program: r0 = open(&(0x7f0000000180)='./bus\x00', 0x3496fe, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=@newlink={0x20, 0x10, 0x40d, 0x70bd2f, 0x1ffffffc, {0x0, 0x0, 0x0, 0x0, 0x61047}}, 0x20}, 0x1, 0x0, 0x0, 0x40040}, 0x8000) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="22000000040000001000000012"], 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000200)={r1, &(0x7f0000000340), &(0x7f0000000000)=@udp6, 0x1}, 0x20) mkdir(&(0x7f0000000000)='./gadget\x00', 0x1ff) syz_open_dev$usbmon(&(0x7f0000000000), 0x5dc0, 0x48502) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000200)='dummy_hcd.0', 0xb) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000400)='dummy_hcd.0', 0xb) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) ioctl$SNDCTL_DSP_GETTRIGGER(r2, 0x80045010, &(0x7f0000000040)) r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r4, &(0x7f0000000400)="00000000090209000101008001120100020000004000000000000000000001", 0x1f) ioctl$LOOP_SET_STATUS64(0xffffffffffffffff, 0x4c04, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1c, 0x0, "ef35af413bb901527fe4d0ce5d29c3ee5e5c3676345a41499db7aac63a01000000000000004faa2ae2c084a0ea0000000000007700000c00002000", "036c47c678082004cb59d654cb9b1b165263bdbcef549ba197fce47ddfdd753abd950100172a00ffffff00f7ffffff000000f3e7f20000000200000000000600", "b7326736181c208220ffff207d00000000000000000500", [0x4, 0x3]}) ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000340), 0xc0440) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000480)={r0, 0x20, &(0x7f0000000440)={&(0x7f0000000240)=""/159, 0x9f, 0x0, &(0x7f00000004c0)=""/94, 0x5e}}, 0x10) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r5, 0x404c534a, &(0x7f0000000080)={0xff, 0x6, 0x4}) syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x5, &(0x7f0000000100), 0x0, 0x5a9, &(0x7f00000005c0)="$eJzs3U1rXFUYAOD33EzSpqkmFUFrFwYKtqCmTVpRVLDFunPhR8WVYMxHKZ22oYlga8UW6j/QHyC4cyMui0hRN27dCf4AKRap2biL3MmddJrO5KOdzK25zwM3OfcjvOdmeOfce+acOwFU1mj+I4vYGxFzKWK4ZV8tip2jy8f9c/vy1OLty1Mplpbe/TtFKrY1j0/F76Hij3dGxG8/pXis79648xcvnZms12cuFOuHFs7OHZq/eOn502cnT82cmjk3Mf7i+AtHj0wcPdyV89wdEb+Mnahdm31933dT3+z5/Idvr6c41tgeq86jW0ZjdOV/0ir/v77U7WAl6SvOp/UlTrVVB73S40qxYc3X79GIeCKGoy/uvHjD8cXbpVYO2FJLKWIJqKgk/6GimtcB+f1vcyn3igTolVvHlzsAmn17iyv5X1vuG4yd0R8RuxZTtHbrpIjoRs9cHmPumTScL7FF/XBAe1euRsST7dr/1MjNkUYvfp7/2V35n0XEW8XvfPs79xl/dNW6/IfeeZD8/7Al/z+6z/jyHwAAAAAAALrnxvGIeK7d53/ZyvifaDP+ZygijnUh/vqf/2U3uxAGaOPW8YhXI2LxnvF/WfOQkb5i7ZHGeID+NHu6f+ZwMWfwYPTvmD1dnxlfI8bovl/7O+5rGf+XL3n85ljAoh43azvu/pvpyYXJBzlnYNmtqxFP1fL8T3F3/qeV9j+1af/z94O5DcZYOvHaz532rZ//wFZZ+jriQNv2/86TK9Laz+c4lLf/xc+2MT794Pr3neLLfyhP3v7vWjv/R1LjKSHF83rmNx/js7/+eID8b3/9P5BONh45M1Bs+2RyYeHCeMRAevPe7RObrzNsR818aOZLnv8H97e//1/r+n8wIq5sMObJH9+41mmf9h/Kk+f/9Lrtf8vz+u6jsP/9r/7tFH9j7f/RRpt+sNii/w/WttEELbueAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPB/lEXE7kjZ2Eo5y8bGIoYi4vHYldXPzy88O3v+43PT+b7G9/9nzW/6HV5eT83v/x9pWZ9YtX4kIvZExJd9g431sanz9emyTx4AAAAAAAAAAAAAAAAAAAAeEkMd5v/n/uwru3bAlquVXQGgNPIfqkv+Q3VtMv/7t6oeQO9p/6G65D9Ul/yH6pL/UF15/u8suxJAKbT/AAAAAACwrex5+sZ7KSKuvDzYWHIDxT7j/GF7y8quAFAaj/iB6jL0B6prA/f4qRf1AMrTLskHW8qdpwd4ewAAAAAAAAAAAACAXjmw98bv5v9DNW1m/v/gFtYD6D3z/6G6zP+H6nKPD6w3i9/8fwAAAAAAAAAAAAAo3/zFS2cm6/WZC2UUdhSVKCe6gkJZhXg4qrFWoeQ3JgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYMV/AQAA//9thPMY") [ 102.895332][ T4653] Bluetooth: hci0: command tx timeout [ 103.024812][ T5331] dummy_hcd dummy_hcd.0: remove, state 4 [ 103.037097][ T5331] usb usb5: USB disconnect, device number 1 [ 103.082772][ T5331] dummy_hcd dummy_hcd.0: stopped [ 103.090944][ T5331] dummy_hcd dummy_hcd.0: USB bus 5 deregistered [ 103.113746][ T5332] dummy_hcd dummy_hcd.0: USB Host+Gadget Emulator, driver 02 May 2005 [ 103.122656][ T5332] dummy_hcd dummy_hcd.0: Dummy host controller [ 103.152380][ T5332] dummy_hcd dummy_hcd.0: new USB bus registered, assigned bus number 5 [ 103.168587][ T5331] gadgetfs: bound to dummy_udc driver [ 103.172070][ T5331] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI [ 103.178007][ T5331] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 103.182129][ T5331] CPU: 0 UID: 0 PID: 5331 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.187009][ T5331] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.191736][ T5331] RIP: 0010:dummy_udc_start+0xd0/0x1f0 [ 103.194519][ T5331] Code: 41 83 ff 03 74 18 41 83 ff 05 0f 85 93 00 00 00 e8 15 b6 0e fa eb 0c e8 0e b6 0e fa eb 05 e8 07 b6 0e fa 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 91 e8 7d fa 4d 8b 36 4c 89 f7 e8 [ 103.204971][ T5331] RSP: 0018:ffffc9000e10f850 EFLAGS: 00010246 [ 103.207997][ T5331] RAX: 0000000000000000 RBX: ffffffff8fa534e0 RCX: 0000000000100000 [ 103.211876][ T5331] RDX: ffffc9000eaa2000 RSI: 0000000000001fb1 RDI: 0000000000001fb2 [ 103.215904][ T5331] RBP: ffff888034b58000 R08: ffff88801f8b4a80 R09: 0000000000000004 [ 103.219802][ T5331] R10: 0000000000000005 R11: 0000000000000002 R12: dffffc0000000000 [ 103.223615][ T5331] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000002 [ 103.227677][ T5331] FS: 00007f04b5a176c0(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 103.231962][ T5331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 103.235117][ T5331] CR2: 00005582538de0c0 CR3: 0000000042fa4000 CR4: 0000000000352ef0 [ 103.238779][ T5331] Call Trace: [ 103.240503][ T5331] [ 103.241998][ T5331] ? __pfx_dummy_udc_start+0x10/0x10 [ 103.244617][ T5331] gadget_bind_driver+0x3a8/0x9e0 [ 103.246889][ T5331] ? __pfx_gadget_bind_driver+0x10/0x10 [ 103.249324][ T5331] really_probe+0x254/0xae0 [ 103.251427][ T5331] __driver_probe_device+0x1e8/0x360 [ 103.253751][ T5331] driver_probe_device+0x4f/0x240 [ 103.256158][ T5331] __driver_attach+0x339/0x600 [ 103.258478][ T5331] bus_for_each_dev+0x23b/0x2c0 [ 103.261019][ T5331] ? __pfx___driver_attach+0x10/0x10 [ 103.263855][ T5331] ? __pfx_bus_for_each_dev+0x10/0x10 [ 103.266497][ T5331] ? do_raw_spin_unlock+0x4d/0x210 [ 103.268868][ T5331] bus_add_driver+0x345/0x670 [ 103.271047][ T5331] driver_register+0x23a/0x320 [ 103.273195][ T5331] usb_gadget_register_driver_owner+0xf9/0x270 [ 103.275971][ T5331] dev_config+0xe3c/0x12a0 [ 103.277814][ T5331] ? __pfx_dev_config+0x10/0x10 [ 103.279918][ T5331] ? __pfx_dev_config+0x10/0x10 [ 103.282039][ T5331] vfs_write+0x296/0xba0 [ 103.283864][ T5331] ? __pfx_vfs_write+0x10/0x10 [ 103.285945][ T5331] ? __fget_files+0x2a/0x420 [ 103.288015][ T5331] ? __fget_files+0x3a2/0x420 [ 103.290108][ T5331] ? __fget_files+0x2a/0x420 [ 103.292173][ T5331] ksys_write+0x150/0x270 [ 103.294123][ T5331] ? __pfx_ksys_write+0x10/0x10 [ 103.296383][ T5331] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.298807][ T5331] do_syscall_64+0x174/0x580 [ 103.300885][ T5331] ? trace_irq_disable+0x3b/0x140 [ 103.303043][ T5331] ? clear_bhb_loop+0x40/0x90 [ 103.306195][ T5331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.308864][ T5331] RIP: 0033:0x7f04b4b9e019 [ 103.310848][ T5331] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.319190][ T5331] RSP: 002b:00007f04b5a16fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 103.322724][ T5331] RAX: ffffffffffffffda RBX: 00007f04b4e25fa0 RCX: 00007f04b4b9e019 [ 103.326191][ T5331] RDX: 000000000000001f RSI: 0000200000000400 RDI: 0000000000000007 [ 103.329539][ T5331] RBP: 00007f04b4c3500c R08: 0000000000000000 R09: 0000000000000000 [ 103.332920][ T5331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.336327][ T5331] R13: 00007f04b4e26038 R14: 00007f04b4e25fa0 R15: 00007fff0b3daa98 [ 103.339893][ T5331] [ 103.341280][ T5331] Modules linked in: [ 103.345264][ T5331] ---[ end trace 0000000000000000 ]--- [ 103.367808][ T5332] usb usb5: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 103.372665][ T5332] usb usb5: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 103.378173][ T5332] usb usb5: Product: Dummy host controller [ 103.381299][ T5332] usb usb5: Manufacturer: Linux syzkaller dummy_hcd [ 103.384576][ T5332] usb usb5: SerialNumber: dummy_hcd.0 [ 103.397726][ T5332] hub 5-0:1.0: USB hub found [ 103.401546][ T5332] hub 5-0:1.0: 1 port detected [ 103.422384][ T5332] loop0: detected capacity change from 0 to 1024 [ 103.441081][ T5332] EXT4-fs (loop0): ext4_check_descriptors: Checksum for group 0 failed (47942!=20869) [ 103.459771][ T5331] RIP: 0010:dummy_udc_start+0xd0/0x1f0 [ 103.487969][ T5332] EXT4-fs (loop0): orphan cleanup on readonly fs [ 103.505895][ T5332] EXT4-fs warning (device loop0): ext4_enable_quotas:7276: Failed to enable quota tracking (type=0, err=-13, ino=3). Please run e2fsck to fix. [ 103.522442][ T5332] EXT4-fs (loop0): Cannot turn on quotas: error -13 [ 103.526512][ T5331] Code: 41 83 ff 03 74 18 41 83 ff 05 0f 85 93 00 00 00 e8 15 b6 0e fa eb 0c e8 0e b6 0e fa eb 05 e8 07 b6 0e fa 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 91 e8 7d fa 4d 8b 36 4c 89 f7 e8 [ 103.537942][ T5332] EXT4-fs error (device loop0): ext4_orphan_get:1404: comm syz.0.0: couldn't read orphan inode 12 (err -116) [ 103.543374][ T5332] loop0: lost filesystem error report for type 5 error -116 [ 103.544419][ T5332] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 103.554579][ T5331] RSP: 0018:ffffc9000e10f850 EFLAGS: 00010246 [ 103.558020][ T5331] RAX: 0000000000000000 RBX: ffffffff8fa534e0 RCX: 0000000000100000 [ 103.563467][ T5331] RDX: ffffc9000eaa2000 RSI: 0000000000001fb1 RDI: 0000000000001fb2 [ 103.567948][ T5331] RBP: ffff888034b58000 R08: ffff88801f8b4a80 R09: 0000000000000004 [ 103.571881][ T5331] R10: 0000000000000005 R11: 0000000000000002 R12: dffffc0000000000 [ 103.576444][ T5331] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000002 [ 103.580490][ T5331] FS: 00007f04b5a176c0(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 103.592250][ T5331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 103.596526][ T5331] CR2: 00007f44d0bda000 CR3: 0000000042fa4000 CR4: 0000000000352ef0 [ 103.600725][ T5331] Kernel panic - not syncing: Fatal exception [ 103.604153][ T5331] Kernel Offset: disabled [ 103.606302][ T5331] Rebooting in 86400 seconds..