Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 0 UID: 0 PID: 581 Comm: syz.0.60 Not tainted syzkaller #0 4e52c0723cb79d31d146da949bb07b469cd0953d Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 RIP: 0010:set_link_state+0x2a/0x1240 drivers/usb/gadget/udc/dummy_hcd.c:435 Code: 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 60 49 89 fd 48 bb 00 00 00 00 00 fc ff df e8 dd 04 ce fd 4c 89 e8 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 ef e8 c8 c4 26 fe 4d 8b 75 00 49 8d 95 93 RSP: 0018:ffffc9000d927938 EFLAGS: 00010046 RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff88811a9eb900 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000d9279c0 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff52001b24f24 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ffff888104b58000 FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8d3204c3c4 CR3: 00000000074aa000 CR4: 00000000003526b0 Call Trace: dummy_pullup+0xd1/0x130 drivers/usb/gadget/udc/dummy_hcd.c:914 usb_gadget_disconnect_locked+0x151/0x400 drivers/usb/gadget/udc/core.c:780 gadget_unbind_driver+0xaf/0x3f0 drivers/usb/gadget/udc/core.c:1670 device_remove drivers/base/dd.c:567 [inline] __device_release_driver drivers/base/dd.c:1272 [inline] device_release_driver_internal+0x4ad/0x830 drivers/base/dd.c:1295 driver_detach+0x1f5/0x2d0 drivers/base/dd.c:1358 bus_remove_driver+0x254/0x2b0 drivers/base/bus.c:744 driver_unregister+0x79/0xb0 drivers/base/driver.c:274 usb_gadget_unregister_driver+0x52/0x80 drivers/usb/gadget/udc/core.c:1736 raw_release+0xdb/0x280 drivers/usb/gadget/legacy/raw_gadget.c:463 __fput+0x20b/0xa30 fs/file_table.c:447 ____fput+0x20/0x30 fs/file_table.c:475 task_work_run+0x1e8/0x260 kernel/task_work.c:246 exit_task_work include/linux/task_work.h:43 [inline] do_exit+0xa46/0x2850 kernel/exit.c:955 do_group_exit+0x21f/0x2f0 kernel/exit.c:1098 __do_sys_exit_group kernel/exit.c:1109 [inline] __se_sys_exit_group kernel/exit.c:1107 [inline] __x64_sys_exit_group+0x43/0x50 kernel/exit.c:1107 x64_sys_call+0x2ed2/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f934d39de99 Code: Unable to access opcode bytes at 0x7f934d39de6f. RSP: 002b:00007ffeeefebb38 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 000000000000000b RCX: 00007f934d39de99 RDX: 0000000000000001 RSI: 0000000000000000 RDI: 000000000000000b RBP: 0000000000000213 R08: 00007ffeeefebfe7 R09: 000000000000000b R10: 00007f934d625fa0 R11: 0000000000000246 R12: 0000000000000003 R13: 00007f934d62627c R14: 00007f934d626278 R15: 00007f934d626270 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:set_link_state+0x2a/0x1240 drivers/usb/gadget/udc/dummy_hcd.c:435 Code: 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 60 49 89 fd 48 bb 00 00 00 00 00 fc ff df e8 dd 04 ce fd 4c 89 e8 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 ef e8 c8 c4 26 fe 4d 8b 75 00 49 8d 95 93 RSP: 0018:ffffc9000d927938 EFLAGS: 00010046 RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff88811a9eb900 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000d9279c0 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff52001b24f24 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ffff888104b58000 FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8d3204c3c4 CR3: 00000000074aa000 CR4: 00000000003526b0 ---------------- Code disassembly (best guess): 0: 55 push %rbp 1: 48 89 e5 mov %rsp,%rbp 4: 41 57 push %r15 6: 41 56 push %r14 8: 41 55 push %r13 a: 41 54 push %r12 c: 53 push %rbx d: 48 83 ec 60 sub $0x60,%rsp 11: 49 89 fd mov %rdi,%r13 14: 48 bb 00 00 00 00 00 movabs $0xdffffc0000000000,%rbx 1b: fc ff df 1e: e8 dd 04 ce fd call 0xfdce0500 23: 4c 89 e8 mov %r13,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1) <-- trapping instruction 2e: 74 08 je 0x38 30: 4c 89 ef mov %r13,%rdi 33: e8 c8 c4 26 fe call 0xfe26c500 38: 4d 8b 75 00 mov 0x0(%r13),%r14 3c: 49 rex.WB 3d: 8d .byte 0x8d 3e: 95 xchg %eax,%ebp 3f: 93 xchg %eax,%ebx