program: ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x4c, 0x0, 0x20, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r0}, @val={0xc, 0x99, {0x2, 0x67}}}}, [@NL80211_ATTR_CSA_C_OFFSETS_TX={0xe, 0xcd, [0x5, 0x4, 0x9, 0xb611, 0xffc0]}, @NL80211_ATTR_CSA_C_OFFSETS_TX={0xc, 0xcd, [0x6, 0xf, 0x40, 0x2]}, @NL80211_ATTR_DURATION={0x8, 0x57, 0xe30}]}, 0x4c}, 0x1, 0x0, 0x0, 0x800}, 0x4004000) r1 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r2, 0x0) writev(r1, &(0x7f0000000100)=[{&(0x7f0000000180)="a1", 0x1}], 0x1) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x55, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$char_usb(r1, &(0x7f00000001c0)="64e9", 0x2) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r3, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f0000000740)=[0x2], 0x0, 0x0, 0x1}}, 0x40) r4 = creat(&(0x7f0000000280)='./file0\x00', 0x0) write$char_usb(r4, &(0x7f0000000f80)="ce56e8", 0x3) write$snapshot(r1, &(0x7f0000000040)="5dc27d74", 0x4) r5 = syz_clone(0x1000011, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x4207, r5) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ff5000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r6 = io_uring_setup(0x520, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, 0x94) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000780)={0x0, 0x1, 0x1, [0x806f, 0x0, 0x2d5, 0x2, 0x6], [0x9d8, 0x5, 0x1, 0x9, 0x8002, 0x0, 0x5, 0xfffffffffffffffe, 0x448, 0x802, 0x6, 0x200000100, 0x3, 0xfffffffffffffff4, 0x4a, 0x5, 0x100, 0xd, 0xdd, 0x5, 0x1, 0x2a9, 0x3, 0xc3c, 0x3, 0x8, 0x100000000, 0x2, 0xa51, 0x8, 0x401, 0x800000000000003, 0x7, 0xfffffffffffffffa, 0x81, 0x100, 0x5, 0x931, 0x4, 0x3, 0x8001, 0x8000000000000000, 0x7, 0x1, 0x8, 0x8, 0x6aa, 0x102, 0x1, 0x83, 0x538a, 0x9, 0xfffffffffffffffb, 0x4, 0x0, 0x8000000000004, 0x200, 0x8, 0x8000, 0x8000000000000000, 0x4, 0xfffffffffffffffc, 0x14, 0x5bc, 0x1, 0x80000001, 0x4, 0x8000, 0xc9, 0x7, 0xa, 0x9, 0x82c, 0x7ff, 0xe000000000000, 0xe4, 0xf, 0x0, 0x8, 0x22, 0xffffffffffffffff, 0x7, 0x1, 0x8000000000000000, 0x2000000009, 0x7, 0x0, 0x6, 0x6, 0xb, 0x100000002, 0x4, 0x4, 0x7, 0x5, 0x7, 0x8, 0x1, 0x16d, 0x6, 0x68d, 0xffffffffffff43b0, 0x8, 0x50000000000000, 0xe, 0x0, 0x0, 0x7, 0x2, 0x7, 0x406, 0x3, 0x6, 0x2, 0x0, 0x3, 0x40, 0x7fffffff, 0x7, 0xe, 0x4]}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x18000000000002a0, 0x33, 0x3d, 0x0, 0x0, 0x500, 0x60000000, 0x0, 0x1e, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xfffffffffffffdce) io_uring_enter(r6, 0x2219, 0x7721, 0x16, 0x0, 0x0) syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000440)=ANY=[], 0x0) r7 = syz_open_dev$usbfs(&(0x7f0000000180), 0x10000001d, 0x8041) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x8480, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(r9, 0x4068aea3, &(0x7f0000000040)={0xc0, 0x0, 0x1000000}) ioctl$USBDEVFS_SETCONFIGURATION(r7, 0x4004550c, 0x0) r10 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x4, &(0x7f0000000440)=[{0x206, 0x0, 0x0, 0x7fff0000}, {0x1000, 0x0, 0x7, 0x81}, {0x0, 0x7, 0x80, 0x4}, {0x1, 0x6c, 0x3, 0xfff}]}) close_range(r10, 0xffffffffffffffff, 0x0) [ 111.272909][ T4655] Bluetooth: hci0: command tx timeout [ 111.642853][ T5337] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000011: 0000 [#1] SMP KASAN NOPTI [ 111.648639][ T5337] KASAN: null-ptr-deref in range [0x0000000000000088-0x000000000000008f] [ 111.652153][ T5337] CPU: 0 UID: 0 PID: 5337 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 111.655912][ T5337] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 111.661023][ T5337] RIP: 0010:mas_start+0xfe/0x550 [ 111.663265][ T5337] Code: 4c 02 00 00 c6 43 4c 00 48 8b 44 24 28 42 80 3c 30 00 74 08 48 89 df e8 70 61 87 f6 4c 8b 23 49 83 c4 48 4c 89 e0 48 c1 e8 03 <42> 80 3c 30 00 74 08 4c 89 e7 e8 53 61 87 f6 4d 8b 24 24 e8 aa 9b [ 111.671012][ T5337] RSP: 0018:ffffc9000febf898 EFLAGS: 00010206 [ 111.673972][ T5337] RAX: 0000000000000011 RBX: ffffc9000febf960 RCX: 1ffff92001fd7f35 [ 111.677844][ T5337] RDX: 1ffff92001fd7f2c RSI: 0000000000000001 RDI: ffffc9000febf988 [ 111.681003][ T5337] RBP: 0000000000000001 R08: ffffffff8baf8bfa R09: 0000000000000000 [ 111.684260][ T5337] R10: 0000000000000000 R11: ffffffff8e959c20 R12: 0000000000000088 [ 111.687771][ T5337] R13: ffffc9000febf960 R14: dffffc0000000000 R15: 1ffff92001fd7f35 [ 111.691741][ T5337] FS: 0000000000000000(0000) GS:ffff88808c815000(0000) knlGS:0000000000000000 [ 111.695324][ T5337] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 111.697859][ T5337] CR2: 00007f3eac618ff8 CR3: 0000000012a2c000 CR4: 0000000000352ef0 [ 111.700983][ T5337] Call Trace: [ 111.702521][ T5337] [ 111.704013][ T5337] mtree_load+0x1f5/0x780 [ 111.706245][ T5337] ? mtree_load+0x12a/0x780 [ 111.708351][ T5337] ? copy_from_vaddr+0x123/0x300 [ 111.710543][ T5337] ? __pfx_mtree_load+0x10/0x10 [ 111.712560][ T5337] ? rcu_is_watching+0x15/0xb0 [ 111.714534][ T5337] ? __up_read+0x29c/0x930 [ 111.716439][ T5337] set_orig_insn+0x226/0x310 [ 111.718458][ T5337] ? __pfx_set_orig_insn+0x10/0x10 [ 111.720908][ T5337] register_for_each_vma+0xa0e/0xb80 [ 111.723534][ T5337] uprobe_unregister_nosync+0x118/0x1b0 [ 111.726073][ T5337] bpf_uprobe_multi_link_release+0x99/0x1a0 [ 111.728564][ T5337] bpf_link_free+0xdd/0x3e0 [ 111.730637][ T5337] ? __pfx_bpf_link_release+0x10/0x10 [ 111.733253][ T5337] bpf_link_release+0x6b/0x80 [ 111.735815][ T5337] __fput+0x418/0xa50 [ 111.737815][ T5337] task_work_run+0x1d9/0x270 [ 111.739835][ T5337] ? __pfx_task_work_run+0x10/0x10 [ 111.741945][ T5337] ? do_raw_spin_unlock+0x4d/0x210 [ 111.744191][ T5337] do_exit+0x73a/0x2360 [ 111.746109][ T5337] ? __pfx_do_exit+0x10/0x10 [ 111.748363][ T5337] ? rcu_is_watching+0x15/0xb0 [ 111.750769][ T5337] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.753445][ T5337] __x64_sys_exit+0x40/0x40 [ 111.755364][ T5337] x64_sys_call+0x2231/0x2240 [ 111.757339][ T5337] do_syscall_64+0x174/0x580 [ 111.759331][ T5337] ? trace_irq_disable+0x3b/0x140 [ 111.761817][ T5337] ? clear_bhb_loop+0x40/0x90 [ 111.764608][ T5337] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.767321][ T5337] RIP: 0033:0x7f3eab79ce59 [ 111.769092][ T5337] Code: Unable to access opcode bytes at 0x7f3eab79ce2f. [ 111.772087][ T5337] RSP: 002b:00007f3eac639f98 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 111.775810][ T5337] RAX: ffffffffffffffda RBX: 00007f3eaba15fa0 RCX: 00007f3eab79ce59 [ 111.780012][ T5337] RDX: 00007f3eac63a9c8 RSI: 0000000000000000 RDI: 0000000000000000 [ 111.783503][ T5337] RBP: 00007f3eab832e6f R08: 0000000000000000 R09: 0000000000000000 [ 111.787098][ T5337] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 111.790967][ T5337] R13: 00007f3eaba16038 R14: 00007f3eaba15fa0 R15: 00007ffdbffe8758 [ 111.794456][ T5337] [ 111.795807][ T5337] Modules linked in: [ 111.798638][ T5337] ---[ end trace 0000000000000000 ]--- [ 111.807656][ T5331] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 111.812898][ T5337] RIP: 0010:mas_start+0xfe/0x550 [ 111.814995][ T5337] Code: 4c 02 00 00 c6 43 4c 00 48 8b 44 24 28 42 80 3c 30 00 74 08 48 89 df e8 70 61 87 f6 4c 8b 23 49 83 c4 48 4c 89 e0 48 c1 e8 03 <42> 80 3c 30 00 74 08 4c 89 e7 e8 53 61 87 f6 4d 8b 24 24 e8 aa 9b [ 111.824720][ T5337] RSP: 0018:ffffc9000febf898 EFLAGS: 00010206 [ 111.828128][ T5337] RAX: 0000000000000011 RBX: ffffc9000febf960 RCX: 1ffff92001fd7f35 [ 111.831690][ T5337] RDX: 1ffff92001fd7f2c RSI: 0000000000000001 RDI: ffffc9000febf988 [ 111.835219][ T5337] RBP: 0000000000000001 R08: ffffffff8baf8bfa R09: 0000000000000000 [ 111.839383][ T5337] R10: 0000000000000000 R11: ffffffff8e959c20 R12: 0000000000000088 [ 111.843734][ T5337] R13: ffffc9000febf960 R14: dffffc0000000000 R15: 1ffff92001fd7f35 [ 111.847704][ T5337] FS: 0000000000000000(0000) GS:ffff88808c815000(0000) knlGS:0000000000000000 [ 111.851485][ T5337] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 111.854437][ T5337] CR2: 00007f3eac618ff8 CR3: 000000004ffe5000 CR4: 0000000000352ef0 [ 111.859128][ T5337] Kernel panic - not syncing: Fatal exception [ 111.862345][ T5337] Kernel Offset: disabled [ 111.864193][ T5337] Rebooting in 86400 seconds..