8<--- cut here --- Unable to handle kernel NULL pointer dereference at virtual address 00000544 when read [00000544] *pgd=80000080004003, *pmd=00000000 Internal error: Oops: 205 [#1] SMP ARM Modules linked in: CPU: 0 UID: 0 PID: 1601 Comm: kworker/0:3 Tainted: G L syzkaller #0 PREEMPT Tainted: [L]=SOFTLOCKUP Hardware name: ARM-Versatile Express Workqueue: usb_hub_wq hub_event PC is at f_midi2_free_ep_reqs+0x18/0xb8 drivers/usb/gadget/function/f_midi2.c:1166 LR is at f_midi2_stop_eps drivers/usb/gadget/function/f_midi2.c:1246 [inline] LR is at f_midi2_set_alt+0x9c/0x190 drivers/usb/gadget/function/f_midi2.c:1296 pc : [<811122a0>] lr : [<81113a28>] psr: 60000193 sp : df801ce8 ip : df801d20 fp : df801d1c r10: 83821c18 r9 : 846e16b0 r8 : 86103a08 r7 : 00000001 r6 : 8629c094 r5 : 8629c000 r4 : 8629c094 r3 : 8629c000 r2 : 00000000 r1 : 00000020 r0 : 8629c094 Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 86403200 DAC: fffffffd Register r0 information: non-slab/vmalloc memory Register r1 information: non-paged memory Register r2 information: NULL pointer Register r3 information: non-slab/vmalloc memory Register r4 information: non-slab/vmalloc memory Register r5 information: non-slab/vmalloc memory Register r6 information: non-slab/vmalloc memory Register r7 information: non-paged memory Register r8 information: slab kmalloc-128 start 86103a00 pointer offset 8 size 128 Register r9 information: slab kmalloc-4k start 846e1000 pointer offset 1712 size 4096 Register r10 information: slab kmalloc-2k start 83821800 pointer offset 1048 size 2048 Register r11 information: 2-page vmalloc region starting at 0xdf800000 allocated at start_kernel+0x690/0x844 init/main.c:1079 Register r12 information: 2-page vmalloc region starting at 0xdf800000 allocated at start_kernel+0x690/0x844 init/main.c:1079 Process kworker/0:3 (pid: 1601, stack limit = 0xea8e4000) Stack: (0xdf801ce8 to 0xdf802000) 1ce0: dddd1634 8629c000 df801d44 8629c094 8629c000 8629c078 1d00: 00000001 86103a08 846e16b0 83821c18 df801d44 df801d20 81113a28 81112294 1d20: 83821ab0 00000001 8111398c 00000001 86103a08 846e16b0 df801dcc df801d48 1d40: 810b4dc8 81113998 df801d94 df801d58 80572aac 8028e490 83e1e200 83e14980 1d60: dddd2400 86446c00 ffffffff 00000001 df801d8c df801d80 8629c000 00000000 1d80: 60000193 834a5d50 df801da4 df801d98 81b5c4c0 81b5c3ac df801dc4 fc6fa468 1da0: a0000193 846e16b0 83821ab0 a0000193 df801e6c 83821d3c 846e1000 856c3780 1dc0: df801df4 df801dd0 810b8220 810b4928 856434c4 00000000 84129bb4 846e1000 1de0: 856434c0 846e1000 df801ea4 df801df8 810c23b4 810b81c0 00000000 00000000 1e00: 00000000 00000000 00000000 80000113 82a03d80 830c4cc0 834a5c80 828d8320 1e20: 846e1004 82c0f350 846e1000 84129bb8 0000d000 82d14ce8 df801e5c df801e48 1e40: 82a03d80 df801e50 81b69aa4 8028e490 84129b68 dddc81ec 84129b68 df801e68 1e60: 81b4bb88 846e1004 84129b68 00010b01 00000001 fc6fa468 80330760 84129b68 1e80: dddc81d0 dddc80c0 00000256 000000c0 810c1adc 00000256 df801efc df801ea8 1ea0: 80330fec 810c1ae8 813cd6b8 00000256 d4a11fc0 00000010 00000004 813cd6a8 1ec0: 82a0b150 84044980 81c05a1c d4a11fc0 20000113 dddc80c0 20000113 000000f0 1ee0: 00000020 30ca6680 002f2be1 84044980 df801f2c df801f00 803312b4 80330e90 1f00: 20000113 000000f0 00000009 82a030a0 00000008 00000009 00000101 00000100 1f20: df801fac df801f30 8025a0dc 80331234 0001c470 00000000 df801f54 04208060 1f40: 82a03d80 0003777d 82522070 00000000 828d3e80 0000000a dddc62a8 82c10038 1f60: 82aff7a4 82a0b150 82513450 828c9258 82a03080 df801f30 802bc6cc 802b14e4 1f80: 84044980 84044980 82522070 824e6bc0 ea8e5640 00000000 84044980 ea8e5778 1fa0: df801fc4 df801fb0 8025a5fc 80259f88 828d3e6c 82522070 df801fd4 df801fc8 1fc0: 8025a934 8025a4b8 df801ffc df801fd8 81b5b81c 8025a930 81b69a48 00000113 1fe0: ffffffff ea8e5674 ea8e5724 84044980 ea8e563c df802000 81b284a4 81b5b7ac Call trace: frame pointer underflow [<81112288>] (f_midi2_free_ep_reqs) from [<81113a28>] (f_midi2_stop_eps drivers/usb/gadget/function/f_midi2.c:1246 [inline]) [<81112288>] (f_midi2_free_ep_reqs) from [<81113a28>] (f_midi2_set_alt+0x9c/0x190 drivers/usb/gadget/function/f_midi2.c:1296) r10:83821c18 r9:846e16b0 r8:86103a08 r7:00000001 r6:8629c078 r5:8629c000 r4:8629c094 [<8111398c>] (f_midi2_set_alt) from [<810b4dc8>] (composite_setup+0x4ac/0x2160 drivers/usb/gadget/composite.c:1933) r9:846e16b0 r8:86103a08 r7:00000001 r6:8111398c r5:00000001 r4:83821ab0 [<810b491c>] (composite_setup) from [<810b8220>] (configfs_composite_setup+0x6c/0x84 drivers/usb/gadget/configfs.c:1877) r10:856c3780 r9:846e1000 r8:83821d3c r7:df801e6c r6:a0000193 r5:83821ab0 r4:846e16b0 [<810b81b4>] (configfs_composite_setup) from [<810c23b4>] (dummy_timer+0x8d8/0xff4 drivers/usb/gadget/udc/dummy_hcd.c:1951) r9:846e1000 r8:856434c0 r7:846e1000 r6:84129bb4 r5:00000000 r4:856434c4 [<810c1adc>] (dummy_timer) from [<80330fec>] (__run_hrtimer kernel/time/hrtimer.c:2032 [inline]) [<810c1adc>] (dummy_timer) from [<80330fec>] (__hrtimer_run_queues+0x168/0x3a4 kernel/time/hrtimer.c:2096) r10:00000256 r9:810c1adc r8:000000c0 r7:00000256 r6:dddc80c0 r5:dddc81d0 r4:84129b68 [<80330e84>] (__hrtimer_run_queues) from [<803312b4>] (hrtimer_run_softirq+0x8c/0xc8 kernel/time/hrtimer.c:2113) r10:84044980 r9:002f2be1 r8:30ca6680 r7:00000020 r6:000000f0 r5:20000113 r4:dddc80c0 [<80331228>] (hrtimer_run_softirq) from [<8025a0dc>] (handle_softirqs+0x160/0x4e4 kernel/softirq.c:622) r9:00000100 r8:00000101 r6:00000009 r5:00000008 r4:82a030a0 [<80259f7c>] (handle_softirqs) from [<8025a5fc>] (__do_softirq kernel/softirq.c:656 [inline]) [<80259f7c>] (handle_softirqs) from [<8025a5fc>] (invoke_softirq kernel/softirq.c:496 [inline]) [<80259f7c>] (handle_softirqs) from [<8025a5fc>] (__irq_exit_rcu+0x150/0x1d0 kernel/softirq.c:735) r10:ea8e5778 r9:84044980 r8:00000000 r7:ea8e5640 r6:824e6bc0 r5:82522070 r4:84044980 [<8025a4ac>] (__irq_exit_rcu) from [<8025a934>] (irq_exit+0x10/0x18 kernel/softirq.c:764) r5:82522070 r4:828d3e6c [<8025a924>] (irq_exit) from [<81b5b81c>] (generic_handle_arch_irq+0x7c/0x80 kernel/irq/handle.c:293) [<81b5b7a0>] (generic_handle_arch_irq) from [<81b284a4>] (call_with_stack+0x1c/0x20 arch/arm/lib/call_with_stack.S:40) r9:84044980 r8:ea8e5724 r7:ea8e5674 r6:ffffffff r5:00000113 r4:81b69a48 [<81b28488>] (call_with_stack) from [<80200bec>] (__irq_svc+0x8c/0xbc arch/arm/kernel/entry-armv.S:228) Exception stack(0xea8e5640 to 0xea8e5688) 5640: dddd0f00 00000000 83317200 0000096f 84607a80 dddd0f00 84044980 ea8e5770 5660: ea8e5724 00000002 ea8e5778 ea8e569c ea8e56a0 ea8e5690 802796f4 81b69a48 5680: 00000113 ffffffff [<81b69a20>] (_raw_spin_unlock_irq) from [<802796f4>] (wq_worker_sleeping+0x8c/0x90 kernel/workqueue.c:1489) [<80279668>] (wq_worker_sleeping) from [<81b6065c>] (sched_submit_work kernel/sched/core.c:7277 [inline]) [<80279668>] (wq_worker_sleeping) from [<81b6065c>] (schedule+0xb4/0xec kernel/sched/core.c:7325) r5:82a03d80 r4:84044980 [<81b605a8>] (schedule) from [<81b688b4>] (schedule_timeout+0x8c/0x114 kernel/time/sleep_timeout.c:99) r5:82a03d80 r4:00037970 [<81b68828>] (schedule_timeout) from [<81b6126c>] (do_wait_for_common kernel/sched/completion.c:100 [inline]) [<81b68828>] (schedule_timeout) from [<81b6126c>] (__wait_for_common kernel/sched/completion.c:121 [inline]) [<81b68828>] (schedule_timeout) from [<81b6126c>] (wait_for_common kernel/sched/completion.c:132 [inline]) [<81b68828>] (schedule_timeout) from [<81b6126c>] (wait_for_completion_timeout+0x70/0x138 kernel/sched/completion.c:172) r6:84044980 r5:ea8e5774 r4:000001f4 [<81b611fc>] (wait_for_completion_timeout) from [<80f4c1e4>] (usb_start_wait_urb+0x12c/0x1c4 drivers/usb/core/message.c:72) r10:00001388 r9:84044980 r8:00000000 r7:ea8e57c0 r6:ea8e5770 r5:00000000 r4:856c3780 [<80f4c0b8>] (usb_start_wait_urb) from [<80f4c34c>] (usb_internal_control_msg drivers/usb/core/message.c:117 [inline]) [<80f4c0b8>] (usb_start_wait_urb) from [<80f4c34c>] (usb_control_msg+0xd0/0x130 drivers/usb/core/message.c:167) r10:00000001 r9:00000001 r8:00000000 r7:00000001 r6:00000000 r5:85cc4c00 r4:856439c0 [<80f4c27c>] (usb_control_msg) from [<80f4e5a0>] (usb_control_msg_send drivers/usb/core/message.c:226 [inline]) [<80f4c27c>] (usb_control_msg) from [<80f4e5a0>] (usb_set_interface+0x184/0x3e8 drivers/usb/core/message.c:1649) r10:84129a00 r9:00000001 r8:00000000 r7:00000000 r6:85f63fa4 r5:85635800 r4:85cc4c00 [<80f4e41c>] (usb_set_interface) from [<815b089c>] (set_altset+0x30/0x80 sound/usb/midi2.c:1027) r10:85005315 r9:861d0c70 r8:85643a40 r7:861d0d3c r6:85643a68 r5:861d0d3c r4:85643a40 [<815b086c>] (set_altset) from [<815b16e4>] (snd_usb_midi_v2_create+0x200/0x10e0 sound/usb/midi2.c:1122) r5:861d0d3c r4:85643a58 [<815b14e4>] (snd_usb_midi_v2_create) from [<81585428>] (snd_usb_create_stream+0x148/0x220 sound/usb/card.c:290) r10:85005315 r9:8500531d r8:85cc4c00 r7:00000000 r6:85635800 r5:861d0c70 r4:00000001 [<815852e0>] (snd_usb_create_stream) from [<8158603c>] (snd_usb_create_streams sound/usb/card.c:392 [inline]) [<815852e0>] (snd_usb_create_stream) from [<8158603c>] (usb_audio_probe+0x4cc/0x10e8 sound/usb/card.c:1031) r9:8500531d r8:8500531c r7:00000000 r6:861d0cd8 r5:00000000 r4:861d0c70 [<81585b70>] (usb_audio_probe) from [<80f50f1c>] (usb_probe_interface+0x148/0x380 drivers/usb/core/driver.c:396) r10:82425d08 r9:82be11ec r8:85cc4c88 r7:00000001 r6:81e46490 r5:86273c30 r4:ffffffed [<80f50dd4>] (usb_probe_interface) from [<80bd4d14>] (call_driver_probe drivers/base/dd.c:628 [inline]) [<80f50dd4>] (usb_probe_interface) from [<80bd4d14>] (really_probe+0xd8/0x40c drivers/base/dd.c:706) r10:82425d08 r9:82b618bc r8:00000056 r7:00000000 r6:82be11ec r5:00000000 r4:86273c30 [<80bd4c3c>] (really_probe) from [<80bd50e8>] (__driver_probe_device+0xa0/0x21c drivers/base/dd.c:868) r8:00000056 r7:86273c30 r6:ea8e5ab4 r5:82be11ec r4:86273c30 [<80bd5048>] (__driver_probe_device) from [<80bd5344>] (driver_probe_device+0x3c/0xc0 drivers/base/dd.c:898) r9:82b618bc r8:00000056 r7:86273c30 r6:ea8e5ab4 r5:82d25004 r4:82d24ff4 [<80bd5308>] (driver_probe_device) from [<80bd5468>] (__device_attach_driver+0xa0/0x138 drivers/base/dd.c:1026) r9:82b618bc r8:83889840 r7:86273c30 r6:ea8e5ab4 r5:82be11ec r4:00000001 [<80bd53c8>] (__device_attach_driver) from [<80bd2920>] (bus_for_each_drv+0x98/0xec drivers/base/bus.c:500) r7:83889800 r6:80bd53c8 r5:ea8e5ab4 r4:00000000 [<80bd2888>] (bus_for_each_drv) from [<80bd5884>] (__device_attach+0xb0/0x1e4 drivers/base/dd.c:1098) r7:83889800 r6:86273c7c r5:00000001 r4:86273c30 [<80bd57d4>] (__device_attach) from [<80bd5b7c>] (device_initial_probe+0x44/0x48 drivers/base/dd.c:1153) r6:83889800 r5:86273c30 r4:83889800 [<80bd5b38>] (device_initial_probe) from [<80bd39e8>] (bus_probe_device+0x30/0x84 drivers/base/bus.c:620) r5:86273c30 r4:86273c30 [<80bd39b8>] (bus_probe_device) from [<80bd0c14>] (device_add+0x610/0x834 drivers/base/core.c:3772) r9:82b618bc r8:81da8f84 r7:85cc4c88 r6:86273c7c r5:00000000 r4:86273c30 [<80bd0604>] (device_add) from [<80f4eff4>] (usb_set_configuration+0x5d8/0x938 drivers/usb/core/message.c:2268) r10:82425d08 r9:82c35298 r8:85cc4c88 r7:8645b254 r6:00000001 r5:8645b250 r4:86273c00 [<80f4ea1c>] (usb_set_configuration) from [<80f5c1ec>] (usb_generic_driver_probe+0x48/0x84 drivers/usb/core/generic.c:250) r10:84128f28 r9:82b618bc r8:00000056 r7:85cc4c00 r6:82b88da0 r5:00000001 r4:85cc4c00 [<80f5c1a4>] (usb_generic_driver_probe) from [<80f5039c>] (usb_probe_device+0x44/0x14c drivers/usb/core/driver.c:291) r5:00000001 r4:85cc4c88 [<80f50358>] (usb_probe_device) from [<80bd4d14>] (call_driver_probe drivers/base/dd.c:628 [inline]) [<80f50358>] (usb_probe_device) from [<80bd4d14>] (really_probe+0xd8/0x40c drivers/base/dd.c:706) r7:00000000 r6:82b88da0 r5:00000000 r4:85cc4c88 [<80bd4c3c>] (really_probe) from [<80bd50e8>] (__driver_probe_device+0xa0/0x21c drivers/base/dd.c:868) r8:00000056 r7:85cc4c88 r6:ea8e5d1c r5:82b88da0 r4:85cc4c88 [<80bd5048>] (__driver_probe_device) from [<80bd5344>] (driver_probe_device+0x3c/0xc0 drivers/base/dd.c:898) r9:82b618bc r8:00000056 r7:85cc4c88 r6:ea8e5d1c r5:82d25004 r4:82d24ff4 [<80bd5308>] (driver_probe_device) from [<80bd5468>] (__device_attach_driver+0xa0/0x138 drivers/base/dd.c:1026) r9:82b618bc r8:83889840 r7:85cc4c88 r6:ea8e5d1c r5:82b88da0 r4:00000001 [<80bd53c8>] (__device_attach_driver) from [<80bd2920>] (bus_for_each_drv+0x98/0xec drivers/base/bus.c:500) r7:83889800 r6:80bd53c8 r5:ea8e5d1c r4:00000000 [<80bd2888>] (bus_for_each_drv) from [<80bd5884>] (__device_attach+0xb0/0x1e4 drivers/base/dd.c:1098) r7:83889800 r6:85cc4cd4 r5:00000001 r4:85cc4c88 [<80bd57d4>] (__device_attach) from [<80bd5b7c>] (device_initial_probe+0x44/0x48 drivers/base/dd.c:1153) r6:83889800 r5:85cc4c88 r4:83889800 [<80bd5b38>] (device_initial_probe) from [<80bd39e8>] (bus_probe_device+0x30/0x84 drivers/base/bus.c:620) r5:85cc4c88 r4:85cc4c88 [<80bd39b8>] (bus_probe_device) from [<80bd0c14>] (device_add+0x610/0x834 drivers/base/core.c:3772) r9:82b618bc r8:00000000 r7:84172088 r6:85cc4cd4 r5:00000000 r4:85cc4c88 [<80bd0604>] (device_add) from [<80f42f8c>] (usb_new_device+0x28c/0x6b8 drivers/usb/core/hub.c:2695) r10:84128f28 r9:00000003 r8:00000000 r7:00000000 r6:00000000 r5:85cc4c88 r4:85cc4c00 [<80f42d00>] (usb_new_device) from [<80f45840>] (hub_port_connect drivers/usb/core/hub.c:5567 [inline]) [<80f42d00>] (usb_new_device) from [<80f45840>] (hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]) [<80f42d00>] (usb_new_device) from [<80f45840>] (port_event drivers/usb/core/hub.c:5871 [inline]) [<80f42d00>] (usb_new_device) from [<80f45840>] (hub_event+0x11ec/0x1b80 drivers/usb/core/hub.c:5953) r10:84128f28 r9:85cc4c00 r8:84172000 r7:00000001 r6:84129a00 r5:00000000 r4:00000003 [<80f44654>] (hub_event) from [<802761e8>] (process_one_work+0x1c8/0x580 kernel/workqueue.c:3322) r10:83317205 r9:84044980 r8:00800000 r7:dddd0f00 r6:83317200 r5:84128f28 r4:84607a80 [<80276020>] (process_one_work) from [<80276e94>] (process_scheduled_works kernel/workqueue.c:3405 [inline]) [<80276020>] (process_one_work) from [<80276e94>] (worker_thread+0x16c/0x318 kernel/workqueue.c:3486) r10:dddd0f00 r9:84607ab0 r8:84044980 r7:82a03d80 r6:dddd0f20 r5:dddd0f00 r4:84607a80 [<80276d28>] (worker_thread) from [<80281710>] (kthread+0x11c/0x154 kernel/kthread.c:436) r10:00000000 r9:df83de88 r8:844ee080 r7:84607a80 r6:80276d28 r5:84044980 r4:84640a80 [<802815f4>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:137) Exception stack(0xea8e5fb0 to 0xea8e5ff8) 5fa0: 00000000 00000000 00000000 00000000 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:802815f4 r4:84640a80 Code: e24cb004 e24dd00c e5902000 e1a06000 (e5921544) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e24cb004 sub fp, ip, #4 4: e24dd00c sub sp, sp, #12 8: e5902000 ldr r2, [r0] c: e1a06000 mov r6, r0 * 10: e5921544 ldr r1, [r2, #1348] @ 0x544 <-- trapping instruction