FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 1, space 0, times 1000
CPU: 0 UID: 0 PID: 5327 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
fail_dump lib/fault-inject.c:73 [inline]
should_fail_ex+0x40c/0x560 lib/fault-inject.c:174
should_failslab+0xa8/0x100 mm/failslab.c:46
slab_pre_alloc_hook mm/slub.c:4539 [inline]
slab_alloc_node mm/slub.c:4897 [inline]
__kmalloc_cache_noprof+0xa8/0x660 mm/slub.c:5485
_kmalloc_noprof include/linux/slab.h:988 [inline]
_kzalloc_noprof include/linux/slab.h:1309 [inline]
uvcg_config_create_group drivers/usb/gadget/function/uvc_configfs.c:161 [inline]
uvcg_config_create_children+0x114/0x280 drivers/usb/gadget/function/uvc_configfs.c:148
uvcg_config_create_group drivers/usb/gadget/function/uvc_configfs.c:168 [inline]
uvcg_config_create_children+0x20b/0x280 drivers/usb/gadget/function/uvc_configfs.c:148
uvcg_attach_configfs+0x33/0x60 drivers/usb/gadget/function/uvc_configfs.c:3829
uvc_alloc_inst+0x6f9/0xa90 drivers/usb/gadget/function/f_uvc.c:999
try_get_usb_function_instance drivers/usb/gadget/functions.c:28 [inline]
usb_get_function_instance+0xe3/0x2f0 drivers/usb/gadget/functions.c:44
function_make+0x127/0x360 drivers/usb/gadget/configfs.c:626
configfs_mkdir+0x4f6/0x9e0 fs/configfs/dir.c:1360
vfs_mkdir+0x406/0x620 fs/namei.c:5276
filename_mkdirat+0x285/0x510 fs/namei.c:5309
__do_sys_mkdirat fs/namei.c:5330 [inline]
__se_sys_mkdirat+0x35/0x150 fs/namei.c:5327
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f708319df99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f70840aafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007f7083425fa0 RCX: 00007f708319df99
RDX: 00000000000001ff RSI: 0000200000000800 RDI: ffffffffffffff9c
RBP: 00007f7083234ec4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f7083426038 R14: 00007f7083425fa0 R15: 00007ffca78049e8
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 UID: 0 PID: 5327 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:usb_put_function_instance+0x54/0xb0 drivers/usb/gadget/functions.c:76
Code: 8d b3 98 00 00 00 4c 89 f0 48 c1 e8 03 42 80 3c 38 00 74 08 4c 89 f7 e8 ea 1b 7f fa 4d 8b 36 49 83 c6 08 4c 89 f0 48 c1 e8 03 <42> 80 3c 38 00 74 08 4c 89 f7 e8 cd 1b 7f fa 4d 8b 36 48 8d bb a8
RSP: 0018:ffffc9000e477a50 EFLAGS: 00010202
RAX: 0000000000000001 RBX: ffff88801fca8800 RCX: 0000000000100000
RDX: ffffc9000ecea000 RSI: 000000000000c259 RDI: 000000000000c25a
RBP: 1ffff11003f95100 R08: ffffffff9057b737 R09: 1ffffffff20af6e6
R10: dffffc0000000000 R11: fffffbfff20af6e7 R12: dffffc0000000000
R13: dffffc0000000000 R14: 0000000000000008 R15: dffffc0000000000
FS: 00007f70840ab6c0(0000) GS:ffff88808c543000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f70833f26b8 CR3: 0000000012d00000 CR4: 0000000000352ef0
Call Trace:
config_item_cleanup fs/configfs/item.c:128 [inline]
config_item_release+0x13a/0x2d0 fs/configfs/item.c:137
config_group_put include/linux/configfs.h:102 [inline]
uvcg_attach_configfs+0x56/0x60 drivers/usb/gadget/function/uvc_configfs.c:3832
uvc_alloc_inst+0x6f9/0xa90 drivers/usb/gadget/function/f_uvc.c:999
try_get_usb_function_instance drivers/usb/gadget/functions.c:28 [inline]
usb_get_function_instance+0xe3/0x2f0 drivers/usb/gadget/functions.c:44
function_make+0x127/0x360 drivers/usb/gadget/configfs.c:626
configfs_mkdir+0x4f6/0x9e0 fs/configfs/dir.c:1360
vfs_mkdir+0x406/0x620 fs/namei.c:5276
filename_mkdirat+0x285/0x510 fs/namei.c:5309
__do_sys_mkdirat fs/namei.c:5330 [inline]
__se_sys_mkdirat+0x35/0x150 fs/namei.c:5327
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f708319df99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f70840aafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007f7083425fa0 RCX: 00007f708319df99
RDX: 00000000000001ff RSI: 0000200000000800 RDI: ffffffffffffff9c
RBP: 00007f7083234ec4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f7083426038 R14: 00007f7083425fa0 R15: 00007ffca78049e8
Modules linked in:
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: 8d b3 98 00 00 00 lea 0x98(%rbx),%esi
6: 4c 89 f0 mov %r14,%rax
9: 48 c1 e8 03 shr $0x3,%rax
d: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1)
12: 74 08 je 0x1c
14: 4c 89 f7 mov %r14,%rdi
17: e8 ea 1b 7f fa call 0xfa7f1c06
1c: 4d 8b 36 mov (%r14),%r14
1f: 49 83 c6 08 add $0x8,%r14
23: 4c 89 f0 mov %r14,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 4c 89 f7 mov %r14,%rdi
34: e8 cd 1b 7f fa call 0xfa7f1c06
39: 4d 8b 36 mov (%r14),%r14
3c: 48 rex.W
3d: 8d .byte 0x8d
3e: bb .byte 0xbb
3f: a8 .byte 0xa8