program: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDFONTOP_SET(r0, 0x4b72, &(0x7f0000000100)={0x0, 0x0, 0x8, 0x1, 0x200, &(0x7f0000000880)="1ae19337aa151f36ae49bb3f8cb95c5bf840d4f1e55efaaf098d47a70eb36a7309000000000000000f4743f490c585108c1331c7749299a25a705f5096cb268cbc6070d680e1be250700000000080000472471ff550c0010000007f3c7b61abe4162256004ea8ca5e5b5f379c6eb3257eda08f7e6959090000004d13184d382747e035b4722525e00ade86b4c6d1e157c75d15c1f961ebc0a64d7f2a73f8979fcecacaa64f9b9069ebcc1d5b471edbc4f6c7f1b98ae74e909aa6f25b7fa77bf9cd4ed36d5c53dc519d11c3cc1c22a3b86cf3c645413fcea0c99ded703699d2bb6a4a663b99b6069da5aaf64785a5887c31261d4b9e57ee07000000def6f255ca26108f11f02047d47f2d0fec30f7e92482f71496e184214a4e0c5fdc48b0af0c0478940016d8f0990a0e1090fd515380aae83c5eaeed338701574b64200a16ef2811fadcf1e0f49a514df529061e09ce45e3da03a03fe9b4a6bcfa7d04594e4f6d0714a2e14ea127ab37d64a5e0db630cd4f4a2e6c985a542ff20a9b2193f265f93a258a88dd6c9d6a926dd23d32425849c5d9210007660a617f22133b6cb5087f4c6057942aa18193172bd995fa70a1f949e496f2e2a3c175858575713be5ee3f7f4dcecc98123f9ded3afdebe13d79a7f7fcb2469ae0ac503111401612df7ee995f74fb97a63bf62d61f78c062f959119ab50c1f706a930121ebcd53ccb93d158186ed360750ca8e728150d988844b9a5cff46591ccaff4175b86ea6171b046b856168f403b5253a5cc393430a09a4489a0895571e597ac8846f945ffb372a88d3a2b463dc961416c80c55773f917020751ed51cfd73c1e06fbadd156d56bedc117af95d242d6d07002ce34dccd6005e944afa92b22ec9a698469c6edc06caa2cfcd61912607d459b4c28ebea9745bcd4697d75c9601fd333d3cd797963a3c71b7cc5fdc756da8d97207936e5f53b53b732533c2722e03002293517966611602f297de6ff5408777b7a93c45cee3ee5c5601a4e94266b295ea7a86812a7ab8896ec5ea1b12643e1844b185734528399e62bceb8700cc6cd491e4a4430d0a3ba329a5a2fa170fd0b1cc4ba8294de988cd35df2cd7344aa8a9f3432b96fb889c02f484f63520cc3466a3c2733d45f176931b2db18dba54991a9553cedb7f585786388d4042dbae1c95b769e3d4e036e8afea0a04c04f542b152ca1fd1f8efee60425c5a122fd1b90e98635284abd9f217d9e19cb2a64b354c9d79509cc47d7305114990148a7291cb0fe2d1c773a6664b66ae04aa62c534d072ae54c2ca0d5962cc58945d8924abfc4d5af922462507430d8f2c17479a6678b0b3700000000000000000000000000000000000000000000f800"}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config/nvmet/subsystems/subsys1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config/nvmet/subsystems/subsys1/namespaces/1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1a4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x81, 0x8c) write(r2, &(0x7f0000000200)='./file0\x00', 0x8) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./config/nvmet/subsystems/subsys1/namespaces/1/buffered_io\x00', 0x1, 0x0) write(r3, &(0x7f0000000200)='1\x00', 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./config/nvmet/subsystems/subsys1/namespaces/1/enable\x00', 0x1, 0x0) write(r4, &(0x7f0000000200)='1\x00', 0x2) write(r4, &(0x7f0000000200)='0\x00', 0x2) socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, &(0x7f0000000080)={{{@in6=@mcast1, @in6=@ipv4={'\x00', '\xff\xff', @multicast2}, 0x0, 0x1, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee00}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@dev, 0x0, 0x32}, 0x0, @in6=@dev={0xfe, 0x80, '\x00', 0x29}, 0x1, 0x4}}, 0xe8) connect$pppl2tp(r2, &(0x7f00000002c0)=@pppol2tpin6={0x18, 0x1, {0x0, r5, 0x4, 0x0, 0x0, 0x0, {0xa, 0xfffc, 0x10, @mcast1, 0x8000000}}}, 0x32) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0) r7 = syz_mount_image$squashfs(&(0x7f0000000040), &(0x7f00000001c0)='./file2\x00', 0x3, &(0x7f0000000380)=ANY=[], 0x21, 0x1ad, &(0x7f0000000440)="$eJzKKC4sZmBgYPj7sSaZwYEBDNgY+BhuMzIysDAwMMgzQsTc2CH0KzYIrQflv2CB0JpQ8UVQ+j8UFFdWZSfm5KQW0ZCBXY4J4hAGUkwEqUeXuvIxlp9Uc4YUg5GMgBplYDLimSHhSB0Dvwy0d4pYBkWoEs9gxJRCcO0bmRjeglP69Y81ySBGArSUAomlQDAjshpQbB5BUiPFAsaMzAz/4WpAhR+Io87AwKBfklugX1xZpZuZm5iemp6aZ2RkbGZgYmBgaqSflpmTagAhGZGsgBVRIBpU9oLKVE4keVYGBoZ70AKWiwEJvIRYC3MaVJ4RWS+oHP4PLaQ1lBlQABOSXhjNznBAAKYXqg1scwiDGgMHAwNDeQOsnAAFjArYFBYGsJc8GBgZmKEcQ6hzGRjhdnGAJfSS83NS2hkYGRhh2pYzsMDNMHzMwArmsCHcCJExtmiACbVDaRUo7QGll0Ppx1AaVmfB6iIWsAlPoDyNBpATKxJLSooM2c5DtRiCaj2wmBEbTNZIoAE5wEC2fmJD9ZwMO8MoGAWjYBSMglEwCkbBEAOAAAAA//+TRlkJ") preadv(r7, 0x0, 0x0, 0x0, 0x5) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) lsetxattr(&(0x7f0000000340)='./sys\x00', &(0x7f0000000380)=@known='trusted.overlay.redirect\x00', &(0x7f00000003c0)='sysfs\x00', 0x6, 0x7) sendmsg$NL80211_CMD_FRAME(r8, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000600)=ANY=[@ANYRESDEC=r1, @ANYRES16=0x0, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r9, @ANYBLOB="d506330080000000ffffffffffff080211000001cc398df3bd43f6bc9a47b864c3801aa51859e7ba8a6cb328b7c345f17f45d363895d49448f682d5e1712e3720687751f53d021bc4107b503bb102646ed002fbaf9"], 0x6f4}}, 0x0) write(r6, &(0x7f0000000940)="77776e6e3d30784d55eec73333333333333333333333332c7777343434343434343434343400000000e1ffffff0000", 0x2f) [ 92.633350][ T4649] Bluetooth: hci0: command tx timeout [ 92.666770][ T10] cfg80211: failed to load regulatory.db [ 92.836120][ T5328] nvmet: adding nsid 1 to subsystem subsys1 [ 92.856118][ T5328] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI [ 92.860955][ T5328] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 92.864318][ T5328] CPU: 0 UID: 0 PID: 5328 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 92.867862][ T5328] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 92.872165][ T5328] RIP: 0010:strlen+0x29/0x70 [ 92.874187][ T5328] Code: 90 f3 0f 1e fa 41 57 41 56 41 54 53 48 c7 c0 ff ff ff ff 49 be 00 00 00 00 00 fc ff df 48 89 fb 49 89 c7 48 89 d8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 75 11 48 ff c3 49 8d 47 01 42 80 7c 3f 01 00 [ 92.882016][ T5328] RSP: 0018:ffffc9000e2a7978 EFLAGS: 00010246 [ 92.884409][ T5328] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000100000 [ 92.887726][ T5328] RDX: ffffc9000edea000 RSI: 0000000000000051 RDI: 0000000000000000 [ 92.890951][ T5328] RBP: ffffc9000e2a7ab8 R08: ffffffff9057c237 R09: 1ffffffff20af846 [ 92.894240][ T5328] R10: dffffc0000000000 R11: fffffbfff20af847 R12: 1ffff92001c54f40 [ 92.897473][ T5328] R13: dffffc0000000000 R14: dffffc0000000000 R15: ffffffffffffffff [ 92.900809][ T5328] FS: 00007f309d32b6c0(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 92.904537][ T5328] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 92.907330][ T5328] CR2: 0000555cf10414b0 CR3: 000000000e772000 CR4: 0000000000352ef0 [ 92.910798][ T5328] Call Trace: [ 92.912285][ T5328] [ 92.913558][ T5328] do_getname_kernel+0x1d/0x230 [ 92.916052][ T5328] ? getname_kernel+0xd/0x20 [ 92.918062][ T5328] filp_open+0x87/0x1d0 [ 92.919973][ T5328] ? __pfx_filp_open+0x10/0x10 [ 92.922099][ T5328] ? __pfx___mutex_lock+0x10/0x10 [ 92.924119][ T5328] ? nvmet_ns_enable_store+0xc8/0x170 [ 92.926665][ T5328] nvmet_file_ns_enable+0x74/0x350 [ 92.929250][ T5328] nvmet_ns_enable+0xaa/0x780 [ 92.931522][ T5328] ? configfs_write_iter+0x238/0x430 [ 92.933818][ T5328] nvmet_ns_enable_store+0xd7/0x170 [ 92.936054][ T5328] ? __pfx_nvmet_ns_enable_store+0x10/0x10 [ 92.938654][ T5328] ? down_read+0x2be/0x330 [ 92.940559][ T5328] ? __pfx_nvmet_ns_enable_store+0x10/0x10 [ 92.942980][ T5328] configfs_write_iter+0x337/0x430 [ 92.945288][ T5328] vfs_write+0x612/0xba0 [ 92.947279][ T5328] ? __pfx_vfs_write+0x10/0x10 [ 92.949376][ T5328] ? __fget_files+0x2a/0x420 [ 92.951406][ T5328] ksys_write+0x150/0x270 [ 92.953317][ T5328] ? __pfx_ksys_write+0x10/0x10 [ 92.955379][ T5328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.957957][ T5328] do_syscall_64+0x174/0x580 [ 92.959912][ T5328] ? trace_irq_disable+0x3b/0x140 [ 92.962064][ T5328] ? clear_bhb_loop+0x40/0x90 [ 92.964125][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.966663][ T5328] RIP: 0033:0x7f309c39e0d9 [ 92.968489][ T5328] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.976312][ T5328] RSP: 002b:00007f309d32afe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 92.979920][ T5328] RAX: ffffffffffffffda RBX: 00007f309c625fa0 RCX: 00007f309c39e0d9 [ 92.983058][ T5328] RDX: 0000000000000002 RSI: 0000200000000200 RDI: 0000000000000006 [ 92.986274][ T5328] RBP: 00007f309c435024 R08: 0000000000000000 R09: 0000000000000000 [ 92.989745][ T5328] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 92.993195][ T5328] R13: 00007f309c626038 R14: 00007f309c625fa0 R15: 00007ffe7cdbfbf8 [ 92.996692][ T5328] [ 92.998089][ T5328] Modules linked in: [ 93.000601][ T5328] ---[ end trace 0000000000000000 ]--- [ 93.046146][ T5328] RIP: 0010:strlen+0x29/0x70 [ 93.048231][ T5328] Code: 90 f3 0f 1e fa 41 57 41 56 41 54 53 48 c7 c0 ff ff ff ff 49 be 00 00 00 00 00 fc ff df 48 89 fb 49 89 c7 48 89 d8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 75 11 48 ff c3 49 8d 47 01 42 80 7c 3f 01 00 [ 93.057450][ T5328] RSP: 0018:ffffc9000e2a7978 EFLAGS: 00010246 [ 93.060192][ T5328] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000100000 [ 93.064091][ T5328] RDX: ffffc9000edea000 RSI: 0000000000000051 RDI: 0000000000000000 [ 93.067565][ T5328] RBP: ffffc9000e2a7ab8 R08: ffffffff9057c237 R09: 1ffffffff20af846 [ 93.070988][ T5328] R10: dffffc0000000000 R11: fffffbfff20af847 R12: 1ffff92001c54f40 [ 93.074760][ T5328] R13: dffffc0000000000 R14: dffffc0000000000 R15: ffffffffffffffff [ 93.078275][ T5328] FS: 00007f309d32b6c0(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 93.082194][ T5328] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 93.085509][ T5328] CR2: 00007f309c5f36b8 CR3: 000000000e772000 CR4: 0000000000352ef0 [ 93.089078][ T5328] Kernel panic - not syncing: Fatal exception [ 93.092093][ T5328] Kernel Offset: disabled [ 93.093936][ T5328] Rebooting in 86400 seconds..