program:
mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000000), &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000a00)={0x84, &(0x7f0000000b00)={0x40, 0x3, 0x4, "01010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000a00)={0x84, &(0x7f0000000000), &(0x7f0000000000)={0x0, 0xa, 0x1}, &(0x7f0000000000)={0x0, 0x8, 0x1}, &(0x7f0000000000)={0x20, 0x0, 0x4}, &(0x7f0000000040)={0x20, 0x0, 0x4}, &(0x7f0000000000)={0x40, 0x7, 0x2}, &(0x7f0000000000)={0x40, 0x9, 0x1}, &(0x7f0000000000)={0x40, 0xb, 0x2, "4883"}, &(0x7f0000000000)={0x40, 0xf, 0x2}, &(0x7f0000000000)={0x40, 0x13, 0x6}, &(0x7f0000000000)={0x40, 0x17, 0x6, @random="c17d5a4db5a7"}, &(0x7f0000000000)={0x40, 0x19, 0x2}, &(0x7f0000000000)={0x40, 0x1a, 0x2}, &(0x7f0000000000)={0x40, 0x1c, 0x1}, &(0x7f0000000000)={0x40, 0x1e, 0x1}, &(0x7f0000000000)={0x40, 0x21, 0x1}})
syz_emit_ethernet(0x32, &(0x7f0000000200)={@broadcast, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0xe000, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x0, 0x10, 0x0, @opaque="0b80d010da6a6a3c"}}}}}, 0x0)
syz_emit_ethernet(0x3a, &(0x7f0000002840)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x2, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x0, 0x18, 0x0, @wg=@data={0x4, 0x9, 0xb2b}}}}}}, 0x0)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000600)='tahvo 2', 0x7)
syz_usb_control_io(r0, 0x0, &(0x7f0000000a00)={0x0, &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000140)=ANY=[@ANYBLOB="0900c7d1403ef7ff25ffff009e6f15f56fb4d1375a18d9cc3244b7be53d1721b5682d60ad2c3c7aef1cd3c8ceb6a2af4b1116c33f0922c0565167763af875575cf209a87ac50f07b43797131f95bb7aa5b2dea1006f0d8f5ee3b6dc4110c87fea5a081c8e92f8cced5141f9117c5f4887bd953022fa96a5f7ccb4191f3972c687e5c39e3d24d2203016134f7f708035691b92785c652"]})
syz_usb_control_io(r0, 0x0, &(0x7f0000000a00))
syz_usb_disconnect(r0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000a00))
nanosleep(&(0x7f0000000700)={0x0, 0x5f5e100}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/bus/platform/devices/tahvo-usb.2-0002\x00', 0x20000, 0x0)
mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff) (async)
mount(&(0x7f0000000000), &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) (async)
syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000a00)={0x84, &(0x7f0000000b00)={0x40, 0x3, 0x4, "01010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000a00)={0x84, &(0x7f0000000000), &(0x7f0000000000)={0x0, 0xa, 0x1}, &(0x7f0000000000)={0x0, 0x8, 0x1}, &(0x7f0000000000)={0x20, 0x0, 0x4}, &(0x7f0000000040)={0x20, 0x0, 0x4}, &(0x7f0000000000)={0x40, 0x7, 0x2}, &(0x7f0000000000)={0x40, 0x9, 0x1}, &(0x7f0000000000)={0x40, 0xb, 0x2, "4883"}, &(0x7f0000000000)={0x40, 0xf, 0x2}, &(0x7f0000000000)={0x40, 0x13, 0x6}, &(0x7f0000000000)={0x40, 0x17, 0x6, @random="c17d5a4db5a7"}, &(0x7f0000000000)={0x40, 0x19, 0x2}, &(0x7f0000000000)={0x40, 0x1a, 0x2}, &(0x7f0000000000)={0x40, 0x1c, 0x1}, &(0x7f0000000000)={0x40, 0x1e, 0x1}, &(0x7f0000000000)={0x40, 0x21, 0x1}}) (async)
syz_emit_ethernet(0x32, &(0x7f0000000200)={@broadcast, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0xe000, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x0, 0x10, 0x0, @opaque="0b80d010da6a6a3c"}}}}}, 0x0) (async)
syz_emit_ethernet(0x3a, &(0x7f0000002840)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x2, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x0, 0x18, 0x0, @wg=@data={0x4, 0x9, 0xb2b}}}}}}, 0x0) (async)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0) (async)
socket$inet_tcp(0x2, 0x1, 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0) (async)
write(r1, &(0x7f0000000600)='tahvo 2', 0x7) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000a00)={0x0, &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000140)=ANY=[@ANYBLOB="0900c7d1403ef7ff25ffff009e6f15f56fb4d1375a18d9cc3244b7be53d1721b5682d60ad2c3c7aef1cd3c8ceb6a2af4b1116c33f0922c0565167763af875575cf209a87ac50f07b43797131f95bb7aa5b2dea1006f0d8f5ee3b6dc4110c87fea5a081c8e92f8cced5141f9117c5f4887bd953022fa96a5f7ccb4191f3972c687e5c39e3d24d2203016134f7f708035691b92785c652"]}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000a00)) (async)
syz_usb_disconnect(r0) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000a00)) (async)
nanosleep(&(0x7f0000000700)={0x0, 0x5f5e100}, 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/bus/platform/devices/tahvo-usb.2-0002\x00', 0x20000, 0x0) (async)
[ 92.972327][ T4653] Bluetooth: hci0: command tx timeout
[ 92.980914][ T9] cfg80211: failed to load regulatory.db
[ 93.438803][ T5316] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 93.592644][ T5316] usb 5-1: New USB device found, idVendor=0403, idProduct=c631, bcdDevice= 1.00
[ 93.596614][ T5316] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 93.622228][ T5316] i2c-tiny-usb 5-1:1.0: version 1.00 found at bus 005 address 002
[ 94.013991][ T5316] (null): failure reading functionality
[ 94.323224][ T5316] i2c i2c-2: failure reading functionality
[ 94.355177][ T5316] i2c i2c-2: connected i2c-tiny-usb device
[ 94.728921][ T5316] usb 5-1: USB disconnect, device number 2
[ 94.736134][ T5330] i2c i2c-2: failure reading status
[ 94.750470][ T5330] retu-mfd 2-0002: could not read Tahvo revision: -5
[ 94.762482][ T5330] ==================================================================
[ 94.765961][ T5330] BUG: KASAN: slab-use-after-free in _raw_spin_lock+0x2e/0x40
[ 94.769108][ T5330] Read of size 1 at addr ffff8880122c5e30 by task syz.0.0/5330
[ 94.772071][ T5330]
[ 94.773081][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.773094][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.773101][ T5330] Call Trace:
[ 94.773108][ T5330]
[ 94.773113][ T5330] dump_stack_lvl+0xe8/0x150
[ 94.773132][ T5330] print_address_description+0x55/0x1e0
[ 94.773146][ T5330] ? _raw_spin_lock+0x2e/0x40
[ 94.773162][ T5330] print_report+0x58/0x70
[ 94.773175][ T5330] kasan_report+0x117/0x150
[ 94.773187][ T5330] ? _raw_spin_lock+0x2e/0x40
[ 94.773202][ T5330] ? lockref_get+0x15/0x60
[ 94.773257][ T5330] __kasan_check_byte+0x2a/0x40
[ 94.773269][ T5330] lock_acquire+0x84/0x350
[ 94.773284][ T5330] ? do_raw_spin_lock+0x12b/0x2f0
[ 94.773296][ T5330] _raw_spin_lock+0x2e/0x40
[ 94.773305][ T5330] ? lockref_get+0x15/0x60
[ 94.773316][ T5330] lockref_get+0x15/0x60
[ 94.773327][ T5330] __simple_recursive_removal+0x33/0x520
[ 94.773340][ T5330] ? mntput+0x65/0xc0
[ 94.773348][ T5330] ? __pfx_remove_one+0x10/0x10
[ 94.773359][ T5330] debugfs_remove+0x5b/0x70
[ 94.773368][ T5330] i2c_device_probe+0x8dc/0xbf0
[ 94.773381][ T5330] ? __pfx_i2c_device_probe+0x10/0x10
[ 94.773394][ T5330] ? sysfs_do_create_link_sd+0xe0/0x110
[ 94.773403][ T5330] ? driver_sysfs_add+0x1fe/0x210
[ 94.773413][ T5330] ? __pfx_i2c_device_probe+0x10/0x10
[ 94.773423][ T5330] really_probe+0x254/0xae0
[ 94.773434][ T5330] __driver_probe_device+0x1e8/0x360
[ 94.773445][ T5330] driver_probe_device+0x4f/0x240
[ 94.773457][ T5330] __device_attach_driver+0x270/0x410
[ 94.773469][ T5330] bus_for_each_drv+0x258/0x2f0
[ 94.773484][ T5330] ? __pfx___device_attach_driver+0x10/0x10
[ 94.773496][ T5330] ? __pfx_bus_for_each_drv+0x10/0x10
[ 94.773506][ T5330] ? lockdep_hardirqs_on+0x7a/0x110
[ 94.773513][ T5330] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 94.773520][ T5330] __device_attach+0x2c4/0x450
[ 94.773527][ T5330] ? __pfx___device_attach+0x10/0x10
[ 94.773533][ T5330] ? do_raw_spin_unlock+0x4d/0x210
[ 94.773541][ T5330] ? _raw_spin_unlock+0x28/0x50
[ 94.773547][ T5330] device_initial_probe+0xa1/0xd0
[ 94.773554][ T5330] bus_probe_device+0x12a/0x220
[ 94.773562][ T5330] device_add+0x7d7/0xb80
[ 94.773572][ T5330] i2c_new_client_device+0xa29/0x1130
[ 94.773585][ T5330] ? __pfx_i2c_new_client_device+0x10/0x10
[ 94.773596][ T5330] ? __mutex_lock+0x30d/0x1550
[ 94.773607][ T5330] ? new_device_store+0x132/0x530
[ 94.773620][ T5330] new_device_store+0x24b/0x530
[ 94.773633][ T5330] ? sysfs_file_kobj+0x1a/0x230
[ 94.773642][ T5330] ? sysfs_file_kobj+0x1a/0x230
[ 94.773650][ T5330] ? __pfx_new_device_store+0x10/0x10
[ 94.773665][ T5330] ? sysfs_file_kobj+0x1a/0x230
[ 94.773673][ T5330] ? sysfs_file_kobj+0x1a/0x230
[ 94.773683][ T5330] ? sysfs_file_kobj+0x1e4/0x230
[ 94.773695][ T5330] ? sysfs_kf_write+0x166/0x260
[ 94.773706][ T5330] ? __pfx_sysfs_kf_write+0x10/0x10
[ 94.773716][ T5330] kernfs_fop_write_iter+0x3a4/0x540
[ 94.773732][ T5330] vfs_write+0x612/0xba0
[ 94.773750][ T5330] ? __pfx_vfs_write+0x10/0x10
[ 94.773764][ T5330] ? __fget_files+0x2a/0x420
[ 94.773777][ T5330] ksys_write+0x150/0x270
[ 94.773790][ T5330] ? __pfx_ksys_write+0x10/0x10
[ 94.773804][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.773815][ T5330] do_syscall_64+0x174/0x580
[ 94.773827][ T5330] ? trace_irq_disable+0x3b/0x140
[ 94.773839][ T5330] ? clear_bhb_loop+0x40/0x90
[ 94.773851][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.773861][ T5330] RIP: 0033:0x7fbbeab9e019
[ 94.773870][ T5330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.773879][ T5330] RSP: 002b:00007fbbeb9c2fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 94.773890][ T5330] RAX: ffffffffffffffda RBX: 00007fbbeae26090 RCX: 00007fbbeab9e019
[ 94.773897][ T5330] RDX: 0000000000000007 RSI: 0000200000000600 RDI: 0000000000000005
[ 94.773904][ T5330] RBP: 00007fbbeac3500c R08: 0000000000000000 R09: 0000000000000000
[ 94.773910][ T5330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.773916][ T5330] R13: 00007fbbeae26128 R14: 00007fbbeae26090 R15: 00007ffd88958e58
[ 94.773927][ T5330]
[ 94.773930][ T5330]
[ 94.943590][ T5330] Allocated by task 5330:
[ 94.945256][ T5330] kasan_save_track+0x3e/0x80
[ 94.947084][ T5330] __kasan_slab_alloc+0x6c/0x80
[ 94.949052][ T5330] kmem_cache_alloc_lru_noprof+0x2aa/0x5f0
[ 94.951498][ T5330] __d_alloc+0x37/0x6f0
[ 94.953308][ T5330] d_alloc+0x4b/0x190
[ 94.954869][ T5330] lookup_one_qstr_excl+0xd8/0x360
[ 94.956916][ T5330] start_dirop+0x5c/0x90
[ 94.958663][ T5330] simple_start_creating+0xcc/0x110
[ 94.960760][ T5330] debugfs_start_creating+0xdb/0x1a0
[ 94.963044][ T5330] debugfs_create_dir+0x24/0x350
[ 94.965141][ T5330] i2c_device_probe+0x814/0xbf0
[ 94.967194][ T5330] really_probe+0x254/0xae0
[ 94.969087][ T5330] __driver_probe_device+0x1e8/0x360
[ 94.971215][ T5330] driver_probe_device+0x4f/0x240
[ 94.973384][ T5330] __device_attach_driver+0x270/0x410
[ 94.975666][ T5330] bus_for_each_drv+0x258/0x2f0
[ 94.977735][ T5330] __device_attach+0x2c4/0x450
[ 94.979616][ T5330] device_initial_probe+0xa1/0xd0
[ 94.981621][ T5330] bus_probe_device+0x12a/0x220
[ 94.983687][ T5330] device_add+0x7d7/0xb80
[ 94.985477][ T5330] i2c_new_client_device+0xa29/0x1130
[ 94.987727][ T5330] new_device_store+0x24b/0x530
[ 94.989735][ T5330] kernfs_fop_write_iter+0x3a4/0x540
[ 94.991836][ T5330] vfs_write+0x612/0xba0
[ 94.993553][ T5330] ksys_write+0x150/0x270
[ 94.995332][ T5330] do_syscall_64+0x174/0x580
[ 94.997245][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.999858][ T5330]
[ 95.000911][ T5330] Freed by task 15:
[ 95.002589][ T5330] kasan_save_track+0x3e/0x80
[ 95.004631][ T5330] kasan_save_free_info+0x40/0x50
[ 95.006820][ T5330] __kasan_slab_free+0x5c/0x80
[ 95.008818][ T5330] kmem_cache_free+0x182/0x650
[ 95.010922][ T5330] rcu_core+0x78b/0x10a0
[ 95.012713][ T5330] handle_softirqs+0x225/0x840
[ 95.014742][ T5330] run_ksoftirqd+0x36/0x60
[ 95.016626][ T5330] smpboot_thread_fn+0x57c/0xa80
[ 95.018832][ T5330] kthread+0x388/0x470
[ 95.020561][ T5330] ret_from_fork+0x514/0xb70
[ 95.022642][ T5330] ret_from_fork_asm+0x1a/0x30
[ 95.024768][ T5330]
[ 95.025814][ T5330] Last potentially related work creation:
[ 95.028270][ T5330] kasan_save_stack+0x3e/0x60
[ 95.030253][ T5330] kasan_record_aux_stack+0xbd/0xd0
[ 95.032520][ T5330] call_rcu+0xee/0x8b0
[ 95.034303][ T5330] dentry_kill+0x4d3/0x880
[ 95.036217][ T5330] finish_dput+0x1a/0x260
[ 95.038115][ T5330] find_next_child+0x1e7/0x250
[ 95.040197][ T5330] __simple_recursive_removal+0x10b/0x520
[ 95.042679][ T5330] debugfs_remove+0x5b/0x70
[ 95.044656][ T5330] i2c_del_adapter+0x229/0x430
[ 95.046745][ T5330] i2c_tiny_usb_disconnect+0x49/0xd0
[ 95.048938][ T5330] usb_unbind_interface+0x295/0x9f0
[ 95.051232][ T5330] device_release_driver_internal+0x4f5/0x880
[ 95.053789][ T5330] bus_remove_device+0x444/0x560
[ 95.055913][ T5330] device_del+0x524/0x8f0
[ 95.057819][ T5330] usb_disable_device+0x3d4/0x8d0
[ 95.060044][ T5330] usb_disconnect+0x346/0x9a0
[ 95.062007][ T5330] hub_event+0x1bbb/0x4d30
[ 95.063898][ T5330] process_scheduled_works+0xa8e/0x14e0
[ 95.066157][ T5330] worker_thread+0xa47/0xfb0
[ 95.068022][ T5330] kthread+0x388/0x470
[ 95.069685][ T5330] ret_from_fork+0x514/0xb70
[ 95.071601][ T5330] ret_from_fork_asm+0x1a/0x30
[ 95.073676][ T5330]
[ 95.074742][ T5330] The buggy address belongs to the object at ffff8880122c5d60
[ 95.074742][ T5330] which belongs to the cache dentry of size 312
[ 95.080421][ T5330] The buggy address is located 208 bytes inside of
[ 95.080421][ T5330] freed 312-byte region [ffff8880122c5d60, ffff8880122c5e98)
[ 95.085870][ T5330]
[ 95.086915][ T5330] The buggy address belongs to the physical page:
[ 95.089513][ T5330] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880122c4d38 pfn:0x122c4
[ 95.093559][ T5330] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 95.097006][ T5330] memcg:ffff88801d16b201
[ 95.098877][ T5330] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff)
[ 95.102451][ T5330] page_type: f5(slab)
[ 95.104183][ T5330] raw: 00fff00000000240 ffff888030414280 ffffea0000742990 ffffea000048b190
[ 95.107756][ T5330] raw: ffff8880122c4d38 0000000800150010 00000000f5000000 ffff88801d16b201
[ 95.111350][ T5330] head: 00fff00000000240 ffff888030414280 ffffea0000742990 ffffea000048b190
[ 95.114850][ T5330] head: ffff8880122c4d38 0000000800150010 00000000f5000000 ffff88801d16b201
[ 95.118456][ T5330] head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
[ 95.121972][ T5330] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[ 95.125586][ T5330] page dumped because: kasan: bad access detected
[ 95.128237][ T5330] page_owner tracks the page as allocated
[ 95.130555][ T5330] page last allocated via order 1, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_RECLAIMABLE|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4706, tgid 4706 (udevd), ts 35246178081, free_ts 34910770812
[ 95.139592][ T5330] post_alloc_hook+0x1f9/0x250
[ 95.141580][ T5330] get_page_from_freelist+0x21fa/0x2270
[ 95.143976][ T5330] __alloc_frozen_pages_noprof+0x18d/0x380
[ 95.146375][ T5330] allocate_slab+0x79/0x5e0
[ 95.148311][ T5330] refill_objects+0x2d5/0x350
[ 95.150346][ T5330] __pcs_replace_empty_main+0x2bf/0x6b0
[ 95.152651][ T5330] kmem_cache_alloc_lru_noprof+0x389/0x5f0
[ 95.155058][ T5330] __d_alloc+0x37/0x6f0
[ 95.156682][ T5330] d_alloc_parallel+0xde/0x16a0
[ 95.158572][ T5330] path_openat+0xbea/0x3830
[ 95.160148][ T5330] do_file_open+0x23e/0x4a0
[ 95.161990][ T5330] do_sys_openat2+0x115/0x200
[ 95.164044][ T5330] __x64_sys_openat+0x138/0x170
[ 95.166021][ T5330] do_syscall_64+0x174/0x580
[ 95.167905][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.170477][ T5330] page last free pid 4715 tgid 4715 stack trace:
[ 95.173134][ T5330] __free_frozen_pages+0xc1e/0xd10
[ 95.175297][ T5330] __slab_free+0x274/0x2c0
[ 95.177273][ T5330] qlist_free_all+0x99/0x100
[ 95.179301][ T5330] kasan_quarantine_reduce+0x148/0x160
[ 95.181612][ T5330] __kasan_slab_alloc+0x22/0x80
[ 95.183709][ T5330] kmem_cache_alloc_noprof+0x2a0/0x5f0
[ 95.185858][ T5330] do_getname+0x2e/0x250
[ 95.187698][ T5330] do_readlinkat+0xc8/0x510
[ 95.189581][ T5330] __x64_sys_readlink+0x7f/0x90
[ 95.191575][ T5330] do_syscall_64+0x174/0x580
[ 95.193408][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.195735][ T5330]
[ 95.196677][ T5330] Memory state around the buggy address:
[ 95.198933][ T5330] ffff8880122c5d00: fb fb fb fb fc fc fc fc fc fc fc fc fa fb fb fb
[ 95.202161][ T5330] ffff8880122c5d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 95.205246][ T5330] >ffff8880122c5e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 95.208335][ T5330] ^
[ 95.210570][ T5330] ffff8880122c5e80: fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 95.213709][ T5330] ffff8880122c5f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 95.216737][ T5330] ==================================================================
[ 95.221930][ T5330] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 95.224985][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 95.228649][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.232735][ T5330] Call Trace:
[ 95.233988][ T5330]
[ 95.235212][ T5330] vpanic+0x56c/0xa60
[ 95.236904][ T5330] ? __pfx_vpanic+0x10/0x10
[ 95.238843][ T5330] panic+0xc5/0xd0
[ 95.240475][ T5330] ? __pfx_panic+0x10/0x10
[ 95.242256][ T5330] ? _raw_spin_lock+0x2e/0x40
[ 95.244156][ T5330] ? _raw_spin_lock+0x2e/0x40
[ 95.246025][ T5330] check_panic_on_warn+0x89/0xb0
[ 95.248046][ T5330] ? _raw_spin_lock+0x2e/0x40
[ 95.249953][ T5330] end_report+0x73/0x170
[ 95.251778][ T5330] ? _raw_spin_lock+0x2e/0x40
[ 95.253911][ T5330] kasan_report+0x128/0x150
[ 95.255840][ T5330] ? _raw_spin_lock+0x2e/0x40
[ 95.257731][ T5330] ? lockref_get+0x15/0x60
[ 95.259463][ T5330] __kasan_check_byte+0x2a/0x40
[ 95.261469][ T5330] lock_acquire+0x84/0x350
[ 95.263421][ T5330] ? do_raw_spin_lock+0x12b/0x2f0
[ 95.265484][ T5330] _raw_spin_lock+0x2e/0x40
[ 95.267581][ T5330] ? lockref_get+0x15/0x60
[ 95.269861][ T5330] lockref_get+0x15/0x60
[ 95.271556][ T5330] __simple_recursive_removal+0x33/0x520
[ 95.273608][ T5330] ? mntput+0x65/0xc0
[ 95.275248][ T5330] ? __pfx_remove_one+0x10/0x10
[ 95.277307][ T5330] debugfs_remove+0x5b/0x70
[ 95.279060][ T5330] i2c_device_probe+0x8dc/0xbf0
[ 95.281028][ T5330] ? __pfx_i2c_device_probe+0x10/0x10
[ 95.283237][ T5330] ? sysfs_do_create_link_sd+0xe0/0x110
[ 95.285598][ T5330] ? driver_sysfs_add+0x1fe/0x210
[ 95.287714][ T5330] ? __pfx_i2c_device_probe+0x10/0x10
[ 95.290000][ T5330] really_probe+0x254/0xae0
[ 95.291908][ T5330] __driver_probe_device+0x1e8/0x360
[ 95.294178][ T5330] driver_probe_device+0x4f/0x240
[ 95.296233][ T5330] __device_attach_driver+0x270/0x410
[ 95.298570][ T5330] bus_for_each_drv+0x258/0x2f0
[ 95.300626][ T5330] ? __pfx___device_attach_driver+0x10/0x10
[ 95.303069][ T5330] ? __pfx_bus_for_each_drv+0x10/0x10
[ 95.305295][ T5330] ? lockdep_hardirqs_on+0x7a/0x110
[ 95.307447][ T5330] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 95.309806][ T5330] __device_attach+0x2c4/0x450
[ 95.311770][ T5330] ? __pfx___device_attach+0x10/0x10
[ 95.313768][ T5330] ? do_raw_spin_unlock+0x4d/0x210
[ 95.316024][ T5330] ? _raw_spin_unlock+0x28/0x50
[ 95.317809][ T5330] device_initial_probe+0xa1/0xd0
[ 95.319730][ T5330] bus_probe_device+0x12a/0x220
[ 95.321518][ T5330] device_add+0x7d7/0xb80
[ 95.323145][ T5330] i2c_new_client_device+0xa29/0x1130
[ 95.325231][ T5330] ? __pfx_i2c_new_client_device+0x10/0x10
[ 95.327450][ T5330] ? __mutex_lock+0x30d/0x1550
[ 95.329221][ T5330] ? new_device_store+0x132/0x530
[ 95.331204][ T5330] new_device_store+0x24b/0x530
[ 95.333241][ T5330] ? sysfs_file_kobj+0x1a/0x230
[ 95.335087][ T5330] ? sysfs_file_kobj+0x1a/0x230
[ 95.336817][ T5330] ? __pfx_new_device_store+0x10/0x10
[ 95.338691][ T5330] ? sysfs_file_kobj+0x1a/0x230
[ 95.340553][ T5330] ? sysfs_file_kobj+0x1a/0x230
[ 95.342615][ T5330] ? sysfs_file_kobj+0x1e4/0x230
[ 95.344594][ T5330] ? sysfs_kf_write+0x166/0x260
[ 95.346548][ T5330] ? __pfx_sysfs_kf_write+0x10/0x10
[ 95.348547][ T5330] kernfs_fop_write_iter+0x3a4/0x540
[ 95.350607][ T5330] vfs_write+0x612/0xba0
[ 95.352260][ T5330] ? __pfx_vfs_write+0x10/0x10
[ 95.354006][ T5330] ? __fget_files+0x2a/0x420
[ 95.355692][ T5330] ksys_write+0x150/0x270
[ 95.357416][ T5330] ? __pfx_ksys_write+0x10/0x10
[ 95.359437][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.362065][ T5330] do_syscall_64+0x174/0x580
[ 95.364033][ T5330] ? trace_irq_disable+0x3b/0x140
[ 95.365730][ T5330] ? clear_bhb_loop+0x40/0x90
[ 95.368055][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.370558][ T5330] RIP: 0033:0x7fbbeab9e019
[ 95.372371][ T5330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 95.379493][ T5330] RSP: 002b:00007fbbeb9c2fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 95.382998][ T5330] RAX: ffffffffffffffda RBX: 00007fbbeae26090 RCX: 00007fbbeab9e019
[ 95.386286][ T5330] RDX: 0000000000000007 RSI: 0000200000000600 RDI: 0000000000000005
[ 95.389464][ T5330] RBP: 00007fbbeac3500c R08: 0000000000000000 R09: 0000000000000000
[ 95.392768][ T5330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 95.395986][ T5330] R13: 00007fbbeae26128 R14: 00007fbbeae26090 R15: 00007ffd88958e58
[ 95.399137][ T5330]
[ 95.400842][ T5330] Kernel Offset: disabled
[ 95.402951][ T5330] Rebooting in 86400 seconds..