[v6.1] BUG: unable to handle kernel paging request in usbtest_probe

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: dc5c83b7f5f8 Linux 6.1.178
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=148fc232580000
kernel config: https://syzkaller.appspot.com/x/.config?x=872c04466179833f
dashboard link: https://syzkaller.appspot.com/bug?extid=31740a5e93bfce39589a
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/96393e4697a3/disk-dc5c83b7.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/0d4afce44fab/vmlinux-dc5c83b7.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4787e310d875/Image-dc5c83b7.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+31740a...@syzkaller.appspotmail.com

usb 1-1: Manufacturer: syz
usb 1-1: SerialNumber: syz
Unable to handle kernel paging request at virtual address dfff800000000001
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
Mem abort info:
ESR = 0x0000000096000006
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x06: level 2 translation fault
Data abort info:
ISV = 0, ISS = 0x00000006
CM = 0, WnR = 0
[dfff800000000001] address between user and kernel address ranges
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 4441 Comm: kworker/1:6 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
Workqueue: usb_hub_wq hub_event
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : usbtest_probe+0x408/0xa6c drivers/usb/misc/usbtest.c:2821
lr : usbtest_probe+0x3f4/0xa6c drivers/usb/misc/usbtest.c:2821
sp : ffff800020fc6e40
x29: ffff800020fc6e70 x28: ffff0000ceee90a8 x27: dfff800000000000
x26: ffff8000130e7740 x25: 1fffe0001a1b2e9b x24: ffff0000ceee9000
x23: 1fffe0001a1b2e80 x22: 000000000000000a x21: ffff0000d0d97400
x20: 0000000000000000 x19: ffff0000ceeee000 x18: 1fffe00033e7697e
x17: ffff80001537d000 x16: ffff8000082dd244 x15: ffff80000bfbf3c0
x14: 0000000000000001 x13: 1ffff00002b7cc9e x12: 0000000000100000
x11: ff0080000dc03568 x10: 0000000000000002 x9 : ffff0000d46d8000
x8 : 0000000000000001 x7 : ffff80000d7882cc x6 : ffff80000d778b54
x5 : ffff0000da728b30 x4 : ffff800020fc6c98 x3 : 0000000000000000
x2 : 0000000000000006 x1 : 00000000ffffffff x0 : 00000000ffffffff
Call trace:
usbtest_probe+0x408/0xa6c drivers/usb/misc/usbtest.c:2821
usb_probe_interface+0x50c/0x988 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x3a0/0xac4 drivers/base/dd.c:638
__driver_probe_device+0x1c8/0x368 drivers/base/dd.c:804
driver_probe_device+0x78/0x324 drivers/base/dd.c:834
__device_attach_driver+0x28c/0x4c0 drivers/base/dd.c:962
bus_for_each_drv+0x154/0x1e4 drivers/base/bus.c:429
__device_attach+0x2a4/0x3d8 drivers/base/dd.c:1034
device_initial_probe+0x24/0x34 drivers/base/dd.c:1083
bus_probe_device+0xbc/0x1c4 drivers/base/bus.c:489
device_add+0x93c/0xe4c drivers/base/core.c:3712
usb_set_configuration+0x15ec/0x1b88 drivers/usb/core/message.c:2223
usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:238
usb_probe_device+0x120/0x258 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x3a0/0xac4 drivers/base/dd.c:638
__driver_probe_device+0x1c8/0x368 drivers/base/dd.c:804
driver_probe_device+0x78/0x324 drivers/base/dd.c:834
__device_attach_driver+0x28c/0x4c0 drivers/base/dd.c:962
bus_for_each_drv+0x154/0x1e4 drivers/base/bus.c:429
__device_attach+0x2a4/0x3d8 drivers/base/dd.c:1034
device_initial_probe+0x24/0x34 drivers/base/dd.c:1083
bus_probe_device+0xbc/0x1c4 drivers/base/bus.c:489
device_add+0x93c/0xe4c drivers/base/core.c:3712
usb_new_device+0x7e4/0x11d0 drivers/usb/core/hub.c:2659
hub_port_connect drivers/usb/core/hub.c:5517 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5657 [inline]
port_event drivers/usb/core/hub.c:5817 [inline]
hub_event+0x2254/0x3e74 drivers/usb/core/hub.c:5899
process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292
worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439
kthread+0x254/0x2e0 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
Code: 96a2bebd 14000016 91002a96 d343fec8 (38fb6908)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: 96a2bebd bl 0xfffffffffa8afaf4
4: 14000016 b 0x5c
8: 91002a96 add x22, x20, #0xa
c: d343fec8 lsr x8, x22, #3
* 10: 38fb6908 ldrsb w8, [x8, x27] <-- trapping instruction


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup