i2c i2c-0: failure reading functionality
i2c i2c-0: connected i2c-tiny-usb device
usb 1-1: USB disconnect, device number 2
==================================================================
BUG: KASAN: use-after-free in kobject_put+0x1df/0x230 lib/kobject.c:745
Read of size 1 at addr ffff888098413054 by task kworker/0:0/5

CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 5.7.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x128/0x182 lib/dump_stack.c:118
 print_address_description.constprop.8.cold.10+0x9/0x317 mm/kasan/report.c:382
 __kasan_report.cold.11+0x35/0x4d mm/kasan/report.c:511
 kasan_report+0x32/0x50 mm/kasan/common.c:625
 kobject_put+0x1df/0x230 lib/kobject.c:745
 i2cdev_detach_adapter drivers/i2c/i2c-dev.c:708 [inline]
 i2cdev_notifier_call+0x75/0xa0 drivers/i2c/i2c-dev.c:704
 notifier_call_chain+0x86/0x150 kernel/notifier.c:83
 __blocking_notifier_call_chain kernel/notifier.c:284 [inline]
 blocking_notifier_call_chain+0x66/0xa0 kernel/notifier.c:295
 device_del+0x16b/0xc00 drivers/base/core.c:2708
 device_unregister+0x9/0x20 drivers/base/core.c:2766
 i2c_del_adapter+0x3ae/0x560 drivers/i2c/i2c-core-base.c:1577
 i2c_tiny_usb_disconnect+0x35/0xa0 drivers/i2c/busses/i2c-tiny-usb.c:283
 usb_unbind_interface+0x15c/0x870 drivers/usb/core/driver.c:436
 __device_release_driver drivers/base/dd.c:1110 [inline]
 device_release_driver_internal+0x1d2/0x470 drivers/base/dd.c:1141
 bus_remove_device+0x293/0x460 drivers/base/bus.c:533
 device_del+0x421/0xc00 drivers/base/core.c:2734
 usb_disable_device+0x1ae/0x580 drivers/usb/core/message.c:1245
 usb_disconnect+0x227/0x850 drivers/usb/core/hub.c:2216
 hub_port_connect drivers/usb/core/hub.c:5058 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5347 [inline]
 port_event drivers/usb/core/hub.c:5493 [inline]
 hub_event+0x1048/0x2d60 drivers/usb/core/hub.c:5575
 process_one_work+0x908/0x15d0 kernel/workqueue.c:2268
 process_scheduled_works kernel/workqueue.c:2330 [inline]
 worker_thread+0x5aa/0xb50 kernel/workqueue.c:2416
 kthread+0x340/0x410 kernel/kthread.c:268
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:351

Allocated by task 5:
 save_stack+0x19/0x40 mm/kasan/common.c:49
 set_track mm/kasan/common.c:57 [inline]
 __kasan_kmalloc.constprop.17+0xc1/0xd0 mm/kasan/common.c:495
 kmem_cache_alloc_trace+0x156/0x780 mm/slab.c:3551
 kmalloc include/linux/slab.h:555 [inline]
 kzalloc include/linux/slab.h:669 [inline]
 get_free_i2c_dev drivers/i2c/i2c-dev.c:76 [inline]
 i2cdev_attach_adapter.part.6+0x81/0x390 drivers/i2c/i2c-dev.c:651
 notifier_call_chain+0x86/0x150 kernel/notifier.c:83
 __blocking_notifier_call_chain kernel/notifier.c:284 [inline]
 blocking_notifier_call_chain+0x66/0xa0 kernel/notifier.c:295
 device_add+0xa6f/0x1a00 drivers/base/core.c:2524
 i2c_register_adapter+0x2a2/0x9d0 drivers/i2c/i2c-core-base.c:1326
 i2c_tiny_usb_probe+0x38e/0x4ff drivers/i2c/busses/i2c-tiny-usb.c:265
 usb_probe_interface+0x268/0x6c0 drivers/usb/core/driver.c:374
 really_probe+0x1f9/0x5e0 drivers/base/dd.c:520
 driver_probe_device+0xc9/0x1b0 drivers/base/dd.c:697
 bus_for_each_drv+0x117/0x1a0 drivers/base/bus.c:431
 __device_attach+0x1be/0x2c0 drivers/base/dd.c:870
 bus_probe_device+0x19e/0x250 drivers/base/bus.c:491
 device_add+0x1089/0x1a00 drivers/base/core.c:2557
 usb_set_configuration+0xcc8/0x1640 drivers/usb/core/message.c:2032
 usb_generic_driver_probe+0x61/0x90 drivers/usb/core/generic.c:241
 usb_probe_device+0x91/0x160 drivers/usb/core/driver.c:272
 really_probe+0x1f9/0x5e0 drivers/base/dd.c:520
 driver_probe_device+0xc9/0x1b0 drivers/base/dd.c:697
 bus_for_each_drv+0x117/0x1a0 drivers/base/bus.c:431
 __device_attach+0x1be/0x2c0 drivers/base/dd.c:870
 bus_probe_device+0x19e/0x250 drivers/base/bus.c:491
 device_add+0x1089/0x1a00 drivers/base/core.c:2557
 usb_new_device.cold.66+0x679/0xe85 drivers/usb/core/hub.c:2553
 hub_port_connect drivers/usb/core/hub.c:5207 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5347 [inline]
 port_event drivers/usb/core/hub.c:5493 [inline]
 hub_event+0x15fe/0x2d60 drivers/usb/core/hub.c:5575
 process_one_work+0x908/0x15d0 kernel/workqueue.c:2268
 worker_thread+0x82/0xb50 kernel/workqueue.c:2414
 kthread+0x340/0x410 kernel/kthread.c:268
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:351

Freed by task 5:
 save_stack+0x19/0x40 mm/kasan/common.c:49
 set_track mm/kasan/common.c:57 [inline]
 kasan_set_free_info mm/kasan/common.c:317 [inline]
 __kasan_slab_free+0xf7/0x140 mm/kasan/common.c:456
 __cache_free mm/slab.c:3426 [inline]
 kfree+0x107/0x2b0 mm/slab.c:3757
 device_release+0x65/0x1c0 drivers/base/core.c:1394
 kobject_cleanup lib/kobject.c:701 [inline]
 kobject_release lib/kobject.c:732 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x12e/0x230 lib/kobject.c:749
 put_i2c_dev+0x132/0x190 drivers/i2c/i2c-dev.c:93
 i2cdev_detach_adapter drivers/i2c/i2c-dev.c:708 [inline]
 i2cdev_notifier_call+0x75/0xa0 drivers/i2c/i2c-dev.c:704
 notifier_call_chain+0x86/0x150 kernel/notifier.c:83
 __blocking_notifier_call_chain kernel/notifier.c:284 [inline]
 blocking_notifier_call_chain+0x66/0xa0 kernel/notifier.c:295
 device_del+0x16b/0xc00 drivers/base/core.c:2708
 device_unregister+0x9/0x20 drivers/base/core.c:2766
 i2c_del_adapter+0x3ae/0x560 drivers/i2c/i2c-core-base.c:1577
 i2c_tiny_usb_disconnect+0x35/0xa0 drivers/i2c/busses/i2c-tiny-usb.c:283
 usb_unbind_interface+0x15c/0x870 drivers/usb/core/driver.c:436
 __device_release_driver drivers/base/dd.c:1110 [inline]
 device_release_driver_internal+0x1d2/0x470 drivers/base/dd.c:1141
 bus_remove_device+0x293/0x460 drivers/base/bus.c:533
 device_del+0x421/0xc00 drivers/base/core.c:2734
 usb_disable_device+0x1ae/0x580 drivers/usb/core/message.c:1245
 usb_disconnect+0x227/0x850 drivers/usb/core/hub.c:2216
 hub_port_connect drivers/usb/core/hub.c:5058 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5347 [inline]
 port_event drivers/usb/core/hub.c:5493 [inline]
 hub_event+0x1048/0x2d60 drivers/usb/core/hub.c:5575
 process_one_work+0x908/0x15d0 kernel/workqueue.c:2268
 process_scheduled_works kernel/workqueue.c:2330 [inline]
 worker_thread+0x5aa/0xb50 kernel/workqueue.c:2416
 kthread+0x340/0x410 kernel/kthread.c:268
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:351

The buggy address belongs to the object at ffff888098413000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 84 bytes inside of
 2048-byte region [ffff888098413000, ffff888098413800)
The buggy address belongs to the page:
page:ffffea00026104c0 refcount:1 mapcount:0 mapping:000000000e783090 index:0x0
flags: 0xfffe0000000200(slab)
raw: 00fffe0000000200 ffffea0002a4af08 ffffea0002927808 ffff8880aa400e00
raw: 0000000000000000 ffff888098413000 0000000100000001 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888098412f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888098412f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888098413000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                 ^
 ffff888098413080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888098413100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================