program: socket$nl_route(0x10, 0x3, 0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0)) r1 = socket$pptp(0x18, 0x1, 0x2) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/secure_tcp\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000080)=0x3, 0x12) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/sys/net/ipv4/vs/secure_tcp\x00', 0x2, 0x0) syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040c60511920000010203010902200001010080fa0904000002ffffff000705810200020007050202000200"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff) mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r4, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x145e81, 0x81) write(r5, &(0x7f0000000340)='dummy_hcd.0\x00', 0xb) close(r5) nanosleep(&(0x7f0000000400)={0x1}, 0x0) write$cgroup_int(r3, &(0x7f0000000200)=0x2, 0x12) bind$pptp(r1, &(0x7f0000000000)={0x18, 0x2, {0x0, @dev={0xac, 0x14, 0x14, 0x10}}}, 0x1e) connect$pptp(r1, &(0x7f0000000700)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x7f}, 0x90) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000280)=0x5010c02) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) syz_mount_image$minix(&(0x7f0000000180), &(0x7f0000000200)='./file0\x00', 0x10000, &(0x7f0000000ac0)=ANY=[@ANYRES8=0x0], 0x9, 0x168, &(0x7f0000000240)="$eJzs29tKOlEUx/HfqP9/ZudzdBUU1E2Op4Lu8lFEJ5PGkuxGCaJH6cl6Ab3oBZpolKnZBE2CDun3A7LXEhZr74vtLC9GAGbWhSRLltKSPM97vDq0tB/3pgBMhDdc3zwAsyfJ1QdmVL+c9J//LUkvrw/V3vCTjjg/9MsJf/34H9H7Uj8ftf7J8te9VLg+I2khyvzyPKg/Mvov/rJ/xqhfilw/OP/xQbh+WdKKpFVJa5LWJW1I2pS09U3/mtF/N2J/AAAAAACisJQ189AXCV02XCcX5P/8PB/k//28YOTFIJ/z82z11q2N6wgARpT44f4njfufMu4/gL+r3eleV1zXuSMgICAIgrh/mQCMm33fbNntTvek0azUnbpzUyidnpWK+fNcwfYnfzs8/wOYHp8P/bh3AgAAAAAAAAAAAAAARrUtaSfuTQAAAACYiEm8ThT3GQEAAAAAAAAAAAAAmHbvAQAA///oFUsF") mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r7, 0x3b87, &(0x7f0000000000)={0x18, 0x1, 0xefc63feaba44c278, 0x0, r8}) ioctl$EVIOCGPROP(r6, 0x40047438, &(0x7f0000000180)=""/246) ioctl$PPPIOCSFLAGS1(r6, 0x4004743a, &(0x7f0000000300)) [ 92.705318][ T5291] Bluetooth: hci0: command tx timeout [ 92.745590][ T1406] cfg80211: failed to load regulatory.db [ 93.123561][ T5315] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 93.278698][ T5315] usb 5-1: New USB device found, idVendor=05c6, idProduct=9211, bcdDevice= 0.00 [ 93.282354][ T5315] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 93.285805][ T5315] usb 5-1: Product: syz [ 93.287731][ T5315] usb 5-1: Manufacturer: syz [ 93.289624][ T5315] usb 5-1: SerialNumber: syz [ 93.306549][ T5315] qcserial 5-1:1.0: Qualcomm USB modem converter detected [ 93.318883][ T5315] usb 5-1: Qualcomm USB modem converter now attached to ttyUSB0 [ 93.507017][ T5330] dummy_hcd dummy_hcd.0: remove, state 1 [ 93.511493][ T5330] usb usb5: USB disconnect, device number 1 [ 93.514954][ T5330] usb 5-1: USB disconnect, device number 2 [ 93.530096][ T5330] qcserial ttyUSB0: Qualcomm USB modem converter now disconnected from ttyUSB0 [ 93.550746][ T5330] qcserial 5-1:1.0: device disconnected [ 93.607720][ T5330] dummy_hcd dummy_hcd.0: stopped [ 93.615163][ T5330] dummy_hcd dummy_hcd.0: USB bus 5 deregistered [ 93.640057][ T5336] loop0: detected capacity change from 0 to 64 [ 94.562500][ T5329] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI [ 94.567319][ T5329] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 94.570926][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.574688][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.578833][ T5329] RIP: 0010:set_link_state+0x27/0x1000 [ 94.581188][ T5329] Code: 90 90 90 55 41 57 41 56 41 55 41 54 53 48 83 ec 38 49 89 fe 48 bb 00 00 00 00 00 fc ff df e8 50 b1 0e fa 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 db e3 7d fa 49 8b 16 4d 8d a6 a3 00 [ 94.589002][ T5329] RSP: 0018:ffffc9000de97b20 EFLAGS: 00010046 [ 94.591458][ T5329] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff888030e9a540 [ 94.594678][ T5329] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 94.597737][ T5329] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004 [ 94.600908][ T5329] R10: dffffc0000000000 R11: fffff52001bd2f60 R12: 0000000000000246 [ 94.603940][ T5329] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 [ 94.607017][ T5329] FS: 0000555579b08540(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 94.610769][ T5329] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.613444][ T5329] CR2: 00007f43f9598000 CR3: 0000000043eb4000 CR4: 0000000000352ef0 [ 94.616672][ T5329] Call Trace: [ 94.618159][ T5329] [ 94.619442][ T5329] ? rcu_is_watching+0x15/0xb0 [ 94.621502][ T5329] ? __pfx_dummy_pullup+0x10/0x10 [ 94.623672][ T5329] dummy_pullup+0xc4/0x120 [ 94.625609][ T5329] ? __pfx_dummy_pullup+0x10/0x10 [ 94.627805][ T5329] usb_gadget_disconnect_locked+0x126/0x480 [ 94.630326][ T5329] gadget_unbind_driver+0xc2/0x410 [ 94.632416][ T5329] ? __pfx_gadget_unbind_driver+0x10/0x10 [ 94.634843][ T5329] device_release_driver_internal+0x48b/0x880 [ 94.637371][ T5329] driver_detach+0x1f3/0x2d0 [ 94.639321][ T5329] bus_remove_driver+0x226/0x320 [ 94.641370][ T5329] usb_gadget_unregister_driver+0x4e/0x70 [ 94.644406][ T5329] raw_release+0xd7/0x260 [ 94.646174][ T5329] ? __pfx_raw_release+0x10/0x10 [ 94.648164][ T5329] __fput+0x418/0xa50 [ 94.649785][ T5329] task_work_run+0x1d9/0x270 [ 94.651457][ T5329] ? __pfx_task_work_run+0x10/0x10 [ 94.653270][ T5329] exit_to_user_mode_loop+0x1fa/0x730 [ 94.655194][ T5329] ? rcu_is_watching+0x15/0xb0 [ 94.657062][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.659410][ T5329] do_syscall_64+0x353/0x580 [ 94.661156][ T5329] ? clear_bhb_loop+0x40/0x90 [ 94.663019][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.665288][ T5329] RIP: 0033:0x7fe05599e019 [ 94.667112][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.674789][ T5329] RSP: 002b:00007ffdec4713c8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 94.678192][ T5329] RAX: 0000000000000000 RBX: 00007fe055c27da0 RCX: 00007fe05599e019 [ 94.681430][ T5329] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 94.684465][ T5329] RBP: 00007fe055c27da0 R08: 00007fe055c26128 R09: 0000000000000000 [ 94.687705][ T5329] R10: 0000000000ddca00 R11: 0000000000000246 R12: 0000000000017911 [ 94.690959][ T5329] R13: 00007fe055c25fac R14: 0000000000016d8b R15: 00007fe055c25fa0 [ 94.694148][ T5329] [ 94.695477][ T5329] Modules linked in: [ 94.697138][ T5329] ---[ end trace 0000000000000000 ]--- [ 94.699454][ T5329] RIP: 0010:set_link_state+0x27/0x1000 [ 94.701750][ T5329] Code: 90 90 90 55 41 57 41 56 41 55 41 54 53 48 83 ec 38 49 89 fe 48 bb 00 00 00 00 00 fc ff df e8 50 b1 0e fa 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 db e3 7d fa 49 8b 16 4d 8d a6 a3 00 [ 94.709795][ T5329] RSP: 0018:ffffc9000de97b20 EFLAGS: 00010046 [ 94.712434][ T5329] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff888030e9a540 [ 94.715720][ T5329] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 94.718906][ T5329] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004 [ 94.722147][ T5329] R10: dffffc0000000000 R11: fffff52001bd2f60 R12: 0000000000000246 [ 94.725288][ T5329] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 [ 94.728533][ T5329] FS: 0000555579b08540(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 94.732282][ T5329] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.735010][ T5329] CR2: 00007f43f9598000 CR3: 0000000043eb4000 CR4: 0000000000352ef0 [ 94.738176][ T5329] Kernel panic - not syncing: Fatal exception [ 94.740757][ T5329] Kernel Offset: disabled [ 94.742515][ T5329] Rebooting in 86400 seconds..