general protection fault, probably for non-canonical address 0xdffffc000000000b: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000058-0x000000000000005f]
CPU: 1 PID: 0 Comm: swapper/1 Tainted: G        W          syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:dummy_queue+0x1b7/0x8e0 drivers/usb/gadget/udc/dummy_hcd.c:717
Code: fc ff df 80 3c 08 00 74 08 4c 89 e7 e8 92 63 6a fe 4d 8b 24 24 49 83 c4 58 4c 89 e0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 f5 05 00 00 45 8b 24 24 44 89 e6 83 e6 02
RSP: 0018:ffffc900001b0c18 EFLAGS: 00010202
RAX: 000000000000000b RBX: ffff88810e50be10 RCX: dffffc0000000000
RDX: ffff888100330000 RSI: 0000000000000003 RDI: 0000000000000005
RBP: ffffc900001b0c90 R08: ffff888120d58173 R09: ffff888120d58170
R10: 0000000000000000 R11: ffffffff834c8bc0 R12: 0000000000000058
R13: ffff88810e50be00 R14: 1ffff11021ca17c0 R15: ffff88810deb4c90
FS:  0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8f5e795e80 CR3: 000000012ce42000 CR4: 00000000003506a0
DR0: 000000000000000c DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 usb_ep_queue+0xdf/0x220 drivers/usb/gadget/udc/core.c:308
 eth_start_xmit+0x87c/0xe50 drivers/usb/gadget/function/u_ether.c:588
 ncm_tx_timeout+0x95/0xb0 drivers/usb/gadget/function/f_ncm.c:1166
 __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
 __hrtimer_run_queues+0x398/0x890 kernel/time/hrtimer.c:1749
 hrtimer_run_softirq+0x19b/0x260 kernel/time/hrtimer.c:1766
 handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
 __do_softirq kernel/softirq.c:680 [inline]
 invoke_softirq kernel/softirq.c:497 [inline]
 __irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:default_idle+0xf/0x20 arch/x86/kernel/process.c:742
Code: cc 00 00 cc cc 00 00 cc cc 00 00 90 90 90 90 90 90 90 90 90 90 90 b8 0c 67 40 a5 55 48 89 e5 66 90 0f 00 2d 53 5b 65 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
RSP: 0018:ffffc90000147dd8 EFLAGS: 00000257
RAX: ffff8881f6f00000 RBX: ffff888100330000 RCX: b88bdb0cf311d500
RDX: 0000000000000001 RSI: ffffffff85ca6940 RDI: ffffffff85ca6900
RBP: ffffc90000147dd8 R08: ffff8881f6f348b3 R09: 1ffff1103ede6916
R10: 0000000000000000 R11: ffffffff8500d380 R12: dffffc0000000000
R13: 0000000000000001 R14: ffff888100330000 R15: dffffc0000000000
 arch_cpu_idle+0x1c/0x20 arch/x86/kernel/process.c:733
 default_idle_call+0x71/0x1d0 kernel/sched/idle.c:109
 cpuidle_idle_call kernel/sched/idle.c:199 [inline]
 do_idle+0x354/0x640 kernel/sched/idle.c:323
 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:422
 start_secondary+0x119/0x120 arch/x86/kernel/smpboot.c:281
 secondary_startup_64_no_verify+0xce/0xdb
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:dummy_queue+0x1b7/0x8e0 drivers/usb/gadget/udc/dummy_hcd.c:717
Code: fc ff df 80 3c 08 00 74 08 4c 89 e7 e8 92 63 6a fe 4d 8b 24 24 49 83 c4 58 4c 89 e0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 f5 05 00 00 45 8b 24 24 44 89 e6 83 e6 02
RSP: 0018:ffffc900001b0c18 EFLAGS: 00010202

RAX: 000000000000000b RBX: ffff88810e50be10 RCX: dffffc0000000000
RDX: ffff888100330000 RSI: 0000000000000003 RDI: 0000000000000005
RBP: ffffc900001b0c90 R08: ffff888120d58173 R09: ffff888120d58170
R10: 0000000000000000 R11: ffffffff834c8bc0 R12: 0000000000000058
R13: ffff88810e50be00 R14: 1ffff11021ca17c0 R15: ffff88810deb4c90
FS:  0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8f5e795e80 CR3: 000000012ce42000 CR4: 00000000003506a0
DR0: 000000000000000c DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	fc                   	cld
   1:	ff                   	lcall  (bad)
   2:	df 80 3c 08 00 74    	filds  0x7400083c(%rax)
   8:	08 4c 89 e7          	or     %cl,-0x19(%rcx,%rcx,4)
   c:	e8 92 63 6a fe       	call   0xfe6a63a3
  11:	4d 8b 24 24          	mov    (%r12),%r12
  15:	49 83 c4 58          	add    $0x58,%r12
  19:	4c 89 e0             	mov    %r12,%rax
  1c:	48 c1 e8 03          	shr    $0x3,%rax
  20:	48 b9 00 00 00 00 00 	movabs $0xdffffc0000000000,%rcx
  27:	fc ff df
* 2a:	0f b6 04 08          	movzbl (%rax,%rcx,1),%eax <-- trapping instruction
  2e:	84 c0                	test   %al,%al
  30:	0f 85 f5 05 00 00    	jne    0x62b
  36:	45 8b 24 24          	mov    (%r12),%r12d
  3a:	44 89 e6             	mov    %r12d,%esi
  3d:	83 e6 02             	and    $0x2,%esi