Oops: general protection fault, probably for non-canonical address 0xdffffc00000000e6: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000730-0x0000000000000737]
CPU: 0 UID: 0 PID: 12679 Comm: syz.6.1224 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
RIP: 0010:f_midi2_free_ep_reqs drivers/usb/gadget/function/f_midi2.c:1166 [inline]
RIP: 0010:f_midi2_stop_eps+0x28e/0x4d0 drivers/usb/gadget/function/f_midi2.c:1246
Code: 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 e7 e6 63 fa 41 bf 30 07 00 00 4d 03 3e 4c 89 f8 48 c1 e8 03 48 89 44 24 18 <42> 0f b6 04 28 84 c0 0f 85 12 02 00 00 41 8b 1f 31 ff 89 de e8 d9
RSP: 0000:ffffc90000007930 EFLAGS: 00010012
RAX: 00000000000000e6 RBX: ffff88805818c120 RCX: ffff888034c60000
RDX: 0000000000000100 RSI: ffffffff8c4bdd60 RDI: ffffffff8c4bdd20
RBP: ffff88805818c100 R08: 00000000ad2b1554 R09: 0000000054db1289
R10: 0000000000000010 R11: ffffffff8eb59c60 R12: ffff88805818c730
R13: dffffc0000000000 R14: ffff88805818c128 R15: 0000000000000730
FS: 0000555580fb2500(0000) GS:ffff888124f4c000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c3003a5 CR3: 000000007531e000 CR4: 0000000000350ef0
Call Trace:
f_midi2_set_alt+0x11c/0xf00 drivers/usb/gadget/function/f_midi2.c:1296
composite_setup+0x1ffd/0x3480 drivers/usb/gadget/composite.c:1933
configfs_composite_setup+0xc7/0x100 drivers/usb/gadget/configfs.c:1877
dummy_timer+0x2f43/0x4cf0 drivers/usb/gadget/udc/dummy_hcd.c:1951
__run_hrtimer kernel/time/hrtimer.c:2032 [inline]
__hrtimer_run_queues+0x3bc/0xa10 kernel/time/hrtimer.c:2096
hrtimer_run_softirq+0x17a/0x240 kernel/time/hrtimer.c:2113
handle_softirqs+0x225/0x840 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0xca/0x220 kernel/softirq.c:735
irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:get_current arch/x86/include/asm/current.h:25 [inline]
RIP: 0010:write_comp_data kernel/kcov.c:245 [inline]
RIP: 0010:__sanitizer_cov_trace_const_cmp8+0x8/0x90 kernel/kcov.c:321
Code: 89 44 11 20 e9 74 27 49 ff cc 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 8b 04 24 <65> 48 8b 0d 48 26 a6 11 65 8b 15 69 26 a6 11 81 e2 00 01 ff 00 74
RSP: 0000:ffffc90005937860 EFLAGS: 00000246
RAX: ffffffff82406385 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff888034c60000 RSI: 0000000000000000 RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000001 R09: 1ffffd400038b578
R10: dffffc0000000000 R11: fffff9400038b579 R12: 0000000000000000
R13: 0000000000000000 R14: ffff888025665810 R15: dffffc0000000000
__page_table_check_ptes_set+0x1f5/0x320 include/linux/pgtable.h:-1
page_table_check_ptes_set include/linux/page_table_check.h:83 [inline]
set_ptes include/linux/pgtable.h:447 [inline]
set_pte_range+0x7ef/0x840 mm/memory.c:5588
filemap_map_order0_folio mm/filemap.c:3874 [inline]
filemap_map_pages+0xf35/0x2090 mm/filemap.c:3944
do_fault_around mm/memory.c:5818 [inline]
do_read_fault mm/memory.c:5851 [inline]
do_fault mm/memory.c:5994 [inline]
do_pte_missing+0x20ae/0x34b0 mm/memory.c:4566
handle_pte_fault mm/memory.c:6379 [inline]
__handle_mm_fault mm/memory.c:6517 [inline]
handle_mm_fault+0x1b36/0x3080 mm/memory.c:6686
do_user_addr_fault+0xa4d/0x1340 arch/x86/mm/fault.c:1343
handle_page_fault arch/x86/mm/fault.c:1483 [inline]
exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1536
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595
RIP: 0033:0x7fd8130728b6
Code: ff 48 83 e8 01 48 89 de bf 01 00 00 00 48 c1 e0 0e 48 c1 ee 06 48 01 c8 48 89 d9 81 e6 ff 3f 00 00 48 c1 e9 03 83 e1 07 d3 e7 <40> 84 bc 06 20 20 00 00 0f 85 20 fe ff ff e9 d4 fd ff ff 0f 1f 80
RSP: 002b:00007ffdc319ced0 EFLAGS: 00010212
RAX: 000000110c2fc000 RBX: ffffffff83d8e156 RCX: 0000000000000002
RDX: 0000000000000156 RSI: 0000000000002385 RDI: 0000000000000004
RBP: 0000000000000000 R08: 00007fd813410000 R09: 00007fd813412000
R10: 0000000083d8e15a R11: 0000000000000016 R12: 00007fd813426218
R13: 0000000000000489 R14: ffffffff83d8ea6d R15: 00007fd813f55720
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:f_midi2_free_ep_reqs drivers/usb/gadget/function/f_midi2.c:1166 [inline]
RIP: 0010:f_midi2_stop_eps+0x28e/0x4d0 drivers/usb/gadget/function/f_midi2.c:1246
Code: 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 e7 e6 63 fa 41 bf 30 07 00 00 4d 03 3e 4c 89 f8 48 c1 e8 03 48 89 44 24 18 <42> 0f b6 04 28 84 c0 0f 85 12 02 00 00 41 8b 1f 31 ff 89 de e8 d9
RSP: 0000:ffffc90000007930 EFLAGS: 00010012
RAX: 00000000000000e6 RBX: ffff88805818c120 RCX: ffff888034c60000
RDX: 0000000000000100 RSI: ffffffff8c4bdd60 RDI: ffffffff8c4bdd20
RBP: ffff88805818c100 R08: 00000000ad2b1554 R09: 0000000054db1289
R10: 0000000000000010 R11: ffffffff8eb59c60 R12: ffff88805818c730
R13: dffffc0000000000 R14: ffff88805818c128 R15: 0000000000000730
FS: 0000555580fb2500(0000) GS:ffff888124f4c000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c3003a5 CR3: 000000007531e000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
0: 89 f0 mov %esi,%eax
2: 48 c1 e8 03 shr $0x3,%rax
6: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1)
b: 74 08 je 0x15
d: 4c 89 f7 mov %r14,%rdi
10: e8 e7 e6 63 fa call 0xfa63e6fc
15: 41 bf 30 07 00 00 mov $0x730,%r15d
1b: 4d 03 3e add (%r14),%r15
1e: 4c 89 f8 mov %r15,%rax
21: 48 c1 e8 03 shr $0x3,%rax
25: 48 89 44 24 18 mov %rax,0x18(%rsp)
* 2a: 42 0f b6 04 28 movzbl (%rax,%r13,1),%eax <-- trapping instruction
2f: 84 c0 test %al,%al
31: 0f 85 12 02 00 00 jne 0x249
37: 41 8b 1f mov (%r15),%ebx
3a: 31 ff xor %edi,%edi
3c: 89 de mov %ebx,%esi
3e: e8 .byte 0xe8
3f: d9 .byte 0xd9