general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] CPU: 0 PID: 21787 Comm: syz-executor.5 Not tainted 5.10.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:cdev_del+0x22/0x90 fs/char_dev.c:596 Code: b5 0f 1f 80 00 00 00 00 55 48 89 fd 48 83 ec 08 e8 73 e0 b2 ff 48 8d 7d 64 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 4f 48 RSP: 0018:ffffc90016ee7ad0 EFLAGS: 00010207 RAX: dffffc0000000000 RBX: ffff88801530e300 RCX: ffffc90013d6e000 RDX: 000000000000000c RSI: ffffffff81bd23fd RDI: 0000000000000064 RBP: 0000000000000000 R08: 0000000000000001 R09: ffffffff8ebb075f R10: 0000000000000000 R11: 0000000000000000 R12: ffff88801530e308 R13: ffff8881439e1208 R14: ffff88806d5a3028 R15: ffff88806d91b650 FS: 00007f7cf4809700(0000) GS:ffff8880b9e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffc6dc85fa8 CR3: 0000000026755000 CR4: 00000000001506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: tty_unregister_device drivers/tty/tty_io.c:3198 [inline] tty_unregister_device+0x112/0x1b0 drivers/tty/tty_io.c:3193 gsmld_detach_gsm drivers/tty/n_gsm.c:2407 [inline] gsmld_close+0xaa/0x260 drivers/tty/n_gsm.c:2476 tty_ldisc_close+0x110/0x190 drivers/tty/tty_ldisc.c:488 tty_ldisc_kill+0x94/0x150 drivers/tty/tty_ldisc.c:636 tty_ldisc_release+0xe1/0x2a0 drivers/tty/tty_ldisc.c:808 tty_release_struct+0x20/0xe0 drivers/tty/tty_io.c:1616 tty_release+0xc70/0x1210 drivers/tty/tty_io.c:1787 __fput+0x285/0x920 fs/file_table.c:281 task_work_run+0xdd/0x190 kernel/task_work.c:151 get_signal+0xd8f/0x1f10 kernel/signal.c:2562 arch_do_signal+0x82/0x2390 arch/x86/kernel/signal.c:811 exit_to_user_mode_loop kernel/entry/common.c:161 [inline] exit_to_user_mode_prepare+0x100/0x1a0 kernel/entry/common.c:191 syscall_exit_to_user_mode+0x38/0x260 kernel/entry/common.c:266 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45e159 Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f7cf4808c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: 0000000000000000 RBX: 0000000000000005 RCX: 000000000045e159 RDX: 0000000020000000 RSI: 0000000000005423 RDI: 0000000000000003 RBP: 00007f7cf4808ca0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 R13: 00000000016afb7f R14: 00007f7cf48099c0 R15: 000000000119c034 Modules linked in: ---[ end trace 13599e308a674627 ]--- RIP: 0010:cdev_del+0x22/0x90 fs/char_dev.c:596 Code: b5 0f 1f 80 00 00 00 00 55 48 89 fd 48 83 ec 08 e8 73 e0 b2 ff 48 8d 7d 64 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 4f 48 RSP: 0018:ffffc90016ee7ad0 EFLAGS: 00010207 RAX: dffffc0000000000 RBX: ffff88801530e300 RCX: ffffc90013d6e000 RDX: 000000000000000c RSI: ffffffff81bd23fd RDI: 0000000000000064 RBP: 0000000000000000 R08: 0000000000000001 R09: ffffffff8ebb075f R10: 0000000000000000 R11: 0000000000000000 R12: ffff88801530e308 R13: ffff8881439e1208 R14: ffff88806d5a3028 R15: ffff88806d91b650 FS: 00007f7cf4809700(0000) GS:ffff8880b9e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2b51241028 CR3: 0000000026755000 CR4: 00000000001506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400