general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 PID: 30927 Comm: syz-executor.3 Not tainted 6.2.0-rc3-syzkaller-00165-gd9fc1511728c #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
RIP: 0010:pn533_out_complete+0x119/0x180 drivers/nfc/pn533/usb.c:441
Code: fe eb 05 e8 09 b9 0b fc 49 83 c6 08 4c 89 f7 5b 41 5c 41 5d 41 5e 41 5f 5d e9 f3 8d e7 fb e8 ee b8 0b fc 4c 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 ff e8 08 71 62 fc bf a8 00 00 00 49 03
RSP: 0018:ffffc900000077f8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 00000000ffffffb9 RCX: 0000000000040000
RDX: ffffc90002131000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: 1ffff11004500fcb R08: 0000000000000005 R09: ffffffff85820f31
R10: 0000000000000003 R11: ffff88802d240000 R12: ffff888022807e58
R13: dffffc0000000000 R14: ffffc900047566e0 R15: 0000000000000000
FS: 00007fa7a2b45700(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2fa3fa8000 CR3: 0000000058907000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__usb_hcd_giveback_urb+0x369/0x530 drivers/usb/core/hcd.c:1671
dummy_timer+0x86b/0x3110 drivers/usb/gadget/udc/dummy_hcd.c:1988
call_timer_fn+0xf5/0x210 kernel/time/timer.c:1700
expire_timers kernel/time/timer.c:1751 [inline]
__run_timers+0x775/0x990 kernel/time/timer.c:2022
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2035
__do_softirq+0x277/0x75b kernel/softirq.c:571
__irq_exit_rcu+0xec/0x170 kernel/softirq.c:650
irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1107
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:unwind_get_return_address+0x2/0x80 arch/x86/kernel/unwind_orc.c:338
Code: fb fe ff ff 48 89 df 89 74 24 14 e8 d8 4d a6 00 48 8d 7c 24 40 8b 74 24 14 e9 e1 fe ff ff e8 45 b2 87 09 0f 1f 44 00 00 41 57 <41> 56 53 48 89 fb 49 be 00 00 00 00 00 fc ff df 48 89 f8 48 c1 e8
RSP: 0018:ffffc9000353f2f0 EFLAGS: 00000202
RAX: 0000000080000001 RBX: ffffc9000353f300 RCX: 0000000080000000
RDX: dffffc0000000000 RSI: ffffc90003538000 RDI: ffffc9000353f300
RBP: ffffc9000353f390 R08: ffffc9000353f470 R09: dffffc0000000000
R10: fffff520006a7e6c R11: 1ffff920006a7e6a R12: ffff88802d240000
R13: ffffffff817b3a60 R14: ffffc9000353f3e0 R15: 0000000000000000
arch_stack_walk+0xf8/0x140 arch/x86/kernel/stacktrace.c:26
stack_trace_save+0x12d/0x1f0 kernel/stacktrace.c:122
save_stack+0xf5/0x1e0 mm/page_owner.c:127
__reset_page_owner+0x52/0x1a0 mm/page_owner.c:148
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1446 [inline]
free_pcp_prepare+0x751/0x780 mm/page_alloc.c:1496
free_unref_page_prepare mm/page_alloc.c:3369 [inline]
free_unref_page_list+0xb2/0x830 mm/page_alloc.c:3510
release_pages+0x234e/0x25f0 mm/swap.c:1076
__pagevec_release+0x7d/0xf0 mm/swap.c:1096
pagevec_release include/linux/pagevec.h:71 [inline]
folio_batch_release include/linux/pagevec.h:135 [inline]
shmem_undo_range+0x6d0/0x1f90 mm/shmem.c:949
shmem_truncate_range mm/shmem.c:1044 [inline]
shmem_evict_inode+0x269/0xa30 mm/shmem.c:1153
evict+0x2a4/0x620 fs/inode.c:664
__dentry_kill+0x3b1/0x5b0 fs/dcache.c:607
dentry_kill+0xbb/0x290
dput+0x1f3/0x410 fs/dcache.c:913
__fput+0x5e4/0x880 fs/file_table.c:328
task_work_run+0x243/0x300 kernel/task_work.c:179
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop+0x134/0x160 kernel/entry/common.c:171
exit_to_user_mode_prepare+0xad/0x110 kernel/entry/common.c:203
__syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]
syscall_exit_to_user_mode+0x2e/0x60 kernel/entry/common.c:296
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fa7a1e3df7b
Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007fa7a2b44f20 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00007fa7a1e3df7b
RDX: ffffffffffffffb8 RSI: 00007fa7a2b44fe0 RDI: 0000000000000003
RBP: 00000000ffffffff R08: 0000000000000000 R09: 000000000000559c
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000002
R13: 00007fa7a2b44fdc R14: 00007fa7a2b456b8 R15: 0000000020005682
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:pn533_out_complete+0x119/0x180 drivers/nfc/pn533/usb.c:441
Code: fe eb 05 e8 09 b9 0b fc 49 83 c6 08 4c 89 f7 5b 41 5c 41 5d 41 5e 41 5f 5d e9 f3 8d e7 fb e8 ee b8 0b fc 4c 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 ff e8 08 71 62 fc bf a8 00 00 00 49 03
RSP: 0018:ffffc900000077f8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 00000000ffffffb9 RCX: 0000000000040000
RDX: ffffc90002131000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: 1ffff11004500fcb R08: 0000000000000005 R09: ffffffff85820f31
R10: 0000000000000003 R11: ffff88802d240000 R12: ffff888022807e58
R13: dffffc0000000000 R14: ffffc900047566e0 R15: 0000000000000000
FS: 00007fa7a2b45700(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2fa3fa8000 CR3: 0000000058907000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 1 bytes skipped:
0: eb 05 jmp 0x7
2: e8 09 b9 0b fc callq 0xfc0bb910
7: 49 83 c6 08 add $0x8,%r14
b: 4c 89 f7 mov %r14,%rdi
e: 5b pop %rbx
f: 41 5c pop %r12
11: 41 5d pop %r13
13: 41 5e pop %r14
15: 41 5f pop %r15
17: 5d pop %rbp
18: e9 f3 8d e7 fb jmpq 0xfbe78e10
1d: e8 ee b8 0b fc callq 0xfc0bb910
22: 4c 89 f8 mov %r15,%rax
25: 48 c1 e8 03 shr $0x3,%rax
* 29: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction
2e: 74 08 je 0x38
30: 4c 89 ff mov %r15,%rdi
33: e8 08 71 62 fc callq 0xfc627140
38: bf a8 00 00 00 mov $0xa8,%edi
3d: 49 rex.WB
3e: 03 .byte 0x3