check_panic_on_warn+0x89/0xb0
[ 97.721342][ T5323] ? dev_driver_string+0x35/0xd0
[ 97.723507][ T5323] end_report+0x73/0x170
[ 97.725428][ T5323] ? dev_driver_string+0x35/0xd0
[ 97.727613][ T5323] kasan_report+0x128/0x150
[ 97.729561][ T5323] ? dev_driver_string+0x35/0xd0
[ 97.731759][ T5323] dev_driver_string+0x35/0xd0
[ 97.733701][ T5323] __dynamic_dev_dbg+0x1ae/0x2e0
[ 97.735754][ T5323] ? __mutex_lock+0x30b/0x1550
[ 97.737939][ T5323] ? __pfx___dynamic_dev_dbg+0x10/0x10
[ 97.740336][ T5323] ? __pfx_ima_file_free+0x10/0x10
[ 97.742588][ T5323] ? __asan_memset+0x22/0x50
[ 97.744606][ T5323] ? __fsnotify_parent+0x267/0x620
[ 97.746878][ T5323] ? display_close+0x4b/0x240
[ 97.748919][ T5323] display_close+0x1f9/0x240
[ 97.750878][ T5323] ? __pfx_display_close+0x10/0x10
[ 97.753050][ T5323] __fput+0x40d/0xa50
[ 97.754878][ T5323] task_work_run+0x1d9/0x270
[ 97.756915][ T5323] ? __pfx_task_work_run+0x10/0x10
[ 97.759193][ T5323] ? do_raw_spin_unlock+0x4d/0x200
[ 97.761409][ T5323] do_exit+0x73a/0x2350
[ 97.763239][ T5323] ? __pfx_do_exit+0x10/0x10
[ 97.765312][ T5323] ? do_raw_spin_lock+0x12b/0x2f0
[ 97.767540][ T5323] do_group_exit+0x22d/0x2f0
[ 97.769547][ T5323] ? _raw_spin_unlock_irq+0x23/0x50
[ 97.771877][ T5323] get_signal+0x121b/0x12c0
[ 97.773972][ T5323] arch_do_signal_or_restart+0xbb/0x860
[ 97.776564][ T5323] ? __pfx_arch_do_signal_or_restart+0x10/0x10
[ 97.779308][ T5323] exit_to_user_mode_loop+0x10e/0x770
[ 97.781743][ T5323] ? rcu_is_watching+0x16/0xb0
[ 97.783976][ T5323] do_syscall_64+0x328/0x520
[ 97.786161][ T5323] ? trace_irq_disable+0x3b/0x140
[ 97.788554][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 97.791345][ T5323] ? clear_bhb_loop+0x70/0xc0
[ 97.793492][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 97.796216][ T5323] RIP: 0033:0x7f7a1bb9e559
[ 97.798271][ T5323] Code: Unable to access opcode bytes at 0x7f7a1bb9e52f.
[ 97.801429][ T5323] RSP: 002b:00007f7a1c9f00a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[ 97.805155][ T5323] RAX: fffffffffffffe00 RBX: 00007f7a1be25fa8 RCX: 00007f7a1bb9e559
[ 97.808740][ T5323] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f7a1be25fa8
[ 97.812343][ T5323] RBP: 00007f7a1be25fa0 R08: 0000000000000000 R09: 0000000000000000
[ 97.815995][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 97.819621][ T5323] R13: 00007f7a1be26038 R14: 00007ffdcc8054b0 R15: 00007ffdcc805598
[ 97.823119][ T5323]
[ 97.824963][ T5323] Kernel Offset: disabled
[ 97.826917][ T5323] Rebooting in 86400 seconds..