program: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$rtc(0xffffffffffffff9c, &(0x7f0000000100), 0xe80, 0x0) (async) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100), 0xe80, 0x0) ioctl$RTC_IRQP_READ(r1, 0x40187014, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000009a40)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x4}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x801, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0xfffffffe}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x88}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./my_configfs\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./my_configfs/usb_gadget/g1\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./my_configfs/usb_gadget/g1\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./my_configfs/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff) syz_emit_ethernet(0x3e, &(0x7f0000000140)={@broadcast, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x4, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote}, @time_exceeded={0x5, 0x0, 0x0, 0xe0, 0x1, 0xe000, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x11, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x2c}}}}}}}, 0x0) (async) syz_emit_ethernet(0x3e, &(0x7f0000000140)={@broadcast, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x4, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote}, @time_exceeded={0x5, 0x0, 0x0, 0xe0, 0x1, 0xe000, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x11, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x2c}}}}}}}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000680)={@broadcast, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote}, @timestamp}}}}, 0x0) chdir(&(0x7f0000000b00)='./my_configfs/usb_gadget/g1/functions/uvc.usb0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='control/header/h\x00', 0x1ff) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='control/header/h\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000d00)='streaming/header/h\x00', 0x1ff) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000d00)='streaming/header/h\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='streaming/uncompressed/u\x00', 0x1ff) symlink(&(0x7f0000001000)='control/header/h\x00', &(0x7f0000001100)='control/class/fs/h\x00') (async) symlink(&(0x7f0000001000)='control/header/h\x00', &(0x7f0000001100)='control/class/fs/h\x00') symlink(&(0x7f0000001400)='streaming/uncompressed/u\x00', &(0x7f0000001500)='streaming/header/h/u\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f0000000280)='./binderfs2/custom1\x00', 0x800, 0x0) symlink(&(0x7f0000001600)='streaming/header/h\x00', &(0x7f0000001700)='streaming/class/fs/h\x00') (async) symlink(&(0x7f0000001600)='streaming/header/h\x00', &(0x7f0000001700)='streaming/class/fs/h\x00') symlink(&(0x7f0000001800)='streaming/header/h\x00', &(0x7f0000001900)='streaming/class/hs/h\x00') (async) symlink(&(0x7f0000001800)='streaming/header/h\x00', &(0x7f0000001900)='streaming/class/hs/h\x00') symlink(&(0x7f0000001a00)='streaming/header/h\x00', &(0x7f0000001b00)='streaming/class/ss/h\x00') fchdir(r3) symlink(&(0x7f0000001c00)='functions/uvc.usb0\x00', &(0x7f0000001d00)='configs/c.1/uvc.usb0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000001e00)='UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000001f00)='usbip-vudc.0', 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0xc}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_CT_DIRECTION={0x5}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x80}}, 0x0) (async) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0xc}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_CT_DIRECTION={0x5}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x80}}, 0x0) sendmsg$IPSET_CMD_LIST(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x5c, 0x7, 0x6, 0x3, 0x0, 0x0, {0x1, 0x0, 0x1}, [@IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x8}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x1ff}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4}, 0x0) (async) sendmsg$IPSET_CMD_LIST(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x5c, 0x7, 0x6, 0x3, 0x0, 0x0, {0x1, 0x0, 0x1}, [@IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x8}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x1ff}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4}, 0x0) syz_emit_ethernet(0x36, &(0x7f00000000c0)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) (async) syz_emit_ethernet(0x36, &(0x7f00000000c0)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) [ 93.188457][ T5327] configfs-gadget.g1 gadget.1: uvc: uvc_function_bind() [ 93.197211][ T5285] Bluetooth: hci0: command tx timeout [ 93.248762][ T1330] cfg80211: failed to load regulatory.db [ 93.289751][ T5327] Oops: general protection fault, probably for non-canonical address 0xdffffc00000000f2: 0000 [#1] SMP KASAN NOPTI [ 93.294438][ T5327] KASAN: null-ptr-deref in range [0x0000000000000790-0x0000000000000797] [ 93.297674][ T5327] CPU: 0 UID: 0 PID: 5327 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.301119][ T5327] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.305130][ T5327] RIP: 0010:uvcg_video_init+0x4e7/0x630 [ 93.307476][ T5327] Code: 89 63 60 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 aa 7b 67 fa 48 8b 1b 4c 8d bb 90 07 00 00 4c 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 ff e8 8a 7b 67 fa 4d 8b 3f 49 83 c7 30 [ 93.314966][ T5327] RSP: 0018:ffffc9000f727710 EFLAGS: 00010202 [ 93.317337][ T5327] RAX: 00000000000000f2 RBX: 0000000000000000 RCX: ffff8880342bca80 [ 93.320610][ T5327] RDX: 0000000000000000 RSI: ffffffff8e230455 RDI: ffffffff8c4bed80 [ 93.323802][ T5327] RBP: 1ffff1100267e914 R08: ffffffff9057b737 R09: 1ffffffff20af6e6 [ 93.327021][ T5327] R10: dffffc0000000000 R11: fffffbfff20af6e7 R12: fffffffffffffffc [ 93.330171][ T5327] R13: dffffc0000000000 R14: ffff8880133f48a0 R15: 0000000000000790 [ 93.333331][ T5327] FS: 00007f1db81f56c0(0000) GS:ffff88808c543000(0000) knlGS:0000000000000000 [ 93.336930][ T5327] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 93.339590][ T5327] CR2: 0000000000000000 CR3: 000000001237e000 CR4: 0000000000352ef0 [ 93.342878][ T5327] Call Trace: [ 93.344278][ T5327] [ 93.345504][ T5327] uvc_function_bind+0x1076/0x15a0 [ 93.347671][ T5327] usb_add_function+0x2e1/0x9f0 [ 93.349726][ T5327] configfs_composite_bind+0xde0/0x1410 [ 93.352021][ T5327] ? __pfx_configfs_composite_bind+0x10/0x10 [ 93.354507][ T5327] gadget_bind_driver+0x2ca/0x9e0 [ 93.356566][ T5327] ? __pfx_gadget_bind_driver+0x10/0x10 [ 93.358832][ T5327] really_probe+0x254/0xae0 [ 93.360795][ T5327] __driver_probe_device+0x1e8/0x360 [ 93.363069][ T5327] driver_probe_device+0x4f/0x240 [ 93.365208][ T5327] __driver_attach+0x339/0x600 [ 93.367341][ T5327] bus_for_each_dev+0x23b/0x2c0 [ 93.369443][ T5327] ? __pfx___driver_attach+0x10/0x10 [ 93.371669][ T5327] ? __pfx_bus_for_each_dev+0x10/0x10 [ 93.373936][ T5327] ? do_raw_spin_unlock+0x4d/0x210 [ 93.376122][ T5327] bus_add_driver+0x345/0x670 [ 93.378142][ T5327] driver_register+0x23a/0x320 [ 93.380181][ T5327] usb_gadget_register_driver_owner+0xf9/0x270 [ 93.382788][ T5327] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 93.385207][ T5327] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10 [ 93.387866][ T5327] configfs_write_iter+0x337/0x430 [ 93.390075][ T5327] vfs_write+0x612/0xba0 [ 93.391899][ T5327] ? __pfx_vfs_write+0x10/0x10 [ 93.393979][ T5327] ? __fget_files+0x2a/0x420 [ 93.395970][ T5327] ksys_write+0x150/0x270 [ 93.397855][ T5327] ? __pfx_ksys_write+0x10/0x10 [ 93.399915][ T5327] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.402504][ T5327] do_syscall_64+0x174/0x580 [ 93.404463][ T5327] ? trace_irq_disable+0x3b/0x140 [ 93.406622][ T5327] ? clear_bhb_loop+0x40/0x90 [ 93.408594][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.411161][ T5327] RIP: 0033:0x7f1dbbd9de99 [ 93.413098][ T5327] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.421161][ T5327] RSP: 002b:00007f1db81f4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 93.424680][ T5327] RAX: ffffffffffffffda RBX: 00007f1dbc025fa0 RCX: 00007f1dbbd9de99 [ 93.427876][ T5327] RDX: 000000000000000c RSI: 0000200000001f00 RDI: 0000000000000007 [ 93.430911][ T5327] RBP: 00007f1dbbe33eaf R08: 0000000000000000 R09: 0000000000000000 [ 93.433936][ T5327] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 93.436942][ T5327] R13: 00007f1dbc026038 R14: 00007f1dbc025fa0 R15: 00007ffe676efd98 [ 93.440038][ T5327] [ 93.441350][ T5327] Modules linked in: [ 93.443420][ T5327] ---[ end trace 0000000000000000 ]--- [ 93.470674][ T5327] RIP: 0010:uvcg_video_init+0x4e7/0x630 [ 93.473096][ T5327] Code: 89 63 60 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 aa 7b 67 fa 48 8b 1b 4c 8d bb 90 07 00 00 4c 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 ff e8 8a 7b 67 fa 4d 8b 3f 49 83 c7 30 [ 93.481224][ T5327] RSP: 0018:ffffc9000f727710 EFLAGS: 00010202 [ 93.483875][ T5327] RAX: 00000000000000f2 RBX: 0000000000000000 RCX: ffff8880342bca80 [ 93.487233][ T5327] RDX: 0000000000000000 RSI: ffffffff8e230455 RDI: ffffffff8c4bed80 [ 93.490579][ T5327] RBP: 1ffff1100267e914 R08: ffffffff9057b737 R09: 1ffffffff20af6e6 [ 93.494116][ T5327] R10: dffffc0000000000 R11: fffffbfff20af6e7 R12: fffffffffffffffc [ 93.497618][ T5327] R13: dffffc0000000000 R14: ffff8880133f48a0 R15: 0000000000000790 [ 93.501166][ T5327] FS: 00007f1db81f56c0(0000) GS:ffff88808c543000(0000) knlGS:0000000000000000 [ 93.505101][ T5327] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 93.508061][ T5327] CR2: 00007f7a93a8fe30 CR3: 000000001237e000 CR4: 0000000000352ef0 [ 93.512110][ T5327] Kernel panic - not syncing: Fatal exception [ 93.515144][ T5327] Kernel Offset: disabled [ 93.517071][ T5327] Rebooting in 86400 seconds..