Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 1 UID: 0 PID: 845 Comm: syz.0.152 Not tainted syzkaller #0 200dea8a17c83f35b0a1e1238c384757fc17b797 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:set_link_state+0x2a/0x1240 drivers/usb/gadget/udc/dummy_hcd.c:435 Code: 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 60 49 89 fd 48 bb 00 00 00 00 00 fc ff df e8 9d 00 ce fd 4c 89 e8 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 ef e8 78 c3 26 fe 4d 8b 75 00 49 8d 95 93 RSP: 0018:ffffc9000f0df718 EFLAGS: 00010046 RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff8881232c0000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000f0df7a0 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff52001e1bee0 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ffff888102bd4000 FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fbb3cf52000 CR3: 00000000074aa000 CR4: 00000000003526b0 Call Trace: dummy_pullup+0xd1/0x130 drivers/usb/gadget/udc/dummy_hcd.c:914 usb_gadget_disconnect_locked+0x151/0x400 drivers/usb/gadget/udc/core.c:782 gadget_unbind_driver+0xaf/0x3f0 drivers/usb/gadget/udc/core.c:1697 device_remove drivers/base/dd.c:567 [inline] __device_release_driver drivers/base/dd.c:1272 [inline] device_release_driver_internal+0x4ad/0x830 drivers/base/dd.c:1295 driver_detach+0x1f5/0x2d0 drivers/base/dd.c:1358 bus_remove_driver+0x254/0x2b0 drivers/base/bus.c:744 driver_unregister+0x79/0xb0 drivers/base/driver.c:274 usb_gadget_unregister_driver+0x52/0x80 drivers/usb/gadget/udc/core.c:1763 raw_release+0xdb/0x280 drivers/usb/gadget/legacy/raw_gadget.c:463 __fput+0x208/0xa30 fs/file_table.c:447 ____fput+0x20/0x30 fs/file_table.c:475 task_work_run+0x1e8/0x260 kernel/task_work.c:246 exit_task_work include/linux/task_work.h:43 [inline] do_exit+0xa46/0x2850 kernel/exit.c:955 do_group_exit+0x21f/0x2f0 kernel/exit.c:1098 get_signal+0x134c/0x1490 kernel/signal.c:2933 arch_do_signal_or_restart+0xbc/0x700 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x57/0xb0 kernel/entry/common.c:218 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f0c0cb9e019 Code: Unable to access opcode bytes at 0x7f0c0cb9dfef. RSP: 002b:00007ffcff587878 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffdfc RBX: 000000000000b8b8 RCX: 00007f0c0cb9e019 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f0c0ce25fac RBP: 0000000000000bea R08: 4000000000000000 R09: 0000000000000000 R10: 00007ffcff587980 R11: 0000000000000246 R12: 00007ffcff5879a0 R13: 00007f0c0ce25fac R14: 000000000000c4a2 R15: 00007ffcff587980 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:set_link_state+0x2a/0x1240 drivers/usb/gadget/udc/dummy_hcd.c:435 Code: 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 60 49 89 fd 48 bb 00 00 00 00 00 fc ff df e8 9d 00 ce fd 4c 89 e8 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 ef e8 78 c3 26 fe 4d 8b 75 00 49 8d 95 93 RSP: 0018:ffffc9000f0df718 EFLAGS: 00010046 RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff8881232c0000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000f0df7a0 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff52001e1bee0 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ffff888102bd4000 FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fbb3cf52000 CR3: 00000000074aa000 CR4: 00000000003526b0 ---------------- Code disassembly (best guess): 0: 55 push %rbp 1: 48 89 e5 mov %rsp,%rbp 4: 41 57 push %r15 6: 41 56 push %r14 8: 41 55 push %r13 a: 41 54 push %r12 c: 53 push %rbx d: 48 83 ec 60 sub $0x60,%rsp 11: 49 89 fd mov %rdi,%r13 14: 48 bb 00 00 00 00 00 movabs $0xdffffc0000000000,%rbx 1b: fc ff df 1e: e8 9d 00 ce fd call 0xfdce00c0 23: 4c 89 e8 mov %r13,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1) <-- trapping instruction 2e: 74 08 je 0x38 30: 4c 89 ef mov %r13,%rdi 33: e8 78 c3 26 fe call 0xfe26c3b0 38: 4d 8b 75 00 mov 0x0(%r13),%r14 3c: 49 rex.WB 3d: 8d .byte 0x8d 3e: 95 xchg %eax,%ebp 3f: 93 xchg %eax,%ebx