usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: syz usb 1-1: Manufacturer: syz usb 1-1: SerialNumber: syz Unable to handle kernel paging request at virtual address dfff800000000001 KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] Mem abort info: ESR = 0x0000000096000005 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x05: level 1 translation fault Data abort info: ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0 [dfff800000000001] address between user and kernel address ranges Internal error: Oops: 0000000096000005 [#1] SMP Modules linked in: CPU: 0 UID: 0 PID: 6827 Comm: kworker/0:12 Tainted: G L syzkaller #0 PREEMPT Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 Workqueue: usb_hub_wq hub_event pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : usbtest_probe+0x40c/0xa6c drivers/usb/misc/usbtest.c:2822 lr : usbtest_probe+0x3f8/0xa6c drivers/usb/misc/usbtest.c:2822 sp : ffff800092d26f20 x29: ffff800092d26f50 x28: ffff0000d85220b0 x27: dfff800000000000 x26: ffff80008730aba0 x25: 1fffe0001e41621a x24: ffff0000d8522000 x23: 1fffe0001e416200 x22: 000000000000000a x21: ffff0000f20b1000 x20: 0000000000000000 x19: ffff0000c730c000 x18: 000000000002a180 x17: 000000000004fffd x16: 000000000004fffe x15: ffff8000824e8a50 x14: ffff8000824f370c x13: 0000000000000001 x12: 0000000000000000 x11: ffff80008a590e28 x10: 0000000000000001 x9 : 0000000000000000 x8 : 0000000000000001 x7 : 0000000000000000 x6 : ffff80008311bf58 x5 : ffff0000c9f71308 x4 : 0000000000000008 x3 : ffff8000834e8364 x2 : 00000000ffffffff x1 : ffff0000d3e9ba80 x0 : 0000000000000000 Call trace: usbtest_probe+0x40c/0xa6c drivers/usb/misc/usbtest.c:2822 (P) usb_probe_interface+0x308/0x788 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x29c/0x800 drivers/base/dd.c:706 __driver_probe_device+0x1e0/0x350 drivers/base/dd.c:868 driver_probe_device+0x6c/0x19c drivers/base/dd.c:898 __device_attach_driver+0x198/0x2f8 drivers/base/dd.c:1026 bus_for_each_drv+0x144/0x1dc drivers/base/bus.c:500 __device_attach+0x248/0x390 drivers/base/dd.c:1098 device_initial_probe+0x90/0xc8 drivers/base/dd.c:1153 bus_probe_device+0x58/0x120 drivers/base/bus.c:620 device_add+0x6cc/0x9e0 drivers/base/core.c:3772 usb_set_configuration+0x1184/0x158c drivers/usb/core/message.c:2268 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:250 usb_probe_device+0x114/0x2b0 drivers/usb/core/driver.c:291 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x29c/0x800 drivers/base/dd.c:706 __driver_probe_device+0x1e0/0x350 drivers/base/dd.c:868 driver_probe_device+0x6c/0x19c drivers/base/dd.c:898 __device_attach_driver+0x198/0x2f8 drivers/base/dd.c:1026 bus_for_each_drv+0x144/0x1dc drivers/base/bus.c:500 __device_attach+0x248/0x390 drivers/base/dd.c:1098 device_initial_probe+0x90/0xc8 drivers/base/dd.c:1153 bus_probe_device+0x58/0x120 drivers/base/bus.c:620 device_add+0x6cc/0x9e0 drivers/base/core.c:3772 usb_new_device+0x9bc/0x11f0 drivers/usb/core/hub.c:2695 hub_port_connect drivers/usb/core/hub.c:5567 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x1ef0/0x39fc drivers/usb/core/hub.c:5953 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0x788/0x10b8 kernel/workqueue.c:3405 worker_thread+0x798/0xbd0 kernel/workqueue.c:3486 kthread+0x304/0x3d4 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:842 Code: 9745b896 14000016 91002a96 d343fec8 (38fb6908) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: 9745b896 bl 0xfffffffffd16e258 4: 14000016 b 0x5c 8: 91002a96 add x22, x20, #0xa c: d343fec8 lsr x8, x22, #3 * 10: 38fb6908 ldrsb w8, [x8, x27] <-- trapping instruction