BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 1af85c067 P4D 1af85c067 PUD 1af85d067 PMD 0
Oops: 0000 [#1] SMP KASAN
CPU: 0 PID: 3268 Comm: kworker/0:2 Not tainted 5.5.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: usb_hub_wq hub_event
RIP: 0010:__read_once_size include/linux/compiler.h:199 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x3d/0x60 kernel/kcov.c:203
Code: 01 1f 00 48 8b 34 24 74 09 80 b8 d4 12 00 00 00 74 2b 8b 90 b0 12 00 00 83 fa 02 75 20 48 8b 88 b8 12 00 00 8b 80 b4 12 00 00 <48> 8b 11 48 83 c2 01 48 39 d0 76 07 48 89 34 d1 48 89 11 c3 0f 1f
RSP: 0018:ffff8881d7897330 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000040 RCX: 0000000000000000
RDX: 0000000000000002 RSI: ffffffff812f27f2 RDI: 0000000000000004
RBP: 000000000000000b R08: ffff8881d0634980 R09: 0000000000000001
R10: 00000000000855cc R11: 0000000000000001 R12: ffffffff811ae84b
R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8881db200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000001af85b000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
stack_trace_consume_entry+0x122/0x180 kernel/stacktrace.c:94
arch_stack_walk+0x67/0xd0 arch/x86/kernel/stacktrace.c:27
stack_trace_save+0x9f/0xe0 kernel/stacktrace.c:123
save_stack+0x1b/0x80 mm/kasan/common.c:72
set_track mm/kasan/common.c:80 [inline]
kasan_set_free_info mm/kasan/common.c:335 [inline]
__kasan_slab_free+0x129/0x170 mm/kasan/common.c:474
slab_free_hook mm/slub.c:1425 [inline]
slab_free_freelist_hook mm/slub.c:1458 [inline]
slab_free mm/slub.c:3005 [inline]
kfree+0xda/0x310 mm/slub.c:3957
rh_call_control drivers/usb/core/hcd.c:732 [inline]
rh_urb_enqueue drivers/usb/core/hcd.c:842 [inline]
usb_hcd_submit_urb+0x8a2/0x1ee0 drivers/usb/core/hcd.c:1543
usb_submit_urb+0x6e5/0x13b0 drivers/usb/core/urb.c:570
usb_start_wait_urb+0x108/0x2b0 drivers/usb/core/message.c:57
usb_internal_control_msg drivers/usb/core/message.c:101 [inline]
usb_control_msg+0x31c/0x4a0 drivers/usb/core/message.c:152
usb_clear_port_feature+0x6a/0x90 drivers/usb/core/hub.c:419
hub_port_disable+0x13b/0x480 drivers/usb/core/hub.c:4336
hub_port_connect drivers/usb/core/hub.c:5235 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5324 [inline]
port_event drivers/usb/core/hub.c:5470 [inline]
hub_event+0x2489/0x3860 drivers/usb/core/hub.c:5552
process_one_work+0x92b/0x1530 kernel/workqueue.c:2264
worker_thread+0x96/0xe20 kernel/workqueue.c:2410
kthread+0x318/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Modules linked in:
CR2: 0000000000000000
---[ end trace fbb52909c7d19f73 ]---
RIP: 0010:__read_once_size include/linux/compiler.h:199 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x3d/0x60 kernel/kcov.c:203
Code: 01 1f 00 48 8b 34 24 74 09 80 b8 d4 12 00 00 00 74 2b 8b 90 b0 12 00 00 83 fa 02 75 20 48 8b 88 b8 12 00 00 8b 80 b4 12 00 00 <48> 8b 11 48 83 c2 01 48 39 d0 76 07 48 89 34 d1 48 89 11 c3 0f 1f
RSP: 0018:ffff8881d7897330 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000040 RCX: 0000000000000000
RDX: 0000000000000002 RSI: ffffffff812f27f2 RDI: 0000000000000004
RBP: 000000000000000b R08: ffff8881d0634980 R09: 0000000000000001
R10: 00000000000855cc R11: 0000000000000001 R12: ffffffff811ae84b
R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8881db200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000001af85b000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400