8<--- cut here --- Unable to handle kernel NULL pointer dereference at virtual address 00000000 when read [00000000] *pgd=86c67003, *pmd=ec555003 Internal error: Oops: 205 [#1] SMP ARM Modules linked in: CPU: 1 UID: 0 PID: 18511 Comm: syz.5.3870 Tainted: G L syzkaller #0 PREEMPT Tainted: [L]=SOFTLOCKUP Hardware name: ARM-Versatile Express PC is at dummy_set_selfpowered+0x44/0x60 drivers/usb/gadget/udc/dummy_hcd.c:906 LR is at 0x1 pc : [<810caa84>] lr : [<00000001>] psr: 20000013 sp : dfa0dc78 ip : 000009a8 fp : dfa0dc84 r10: 81c2dadc r9 : 00000000 r8 : 00000088 r7 : 00000000 r6 : 85b6120c r5 : 83e8c6b0 r4 : 83e8c6b0 r3 : 00000000 r2 : 00000000 r1 : 00000001 r0 : 00000000 Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 30c5387d Table: 86022100 DAC: 00000000 Register r0 information: NULL pointer Register r1 information: non-paged memory Register r2 information: NULL pointer Register r3 information: NULL pointer Register r4 information: slab kmalloc-4k start 83e8c000 pointer offset 1712 size 4096 Register r5 information: slab kmalloc-4k start 83e8c000 pointer offset 1712 size 4096 Register r6 information: slab kmalloc-2k start 85b61000 pointer offset 524 size 2048 Register r7 information: NULL pointer Register r8 information: non-paged memory Register r9 information: NULL pointer Register r10 information: non-slab/vmalloc memory Register r11 information: 2-page vmalloc region starting at 0xdfa0c000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2766 Register r12 information: non-paged memory Process syz.5.3870 (pid: 18511, stack limit = 0xdfa0c000) Stack: (0xdfa0dc78 to 0xdfa0e000) dc60: dfa0dca4 dfa0dc88 dc80: 810c74ec 810caa4c 85b612b0 83e8c6b0 85b6120c 00000000 dfa0dcc4 dfa0dca8 dca0: 810c1f64 810c74d0 83fefc00 85b61234 85b61234 83e8c6f8 dfa0dd0c dfa0dcc8 dcc0: 810c560c 810c1ecc dfa0dce4 847fa7e8 823a8d0c 86d417e8 85b612b0 83e8c6b0 dce0: 8067f024 83fefc00 85b61234 85b61258 83e8c6f8 00000088 00000000 81c2dadc dd00: dfa0dd34 dfa0dd10 810c8a18 810c55dc 83e8c6f8 00000000 85b61258 00000000 dd20: 00000088 00000000 dfa0dd64 dfa0dd38 80be04cc 810c8994 dfa0dd64 dfa0dd48 dd40: 80bf33c4 83e8c6f8 85b61258 83e8c744 83e8c6f8 00000088 dfa0dd94 dfa0dd68 dd60: 80be08a0 80be0400 dfa0dd9c dfa0dd78 82d27194 82d271a4 83e8c744 83e8c6f8 dd80: 00000088 00000000 dfa0ddbc dfa0dd98 80be0afc 80be080c 83e8c6f8 85b61258 dda0: 83e8c744 00000000 85e47d38 00000000 dfa0dddc dfa0ddc0 80be0d78 80be0acc ddc0: 85b61258 80be0cb8 833d4f00 00000000 dfa0de0c dfa0dde0 80bdddec 80be0cc4 dde0: 81b7c108 833d4f54 847e68b4 8a277450 85b61258 85e47d00 00000000 833d4f00 de00: dfa0de1c dfa0de10 80bdfd4c 80bddd74 dfa0de4c dfa0de20 80bdf4a4 80bdfd34 de20: 860a0fc0 85b611e0 dfa0de4c 85b61258 85b61000 85b61258 87175218 85b611e0 de40: dfa0de64 dfa0de50 80be1e08 80bdf3a0 85b61234 85b61000 dfa0de84 dfa0de68 de60: 810c62e0 80be1d8c 85c26280 85b61000 0000000b 87175218 dfa0deac dfa0de88 de80: 810c3f9c 810c6298 0000000b 87175200 dfa0df08 87175218 8609f904 8609f900 dea0: dfa0ded4 dfa0deb0 80680750 810c3ecc 0000000b 859a7f00 20000680 dfa0df68 dec0: 806806a0 839e4980 dfa0df64 dfa0ded8 805a1390 806806ac 00000000 00000000 dee0: 00000000 00000000 00000000 00000000 00010000 0000000b 20000680 00000000 df00: 00000001 00000000 859a7f00 00000000 00000000 00000000 00000000 00000000 df20: 00000000 00004004 00000000 00000000 00000001 8a277450 dfa0df64 859a7f03 df40: 859a7f00 00000000 00000000 8020029c 839e4980 00000004 dfa0df94 dfa0df68 df60: 805a16b4 805a1120 00000000 00000000 00000000 8a277450 00000000 00000000 df80: 00356450 00000004 dfa0dfa4 dfa0df98 805a173c 805a164c 00000000 dfa0dfa8 dfa0: 80200060 805a1738 00000000 00000000 00000006 20000680 0000000b 00000000 dfc0: 00000000 00000000 00356450 00000004 00356418 00000000 00000001 76ef70dc dfe0: 76ef6e88 76ef6e78 00018fa0 001309d0 60000010 00000006 00000000 00000000 Call trace: [<810caa40>] (dummy_set_selfpowered) from [<810c74ec>] (usb_gadget_set_selfpowered+0x28/0x114 drivers/usb/gadget/udc/core.c:578) [<810c74c4>] (usb_gadget_set_selfpowered) from [<810c1f64>] (composite_dev_prepare+0xa4/0xe8 drivers/usb/gadget/composite.c:2440) r7:00000000 r6:85b6120c r5:83e8c6b0 r4:85b612b0 [<810c1ec0>] (composite_dev_prepare) from [<810c560c>] (configfs_composite_bind+0x3c/0x5e8 drivers/usb/gadget/configfs.c:1701) r7:83e8c6f8 r6:85b61234 r5:85b61234 r4:83fefc00 [<810c55d0>] (configfs_composite_bind) from [<810c8a18>] (gadget_bind_driver+0x90/0x2b0 drivers/usb/gadget/udc/core.c:1662) r10:81c2dadc r9:00000000 r8:00000088 r7:83e8c6f8 r6:85b61258 r5:85b61234 r4:83fefc00 [<810c8988>] (gadget_bind_driver) from [<80be04cc>] (call_driver_probe drivers/base/dd.c:628 [inline]) [<810c8988>] (gadget_bind_driver) from [<80be04cc>] (really_probe+0xd8/0x40c drivers/base/dd.c:706) r9:00000000 r8:00000088 r7:00000000 r6:85b61258 r5:00000000 r4:83e8c6f8 [<80be03f4>] (really_probe) from [<80be08a0>] (__driver_probe_device+0xa0/0x21c drivers/base/dd.c:868) r8:00000088 r7:83e8c6f8 r6:83e8c744 r5:85b61258 r4:83e8c6f8 [<80be0800>] (__driver_probe_device) from [<80be0afc>] (driver_probe_device+0x3c/0xc0 drivers/base/dd.c:898) r9:00000000 r8:00000088 r7:83e8c6f8 r6:83e8c744 r5:82d271a4 r4:82d27194 [<80be0ac0>] (driver_probe_device) from [<80be0d78>] (__driver_attach+0xc0/0x1f0 drivers/base/dd.c:1292) r9:00000000 r8:85e47d38 r7:00000000 r6:83e8c744 r5:85b61258 r4:83e8c6f8 [<80be0cb8>] (__driver_attach) from [<80bdddec>] (bus_for_each_dev+0x84/0xd4 drivers/base/bus.c:383) r7:00000000 r6:833d4f00 r5:80be0cb8 r4:85b61258 [<80bddd68>] (bus_for_each_dev) from [<80bdfd4c>] (driver_attach+0x24/0x28 drivers/base/dd.c:1310) r7:833d4f00 r6:00000000 r5:85e47d00 r4:85b61258 [<80bdfd28>] (driver_attach) from [<80bdf4a4>] (bus_add_driver+0x110/0x230 drivers/base/bus.c:763) [<80bdf394>] (bus_add_driver) from [<80be1e08>] (driver_register+0x88/0x124 drivers/base/driver.c:174) r8:85b611e0 r7:87175218 r6:85b61258 r5:85b61000 r4:85b61258 [<80be1d80>] (driver_register) from [<810c62e0>] (usb_gadget_register_driver_owner+0x54/0xec drivers/usb/gadget/udc/core.c:1752) r5:85b61000 r4:85b61234 [<810c628c>] (usb_gadget_register_driver_owner) from [<810c3f9c>] (gadget_dev_desc_UDC_store+0xdc/0x114 drivers/usb/gadget/configfs.c:300) r7:87175218 r6:0000000b r5:85b61000 r4:85c26280 [<810c3ec0>] (gadget_dev_desc_UDC_store) from [<80680750>] (flush_write_buffer fs/configfs/file.c:207 [inline]) [<810c3ec0>] (gadget_dev_desc_UDC_store) from [<80680750>] (configfs_write_iter+0xb0/0x124 fs/configfs/file.c:229) r9:8609f900 r8:8609f904 r7:87175218 r6:dfa0df08 r5:87175200 r4:0000000b [<806806a0>] (configfs_write_iter) from [<805a1390>] (new_sync_write fs/read_write.c:595 [inline]) [<806806a0>] (configfs_write_iter) from [<805a1390>] (vfs_write fs/read_write.c:687 [inline]) [<806806a0>] (configfs_write_iter) from [<805a1390>] (vfs_write+0x27c/0x42c fs/read_write.c:667) r9:839e4980 r8:806806a0 r7:dfa0df68 r6:20000680 r5:859a7f00 r4:0000000b [<805a1114>] (vfs_write) from [<805a16b4>] (ksys_write+0x74/0xec fs/read_write.c:739) r10:00000004 r9:839e4980 r8:8020029c r7:00000000 r6:00000000 r5:859a7f00 r4:859a7f03 [<805a1640>] (ksys_write) from [<805a173c>] (__do_sys_write fs/read_write.c:750 [inline]) [<805a1640>] (ksys_write) from [<805a173c>] (sys_write+0x10/0x14 fs/read_write.c:747) r7:00000004 r6:00356450 r5:00000000 r4:00000000 [<805a172c>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67) Exception stack(0xdfa0dfa8 to 0xdfa0dff0) dfa0: 00000000 00000000 00000006 20000680 0000000b 00000000 dfc0: 00000000 00000000 00356450 00000004 00356418 00000000 00000001 76ef70dc dfe0: 76ef6e88 76ef6e78 00018fa0 001309d0 Code: e3a00000 01a03002 e3510000 030f2ffe (e5933000) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e3a00000 mov r0, #0 4: 01a03002 moveq r3, r2 8: e3510000 cmp r1, #0 c: 030f2ffe movweq r2, #65534 @ 0xfffe * 10: e5933000 ldr r3, [r3] <-- trapping instruction