8<--- cut here --- Unable to handle kernel NULL pointer dereference at virtual address 00000000 when read [00000000] *pgd=8647d003, *pmd=df772003 Internal error: Oops: 205 [#1] SMP ARM Modules linked in: CPU: 1 UID: 0 PID: 8343 Comm: syz.0.1250 Tainted: G L syzkaller #0 PREEMPT Tainted: [L]=SOFTLOCKUP Hardware name: ARM-Versatile Express PC is at dummy_udc_start+0x28/0x80 drivers/usb/gadget/udc/dummy_hcd.c:1022 LR is at usb_gadget_udc_start_locked drivers/usb/gadget/udc/core.c:1237 [inline] LR is at gadget_bind_driver+0x164/0x2b0 drivers/usb/gadget/udc/core.c:1667 pc : [<810cae78>] lr : [<810c8aec>] psr: 60000013 sp : eab41d28 ip : eab41d48 fp : eab41d44 r10: 840f55c0 r9 : 00000003 r8 : 8417c224 r7 : 83e6e6f8 r6 : 851f080c r5 : 00000000 r4 : 8417c000 r3 : 00000002 r2 : 00000000 r1 : 00000000 r0 : 83e6e6b0 Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 30c5387d Table: 85cb87c0 DAC: 00000000 Register r0 information: slab kmalloc-4k start 83e6e000 pointer offset 1712 size 4096 Register r1 information: NULL pointer Register r2 information: NULL pointer Register r3 information: non-paged memory Register r4 information: slab kmalloc-1k start 8417c000 pointer offset 0 size 1024 Register r5 information: NULL pointer Register r6 information: slab kmalloc-2k start 851f0800 pointer offset 12 size 2048 Register r7 information: slab kmalloc-4k start 83e6e000 pointer offset 1784 size 4096 Register r8 information: slab kmalloc-1k start 8417c000 pointer offset 548 size 1024 Register r9 information: non-paged memory Register r10 information: slab task_struct start 840f55c0 pointer offset 0 size 3136 Register r11 information: 2-page vmalloc region starting at 0xeab40000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2766 Register r12 information: 2-page vmalloc region starting at 0xeab40000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2766 Process syz.0.1250 (pid: 8343, stack limit = 0xeab40000) Stack: (0xeab41d28 to 0xeab42000) 1d20: 8417c000 00000000 851f0830 83e6e6f8 eab41d6c eab41d48 1d40: 810c8aec 810cae5c 83e6e6f8 00000000 851f0830 00000000 0000002b 00000003 1d60: eab41d9c eab41d70 80be04cc 810c8994 eab41d9c eab41d80 80bf33c4 83e6e6f8 1d80: 851f0830 83e6e744 83e6e6f8 0000002b eab41dcc eab41da0 80be08a0 80be0400 1da0: eab41dd4 eab41db0 82d27194 82d271a4 83e6e744 83e6e6f8 0000002b 00000003 1dc0: eab41df4 eab41dd0 80be0afc 80be080c 83e6e6f8 851f0830 83e6e744 00000000 1de0: 84ed37b8 00000003 eab41e14 eab41df8 80be0d78 80be0acc 851f0830 80be0cb8 1e00: 833d4300 00000000 eab41e44 eab41e18 80bdddec 80be0cc4 81b7c108 833d4354 1e20: 84623034 ff795636 851f0830 84ed3780 00000000 833d4300 eab41e54 eab41e48 1e40: 80bdfd4c 80bddd74 eab41e84 eab41e58 80bdf4a4 80bdfd34 856f9d80 860bbd80 1e60: eab41e84 851f0830 860bbd81 851f0830 851f0804 860bbd80 eab41e9c eab41e88 1e80: 80be1e08 80bdf3a0 851f080c 860bbd81 eab41ebc eab41ea0 810c62e0 80be1d8c 1ea0: 851f0800 860bbd81 60000013 851f0804 eab41f14 eab41ec0 8112f4c8 810c6298 1ec0: 00005501 00000000 00000000 860bbd80 00000003 840f55c0 eab41ef4 eab41ee8 1ee0: 8080b8a0 ff795636 eab41f14 00000000 860bbd81 00005501 00000000 860bbd80 1f00: 00000003 840f55c0 eab41fa4 eab41f18 805bdf78 8112eae4 84f8f800 00000002 1f20: eab41f74 eab41f30 8023409c 8050486c eab41fb0 80234350 00480000 00000000 1f40: eab41f74 850bcc80 80234470 82a1ec20 00000a07 76fb1e31 eab41fb0 80233e80 1f60: 76fb0e00 00000003 eab41fac eab41f78 8023451c ff795636 00000000 00000000 1f80: 76fb1e38 76fb0e38 00000036 8020029c 840f55c0 00000036 00000000 eab41fa8 1fa0: 80200060 805bdd40 00000000 76fb1e38 00000003 00005501 00000000 76fb0dc8 1fc0: 00000000 76fb1e38 76fb0e38 00000036 00000000 76fb0e00 00000003 00480000 1fe0: 00000000 76fb0db0 00320000 001304dc 60000010 00000003 00000000 00000000 Call trace: [<810cae50>] (dummy_udc_start) from [<810c8aec>] (usb_gadget_udc_start_locked drivers/usb/gadget/udc/core.c:1237 [inline]) [<810cae50>] (dummy_udc_start) from [<810c8aec>] (gadget_bind_driver+0x164/0x2b0 drivers/usb/gadget/udc/core.c:1667) r7:83e6e6f8 r6:851f0830 r5:00000000 r4:8417c000 [<810c8988>] (gadget_bind_driver) from [<80be04cc>] (call_driver_probe drivers/base/dd.c:628 [inline]) [<810c8988>] (gadget_bind_driver) from [<80be04cc>] (really_probe+0xd8/0x40c drivers/base/dd.c:706) r9:00000003 r8:0000002b r7:00000000 r6:851f0830 r5:00000000 r4:83e6e6f8 [<80be03f4>] (really_probe) from [<80be08a0>] (__driver_probe_device+0xa0/0x21c drivers/base/dd.c:868) r8:0000002b r7:83e6e6f8 r6:83e6e744 r5:851f0830 r4:83e6e6f8 [<80be0800>] (__driver_probe_device) from [<80be0afc>] (driver_probe_device+0x3c/0xc0 drivers/base/dd.c:898) r9:00000003 r8:0000002b r7:83e6e6f8 r6:83e6e744 r5:82d271a4 r4:82d27194 [<80be0ac0>] (driver_probe_device) from [<80be0d78>] (__driver_attach+0xc0/0x1f0 drivers/base/dd.c:1292) r9:00000003 r8:84ed37b8 r7:00000000 r6:83e6e744 r5:851f0830 r4:83e6e6f8 [<80be0cb8>] (__driver_attach) from [<80bdddec>] (bus_for_each_dev+0x84/0xd4 drivers/base/bus.c:383) r7:00000000 r6:833d4300 r5:80be0cb8 r4:851f0830 [<80bddd68>] (bus_for_each_dev) from [<80bdfd4c>] (driver_attach+0x24/0x28 drivers/base/dd.c:1310) r7:833d4300 r6:00000000 r5:84ed3780 r4:851f0830 [<80bdfd28>] (driver_attach) from [<80bdf4a4>] (bus_add_driver+0x110/0x230 drivers/base/bus.c:763) [<80bdf394>] (bus_add_driver) from [<80be1e08>] (driver_register+0x88/0x124 drivers/base/driver.c:174) r8:860bbd80 r7:851f0804 r6:851f0830 r5:860bbd81 r4:851f0830 [<80be1d80>] (driver_register) from [<810c62e0>] (usb_gadget_register_driver_owner+0x54/0xec drivers/usb/gadget/udc/core.c:1752) r5:860bbd81 r4:851f080c [<810c628c>] (usb_gadget_register_driver_owner) from [<8112f4c8>] (raw_ioctl_run drivers/usb/gadget/legacy/raw_gadget.c:596 [inline]) [<810c628c>] (usb_gadget_register_driver_owner) from [<8112f4c8>] (raw_ioctl+0x9f0/0x1228 drivers/usb/gadget/legacy/raw_gadget.c:1307) r7:851f0804 r6:60000013 r5:860bbd81 r4:851f0800 [<8112ead8>] (raw_ioctl) from [<805bdf78>] (vfs_ioctl fs/ioctl.c:51 [inline]) [<8112ead8>] (raw_ioctl) from [<805bdf78>] (do_vfs_ioctl fs/ioctl.c:551 [inline]) [<8112ead8>] (raw_ioctl) from [<805bdf78>] (__do_sys_ioctl fs/ioctl.c:595 [inline]) [<8112ead8>] (raw_ioctl) from [<805bdf78>] (sys_ioctl+0x244/0xb5c fs/ioctl.c:583) r10:840f55c0 r9:00000003 r8:860bbd80 r7:00000000 r6:00005501 r5:860bbd81 r4:00000000 [<805bdd34>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67) Exception stack(0xeab41fa8 to 0xeab41ff0) 1fa0: 00000000 76fb1e38 00000003 00005501 00000000 76fb0dc8 1fc0: 00000000 76fb1e38 76fb0e38 00000036 00000000 76fb0e00 00000003 00480000 1fe0: 00000000 76fb0db0 00320000 001304dc r10:00000036 r9:840f55c0 r8:8020029c r7:00000036 r6:76fb0e38 r5:76fb1e38 r4:00000000 Code: 0a00000e e59012fc e2433001 e3530002 (e5915000) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: 0a00000e beq 0x40 4: e59012fc ldr r1, [r0, #764] @ 0x2fc 8: e2433001 sub r3, r3, #1 c: e3530002 cmp r3, #2 * 10: e5915000 ldr r5, [r1] <-- trapping instruction