usb 5-1: Direct firmware load for ueagle-atm/eagleI.fw failed with error -2
usb 5-1: Falling back to sysfs fallback for: ueagle-atm/eagleI.fw
==================================================================
BUG: KASAN: slab-use-after-free in kernfs_root fs/kernfs/kernfs-internal.h:68 [inline]
BUG: KASAN: slab-use-after-free in kernfs_next_descendant_post+0x2e0/0x310 fs/kernfs/dir.c:1342
Read of size 8 at addr ffff88802f002dc8 by task kworker/1:2/1389

CPU: 1 PID: 1389 Comm: kworker/1:2 Not tainted 6.8.0-syzkaller-11339-g741e9d668aa5 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Workqueue: events request_firmware_work_func
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0xc3/0x620 mm/kasan/report.c:488
 kasan_report+0xd9/0x110 mm/kasan/report.c:601
 kernfs_root fs/kernfs/kernfs-internal.h:68 [inline]
 kernfs_next_descendant_post+0x2e0/0x310 fs/kernfs/dir.c:1342
 kernfs_activate fs/kernfs/dir.c:1397 [inline]
 kernfs_add_one+0x3b9/0x520 fs/kernfs/dir.c:810
 kernfs_create_dir_ns+0xf4/0x150 fs/kernfs/dir.c:1062
 sysfs_create_dir_ns+0x13b/0x2b0 fs/sysfs/dir.c:59
 create_dir lib/kobject.c:73 [inline]
 kobject_add_internal+0x2c8/0x980 lib/kobject.c:240
 kobject_add_varg lib/kobject.c:374 [inline]
 kobject_add+0x16f/0x240 lib/kobject.c:426
 class_dir_create_and_add drivers/base/core.c:3182 [inline]
 get_device_parent+0x399/0x4e0 drivers/base/core.c:3233
 device_add+0x1ae/0x1ab0 drivers/base/core.c:3563
 fw_load_sysfs_fallback drivers/base/firmware_loader/fallback.c:86 [inline]
 fw_load_from_user_helper drivers/base/firmware_loader/fallback.c:162 [inline]
 firmware_fallback_sysfs+0x2ec/0xbd0 drivers/base/firmware_loader/fallback.c:238
 _request_firmware+0xe3e/0x1270 drivers/base/firmware_loader/main.c:910
 request_firmware_work_func+0xeb/0x250 drivers/base/firmware_loader/main.c:1161
 process_one_work+0x9a9/0x1a60 kernel/workqueue.c:3254
 process_scheduled_works kernel/workqueue.c:3335 [inline]
 worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416
 kthread+0x2c1/0x3a0 kernel/kthread.c:388
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
 </TASK>

Allocated by task 1389:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 unpoison_slab_object mm/kasan/common.c:312 [inline]
 __kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:338
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook mm/slub.c:3798 [inline]
 slab_alloc_node mm/slub.c:3845 [inline]
 kmem_cache_alloc+0x136/0x320 mm/slub.c:3852
 kmem_cache_zalloc include/linux/slab.h:739 [inline]
 __kernfs_new_node+0xd3/0x8a0 fs/kernfs/dir.c:615
 kernfs_new_node+0x18c/0x240 fs/kernfs/dir.c:691
 kernfs_create_dir_ns+0x4c/0x150 fs/kernfs/dir.c:1052
 sysfs_create_dir_ns+0x13b/0x2b0 fs/sysfs/dir.c:59
 create_dir lib/kobject.c:73 [inline]
 kobject_add_internal+0x2c8/0x980 lib/kobject.c:240
 kobject_add_varg lib/kobject.c:374 [inline]
 kobject_add+0x16f/0x240 lib/kobject.c:426
 class_dir_create_and_add drivers/base/core.c:3182 [inline]
 get_device_parent+0x399/0x4e0 drivers/base/core.c:3233
 device_add+0x1ae/0x1ab0 drivers/base/core.c:3563
 fw_load_sysfs_fallback drivers/base/firmware_loader/fallback.c:86 [inline]
 fw_load_from_user_helper drivers/base/firmware_loader/fallback.c:162 [inline]
 firmware_fallback_sysfs+0x2ec/0xbd0 drivers/base/firmware_loader/fallback.c:238
 _request_firmware+0xe3e/0x1270 drivers/base/firmware_loader/main.c:910
 request_firmware_work_func+0xeb/0x250 drivers/base/firmware_loader/main.c:1161
 process_one_work+0x9a9/0x1a60 kernel/workqueue.c:3254
 process_scheduled_works kernel/workqueue.c:3335 [inline]
 worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416
 kthread+0x2c1/0x3a0 kernel/kthread.c:388
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243

Freed by task 29:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
 poison_slab_object mm/kasan/common.c:240 [inline]
 __kasan_slab_free+0x11d/0x1a0 mm/kasan/common.c:256
 kasan_slab_free include/linux/kasan.h:184 [inline]
 slab_free_hook mm/slub.c:2106 [inline]
 slab_free mm/slub.c:4280 [inline]
 kmem_cache_free+0x12e/0x360 mm/slub.c:4344
 kernfs_put.part.0+0x22a/0x490 fs/kernfs/dir.c:569
 kernfs_put+0x47/0x50 fs/kernfs/dir.c:543
 __kernfs_remove+0x3ff/0x650 fs/kernfs/dir.c:1499
 kernfs_remove+0x79/0xa0 fs/kernfs/dir.c:1519
 sysfs_remove_dir+0xc5/0x100 fs/sysfs/dir.c:101
 __kobject_del+0xe2/0x1f0 lib/kobject.c:604
 kobject_del lib/kobject.c:627 [inline]
 kobject_del+0x3f/0x60 lib/kobject.c:619
 device_del+0x66c/0xa10 drivers/base/core.c:3848
 usb_disconnect+0x58b/0x920 drivers/usb/core/hub.c:2295
 hub_port_connect drivers/usb/core/hub.c:5323 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5623 [inline]
 port_event drivers/usb/core/hub.c:5783 [inline]
 hub_event+0x1dbb/0x4e20 drivers/usb/core/hub.c:5865
 process_one_work+0x9a9/0x1a60 kernel/workqueue.c:3254
 process_scheduled_works kernel/workqueue.c:3335 [inline]
 worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416
 kthread+0x2c1/0x3a0 kernel/kthread.c:388
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243

The buggy address belongs to the object at ffff88802f002d98
 which belongs to the cache kernfs_node_cache of size 168
The buggy address is located 48 bytes inside of
 freed 168-byte region [ffff88802f002d98, ffff88802f002e40)

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2f002
ksm flags: 0xfff80000000800(slab|node=0|zone=1|lastcpupid=0xfff)
page_type: 0xffffffff()
raw: 00fff80000000800 ffff8880166b63c0 ffffea0000454c40 dead00000000000b
raw: 0000000000000000 0000000080110011 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 7128, tgid 7128 (syz-executor.3), ts 141499835357, free_ts 141498021389
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x2d4/0x350 mm/page_alloc.c:1534
 prep_new_page mm/page_alloc.c:1541 [inline]
 get_page_from_freelist+0xa28/0x3780 mm/page_alloc.c:3317
 __alloc_pages+0x22b/0x23f0 mm/page_alloc.c:4575
 __alloc_pages_node include/linux/gfp.h:238 [inline]
 alloc_pages_node include/linux/gfp.h:261 [inline]
 alloc_slab_page mm/slub.c:2175 [inline]
 allocate_slab mm/slub.c:2338 [inline]
 new_slab+0xcc/0x3a0 mm/slub.c:2391
 ___slab_alloc+0x66d/0x1790 mm/slub.c:3525
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3610
 __slab_alloc_node mm/slub.c:3663 [inline]
 slab_alloc_node mm/slub.c:3835 [inline]
 kmem_cache_alloc+0x2e9/0x320 mm/slub.c:3852
 kmem_cache_zalloc include/linux/slab.h:739 [inline]
 __kernfs_new_node+0xd3/0x8a0 fs/kernfs/dir.c:615
 kernfs_new_node+0x18c/0x240 fs/kernfs/dir.c:691
 __kernfs_create_file+0x53/0x340 fs/kernfs/file.c:1025
 sysfs_add_file_mode_ns+0x1ff/0x3b0 fs/sysfs/file.c:307
 create_files fs/sysfs/group.c:64 [inline]
 internal_create_group+0x31f/0xb50 fs/sysfs/group.c:152
 internal_create_groups+0x9d/0x150 fs/sysfs/group.c:192
 create_dir lib/kobject.c:78 [inline]
 kobject_add_internal+0x317/0x980 lib/kobject.c:240
 kobject_add_varg lib/kobject.c:374 [inline]
 kobject_init_and_add+0x11c/0x190 lib/kobject.c:457
 rx_queue_add_kobject net/core/net-sysfs.c:1105 [inline]
 net_rx_queue_update_kobjects+0x2d6/0x5f0 net/core/net-sysfs.c:1160
page last free pid 54 tgid 54 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1141 [inline]
 free_unref_page_prepare+0x527/0xb10 mm/page_alloc.c:2347
 free_unref_page+0x33/0x3c0 mm/page_alloc.c:2487
 vfree+0x181/0x7a0 mm/vmalloc.c:3324
 delayed_vfree_work+0x56/0x70 mm/vmalloc.c:3245
 process_one_work+0x9a9/0x1a60 kernel/workqueue.c:3254
 process_scheduled_works kernel/workqueue.c:3335 [inline]
 worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416
 kthread+0x2c1/0x3a0 kernel/kthread.c:388
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243

Memory state around the buggy address:
 ffff88802f002c80: fc fc fc fc fc fc fa fb fb fb fb fb fb fb fb fb
 ffff88802f002d00: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc
>ffff88802f002d80: fc fc fc fa fb fb fb fb fb fb fb fb fb fb fb fb
                                              ^
 ffff88802f002e00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff88802f002e80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================