program: r0 = socket(0x10, 0x2, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@newqdisc={0x24, 0x24, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {}, {0x0, 0xb}}}, 0x24}}, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x3, 0xebca, 0x0, 0x8000, 0x0, 0xfffffffe, 0x2, 0x2, 0x80000000}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20048010}, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000400)=ANY=[], 0x0) (async) syz_usb_connect(0x0, 0x24, &(0x7f0000000400)=ANY=[], 0x0) syz_usb_disconnect(0xffffffffffffffff) (async) syz_usb_disconnect(0xffffffffffffffff) r2 = syz_open_dev$usbfs(&(0x7f0000000180), 0x10000001d, 0x8041) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000200)=@usbdevfs_connect) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newtfilter={0x24, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0xfff1}, {0x0, 0x2}, {0xfff2}}}, 0x24}}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newtfilter={0x24, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0xfff1}, {0x0, 0x2}, {0xfff2}}}, 0x24}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$IPCTNL_MSG_CT_GET_STATS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x5, 0x1, 0x101, 0x0, 0x0, {0x2, 0x0, 0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x8050}, 0x20040090) (async) sendmsg$IPCTNL_MSG_CT_GET_STATS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x5, 0x1, 0x101, 0x0, 0x0, {0x2, 0x0, 0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x8050}, 0x20040090) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f000000c300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a40000000160a03020000000000000000020000000900020073797a31070000000900010073797a3000000000140003800800024000000000080001400000000014000000110001"], 0x68}}, 0x0) sendmsg$NFT_MSG_GETFLOWTABLE(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000c00)={0x2c, 0x17, 0xa, 0xc03, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}]}, 0x2c}}, 0x0) pipe(&(0x7f0000000100)) (async) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) write$cgroup_devices(r6, &(0x7f0000000080)=ANY=[@ANYBLOB='b *:* m'], 0x8) (async) write$cgroup_devices(r6, &(0x7f0000000080)=ANY=[@ANYBLOB='b *:* m'], 0x8) truncate(&(0x7f0000000580)='./file0/file0\x00', 0x4) (async) truncate(&(0x7f0000000580)='./file0/file0\x00', 0x4) r7 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r7, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="3000002b7d2d9eb181dfc574002000010000000000000000000a0080000000000812000000140019ccfe800000000000"], 0x30}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r10, @ANYBLOB="1f003300d00000000802110000010802110000005050505050500000", @ANYRES8=r8], 0x3c}}, 0x0) (async) sendmsg$NL80211_CMD_FRAME(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r10, @ANYBLOB="1f003300d00000000802110000010802110000005050505050500000", @ANYRES8=r8], 0x3c}}, 0x0) sendmsg$NL80211_CMD_NOTIFY_RADAR(r7, &(0x7f0000000540)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000500)={&(0x7f0000000380)=ANY=[@ANYBLOB="34000001", @ANYRES16=r9, @ANYBLOB="00032cbd7000fbdbdf25860000000800270002000000080022016d02000008002700020000000800270002000000"], 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r11 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r12 = openat$cgroup_devices(r11, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0) splice(r5, 0x0, r12, 0x0, 0x8, 0x0) [ 68.453156][ T4662] Bluetooth: hci0: command tx timeout [ 68.531677][ T5317] sysfs: cannot create duplicate filename '/module/raw_gadget' [ 68.534917][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted 6.15.0-rc5-syzkaller-00043-gd76bb1ebb558 #0 PREEMPT(full) [ 68.534933][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 68.534940][ T5317] Call Trace: [ 68.534945][ T5317] [ 68.534950][ T5317] dump_stack_lvl+0x189/0x250 [ 68.535060][ T5317] ? __pfx_dump_stack_lvl+0x10/0x10 [ 68.535073][ T5317] ? __pfx__printk+0x10/0x10 [ 68.535083][ T5317] ? kernfs_path_from_node+0x2b/0x260 [ 68.535124][ T5317] ? kernfs_path_from_node+0x2b/0x260 [ 68.535136][ T5317] ? kernfs_path_from_node+0x2b/0x260 [ 68.535149][ T5317] ? kernfs_path_from_node+0x216/0x260 [ 68.535164][ T5317] sysfs_create_dir_ns+0x259/0x280 [ 68.535178][ T5317] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 68.535192][ T5317] ? do_raw_spin_unlock+0x4d/0x240 [ 68.535206][ T5317] kobject_add_internal+0x59f/0xb40 [ 68.535252][ T5317] kobject_init_and_add+0x125/0x190 [ 68.535268][ T5317] ? __pfx_kobject_init_and_add+0x10/0x10 [ 68.535281][ T5317] ? __kasan_kmalloc+0x93/0xb0 [ 68.535293][ T5317] ? __kmalloc_cache_noprof+0x230/0x3d0 [ 68.535305][ T5317] ? lookup_or_create_module_kobject+0x75/0x170 [ 68.535317][ T5317] lookup_or_create_module_kobject+0xe3/0x170 [ 68.535329][ T5317] module_add_driver+0xb9/0x310 [ 68.535342][ T5317] bus_add_driver+0x391/0x640 [ 68.535355][ T5317] driver_register+0x23a/0x320 [ 68.535376][ T5317] usb_gadget_register_driver_owner+0xf9/0x270 [ 68.535394][ T5317] raw_ioctl+0x149a/0x3c90 [ 68.535410][ T5317] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 68.535426][ T5317] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 68.535440][ T5317] ? tomoyo_path_number_perm+0x4e2/0x5a0 [ 68.535453][ T5317] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 68.535467][ T5317] ? __pfx_raw_ioctl+0x10/0x10 [ 68.535483][ T5317] ? count_memcg_event_mm+0x92/0x3b0 [ 68.535498][ T5317] ? __lock_acquire+0xaac/0xd20 [ 68.535520][ T5317] ? __fget_files+0x2a/0x420 [ 68.535535][ T5317] ? __fget_files+0x3a0/0x420 [ 68.535547][ T5317] ? __fget_files+0x2a/0x420 [ 68.535560][ T5317] ? bpf_lsm_file_ioctl+0x9/0x20 [ 68.535572][ T5317] ? __pfx_raw_ioctl+0x10/0x10 [ 68.535584][ T5317] __se_sys_ioctl+0xf9/0x170 [ 68.535595][ T5317] do_syscall_64+0xf6/0x210 [ 68.535608][ T5317] ? clear_bhb_loop+0x45/0xa0 [ 68.535621][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 68.535631][ T5317] RIP: 0033:0x7f6a1f98e56b [ 68.535642][ T5317] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 68.535649][ T5317] RSP: 002b:00007f6a20889f10 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 68.535658][ T5317] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007f6a1f98e56b [ 68.535663][ T5317] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000005 [ 68.535667][ T5317] RBP: 00007f6a2088afe0 R08: 0000000000000000 R09: 00302e6364755f79 [ 68.535671][ T5317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 68.535675][ T5317] R13: 00007f6a20889fb0 R14: 0000200000000400 R15: 00007f6a1fce0b88 [ 68.535687][ T5317] [ 68.535708][ T5317] kobject: kobject_add_internal failed for raw_gadget with -EEXIST, don't try to register things with the same name in the same directory. [ 68.683873][ T5317] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN NOPTI [ 68.688963][ T5317] KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] [ 68.692435][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted 6.15.0-rc5-syzkaller-00043-gd76bb1ebb558 #0 PREEMPT(full) [ 68.697164][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 68.701669][ T5317] RIP: 0010:kasan_byte_accessible+0x12/0x30 [ 68.704397][ T5317] Code: 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cc cc cc cc 66 66 66 66 66 66 2e [ 68.712921][ T5317] RSP: 0018:ffffc9000fea7840 EFLAGS: 00010002 [ 68.715526][ T5317] RAX: dffffc0000000000 RBX: ffffffff8b58a807 RCX: 410933b2ef012f00 [ 68.718845][ T5317] RDX: 0000000000000000 RSI: ffffffff8b58a807 RDI: 0000000000000004 [ 68.722390][ T5317] RBP: ffffffff819b49d8 R08: 0000000000000001 R09: 0000000000000000 [ 68.725607][ T5317] R10: dffffc0000000000 R11: fffffbfff1efdb2f R12: 0000000000000000 [ 68.728817][ T5317] R13: 0000000000000020 R14: 0000000000000020 R15: 0000000000000001 [ 68.732107][ T5317] FS: 00007f6a2088c6c0(0000) GS:ffff88808d6cb000(0000) knlGS:0000000000000000 [ 68.735741][ T5317] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 68.738573][ T5317] CR2: 00007f6a2088afe0 CR3: 000000003b4f1000 CR4: 0000000000352ef0 [ 68.742089][ T5317] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 68.745543][ T5317] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 68.748828][ T5317] Call Trace: [ 68.750314][ T5317] [ 68.751654][ T5317] __kasan_check_byte+0x12/0x40 [ 68.753641][ T5317] lock_acquire+0x8d/0x360 [ 68.755608][ T5317] ? kobj_kset_leave+0x163/0x190 [ 68.757716][ T5317] _raw_spin_lock_irqsave+0xa7/0xf0 [ 68.759901][ T5317] ? complete+0x28/0x1b0 [ 68.761724][ T5317] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 68.764380][ T5317] ? kobject_init_and_add+0x125/0x190 [ 68.766904][ T5317] complete+0x28/0x1b0 [ 68.768790][ T5317] kobject_put+0x228/0x480 [ 68.770822][ T5317] lookup_or_create_module_kobject+0x150/0x170 [ 68.773097][ T5317] module_add_driver+0xb9/0x310 [ 68.774979][ T5317] bus_add_driver+0x391/0x640 [ 68.776752][ T5317] driver_register+0x23a/0x320 [ 68.778472][ T5317] usb_gadget_register_driver_owner+0xf9/0x270 [ 68.780921][ T5317] raw_ioctl+0x149a/0x3c90 [ 68.782753][ T5317] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 68.785015][ T5317] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 68.787254][ T5317] ? tomoyo_path_number_perm+0x4e2/0x5a0 [ 68.789497][ T5317] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 68.791824][ T5317] ? __pfx_raw_ioctl+0x10/0x10 [ 68.793806][ T5317] ? count_memcg_event_mm+0x92/0x3b0 [ 68.796091][ T5317] ? __lock_acquire+0xaac/0xd20 [ 68.798303][ T5317] ? __fget_files+0x2a/0x420 [ 68.800261][ T5317] ? __fget_files+0x3a0/0x420 [ 68.802375][ T5317] ? __fget_files+0x2a/0x420 [ 68.804321][ T5317] ? bpf_lsm_file_ioctl+0x9/0x20 [ 68.806374][ T5317] ? __pfx_raw_ioctl+0x10/0x10 [ 68.808276][ T5317] __se_sys_ioctl+0xf9/0x170 [ 68.810163][ T5317] do_syscall_64+0xf6/0x210 [ 68.811931][ T5317] ? clear_bhb_loop+0x45/0xa0 [ 68.813750][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 68.816069][ T5317] RIP: 0033:0x7f6a1f98e56b [ 68.818051][ T5317] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 68.825787][ T5317] RSP: 002b:00007f6a20889f10 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 68.829174][ T5317] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007f6a1f98e56b [ 68.832203][ T5317] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000005 [ 68.835337][ T5317] RBP: 00007f6a2088afe0 R08: 0000000000000000 R09: 00302e6364755f79 [ 68.838414][ T5317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 68.841370][ T5317] R13: 00007f6a20889fb0 R14: 0000200000000400 R15: 00007f6a1fce0b88 [ 68.844549][ T5317] [ 68.845880][ T5317] Modules linked in: [ 68.847481][ T5317] ---[ end trace 0000000000000000 ]--- [ 68.849765][ T5317] RIP: 0010:kasan_byte_accessible+0x12/0x30 [ 68.852268][ T5317] Code: 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cc cc cc cc 66 66 66 66 66 66 2e [ 68.859969][ T5317] RSP: 0018:ffffc9000fea7840 EFLAGS: 00010002 [ 68.862495][ T5317] RAX: dffffc0000000000 RBX: ffffffff8b58a807 RCX: 410933b2ef012f00 [ 68.865595][ T5317] RDX: 0000000000000000 RSI: ffffffff8b58a807 RDI: 0000000000000004 [ 68.868530][ T5317] RBP: ffffffff819b49d8 R08: 0000000000000001 R09: 0000000000000000 [ 68.871855][ T5317] R10: dffffc0000000000 R11: fffffbfff1efdb2f R12: 0000000000000000 [ 68.875029][ T5317] R13: 0000000000000020 R14: 0000000000000020 R15: 0000000000000001 [ 68.878087][ T5317] FS: 00007f6a2088c6c0(0000) GS:ffff88808d6cb000(0000) knlGS:0000000000000000 [ 68.881768][ T5317] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 68.884314][ T5317] CR2: 00007f6a2088afe0 CR3: 000000003b4f1000 CR4: 0000000000352ef0 [ 68.887637][ T5317] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 68.891030][ T5317] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 68.894216][ T5317] Kernel panic - not syncing: Fatal exception [ 68.897044][ T5317] Kernel Offset: disabled [ 68.898773][ T5317] Rebooting in 86400 seconds..