8<--- cut here --- Unable to handle kernel NULL pointer dereference at virtual address 00000077 when read [00000077] *pgd=80000080004003, *pmd=00000000 Internal error: Oops: 205 [#1] SMP ARM Modules linked in: CPU: 0 UID: 0 PID: 12979 Comm: syz.0.2030 Not tainted syzkaller #0 PREEMPT Hardware name: ARM-Versatile Express PC is at set_link_state+0xc/0x2f0 drivers/usb/gadget/udc/dummy_hcd.c:458 LR is at dummy_pullup+0x54/0x70 drivers/usb/gadget/udc/dummy_hcd.c:933 pc : [<810c21a0>] lr : [<810c256c>] psr: 60000193 sp : ec161cc0 ip : ec161ce0 fp : ec161cdc r10: 00000000 r9 : 831916b0 r8 : 83191000 r7 : 80000113 r6 : 00000000 r5 : 00000000 r4 : 831916b0 r3 : 00000001 r2 : 00007fe5 r1 : 00000000 r0 : 00000000 Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 85ade400 DAC: fffffffd Register r0 information: NULL pointer Register r1 information: NULL pointer Register r2 information: non-paged memory Register r3 information: non-paged memory Register r4 information: slab kmalloc-4k start 83191000 pointer offset 1712 size 4096 Register r5 information: NULL pointer Register r6 information: NULL pointer Register r7 information: non-slab/vmalloc memory Register r8 information: slab kmalloc-4k start 83191000 pointer offset 0 size 4096 Register r9 information: slab kmalloc-4k start 83191000 pointer offset 1712 size 4096 Register r10 information: NULL pointer Register r11 information: 2-page vmalloc region starting at 0xec160000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2748 Register r12 information: 2-page vmalloc region starting at 0xec160000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2748 Process syz.0.2030 (pid: 12979, stack limit = 0xec160000) Stack: (0xec161cc0 to 0xec162000) 1cc0: 831916b0 00000000 00000000 80000113 ec161d04 ec161ce0 810c256c 810c21a0 1ce0: 831916b0 831916f8 84211624 855e680c 84211410 831916b0 ec161d24 ec161d08 1d00: 810bef1c 810c2524 84211400 831916f8 84211624 855e680c ec161d54 ec161d28 1d20: 810bf4dc 810beee0 810bf494 831916f8 84213410 855e6830 83191744 855e6830 1d40: 00000002 85cbcfc0 ec161d6c ec161d58 80bd65e8 810bf4a0 831916f8 84213410 1d60: ec161d94 ec161d70 80bd7cc0 80bd65ac 831916f8 855e6830 00000001 84509850 1d80: 85f90f10 00000002 ec161dac ec161d98 80bd7db8 80bd7b44 855e6830 8382180c 1da0: ec161dcc ec161db0 80bd5e28 80bd7d78 855e6830 855e6804 00000001 84509850 1dc0: ec161de4 ec161dd0 80bd86f8 80bd5dd0 855e6800 855e6804 ec161df4 ec161de8 1de0: 810bcab0 80bd86d4 ec161e14 ec161df8 81124bfc 810bca94 85878e80 0408001b 1e00: 834dc880 84509850 ec161e4c ec161e18 805a2bfc 81124b64 00000020 8030dca8 1e20: ec161e4c ec161e30 00000000 845f5e20 845f55c0 82c856ac 845f5e54 00000002 1e40: ec161e5c ec161e50 805a2eac 805a2b30 ec161e84 ec161e60 8027e790 805a2ea4 1e60: 862fa000 845f55c0 862fa14c 845f5e50 ec161e90 00000002 ec161ebc ec161e88 1e80: 80258888 8027e710 ec161ebc ec161e98 80290b84 802d68ac ec161ed4 ec161ea8 1ea0: 80264b78 e3b811b1 ec161fb0 845f5dec ec161ed4 ec161ec0 8025928c 802585e8 1ec0: 845f55c0 845f5dec ec161f34 ec161ed8 8026a358 80259258 ec161f44 845f55c0 1ee0: ec161f34 82aff7a4 08430000 82a0b150 00000000 00000001 00000000 ec161f44 1f00: 00000000 e3b811b1 00000060 845f55c0 ec161fb0 00000000 845f5dec 00000000 1f20: 76fd3c30 b5403587 ec161fac ec161f38 8022b630 802698fc ec161f54 00000000 1f40: 809f4718 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1f60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 e3b811b1 1f80: ec161fa4 00131d58 ffffffff 76fd47d4 000000ad 00000000 845f55c0 000000ad 1fa0: 00000000 ec161fb0 80200088 8022b518 00000021 76fd3bb0 76fd3c30 00000000 1fc0: 00131d58 ffffffff 76fd47d4 000000f0 00340000 00000000 00000001 76fd40dc 1fe0: 76fd3f38 76fd3bb0 000f3b50 0014df48 00000010 0000040c 00000000 00000000 Call trace: [<810c2194>] (set_link_state) from [<810c256c>] (dummy_pullup+0x54/0x70 drivers/usb/gadget/udc/dummy_hcd.c:933) r7:80000113 r6:00000000 r5:00000000 r4:831916b0 [<810c2518>] (dummy_pullup) from [<810bef1c>] (usb_gadget_disconnect_locked+0x48/0x188 drivers/usb/gadget/udc/core.c:785) r9:831916b0 r8:84211410 r7:855e680c r6:84211624 r5:831916f8 r4:831916b0 [<810beed4>] (usb_gadget_disconnect_locked) from [<810bf4dc>] (gadget_unbind_driver+0x48/0x14c drivers/usb/gadget/udc/core.c:1718) r7:855e680c r6:84211624 r5:831916f8 r4:84211400 [<810bf494>] (gadget_unbind_driver) from [<80bd65e8>] (device_remove+0x48/0x6c drivers/base/dd.c:616) r10:85cbcfc0 r9:00000002 r8:855e6830 r7:83191744 r6:855e6830 r5:84213410 r4:831916f8 r3:810bf494 [<80bd65a0>] (device_remove) from [<80bd7cc0>] (__device_release_driver drivers/base/dd.c:1349 [inline]) [<80bd65a0>] (device_remove) from [<80bd7cc0>] (device_release_driver_internal+0x188/0x1fc drivers/base/dd.c:1372) r5:84213410 r4:831916f8 [<80bd7b38>] (device_release_driver_internal) from [<80bd7db8>] (driver_detach+0x4c/0x88 drivers/base/dd.c:1435) r9:00000002 r8:85f90f10 r7:84509850 r6:00000001 r5:855e6830 r4:831916f8 [<80bd7d6c>] (driver_detach) from [<80bd5e28>] (bus_remove_driver+0x64/0xe8 drivers/base/bus.c:832) r5:8382180c r4:855e6830 [<80bd5dc4>] (bus_remove_driver) from [<80bd86f8>] (driver_unregister+0x30/0x54 drivers/base/driver.c:202) r7:84509850 r6:00000001 r5:855e6804 r4:855e6830 [<80bd86c8>] (driver_unregister) from [<810bcab0>] (usb_gadget_unregister_driver+0x28/0x38 drivers/usb/gadget/udc/core.c:1784) r5:855e6804 r4:855e6800 [<810bca88>] (usb_gadget_unregister_driver) from [<81124bfc>] (raw_release+0xa4/0x130 drivers/usb/gadget/legacy/raw_gadget.c:463) [<81124b58>] (raw_release) from [<805a2bfc>] (__fput+0xd8/0x2f4 fs/file_table.c:512) r7:84509850 r6:834dc880 r5:0408001b r4:85878e80 [<805a2b24>] (__fput) from [<805a2eac>] (____fput+0x14/0x18 fs/file_table.c:540) r9:00000002 r8:845f5e54 r7:82c856ac r6:845f55c0 r5:845f5e20 r4:00000000 [<805a2e98>] (____fput) from [<8027e790>] (task_work_run+0x8c/0xb4 kernel/task_work.c:233) [<8027e704>] (task_work_run) from [<80258888>] (exit_task_work include/linux/task_work.h:40 [inline]) [<8027e704>] (task_work_run) from [<80258888>] (do_exit+0x2ac/0xadc kernel/exit.c:1009) r9:00000002 r8:ec161e90 r7:845f5e50 r6:862fa14c r5:845f55c0 r4:862fa000 [<802585dc>] (do_exit) from [<8025928c>] (do_group_exit+0x40/0x8c kernel/exit.c:1152) r7:845f5dec [<8025924c>] (do_group_exit) from [<8026a358>] (get_signal+0xa68/0xa90 kernel/signal.c:3046) r7:845f5dec r4:845f55c0 [<802698f0>] (get_signal) from [<8022b630>] (do_signal arch/arm/kernel/signal.c:579 [inline]) [<802698f0>] (get_signal) from [<8022b630>] (do_work_pending+0x124/0x4f0 arch/arm/kernel/signal.c:619) r10:b5403587 r9:76fd3c30 r8:00000000 r7:845f5dec r6:00000000 r5:ec161fb0 r4:845f55c0 [<8022b50c>] (do_work_pending) from [<80200088>] (slow_work_pending+0xc/0x24) Exception stack(0xec161fb0 to 0xec161ff8) 1fa0: 00000021 76fd3bb0 76fd3c30 00000000 1fc0: 00131d58 ffffffff 76fd47d4 000000f0 00340000 00000000 00000001 76fd40dc 1fe0: 76fd3f38 76fd3bb0 000f3b50 0014df48 00000010 0000040c r10:000000ad r9:845f55c0 r8:00000000 r7:000000ad r6:76fd47d4 r5:ffffffff r4:00131d58 Code: e89dabf0 e1a0c00d e92dd8f0 e24cb004 (e5d03077) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e89dabf0 ldm sp, {r4, r5, r6, r7, r8, r9, fp, sp, pc} 4: e1a0c00d mov ip, sp 8: e92dd8f0 push {r4, r5, r6, r7, fp, ip, lr, pc} c: e24cb004 sub fp, ip, #4 * 10: e5d03077 ldrb r3, [r0, #119] @ 0x77 <-- trapping instruction