program: r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000000c0)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000380)='rxrpc_call\x00', r0}, 0x10) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000340)='afs_make_fs_call1\x00', r0, 0x0, 0x7fffffff}, 0x2e) mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000440)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0\x00', &(0x7f0000000140)='configfs\x00', 0x44000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0/virtual_lun\x00', 0x1ff) symlinkat(&(0x7f0000000880)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000008c0)='./my_configfs/usb_gadget/g1/configs/c.1/midi2.usb0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./my_configfs/usb_gadget/g1/UDC\x00', 0x1, 0x1) write(r2, &(0x7f0000000940)='dummy_udc.0', 0xb) mkdir(&(0x7f0000000200)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000300)='./my_configfs/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdir(&(0x7f0000000400)='./my_configfs/target/usb_gadget\x00', 0x1ff) mkdir(&(0x7f0000000500)='./my_configfs/target/usb_gadget/naa.1234567890abcdef\x00', 0x1ff) mkdir(&(0x7f0000000600)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1\x00', 0x1ff) mkdir(&(0x7f0000000800)='./my_configfs/target/core/rd_mcp_0/dev0\x00', 0x1ff) mkdir(&(0x7f0000000d00)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0\x00', 0x1ff) symlink(&(0x7f0000000e00)='./my_configfs/target/core/rd_mcp_0/dev0\x00', &(0x7f0000000f00)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0/virtual_lun\x00') connect$rxrpc(0xffffffffffffffff, &(0x7f0000000000)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @loopback}}, 0x24) quotactl_fd$Q_GETQUOTA(0xffffffffffffffff, 0xffffffff80000700, 0x0, 0x0) r3 = signalfd(r1, &(0x7f0000000080), 0x8) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000c00000002000000ffff000005"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000180)={0xd, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="180000000000000000000000000000006112c4008094e3c2d60000000095000067116f9696dacd292dcdf98f5979af5b45c400aafa6dd9a6eac5567bdc6a2b6c00f10c84433ee2043975eea3b96aad6ef188cea0c1af5b82008eae10985470b9a70e0cac5e902576c2246ad0c0106193e7396da5e7170648f84a75278029a0bfe99e9b438175abc6db28f0812c01f38e3ca2049d6ab5e5cafdf002a6a2df2ada84758809ee3830bd87b9a7b9d1055f7f33179cb32c4341ae244f50c41a4a"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001a80)={0xffffffffffffffff, 0x0, 0x492, 0x0, &(0x7f0000000880)="82ade89121a5686134b670cf882eb96d071d854353d03beb6cfa58e26246dbab13a222d955274c2bd3f59613f13251d71e77e4fbbab1292bd7a25381dbba2962e1eaac8d00c78f7f5fe73e63d48493597cd2eecf21d0d49beac16df9a6fa1f342c200c114411e50b226fc7af47769f239273452ad69bce84461445ad16a6420cd8c100e08b746c74111bb058fe8421457ea1c7fdb49d6f183e67ea80b3eeebe8d297731a4a7c48abc39d856713a57fd88c9537c0a3599c122ecc2a5d9f395efa490e0437951a76638decb895c60c2a11a448d1e266ac9e45f5c1ddb877182cf4e5467cf39383ab7b641c4f335a1a80d6c2ec41c6b39841a98b70aab0c0e10c27e813cfc813305d31bef48ca2c9c64737fcd1e8b9e2df38e87296cd04508a1c9c86aef76b6514be23c6dcd85bfb48ae55233a3fa7218a77c1c759187d84348904a0de76499d5bf9b9ab6bcf55a6fda36c0a1adb323594780f1f25f76b39bbb5cc7d158985a65c5ec5750dfafb45cac42fb4d630459ae818875658d4817ceb4f9b491865ac0a8f543355b8828113d74b2353522a50eea2f0912a17188f04e3a1a24f6dcee87011a1b8e75442ae5029258b7bc42e7d9625a3724e397a96ddc21f90250662fc3ee2e836f305713bc8fd260ceeb2ca9f509cbec7d45f3fafb6d675178903b8bd3047407f3fbddc52d4af0aead35c527f6fc19b416afebc579372c3495cbfe9fb3a78ed27cb5154abd3523c10880a18b2eb1392c8015f20c7881dced81c01ca137f1d7d3dd45e4499913febdb29f038a7883094079503a26651293db6d4b4253bcb92d6b82c37ec1227b36b99746b000ecb965c578f2fb7719fed81b6a4f52262b5e37d0931c48e59a0f02c8554accff78cc4e1a2194549e5674023a792fab2dc593d0af2e57da500557281628d7c6a3cd53666f786d7933dab76b835d0e053f2e06e01d8d08eec9c225e5f74911e8e9fbd0cfc6325e1fa3cce855645978c094063a2471339fe80f035015593d64fdcfdcbc329fc7ba01c177dd4d5e70cce3e3e0cc4adda782d5ec4d0fb5417de87b7562c4986a869c071ca3ebc82a25deda7cfc71a8438c6d21262d76bfe59801de343984da6b95128f08e09ce9b4b14c0a033284ea07e81962544f29ac216a9ff6776b2c4123f1b8cd65cc5862431571d83bc530495b157c95dbce727ec2af79b67be7d741e4763ddf8cd1e4e9c7e683d7f316bfd5551e431f97eb8d6e9539f5dd7019a9d5513d7361418753c76da7dc012e3b6b08abe7a75419294219547e1d1a1d466d1fed24cfdfb2935df76214103c60798cfef1263562c3a3a4ee2c250ac138887597e20fec8f92657d82add891aa335fb1cd2717120dc400792b40a1bc8d2a3287c319d6b0e80fddb849c9eab3bfce68c20f67eb5fd222feec8f8283a371f2de0fd56d7f290bc62a8729ea384ad702868ce026efdab6ec1f46348fd668c6b3df46a8cd3714168ef24f7fb245fe21a212680839abfc21675ddc145db1a68b14c1a62bc98bef24352fcf7dfaa0cd070f78eaa83f27dee4500b01420f02eab704869e197a1366a9be998b888cc1f5a5f248981f06b44fec656b004f9819c86af06546971571f18db29721bcfa65760179fcab6679a144ab820c11cdc92bcd1", 0x0, 0x3ff, 0x0, 0x95, 0x11, &(0x7f0000001980)="100d3ed3c2e94a82021a46c55272ea983b8ad8479baba0a68e1ffcbdbcd2850bf14cd4076eb529edaf1633cbdc8f439a21d0e62552984f5c045cb4943f676a825ca5e30113becb3e4f47e3e2a3be3d94f0c13671f67d5a4957fbdcc0a2f3a9673d48fb69416edfad40a51db8d7098df20cb1fe3c5bd370514eff5b2e23e2b50697d01aea251ef1f4f36ba37a08fabb4eadbc8efc77", &(0x7f0000001a40)="b292847ba0b07610ad15deb2aaec03906f", 0x5, 0x0, 0x901}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000280), &(0x7f0000000340), 0x7ff, r4}, 0x38) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f0000000140)=@ccm_128={{0x304}, "acd83b4770ee7dda", "8ee02b02f429441cd7c74376c14f53b4", "1ba2da3b", "00dc78cded078889"}, 0x28) [ 93.798697][ T5284] Bluetooth: hci0: command tx timeout [ 93.929007][ T5331] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI [ 93.936799][ T5331] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] [ 93.941379][ T5331] CPU: 0 UID: 0 PID: 5331 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.945164][ T5331] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.949286][ T5331] RIP: 0010:configfs_depend_item_unlocked+0x96/0x420 [ 93.952325][ T5331] Code: df e8 0e 88 00 00 89 c5 31 ff 89 c6 e8 c3 31 4f ff 85 ed 74 0a e8 7a 2d 4f ff 4d 89 fd eb 6c 48 8d 7b 60 48 89 f8 48 c1 e8 03 <42> 80 3c 30 00 74 05 e8 ae 58 be ff 4c 8b 6b 60 48 89 df e8 d2 87 [ 93.962938][ T5331] RSP: 0018:ffffc9000f5c7ad8 EFLAGS: 00010206 [ 93.967532][ T5331] RAX: 000000000000000c RBX: 0000000000000000 RCX: 0000000000000002 [ 93.972088][ T5331] RDX: ffff88803466ca80 RSI: 0000000000000000 RDI: 0000000000000060 [ 93.977146][ T5331] RBP: 0000000000000000 R08: ffffffff9057b237 R09: 1ffffffff20af646 [ 93.981729][ T5331] R10: dffffc0000000000 R11: fffffbfff20af647 R12: ffffffff8f71cf60 [ 93.986314][ T5331] R13: dffffc0000000000 R14: dffffc0000000000 R15: ffff88803fa93c00 [ 93.990093][ T5331] FS: 00007f6b32a646c0(0000) GS:ffff88808c545000(0000) knlGS:0000000000000000 [ 93.994414][ T5331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 93.998005][ T5331] CR2: 00007f6b32a63fe8 CR3: 000000001fda9000 CR4: 0000000000352ef0 [ 94.003100][ T5331] Call Trace: [ 94.005324][ T5331] [ 94.007003][ T5331] usbg_make_tpg+0x1f6/0x590 [ 94.009835][ T5331] ? configfs_mkdir+0x4b0/0x9e0 [ 94.012709][ T5331] ? __pfx___mutex_lock+0x10/0x10 [ 94.015669][ T5331] ? __pfx_usbg_make_tpg+0x10/0x10 [ 94.018815][ T5331] ? do_raw_spin_lock+0x12b/0x2f0 [ 94.022249][ T5331] target_fabric_make_tpg+0xa8/0x6d0 [ 94.024936][ T5331] configfs_mkdir+0x4f6/0x9e0 [ 94.027057][ T5331] ? d_splice_alias+0x12/0x30 [ 94.029387][ T5331] ? __pfx_configfs_mkdir+0x10/0x10 [ 94.031763][ T5331] ? generic_permission+0x2bf/0x670 [ 94.034164][ T5331] ? bpf_lsm_inode_mkdir+0x9/0x20 [ 94.036742][ T5331] vfs_mkdir+0x406/0x620 [ 94.039166][ T5331] filename_mkdirat+0x285/0x510 [ 94.042026][ T5331] ? __pfx_filename_mkdirat+0x10/0x10 [ 94.045202][ T5331] ? do_getname+0x151/0x250 [ 94.047653][ T5331] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.050390][ T5331] __se_sys_mkdir+0x34/0x150 [ 94.052479][ T5331] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.055176][ T5331] do_syscall_64+0x174/0x580 [ 94.057273][ T5331] ? trace_irq_disable+0x3b/0x140 [ 94.059756][ T5331] ? clear_bhb_loop+0x40/0x90 [ 94.061866][ T5331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.064551][ T5331] RIP: 0033:0x7f6b31b9de99 [ 94.066615][ T5331] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.075189][ T5331] RSP: 002b:00007f6b32a63fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 94.078701][ T5331] RAX: ffffffffffffffda RBX: 00007f6b31e26180 RCX: 00007f6b31b9de99 [ 94.082051][ T5331] RDX: 0000000000000000 RSI: 00000000000001ff RDI: 0000200000000600 [ 94.085391][ T5331] RBP: 00007f6b31c33eaf R08: 0000000000000000 R09: 0000000000000000 [ 94.088757][ T5331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.092165][ T5331] R13: 00007f6b31e26218 R14: 00007f6b31e26180 R15: 00007fff61fc0928 [ 94.095534][ T5331] [ 94.096935][ T5331] Modules linked in: [ 94.100320][ T5331] ---[ end trace 0000000000000000 ]--- [ 94.174531][ T5331] RIP: 0010:configfs_depend_item_unlocked+0x96/0x420 [ 94.184215][ T5331] Code: df e8 0e 88 00 00 89 c5 31 ff 89 c6 e8 c3 31 4f ff 85 ed 74 0a e8 7a 2d 4f ff 4d 89 fd eb 6c 48 8d 7b 60 48 89 f8 48 c1 e8 03 <42> 80 3c 30 00 74 05 e8 ae 58 be ff 4c 8b 6b 60 48 89 df e8 d2 87 [ 94.196797][ T5331] RSP: 0018:ffffc9000f5c7ad8 EFLAGS: 00010206 [ 94.199569][ T5331] RAX: 000000000000000c RBX: 0000000000000000 RCX: 0000000000000002 [ 94.203003][ T5331] RDX: ffff88803466ca80 RSI: 0000000000000000 RDI: 0000000000000060 [ 94.206498][ T5331] RBP: 0000000000000000 R08: ffffffff9057b237 R09: 1ffffffff20af646 [ 94.210238][ T5331] R10: dffffc0000000000 R11: fffffbfff20af647 R12: ffffffff8f71cf60 [ 94.215358][ T5331] R13: dffffc0000000000 R14: dffffc0000000000 R15: ffff88803fa93c00 [ 94.218869][ T5331] FS: 00007f6b32a646c0(0000) GS:ffff88808c545000(0000) knlGS:0000000000000000 [ 94.224932][ T5331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.227667][ T5331] CR2: 00007f8c518c6d20 CR3: 000000001fda9000 CR4: 0000000000352ef0 [ 94.232448][ T5331] Kernel panic - not syncing: Fatal exception [ 94.235513][ T5331] Kernel Offset: disabled [ 94.237374][ T5331] Rebooting in 86400 seconds..