program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./my_configfs\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./my_configfs/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./my_configfs/usb_gadget/g1\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./my_configfs/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff) chdir(&(0x7f0000000b00)='./my_configfs/usb_gadget/g1/functions/uvc.usb0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000d00)='streaming/header/h\x00', 0x1ff) symlink(&(0x7f0000001600)='streaming/header/h\x00', &(0x7f0000001700)='streaming/class/fs/h\x00') fchdir(r0) symlink(&(0x7f0000001c00)='functions/uvc.usb0\x00', &(0x7f0000001d00)='configs/c.1/uvc.usb0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000001e00)='UDC\x00', 0x1, 0x0) write(r1, &(0x7f0000001f00)='usbip-', 0x6) [ 124.957564][ T5295] Bluetooth: hci0: command tx timeout [ 125.184534][ T5333] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000016: 0000 [#1] SMP KASAN NOPTI [ 125.189604][ T5333] KASAN: null-ptr-deref in range [0x00000000000000b0-0x00000000000000b7] [ 125.193087][ T5333] CPU: 0 UID: 0 PID: 5333 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 125.196845][ T5333] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 125.201060][ T5333] RIP: 0010:configfs_symlink+0x5fc/0x1030 [ 125.203638][ T5333] Code: 03 42 80 3c 20 00 74 08 48 89 df e8 be dc bd ff 41 bc b0 00 00 00 4c 03 23 4c 89 e0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 e7 e8 96 dc bd ff 4d 8b 2c 24 4c 89 ef e8 [ 125.211715][ T5333] RSP: 0018:ffffc9000ec6fc80 EFLAGS: 00010202 [ 125.214354][ T5333] RAX: 0000000000000016 RBX: ffff88803475af48 RCX: dffffc0000000000 [ 125.217704][ T5333] RDX: 0000000000000000 RSI: ffffffff8c4bed60 RDI: 00000000ffffffff [ 125.221127][ T5333] RBP: ffffc9000ec6fd88 R08: ffffffff9057b737 R09: 1ffffffff20af6e6 [ 125.224529][ T5333] R10: dffffc0000000000 R11: fffffbfff20af6e7 R12: 00000000000000b0 [ 125.227836][ T5333] R13: 0000000000000000 R14: ffffffff8cb3d8a8 R15: 1ffff92001d8dfa0 [ 125.231168][ T5333] FS: 00007fbdb807f6c0(0000) GS:ffff88808c543000(0000) knlGS:0000000000000000 [ 125.234916][ T5333] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 125.237692][ T5333] CR2: 0000200000001600 CR3: 000000001f5e4000 CR4: 0000000000352ef0 [ 125.241068][ T5333] Call Trace: [ 125.242596][ T5333] [ 125.243938][ T5333] ? lookup_one_qstr_excl+0x1d4/0x360 [ 125.246274][ T5333] ? make_vfsuid+0x49/0xa0 [ 125.248389][ T5333] ? __pfx_configfs_symlink+0x10/0x10 [ 125.250857][ T5333] ? bpf_lsm_inode_symlink+0x9/0x20 [ 125.252934][ T5333] vfs_symlink+0x18b/0x330 [ 125.254698][ T5333] ? security_path_symlink+0xfd/0x360 [ 125.256936][ T5333] filename_symlinkat+0x1cd/0x410 [ 125.258967][ T5333] ? __pfx_filename_symlinkat+0x10/0x10 [ 125.261214][ T5333] ? do_getname+0x151/0x250 [ 125.263108][ T5333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.265614][ T5333] __se_sys_symlink+0x4d/0x2b0 [ 125.267593][ T5333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.270033][ T5333] do_syscall_64+0x174/0x580 [ 125.272009][ T5333] ? trace_irq_disable+0x3b/0x140 [ 125.274072][ T5333] ? clear_bhb_loop+0x40/0x90 [ 125.275980][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.278272][ T5333] RIP: 0033:0x7fbdb719de99 [ 125.280102][ T5333] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 125.287685][ T5333] RSP: 002b:00007fbdb807efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000058 [ 125.290963][ T5333] RAX: ffffffffffffffda RBX: 00007fbdb7425fa0 RCX: 00007fbdb719de99 [ 125.294168][ T5333] RDX: 0000000000000000 RSI: 0000200000001700 RDI: 0000200000001600 [ 125.297274][ T5333] RBP: 00007fbdb7233eaf R08: 0000000000000000 R09: 0000000000000000 [ 125.300341][ T5333] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 125.303643][ T5333] R13: 00007fbdb7426038 R14: 00007fbdb7425fa0 R15: 00007fff7bdc0a98 [ 125.306838][ T5333] [ 125.308108][ T5333] Modules linked in: [ 125.310292][ T5333] ---[ end trace 0000000000000000 ]--- [ 125.363219][ T5333] RIP: 0010:configfs_symlink+0x5fc/0x1030 [ 125.365469][ T5333] Code: 03 42 80 3c 20 00 74 08 48 89 df e8 be dc bd ff 41 bc b0 00 00 00 4c 03 23 4c 89 e0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 e7 e8 96 dc bd ff 4d 8b 2c 24 4c 89 ef e8 [ 125.373598][ T5333] RSP: 0018:ffffc9000ec6fc80 EFLAGS: 00010202 [ 125.376021][ T5333] RAX: 0000000000000016 RBX: ffff88803475af48 RCX: dffffc0000000000 [ 125.380017][ T5333] RDX: 0000000000000000 RSI: ffffffff8c4bed60 RDI: 00000000ffffffff [ 125.383277][ T5333] RBP: ffffc9000ec6fd88 R08: ffffffff9057b737 R09: 1ffffffff20af6e6 [ 125.386593][ T5333] R10: dffffc0000000000 R11: fffffbfff20af6e7 R12: 00000000000000b0 [ 125.390677][ T5333] R13: 0000000000000000 R14: ffffffff8cb3d8a8 R15: 1ffff92001d8dfa0 [ 125.393888][ T5333] FS: 00007fbdb807f6c0(0000) GS:ffff88808c543000(0000) knlGS:0000000000000000 [ 125.397898][ T5333] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 125.400733][ T5333] CR2: 00007fbdb741ac98 CR3: 000000001f5e4000 CR4: 0000000000352ef0 [ 125.404464][ T5333] Kernel panic - not syncing: Fatal exception [ 125.407318][ T5333] Kernel Offset: disabled [ 125.409105][ T5333] Rebooting in 86400 seconds..