program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000180)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='+p', 0x2) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x4, 0x7fff0000}]}) syz_open_dev$video4linux(0x0, 0x9, 0x12800) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000340)='numa_maps\x00') close_range(r1, 0xffffffffffffffff, 0x0) syz_usb_connect(0x5, 0x4e, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040cd06350100010000000109023c0001010080320904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x0, 0x0) ioctl$TCSBRKP(r2, 0x5425, 0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000180)='debugfs\x00', 0x0, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/dynamic_debug/control\x00', 0x2, 0x0) (async) write(r0, &(0x7f0000000100)='+p', 0x2) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x4, 0x7fff0000}]}) (async) syz_open_dev$video4linux(0x0, 0x9, 0x12800) (async) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000340)='numa_maps\x00') (async) close_range(r1, 0xffffffffffffffff, 0x0) (async) syz_usb_connect(0x5, 0x4e, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040cd06350100010000000109023c0001010080320904"], 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x0, 0x0) (async) ioctl$TCSBRKP(r2, 0x5425, 0x7) (async) [ 132.353520][ T4646] Bluetooth: hci0: command tx timeout [ 132.768241][ T10] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 132.919812][ T10] usb 5-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 132.921446][ T10] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 132.921491][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 132.964986][ T10] keyspan 5-1:1.0: Keyspan 2 port adapter converter detected [ 132.965185][ T10] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 81 [ 132.965240][ T10] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 1 [ 132.986641][ T10] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 84 [ 132.986709][ T10] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 2 [ 133.003646][ T10] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 133.032382][ T10] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 88 [ 133.032445][ T10] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 6 [ 133.049646][ T10] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 133.217895][ T1364] usb 5-1: USB disconnect, device number 2 [ 133.547037][ T1364] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 133.576060][ T1364] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 133.585244][ T1364] keyspan 5-1:1.0: device disconnected [ 133.900825][ T5329] usb-serial ttyUSB0: serial_break [ 133.900899][ T5329] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000013: 0000 [#1] SMP KASAN NOPTI [ 133.907450][ T5329] KASAN: null-ptr-deref in range [0x0000000000000098-0x000000000000009f] [ 133.910918][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 133.914410][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 133.920233][ T5329] RIP: 0010:keyspan_break_ctl+0x83/0xc0 [ 133.922675][ T5329] Code: 83 4a 8a fa 41 be 9c 00 00 00 4d 03 37 bf ff ff ff ff 89 ee e8 5e 9f 18 fa 45 31 ff 83 fd ff 41 0f 94 c7 4c 89 f0 48 c1 e8 03 <42> 0f b6 04 20 84 c0 75 1d 45 89 3e 48 89 df 31 f6 e8 57 c3 00 00 [ 133.930562][ T5329] RSP: 0018:ffffc9000f0ffe08 EFLAGS: 00010203 [ 133.933110][ T5329] RAX: 0000000000000013 RBX: ffff888035e6e000 RCX: ffff8880316ea580 [ 133.936569][ T5329] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000ffffffff [ 133.939938][ T5329] RBP: 0000000000000000 R08: ffffc9000f0ff8a7 R09: 1ffff92001e1ff14 [ 133.943149][ T5329] R10: dffffc0000000000 R11: ffffffff87af8590 R12: dffffc0000000000 [ 133.946546][ T5329] R13: dffffc0000000000 R14: 000000000000009c R15: 0000000000000000 [ 133.950100][ T5329] FS: 00007fee2c8966c0(0000) GS:ffff88808c2bb000(0000) knlGS:0000000000000000 [ 133.953605][ T5329] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 133.956132][ T5329] CR2: 000055f4fbb0d5a8 CR3: 000000001f606000 CR4: 0000000000352ef0 [ 133.959305][ T5329] Call Trace: [ 133.960756][ T5329] [ 133.961970][ T5329] send_break+0x222/0x300 [ 133.963873][ T5329] tty_ioctl+0xd0f/0xdd0 [ 133.965659][ T5329] ? __pfx_tty_ioctl+0x10/0x10 [ 133.967550][ T5329] __se_sys_ioctl+0xfc/0x170 [ 133.969473][ T5329] do_syscall_64+0x166/0x520 [ 133.971551][ T5329] ? trace_irq_disable+0x3b/0x140 [ 133.973799][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 133.976506][ T5329] ? clear_bhb_loop+0x70/0xc0 [ 133.978597][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 133.981366][ T5329] RIP: 0033:0x7fee2b99e159 [ 133.983516][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 133.991940][ T5329] RSP: 002b:00007fee2c895fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 133.995424][ T5329] RAX: ffffffffffffffda RBX: 00007fee2bc25fa0 RCX: 00007fee2b99e159 [ 133.998640][ T5329] RDX: 0000000000000007 RSI: 0000000000005425 RDI: 0000000000000001 [ 134.001940][ T5329] RBP: 00007fee2ba3506b R08: 0000000000000000 R09: 0000000000000000 [ 134.005345][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 134.008699][ T5329] R13: 00007fee2bc26038 R14: 00007fee2bc25fa0 R15: 00007fff808c3ee8 [ 134.012109][ T5329] [ 134.013362][ T5329] Modules linked in: [ 134.015395][ T5329] ---[ end trace 0000000000000000 ]--- [ 134.018935][ T1364] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 134.021356][ T1364] raw-gadget.1 gadget.0: gadget reset [ 134.022558][ T5329] RIP: 0010:keyspan_break_ctl+0x83/0xc0 [ 134.022580][ T5329] Code: 83 4a 8a fa 41 be 9c 00 00 00 4d 03 37 bf ff ff ff ff 89 ee e8 5e 9f 18 fa 45 31 ff 83 fd ff 41 0f 94 c7 4c 89 f0 48 c1 e8 03 <42> 0f b6 04 20 84 c0 75 1d 45 89 3e 48 89 df 31 f6 e8 57 c3 00 00 [ 134.022590][ T5329] RSP: 0018:ffffc9000f0ffe08 EFLAGS: 00010203 [ 134.022602][ T5329] RAX: 0000000000000013 RBX: ffff888035e6e000 RCX: ffff8880316ea580 [ 134.022611][ T5329] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000ffffffff [ 134.022618][ T5329] RBP: 0000000000000000 R08: ffffc9000f0ff8a7 R09: 1ffff92001e1ff14 [ 134.022626][ T5329] R10: dffffc0000000000 R11: ffffffff87af8590 R12: dffffc0000000000 [ 134.022634][ T5329] R13: dffffc0000000000 R14: 000000000000009c R15: 0000000000000000 [ 134.022642][ T5329] FS: 00007fee2c8966c0(0000) GS:ffff88808c2bb000(0000) knlGS:0000000000000000 [ 134.022651][ T5329] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 134.022658][ T5329] CR2: 000055f4fbb0d5a8 CR3: 000000001f606000 CR4: 0000000000352ef0 [ 134.022698][ T5329] Kernel panic - not syncing: Fatal exception [ 134.070190][ T5329] Kernel Offset: disabled [ 134.071975][ T5329] Rebooting in 86400 seconds..