program: r0 = openat$comedi(0xffffffffffffff9c, &(0x7f000000b200)='/dev/comedi1\x00', 0x8040, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000100)={'pcl818\x00', [0x8043, 0x7fffffff, 0x1, 0x4, 0x4, 0x6f8, 0x404d7, 0x0, 0x4, 0x4, 0x0, 0x401, 0x3, 0x8001, 0x9, 0x807ff, 0x101, 0x1, 0xffffffff, 0x5, 0x8, 0x8, 0xfe, 0x6, 0x54, 0x10001, 0x7, 0x50, 0x10001, 0x8, 0x4]}) ioctl$COMEDI_CANCEL(r0, 0x6407) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r2, &(0x7f00000103c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r2, &(0x7f0000000040)={0x50, 0x0, r3, {0x7, 0x1f, 0x0, 0x10408}}, 0x50) r4 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x141301) ioctl$USBDEVFS_CLEAR_HALT(r4, 0x80045515, 0x0) r5 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r5) ptrace(0x15, r5) write$FUSE_LK(r1, &(0x7f0000000040)={0x28, 0x7fffffffffffffed, r3, {{0xffffffffffffffff, 0x7, 0x1, r5}}}, 0x28) [ 68.859931][ T4677] Bluetooth: hci0: command tx timeout [ 68.902931][ T5331] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN NOPTI [ 68.915576][ T5331] KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] [ 68.920875][ T5331] CPU: 0 UID: 0 PID: 5331 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 68.924759][ T5331] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 68.929461][ T5331] RIP: 0010:pcl818_ai_cancel+0x69/0x3f0 [ 68.932141][ T5331] Code: 8b 1b 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 f9 1d 70 f9 48 8b 03 48 89 04 24 49 83 c4 28 4c 89 e0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 e7 e8 d8 1d 70 f9 4d 8b 24 24 48 83 c3 [ 68.940476][ T5331] RSP: 0018:ffffc9000d5b7a40 EFLAGS: 00010206 [ 68.943163][ T5331] RAX: 0000000000000005 RBX: ffff88804276c480 RCX: 0000000000100000 [ 68.946576][ T5331] RDX: ffffc9000ef62000 RSI: 0000000000000361 RDI: 0000000000000362 [ 68.950135][ T5331] RBP: 0000000000000001 R08: ffff88803e04792f R09: 1ffff11007c08f25 [ 68.953863][ T5331] R10: dffffc0000000000 R11: ffffffff88b898f0 R12: 0000000000000028 [ 68.957382][ T5331] R13: dffffc0000000000 R14: ffff88803e047800 R15: dffffc0000000000 [ 68.961001][ T5331] FS: 00007fd6aeecc6c0(0000) GS:ffff88808d69f000(0000) knlGS:0000000000000000 [ 68.964961][ T5331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 68.968244][ T5331] CR2: 0000200000000100 CR3: 00000000111de000 CR4: 0000000000352ef0 [ 68.971927][ T5331] Call Trace: [ 68.973513][ T5331] [ 68.974922][ T5331] pcl818_detach+0x66/0xd0 [ 68.976918][ T5331] comedi_device_detach_locked+0x178/0x750 [ 68.979532][ T5331] comedi_unlocked_ioctl+0xcde/0x1020 [ 68.981894][ T5331] ? kasan_quarantine_put+0xdd/0x220 [ 68.984232][ T5331] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 68.986897][ T5331] ? do_futex+0x333/0x420 [ 68.988927][ T5331] ? __fget_files+0x2a/0x420 [ 68.991070][ T5331] ? __fget_files+0x3a0/0x420 [ 68.993193][ T5331] ? __fget_files+0x2a/0x420 [ 68.995276][ T5331] ? bpf_lsm_file_ioctl+0x9/0x20 [ 68.997401][ T5331] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 69.000206][ T5331] __se_sys_ioctl+0xfc/0x170 [ 69.002247][ T5331] do_syscall_64+0xfa/0xf80 [ 69.004298][ T5331] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 69.007025][ T5331] ? clear_bhb_loop+0x60/0xb0 [ 69.009137][ T5331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 69.011932][ T5331] RIP: 0033:0x7fd6adf8f7c9 [ 69.013946][ T5331] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 69.022234][ T5331] RSP: 002b:00007fd6aeecc038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 69.025965][ T5331] RAX: ffffffffffffffda RBX: 00007fd6ae1e5fa0 RCX: 00007fd6adf8f7c9 [ 69.029459][ T5331] RDX: 0000000000000000 RSI: 0000000040946400 RDI: 0000000000000003 [ 69.032793][ T5331] RBP: 00007fd6ae013f91 R08: 0000000000000000 R09: 0000000000000000 [ 69.036160][ T5331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 69.039792][ T5331] R13: 00007fd6ae1e6038 R14: 00007fd6ae1e5fa0 R15: 00007ffe9c24aa58 [ 69.043327][ T5331] [ 69.044735][ T5331] Modules linked in: [ 69.047024][ T5331] ---[ end trace 0000000000000000 ]--- [ 69.072988][ T5331] RIP: 0010:pcl818_ai_cancel+0x69/0x3f0 [ 69.075617][ T5331] Code: 8b 1b 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 f9 1d 70 f9 48 8b 03 48 89 04 24 49 83 c4 28 4c 89 e0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 e7 e8 d8 1d 70 f9 4d 8b 24 24 48 83 c3 [ 69.085150][ T5331] RSP: 0018:ffffc9000d5b7a40 EFLAGS: 00010206 [ 69.087643][ T5331] RAX: 0000000000000005 RBX: ffff88804276c480 RCX: 0000000000100000 [ 69.092434][ T5331] RDX: ffffc9000ef62000 RSI: 0000000000000361 RDI: 0000000000000362 [ 69.095862][ T5331] RBP: 0000000000000001 R08: ffff88803e04792f R09: 1ffff11007c08f25 [ 69.099920][ T5331] R10: dffffc0000000000 R11: ffffffff88b898f0 R12: 0000000000000028 [ 69.103162][ T5331] R13: dffffc0000000000 R14: ffff88803e047800 R15: dffffc0000000000 [ 69.106612][ T5331] FS: 00007fd6aeecc6c0(0000) GS:ffff88808d69f000(0000) knlGS:0000000000000000 [ 69.110852][ T5331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 69.113741][ T5331] CR2: 00007f3333539ad0 CR3: 00000000111de000 CR4: 0000000000352ef0 [ 69.117291][ T5331] Kernel panic - not syncing: Fatal exception [ 69.120158][ T5331] Kernel Offset: disabled [ 69.122032][ T5331] Rebooting in 86400 seconds..