syzbot
BUG: unable to handle kernel paging request in set_link_state
Status:
upstream: reported C repro on 2026/07/24 22:28
Reported-by: syzbot+dd6dbf1b89f9af46cb13@syzkaller.appspotmail.com
First crash: 3d21h, last: 16h45m
Sample crash report:
Unable to handle kernel paging request at virtual address dfff800000000000
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
Mem abort info:
ESR = 0x0000000096000006
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x06: level 2 translation fault
Data abort info:
ISV = 0, ISS = 0x00000006
CM = 0, WnR = 0
[dfff800000000000] address between user and kernel address ranges
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4510 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
pstate: 824000c5 (Nzcv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : set_link_state+0x38/0xf38 drivers/usb/gadget/udc/dummy_hcd.c:435
lr : set_link_state+0x34/0xf38 drivers/usb/gadget/udc/dummy_hcd.c:434
sp : ffff800021737520
x29: ffff800021737570 x28: 1fffe000198a7a84 x27: dfff800000000000
x26: 1fffe0001a3cb189 x25: ffff80000dceb9e4 x24: dfff800000000000
x23: 0000000000000000 x22: 0000000000000000 x21: ffff0000d1e5924a
x20: 0000000000000000 x19: 0000000000000000 x18: 1fffe00033e7277e
x17: ffff80001537d000 x16: ffff8000082f2840 x15: 000000000004ffff
x14: ffff7000042e6ea0 x13: 1ffff000042e6ea0 x12: 0000000000000004
x11: ff0080000dcec254 x10: 0000000000000000 x9 : ffff80000dcec254
x8 : 0000000000000000 x7 : ffff80000dceba78 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : ffff8000082f2968
x2 : 0000000000000001 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
set_link_state+0x38/0xf38 drivers/usb/gadget/udc/dummy_hcd.c:435
dummy_pullup+0xd8/0x12c drivers/usb/gadget/udc/dummy_hcd.c:914
usb_gadget_disconnect_locked+0xf8/0x54c drivers/usb/gadget/udc/core.c:782
gadget_unbind_driver+0xa0/0x35c drivers/usb/gadget/udc/core.c:1696
device_remove drivers/base/dd.c:547 [inline]
__device_release_driver drivers/base/dd.c:1279 [inline]
device_release_driver_internal+0x3d4/0x6e4 drivers/base/dd.c:1305
driver_detach+0x1e8/0x2ac drivers/base/dd.c:1368
bus_remove_driver+0x120/0x240 drivers/base/bus.c:679
driver_unregister+0x78/0xac drivers/base/driver.c:274
usb_gadget_unregister_driver+0x50/0x78 drivers/usb/gadget/udc/core.c:1762
raw_release+0xc4/0x294 drivers/usb/gadget/legacy/raw_gadget.c:416
__fput+0x1b4/0x7b0 fs/file_table.c:320
____fput+0x20/0x30 fs/file_table.c:348
task_work_run+0x1f4/0x280 kernel/task_work.c:203
exit_task_work include/linux/task_work.h:39 [inline]
do_exit+0x54c/0x19ac kernel/exit.c:881
do_group_exit+0x198/0x238 kernel/exit.c:1024
get_signal+0x11f4/0x133c kernel/signal.c:2872
do_signal arch/arm64/kernel/signal.c:1095 [inline]
do_notify_resume+0x364/0x2c84 arch/arm64/kernel/signal.c:1148
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
el0_svc+0x98/0x128 arch/arm64/kernel/entry-common.c:638
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: aa0003f4 f2fbfffb 969f1b84 d343fe88 (387b6908)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: aa0003f4 mov x20, x0
4: f2fbfffb movk x27, #0xdfff, lsl #48
8: 969f1b84 bl 0xfffffffffa7c6e18
c: d343fe88 lsr x8, x20, #3
* 10: 387b6908 ldrb w8, [x8, x27] <-- trapping instruction
Struck through repros no longer work on HEAD.