8<--- cut here --- Unable to handle kernel NULL pointer dereference at virtual address 00000000 when read [00000000] *pgd=875c0003, *pmd=df7b0003 Internal error: Oops: 205 [#1] SMP ARM Modules linked in: CPU: 0 UID: 0 PID: 26707 Comm: syz.4.4722 Tainted: G L syzkaller #0 PREEMPT Tainted: [L]=SOFTLOCKUP Hardware name: ARM-Versatile Express PC is at dummy_set_selfpowered+0x44/0x60 drivers/usb/gadget/udc/dummy_hcd.c:888 LR is at 0x1 pc : [<810beec4>] lr : [<00000001>] psr: 20000013 sp : e02c9c78 ip : 000009a8 fp : e02c9c84 r10: 81c2d69c r9 : 00000000 r8 : 000000d1 r7 : 00000000 r6 : 8517420c r5 : 83e0d6b0 r4 : 83e0d6b0 r3 : 00000000 r2 : 00000000 r1 : 00000001 r0 : 00000000 Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 8608be80 DAC: fffffffd Register r0 information: NULL pointer Register r1 information: non-paged memory Register r2 information: NULL pointer Register r3 information: NULL pointer Register r4 information: slab kmalloc-4k start 83e0d000 pointer offset 1712 size 4096 Register r5 information: slab kmalloc-4k start 83e0d000 pointer offset 1712 size 4096 Register r6 information: slab kmalloc-2k start 85174000 pointer offset 524 size 2048 Register r7 information: NULL pointer Register r8 information: non-paged memory Register r9 information: NULL pointer Register r10 information: non-slab/vmalloc memory Register r11 information: 2-page vmalloc region starting at 0xe02c8000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2748 Register r12 information: non-paged memory Process syz.4.4722 (pid: 26707, stack limit = 0xe02c8000) Stack: (0xe02c9c78 to 0xe02ca000) 9c60: e02c9ca4 e02c9c88 9c80: 810bb92c 810bee8c 851742b0 83e0d6b0 8517420c 00000000 e02c9cc4 e02c9ca8 9ca0: 810b63a4 810bb910 845fd800 85174234 85174234 83e0d6f8 e02c9d0c e02c9cc8 9cc0: 810b9a4c 810b630c e02c9ce4 844f45d8 823a4f4c 86ef3dc0 851742b0 83e0d6b0 9ce0: 80679fbc 845fd800 85174234 85174258 83e0d6f8 000000d1 00000000 81c2d69c 9d00: e02c9d34 e02c9d10 810bce58 810b9a1c 83e0d6f8 00000000 85174258 00000000 9d20: 000000d1 00000000 e02c9d64 e02c9d38 80bd481c 810bcdd4 e02c9d64 e02c9d48 9d40: 80be7714 83e0d6f8 85174258 83e0d744 83e0d6f8 000000d1 e02c9d94 e02c9d68 9d60: 80bd4bf0 80bd4750 e02c9d9c e02c9d78 82d24ff4 82d25004 83e0d744 83e0d6f8 9d80: 000000d1 00000000 e02c9dbc e02c9d98 80bd4e4c 80bd4b5c 83e0d6f8 85174258 9da0: 83e0d744 00000000 8759fa38 00000000 e02c9ddc e02c9dc0 80bd50c8 80bd4e1c 9dc0: 85174258 80bd5008 833d1400 00000000 e02c9e0c e02c9de0 80bd213c 80bd5014 9de0: 81b67c70 833d1454 844cbdb4 eabe46d5 85174258 8759fa00 00000000 833d1400 9e00: e02c9e1c e02c9e10 80bd409c 80bd20c4 e02c9e4c e02c9e20 80bd37f4 80bd4084 9e20: 86575c40 851741e0 e02c9e4c 85174258 85174000 85174258 8638fb18 851741e0 9e40: e02c9e64 e02c9e50 80bd6158 80bd36f0 85174234 85174000 e02c9e84 e02c9e68 9e60: 810ba720 80bd60dc 8c9f1ac0 85174000 0000000b 8638fb18 e02c9eac e02c9e88 9e80: 810b83dc 810ba6d8 0000000b 8638fb00 e02c9f08 8638fb18 860c1284 860c1280 9ea0: e02c9ed4 e02c9eb0 8067b6e8 810b830c 0000000b 8648b880 20000d00 e02c9f68 9ec0: 8067b638 839f8000 e02c9f64 e02c9ed8 8059fb68 8067b644 e02c9f04 e02c9ee8 9ee0: 8022ab90 8022bb88 00000000 00000000 00010000 0000000b 20000d00 00000000 9f00: 00000001 00000000 8648b880 00000000 00000000 00000000 00000000 00000000 9f20: 00000000 00004004 00000000 00000000 e02c9f54 eabe46d5 e02c9f64 8648b883 9f40: 8648b880 00000000 00000000 8020029c 839f8000 00000004 e02c9f94 e02c9f68 9f60: 8059fe8c 8059f8f8 00000000 00000000 00000000 eabe46d5 00000000 00000000 9f80: 00356310 00000004 e02c9fa4 e02c9f98 8059ff14 8059fe24 00000000 e02c9fa8 9fa0: 80200060 8059ff10 00000000 00000000 00000003 20000d00 0000000b 00000000 9fc0: 00000000 00000000 00356310 00000004 003562d8 00000000 00000001 76fe40dc 9fe0: 76fe3e88 76fe3e78 00018ebc 001308d0 60000010 00000003 00000000 00000000 Call trace: [<810bee80>] (dummy_set_selfpowered) from [<810bb92c>] (usb_gadget_set_selfpowered+0x28/0x114 drivers/usb/gadget/udc/core.c:578) [<810bb904>] (usb_gadget_set_selfpowered) from [<810b63a4>] (composite_dev_prepare+0xa4/0xe8 drivers/usb/gadget/composite.c:2440) r7:00000000 r6:8517420c r5:83e0d6b0 r4:851742b0 [<810b6300>] (composite_dev_prepare) from [<810b9a4c>] (configfs_composite_bind+0x3c/0x5e8 drivers/usb/gadget/configfs.c:1701) r7:83e0d6f8 r6:85174234 r5:85174234 r4:845fd800 [<810b9a10>] (configfs_composite_bind) from [<810bce58>] (gadget_bind_driver+0x90/0x2b0 drivers/usb/gadget/udc/core.c:1662) r10:81c2d69c r9:00000000 r8:000000d1 r7:83e0d6f8 r6:85174258 r5:85174234 r4:845fd800 [<810bcdc8>] (gadget_bind_driver) from [<80bd481c>] (call_driver_probe drivers/base/dd.c:628 [inline]) [<810bcdc8>] (gadget_bind_driver) from [<80bd481c>] (really_probe+0xd8/0x40c drivers/base/dd.c:706) r9:00000000 r8:000000d1 r7:00000000 r6:85174258 r5:00000000 r4:83e0d6f8 [<80bd4744>] (really_probe) from [<80bd4bf0>] (__driver_probe_device+0xa0/0x21c drivers/base/dd.c:868) r8:000000d1 r7:83e0d6f8 r6:83e0d744 r5:85174258 r4:83e0d6f8 [<80bd4b50>] (__driver_probe_device) from [<80bd4e4c>] (driver_probe_device+0x3c/0xc0 drivers/base/dd.c:898) r9:00000000 r8:000000d1 r7:83e0d6f8 r6:83e0d744 r5:82d25004 r4:82d24ff4 [<80bd4e10>] (driver_probe_device) from [<80bd50c8>] (__driver_attach+0xc0/0x1f0 drivers/base/dd.c:1292) r9:00000000 r8:8759fa38 r7:00000000 r6:83e0d744 r5:85174258 r4:83e0d6f8 [<80bd5008>] (__driver_attach) from [<80bd213c>] (bus_for_each_dev+0x84/0xd4 drivers/base/bus.c:383) r7:00000000 r6:833d1400 r5:80bd5008 r4:85174258 [<80bd20b8>] (bus_for_each_dev) from [<80bd409c>] (driver_attach+0x24/0x28 drivers/base/dd.c:1310) r7:833d1400 r6:00000000 r5:8759fa00 r4:85174258 [<80bd4078>] (driver_attach) from [<80bd37f4>] (bus_add_driver+0x110/0x230 drivers/base/bus.c:763) [<80bd36e4>] (bus_add_driver) from [<80bd6158>] (driver_register+0x88/0x124 drivers/base/driver.c:174) r8:851741e0 r7:8638fb18 r6:85174258 r5:85174000 r4:85174258 [<80bd60d0>] (driver_register) from [<810ba720>] (usb_gadget_register_driver_owner+0x54/0xec drivers/usb/gadget/udc/core.c:1752) r5:85174000 r4:85174234 [<810ba6cc>] (usb_gadget_register_driver_owner) from [<810b83dc>] (gadget_dev_desc_UDC_store+0xdc/0x114 drivers/usb/gadget/configfs.c:300) r7:8638fb18 r6:0000000b r5:85174000 r4:8c9f1ac0 [<810b8300>] (gadget_dev_desc_UDC_store) from [<8067b6e8>] (flush_write_buffer fs/configfs/file.c:207 [inline]) [<810b8300>] (gadget_dev_desc_UDC_store) from [<8067b6e8>] (configfs_write_iter+0xb0/0x124 fs/configfs/file.c:229) r9:860c1280 r8:860c1284 r7:8638fb18 r6:e02c9f08 r5:8638fb00 r4:0000000b [<8067b638>] (configfs_write_iter) from [<8059fb68>] (new_sync_write fs/read_write.c:595 [inline]) [<8067b638>] (configfs_write_iter) from [<8059fb68>] (vfs_write fs/read_write.c:687 [inline]) [<8067b638>] (configfs_write_iter) from [<8059fb68>] (vfs_write+0x27c/0x42c fs/read_write.c:667) r9:839f8000 r8:8067b638 r7:e02c9f68 r6:20000d00 r5:8648b880 r4:0000000b [<8059f8ec>] (vfs_write) from [<8059fe8c>] (ksys_write+0x74/0xec fs/read_write.c:739) r10:00000004 r9:839f8000 r8:8020029c r7:00000000 r6:00000000 r5:8648b880 r4:8648b883 [<8059fe18>] (ksys_write) from [<8059ff14>] (__do_sys_write fs/read_write.c:750 [inline]) [<8059fe18>] (ksys_write) from [<8059ff14>] (sys_write+0x10/0x14 fs/read_write.c:747) r7:00000004 r6:00356310 r5:00000000 r4:00000000 [<8059ff04>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67) Exception stack(0xe02c9fa8 to 0xe02c9ff0) 9fa0: 00000000 00000000 00000003 20000d00 0000000b 00000000 9fc0: 00000000 00000000 00356310 00000004 003562d8 00000000 00000001 76fe40dc 9fe0: 76fe3e88 76fe3e78 00018ebc 001308d0 Code: e3a00000 01a03002 e3510000 030f2ffe (e5933000) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e3a00000 mov r0, #0 4: 01a03002 moveq r3, r2 8: e3510000 cmp r1, #0 c: 030f2ffe movweq r2, #65534 @ 0xfffe * 10: e5933000 ldr r3, [r3] <-- trapping instruction