program: ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './mysys\x00'}) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x0, 0x3, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000004000045c1c0127e53e1e156c500000095"], &(0x7f0000000180)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x61, 0x0, &(0x7f0000000680)="6e396043c7f73cdb24daad17f83ce74b34cd63b8facb5c284d61010075bfdbc35cfe8116ba2125d355b852159de6df41715a3e9d41970b39c9293403d0e740dd1fd8e8b590936714c68252a41c8876cefdd8a3b4e05edd64fafd10e7ab0feabc0e", 0x0, 0x0, 0x2}, 0x50) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000297ff8208582005109bc10102030109021200010100800009048f0000bf575a00"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) symlink(&(0x7f0000000440)='./cgroup.cpu/cgroup.procs\x00', &(0x7f0000000980)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') stat(&(0x7f0000000340)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000480)) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x86003, 0x0) write(r2, &(0x7f0000000400)='dummy_hcd.0\x00', 0xb) close(r2) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './mysys\x00'}) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x0, 0x3, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000004000045c1c0127e53e1e156c500000095"], &(0x7f0000000180)='GPL\x00'}, 0x94) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x61, 0x0, &(0x7f0000000680)="6e396043c7f73cdb24daad17f83ce74b34cd63b8facb5c284d61010075bfdbc35cfe8116ba2125d355b852159de6df41715a3e9d41970b39c9293403d0e740dd1fd8e8b590936714c68252a41c8876cefdd8a3b4e05edd64fafd10e7ab0feabc0e", 0x0, 0x0, 0x2}, 0x50) (async) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000297ff8208582005109bc10102030109021200010100800009048f0000bf575a00"], 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) (async) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) (async) symlink(&(0x7f0000000440)='./cgroup.cpu/cgroup.procs\x00', &(0x7f0000000980)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') (async) stat(&(0x7f0000000340)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000480)) (async) openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) (async) write(r1, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) close(r1) (async) openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x86003, 0x0) (async) write(r2, &(0x7f0000000400)='dummy_hcd.0\x00', 0xb) (async) close(r2) (async) [ 94.073462][ T5290] Bluetooth: hci0: command tx timeout [ 94.384828][ T10] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 94.534762][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 94.541349][ T10] usb 5-1: config 1 has an invalid interface number: 143 but max is 0 [ 94.545868][ T10] usb 5-1: config 1 has no interface number 0 [ 94.553862][ T10] usb 5-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 94.559262][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 94.562575][ T10] usb 5-1: Product: syz [ 94.565089][ T10] usb 5-1: Manufacturer: syz [ 94.567210][ T10] usb 5-1: SerialNumber: syz [ 94.707824][ T10] viperboard 5-1:1.143: version 0.00 found at bus 005 address 002 [ 94.736730][ T10] viperboard-i2c viperboard-i2c.3.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 94.741729][ T10] viperboard-i2c viperboard-i2c.3.auto: probe with driver viperboard-i2c failed with error -5 [ 94.812485][ T5331] dummy_hcd dummy_hcd.0: remove, state 1 [ 94.825323][ T5331] usb usb5: USB disconnect, device number 1 [ 94.830760][ T5331] usb 5-1: USB disconnect, device number 2 [ 94.938738][ T5331] dummy_hcd dummy_hcd.0: stopped [ 94.941164][ T5331] dummy_hcd dummy_hcd.0: USB bus 5 deregistered [ 94.974546][ T5331] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI [ 94.979468][ T5331] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 94.982759][ T5331] CPU: 0 UID: 0 PID: 5331 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.986144][ T5331] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.990113][ T5331] RIP: 0010:set_link_state+0x27/0x1000 [ 94.992411][ T5331] Code: 90 90 90 55 41 57 41 56 41 55 41 54 53 48 83 ec 38 49 89 fe 48 bb 00 00 00 00 00 fc ff df e8 30 3b 0e fa 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 bb 6d 7d fa 49 8b 16 4d 8d a6 a3 00 [ 95.000522][ T5331] RSP: 0018:ffffc9000e5a7780 EFLAGS: 00010046 [ 95.003245][ T5331] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff888032f88000 [ 95.006721][ T5331] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 95.010170][ T5331] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004 [ 95.013517][ T5331] R10: dffffc0000000000 R11: fffff52001cb4eec R12: 0000000000000246 [ 95.017071][ T5331] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 [ 95.020567][ T5331] FS: 0000000000000000(0000) GS:ffff88808c53f000(0000) knlGS:0000000000000000 [ 95.024388][ T5331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.026708][ T5331] CR2: 00007ffeab0d7e40 CR3: 0000000050103000 CR4: 0000000000352ef0 [ 95.029975][ T5331] Call Trace: [ 95.031311][ T5331] [ 95.032493][ T5331] ? rcu_is_watching+0x15/0xb0 [ 95.034488][ T5331] ? __pfx_dummy_pullup+0x10/0x10 [ 95.036543][ T5331] dummy_pullup+0xc4/0x120 [ 95.038474][ T5331] ? __pfx_dummy_pullup+0x10/0x10 [ 95.040732][ T5331] usb_gadget_disconnect_locked+0x126/0x480 [ 95.043281][ T5331] gadget_unbind_driver+0xc2/0x410 [ 95.045529][ T5331] ? __pfx_gadget_unbind_driver+0x10/0x10 [ 95.047766][ T5331] device_release_driver_internal+0x48b/0x880 [ 95.050181][ T5331] driver_detach+0x1f3/0x2d0 [ 95.052197][ T5331] bus_remove_driver+0x226/0x320 [ 95.054430][ T5331] usb_gadget_unregister_driver+0x4e/0x70 [ 95.056844][ T5331] raw_release+0xd7/0x260 [ 95.058698][ T5331] ? __pfx_raw_release+0x10/0x10 [ 95.060876][ T5331] __fput+0x418/0xa50 [ 95.062578][ T5331] task_work_run+0x1d9/0x270 [ 95.064630][ T5331] ? __pfx_task_work_run+0x10/0x10 [ 95.066868][ T5331] ? do_raw_spin_unlock+0x4d/0x210 [ 95.069120][ T5331] do_exit+0x73a/0x2360 [ 95.071024][ T5331] ? __pfx_do_exit+0x10/0x10 [ 95.073082][ T5331] ? do_raw_spin_lock+0x12b/0x2f0 [ 95.075314][ T5331] do_group_exit+0x22d/0x2f0 [ 95.077318][ T5331] ? _raw_spin_unlock_irq+0x23/0x50 [ 95.079609][ T5331] get_signal+0x121b/0x12c0 [ 95.081624][ T5331] arch_do_signal_or_restart+0xbb/0x860 [ 95.083914][ T5331] ? __pfx___fput_deferred+0x10/0x10 [ 95.086205][ T5331] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 95.088857][ T5331] ? ksys_write+0x242/0x270 [ 95.090833][ T5331] exit_to_user_mode_loop+0x104/0x730 [ 95.093226][ T5331] ? rcu_is_watching+0x15/0xb0 [ 95.095302][ T5331] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.097882][ T5331] do_syscall_64+0x353/0x580 [ 95.099923][ T5331] ? clear_bhb_loop+0x40/0x90 [ 95.101836][ T5331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.104224][ T5331] RIP: 0033:0x7ff16659e019 [ 95.106157][ T5331] Code: Unable to access opcode bytes at 0x7ff16659dfef. [ 95.109203][ T5331] RSP: 002b:00007ff167509fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 95.112685][ T5331] RAX: 000000000000000b RBX: 00007ff166825fa0 RCX: 00007ff16659e019 [ 95.116059][ T5331] RDX: 000000000000000b RSI: 0000200000000200 RDI: 0000000000000004 [ 95.119384][ T5331] RBP: 00007ff16663500c R08: 0000000000000000 R09: 0000000000000000 [ 95.122751][ T5331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.126186][ T5331] R13: 00007ff166826038 R14: 00007ff166825fa0 R15: 00007ffeab0d8808 [ 95.129569][ T5331] [ 95.130952][ T5331] Modules linked in: [ 95.132668][ T5331] ---[ end trace 0000000000000000 ]--- [ 95.134930][ T5331] RIP: 0010:set_link_state+0x27/0x1000 [ 95.137186][ T5331] Code: 90 90 90 55 41 57 41 56 41 55 41 54 53 48 83 ec 38 49 89 fe 48 bb 00 00 00 00 00 fc ff df e8 30 3b 0e fa 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 bb 6d 7d fa 49 8b 16 4d 8d a6 a3 00 [ 95.145146][ T5331] RSP: 0018:ffffc9000e5a7780 EFLAGS: 00010046 [ 95.147784][ T5331] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff888032f88000 [ 95.151034][ T5331] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 95.154303][ T5331] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004 [ 95.157724][ T5331] R10: dffffc0000000000 R11: fffff52001cb4eec R12: 0000000000000246 [ 95.160994][ T5331] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 [ 95.164427][ T5331] FS: 0000000000000000(0000) GS:ffff88808c53f000(0000) knlGS:0000000000000000 [ 95.168182][ T5331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.170952][ T5331] CR2: 00007ffeab0d7e40 CR3: 0000000050103000 CR4: 0000000000352ef0 [ 95.174234][ T5331] Kernel panic - not syncing: Fatal exception [ 95.177222][ T5331] Kernel Offset: disabled [ 95.179066][ T5331] Rebooting in 86400 seconds..