Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 UID: 0 PID: 5772 Comm: kworker/0:8 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 Workqueue: sync_wq local_pci_probe_callback RIP: 0010:software_node_register+0x2c/0x350 drivers/base/swnode.c:927 Code: 1e fa 41 57 41 56 41 55 41 54 49 89 fc 55 4d 8d 7c 24 08 53 e8 d5 20 aa fb 4c 89 fa 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 f2 02 00 00 4d 8b 74 24 08 4d 85 f6 0f 84 0e 02 RSP: 0018:ffffc900041cfa60 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff8660562f RDX: 0000000000000001 RSI: ffffffff8660440b RDI: 0000000000000000 RBP: ffff8880242d6000 R08: 0000000000000007 R09: fffffffffffff000 R10: ffff888023aab010 R11: 0000000000000000 R12: 0000000000000000 R13: ffff888075bf0010 R14: ffff8880242d60d0 R15: 0000000000000008 FS: 0000000000000000(0000) GS:ffff888123dd8000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffc9c36a918 CR3: 00000000350c5000 CR4: 00000000003526f0 Call Trace: device_add_software_node+0x35d/0x3f0 drivers/base/swnode.c:1015 dwc3_pci_quirks drivers/usb/dwc3/dwc3-pci.c:311 [inline] dwc3_pci_probe+0x3cd/0xbf0 drivers/usb/dwc3/dwc3-pci.c:375 local_pci_probe+0xdd/0x1b0 drivers/pci/pci-driver.c:332 local_pci_probe_callback+0x35/0x80 drivers/pci/pci-driver.c:361 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322 process_scheduled_works kernel/workqueue.c:3405 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:software_node_register+0x2c/0x350 drivers/base/swnode.c:927 Code: 1e fa 41 57 41 56 41 55 41 54 49 89 fc 55 4d 8d 7c 24 08 53 e8 d5 20 aa fb 4c 89 fa 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 f2 02 00 00 4d 8b 74 24 08 4d 85 f6 0f 84 0e 02 RSP: 0018:ffffc900041cfa60 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff8660562f RDX: 0000000000000001 RSI: ffffffff8660440b RDI: 0000000000000000 RBP: ffff8880242d6000 R08: 0000000000000007 R09: fffffffffffff000 R10: ffff888023aab010 R11: 0000000000000000 R12: 0000000000000000 R13: ffff888075bf0010 R14: ffff8880242d60d0 R15: 0000000000000008 FS: 0000000000000000(0000) GS:ffff888123dd8000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffc9c36a918 CR3: 00000000350c5000 CR4: 00000000003526f0 ---------------- Code disassembly (best guess), 1 bytes skipped: 0: fa cli 1: 41 57 push %r15 3: 41 56 push %r14 5: 41 55 push %r13 7: 41 54 push %r12 9: 49 89 fc mov %rdi,%r12 c: 55 push %rbp d: 4d 8d 7c 24 08 lea 0x8(%r12),%r15 12: 53 push %rbx 13: e8 d5 20 aa fb call 0xfbaa20ed 18: 4c 89 fa mov %r15,%rdx 1b: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 22: fc ff df 25: 48 c1 ea 03 shr $0x3,%rdx * 29: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction 2d: 0f 85 f2 02 00 00 jne 0x325 33: 4d 8b 74 24 08 mov 0x8(%r12),%r14 38: 4d 85 f6 test %r14,%r14 3b: 0f .byte 0xf 3c: 84 0e test %cl,(%rsi) 3e: 02 .byte 0x2