Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]
CPU: 1 UID: 0 PID: 3804 Comm: syz.0.5055 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026
RIP: 0010:nfcmrvl_bulk_complete+0x33f/0x630 drivers/nfc/nfcmrvl/usb.c:70
Code: c1 e9 03 80 3c 01 00 0f 85 f8 02 00 00 49 8b ac 24 b8 02 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7d 20 48 89 f9 48 c1 e9 03 <80> 3c 01 00 0f 85 9e 02 00 00 4c 8b 7d 20 49 8d 47 18 48 89 c1 48
RSP: 0018:ffffc90000a18b80 EFLAGS: 00010012
RAX: dffffc0000000000 RBX: ffff888062a61a00 RCX: 0000000000000004
RDX: 0000000000000000 RSI: ffffffff86848753 RDI: 0000000000000020
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffff888032a04038
R13: ffff888032a04048 R14: ffff888062a61a8c R15: ffff888062a61a40
FS: 00007fea2610b6c0(0000) GS:ffff888123c61000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f905a865030 CR3: 000000006862a000 CR4: 0000000000350ef0
Call Trace:
__usb_hcd_giveback_urb+0x38e/0x610 drivers/usb/core/hcd.c:1657
usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
dummy_timer+0xdb2/0x3700 drivers/usb/gadget/udc/dummy_hcd.c:2019
__run_hrtimer kernel/time/hrtimer.c:2067 [inline]
__hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2124
hrtimer_run_softirq+0x1ca/0x360 kernel/time/hrtimer.c:2141
handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645
__do_softirq kernel/softirq.c:679 [inline]
invoke_softirq kernel/softirq.c:519 [inline]
__irq_exit_rcu+0x194/0x210 kernel/softirq.c:767
irq_exit_rcu+0x9/0x30 kernel/softirq.c:784
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x70 kernel/kcov.c:206
Code: 46 0c 60 00 48 89 df 5b e9 4d ee 65 00 be 03 00 00 00 5b e9 f2 07 1d 03 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 65 48 8b 05 2c 24 80 12 48 8b 34 24 65 48 8b 15 10 24
RSP: 0018:ffffc900092ff398 EFLAGS: 00000287
RAX: 0000000000000735 RBX: 0000000000000000 RCX: ffffc9001b38f000
RDX: 0000000000080000 RSI: ffffffff81d0db8b RDI: ffff888049a1be80
RBP: 0000000000000001 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000008
R13: ffff888032a07800 R14: 0000000000000001 R15: ffff88807e6f3140
queue_work_on+0x141/0x1e0 kernel/workqueue.c:2506
queue_work include/linux/workqueue.h:700 [inline]
nci_send_cmd+0x24f/0x370 net/nfc/nci/core.c:1415
nci_reset_req+0x75/0xa0 net/nfc/nci/core.c:167
__nci_request+0x8a/0x2a0 net/nfc/nci/core.c:108
nci_open_device net/nfc/nci/core.c:503 [inline]
nci_dev_up+0x36a/0x680 net/nfc/nci/core.c:643
nfc_dev_up+0x1b6/0x3a0 net/nfc/core.c:118
nfc_genl_dev_up+0xa5/0xf0 net/nfc/netlink.c:775
genl_family_rcv_msg_doit+0x214/0x300 net/netlink/genetlink.c:1114
genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline]
genl_rcv_msg+0x560/0x800 net/netlink/genetlink.c:1209
netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2556
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x585/0x850 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x8b0/0xda0 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec net/socket.c:800 [inline]
__sock_sendmsg net/socket.c:815 [inline]
____sys_sendmsg+0xa4d/0xbe0 net/socket.c:2713
___sys_sendmsg+0x190/0x1e0 net/socket.c:2767
__sys_sendmsg+0x160/0x210 net/socket.c:2799
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fea2519e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fea2610b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fea25425fa0 RCX: 00007fea2519e159
RDX: 0000000000000000 RSI: 0000200000001000 RDI: 0000000000000005
RBP: 00007fea25235024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fea25426038 R14: 00007fea25425fa0 R15: 00007fff8c6d4e28
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:nfcmrvl_bulk_complete+0x33f/0x630 drivers/nfc/nfcmrvl/usb.c:70
Code: c1 e9 03 80 3c 01 00 0f 85 f8 02 00 00 49 8b ac 24 b8 02 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7d 20 48 89 f9 48 c1 e9 03 <80> 3c 01 00 0f 85 9e 02 00 00 4c 8b 7d 20 49 8d 47 18 48 89 c1 48
RSP: 0018:ffffc90000a18b80 EFLAGS: 00010012
RAX: dffffc0000000000 RBX: ffff888062a61a00 RCX: 0000000000000004
RDX: 0000000000000000 RSI: ffffffff86848753 RDI: 0000000000000020
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffff888032a04038
R13: ffff888032a04048 R14: ffff888062a61a8c R15: ffff888062a61a40
FS: 00007fea2610b6c0(0000) GS:ffff888123c61000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f905a865030 CR3: 000000006862a000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
0: c1 e9 03 shr $0x3,%ecx
3: 80 3c 01 00 cmpb $0x0,(%rcx,%rax,1)
7: 0f 85 f8 02 00 00 jne 0x305
d: 49 8b ac 24 b8 02 00 mov 0x2b8(%r12),%rbp
14: 00
15: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
1c: fc ff df
1f: 48 8d 7d 20 lea 0x20(%rbp),%rdi
23: 48 89 f9 mov %rdi,%rcx
26: 48 c1 e9 03 shr $0x3,%rcx
* 2a: 80 3c 01 00 cmpb $0x0,(%rcx,%rax,1) <-- trapping instruction
2e: 0f 85 9e 02 00 00 jne 0x2d2
34: 4c 8b 7d 20 mov 0x20(%rbp),%r15
38: 49 8d 47 18 lea 0x18(%r15),%rax
3c: 48 89 c1 mov %rax,%rcx
3f: 48 rex.W