ci2-upstream-fs/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-upstream-fs/syz-executor12107228 <...> Warning: Permanently added '10.128.0.119' (ED25519) to the list of known hosts. execve("ci2-upstream-fs/syz-executor12107228", ["ci2-upstream-fs/syz-executor12107228"], 0x7fff42623390 /* 10 vars */) = 0 brk(NULL) = 0x55558593b000 brk(0x55558593bd80) = 0x55558593bd80 arch_prctl(ARCH_SET_FS, 0x55558593b400) = 0 set_tid_address(0x55558593b6d0) = 5619 set_robust_list(0x55558593b6e0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-upstream-fs/syz-executor12107228", 4096) = 42 getrandom("\x0b\xa1\x75\xc7\x7f\x70\xaa\xb6", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55558593bd80 brk(0x55558595cd80) = 0x55558595cd80 brk(0x55558595d000) = 0x55558595d000 mprotect(0x7fd36789a000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5620 attached , child_tidptr=0x55558593b6d0) = 5620 [pid 5620] set_robust_list(0x55558593b6e0, 24) = 0 [pid 5619] rt_sigprocmask(SIG_SETMASK, [] [pid 5620] rt_sigprocmask(SIG_SETMASK, [] [pid 5619] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5620] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5620] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5620] setpgid(0, 0) = 0 [pid 5620] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5620] write(3, "1000", 4) = 4 [pid 5620] close(3) = 0 executing program [pid 5620] write(1, "executing program\n", 18) = 18 [pid 5620] mkdirat(AT_FDCWD, "./my_configfs", 0777) = 0 [pid 5620] mount(NULL, "./my_configfs", "configfs", 0, NULL) = 0 [pid 5620] mkdirat(AT_FDCWD, "./my_configfs/usb_gadget/g1", 0777) = 0 [pid 5620] mkdirat(AT_FDCWD, "./my_configfs/usb_gadget/g1/configs/c.1", 0777) = 0 [pid 5620] mkdirat(AT_FDCWD, "./my_configfs/usb_gadget/g1/functions/midi2.usb0", 0777) = 0 [pid 5620] openat(AT_FDCWD, "./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/direction", O_WRONLY) = 3 [pid 5620] write(3, "1", 1) = 1 [pid 5620] symlinkat("./my_configfs/usb_gadget/g1/functions/midi2.usb0", AT_FDCWD, "./my_configfs/usb_gadget/g1/configs/c.1/midi2.usb0") = 0 [pid 5620] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 5620] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 5620] openat(AT_FDCWD, "./config/usb_gadget/g1/UDC", O_WRONLY) = 4 [pid 5620] write(4, "usbip-vudc.0", 12) = 12 [ 99.553665][ T5620] Oops: gen[ 99.553665][ T5620] Oops: general protection fault, probably for non-canonical address 0xdffffc00000000ee: 0000 [#1] SMP KASAN PTI [ 99.553697][ T5620] KASAN: null-ptr-deref in range [0x0000000000000770-0x0000000000000777] [ 99.553731][ T5620] CPU: 0 UID: 0 PID: 5620 Comm: syz-executor121 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 99.553755][ T5620] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 99.553769][ T5620] RIP: 0010:f_midi2_free_ep+0x52/0x2f0 [ 99.553824][ T5620] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 23 9d e7 fa 41 bc 70 07 00 00 4d 03 26 4c 89 e0 48 c1 e8 03 48 89 44 24 30 <0f> b6 04 28 84 c0 0f 85 5d 02 00 00 41 8b 1c 24 31 ff 89 de e8 d5 [ 99.553842][ T5620] RSP: 0018:ffffc900040df978 EFLAGS: 00010206 [ 99.553862][ T5620] RAX: 00000000000000ee RBX: ffff8880446f4000 RCX: ffff888038dcdd00 [ 99.553878][ T5620] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 99.553891][ T5620] RBP: dffffc0000000000 R08: ffffffff8faf9837 R09: 1ffffffff1f5f306 [ 99.553907][ T5620] R10: dffffc0000000000 R11: fffffbfff1f5f307 R12: 0000000000000770 [ 99.553923][ T5620] R13: dffffc0000000000 R14: ffff8880446f4128 R15: dffffc0000000000 [ 99.553938][ T5620] FS: 000055558593b400(0000) GS:ffff888125c41000(0000) knlGS:0000000000000000 [ 99.553958][ T5620] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 99.553972][ T5620] CR2: 00005653470e07a0 CR3: 0000000042ae2000 CR4: 00000000003526f0 [ 99.553991][ T5620] Call Trace: [ 99.553998][ T5620] [ 99.554012][ T5620] f_midi2_unbind+0x9b/0x340 [ 99.554046][ T5620] purge_configs_funcs+0x248/0x3d0 [ 99.554077][ T5620] configfs_composite_unbind+0xa0/0x1b0 [ 99.554105][ T5620] gadget_unbind_driver+0x1cb/0x410 [ 99.554140][ T5620] ? __pfx_gadget_unbind_driver+0x10/0x10 [ 99.554173][ T5620] device_release_driver_internal+0x48b/0x880 [ 99.554209][ T5620] driver_detach+0x1f3/0x2d0 [ 99.554239][ T5620] bus_remove_driver+0x229/0x320 [ 99.554263][ T5620] usb_gadget_unregister_driver+0x4e/0x70 [ 99.554293][ T5620] gadget_dev_desc_UDC_store+0x17a/0x2f0 [ 99.554327][ T5620] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10 [ 99.554361][ T5620] configfs_write_iter+0x33a/0x430 [ 99.554397][ T5620] vfs_write+0x61e/0xbb0 [ 99.554428][ T5620] ? __pfx_vfs_write+0x10/0x10 [ 99.554457][ T5620] ? rt_spin_unlock+0x157/0x200 [ 99.554498][ T5620] ? rt_spin_unlock+0x163/0x200 [ 99.554535][ T5620] ksys_write+0x156/0x270 [ 99.554563][ T5620] ? __pfx_ksys_write+0x10/0x10 [ 99.554593][ T5620] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.554616][ T5620] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.554638][ T5620] do_syscall_64+0x174/0x580 [ 99.554665][ T5620] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.554687][ T5620] ? clear_bhb_loop+0x40/0x90 [ 99.554713][ T5620] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.554734][ T5620] RIP: 0033:0x7fd367807789 [ 99.554758][ T5620] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 99.554775][ T5620] RSP: 002b:00007ffd35b431c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 99.554804][ T5620] RAX: ffffffffffffffda RBX: 6769666e6f632f2e RCX: 00007fd367807789 [ 99.554820][ T5620] RDX: 0000000000000001 RSI: 00002000000004c0 RDI: 0000000000000004 [ 99.554834][ T5620] RBP: 6e6f635f796d2f2e R08: 0000000000000006 R09: 0000000000000006 [ 99.554848][ T5620] R10: 0000000000000006 R11: 0000000000000246 R12: 00007ffd35b43338 [ 99.554862][ T5620] R13: 431bde82d7b634db R14: 00007fd36789ac40 R15: 0000000000000002 [ 99.554887][ T5620] [ 99.554895][ T5620] Modules linked in: [ 99.554970][ T5620] ---[ end trace 0000000000000000 ]--- [ 99.557148][ T5620] RIP: 0010:f_midi2_free_ep+0x52/0x2f0 [ 99.557225][ T5620] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 23 9d e7 fa 41 bc 70 07 00 00 4d 03 26 4c 89 e0 48 c1 e8 03 48 89 44 24 30 <0f> b6 04 28 84 c0 0f 85 5d 02 00 00 41 8b 1c 24 31 ff 89 de e8 d5 [ 99.557276][ T5620] RSP: 0018:ffffc900040df978 EFLAGS: 00010206 [ 99.557315][ T5620] RAX: 00000000000000ee RBX: ffff8880446f4000 RCX: ffff888038dcdd00 [ 99.557358][ T5620] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 99.557390][ T5620] RBP: dffffc0000000000 R08: ffffffff8faf9837 R09: 1ffffffff1f5f306 [ 99.557440][ T5620] R10: dffffc0000000000 R11: fffffbfff1f5f307 R12: 0000000000000770 [ 99.557475][ T5620] R13: dffffc0000000000 R14: ffff8880446f4128 R15: dffffc0000000000 [ 99.557570][ T5620] FS: 000055558593b400(0000) GS:ffff888125c41000(0000) knlGS:0000000000000000 [ 99.557624][ T5620] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 99.557666][ T5620] CR2: 00005653470e07a0 CR3: 0000000042ae2000 CR4: 00000000003526f0 [ 99.557711][ T5620] Kernel panic - not syncing: Fatal exception [ 99.558317][ T5620] Kernel Offset: disabled