program: syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000297ff8208582005109bc10102030109021200010100800009048f0000bf575a00"], 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) (async) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='attr\x00') (async) unshare(0x20040600) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)={0x1d8, 0x0, 0x2, 0x301, 0x0, 0x0, {0x7, 0x0, 0x2}, [@CTA_EXPECT_NAT={0x120, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_TUPLE={0x98, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @remote}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}]}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x64, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x2a}}, {0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2}, {0x8, 0x2, @rand_addr=0x64010102}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}]}, @CTA_EXPECT_NAT={0x9c, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x30, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private1}, {0x14, 0x4, @private1}}}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x60, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2}, {0x8, 0x2, @broadcast}}}]}]}, @CTA_EXPECT_ZONE={0x6, 0x7, 0x1, 0x0, 0x3}]}, 0x1d8}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) (async) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) (async) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) cachestat(r1, 0x0, 0x0, 0x0) (async) close(r0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000400)='dummy_hcd.0\x00', 0xb) (async) close(r3) [ 110.130530][ T5332] dummy_hcd dummy_hcd.0: remove, state 4 [ 110.133286][ T5332] usb usb5: USB disconnect, device number 1 [ 110.147686][ T5291] Bluetooth: hci0: command tx timeout [ 110.196002][ T5332] dummy_hcd dummy_hcd.0: stopped [ 110.204830][ T5332] dummy_hcd dummy_hcd.0: USB bus 5 deregistered [ 110.315699][ T5330] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI [ 110.320728][ T5330] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 110.324537][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 110.328480][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 110.332838][ T5330] RIP: 0010:set_link_state+0x27/0x1000 [ 110.335377][ T5330] Code: 90 90 90 55 41 57 41 56 41 55 41 54 53 48 83 ec 38 49 89 fe 48 bb 00 00 00 00 00 fc ff df e8 b0 b1 0e fa 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 3b e4 7d fa 49 8b 16 4d 8d a6 a3 00 [ 110.343605][ T5330] RSP: 0000:ffffc9000efd79c0 EFLAGS: 00010046 [ 110.346324][ T5330] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff888000efca80 [ 110.349778][ T5330] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 110.353175][ T5330] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004 [ 110.356608][ T5330] R10: dffffc0000000000 R11: fffff52001dfaf34 R12: 0000000000000246 [ 110.360068][ T5330] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 [ 110.363483][ T5330] FS: 0000000000000000(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 110.367381][ T5330] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 110.370215][ T5330] CR2: 000055ce4eb7c020 CR3: 000000001299b000 CR4: 0000000000352ef0 [ 110.373689][ T5330] Call Trace: [ 110.375229][ T5330] [ 110.376612][ T5330] ? rcu_is_watching+0x15/0xb0 [ 110.378726][ T5330] ? __pfx_dummy_pullup+0x10/0x10 [ 110.380959][ T5330] dummy_pullup+0xc4/0x120 [ 110.382965][ T5330] ? __pfx_dummy_pullup+0x10/0x10 [ 110.385179][ T5330] usb_gadget_disconnect_locked+0x126/0x480 [ 110.387829][ T5330] gadget_unbind_driver+0xc2/0x410 [ 110.390097][ T5330] ? __pfx_gadget_unbind_driver+0x10/0x10 [ 110.392641][ T5330] device_release_driver_internal+0x48b/0x880 [ 110.395376][ T5330] driver_detach+0x1f3/0x2d0 [ 110.397462][ T5330] bus_remove_driver+0x226/0x320 [ 110.399710][ T5330] usb_gadget_unregister_driver+0x4e/0x70 [ 110.402207][ T5330] raw_release+0xd7/0x260 [ 110.404083][ T5330] ? __pfx_raw_release+0x10/0x10 [ 110.406147][ T5330] __fput+0x418/0xa50 [ 110.407829][ T5330] task_work_run+0x1d9/0x270 [ 110.409714][ T5330] ? __pfx_task_work_run+0x10/0x10 [ 110.411807][ T5330] ? do_raw_spin_unlock+0x4d/0x210 [ 110.413905][ T5330] do_exit+0x73a/0x2360 [ 110.415632][ T5330] ? lockdep_hardirqs_on+0x7a/0x110 [ 110.417926][ T5330] ? __pfx_do_exit+0x10/0x10 [ 110.420015][ T5330] ? preempt_schedule_thunk+0x16/0x40 [ 110.422388][ T5330] ? preempt_schedule_thunk+0x16/0x40 [ 110.424798][ T5330] do_group_exit+0x22d/0x2f0 [ 110.426882][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.429341][ T5330] __x64_sys_exit_group+0x3f/0x40 [ 110.431396][ T5330] x64_sys_call+0x221a/0x2240 [ 110.433413][ T5330] do_syscall_64+0x174/0x580 [ 110.435388][ T5330] ? trace_irq_disable+0x3b/0x140 [ 110.437603][ T5330] ? clear_bhb_loop+0x40/0x90 [ 110.439689][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.442284][ T5330] RIP: 0033:0x7f1c70b9e019 [ 110.444268][ T5330] Code: Unable to access opcode bytes at 0x7f1c70b9dfef. [ 110.447242][ T5330] RSP: 002b:00007ffc53790cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 110.450759][ T5330] RAX: ffffffffffffffda RBX: 000000000000000b RCX: 00007f1c70b9e019 [ 110.454062][ T5330] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 000000000000000b [ 110.457500][ T5330] RBP: 0000000000001130 R08: 00007ffc537918d7 R09: 000000000000000b [ 110.460803][ T5330] R10: 00007f1c70e25fa0 R11: 0000000000000246 R12: 0000000000000003 [ 110.464110][ T5330] R13: 00007f1c70e2627c R14: 00007f1c70e26278 R15: 00007f1c70e26270 [ 110.467582][ T5330] [ 110.468948][ T5330] Modules linked in: [ 110.470694][ T5330] ---[ end trace 0000000000000000 ]--- [ 110.473120][ T5330] RIP: 0010:set_link_state+0x27/0x1000 [ 110.475457][ T5330] Code: 90 90 90 55 41 57 41 56 41 55 41 54 53 48 83 ec 38 49 89 fe 48 bb 00 00 00 00 00 fc ff df e8 b0 b1 0e fa 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 3b e4 7d fa 49 8b 16 4d 8d a6 a3 00 [ 110.483382][ T5330] RSP: 0000:ffffc9000efd79c0 EFLAGS: 00010046 [ 110.485770][ T5330] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff888000efca80 [ 110.488931][ T5330] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 110.492281][ T5330] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004 [ 110.495654][ T5330] R10: dffffc0000000000 R11: fffff52001dfaf34 R12: 0000000000000246 [ 110.499112][ T5330] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 [ 110.502437][ T5330] FS: 0000000000000000(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 110.506140][ T5330] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 110.508976][ T5330] CR2: 000055ce4eb7c020 CR3: 000000001299b000 CR4: 0000000000352ef0 [ 110.512209][ T5330] Kernel panic - not syncing: Fatal exception [ 110.514992][ T5330] Kernel Offset: disabled [ 110.516882][ T5330] Rebooting in 86400 seconds..