program: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000200), 0x200, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000003280)={0x73622a85, 0x100b, 0x4}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@acquire], 0xffffffffffffff47, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000540)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0xfffffffffffffffd}) r5 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) sigaltstack(&(0x7f0000000000)={&(0x7f0000000280)=""/4124, 0x80000001, 0x101c}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000640)={0x8, 0x0, &(0x7f0000000000)=[@decrefs={0x400c6314}], 0xfc, 0x200000000000000, 0x0}) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040c60511920000010203010902200001010080fa0904000002ffffff000705810200020007050202000200"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff) mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r6, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb) close(r6) r7 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x442, 0x0) write(r7, &(0x7f0000000340)='dummy_hcd.0\x00', 0xb) close(r7) nanosleep(&(0x7f0000000400)={0x1}, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0xffffffffffffff67, 0x0, 0x0}) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r3, 0x80845663, &(0x7f00000012c0)={0x0, @reserved}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000940)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000400)={@ptr={0x66642a85, 0x0, 0x0, 0x0, 0x1, 0x3e}, @ptr={0x70742a85, 0x20000000, &(0x7f0000001380)=""/236, 0xec, 0x1, 0x26}, @fda={0x66646185, 0x5, 0x1, 0xd8}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1040}], 0x0, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000080)={0xc}) [ 103.014153][ T5287] Bluetooth: hci0: command tx timeout [ 103.157423][ T5330] binder: 5329:5330 ioctl c0306201 200000000080 returned -14 [ 103.168087][ T24] audit: type=1326 audit(1785949637.869:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5329 comm="syz.0.0" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f45d039e0d9 code=0x7ffc0000 [ 103.187790][ T24] audit: type=1326 audit(1785949637.879:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5329 comm="syz.0.0" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f45d039e0d9 code=0x7ffc0000 [ 103.198535][ T24] audit: type=1326 audit(1785949637.879:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5329 comm="syz.0.0" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f45d039e0d9 code=0x7ffc0000 [ 103.207953][ T24] audit: type=1326 audit(1785949637.879:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5329 comm="syz.0.0" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f45d039e0d9 code=0x7ffc0000 [ 103.218542][ T24] audit: type=1326 audit(1785949637.879:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5329 comm="syz.0.0" exe="/syz-executor" sig=0 arch=c000003e syscall=131 compat=0 ip=0x7f45d039e0d9 code=0x7ffc0000 [ 103.252293][ T24] audit: type=1326 audit(1785949637.879:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5329 comm="syz.0.0" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f45d039e0d9 code=0x7ffc0000 [ 103.263369][ T24] audit: type=1326 audit(1785949637.879:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5329 comm="syz.0.0" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f45d039e0d9 code=0x7ffc0000 [ 103.273943][ T24] audit: type=1326 audit(1785949637.879:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5329 comm="syz.0.0" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f45d039e0d9 code=0x7ffc0000 [ 103.285778][ T24] audit: type=1326 audit(1785949637.879:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5329 comm="syz.0.0" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f45d039e0d9 code=0x7ffc0000 [ 103.299720][ T24] audit: type=1326 audit(1785949637.879:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5329 comm="syz.0.0" exe="/syz-executor" sig=0 arch=c000003e syscall=223 compat=0 ip=0x7f45d039e0d9 code=0x7ffc0000 [ 103.391581][ T5330] dummy_hcd dummy_hcd.0: remove, state 1 [ 103.445019][ T1379] hub 5-0:1.0: activate --> -108 [ 103.450631][ T1379] hub 5-0:1.0: hub_ext_port_status failed (err = -108) [ 103.456666][ T5330] usb usb5: USB disconnect, device number 1 [ 103.568432][ T5332] binder: 5329:5332 ioctl c0306201 2000000003c0 returned -14 [ 103.603996][ T5332] binder: 5329:5332 ioctl 80845663 2000000012c0 returned -22 [ 103.730143][ T5330] dummy_hcd dummy_hcd.0: stopped [ 103.734131][ T5330] dummy_hcd dummy_hcd.0: USB bus 5 deregistered [ 104.487742][ T5329] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI [ 104.493154][ T5329] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 104.496899][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 104.501201][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 104.505917][ T5329] RIP: 0010:set_link_state+0x27/0x1000 [ 104.508098][ T5329] Code: 90 90 90 55 41 57 41 56 41 55 41 54 53 48 83 ec 38 49 89 fe 48 bb 00 00 00 00 00 fc ff df e8 e0 ad 0e fa 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 6b e0 7d fa 49 8b 16 4d 8d a6 a3 00 [ 104.516276][ T5329] RSP: 0018:ffffc9000f787b20 EFLAGS: 00010046 [ 104.519207][ T5329] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff888035888000 [ 104.522744][ T5329] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 104.526409][ T5329] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004 [ 104.530227][ T5329] R10: dffffc0000000000 R11: fffff52001ef0f60 R12: 0000000000000246 [ 104.534232][ T5329] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 [ 104.537594][ T5329] FS: 0000555576e45540(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 104.541257][ T5329] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 104.544309][ T5329] CR2: 00007f45d11f7008 CR3: 000000001f5d2000 CR4: 0000000000352ef0 [ 104.547548][ T5329] Call Trace: [ 104.549156][ T5329] [ 104.550519][ T5329] ? rcu_is_watching+0x15/0xb0 [ 104.552761][ T5329] ? __pfx_dummy_pullup+0x10/0x10 [ 104.554886][ T5329] dummy_pullup+0xc4/0x120 [ 104.556791][ T5329] ? __pfx_dummy_pullup+0x10/0x10 [ 104.559189][ T5329] usb_gadget_disconnect_locked+0x126/0x480 [ 104.561920][ T5329] gadget_unbind_driver+0xc2/0x410 [ 104.564290][ T5329] ? __pfx_gadget_unbind_driver+0x10/0x10 [ 104.567460][ T5329] device_release_driver_internal+0x48b/0x880 [ 104.570656][ T5329] driver_detach+0x1f3/0x2d0 [ 104.572806][ T5329] bus_remove_driver+0x226/0x320 [ 104.575200][ T5329] usb_gadget_unregister_driver+0x4e/0x70 [ 104.577667][ T5329] raw_release+0xd7/0x260 [ 104.579774][ T5329] ? __pfx_raw_release+0x10/0x10 [ 104.582105][ T5329] __fput+0x418/0xa50 [ 104.583817][ T5329] task_work_run+0x1d9/0x270 [ 104.585759][ T5329] ? __pfx_task_work_run+0x10/0x10 [ 104.588020][ T5329] exit_to_user_mode_loop+0x1fa/0x730 [ 104.590325][ T5329] ? rcu_is_watching+0x15/0xb0 [ 104.592499][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.595456][ T5329] do_syscall_64+0x353/0x580 [ 104.597522][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.600171][ T5329] ? clear_bhb_loop+0x40/0x90 [ 104.602688][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.606133][ T5329] RIP: 0033:0x7f45d039e0d9 [ 104.608427][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 104.617783][ T5329] RSP: 002b:00007ffe743e6a88 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 104.621809][ T5329] RAX: 0000000000000000 RBX: 00007f45d0627da0 RCX: 00007f45d039e0d9 [ 104.625083][ T5329] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 104.628390][ T5329] RBP: 00007f45d0627da0 R08: 00007f45d0626128 R09: 0000000000000000 [ 104.631836][ T5329] R10: 0000000000dd6338 R11: 0000000000000246 R12: 0000000000019fe7 [ 104.635115][ T5329] R13: 00007f45d062618c R14: 0000000000019447 R15: 00007f45d0626180 [ 104.638487][ T5329] [ 104.639826][ T5329] Modules linked in: [ 104.641609][ T5329] ---[ end trace 0000000000000000 ]--- [ 104.644018][ T5329] RIP: 0010:set_link_state+0x27/0x1000 [ 104.646272][ T5329] Code: 90 90 90 55 41 57 41 56 41 55 41 54 53 48 83 ec 38 49 89 fe 48 bb 00 00 00 00 00 fc ff df e8 e0 ad 0e fa 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 6b e0 7d fa 49 8b 16 4d 8d a6 a3 00 [ 104.654788][ T5329] RSP: 0018:ffffc9000f787b20 EFLAGS: 00010046 [ 104.657458][ T5329] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff888035888000 [ 104.660694][ T5329] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 104.664416][ T5329] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004 [ 104.668229][ T5329] R10: dffffc0000000000 R11: fffff52001ef0f60 R12: 0000000000000246 [ 104.671932][ T5329] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 [ 104.675933][ T5329] FS: 0000555576e45540(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 104.679997][ T5329] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 104.683300][ T5329] CR2: 00007f45d11f7008 CR3: 000000001f5d2000 CR4: 0000000000352ef0 [ 104.686688][ T5329] Kernel panic - not syncing: Fatal exception [ 104.689740][ T5329] Kernel Offset: disabled [ 104.691893][ T5329] Rebooting in 86400 seconds..