Oops: general protection fault, probably for non-canonical address 0xdffffc0000000060: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000300-0x0000000000000307]
CPU: 1 UID: 0 PID: 15117 Comm: udevd Not tainted 6.13.0-rc4-syzkaller-00054-gd6ef8b40d075 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:strcmp+0x42/0xa0 lib/string.c:277
Code: 00 fc ff df 31 db 49 8d 3c 1c 48 89 f8 48 c1 e8 03 42 0f b6 04 38 84 c0 75 29 41 0f b6 2c 1c 49 8d 3c 1e 48 89 f8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 75 20 41 3a 2c 1e 75 2a 48 ff c3 40 84 ed 75
RSP: 0018:ffffc90000a184d8 EFLAGS: 00010006
RAX: 0000000000000060 RBX: 0000000000000000 RCX: dffffc0000000000
RDX: 0000000000000001 RSI: 0000000000000300 RDI: 0000000000000300
RBP: 0000000000000026 R08: ffffffff942a4a2f R09: 1ffffffff2854945
R10: dffffc0000000000 R11: fffffbfff2854946 R12: ffffffff8c5fb700
R13: ffffffff93c4efd8 R14: 0000000000000300 R15: dffffc0000000000
FS: 00007f248c6ccc80(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000561912983950 CR3: 000000005bfb4000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
count_matching_names+0xfa/0x1c0 kernel/locking/lockdep.c:875
register_lock_class+0x450/0x980 kernel/locking/lockdep.c:1340
__lock_acquire+0xf3/0x2100 kernel/locking/lockdep.c:5101
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
complete_with_flags kernel/sched/completion.c:20 [inline]
complete+0x28/0x1c0 kernel/sched/completion.c:47
transfer drivers/usb/gadget/udc/dummy_hcd.c:1522 [inline]
dummy_timer+0x224c/0x4620 drivers/usb/gadget/udc/dummy_hcd.c:1977
__run_hrtimer kernel/time/hrtimer.c:1739 [inline]
__hrtimer_run_queues+0x59b/0xd30 kernel/time/hrtimer.c:1803
hrtimer_run_softirq+0x19a/0x2c0 kernel/time/hrtimer.c:1820
handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561
__do_softirq kernel/softirq.c:595 [inline]
invoke_softirq kernel/softirq.c:435 [inline]
__irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662
irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:stack_trace_consume_entry+0xd/0x280 kernel/stacktrace.c:83
Code: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 41 57 41 56 41 55 41 54 <53> 48 83 ec 18 48 89 fb 48 ba 00 00 00 00 00 fc ff df 4c 8d 4f 10
RSP: 0018:ffffc900156e7450 EFLAGS: 00000282
RAX: ffffffff8215de3e RBX: ffffc900156e7480 RCX: ffffffff91792000
RDX: ffffffff91942801 RSI: ffffffff8215de3e RDI: ffffc900156e7560
RBP: ffffc900156e7510 R08: ffffc900156e7d30 R09: 0000000000000000
R10: ffffc900156e74d0 R11: ffffffff818b3a20 R12: ffff88806ea90000
R13: ffffffff818b3a20 R14: ffffc900156e7560 R15: 0000000000000000
arch_stack_walk+0x10e/0x150 arch/x86/kernel/stacktrace.c:27
stack_trace_save+0x118/0x1d0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329
kmalloc_noprof include/linux/slab.h:901 [inline]
slab_free_hook mm/slub.c:2305 [inline]
slab_free mm/slub.c:4613 [inline]
kmem_cache_free+0x16c/0x410 mm/slub.c:4715
path_openat+0x2ee0/0x3590 fs/namei.c:3996
do_filp_open+0x27f/0x4e0 fs/namei.c:4014
do_sys_openat2+0x13e/0x1d0 fs/open.c:1402
do_sys_open fs/open.c:1417 [inline]
__do_sys_openat fs/open.c:1433 [inline]
__se_sys_openat fs/open.c:1428 [inline]
__x64_sys_openat+0x247/0x2a0 fs/open.c:1428
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f248c3169a4
Code: 24 20 48 8d 44 24 30 48 89 44 24 28 64 8b 04 25 18 00 00 00 85 c0 75 2c 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 76 60 48 8b 15 55 a4 0d 00 f7 d8 64 89 02 48 83
RSP: 002b:00007ffee96b7410 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00007f248c3169a4
RDX: 0000000000080000 RSI: 00007ffee96b7548 RDI: 00000000ffffff9c
RBP: 00007ffee96b7548 R08: 0000000000000008 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000080000
R13: 000055bb92963b42 R14: 0000000000000001 R15: 000055bb9297f160
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:strcmp+0x42/0xa0 lib/string.c:277
Code: 00 fc ff df 31 db 49 8d 3c 1c 48 89 f8 48 c1 e8 03 42 0f b6 04 38 84 c0 75 29 41 0f b6 2c 1c 49 8d 3c 1e 48 89 f8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 75 20 41 3a 2c 1e 75 2a 48 ff c3 40 84 ed 75
RSP: 0018:ffffc90000a184d8 EFLAGS: 00010006
RAX: 0000000000000060 RBX: 0000000000000000 RCX: dffffc0000000000
RDX: 0000000000000001 RSI: 0000000000000300 RDI: 0000000000000300
RBP: 0000000000000026 R08: ffffffff942a4a2f R09: 1ffffffff2854945
R10: dffffc0000000000 R11: fffffbfff2854946 R12: ffffffff8c5fb700
R13: ffffffff93c4efd8 R14: 0000000000000300 R15: dffffc0000000000
FS: 00007f248c6ccc80(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000561912983950 CR3: 000000005bfb4000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 3 bytes skipped:
0: df 31 fbstp (%rcx)
2: db 49 8d fisttpl -0x73(%rcx)
5: 3c 1c cmp $0x1c,%al
7: 48 89 f8 mov %rdi,%rax
a: 48 c1 e8 03 shr $0x3,%rax
e: 42 0f b6 04 38 movzbl (%rax,%r15,1),%eax
13: 84 c0 test %al,%al
15: 75 29 jne 0x40
17: 41 0f b6 2c 1c movzbl (%r12,%rbx,1),%ebp
1c: 49 8d 3c 1e lea (%r14,%rbx,1),%rdi
20: 48 89 f8 mov %rdi,%rax
23: 48 c1 e8 03 shr $0x3,%rax
* 27: 42 0f b6 04 38 movzbl (%rax,%r15,1),%eax <-- trapping instruction
2c: 84 c0 test %al,%al
2e: 75 20 jne 0x50
30: 41 3a 2c 1e cmp (%r14,%rbx,1),%bpl
34: 75 2a jne 0x60
36: 48 ff c3 inc %rbx
39: 40 84 ed test %bpl,%bpl
3c: 75 .byte 0x75