program: syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040c60511920000010203010902200001010080fa0904000002ffffff000705810200020007050202000200"], 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff) (async) mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0) (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01040000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a320000000058000000060a010400000000000000000100000008000b4000000000300004802c0001800b00010065787468647200001c000280080001400000000c080003400000000005000200070000000900010073797a3000000000140008001100010000000000000000000000000a"], 0xcc}}, 0x0) (async, rerun: 32) close(r0) (async, rerun: 32) setns(0xc9, 0x0) (async, rerun: 64) socket(0x8, 0x5, 0x5) (rerun: 64) pselect6(0xfe41, &(0x7f0000000040)={0xd, 0x0, 0x0, 0x8000000}, 0x0, 0x0, 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='dummy_hcd.0\x00', 0xb) (async) close(r2) nanosleep(&(0x7f0000000400)={0x1}, 0x0) [ 116.545797][ T5331] dummy_hcd dummy_hcd.0: remove, state 1 [ 116.581071][ T4652] Bluetooth: hci0: command tx timeout [ 116.620440][ T10] hub 5-0:1.0: activate --> -108 [ 116.623919][ T10] hub 5-0:1.0: hub_ext_port_status failed (err = -108) [ 116.627115][ T5331] usb usb5: USB disconnect, device number 1 [ 116.658448][ T5331] dummy_hcd dummy_hcd.0: stopped [ 116.665031][ T5331] dummy_hcd dummy_hcd.0: USB bus 5 deregistered [ 116.705430][ T5331] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI [ 116.710489][ T5331] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 116.713766][ T5331] CPU: 0 UID: 0 PID: 5331 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 116.717654][ T5331] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 116.722050][ T5331] RIP: 0010:set_link_state+0x27/0x1000 [ 116.724581][ T5331] Code: 90 90 90 55 41 57 41 56 41 55 41 54 53 48 83 ec 38 49 89 fe 48 bb 00 00 00 00 00 fc ff df e8 30 3b 0e fa 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 bb 6d 7d fa 49 8b 16 4d 8d a6 a3 00 [ 116.732580][ T5331] RSP: 0018:ffffc9000f0ff780 EFLAGS: 00010046 [ 116.735375][ T5331] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff88801f9ea540 [ 116.738812][ T5331] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 116.742214][ T5331] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004 [ 116.745424][ T5331] R10: dffffc0000000000 R11: fffff52001e1feec R12: 0000000000000246 [ 116.748738][ T5331] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 [ 116.752088][ T5331] FS: 0000000000000000(0000) GS:ffff88808c53f000(0000) knlGS:0000000000000000 [ 116.755708][ T5331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 116.758394][ T5331] CR2: 00005625747724c0 CR3: 0000000051404000 CR4: 0000000000352ef0 [ 116.761874][ T5331] Call Trace: [ 116.763379][ T5331] [ 116.764731][ T5331] ? rcu_is_watching+0x15/0xb0 [ 116.766841][ T5331] ? __pfx_dummy_pullup+0x10/0x10 [ 116.768980][ T5331] dummy_pullup+0xc4/0x120 [ 116.770590][ T5331] ? __pfx_dummy_pullup+0x10/0x10 [ 116.772655][ T5331] usb_gadget_disconnect_locked+0x126/0x480 [ 116.775243][ T5331] gadget_unbind_driver+0xc2/0x410 [ 116.777487][ T5331] ? __pfx_gadget_unbind_driver+0x10/0x10 [ 116.779892][ T5331] device_release_driver_internal+0x48b/0x880 [ 116.782556][ T5331] driver_detach+0x1f3/0x2d0 [ 116.784551][ T5331] bus_remove_driver+0x226/0x320 [ 116.786666][ T5331] usb_gadget_unregister_driver+0x4e/0x70 [ 116.789136][ T5331] raw_release+0xd7/0x260 [ 116.791069][ T5331] ? __pfx_raw_release+0x10/0x10 [ 116.793256][ T5331] __fput+0x418/0xa50 [ 116.795030][ T5331] task_work_run+0x1d9/0x270 [ 116.797043][ T5331] ? __pfx_task_work_run+0x10/0x10 [ 116.799238][ T5331] ? do_raw_spin_unlock+0x4d/0x210 [ 116.801483][ T5331] do_exit+0x73a/0x2360 [ 116.803024][ T5331] ? __pfx_do_exit+0x10/0x10 [ 116.804988][ T5331] ? do_raw_spin_lock+0x12b/0x2f0 [ 116.807098][ T5331] do_group_exit+0x22d/0x2f0 [ 116.809076][ T5331] ? _raw_spin_unlock_irq+0x23/0x50 [ 116.811183][ T5331] get_signal+0x121b/0x12c0 [ 116.813125][ T5331] arch_do_signal_or_restart+0xbb/0x860 [ 116.815533][ T5331] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 116.818177][ T5331] ? ksys_write+0x242/0x270 [ 116.820127][ T5331] exit_to_user_mode_loop+0x104/0x730 [ 116.822376][ T5331] ? rcu_is_watching+0x15/0xb0 [ 116.824413][ T5331] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.826919][ T5331] do_syscall_64+0x353/0x580 [ 116.828828][ T5331] ? trace_irq_disable+0x3b/0x140 [ 116.831069][ T5331] ? clear_bhb_loop+0x40/0x90 [ 116.833542][ T5331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.836644][ T5331] RIP: 0033:0x7f809b99e019 [ 116.838969][ T5331] Code: Unable to access opcode bytes at 0x7f809b99dfef. [ 116.842732][ T5331] RSP: 002b:00007f809c7c1fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 116.847048][ T5331] RAX: 000000000000000b RBX: 00007f809bc26090 RCX: 00007f809b99e019 [ 116.850304][ T5331] RDX: 000000000000000b RSI: 0000200000000240 RDI: 0000000000000004 [ 116.853336][ T5331] RBP: 00007f809ba3500c R08: 0000000000000000 R09: 0000000000000000 [ 116.856947][ T5331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 116.860696][ T5331] R13: 00007f809bc26128 R14: 00007f809bc26090 R15: 00007ffd6c060098 [ 116.864152][ T5331] [ 116.865885][ T5331] Modules linked in: [ 116.867836][ T5331] ---[ end trace 0000000000000000 ]--- [ 116.870495][ T5331] RIP: 0010:set_link_state+0x27/0x1000 [ 116.873123][ T5331] Code: 90 90 90 55 41 57 41 56 41 55 41 54 53 48 83 ec 38 49 89 fe 48 bb 00 00 00 00 00 fc ff df e8 30 3b 0e fa 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 bb 6d 7d fa 49 8b 16 4d 8d a6 a3 00 [ 116.881908][ T5331] RSP: 0018:ffffc9000f0ff780 EFLAGS: 00010046 [ 116.884472][ T5331] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff88801f9ea540 [ 116.887804][ T5331] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 116.891196][ T5331] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004 [ 116.894390][ T5331] R10: dffffc0000000000 R11: fffff52001e1feec R12: 0000000000000246 [ 116.897641][ T5331] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 [ 116.900978][ T5331] FS: 0000000000000000(0000) GS:ffff88808c53f000(0000) knlGS:0000000000000000 [ 116.904417][ T5331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 116.907046][ T5331] CR2: 00005625747724c0 CR3: 0000000051404000 CR4: 0000000000352ef0 [ 116.911027][ T5331] Kernel panic - not syncing: Fatal exception [ 116.915003][ T5331] Kernel Offset: disabled [ 116.917324][ T5331] Rebooting in 86400 seconds..