smsusb:smsusb_onresponse: error, urb status -71, 0 bytes
smsusb:smsusb_onresponse: error, urb status -71, 0 bytes
smsusb:smsusb_onresponse: error, urb status -71, 0 bytes
smsusb:smsusb_onresponse: error, urb status -71, 0 bytes
general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 PID: 2927 Comm: kworker/u4:9 Not tainted 6.6.101-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Workqueue: bat_events batadv_nc_worker
RIP: 0010:send_mayday kernel/workqueue.c:2388 [inline]
RIP: 0010:pool_mayday_timeout+0x166/0x5e0 kernel/workqueue.c:2425
Code: dd 49 c1 e5 3d 49 c1 fd 3f 89 de 83 e6 04 31 ff e8 9f 7f 2d 00 49 21 dd 49 81 e5 00 fe ff ff 49 8d 5d 08 48 89 d8 48 c1 e8 03 <80> 3c 28 00 74 08 48 89 df e8 3c c1 84 00 4c 8b 33 48 8b 44 24 28
RSP: 0018:ffffc90000007b48 EFLAGS: 00010002
RAX: 0000000000000001 RBX: 0000000000000008 RCX: ffff88802c279e00
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffff88805ac7644f R09: 1ffff1100b58ec89
R10: dffffc0000000000 R11: ffffed100b58ec8a R12: ffff88805ac76450
R13: 0000000000000000 R14: 1ffff110171c778c R15: ffff8880b8e3bd20
FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fabe2a26da4 CR3: 000000006367f000 CR4: 00000000003506f0
Call Trace:
<IRQ>
call_timer_fn+0x16e/0x530 kernel/time/timer.c:1700
expire_timers kernel/time/timer.c:1751 [inline]
__run_timers+0x52d/0x7d0 kernel/time/timer.c:2022
run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2035
handle_softirqs+0x280/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:kasan_check_range+0x1c0/0x290 mm/kasan/generic.c:-1
Code: 49 8d 5c 24 07 4d 85 e4 49 0f 49 dc 48 83 e3 f8 49 29 dc 74 12 41 80 3b 00 0f 85 a6 00 00 00 49 ff c3 49 ff cc 75 ee 5b 41 5c <41> 5d 41 5e 41 5f 5d c3 45 84 ff 75 61 41 f7 c7 00 ff 00 00 75 5d
RSP: 0018:ffffc9000bb57a18 EFLAGS: 00000256
RAX: 0000000000000001 RBX: 0000000000000000 RCX: ffffffff816708dc
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8e4a84e8
RBP: ffffc9000bb57b48 R08: ffffffff8e4a84ef R09: 1ffffffff1c9509d
R10: dffffc0000000000 R11: fffffbfff1c9509e R12: 1ffff9200176af54
R13: ffffffff8cd2fba0 R14: fffffbfff1c9509e R15: 1ffffffff1c9509d
instrument_atomic_read include/linux/instrumented.h:68 [inline]
_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
cpumask_test_cpu include/linux/cpumask.h:504 [inline]
cpu_online include/linux/cpumask.h:1082 [inline]
trace_lock_acquire include/trace/events/lock.h:24 [inline]
lock_acquire+0xbc/0x410 kernel/locking/lockdep.c:5725
rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
rcu_read_lock include/linux/rcupdate.h:786 [inline]
batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:408 [inline]
batadv_nc_worker+0xef/0x610 net/batman-adv/network-coding.c:719
process_one_work kernel/workqueue.c:2634 [inline]
process_scheduled_works+0xa45/0x15b0 kernel/workqueue.c:2711
worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:send_mayday kernel/workqueue.c:2388 [inline]
RIP: 0010:pool_mayday_timeout+0x166/0x5e0 kernel/workqueue.c:2425
Code: dd 49 c1 e5 3d 49 c1 fd 3f 89 de 83 e6 04 31 ff e8 9f 7f 2d 00 49 21 dd 49 81 e5 00 fe ff ff 49 8d 5d 08 48 89 d8 48 c1 e8 03 <80> 3c 28 00 74 08 48 89 df e8 3c c1 84 00 4c 8b 33 48 8b 44 24 28
RSP: 0018:ffffc90000007b48 EFLAGS: 00010002
RAX: 0000000000000001 RBX: 0000000000000008 RCX: ffff88802c279e00
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffff88805ac7644f R09: 1ffff1100b58ec89
R10: dffffc0000000000 R11: ffffed100b58ec8a R12: ffff88805ac76450
R13: 0000000000000000 R14: 1ffff110171c778c R15: ffff8880b8e3bd20
FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fabe2a26da4 CR3: 000000006367f000 CR4: 00000000003506f0
----------------
Code disassembly (best guess):
0: dd 49 c1 fisttpll -0x3f(%rcx)
3: e5 3d in $0x3d,%eax
5: 49 c1 fd 3f sar $0x3f,%r13
9: 89 de mov %ebx,%esi
b: 83 e6 04 and $0x4,%esi
e: 31 ff xor %edi,%edi
10: e8 9f 7f 2d 00 call 0x2d7fb4
15: 49 21 dd and %rbx,%r13
18: 49 81 e5 00 fe ff ff and $0xfffffffffffffe00,%r13
1f: 49 8d 5d 08 lea 0x8(%r13),%rbx
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1) <-- trapping instruction
2e: 74 08 je 0x38
30: 48 89 df mov %rbx,%rdi
33: e8 3c c1 84 00 call 0x84c174
38: 4c 8b 33 mov (%rbx),%r14
3b: 48 8b 44 24 28 mov 0x28(%rsp),%rax