program: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) socket$unix(0x1, 0x1, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x50, &(0x7f0000000000)={&(0x7f00000084c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a30000000003c000000090a010400000000000000000100000008000a40000000000900020025642532000000000900010073797a30000000000800054000000002"], 0x40c4}}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000001240)=@newtfilter={0x480, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r5, {0xffff, 0x3}, {}, {0x7, 0x3}}, [@filter_kind_options=@f_flow={{0x9}, {0x450, 0x2, [@TCA_FLOW_PERTURB={0x8, 0xc, 0xd}, @TCA_FLOW_XOR={0x8, 0x7, 0x100}, @TCA_FLOW_POLICE={0x424, 0xa, 0x0, 0x1, [@TCA_POLICE_RATE64={0xc, 0x8, 0x200}, @TCA_POLICE_RATE={0x404, 0x2, [0x516, 0x3, 0x100, 0xa, 0x20c, 0x4, 0x4, 0x4, 0x7f, 0x8, 0xd, 0x5, 0x0, 0x36c4, 0x9, 0x828, 0x3ff, 0x7, 0x7fffffff, 0xff, 0xe, 0xff, 0x2, 0xfffffff9, 0x9, 0xfffffff7, 0x82, 0x1, 0x0, 0x1, 0x4, 0x3, 0x10001, 0xb, 0x8000, 0x0, 0x0, 0x9, 0x7, 0x4, 0x3, 0xfffffff7, 0x5, 0x1, 0x0, 0x2, 0x1, 0x3, 0xfff7fffc, 0x7, 0x2, 0x81, 0xff58, 0x6, 0x4, 0x0, 0xf, 0x7, 0x8000, 0x5, 0x1, 0xd6, 0x9599, 0x3, 0x6, 0x80000000, 0x68, 0xffffffff, 0x5, 0x6, 0x9, 0xffffffff, 0x5, 0x2, 0x3, 0x8, 0xe3dc, 0xffffffff, 0x80, 0x8001, 0xfff80000, 0x1, 0x0, 0x4, 0x8d, 0x2, 0x5, 0xffff, 0x0, 0x3, 0x8000, 0x5, 0x3, 0x0, 0x80000001, 0x0, 0x9, 0x9, 0xfffffffd, 0x9, 0x2, 0x9, 0xffffffff, 0x7fffffff, 0xd8, 0x3cc3, 0x401, 0x3, 0xf8, 0x4, 0x8, 0x0, 0x6, 0x8b44, 0x1, 0x0, 0x9, 0x2, 0x8, 0x7f, 0x0, 0x5, 0xbbd2, 0x2, 0x200, 0x6, 0x5, 0x5, 0x4, 0x1, 0xb6, 0x9, 0x5, 0xb, 0x100, 0x6, 0x9, 0x821, 0x3, 0x0, 0x3, 0x3, 0x80000000, 0xb35, 0xa, 0x5, 0xacb, 0x3, 0x81, 0x0, 0x800d, 0x0, 0x9, 0x7, 0x9, 0x0, 0x4, 0x1, 0x5, 0x1, 0x28000000, 0xffffff01, 0x0, 0x5b3400, 0xe5b1, 0xfffffff8, 0x10, 0x7ffff001, 0x3, 0xd04, 0x1, 0x9, 0x7, 0x6, 0x4, 0x1, 0x7, 0x800, 0x7, 0xc, 0x5, 0x6, 0x81, 0x0, 0x2, 0x7ff, 0x9, 0xffff, 0x7ff, 0x9, 0x5, 0xfffffffa, 0x6, 0x4, 0x1f, 0x7, 0x77e5, 0x1, 0x8, 0xfff, 0x5, 0x8, 0x8, 0x80000000, 0xfffff000, 0x3, 0x5, 0x101, 0x6, 0xf3d, 0x1, 0x8, 0x7, 0x8d5, 0x4, 0x8, 0xffffffff, 0x8, 0x5, 0xfff, 0xfea5, 0x8, 0x2, 0x0, 0x6, 0x0, 0x401, 0x200, 0x10000, 0x4dcc6b80, 0x5, 0x100, 0x81, 0x3c8, 0x3, 0x6, 0x9, 0x7ff, 0x1, 0x1, 0x1, 0x1, 0x5, 0x80, 0x123a4000, 0x1, 0x1, 0x1, 0x6, 0x9b, 0x200, 0x0, 0x81, 0x3, 0x7, 0x8]}, @TCA_POLICE_RESULT={0x8, 0x5, 0x9}, @TCA_POLICE_AVRATE={0x8}]}, @TCA_FLOW_XOR={0x8, 0x7, 0x50}, @TCA_FLOW_XOR={0x8, 0x7, 0x7}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}]}}]}, 0x480}, 0x1, 0x0, 0x0, 0xc0}, 0x20044004) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="06000001c21d1fe500008ff6ccfd9364a20995", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) fsetxattr$system_posix_acl(r6, &(0x7f0000000140)='system.posix_acl_default\x00', 0x0, 0x0, 0x2) socket$kcm(0x11, 0x3, 0x0) r7 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r7, 0x1, 0x0, 0x0) syz_usb_ep_write(r7, 0x81, 0x90, &(0x7f0000000140)="90010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000032eac33fc36fd0dca9cfff6edbacbe2b9298c4ecf43ba7b9d4e97984c3fe1c24f8de3cecac99d83cda3f21a8a3976c1da15382354eeb0031a084040045a3885d637384c6920fa8c7016a53550000000000000000") syz_usb_ep_read(r7, 0x1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000e00)='./sys\x00', &(0x7f0000000f00)='sysfs\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./sys/devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/adsl_state\x00', 0x2, 0x0) write(r8, &(0x7f0000001200)='stop', 0x4) [ 101.638833][ T4641] Bluetooth: hci0: command tx timeout [ 101.809185][ T5321] syzkaller0: entered promiscuous mode [ 101.811509][ T5321] syzkaller0: entered allmulticast mode [ 102.042732][ T9] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 102.194306][ T9] usb 5-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 102.200273][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.430517][ T9] cxacru 5-1:1.0: invalid response length to cm 0x90: 144 [ 102.438039][ T5323] cxacru 5-1:1.0: Direct firmware load for cxacru-fw.bin failed with error -2 [ 102.451783][ T5323] cxacru 5-1:1.0: Falling back to sysfs fallback for: cxacru-fw.bin [ 103.674220][ T4641] Bluetooth: hci0: command tx timeout [ 105.033425][ T5322] cxacru 5-1:1.0: receive of cm 0x85 failed (-104) [ 105.036250][ T5322] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI [ 105.041373][ T5322] KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] [ 105.044780][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 105.048603][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 105.052799][ T5322] RIP: 0010:adsl_state_store+0x5cc/0x770 [ 105.055120][ T5322] Code: 03 42 80 3c 28 00 74 14 48 89 4c 24 10 48 8b 7c 24 10 e8 f7 7e 85 fa 48 8b 4c 24 10 48 8b 11 48 83 c2 10 48 89 d0 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 4b 01 00 00 4d 89 f4 8b 32 48 c7 c7 60 [ 105.062929][ T5322] RSP: 0018:ffffc9000d38fb80 EFLAGS: 00010202 [ 105.065337][ T5322] RAX: 0000000000000002 RBX: 00000000ffffff98 RCX: ffff888040b17078 [ 105.068509][ T5322] RDX: 0000000000000010 RSI: 00000000000006c3 RDI: 00000000000006c4 [ 105.071739][ T5322] RBP: ffffc9000d38fc40 R08: ffffc9000d38f907 R09: 1ffff92001a71f20 [ 105.074883][ T5322] R10: dffffc0000000000 R11: fffff52001a71f21 R12: ffff88800bf37000 [ 105.078173][ T5322] R13: dffffc0000000000 R14: 0000000000000004 R15: 1ffff92001a71f74 [ 105.081394][ T5322] FS: 00007f3fe3df56c0(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000 [ 105.085055][ T5322] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 105.087665][ T5322] CR2: 000055556482ca58 CR3: 000000005203b000 CR4: 0000000000352ef0 [ 105.090894][ T5322] Call Trace: [ 105.092299][ T5322] [ 105.093548][ T5322] ? sysfs_file_kobj+0x1a/0x230 [ 105.095574][ T5322] ? __pfx_adsl_state_store+0x10/0x10 [ 105.097821][ T5322] ? sysfs_file_kobj+0x1e4/0x230 [ 105.099864][ T5322] ? sysfs_kf_write+0x166/0x260 [ 105.101809][ T5322] ? __pfx_sysfs_kf_write+0x10/0x10 [ 105.103918][ T5322] kernfs_fop_write_iter+0x3a4/0x540 [ 105.106070][ T5322] vfs_write+0x612/0xba0 [ 105.107862][ T5322] ? __pfx_vfs_write+0x10/0x10 [ 105.109799][ T5322] ? __fget_files+0x2a/0x420 [ 105.111756][ T5322] ksys_write+0x150/0x270 [ 105.113493][ T5322] ? __pfx_ksys_write+0x10/0x10 [ 105.115469][ T5322] do_syscall_64+0x166/0x520 [ 105.117400][ T5322] ? trace_irq_disable+0x3b/0x140 [ 105.119505][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.122063][ T5322] ? clear_bhb_loop+0x70/0xc0 [ 105.124049][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.126434][ T5322] RIP: 0033:0x7f3fe799e0d9 [ 105.128304][ T5322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 105.135894][ T5322] RSP: 002b:00007f3fe3df4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 105.139362][ T5322] RAX: ffffffffffffffda RBX: 00007f3fe7c26090 RCX: 00007f3fe799e0d9 [ 105.142460][ T5322] RDX: 0000000000000004 RSI: 0000200000001200 RDI: 000000000000000a [ 105.145574][ T5322] RBP: 00007f3fe7a35024 R08: 0000000000000000 R09: 0000000000000000 [ 105.148578][ T5322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 105.151714][ T5322] R13: 00007f3fe7c26128 R14: 00007f3fe7c26090 R15: 00007ffcee209ec8 [ 105.154851][ T5322] [ 105.156191][ T5322] Modules linked in: [ 105.158135][ T5322] ---[ end trace 0000000000000000 ]--- [ 105.165284][ T5322] RIP: 0010:adsl_state_store+0x5cc/0x770 [ 105.167719][ T5322] Code: 03 42 80 3c 28 00 74 14 48 89 4c 24 10 48 8b 7c 24 10 e8 f7 7e 85 fa 48 8b 4c 24 10 48 8b 11 48 83 c2 10 48 89 d0 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 4b 01 00 00 4d 89 f4 8b 32 48 c7 c7 60 [ 105.176098][ T5322] RSP: 0018:ffffc9000d38fb80 EFLAGS: 00010202 [ 105.178709][ T5322] RAX: 0000000000000002 RBX: 00000000ffffff98 RCX: ffff888040b17078 [ 105.181845][ T5322] RDX: 0000000000000010 RSI: 00000000000006c3 RDI: 00000000000006c4 [ 105.185497][ T5322] RBP: ffffc9000d38fc40 R08: ffffc9000d38f907 R09: 1ffff92001a71f20 [ 105.188672][ T5322] R10: dffffc0000000000 R11: fffff52001a71f21 R12: ffff88800bf37000 [ 105.191962][ T5322] R13: dffffc0000000000 R14: 0000000000000004 R15: 1ffff92001a71f74 [ 105.195440][ T5322] FS: 00007f3fe3df56c0(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000 [ 105.199676][ T5322] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 105.202823][ T5322] CR2: 000055556482ca58 CR3: 000000005203b000 CR4: 0000000000352ef0 [ 105.206163][ T5322] Kernel panic - not syncing: Fatal exception [ 105.209114][ T5322] Kernel Offset: disabled [ 105.210913][ T5322] Rebooting in 86400 seconds..