program: syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000140)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x2a9e524, [{{0x9, 0x2, 0x48}}]}}, 0x0) mkdir(&(0x7f0000000000)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="00000000090209000101008001120100020000004000000000000000000001", 0x1f) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) syz_mount_image$squashfs(&(0x7f0000000200), &(0x7f0000000240)='./file0\x00', 0x0, &(0x7f0000000280), 0x1, 0x1cf, &(0x7f00000002c0)="$eJzKKC4sZmdgYPj7sSaZgUGAAQQYGXgYLjAwMrAwMDCoMzJAABOEWg/lv4DSM6HSNlB+M5ReCKUrbmmvW3PK78xJT12tZbLMDK2e2vLIYnKpPUZukot5JJgZQlOPLCqurMpOzMlJLSpeyFBxKzmp4vQJBpbr9tdUmiU4Hf7IczgkaTroMB3x8cia0VjCOUlKU4yNLVPh7JkP8uvYNI4wPFrBvLHOM6+xrjB1al5aXlJVVlXWvIkTN85s7GxsXDmxLirNbxVjS4rLpqZORiaHLWoCm5kN1SfZaE94177qYZIDa4+HX/MpY6XXqcyXjBcWSZ1aUTVzwhel2YyG3xnu8JStkNDQcJK4ImHRYMJwpM62wRXkxJQGhjSFMMYkNTaxti1n5oQw87O5LVBoST7BFHqUY+lMCYsDQlUnf1pqvnVIdJux7akD2xmew8d51hT0CRodl2BwWij4XwZkTEJDQ5nGWqaltgu+FGn8lfBabeyUweBuz7QMFqAsDSByJZQnC9aTkLzCQ0dT0yglOaFhk0RCkluBoTLD1j2cqwUaGJCiTYWBgWE7VCMsOq/BGKNgFIyCUTAKRsEoGAWjYBSMglEwCkYEAAQAAP//QICYyw==") mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) mkdir(&(0x7f0000000100)='./debugfs\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./debugfs\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./debugfs/ubifs/chk_index\x00', 0x2, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debugfs/ubifs/chk_index\x00', 0x2, 0x0) pread64(r2, 0x0, 0x0, 0x0) open(&(0x7f00000004c0)='./file0\x00', 0x400400, 0x24) write(r1, &(0x7f0000000200)='dummy_hcd.0', 0xb) (async) write(r1, &(0x7f0000000200)='dummy_hcd.0', 0xb) syz_clone(0x0, &(0x7f0000000040)="0859ba4206a9de58b8d83b675925bc8fc22bbdf0c80a7d72f519883e6731693b5f93", 0x22, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="9d05a241c3e3fc3ba62cc6d1ba3721b4f65f27f43a191bf3aa6a") (async) syz_clone(0x0, &(0x7f0000000040)="0859ba4206a9de58b8d83b675925bc8fc22bbdf0c80a7d72f519883e6731693b5f93", 0x22, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="9d05a241c3e3fc3ba62cc6d1ba3721b4f65f27f43a191bf3aa6a") [ 87.022249][ T5285] Bluetooth: hci0: command tx timeout [ 87.425480][ T5319] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 87.585894][ T5319] usb 5-1: too many configurations: 36, using maximum allowed: 8 [ 87.603772][ T5319] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 87.608671][ T5319] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 87.612086][ T5319] usb 5-1: Product: syz [ 87.613934][ T5319] usb 5-1: Manufacturer: syz [ 87.618437][ T5319] usb 5-1: SerialNumber: syz [ 87.692455][ T5308] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 87.903349][ T5322] gadgetfs expected dummy_udc controller not usbip-vudc [ 87.908574][ T5322] udc usbip-vudc.0: failed to start USB Gadget filesystem: -19 [ 87.927013][ T5322] UDC core: USB Gadget filesystem: couldn't find an available UDC [ 87.940247][ T5322] loop0: detected capacity change from 0 to 8 [ 87.977633][ T5322] squashfs image failed sanity check [ 88.027115][ T5322] dummy_hcd dummy_hcd.0: remove, state 1 [ 88.041052][ T5322] usb usb5: USB disconnect, device number 1 [ 88.055110][ T5322] usb 5-1: USB disconnect, device number 2 [ 88.794908][ T5308] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 88.799679][ T5308] ath9k_htc: Failed to initialize the device [ 88.804555][ T5322] usb 5-1: ath9k_htc: USB layer deinitialized [ 88.874316][ T5322] dummy_hcd dummy_hcd.0: stopped [ 88.881807][ T5322] dummy_hcd dummy_hcd.0: USB bus 5 deregistered [ 88.927951][ T5322] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI [ 88.933683][ T5322] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 88.937666][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 88.942214][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 88.946916][ T5322] RIP: 0010:set_link_state+0x27/0x1000 [ 88.949611][ T5322] Code: 90 90 90 55 41 57 41 56 41 55 41 54 53 48 83 ec 38 49 89 fe 48 bb 00 00 00 00 00 fc ff df e8 a0 ad 0e fa 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 3b e0 7d fa 49 8b 16 4d 8d a6 a3 00 [ 88.958293][ T5322] RSP: 0018:ffffc9000f207780 EFLAGS: 00010046 [ 88.961002][ T5322] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff888038930000 [ 88.964953][ T5322] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 88.969229][ T5322] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004 [ 88.973260][ T5322] R10: dffffc0000000000 R11: fffff52001e40eec R12: 0000000000000246 [ 88.977107][ T5322] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 [ 88.981919][ T5322] FS: 0000000000000000(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 88.986580][ T5322] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 88.990429][ T5322] CR2: 00007fe2c4ff5990 CR3: 0000000051496000 CR4: 0000000000352ef0 [ 88.994429][ T5322] Call Trace: [ 88.996379][ T5322] [ 88.998221][ T5322] ? rcu_is_watching+0x15/0xb0 [ 89.000721][ T5322] ? __pfx_dummy_pullup+0x10/0x10 [ 89.003004][ T5322] dummy_pullup+0xc4/0x120 [ 89.005217][ T5322] ? __pfx_dummy_pullup+0x10/0x10 [ 89.008042][ T5322] usb_gadget_disconnect_locked+0x126/0x480 [ 89.011408][ T5322] gadget_unbind_driver+0xc2/0x410 [ 89.014146][ T5322] ? __pfx_gadget_unbind_driver+0x10/0x10 [ 89.016774][ T5322] device_release_driver_internal+0x48b/0x880 [ 89.019732][ T5322] driver_detach+0x1f3/0x2d0 [ 89.022173][ T5322] bus_remove_driver+0x226/0x320 [ 89.024912][ T5322] usb_gadget_unregister_driver+0x4e/0x70 [ 89.028064][ T5322] raw_release+0xd7/0x260 [ 89.030110][ T5322] ? __pfx_raw_release+0x10/0x10 [ 89.032362][ T5322] __fput+0x418/0xa50 [ 89.034317][ T5322] task_work_run+0x1d9/0x270 [ 89.036817][ T5322] ? __pfx_task_work_run+0x10/0x10 [ 89.039622][ T5322] ? do_raw_spin_unlock+0x4d/0x210 [ 89.042348][ T5322] do_exit+0x73a/0x2360 [ 89.044540][ T5322] ? __pfx___resched_curr+0x10/0x10 [ 89.047379][ T5322] ? __pfx_do_exit+0x10/0x10 [ 89.049927][ T5322] ? do_raw_spin_lock+0x12b/0x2f0 [ 89.052600][ T5322] do_group_exit+0x22d/0x2f0 [ 89.055217][ T5322] ? _raw_spin_unlock_irq+0x23/0x50 [ 89.058138][ T5322] get_signal+0x121b/0x12c0 [ 89.060371][ T5322] arch_do_signal_or_restart+0xbb/0x860 [ 89.063162][ T5322] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 89.066356][ T5322] ? ksys_write+0x242/0x270 [ 89.068761][ T5322] exit_to_user_mode_loop+0x104/0x730 [ 89.071290][ T5322] ? rcu_is_watching+0x15/0xb0 [ 89.073515][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.076326][ T5322] do_syscall_64+0x353/0x580 [ 89.078595][ T5322] ? clear_bhb_loop+0x40/0x90 [ 89.081139][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.084326][ T5322] RIP: 0033:0x7fe2c8b9e0d9 [ 89.086473][ T5322] Code: Unable to access opcode bytes at 0x7fe2c8b9e0af. [ 89.089876][ T5322] RSP: 002b:00007fe2c999cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 89.094225][ T5322] RAX: 000000000000000b RBX: 00007fe2c8e25fa0 RCX: 00007fe2c8b9e0d9 [ 89.098305][ T5322] RDX: 000000000000000b RSI: 0000200000000200 RDI: 0000000000000004 [ 89.102468][ T5322] RBP: 00007fe2c8c35024 R08: 0000000000000000 R09: 0000000000000000 [ 89.106618][ T5322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 89.110335][ T5322] R13: 00007fe2c8e26038 R14: 00007fe2c8e25fa0 R15: 00007ffc2b6a26c8 [ 89.113780][ T5322] [ 89.115258][ T5322] Modules linked in: [ 89.117301][ T5322] ---[ end trace 0000000000000000 ]--- [ 89.120453][ T5322] RIP: 0010:set_link_state+0x27/0x1000 [ 89.122958][ T5322] Code: 90 90 90 55 41 57 41 56 41 55 41 54 53 48 83 ec 38 49 89 fe 48 bb 00 00 00 00 00 fc ff df e8 a0 ad 0e fa 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 3b e0 7d fa 49 8b 16 4d 8d a6 a3 00 [ 89.131591][ T5322] RSP: 0018:ffffc9000f207780 EFLAGS: 00010046 [ 89.134936][ T5322] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff888038930000 [ 89.138582][ T5322] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 89.141890][ T5322] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004 [ 89.145506][ T5322] R10: dffffc0000000000 R11: fffff52001e40eec R12: 0000000000000246 [ 89.149558][ T5322] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 [ 89.153189][ T5322] FS: 0000000000000000(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 89.156851][ T5322] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 89.160032][ T5322] CR2: 00007fe2c4ff5990 CR3: 0000000051496000 CR4: 0000000000352ef0 [ 89.164035][ T5322] Kernel panic - not syncing: Fatal exception [ 89.167341][ T5322] Kernel Offset: disabled [ 89.169433][ T5322] Rebooting in 86400 seconds..