Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: usb_hub_wq hub_event
RIP: 0010:llc_conn_state_process+0xd09/0x1360 net/llc/llc_conn.c:-1
Code: 4c 89 f7 e8 39 01 93 f8 31 c0 84 db 0f 94 c0 4d 8b 36 8d 5c 00 01 b8 01 00 00 00 bd 07 00 00 00 0f 44 e8 4c 89 f0 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 0e 06 00 00 41 89 1e 43 0f b6 04 2c 84
RSP: 0018:ffffc90000007bd0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000100
RDX: ffff88801caf24c0 RSI: 0000000000000002 RDI: 0000000000000000
RBP: 0000000000000007 R08: ffff88801caf24c0 R09: 0000000000000005
R10: 0000000000000005 R11: 0000000000000100 R12: 1ffff11008668602
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff888043343012
FS: 0000000000000000(0000) GS:ffff88808ca4f000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe7e477e48 CR3: 0000000040f80000 CR4: 0000000000352ef0
Call Trace:
llc_process_tmr_ev net/llc/llc_c_ac.c:1448 [inline]
llc_conn_tmr_common_cb+0x34a/0x790 net/llc/llc_c_ac.c:1331
call_timer_fn+0x192/0x640 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2373 [inline]
__run_timer_base+0x652/0x8b0 kernel/time/timer.c:2385
run_timer_base kernel/time/timer.c:2394 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2404
handle_softirqs+0x22a/0x870 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:179 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 kernel/locking/spinlock.c:194
Code: f7 e8 1d c1 ee f5 f7 c3 00 02 00 00 74 05 e8 00 36 1a f6 9c 58 a9 00 02 00 00 75 27 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 e4 7d e0 f5 65 8b 05 0d a0 69 07 85 c0 74 18 5b 41 5e c3 cc cc
RSP: 0018:ffffc9000023e9c8 EFLAGS: 00000206
RAX: 0000000000000002 RBX: 0000000000000246 RCX: 0000000080000001
RDX: 0000000000000006 RSI: ffffffff8defc240 RDI: 0000000000000001
RBP: 0000000000000001 R08: ffffffff9011dbb7 R09: 1ffffffff2023b76
R10: dffffc0000000000 R11: fffffbfff2023b77 R12: 0000000000000000
R13: dffffc0000000000 R14: ffff8880375d8000 R15: ffff88805b2f0408
spin_unlock_irqrestore include/linux/spinlock.h:407 [inline]
dummy_urb_enqueue+0x58a/0x780 drivers/usb/gadget/udc/dummy_hcd.c:1315
usb_hcd_submit_urb+0x328/0x1b70 drivers/usb/core/hcd.c:1542
usb_start_wait_urb+0x13f/0x5b0 drivers/usb/core/message.c:62
usb_internal_control_msg drivers/usb/core/message.c:117 [inline]
usb_control_msg+0x234/0x3e0 drivers/usb/core/message.c:167
usb_get_string+0xa1/0x3c0 drivers/usb/core/message.c:902
usb_string_sub+0x76/0x420 drivers/usb/core/message.c:941
usb_string+0x38f/0x7d0 drivers/usb/core/message.c:1046
usbhid_probe+0xbf8/0x12f0 drivers/hid/usbhid/hid-core.c:1430
usb_probe_interface+0x668/0xc90 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:721
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:863
driver_probe_device+0x4f/0x240 drivers/base/dd.c:893
__device_attach_driver+0x279/0x430 drivers/base/dd.c:1021
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1093
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1148
bus_probe_device+0x12a/0x220 drivers/base/bus.c:613
device_add+0x7b6/0xb70 drivers/base/core.c:3691
usb_set_configuration+0x1a87/0x2110 drivers/usb/core/message.c:2266
usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
usb_probe_device+0x1c4/0x3b0 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:721
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:863
driver_probe_device+0x4f/0x240 drivers/base/dd.c:893
__device_attach_driver+0x279/0x430 drivers/base/dd.c:1021
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1093
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1148
bus_probe_device+0x12a/0x220 drivers/base/bus.c:613
device_add+0x7b6/0xb70 drivers/base/core.c:3691
usb_new_device+0xa08/0x16f0 drivers/usb/core/hub.c:2695
hub_port_connect drivers/usb/core/hub.c:5567 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x2a1c/0x4f30 drivers/usb/core/hub.c:5953
process_one_work kernel/workqueue.c:3276 [inline]
process_scheduled_works+0xb6e/0x18c0 kernel/workqueue.c:3359
worker_thread+0xa53/0xfc0 kernel/workqueue.c:3440
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:llc_conn_state_process+0xd09/0x1360 net/llc/llc_conn.c:-1
Code: 4c 89 f7 e8 39 01 93 f8 31 c0 84 db 0f 94 c0 4d 8b 36 8d 5c 00 01 b8 01 00 00 00 bd 07 00 00 00 0f 44 e8 4c 89 f0 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 0e 06 00 00 41 89 1e 43 0f b6 04 2c 84
RSP: 0018:ffffc90000007bd0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000100
RDX: ffff88801caf24c0 RSI: 0000000000000002 RDI: 0000000000000000
RBP: 0000000000000007 R08: ffff88801caf24c0 R09: 0000000000000005
R10: 0000000000000005 R11: 0000000000000100 R12: 1ffff11008668602
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff888043343012
FS: 0000000000000000(0000) GS:ffff88808ca4f000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe7e477e48 CR3: 0000000040f80000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
0: 4c 89 f7 mov %r14,%rdi
3: e8 39 01 93 f8 call 0xf8930141
8: 31 c0 xor %eax,%eax
a: 84 db test %bl,%bl
c: 0f 94 c0 sete %al
f: 4d 8b 36 mov (%r14),%r14
12: 8d 5c 00 01 lea 0x1(%rax,%rax,1),%ebx
16: b8 01 00 00 00 mov $0x1,%eax
1b: bd 07 00 00 00 mov $0x7,%ebp
20: 0f 44 e8 cmove %eax,%ebp
23: 4c 89 f0 mov %r14,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 0f b6 04 28 movzbl (%rax,%r13,1),%eax <-- trapping instruction
2f: 84 c0 test %al,%al
31: 0f 85 0e 06 00 00 jne 0x645
37: 41 89 1e mov %ebx,(%r14)
3a: 43 0f b6 04 2c movzbl (%r12,%r13,1),%eax
3f: 84 .byte 0x84