program: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4001}) r1 = socket$inet(0x2, 0x2, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200de7e001009058b1e20"], 0x0) syz_usb_control_io(r3, 0x0, &(0x7f0000000300)={0x84, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r5, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) syz_mount_image$nilfs2(&(0x7f0000000380), &(0x7f0000000a40)='./file0\x00', 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='\x00'], 0xf, 0xa02, &(0x7f0000001ec0)="$eJzs3U9sXEcdAOB5a68d16mzhgKmoYmBAqmgTrCtKrmkMZRrpN7KsQppiHBTlHBpVakpUsUNRap67IGqh1wQFeLSA1JEVUQvQZQ7CoVKVVGgFQipoNYo9sx6d+zH/rG99vp9n/Tz+L2ZfTPPu943fp6dCUBl1Va/Li7OFCG89PqLj/zkD698twghHG2WaLSUW9uqhxCKtsevuxUzPv7w2XObpUWYX/2atsPZ283HToYQrobZcCM0wsL7j829ubT08vWbj16efuH02zt0+gAAUCln3/jH7x94761vTP/nF0fOhPHm/tQ/b8TtydjvPxH793n/v2hJi5btZCwrNxIj//thJCs3mtUzWlJfPTtOvaTcWIf6Rlr2bXaeALAfrN/XK2pzbdu12tzc2nX/jlvjY8XcpYvLT1zZpYYCANvmXw+HEM4IIYQQokqxcmi3eyAAQNXl44U3uJqPLNia5tEOdFf/7aXa5o+HbTDo17/6h6v+V5/3jsP22a+vpnRe6fcojWPIxxGOZI/r9fe/lh1ntMd2lo0rHJbxhmXtzH+ue1VZ+3t9HndLWfvz8bB7VVn783G6e1VZ+8cH3I5+lbX/wIDb0a+y9k80v9uvV7jtcd/q1/V3iyNZfuv1M39PH5b3eACg3UfG/wkhhBCVi+d2uwMCAOw5+fw4K1HKz+fjyfPzeXjy/HxeoDx/vEP+gQ75AMBGC7+68PNrxfr/+bc6Hi6Nu7grppM9ticfrdFr/Vsd97TV+odl3BIA1fbUTxe/89aZpZG1+X/Xr2WfZPP/prl6r8XtNO7yYLbdnPt3tr2eWkm5gztxUgDA/5Wuv2Xz/94dt2dCvXji4vL5E3F7Kqa/G6+P39n/zQG3GwDoX7fz/8+E9vn/Dzb312ut/YJD6/uL1n5BI9s/X7J/IW5Px/T74xOr++fOPbX8ve0+eQCoqDe+dfC1D357Kazd/1///3e6/59u4zfiWLsPYoHUT0j3Bzbc/z/WXs9UWbkT7eUOlZU72V6ukZWrx8jn3cjHB05kj0vjFNK4h9TfSeMap8vak02QMZaVG41xd9aeqaw9G873RHt78nloUv2NbH8+7iGVmw4AsNGVp5/5wePLy+cv+8Y3vqngN8+FEDbL2u13JmCnHf/Rkz88fuXpZx68+OTjF85fOH9pYXH+1KmHFucXHzq+el//eOvdfQBgP1jv9O92SwAAAAAAAAAAAAAAgDKD+KTxbp8jANDu7w+HEM6ILEb2QBuEECk+2gNtEGKfxcpKvuIvAMBg9bre/lY1jxbn80/rHqT04IN/nL4Tqdjtpfb+kvWL2U6Dfv2rf7jqf/X57a2/ub5I1+9/tfYDzPZX761fnjzZWv+9o13Wn5//sf7q/3NW/9dCd/Wv/Cyrv8+pcd/J6r+ry/o3nP/J/ur/S6z/nrh97Mvd1t/+/Kf1dtJyOBPZ+UyW1P/Xevv5p7X9ej7/Az2cdIt34/kDQBXVdrsBOyT1ElI/OvVDWtfnCy3r7IWsfLf9/1p2nHy9vn6l46Z+0BfjdurupHUD8/UOe21/Wp9wKjtu0WW/tuz1Myz/VSpr/3Y9jzutrP35epB7VVn7xwbcjn6VtT//vdyrytrf559VA1fW/okBt2NYHY5p2fUwXX+mYl7abmTbk5s8F/u1bwEAw+7bp2/ef+3rozfy9fnTdT39GTgZ/6a+npXL+wsTWd+xyMp/KaY/jukrMf1NTN/Jjrez/20DgGp6z+f/hBBCiMpF1T//5/4CVVb113/Vz7/a7/6e/07S6yO/j5+Mdsivt+SPbJI/1uHx41l+/nwd6JB/T3bclSjlf6ZD/mc75H+uQ/5Mh/xDHfLv7ZB/uEP+FzrkH+mQf7RDPgDD6fMx9f4OANWRj/tz/QeA/S9NrOP6DwDV8amYll3/7+uQDwAMn0/H1PUdACqk2Hymx63O2wMMjzS/dPo9j8uBhPtj+pWYfjWmab2UPpdfAfaA//7713+7VqzP93c4y+92Pvmi1v7Ju3z9nwe6bE/++b1e57NvdFnPTtU/vcX6AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABis2urXxcWZIoSXXn/xkX+e+tO7RQjhaLNEo6Xc2la9ZXu27TghvFaspR9/+Oy51vSTmBZhPhShaO4PZ283a5oMIVwNs+FGaISF9x+be3Np6eXrNx+9PP3C6bd38EcAAAAA+97/AgAA//87+jkE") r6 = openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x80, 0x0) ioctl$NILFS_IOCTL_CLEAN_SEGMENTS(r6, 0x40786e88, &(0x7f00000000c0)={{0x0, 0x0, 0x40, 0x5, 0xe2}, {0x0, 0x0, 0x10, 0x20c, 0xfffffffffffffff3}, {0x0, 0x0, 0x8, 0x44, 0x3}, {0x0, 0x0, 0x28, 0x9, 0xffffffffffffff2d}, {&(0x7f0000000040)=[0x0, 0x0], 0x2, 0x8, 0x98f, 0x8}}) close(r5) r7 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0) write(r7, &(0x7f0000000400)='dummy_hcd.0\x00', 0xb) close(r7) ioctl$FS_IOC_GETVERSION(r4, 0x40015b0b, &(0x7f00000001c0)) sendmsg$kcm(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)="2e00000010008188040f80ec59acbc0413a181000b00000000010000000000000e000a000f000000028002002d1f", 0x2e}], 0x1}, 0x0) r8 = socket$nl_rdma(0x10, 0x3, 0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="38000000031401002abd7000fedbdf250900007379eb84a97a3100deff00270041007369770014003300626f0000000000000000000057f1caf3b214cfd583176d9eb5aa46c3a8c283e5df160283cec4c24ce00f4fc826f75d8ff177d971268493acd9a6be21c91cc29396836b"], 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000080)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}}) socket$inet_sctp(0x2, 0x0, 0x84) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) r9 = socket$inet_sctp(0x2, 0x1, 0x84) bind(r9, &(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x20000001, @private1={0xfc, 0x1, '\x00', 0x1}, 0x80000001}, 0x80) ioctl$sock_inet_udp_SIOCINQ(r1, 0x541b, &(0x7f0000000280)) [ 110.415232][ T5287] Bluetooth: hci0: command tx timeout [ 110.873816][ T10] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 111.024022][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 111.030984][ T10] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 111.037812][ T10] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 111.042685][ T10] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 111.047863][ T10] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 111.054687][ T10] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 111.058540][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 111.277711][ T10] usb 5-1: GET_CAPABILITIES returned 0 [ 111.281893][ T10] usbtmc 5-1:16.0: can't read capabilities [ 111.485410][ T5330] dummy_hcd dummy_hcd.0: remove, state 1 [ 111.489283][ T5330] usb usb5: USB disconnect, device number 1 [ 111.492549][ T5330] usb 5-1: USB disconnect, device number 2 [ 111.587115][ T5331] loop0: detected capacity change from 0 to 2048 [ 111.609452][ T5330] dummy_hcd dummy_hcd.0: stopped [ 111.627715][ T5330] dummy_hcd dummy_hcd.0: USB bus 5 deregistered [ 111.688500][ T5331] NILFS (loop0): invalid segment: Magic number mismatch [ 111.714475][ T5331] NILFS (loop0): trying rollback from an earlier position [ 111.789050][ T5331] NILFS (loop0): recovery complete [ 111.806575][ T5332] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 111.840083][ T5330] NILFS (loop0): nilfs_sufile_do_free: segment 0 is already clean [ 111.855901][ T5330] NILFS (loop0): nilfs_sufile_do_cancel_free: segment 0 must be clean [ 111.860189][ T5330] NILFS (loop0): nilfs_sufile_do_free: segment 0 is already clean [ 111.890393][ T5330] netlink: 'syz.0.0': attribute type 10 has an invalid length. [ 111.899248][ T5330] syz_tun: entered promiscuous mode [ 111.915219][ T5330] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 112.016677][ T5329] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI [ 112.021634][ T5329] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 112.026406][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 112.030270][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 112.034775][ T5329] RIP: 0010:set_link_state+0x27/0x1000 [ 112.037348][ T5329] Code: 90 90 90 55 41 57 41 56 41 55 41 54 53 48 83 ec 38 49 89 fe 48 bb 00 00 00 00 00 fc ff df e8 e0 ad 0e fa 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 6b e0 7d fa 49 8b 16 4d 8d a6 a3 00 [ 112.049692][ T5329] RSP: 0018:ffffc9000edafb20 EFLAGS: 00010046 [ 112.052550][ T5329] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff888033dd2540 [ 112.056363][ T5329] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 112.060159][ T5329] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004 [ 112.064900][ T5329] R10: dffffc0000000000 R11: fffff52001db5f60 R12: 0000000000000246 [ 112.069659][ T5329] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 [ 112.073419][ T5329] FS: 0000555560c31540(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 112.077678][ T5329] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 112.081754][ T5329] CR2: 00007f516b640e9c CR3: 00000000128bf000 CR4: 0000000000352ef0 [ 112.086521][ T5329] Call Trace: [ 112.088104][ T5329] [ 112.089458][ T5329] ? rcu_is_watching+0x15/0xb0 [ 112.091800][ T5329] ? __pfx_dummy_pullup+0x10/0x10 [ 112.094416][ T5329] dummy_pullup+0xc4/0x120 [ 112.097347][ T5329] ? __pfx_dummy_pullup+0x10/0x10 [ 112.100511][ T5329] usb_gadget_disconnect_locked+0x126/0x480 [ 112.103185][ T5329] gadget_unbind_driver+0xc2/0x410 [ 112.105131][ T5329] ? __pfx_gadget_unbind_driver+0x10/0x10 [ 112.107369][ T5329] device_release_driver_internal+0x48b/0x880 [ 112.109754][ T5329] driver_detach+0x1f3/0x2d0 [ 112.112286][ T5329] bus_remove_driver+0x226/0x320 [ 112.114943][ T5329] usb_gadget_unregister_driver+0x4e/0x70 [ 112.117820][ T5329] raw_release+0xd7/0x260 [ 112.119597][ T5329] ? __pfx_raw_release+0x10/0x10 [ 112.121589][ T5329] __fput+0x418/0xa50 [ 112.123297][ T5329] task_work_run+0x1d9/0x270 [ 112.125196][ T5329] ? __pfx_task_work_run+0x10/0x10 [ 112.127963][ T5329] exit_to_user_mode_loop+0x1fa/0x730 [ 112.131922][ T5329] ? rcu_is_watching+0x15/0xb0 [ 112.134846][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.137724][ T5329] do_syscall_64+0x353/0x580 [ 112.139984][ T5329] ? clear_bhb_loop+0x40/0x90 [ 112.142194][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.145080][ T5329] RIP: 0033:0x7f3963d9e0d9 [ 112.147241][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 112.157401][ T5329] RSP: 002b:00007ffc3be76a98 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 112.160670][ T5329] RAX: 0000000000000000 RBX: 00007f3964027da0 RCX: 00007f3963d9e0d9 [ 112.164523][ T5329] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 112.170194][ T5329] RBP: 00007f3964027da0 R08: 0000000000000006 R09: 0000000000000000 [ 112.174394][ T5329] R10: 0000000000dd008c R11: 0000000000000246 R12: 000000000001c063 [ 112.177910][ T5329] R13: 00007f396402609c R14: 000000000001b4dd R15: 00007f3964026090 [ 112.181711][ T5329] [ 112.183273][ T5329] Modules linked in: [ 112.185349][ T5329] ---[ end trace 0000000000000000 ]--- [ 112.188505][ T5329] RIP: 0010:set_link_state+0x27/0x1000 [ 112.191216][ T5329] Code: 90 90 90 55 41 57 41 56 41 55 41 54 53 48 83 ec 38 49 89 fe 48 bb 00 00 00 00 00 fc ff df e8 e0 ad 0e fa 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 6b e0 7d fa 49 8b 16 4d 8d a6 a3 00 [ 112.199891][ T5329] RSP: 0018:ffffc9000edafb20 EFLAGS: 00010046 [ 112.202782][ T5329] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff888033dd2540 [ 112.206170][ T5329] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 112.209381][ T5329] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004 [ 112.212826][ T5329] R10: dffffc0000000000 R11: fffff52001db5f60 R12: 0000000000000246 [ 112.216219][ T5329] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 [ 112.219636][ T5329] FS: 0000555560c31540(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 112.223683][ T5329] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 112.226263][ T5329] CR2: 00007f516b640e9c CR3: 00000000128bf000 CR4: 0000000000352ef0 [ 112.228996][ T5329] Kernel panic - not syncing: Fatal exception [ 112.231810][ T5329] Kernel Offset: disabled [ 112.233717][ T5329] Rebooting in 86400 seconds..