program: r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000000080008d804dd0000000000000109022400010000a008090400fe01030001000921fffffd0122050009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000080)={0x2c, &(0x7f00000012c0)=ANY=[@ANYBLOB="001105"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f00000005c0)=ANY=[@ANYBLOB="1201000005d0d3087d07aa04d85b0102030109021b000f000000000904000001dbcc7a000905", @ANYRES32], 0x0) sendmsg$NL80211_CMD_AUTHENTICATE(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)={0x60, 0x0, 0x1, 0x20000002, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x81}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x7}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x2}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x4}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0xd9b9fafd212acc2a}], @NL80211_ATTR_AUTH_TYPE={0x8}, @key_params=[@NL80211_ATTR_KEY_SEQ={0x4}, @NL80211_ATTR_KEY={0x10, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}]}]]}, 0x60}, 0x1, 0x0, 0x0, 0x20040040}, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000100)=ANY=[@ANYBLOB='<\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100626f6e64000000000c0002800800040001"], 0x3c}}, 0x0) r2 = syz_open_dev$evdev(&(0x7f00000000c0), 0x4, 0x2) close(0x3) write$char_usb(r2, &(0x7f0000000040)="e2", 0x2250) mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0) write(r3, &(0x7f0000000600)='tahvo 2', 0x7) [ 93.217365][ T5273] Bluetooth: hci0: command tx timeout [ 93.234877][ T11] cfg80211: failed to load regulatory.db [ 93.662258][ T842] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 93.812147][ T842] usb 5-1: Using ep0 maxpacket: 8 [ 93.816383][ T842] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 93.823037][ T842] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 93.828118][ T842] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 93.832663][ T842] usb 5-1: config 0 interface 0 has no altsetting 0 [ 93.835672][ T842] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 93.854027][ T842] usb 5-1: config 0 descriptor?? [ 94.290819][ T842] mcp2221 0003:04D8:00DD.0002: unknown main item tag 0x0 [ 94.296275][ T842] mcp2221 0003:04D8:00DD.0002: unknown main item tag 0x0 [ 94.300199][ T842] mcp2221 0003:04D8:00DD.0002: unknown main item tag 0x0 [ 94.303946][ T842] mcp2221 0003:04D8:00DD.0002: unknown main item tag 0x0 [ 94.307043][ T842] mcp2221 0003:04D8:00DD.0002: unknown main item tag 0x0 [ 94.311362][ T842] mcp2221 0003:04D8:00DD.0002: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.0-1/input0 [ 94.475232][ T5312] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 94.481224][ T5312] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 94.491232][ T5062] usb 5-1: USB disconnect, device number 2 [ 94.554703][ T5312] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000028: 0000 [#1] SMP KASAN NOPTI [ 94.559990][ T5312] KASAN: null-ptr-deref in range [0x0000000000000140-0x0000000000000147] [ 94.563720][ T5312] CPU: 0 UID: 0 PID: 5312 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.567612][ T5312] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.572089][ T5312] RIP: 0010:kasan_byte_accessible+0x12/0x30 [ 94.574799][ T5312] Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 e9 00 74 a8 09 cc 66 66 66 66 66 66 2e [ 94.584019][ T5312] RSP: 0018:ffffc9000e1e7360 EFLAGS: 00010206 [ 94.586925][ T5312] RAX: dffffc0000000000 RBX: ffffffff81a2498d RCX: 8000000000000001 [ 94.590630][ T5312] RDX: 0000000000000000 RSI: ffffffff81a2498d RDI: 0000000000000028 [ 94.594407][ T5312] RBP: ffffffff824f460f R08: 0000000000000001 R09: 0000000000000000 [ 94.598173][ T5312] R10: 000000000000002f R11: 0000000000000002 R12: 0000000000000000 [ 94.601918][ T5312] R13: 0000000000000140 R14: 0000000000000140 R15: 0000000000000001 [ 94.605464][ T5312] FS: 00007f29435d36c0(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000 [ 94.610147][ T5312] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.613429][ T5312] CR2: 00007fff32018d14 CR3: 000000000bf22000 CR4: 0000000000352ef0 [ 94.617083][ T5312] Call Trace: [ 94.618812][ T5312] [ 94.620187][ T5312] __kasan_check_byte+0x12/0x40 [ 94.622495][ T5312] lock_acquire+0x84/0x350 [ 94.624599][ T5312] down_write_nested+0x9d/0x210 [ 94.627210][ T5312] ? start_dirop+0x4f/0x90 [ 94.629684][ T5312] ? __pfx_down_write_nested+0x10/0x10 [ 94.632388][ T5312] ? lookup_noperm_common+0x245/0x430 [ 94.634913][ T5312] start_dirop+0x4f/0x90 [ 94.636892][ T5312] simple_start_creating+0xcc/0x110 [ 94.639409][ T5312] ? __pfx_simple_start_creating+0x10/0x10 [ 94.642154][ T5312] ? mntput+0x65/0xc0 [ 94.644016][ T5312] debugfs_start_creating+0xca/0x1b0 [ 94.646476][ T5312] debugfs_create_dir+0x24/0x350 [ 94.648696][ T5312] i2c_device_probe+0x814/0xbf0 [ 94.651093][ T5312] ? __pfx_i2c_device_probe+0x10/0x10 [ 94.653688][ T5312] ? sysfs_do_create_link_sd+0xe0/0x110 [ 94.656242][ T5312] ? driver_sysfs_add+0x1fe/0x210 [ 94.658741][ T5312] ? __pfx_i2c_device_probe+0x10/0x10 [ 94.661286][ T5312] really_probe+0x254/0xae0 [ 94.663484][ T5312] __driver_probe_device+0x1e8/0x360 [ 94.666161][ T5312] driver_probe_device+0x4f/0x240 [ 94.668508][ T5312] __device_attach_driver+0x270/0x410 [ 94.671442][ T5312] bus_for_each_drv+0x258/0x2f0 [ 94.673846][ T5312] ? __pfx___device_attach_driver+0x10/0x10 [ 94.676643][ T5312] ? __pfx_bus_for_each_drv+0x10/0x10 [ 94.679204][ T5312] ? _raw_spin_unlock_irqrestore+0x76/0x80 [ 94.681841][ T5312] __device_attach+0x2c4/0x450 [ 94.684111][ T5312] ? __pfx___device_attach+0x10/0x10 [ 94.686616][ T5312] ? do_raw_spin_unlock+0x4d/0x200 [ 94.688948][ T5312] ? _raw_spin_unlock+0x28/0x50 [ 94.691209][ T5312] device_initial_probe+0xa1/0xd0 [ 94.694729][ T5312] bus_probe_device+0x12a/0x220 [ 94.697195][ T5312] device_add+0x7d7/0xb80 [ 94.699294][ T5312] i2c_new_client_device+0xa29/0x1130 [ 94.701705][ T5312] ? __pfx_i2c_new_client_device+0x10/0x10 [ 94.704385][ T5312] ? __mutex_lock+0x30b/0x1550 [ 94.706678][ T5312] ? new_device_store+0x132/0x530 [ 94.709083][ T5312] new_device_store+0x24b/0x530 [ 94.711469][ T5312] ? sysfs_file_kobj+0x1a/0x230 [ 94.713740][ T5312] ? sysfs_file_kobj+0x1a/0x230 [ 94.716029][ T5312] ? __pfx_new_device_store+0x10/0x10 [ 94.718583][ T5312] ? sysfs_file_kobj+0x1a/0x230 [ 94.720943][ T5312] ? sysfs_file_kobj+0x1a/0x230 [ 94.723268][ T5312] ? sysfs_file_kobj+0x1e4/0x230 [ 94.725526][ T5312] ? sysfs_kf_write+0x166/0x260 [ 94.727672][ T5312] ? __pfx_sysfs_kf_write+0x10/0x10 [ 94.730128][ T5312] kernfs_fop_write_iter+0x3a4/0x540 [ 94.732619][ T5312] vfs_write+0x612/0xba0 [ 94.734761][ T5312] ? __pfx_vfs_write+0x10/0x10 [ 94.736930][ T5312] ? __fget_files+0x2a/0x420 [ 94.739168][ T5312] ksys_write+0x150/0x270 [ 94.741322][ T5312] ? __pfx_ksys_write+0x10/0x10 [ 94.743548][ T5312] do_syscall_64+0x166/0x520 [ 94.745880][ T5312] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.748899][ T5312] ? clear_bhb_loop+0x70/0xc0 [ 94.751131][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.754048][ T5312] RIP: 0033:0x7f294279e0d9 [ 94.756624][ T5312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.765535][ T5312] RSP: 002b:00007f29435d2fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 94.769645][ T5312] RAX: ffffffffffffffda RBX: 00007f2942a25fa0 RCX: 00007f294279e0d9 [ 94.773465][ T5312] RDX: 0000000000000007 RSI: 0000200000000600 RDI: 0000000000000003 [ 94.777442][ T5312] RBP: 00007f2942835024 R08: 0000000000000000 R09: 0000000000000000 [ 94.781224][ T5312] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.785109][ T5312] R13: 00007f2942a26038 R14: 00007f2942a25fa0 R15: 00007fff210b7ad8 [ 94.788883][ T5312] [ 94.790489][ T5312] Modules linked in: [ 94.794841][ T5312] ---[ end trace 0000000000000000 ]--- [ 94.805795][ T5312] RIP: 0010:kasan_byte_accessible+0x12/0x30 [ 94.811387][ T5312] Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 e9 00 74 a8 09 cc 66 66 66 66 66 66 2e [ 94.821719][ T5312] RSP: 0018:ffffc9000e1e7360 EFLAGS: 00010206 [ 94.825310][ T5312] RAX: dffffc0000000000 RBX: ffffffff81a2498d RCX: 8000000000000001 [ 94.829999][ T5312] RDX: 0000000000000000 RSI: ffffffff81a2498d RDI: 0000000000000028 [ 94.833720][ T5312] RBP: ffffffff824f460f R08: 0000000000000001 R09: 0000000000000000 [ 94.837106][ T5312] R10: 000000000000002f R11: 0000000000000002 R12: 0000000000000000 [ 94.841019][ T5312] R13: 0000000000000140 R14: 0000000000000140 R15: 0000000000000001 [ 94.845981][ T5312] FS: 00007f29435d36c0(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000 [ 94.851127][ T5312] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.855206][ T5312] CR2: 00007fff32018d14 CR3: 000000000bf22000 CR4: 0000000000352ef0 [ 94.859737][ T5312] Kernel panic - not syncing: Fatal exception [ 94.863437][ T5312] Kernel Offset: disabled [ 94.865895][ T5312] Rebooting in 86400 seconds..