Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]
CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
RIP: 0010:dummy_queue+0x1a9/0x890 drivers/usb/gadget/udc/dummy_hcd.c:718
Code: e8 03 42 80 3c 28 00 74 08 48 89 ef e8 20 35 f8 fa 48 8b 6d 00 48 83 c5 60 48 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 c3 05 00 00 8b 6d 00 89 ee 83 e6 02 31 ff
RSP: 0018:ffffc90000157a50 EFLAGS: 00010206
RAX: 000000000000000c RBX: ffff888035329a10 RCX: dffffc0000000000
RDX: 0000000000000100 RSI: 0000000000000003 RDI: 0000000000000005
RBP: 0000000000000060 R08: 0000000000000000 R09: 0000000000000100
R10: dffffc0000000000 R11: ffffffff8739c3e0 R12: ffff888035329a00
R13: dffffc0000000000 R14: 1ffff11006a65340 R15: ffff888028184c40
FS:  0000000000000000(0000) GS:ffff8881259f2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f73f19a37e8 CR3: 000000000e1b0000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 usb_ep_queue+0xf1/0x3c0 drivers/usb/gadget/udc/core.c:305
 eth_start_xmit+0x984/0x1060 drivers/usb/gadget/function/u_ether.c:579
 ncm_tx_timeout+0x87/0xa0 drivers/usb/gadget/function/f_ncm.c:1161
 __run_hrtimer kernel/time/hrtimer.c:2065 [inline]
 __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2122
 hrtimer_run_softirq+0x18f/0x260 kernel/time/hrtimer.c:2139
 handle_softirqs+0x1d9/0x6c0 kernel/softirq.c:626
 __do_softirq kernel/softirq.c:660 [inline]
 run_ktimerd+0x69/0x100 kernel/softirq.c:1155
 smpboot_thread_fn+0x57c/0xa80 kernel/smpboot.c:160
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:dummy_queue+0x1a9/0x890 drivers/usb/gadget/udc/dummy_hcd.c:718
Code: e8 03 42 80 3c 28 00 74 08 48 89 ef e8 20 35 f8 fa 48 8b 6d 00 48 83 c5 60 48 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 c3 05 00 00 8b 6d 00 89 ee 83 e6 02 31 ff
RSP: 0018:ffffc90000157a50 EFLAGS: 00010206
RAX: 000000000000000c RBX: ffff888035329a10 RCX: dffffc0000000000
RDX: 0000000000000100 RSI: 0000000000000003 RDI: 0000000000000005
RBP: 0000000000000060 R08: 0000000000000000 R09: 0000000000000100
R10: dffffc0000000000 R11: ffffffff8739c3e0 R12: ffff888035329a00
R13: dffffc0000000000 R14: 1ffff11006a65340 R15: ffff888028184c40
FS:  0000000000000000(0000) GS:ffff8881259f2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f73f19a37e8 CR3: 000000000e1b0000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
   0:	e8 03 42 80 3c       	call   0x3c804208
   5:	28 00                	sub    %al,(%rax)
   7:	74 08                	je     0x11
   9:	48 89 ef             	mov    %rbp,%rdi
   c:	e8 20 35 f8 fa       	call   0xfaf83531
  11:	48 8b 6d 00          	mov    0x0(%rbp),%rbp
  15:	48 83 c5 60          	add    $0x60,%rbp
  19:	48 89 e8             	mov    %rbp,%rax
  1c:	48 c1 e8 03          	shr    $0x3,%rax
  20:	48 b9 00 00 00 00 00 	movabs $0xdffffc0000000000,%rcx
  27:	fc ff df
* 2a:	0f b6 04 08          	movzbl (%rax,%rcx,1),%eax <-- trapping instruction
  2e:	84 c0                	test   %al,%al
  30:	0f 85 c3 05 00 00    	jne    0x5f9
  36:	8b 6d 00             	mov    0x0(%rbp),%ebp
  39:	89 ee                	mov    %ebp,%esi
  3b:	83 e6 02             	and    $0x2,%esi
  3e:	31 ff                	xor    %edi,%edi