program: r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./file0\x00', 0x42, 0x1ff) ftruncate(r0, 0x100000) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='configfs\x00', &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nvmet/subsystems/testnqn\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nvmet/subsystems/testnqn/attr_allow_any_host\x00', 0x1, 0x0) write(r1, &(0x7f0000000180)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/subsystems/testnqn/namespaces/1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/subsystems/testnqn/namespaces/1/device_path\x00', 0x1, 0x0) write(r2, &(0x7f0000000500)='./file0\x00', 0x7) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/subsystems/testnqn/namespaces/1/buffered_io\x00', 0x1, 0x0) write(r3, &(0x7f0000000180)='1\x00', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/subsystems/testnqn/namespaces/1/enable\x00', 0x1, 0x0) write(r4, &(0x7f0000000180)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nvmet/ports/1\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0) write(r5, &(0x7f0000000280)='loop\x00', 0x4) symlinkat(&(0x7f0000000100)='./config/nvmet/subsystems/testnqn\x00', 0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/ports/1/subsystems/testnqn\x00') r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0) write(r6, &(0x7f0000000340)='transport=loop,nqn=testnqn\x00', 0x1a) nanosleep(&(0x7f0000000380)={0x0, 0x989680}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys\x00', 0x1ff) mount(&(0x7f0000000400)=@filename='sysfs\x00', &(0x7f00000003c0)='./sys\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/class/nvme/nvme0/reset_controller\x00', 0x1, 0x0) write(r7, &(0x7f0000000480)='1\x00', 0x1) nanosleep(&(0x7f0000000380)={0x0, 0x989680}, 0x0) [ 94.197054][ T4645] Bluetooth: hci0: command tx timeout [ 94.370215][ T5315] nvmet: adding nsid 1 to subsystem testnqn [ 94.509405][ T13] Oops: general protection fault, probably for non-canonical address 0xdffffc000000001c: 0000 [#1] SMP KASAN NOPTI [ 94.514523][ T13] KASAN: null-ptr-deref in range [0x00000000000000e0-0x00000000000000e7] [ 94.518035][ T13] CPU: 0 UID: 0 PID: 13 Comm: kworker/u4:1 Not tainted syzkaller #0 PREEMPT(full) [ 94.522068][ T13] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.526554][ T13] Workqueue: nvme-reset-wq nvme_loop_reset_ctrl_work [ 94.529388][ T13] RIP: 0010:kasan_byte_accessible+0x12/0x30 [ 94.531933][ T13] Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cc cc cc cc 66 66 66 66 66 66 2e [ 94.540223][ T13] RSP: 0018:ffffc9000026f978 EFLAGS: 00010002 [ 94.542905][ T13] RAX: dffffc0000000000 RBX: ffffffff8be8ac30 RCX: 8000000000000002 [ 94.546416][ T13] RDX: 0000000000000000 RSI: ffffffff8be8ac30 RDI: 000000000000001c [ 94.549923][ T13] RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000 [ 94.553392][ T13] R10: dffffc0000000000 R11: fffffbfff20f46f0 R12: 00000000000000e0 [ 94.557012][ T13] R13: 0000000000000000 R14: 00000000000000e0 R15: 0000000000000001 [ 94.560453][ T13] FS: 0000000000000000(0000) GS:ffff88808c2cf000(0000) knlGS:0000000000000000 [ 94.564336][ T13] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.567190][ T13] CR2: 00007f73e1aa3e9c CR3: 000000000bebe000 CR4: 0000000000352ef0 [ 94.570577][ T13] Call Trace: [ 94.571992][ T13] [ 94.573259][ T13] __kasan_check_byte+0x12/0x40 [ 94.575335][ T13] lock_acquire+0x7d/0x350 [ 94.577191][ T13] ? enable_work+0x17f/0x230 [ 94.579041][ T13] ? rcu_is_watching+0x16/0xb0 [ 94.580834][ T13] _raw_spin_lock_irqsave+0x40/0x60 [ 94.582995][ T13] ? blk_mq_quiesce_queue+0x2f/0x190 [ 94.585136][ T13] blk_mq_quiesce_queue+0x2f/0x190 [ 94.587161][ T13] nvme_loop_reset_ctrl_work+0x1cf/0x810 [ 94.589321][ T13] ? process_scheduled_works+0x97a/0x1630 [ 94.591474][ T13] process_scheduled_works+0xc3d/0x1630 [ 94.593681][ T13] ? __pfx_process_scheduled_works+0x10/0x10 [ 94.595933][ T13] ? assign_work+0x3cf/0x5d0 [ 94.597704][ T13] worker_thread+0xa47/0xfb0 [ 94.599478][ T13] kthread+0x38b/0x480 [ 94.601127][ T13] ? __pfx_worker_thread+0x10/0x10 [ 94.603068][ T13] ? __pfx_kthread+0x10/0x10 [ 94.604784][ T13] ret_from_fork+0x514/0xb70 [ 94.606654][ T13] ? __pfx_ret_from_fork+0x10/0x10 [ 94.608721][ T13] ? __switch_to+0xc89/0x1420 [ 94.610667][ T13] ? __pfx_kthread+0x10/0x10 [ 94.612493][ T13] ret_from_fork_asm+0x1a/0x30 [ 94.614970][ T13] [ 94.616183][ T13] Modules linked in: [ 94.617760][ T13] ---[ end trace 0000000000000000 ]--- [ 94.619864][ T13] RIP: 0010:kasan_byte_accessible+0x12/0x30 [ 94.619884][ T13] Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cc cc cc cc 66 66 66 66 66 66 2e [ 94.619893][ T13] RSP: 0018:ffffc9000026f978 EFLAGS: 00010002 [ 94.619904][ T13] RAX: dffffc0000000000 RBX: ffffffff8be8ac30 RCX: 8000000000000002 [ 94.619912][ T13] RDX: 0000000000000000 RSI: ffffffff8be8ac30 RDI: 000000000000001c [ 94.619920][ T13] RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000 [ 94.619927][ T13] R10: dffffc0000000000 R11: fffffbfff20f46f0 R12: 00000000000000e0 [ 94.619935][ T13] R13: 0000000000000000 R14: 00000000000000e0 R15: 0000000000000001 [ 94.619942][ T13] FS: 0000000000000000(0000) GS:ffff88808c2cf000(0000) knlGS:0000000000000000 [ 94.619951][ T13] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.619959][ T13] CR2: 00007f73e1aa3e9c CR3: 000000000bebe000 CR4: 0000000000352ef0 [ 94.619994][ T13] Kernel panic - not syncing: Fatal exception [ 94.656231][ T13] Kernel Offset: disabled [ 94.658105][ T13] Rebooting in 86400 seconds..