program: r0 = syz_open_dev$vbi(&(0x7f0000000340), 0x0, 0x2) (async) mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) (async) mkdir(&(0x7f0000000200)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000300)='./my_configfs/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) (async) mkdir(&(0x7f0000000400)='./my_configfs/target/usb_gadget\x00', 0x1ff) (async) mkdir(&(0x7f0000000500)='./my_configfs/target/usb_gadget/naa.1234567890abcdef\x00', 0x1ff) mkdir(&(0x7f0000000600)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1\x00', 0x1ff) mkdir(&(0x7f0000000d00)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000001500)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0/alua_tg_pt_offline\x00', 0x800, 0x0) (async) ioctl$VIDIOC_S_INPUT(r0, 0xc0045627, &(0x7f00000000c0)=0x3) (async) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000200)={0x0, @bt={0x8a5, 0x90, 0x1, 0x2, 0xd59f80, 0x19ef, 0x6, 0x19ef, 0x3, 0x6, 0x27ff, 0x2800, 0x2, 0xbb6, 0x0, 0x8, {0x8, 0xffffffff}, 0xd0, 0x9}}) [ 155.054722][ T5299] Bluetooth: hci0: command tx timeout [ 155.100794][ T5337] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI [ 155.106088][ T5337] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] [ 155.109586][ T5337] CPU: 0 UID: 0 PID: 5337 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 155.113296][ T5337] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 155.117411][ T5337] RIP: 0010:configfs_depend_item_unlocked+0x96/0x420 [ 155.120219][ T5337] Code: df e8 0e 88 00 00 89 c5 31 ff 89 c6 e8 a3 24 4f ff 85 ed 74 0a e8 5a 20 4f ff 4d 89 fd eb 6c 48 8d 7b 60 48 89 f8 48 c1 e8 03 <42> 80 3c 30 00 74 05 e8 de 52 be ff 4c 8b 6b 60 48 89 df e8 d2 87 [ 155.127901][ T5337] RSP: 0018:ffffc9000da27ad8 EFLAGS: 00010206 [ 155.130429][ T5337] RAX: 000000000000000c RBX: 0000000000000000 RCX: 0000000000000000 [ 155.133701][ T5337] RDX: ffff888000610000 RSI: 0000000000000000 RDI: 0000000000000060 [ 155.136932][ T5337] RBP: 0000000000000000 R08: ffffffff9057c237 R09: 1ffffffff20af846 [ 155.140188][ T5337] R10: dffffc0000000000 R11: fffffbfff20af847 R12: ffffffff8f71d360 [ 155.143437][ T5337] R13: dffffc0000000000 R14: dffffc0000000000 R15: ffff88801fd54400 [ 155.146645][ T5337] FS: 00007fe4d68e66c0(0000) GS:ffff88808c53f000(0000) knlGS:0000000000000000 [ 155.150252][ T5337] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 155.153019][ T5337] CR2: 00007fe4d68e5ff8 CR3: 0000000012dc0000 CR4: 0000000000352ef0 [ 155.156390][ T5337] Call Trace: [ 155.157808][ T5337] [ 155.158939][ T5337] usbg_make_tpg+0x1f6/0x590 [ 155.160702][ T5337] ? configfs_mkdir+0x4b0/0x9e0 [ 155.162662][ T5337] ? __pfx___mutex_lock+0x10/0x10 [ 155.164785][ T5337] ? __pfx_usbg_make_tpg+0x10/0x10 [ 155.167094][ T5337] ? do_raw_spin_lock+0x12b/0x2f0 [ 155.169326][ T5337] target_fabric_make_tpg+0xa8/0x6d0 [ 155.171666][ T5337] configfs_mkdir+0x4f6/0x9e0 [ 155.173770][ T5337] ? d_splice_alias+0x12/0x30 [ 155.175723][ T5337] ? __pfx_configfs_mkdir+0x10/0x10 [ 155.177756][ T5337] ? generic_permission+0x2bf/0x670 [ 155.179709][ T5337] ? bpf_lsm_inode_mkdir+0x9/0x20 [ 155.181713][ T5337] vfs_mkdir+0x406/0x620 [ 155.183392][ T5337] filename_mkdirat+0x285/0x510 [ 155.185371][ T5337] ? __pfx_filename_mkdirat+0x10/0x10 [ 155.187589][ T5337] ? do_getname+0x151/0x250 [ 155.189457][ T5337] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 155.191953][ T5337] __se_sys_mkdir+0x34/0x150 [ 155.193894][ T5337] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 155.196367][ T5337] do_syscall_64+0x174/0x580 [ 155.198334][ T5337] ? trace_irq_disable+0x3b/0x140 [ 155.200523][ T5337] ? clear_bhb_loop+0x40/0x90 [ 155.202575][ T5337] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 155.205165][ T5337] RIP: 0033:0x7fe4d599e019 [ 155.207110][ T5337] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 155.214920][ T5337] RSP: 002b:00007fe4d68e5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 155.218093][ T5337] RAX: ffffffffffffffda RBX: 00007fe4d5c26090 RCX: 00007fe4d599e019 [ 155.221109][ T5337] RDX: 0000000000000000 RSI: 00000000000001ff RDI: 0000200000000600 [ 155.224161][ T5337] RBP: 00007fe4d5a3500c R08: 0000000000000000 R09: 0000000000000000 [ 155.226893][ T5337] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 155.229874][ T5337] R13: 00007fe4d5c26128 R14: 00007fe4d5c26090 R15: 00007fff84da3d08 [ 155.233221][ T5337] [ 155.234526][ T5337] Modules linked in: [ 155.236418][ T5337] ---[ end trace 0000000000000000 ]--- [ 155.244321][ T5337] RIP: 0010:configfs_depend_item_unlocked+0x96/0x420 [ 155.247152][ T5337] Code: df e8 0e 88 00 00 89 c5 31 ff 89 c6 e8 a3 24 4f ff 85 ed 74 0a e8 5a 20 4f ff 4d 89 fd eb 6c 48 8d 7b 60 48 89 f8 48 c1 e8 03 <42> 80 3c 30 00 74 05 e8 de 52 be ff 4c 8b 6b 60 48 89 df e8 d2 87 [ 155.255272][ T5337] RSP: 0018:ffffc9000da27ad8 EFLAGS: 00010206 [ 155.258313][ T5337] RAX: 000000000000000c RBX: 0000000000000000 RCX: 0000000000000000 [ 155.261959][ T5337] RDX: ffff888000610000 RSI: 0000000000000000 RDI: 0000000000000060 [ 155.265215][ T5337] RBP: 0000000000000000 R08: ffffffff9057c237 R09: 1ffffffff20af846 [ 155.268938][ T5337] R10: dffffc0000000000 R11: fffffbfff20af847 R12: ffffffff8f71d360 [ 155.272082][ T5337] R13: dffffc0000000000 R14: dffffc0000000000 R15: ffff88801fd54400 [ 155.275448][ T5337] FS: 00007fe4d68e66c0(0000) GS:ffff88808c53f000(0000) knlGS:0000000000000000 [ 155.279473][ T5337] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 155.282233][ T5337] CR2: 0000000000000000 CR3: 0000000012dc0000 CR4: 0000000000352ef0 [ 155.285513][ T5337] Kernel panic - not syncing: Fatal exception [ 155.288242][ T5337] Kernel Offset: disabled [ 155.290013][ T5337] Rebooting in 86400 seconds..