8<--- cut here ---
Unable to handle kernel NULL pointer dereference at virtual address 00000048 when read
[00000048] *pgd=80000080004003, *pmd=00000000
Internal error: Oops: 205 [#1] SMP ARM
Modules linked in:
CPU: 0 UID: 0 PID: 11 Comm: kworker/0:0H Not tainted syzkaller #0 PREEMPT 
Hardware name: ARM-Versatile Express
Workqueue: events_highpri f_midi_in_work
PC is at dummy_queue+0x70/0x244 drivers/usb/gadget/udc/dummy_hcd.c:737
LR is at usb_ep_queue+0x40/0x168 drivers/usb/gadget/udc/core.c:305
pc : [<810cc980>]    lr : [<810c869c>]    psr: a0000093
sp : df845e38  ip : df845e80  fp : df845e7c
r10: 8b6b9200  r9 : 863b5600  r8 : 8476c000
r7 : 81de3830  r6 : 8476c6b0  r5 : 8476c05c  r4 : 8b6b9208
r3 : 00000000  r2 : 8b7b2a34  r1 : 00000003  r0 : 8476c05c
Flags: NzCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 30c5387d  Table: 916a8f00  DAC: fffffffd
Register r0 information: slab kmalloc-4k start 8476c000 pointer offset 92 size 4096
Register r1 information: non-paged memory
Register r2 information: slab kmalloc-2k start 8b7b2800 pointer offset 564 size 2048
Register r3 information: NULL pointer
Register r4 information: slab kmalloc-128 start 8b6b9200 pointer offset 8 size 128
Register r5 information: slab kmalloc-4k start 8476c000 pointer offset 92 size 4096
Register r6 information: slab kmalloc-4k start 8476c000 pointer offset 1712 size 4096
Register r7 information: non-slab/vmalloc memory
Register r8 information: slab kmalloc-4k start 8476c000 pointer offset 0 size 4096
Register r9 information: slab kmalloc-128 start 863b5600 pointer offset 0 size 128
Register r10 information: slab kmalloc-128 start 8b6b9200 pointer offset 0 size 128
Register r11 information: 2-page vmalloc region starting at 0xdf844000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2766
Register r12 information: 2-page vmalloc region starting at 0xdf844000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2766
Process kworker/0:0H (pid: 11, stack limit = 0xdf844000)
Stack: (0xdf845e38 to 0xdf846000)
5e20:                                                       00000000 8111cc24
5e40: 00000001 00001000 85ef4c80 863b5628 80000093 8476c05c 8b6b9208 860e7acc
5e60: 81de3830 8b6b9208 863b5600 00000000 df845ea4 df845e80 810c869c 810cc91c
5e80: 860e7b08 00000000 860e7acc 81de3830 8b6b9208 863b5600 df845ef4 df845ea8
5ea0: 8111cd98 810c8668 00000001 8476c05c 20000013 860e7b08 00000005 0001ea80
5ec0: 007bb00b e323e9ab 00000000 83015b80 860e7acc 8302ac00 dddd11a0 828cb748
5ee0: 83184980 8302ac05 df845f4c df845ef8 802772b8 8111cb70 83015bb0 83015bb0
5f00: df845f34 df845f10 802739e0 80966f18 860e7acc 00000000 83015b80 00000000
5f20: 83184980 83015b80 dddd11a0 dddd11c0 82a03d80 83184980 83015bb0 dddd11a0
5f40: df845f84 df845f50 80277f64 802770fc 82a03d80 dddd11fc 802803bc 830ed6c0
5f60: 83184980 80277df8 83015b80 83015a00 df819e50 00000000 df845fac df845f88
5f80: 802827b4 80277e04 830ed6c0 80282698 00000000 00000000 00000000 00000000
5fa0: 00000000 df845fb0 80200114 802826a4 00000000 00000000 00000000 00000000
5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
5fe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000
Call trace: 
[<810cc910>] (dummy_queue) from [<810c869c>] (usb_ep_queue+0x40/0x168 drivers/usb/gadget/udc/core.c:305)
 r10:00000000 r9:863b5600 r8:8b6b9208 r7:81de3830 r6:860e7acc r5:8b6b9208
 r4:8476c05c
[<810c865c>] (usb_ep_queue) from [<8111cd98>] (f_midi_do_transmit drivers/usb/gadget/function/f_midi.c:659 [inline])
[<810c865c>] (usb_ep_queue) from [<8111cd98>] (f_midi_transmit drivers/usb/gadget/function/f_midi.c:687 [inline])
[<810c865c>] (usb_ep_queue) from [<8111cd98>] (f_midi_in_work+0x234/0x56c drivers/usb/gadget/function/f_midi.c:707)
 r9:863b5600 r8:8b6b9208 r7:81de3830 r6:860e7acc r5:00000000 r4:860e7b08
[<8111cb64>] (f_midi_in_work) from [<802772b8>] (process_one_work+0x1c8/0x580 kernel/workqueue.c:3322)
 r10:8302ac05 r9:83184980 r8:828cb748 r7:dddd11a0 r6:8302ac00 r5:860e7acc
 r4:83015b80
[<802770f0>] (process_one_work) from [<80277f64>] (process_scheduled_works kernel/workqueue.c:3405 [inline])
[<802770f0>] (process_one_work) from [<80277f64>] (worker_thread+0x16c/0x318 kernel/workqueue.c:3486)
 r10:dddd11a0 r9:83015bb0 r8:83184980 r7:82a03d80 r6:dddd11c0 r5:dddd11a0
 r4:83015b80
[<80277df8>] (worker_thread) from [<802827b4>] (kthread+0x11c/0x154 kernel/kthread.c:436)
 r10:00000000 r9:df819e50 r8:83015a00 r7:83015b80 r6:80277df8 r5:83184980
 r4:830ed6c0
[<80282698>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:137)
Exception stack(0xdf845fb0 to 0xdf845ff8)
5fa0:                                     00000000 00000000 00000000 00000000
5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
5fe0: 00000000 00000000 00000000 00000000 00000013 00000000
 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:80282698 r4:830ed6c0
Code: 01a03002 e5962260 e3520000 0a00005c (e5933048) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	01a03002 	moveq	r3, r2
   4:	e5962260 	ldr	r2, [r6, #608]	@ 0x260
   8:	e3520000 	cmp	r2, #0
   c:	0a00005c 	beq	0x184
* 10:	e5933048 	ldr	r3, [r3, #72]	@ 0x48 <-- trapping instruction