8<--- cut here --- Unable to handle kernel NULL pointer dereference at virtual address 00000000 when read [00000000] *pgd=8625b003, *pmd=df126003 Internal error: Oops: 205 [#1] SMP ARM Modules linked in: CPU: 0 UID: 0 PID: 15547 Comm: syz.4.3209 Tainted: G L syzkaller #0 PREEMPT Tainted: [L]=SOFTLOCKUP Hardware name: ARM-Versatile Express PC is at dummy_set_selfpowered+0x44/0x60 drivers/usb/gadget/udc/dummy_hcd.c:906 LR is at 0x1 pc : [<810bf37c>] lr : [<00000001>] psr: 20000013 sp : dfa9dc78 ip : 000009a8 fp : dfa9dc84 r10: 81c2d69c r9 : 00000000 r8 : 0000001a r7 : 00000000 r6 : 85a2120c r5 : 8460c6b0 r4 : 8460c6b0 r3 : 00000000 r2 : 00000000 r1 : 00000001 r0 : 00000000 Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 85a8bd40 DAC: fffffffd Register r0 information: NULL pointer Register r1 information: non-paged memory Register r2 information: NULL pointer Register r3 information: NULL pointer Register r4 information: slab kmalloc-4k start 8460c000 pointer offset 1712 size 4096 Register r5 information: slab kmalloc-4k start 8460c000 pointer offset 1712 size 4096 Register r6 information: slab kmalloc-2k start 85a21000 pointer offset 524 size 2048 Register r7 information: NULL pointer Register r8 information: non-paged memory Register r9 information: NULL pointer Register r10 information: non-slab/vmalloc memory Register r11 information: 2-page vmalloc region starting at 0xdfa9c000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2748 Register r12 information: non-paged memory Process syz.4.3209 (pid: 15547, stack limit = 0xdfa9c000) Stack: (0xdfa9dc78 to 0xdfa9e000) dc60: dfa9dca4 dfa9dc88 dc80: 810bbde4 810bf344 85a212b0 8460c6b0 85a2120c 00000000 dfa9dcc4 dfa9dca8 dca0: 810b685c 810bbdc8 8454b800 85a21234 85a21234 8460c6f8 dfa9dd0c dfa9dcc8 dcc0: 810b9f04 810b67c4 dfa9dce4 8468a5d8 823a5090 8750ca50 85a212b0 8460c6b0 dce0: 8067a2ac 8454b800 85a21234 85a21258 8460c6f8 0000001a 00000000 81c2d69c dd00: dfa9dd34 dfa9dd10 810bd310 810b9ed4 8460c6f8 00000000 85a21258 00000000 dd20: 0000001a 00000000 dfa9dd64 dfa9dd38 80bd4b6c 810bd28c dfa9dd64 dfa9dd48 dd40: 80be7a64 8460c6f8 85a21258 8460c744 8460c6f8 0000001a dfa9dd94 dfa9dd68 dd60: 80bd4f40 80bd4aa0 dfa9dd9c dfa9dd78 82d24ff4 82d25004 8460c744 8460c6f8 dd80: 0000001a 00000000 dfa9ddbc dfa9dd98 80bd519c 80bd4eac 8460c6f8 85a21258 dda0: 8460c744 00000000 8731f2b8 00000000 dfa9dddc dfa9ddc0 80bd5418 80bd516c ddc0: 85a21258 80bd5358 8384d400 00000000 dfa9de0c dfa9dde0 80bd248c 80bd5364 dde0: 81b68570 8384d454 844cd1b4 8386cd11 85a21258 8731f280 00000000 8384d400 de00: dfa9de1c dfa9de10 80bd43ec 80bd2414 dfa9de4c dfa9de20 80bd3b44 80bd43d4 de20: 878f8200 85a211e0 dfa9de4c 85a21258 85a21000 85a21258 868f1598 85a211e0 de40: dfa9de64 dfa9de50 80bd64a8 80bd3a40 85a21234 85a21000 dfa9de84 dfa9de68 de60: 810babd8 80bd642c 8791e6c0 85a21000 0000000b 868f1598 dfa9deac dfa9de88 de80: 810b8894 810bab90 0000000b 868f1580 dfa9df08 868f1598 8658bb04 8658bb00 dea0: dfa9ded4 dfa9deb0 8067b9d8 810b87c4 0000000b 8679ee00 20000700 dfa9df68 dec0: 8067b928 878d0c40 dfa9df64 dfa9ded8 8059fbd0 8067b934 dfa9df04 dfa9dee8 dee0: 8022ab90 8022bb88 00000000 00000000 00010000 0000000b 20000700 00000000 df00: 00000001 00000000 8679ee00 00000000 00000000 00000000 00000000 00000000 df20: 00000000 00004004 00000000 00000000 dfa9df54 8386cd11 dfa9df64 8679ee03 df40: 8679ee00 00000000 00000000 8020029c 878d0c40 00000004 dfa9df94 dfa9df68 df60: 8059fef4 8059f960 00000000 00000000 00000000 8386cd11 00000000 00000000 df80: 00356310 00000004 dfa9dfa4 dfa9df98 8059ff7c 8059fe8c 00000000 dfa9dfa8 dfa0: 80200060 8059ff78 00000000 00000000 00000005 20000700 0000000b 00000000 dfc0: 00000000 00000000 00356310 00000004 003562d8 00000000 00000001 76fe50dc dfe0: 76fe4e88 76fe4e78 00018ebc 001308d0 60000010 00000005 00000000 00000000 Call trace: [<810bf338>] (dummy_set_selfpowered) from [<810bbde4>] (usb_gadget_set_selfpowered+0x28/0x114 drivers/usb/gadget/udc/core.c:578) [<810bbdbc>] (usb_gadget_set_selfpowered) from [<810b685c>] (composite_dev_prepare+0xa4/0xe8 drivers/usb/gadget/composite.c:2440) r7:00000000 r6:85a2120c r5:8460c6b0 r4:85a212b0 [<810b67b8>] (composite_dev_prepare) from [<810b9f04>] (configfs_composite_bind+0x3c/0x5e8 drivers/usb/gadget/configfs.c:1701) r7:8460c6f8 r6:85a21234 r5:85a21234 r4:8454b800 [<810b9ec8>] (configfs_composite_bind) from [<810bd310>] (gadget_bind_driver+0x90/0x2b0 drivers/usb/gadget/udc/core.c:1662) r10:81c2d69c r9:00000000 r8:0000001a r7:8460c6f8 r6:85a21258 r5:85a21234 r4:8454b800 [<810bd280>] (gadget_bind_driver) from [<80bd4b6c>] (call_driver_probe drivers/base/dd.c:628 [inline]) [<810bd280>] (gadget_bind_driver) from [<80bd4b6c>] (really_probe+0xd8/0x40c drivers/base/dd.c:706) r9:00000000 r8:0000001a r7:00000000 r6:85a21258 r5:00000000 r4:8460c6f8 [<80bd4a94>] (really_probe) from [<80bd4f40>] (__driver_probe_device+0xa0/0x21c drivers/base/dd.c:868) r8:0000001a r7:8460c6f8 r6:8460c744 r5:85a21258 r4:8460c6f8 [<80bd4ea0>] (__driver_probe_device) from [<80bd519c>] (driver_probe_device+0x3c/0xc0 drivers/base/dd.c:898) r9:00000000 r8:0000001a r7:8460c6f8 r6:8460c744 r5:82d25004 r4:82d24ff4 [<80bd5160>] (driver_probe_device) from [<80bd5418>] (__driver_attach+0xc0/0x1f0 drivers/base/dd.c:1292) r9:00000000 r8:8731f2b8 r7:00000000 r6:8460c744 r5:85a21258 r4:8460c6f8 [<80bd5358>] (__driver_attach) from [<80bd248c>] (bus_for_each_dev+0x84/0xd4 drivers/base/bus.c:383) r7:00000000 r6:8384d400 r5:80bd5358 r4:85a21258 [<80bd2408>] (bus_for_each_dev) from [<80bd43ec>] (driver_attach+0x24/0x28 drivers/base/dd.c:1310) r7:8384d400 r6:00000000 r5:8731f280 r4:85a21258 [<80bd43c8>] (driver_attach) from [<80bd3b44>] (bus_add_driver+0x110/0x230 drivers/base/bus.c:763) [<80bd3a34>] (bus_add_driver) from [<80bd64a8>] (driver_register+0x88/0x124 drivers/base/driver.c:174) r8:85a211e0 r7:868f1598 r6:85a21258 r5:85a21000 r4:85a21258 [<80bd6420>] (driver_register) from [<810babd8>] (usb_gadget_register_driver_owner+0x54/0xec drivers/usb/gadget/udc/core.c:1752) r5:85a21000 r4:85a21234 [<810bab84>] (usb_gadget_register_driver_owner) from [<810b8894>] (gadget_dev_desc_UDC_store+0xdc/0x114 drivers/usb/gadget/configfs.c:300) r7:868f1598 r6:0000000b r5:85a21000 r4:8791e6c0 [<810b87b8>] (gadget_dev_desc_UDC_store) from [<8067b9d8>] (flush_write_buffer fs/configfs/file.c:207 [inline]) [<810b87b8>] (gadget_dev_desc_UDC_store) from [<8067b9d8>] (configfs_write_iter+0xb0/0x124 fs/configfs/file.c:229) r9:8658bb00 r8:8658bb04 r7:868f1598 r6:dfa9df08 r5:868f1580 r4:0000000b [<8067b928>] (configfs_write_iter) from [<8059fbd0>] (new_sync_write fs/read_write.c:595 [inline]) [<8067b928>] (configfs_write_iter) from [<8059fbd0>] (vfs_write fs/read_write.c:687 [inline]) [<8067b928>] (configfs_write_iter) from [<8059fbd0>] (vfs_write+0x27c/0x42c fs/read_write.c:667) r9:878d0c40 r8:8067b928 r7:dfa9df68 r6:20000700 r5:8679ee00 r4:0000000b [<8059f954>] (vfs_write) from [<8059fef4>] (ksys_write+0x74/0xec fs/read_write.c:739) r10:00000004 r9:878d0c40 r8:8020029c r7:00000000 r6:00000000 r5:8679ee00 r4:8679ee03 [<8059fe80>] (ksys_write) from [<8059ff7c>] (__do_sys_write fs/read_write.c:750 [inline]) [<8059fe80>] (ksys_write) from [<8059ff7c>] (sys_write+0x10/0x14 fs/read_write.c:747) r7:00000004 r6:00356310 r5:00000000 r4:00000000 [<8059ff6c>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67) Exception stack(0xdfa9dfa8 to 0xdfa9dff0) dfa0: 00000000 00000000 00000005 20000700 0000000b 00000000 dfc0: 00000000 00000000 00356310 00000004 003562d8 00000000 00000001 76fe50dc dfe0: 76fe4e88 76fe4e78 00018ebc 001308d0 Code: e3a00000 01a03002 e3510000 030f2ffe (e5933000) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e3a00000 mov r0, #0 4: 01a03002 moveq r3, r2 8: e3510000 cmp r1, #0 c: 030f2ffe movweq r2, #65534 @ 0xfffe * 10: e5933000 ldr r3, [r3] <-- trapping instruction