program: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0xc, &(0x7f0000000000)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848480000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32=r3, @ANYBLOB="0800050002000000"], 0x24}}, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000040)="2e00000010008108040f80ecdb4cb92e0a480e000f000000e8bd6efb250314000e000100240248ff05000500", 0x2c}, {&(0x7f00000019c0)="06bb", 0x2}], 0x2}, 0x4000000) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0) (async) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0) syz_open_dev$usbfs(&(0x7f0000000080), 0x13, 0x68e5c0) (async) syz_open_dev$usbfs(&(0x7f0000000080), 0x13, 0x68e5c0) r5 = socket$phonet(0x23, 0x2, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r6 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f00000002c0)={'veth0_vlan\x00', &(0x7f00000004c0)=@ethtool_link_settings={0x4c, 0x3, 0x3, 0x5, 0x8, 0x0, 0x9, 0x5, 0x0, 0x52, [0xa6, 0xeef, 0x2000100, 0xb, 0xffffffff, 0x7fffffff, 0x8001, 0x4]}}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000000c0)={'syz_tun\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000000c0)={'syz_tun\x00'}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000001c0)={'ip6gretap0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000001c0)={'ip6gretap0\x00', 0x0}) r8 = socket$packet(0x11, 0x3, 0x300) syz_open_procfs(0x0, &(0x7f0000000100)='syscall\x00') r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket(0x1, 0x803, 0x0) getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) (async) getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r11 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000040)={'hsr0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000040)={'hsr0\x00'}) getuid() newfstatat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0) (async) newfstatat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) setresuid(0x0, r12, 0x0) (async) setresuid(0x0, r12, 0x0) sendmsg$nl_route(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="340000001900000129bd7000fcdbdf250220101cfd04fd08000700e828c0a5003a00f60006001500000000000800010000000000"], 0x34}, 0x1, 0x8, 0x0, 0x24008010}, 0x0) setsockopt$SO_TIMESTAMPING(r8, 0x1, 0x25, &(0x7f0000000340)=0x115, 0x4) connect$packet(0xffffffffffffffff, &(0x7f0000000140), 0x14) setsockopt$packet_add_memb(r8, 0x107, 0x18, &(0x7f0000000800)={r7, 0x1, 0x6, @local}, 0x10) sendto$packet(r8, &(0x7f0000000040)="0203000008000000000045", 0xff4b, 0x4000050, &(0x7f0000000000)={0x11, 0x0, r7, 0x1, 0x0, 0x6, @remote}, 0x14) [ 68.865066][ T4664] Bluetooth: hci0: command tx timeout [ 68.892318][ T5316] netlink: 'syz.0.0': attribute type 10 has an invalid length. [ 68.917597][ T5316] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 68.952234][ T5317] sysfs: cannot create duplicate filename '/module/raw_gadget' [ 68.955512][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted 6.15.0-rc4-syzkaller-00296-ge8ab83e34bdc #0 PREEMPT(full) [ 68.955528][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 68.955534][ T5317] Call Trace: [ 68.955540][ T5317] [ 68.955544][ T5317] dump_stack_lvl+0x189/0x250 [ 68.955663][ T5317] ? __pfx_dump_stack_lvl+0x10/0x10 [ 68.955676][ T5317] ? __pfx__printk+0x10/0x10 [ 68.955687][ T5317] ? kernfs_path_from_node+0x2b/0x260 [ 68.955730][ T5317] ? kernfs_path_from_node+0x2b/0x260 [ 68.955741][ T5317] ? kernfs_path_from_node+0x2b/0x260 [ 68.955753][ T5317] ? kernfs_path_from_node+0x216/0x260 [ 68.955768][ T5317] sysfs_create_dir_ns+0x259/0x280 [ 68.955782][ T5317] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 68.955796][ T5317] ? do_raw_spin_unlock+0x4d/0x240 [ 68.955810][ T5317] kobject_add_internal+0x59f/0xb40 [ 68.955860][ T5317] kobject_init_and_add+0x125/0x190 [ 68.955876][ T5317] ? __pfx_kobject_init_and_add+0x10/0x10 [ 68.955895][ T5317] ? __kasan_kmalloc+0x93/0xb0 [ 68.955907][ T5317] ? __kmalloc_cache_noprof+0x230/0x3d0 [ 68.955919][ T5317] ? lookup_or_create_module_kobject+0x75/0x170 [ 68.955936][ T5317] lookup_or_create_module_kobject+0xe3/0x170 [ 68.955952][ T5317] module_add_driver+0xb9/0x310 [ 68.955967][ T5317] bus_add_driver+0x391/0x640 [ 68.955981][ T5317] driver_register+0x23a/0x320 [ 68.955995][ T5317] usb_gadget_register_driver_owner+0xf9/0x270 [ 68.956015][ T5317] raw_ioctl+0x149a/0x3c90 [ 68.956031][ T5317] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 68.956047][ T5317] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 68.956062][ T5317] ? tomoyo_path_number_perm+0x4e2/0x5a0 [ 68.956076][ T5317] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 68.956091][ T5317] ? __pfx_raw_ioctl+0x10/0x10 [ 68.956107][ T5317] ? count_memcg_event_mm+0x92/0x3b0 [ 68.956123][ T5317] ? __lock_acquire+0xaac/0xd20 [ 68.956147][ T5317] ? __fget_files+0x2a/0x420 [ 68.956163][ T5317] ? __fget_files+0x3a0/0x420 [ 68.956174][ T5317] ? __fget_files+0x2a/0x420 [ 68.956188][ T5317] ? bpf_lsm_file_ioctl+0x9/0x20 [ 68.956201][ T5317] ? __pfx_raw_ioctl+0x10/0x10 [ 68.956213][ T5317] __se_sys_ioctl+0xf9/0x170 [ 68.956225][ T5317] do_syscall_64+0xf6/0x210 [ 68.956238][ T5317] ? clear_bhb_loop+0x45/0xa0 [ 68.956250][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 68.956259][ T5317] RIP: 0033:0x7fbc3858e56b [ 68.956269][ T5317] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 68.956277][ T5317] RSP: 002b:00007fbc349d1f10 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 68.956289][ T5317] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 00007fbc3858e56b [ 68.956296][ T5317] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000007 [ 68.956302][ T5317] RBP: 00007fbc349d2fe0 R08: 0000000000000000 R09: 00302e6364755f79 [ 68.956308][ T5317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 68.956314][ T5317] R13: 00007fbc349d1fb0 R14: 0000200000000000 R15: 00007fbc388e0b88 [ 68.956329][ T5317] [ 68.956359][ T5317] kobject: kobject_add_internal failed for raw_gadget with -EEXIST, don't try to register things with the same name in the same directory. [ 69.107881][ T5317] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN NOPTI [ 69.113077][ T5317] KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] [ 69.116653][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted 6.15.0-rc4-syzkaller-00296-ge8ab83e34bdc #0 PREEMPT(full) [ 69.121600][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 69.126294][ T5317] RIP: 0010:kasan_byte_accessible+0x12/0x30 [ 69.128871][ T5317] Code: 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cc cc cc cc 66 66 66 66 66 66 2e [ 69.136639][ T5317] RSP: 0018:ffffc9000d5cf840 EFLAGS: 00010002 [ 69.139100][ T5317] RAX: dffffc0000000000 RBX: ffffffff8b589807 RCX: b4ed72fb420b1e00 [ 69.142400][ T5317] RDX: 0000000000000000 RSI: ffffffff8b589807 RDI: 0000000000000004 [ 69.145599][ T5317] RBP: ffffffff819b39d8 R08: 0000000000000001 R09: 0000000000000000 [ 69.149074][ T5317] R10: dffffc0000000000 R11: fffffbfff1efdb2f R12: 0000000000000000 [ 69.152445][ T5317] R13: 0000000000000020 R14: 0000000000000020 R15: 0000000000000001 [ 69.155839][ T5317] FS: 00007fbc349d46c0(0000) GS:ffff88808d6cb000(0000) knlGS:0000000000000000 [ 69.159654][ T5317] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 69.162504][ T5317] CR2: 000055b63d2b0a28 CR3: 000000003ff8a000 CR4: 0000000000352ef0 [ 69.165900][ T5317] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 69.169235][ T5317] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 69.173331][ T5317] Call Trace: [ 69.174872][ T5317] [ 69.176151][ T5317] __kasan_check_byte+0x12/0x40 [ 69.178289][ T5317] lock_acquire+0x8d/0x360 [ 69.180295][ T5317] ? kobj_kset_leave+0x163/0x190 [ 69.182520][ T5317] _raw_spin_lock_irqsave+0xa7/0xf0 [ 69.184781][ T5317] ? complete+0x28/0x1b0 [ 69.186669][ T5317] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 69.189184][ T5317] ? kobject_init_and_add+0x125/0x190 [ 69.191533][ T5317] complete+0x28/0x1b0 [ 69.193309][ T5317] kobject_put+0x228/0x480 [ 69.195235][ T5317] lookup_or_create_module_kobject+0x150/0x170 [ 69.197954][ T5317] module_add_driver+0xb9/0x310 [ 69.200776][ T5317] bus_add_driver+0x391/0x640 [ 69.202877][ T5317] driver_register+0x23a/0x320 [ 69.204947][ T5317] usb_gadget_register_driver_owner+0xf9/0x270 [ 69.207643][ T5317] raw_ioctl+0x149a/0x3c90 [ 69.209742][ T5317] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 69.212197][ T5317] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 69.214643][ T5317] ? tomoyo_path_number_perm+0x4e2/0x5a0 [ 69.216901][ T5317] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 69.219183][ T5317] ? __pfx_raw_ioctl+0x10/0x10 [ 69.221152][ T5317] ? count_memcg_event_mm+0x92/0x3b0 [ 69.223437][ T5317] ? __lock_acquire+0xaac/0xd20 [ 69.225654][ T5317] ? __fget_files+0x2a/0x420 [ 69.227767][ T5317] ? __fget_files+0x3a0/0x420 [ 69.229813][ T5317] ? __fget_files+0x2a/0x420 [ 69.231814][ T5317] ? bpf_lsm_file_ioctl+0x9/0x20 [ 69.233915][ T5317] ? __pfx_raw_ioctl+0x10/0x10 [ 69.235956][ T5317] __se_sys_ioctl+0xf9/0x170 [ 69.237931][ T5317] do_syscall_64+0xf6/0x210 [ 69.239891][ T5317] ? clear_bhb_loop+0x45/0xa0 [ 69.241941][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 69.244442][ T5317] RIP: 0033:0x7fbc3858e56b [ 69.246449][ T5317] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 69.254693][ T5317] RSP: 002b:00007fbc349d1f10 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 69.258297][ T5317] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 00007fbc3858e56b [ 69.261666][ T5317] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000007 [ 69.265063][ T5317] RBP: 00007fbc349d2fe0 R08: 0000000000000000 R09: 00302e6364755f79 [ 69.268543][ T5317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 69.272023][ T5317] R13: 00007fbc349d1fb0 R14: 0000200000000000 R15: 00007fbc388e0b88 [ 69.275427][ T5317] [ 69.276792][ T5317] Modules linked in: [ 69.278554][ T5317] ---[ end trace 0000000000000000 ]--- [ 69.280926][ T5317] RIP: 0010:kasan_byte_accessible+0x12/0x30 [ 69.283458][ T5317] Code: 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cc cc cc cc 66 66 66 66 66 66 2e [ 69.291697][ T5317] RSP: 0018:ffffc9000d5cf840 EFLAGS: 00010002 [ 69.294255][ T5317] RAX: dffffc0000000000 RBX: ffffffff8b589807 RCX: b4ed72fb420b1e00 [ 69.297708][ T5317] RDX: 0000000000000000 RSI: ffffffff8b589807 RDI: 0000000000000004 [ 69.301137][ T5317] RBP: ffffffff819b39d8 R08: 0000000000000001 R09: 0000000000000000 [ 69.304456][ T5317] R10: dffffc0000000000 R11: fffffbfff1efdb2f R12: 0000000000000000 [ 69.307851][ T5317] R13: 0000000000000020 R14: 0000000000000020 R15: 0000000000000001 [ 69.311308][ T5317] FS: 00007fbc349d46c0(0000) GS:ffff88808d6cb000(0000) knlGS:0000000000000000 [ 69.315044][ T5317] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 69.318017][ T5317] CR2: 000055b63d2b0a28 CR3: 000000003ff8a000 CR4: 0000000000352ef0 [ 69.321528][ T5317] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 69.324895][ T5317] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 69.328286][ T5317] Kernel panic - not syncing: Fatal exception [ 69.331022][ T5317] Kernel Offset: disabled [ 69.332835][ T5317] Rebooting in 86400 seconds..