program: r0 = syz_usb_connect$uac2(0x0, 0x7b, &(0x7f0000000780)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x8, 0x582, 0x8b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x0, 0x50, 0x7, {0x8, 0xb, 0x1, 0x1, 0x1, 0xff, 0x20, 0x9}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x9, 0xf1, 0x9, 0x2}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x9, 0x9, 0x7, {0x8, 0x25, 0x1, 0x1, 0x0, 0x6, 0xd}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x5, 0x6, 0xfc, {0x8, 0x25, 0x1, 0x81, 0x0, 0x0, 0x7}}}}}}}}]}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) syz_mount_image$udf(&(0x7f0000000480), &(0x7f00000004c0)='./file0\x00', 0x0, &(0x7f0000000180)=ANY=[@ANYRESDEC], 0x1, 0x46f, &(0x7f0000000540)="$eJzs299PW2Ucx/HPc2i7M0a0MIZuWUwTE0cwAgUZbKgJDjHGDeZY8cYsYVCwrlBCwcCyKLf7A3alN14sMV4si//DovEP0LhkXuj0xpvezSs153BOz2npBlra0u39SqCnp9+e85znx3m+T9MKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABIb78z1p80jS4FAACop8npS/0DzP8AADxTLrP+BwAAeJYYWfpNRu/PFMwF9/k2+3xmeX0jNT5R+W2HjfvOFjfe+bOTA4OvD50eHvEfn/z+/XZcU9OXxxLncksrq+l8Pj2fSC1n5nLz6T0fodr3l+txKyCxdG19fmEhnxjoHSx5eSP+x6EjXfHR0zOppB+bGp+YmA7FRKL/++w7PC7Dj8nSmzLqs++YSUmWqq+LXfpOrR12L6LHvYjU+IR7IdnM7PKa86LxK8IqrZOYX0d1aIuqWJJTLhPbnzVbVJZekdEPnQUzJanFr4dX3Q+G91SeRog4S1dJ3WqCNjvADsnSFRnd64vrolevbvvHpBuNLhxqLiJLd2R06q2C+cC9Hzjjybltnp9JvLe8kAvFGuONqGafH+rpgN+bbFmadEd8wVxqdGFQd06ylJZRavRTN6+Qm5c+Pzp8oufDcIbxwi7HcWJ7vcG1lzk5GkodTINyCEi2sfRQRo9+tt3n3f4cIG3909iioR6Mpfsyyq0X3KVReF3aElrfFzX73F/b8h+2z+VWNlczix+vVXy91R67ml9bnZ2r/PL22rXkdrjbOrZKUWPpCxl99e7XxfN6a4BIeeztN4Ky2d75i8Vw+81z259n+HPI8YHO8HbFIv+H/Mj2zttS3SUjxHj3/4UrL3pr/1bt6INe3DEZfXTrpBdnxZwgv5PE3f/2Qiab7ndi/5ZRx/d+rPsxk3Nk19EgNunErsro5r3S2CNebGcQO+DE/iSjBz9Wjj0WxA46sRsyyj9I+LGtTuxLXmxXENs7l8vO16yCDzhn/H8no0/6EsZvy9LxH4y22zeC8b5VfqDHjPlqx388tG/L64e/e/01skt/vSmjzT9P+tfj9hX/ttLu/g/6a1ZG394qjfUXih1BbHLPFdsknPaPyKh96G6xbrw68J4GrRZu/xPlvaNG7d8e2hf3zhvbn0uHpPzm9Wuz2Wx6lQ022GCjuNHoOxPqwZn//5LRrz33i/mON/+3bT8L8r9HnwXz/9nyA9Vo/u8I7TvrZSPRiGSvLa1EuyQ7v3n9tczS7GJ6Mb08PDhyZmjwTHIkGvNzu2Cr6qp6KjntPyuj1NQ3xfVZaf5XOf9vLT9Qjdr/aGhfa0m+UvWlw2v/hIw2Ht4trqOflP/766zul7cfi+OzRu3fGdoX987btj+XDgAAAAAAAAAAAAAAAABNLWos/SKji1cjxv9t1F6+/7fjB1M1+v5XV2jffJ1+r1B1pQIAAAAAAAAAADSQJUtfyuiUCuZzZ0ebdCH8iKfavwEAAP//M8EfQQ==") r2 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x50, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0x50}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000ec0)={0x58, 0xb, 0x6, 0x201, 0x0, 0x0, {0x5, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x30, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @mcast2}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e24}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x4800) r5 = fanotify_init(0x200, 0x0) fanotify_mark(r5, 0x1, 0x4800003e, r2, 0x0) write(r1, &(0x7f0000000200)='dummy_hcd.0', 0xb) syz_usb_control_io$uac2(r0, 0x0, 0x0) r6 = syz_open_dev$usbfs(&(0x7f0000000180), 0x10000001d, 0x8041) ioctl$USBDEVFS_SETCONFIGURATION(r6, 0x80045505, &(0x7f0000000140)=0x1) [ 86.760721][ T5287] Bluetooth: hci0: command tx timeout [ 87.079037][ T111] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 87.229155][ T111] usb 5-1: Using ep0 maxpacket: 8 [ 87.237895][ T111] usb 5-1: New USB device found, idVendor=0582, idProduct=008b, bcdDevice= 0.40 [ 87.242959][ T111] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 87.248690][ T111] usb 5-1: Product: syz [ 87.254155][ T111] usb 5-1: Manufacturer: syz [ 87.256143][ T111] usb 5-1: SerialNumber: syz [ 87.277141][ T111] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 87.282727][ T111] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 87.491092][ T5323] loop0: detected capacity change from 0 to 128 [ 87.499582][ T5323] udf: Unknown parameter '18446744073709551615' [ 87.527418][ T5323] dummy_hcd dummy_hcd.0: remove, state 1 [ 87.541572][ T5323] usb usb5: USB disconnect, device number 1 [ 87.544426][ T5323] usb 5-1: USB disconnect, device number 2 [ 87.671883][ T5323] dummy_hcd dummy_hcd.0: stopped [ 87.676731][ T5323] dummy_hcd dummy_hcd.0: USB bus 5 deregistered [ 88.840401][ T5287] Bluetooth: hci0: command tx timeout [ 89.885966][ T5323] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI [ 89.891552][ T5323] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 89.894952][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 89.898607][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 89.902958][ T5323] RIP: 0010:set_link_state+0x27/0x1000 [ 89.905727][ T5323] Code: 90 90 90 55 41 57 41 56 41 55 41 54 53 48 83 ec 38 49 89 fe 48 bb 00 00 00 00 00 fc ff df e8 10 ae 0e fa 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 9b e0 7d fa 49 8b 16 4d 8d a6 a3 00 [ 89.914566][ T5323] RSP: 0018:ffffc9000f9b7780 EFLAGS: 00010046 [ 89.917272][ T5323] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff8880007aca80 [ 89.920726][ T5323] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 89.924112][ T5323] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004 [ 89.927412][ T5323] R10: dffffc0000000000 R11: fffff52001f36eec R12: 0000000000000246 [ 89.930811][ T5323] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 [ 89.934213][ T5323] FS: 0000000000000000(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 89.938007][ T5323] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 89.940846][ T5323] CR2: 000055d2edfb4168 CR3: 00000000514a4000 CR4: 0000000000352ef0 [ 89.944365][ T5323] Call Trace: [ 89.945723][ T5323] [ 89.947051][ T5323] ? rcu_is_watching+0x15/0xb0 [ 89.949136][ T5323] ? __pfx_dummy_pullup+0x10/0x10 [ 89.951274][ T5323] dummy_pullup+0xc4/0x120 [ 89.953276][ T5323] ? __pfx_dummy_pullup+0x10/0x10 [ 89.955495][ T5323] usb_gadget_disconnect_locked+0x126/0x480 [ 89.958060][ T5323] gadget_unbind_driver+0xc2/0x410 [ 89.960225][ T5323] ? __pfx_gadget_unbind_driver+0x10/0x10 [ 89.962764][ T5323] device_release_driver_internal+0x48b/0x880 [ 89.965388][ T5323] driver_detach+0x1f3/0x2d0 [ 89.967391][ T5323] bus_remove_driver+0x226/0x320 [ 89.969523][ T5323] usb_gadget_unregister_driver+0x4e/0x70 [ 89.971916][ T5323] raw_release+0xd7/0x260 [ 89.973821][ T5323] ? __pfx_raw_release+0x10/0x10 [ 89.975958][ T5323] __fput+0x418/0xa50 [ 89.977709][ T5323] task_work_run+0x1d9/0x270 [ 89.979750][ T5323] ? __pfx_task_work_run+0x10/0x10 [ 89.981902][ T5323] ? do_raw_spin_unlock+0x4d/0x210 [ 89.984132][ T5323] do_exit+0x73a/0x2360 [ 89.985898][ T5323] ? __pfx_do_exit+0x10/0x10 [ 89.987820][ T5323] ? do_raw_spin_lock+0x12b/0x2f0 [ 89.990016][ T5323] do_group_exit+0x22d/0x2f0 [ 89.992029][ T5323] ? _raw_spin_unlock_irq+0x23/0x50 [ 89.994266][ T5323] get_signal+0x121b/0x12c0 [ 89.996156][ T5323] arch_do_signal_or_restart+0xbb/0x860 [ 89.999214][ T5323] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 90.001959][ T5323] exit_to_user_mode_loop+0x104/0x730 [ 90.004224][ T5323] ? rcu_is_watching+0x15/0xb0 [ 90.006307][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.008839][ T5323] do_syscall_64+0x353/0x580 [ 90.010810][ T5323] ? trace_irq_disable+0x3b/0x140 [ 90.012908][ T5323] ? clear_bhb_loop+0x40/0x90 [ 90.014783][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.017241][ T5323] RIP: 0033:0x7f17f5f9e019 [ 90.019180][ T5323] Code: Unable to access opcode bytes at 0x7f17f5f9dfef. [ 90.021969][ T5323] RSP: 002b:00007f17f6df00a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 90.025310][ T5323] RAX: fffffffffffffe00 RBX: 00007f17f6225fa8 RCX: 00007f17f5f9e019 [ 90.028575][ T5323] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f17f6225fa8 [ 90.031771][ T5323] RBP: 00007f17f6225fa0 R08: 0000000000000000 R09: 0000000000000000 [ 90.035510][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 90.039596][ T5323] R13: 00007f17f6226038 R14: 00007ffec5b3ac30 R15: 00007ffec5b3ad18 [ 90.043785][ T5323] [ 90.045427][ T5323] Modules linked in: [ 90.047586][ T5323] ---[ end trace 0000000000000000 ]--- [ 90.050247][ T5323] RIP: 0010:set_link_state+0x27/0x1000 [ 90.052628][ T5323] Code: 90 90 90 55 41 57 41 56 41 55 41 54 53 48 83 ec 38 49 89 fe 48 bb 00 00 00 00 00 fc ff df e8 10 ae 0e fa 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 9b e0 7d fa 49 8b 16 4d 8d a6 a3 00 [ 90.062242][ T5323] RSP: 0018:ffffc9000f9b7780 EFLAGS: 00010046 [ 90.064803][ T5323] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff8880007aca80 [ 90.068359][ T5323] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 90.071861][ T5323] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004 [ 90.075533][ T5323] R10: dffffc0000000000 R11: fffff52001f36eec R12: 0000000000000246 [ 90.078978][ T5323] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 [ 90.082479][ T5323] FS: 0000000000000000(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 90.086088][ T5323] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 90.088989][ T5323] CR2: 000055d2edfb4168 CR3: 00000000514a4000 CR4: 0000000000352ef0 [ 90.092513][ T5323] Kernel panic - not syncing: Fatal exception [ 90.095694][ T5323] Kernel Offset: disabled [ 90.097856][ T5323] Rebooting in 86400 seconds..