program: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a01010000000000000000010000020900010073797a3100000000080002400000000248000000030a010400000000000000000100ffff0900030073797a310000000014000480080002400000000008000140000000030900010073797a3100000000080007006e61740014000000110001"], 0x98}, 0x1, 0x0, 0x0, 0x2000c091}, 0x800) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7ffffffd}]}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r3 = io_uring_setup(0xa75, &(0x7f0000000040)={0x0, 0x9800, 0xc000, 0x0, 0x10000c1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x0, 0xbf22, 0x312, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x4}, 0x50) io_uring_enter(r3, 0x2219, 0x7721, 0x16, 0x0, 0x0) r4 = dup2(r0, r2) r5 = socket$netlink(0x10, 0x3, 0x0) syz_usb_connect(0x5, 0x4e, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040cd06350100010000000109023c0001010080320904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x0, 0x0) ioctl$TCSBRKP(r6, 0x5425, 0x7) r7 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) ioctl$sock_SIOCBRDELBR(r5, 0x89a2, &(0x7f0000000000)='bridge0\x00') r8 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000007c0)={0x44, 0x16, 0x1, 0x0, 0x0, {0xa}, [@typed={0x4}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@mcast1}, @nested={0x18, 0x2, 0x0, 0x1, [@nested={0x12, 0x97, 0x0, 0x1, [@typed={0x8, 0x47, 0x0, 0x0, @ipv4=@loopback}, @generic="dc3b0fe26e94"]}]}]}, 0x44}}, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) [ 94.289332][ T4644] Bluetooth: hci0: command tx timeout [ 94.659152][ T5315] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 94.807601][ T5315] usb 5-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 94.809336][ T5315] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 94.809370][ T5315] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 94.848512][ T5315] keyspan 5-1:1.0: Keyspan 2 port adapter converter detected [ 94.848690][ T5315] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 81 [ 94.848733][ T5315] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 1 [ 94.877600][ T5315] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 84 [ 94.877678][ T5315] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 2 [ 94.885602][ T5315] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 94.910082][ T5315] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 88 [ 94.910145][ T5315] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 6 [ 94.914097][ T5315] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 95.109032][ T5315] usb 5-1: USB disconnect, device number 2 [ 95.364996][ T5315] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 95.401598][ T5315] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 95.401911][ T5315] keyspan 5-1:1.0: device disconnected [ 95.840031][ T5317] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000013: 0000 [#1] SMP KASAN NOPTI [ 95.846121][ T5317] KASAN: null-ptr-deref in range [0x0000000000000098-0x000000000000009f] [ 95.849954][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.853909][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.858474][ T5317] RIP: 0010:keyspan_break_ctl+0x83/0xc0 [ 95.861113][ T5317] Code: f3 28 8b fa 41 be 9c 00 00 00 4d 03 37 bf ff ff ff ff 89 ee e8 6e 8f 19 fa 45 31 ff 83 fd ff 41 0f 94 c7 4c 89 f0 48 c1 e8 03 <42> 0f b6 04 20 84 c0 75 1d 45 89 3e 48 89 df 31 f6 e8 57 c3 00 00 [ 95.869623][ T5317] RSP: 0018:ffffc9000f01fe08 EFLAGS: 00010203 [ 95.872411][ T5317] RAX: 0000000000000013 RBX: ffff888035768000 RCX: ffff888039174b00 [ 95.875792][ T5317] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 00000000ffffffff [ 95.879455][ T5317] RBP: 0000000000000000 R08: ffffffff907a507f R09: 1ffffffff20f4a0f [ 95.882850][ T5317] R10: dffffc0000000000 R11: ffffffff87ae50c0 R12: dffffc0000000000 [ 95.886537][ T5317] R13: dffffc0000000000 R14: 000000000000009c R15: 0000000000000000 [ 95.890175][ T5317] FS: 00007f6ed22db6c0(0000) GS:ffff88808c2c7000(0000) knlGS:0000000000000000 [ 95.894106][ T5317] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.896987][ T5317] CR2: 00005599a5cb5b48 CR3: 000000000bf3a000 CR4: 0000000000352ef0 [ 95.900502][ T5317] Call Trace: [ 95.902072][ T5317] [ 95.903429][ T5317] send_break+0x222/0x300 [ 95.905447][ T5317] tty_ioctl+0xd0f/0xdd0 [ 95.907384][ T5317] ? __pfx_tty_ioctl+0x10/0x10 [ 95.909552][ T5317] __se_sys_ioctl+0xfc/0x170 [ 95.911936][ T5317] do_syscall_64+0x166/0x520 [ 95.914144][ T5317] ? trace_irq_disable+0x3b/0x140 [ 95.916350][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.918740][ T5317] ? clear_bhb_loop+0x70/0xc0 [ 95.920724][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.923181][ T5317] RIP: 0033:0x7f6ed139e159 [ 95.925075][ T5317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.933422][ T5317] RSP: 002b:00007f6ed22dafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 95.937010][ T5317] RAX: ffffffffffffffda RBX: 00007f6ed1625fa0 RCX: 00007f6ed139e159 [ 95.940483][ T5317] RDX: 0000000000000007 RSI: 0000000000005425 RDI: 0000000000000008 [ 95.944926][ T5317] RBP: 00007f6ed143503b R08: 0000000000000000 R09: 0000000000000000 [ 95.948307][ T5317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.951814][ T5317] R13: 00007f6ed1626038 R14: 00007f6ed1625fa0 R15: 00007ffdeaf666d8 [ 95.955317][ T5317] [ 95.956707][ T5317] Modules linked in: [ 95.959755][ T5317] ---[ end trace 0000000000000000 ]--- [ 95.970920][ T5317] RIP: 0010:keyspan_break_ctl+0x83/0xc0 [ 95.970951][ T5317] Code: f3 28 8b fa 41 be 9c 00 00 00 4d 03 37 bf ff ff ff ff 89 ee e8 6e 8f 19 fa 45 31 ff 83 fd ff 41 0f 94 c7 4c 89 f0 48 c1 e8 03 <42> 0f b6 04 20 84 c0 75 1d 45 89 3e 48 89 df 31 f6 e8 57 c3 00 00 [ 95.971014][ T5317] RSP: 0018:ffffc9000f01fe08 EFLAGS: 00010203 [ 95.971033][ T5317] RAX: 0000000000000013 RBX: ffff888035768000 RCX: ffff888039174b00 [ 95.971040][ T5317] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 00000000ffffffff [ 95.971047][ T5317] RBP: 0000000000000000 R08: ffffffff907a507f R09: 1ffffffff20f4a0f [ 95.971055][ T5317] R10: dffffc0000000000 R11: ffffffff87ae50c0 R12: dffffc0000000000 [ 95.971063][ T5317] R13: dffffc0000000000 R14: 000000000000009c R15: 0000000000000000 [ 95.971070][ T5317] FS: 00007f6ed22db6c0(0000) GS:ffff88808c2c7000(0000) knlGS:0000000000000000 [ 95.971086][ T5317] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.971094][ T5317] CR2: 000055998f51a660 CR3: 000000000bf3a000 CR4: 0000000000352ef0 [ 95.971133][ T5317] Kernel panic - not syncing: Fatal exception [ 96.014693][ T5317] Kernel Offset: disabled [ 96.016641][ T5317] Rebooting in 86400 seconds..