Oops: general protection fault, probably for non-canonical address 0xdffffc0000000060: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000300-0x0000000000000307]
CPU: 0 UID: 0 PID: 1303 Comm: syz.9.4649 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:strcmp+0x3c/0xc0 lib/string.c:284
Code: 00 fc ff df 45 31 f6 4a 8d 04 37 48 89 c1 48 c1 e9 03 0f b6 0c 19 84 c9 75 2c 42 0f b6 2c 37 4a 8d 04 36 48 89 c1 48 c1 e9 03 <0f> b6 0c 19 84 c9 75 33 42 0f b6 0c 36 40 38 cd 75 48 49 ff c6 40
RSP: 0018:ffffc90000007700 EFLAGS: 00010006
RAX: 0000000000000300 RBX: dffffc0000000000 RCX: 0000000000000060
RDX: 0000000000000001 RSI: 0000000000000300 RDI: ffffffff8be0f760
RBP: 0000000000000026 R08: 0000000000000001 R09: 0000000000000001
R10: dffffc0000000000 R11: ffffed10086ad402 R12: ffffffff93644638
R13: ffffffff96414bf8 R14: 0000000000000000 R15: ffffffff9360f380
FS:  0000555557e47500(0000) GS:ffff888125a9c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f89e29212c0 CR3: 0000000031868000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 count_matching_names+0x57/0x90 kernel/locking/lockdep.c:878
 register_lock_class+0x23f/0x320 kernel/locking/lockdep.c:1344
 __lock_acquire+0x99/0xd20 kernel/locking/lockdep.c:5112
 lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162
 complete_with_flags kernel/sched/completion.c:25 [inline]
 complete+0x28/0x1b0 kernel/sched/completion.c:52
 transfer drivers/usb/gadget/udc/dummy_hcd.c:1523 [inline]
 dummy_timer+0x214f/0x45b0 drivers/usb/gadget/udc/dummy_hcd.c:1979
 __run_hrtimer kernel/time/hrtimer.c:1777 [inline]
 __hrtimer_run_queues+0x52c/0xc60 kernel/time/hrtimer.c:1841
 hrtimer_run_softirq+0x187/0x2b0 kernel/time/hrtimer.c:1858
 handle_softirqs+0x286/0x870 kernel/softirq.c:626
 __do_softirq kernel/softirq.c:660 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:727
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:743
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1052
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:unwind_next_frame+0x374/0x2390 arch/x86/kernel/unwind_orc.c:505
Code: ea 48 01 d2 48 01 f2 48 bd 00 00 00 00 00 fc ff df 0f 84 37 01 00 00 4c 8d 62 04 4c 8d 6a 05 4c 89 e0 48 c1 e8 03 0f b6 04 28 <84> c0 0f 85 6d 19 00 00 4c 89 e8 48 c1 e8 03 0f b6 04 28 84 c0 0f
RSP: 0018:ffffc9000d6af1b8 EFLAGS: 00000a06
RAX: 0000000000000000 RBX: ffffffff9041a88c RCX: ffffffff9041a894
RDX: ffffffff90f4adbc RSI: ffffffff90f4adbc RDI: ffffffff8be0f060
RBP: dffffc0000000000 R08: 000000000000000d R09: ffffffff81741f85
R10: ffffc9000d6af2d8 R11: ffffffff81ad0160 R12: ffffffff90f4adc0
R13: ffffffff90f4adc1 R14: ffffc9000d6af288 R15: ffffffff9041a890
 arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:56 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:77
 unpoison_slab_object mm/kasan/common.c:339 [inline]
 __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:365
 kasan_slab_alloc include/linux/kasan.h:252 [inline]
 slab_post_alloc_hook mm/slub.c:4978 [inline]
 slab_alloc_node mm/slub.c:5288 [inline]
 kmem_cache_alloc_noprof+0x37d/0x700 mm/slub.c:5295
 mt_alloc_one lib/maple_tree.c:172 [inline]
 mas_alloc_nodes+0x291/0x350 lib/maple_tree.c:1108
 mas_preallocate+0x2e0/0x670 lib/maple_tree.c:5192
 vma_iter_prealloc mm/vma.h:436 [inline]
 __split_vma+0x2fa/0xa00 mm/vma.c:530
 split_vma mm/vma.c:600 [inline]
 vma_modify+0x12c3/0x1970 mm/vma.c:1625
 vma_modify_flags+0x1e8/0x230 mm/vma.c:1651
 mprotect_fixup+0x407/0x9c0 mm/mprotect.c:759
 do_mprotect_pkey+0x8c5/0xcd0 mm/mprotect.c:933
 __do_sys_mprotect mm/mprotect.c:954 [inline]
 __se_sys_mprotect mm/mprotect.c:951 [inline]
 __x64_sys_mprotect+0x80/0x90 mm/mprotect.c:951
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f123218f087
Code: 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 0a 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff2e75ff68 EFLAGS: 00000206 ORIG_RAX: 000000000000000a
RAX: ffffffffffffffda RBX: 00007f1232f6c6c0 RCX: 00007f123218f087
RDX: 0000000000000003 RSI: 0000000000020000 RDI: 00007f1232f4d000
RBP: 0000000000000000 R08: 00000000ffffffff R09: 0000000000000000
R10: 0000000000021000 R11: 0000000000000206 R12: 00007fff2e7600c0
R13: ffffffffffffffc0 R14: 0000000000001000 R15: 0000000000000000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:strcmp+0x3c/0xc0 lib/string.c:284
Code: 00 fc ff df 45 31 f6 4a 8d 04 37 48 89 c1 48 c1 e9 03 0f b6 0c 19 84 c9 75 2c 42 0f b6 2c 37 4a 8d 04 36 48 89 c1 48 c1 e9 03 <0f> b6 0c 19 84 c9 75 33 42 0f b6 0c 36 40 38 cd 75 48 49 ff c6 40
RSP: 0018:ffffc90000007700 EFLAGS: 00010006
RAX: 0000000000000300 RBX: dffffc0000000000 RCX: 0000000000000060
RDX: 0000000000000001 RSI: 0000000000000300 RDI: ffffffff8be0f760
RBP: 0000000000000026 R08: 0000000000000001 R09: 0000000000000001
R10: dffffc0000000000 R11: ffffed10086ad402 R12: ffffffff93644638
R13: ffffffff96414bf8 R14: 0000000000000000 R15: ffffffff9360f380
FS:  0000555557e47500(0000) GS:ffff888125a9c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f89e29212c0 CR3: 0000000031868000 CR4: 00000000003526f0
----------------
Code disassembly (best guess), 4 bytes skipped:
   0:	45 31 f6             	xor    %r14d,%r14d
   3:	4a 8d 04 37          	lea    (%rdi,%r14,1),%rax
   7:	48 89 c1             	mov    %rax,%rcx
   a:	48 c1 e9 03          	shr    $0x3,%rcx
   e:	0f b6 0c 19          	movzbl (%rcx,%rbx,1),%ecx
  12:	84 c9                	test   %cl,%cl
  14:	75 2c                	jne    0x42
  16:	42 0f b6 2c 37       	movzbl (%rdi,%r14,1),%ebp
  1b:	4a 8d 04 36          	lea    (%rsi,%r14,1),%rax
  1f:	48 89 c1             	mov    %rax,%rcx
  22:	48 c1 e9 03          	shr    $0x3,%rcx
* 26:	0f b6 0c 19          	movzbl (%rcx,%rbx,1),%ecx <-- trapping instruction
  2a:	84 c9                	test   %cl,%cl
  2c:	75 33                	jne    0x61
  2e:	42 0f b6 0c 36       	movzbl (%rsi,%r14,1),%ecx
  33:	40 38 cd             	cmp    %cl,%bpl
  36:	75 48                	jne    0x80
  38:	49 ff c6             	inc    %r14
  3b:	40                   	rex