Oops: general protection fault, probably for non-canonical address 0xdffffc00000000e6: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000730-0x0000000000000737]
CPU: 1 UID: 0 PID: 5599 Comm: udevd Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
RIP: 0010:f_midi2_free_ep_reqs+0x56/0x2b0 drivers/usb/gadget/function/f_midi2.c:1166
Code: 85 6a 02 00 00 49 8b 45 00 48 89 44 24 18 48 05 30 07 00 00 48 89 c2 48 89 44 24 20 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e b5 01 00 00 48 8b 44 24 18 31
RSP: 0018:ffffc90000a089e8 EFLAGS: 00010002
RAX: dffffc0000000000 RBX: ffff888048bb8000 RCX: ffffffff87e79339
RDX: 00000000000000e6 RSI: ffffffff87e79176 RDI: ffff888048bb8128
RBP: ffff888048bb8128 R08: 0000000000000004 R09: 0000000000000020
R10: 0000000000000020 R11: 0000000000000000 R12: ffff888048bb80f0
R13: ffff888048bb8128 R14: ffff888048bb8740 R15: 0000000000000001
FS: 00007f123136c880(0000) GS:ffff888123ede000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000002ae85000 CR4: 00000000003526f0
Call Trace:
f_midi2_stop_eps drivers/usb/gadget/function/f_midi2.c:1246 [inline]
f_midi2_set_alt+0x444/0x5f0 drivers/usb/gadget/function/f_midi2.c:1296
composite_setup+0x16f8/0x9290 drivers/usb/gadget/composite.c:1933
configfs_composite_setup+0xfb/0x130 drivers/usb/gadget/configfs.c:1877
dummy_timer+0x2062/0x36c0 drivers/usb/gadget/udc/dummy_hcd.c:1937
__run_hrtimer kernel/time/hrtimer.c:2032 [inline]
__hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2096
hrtimer_run_softirq+0x17d/0x2c0 kernel/time/hrtimer.c:2113
handle_softirqs+0x1ea/0x9b0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x162/0x210 kernel/softirq.c:735
irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:security_compute_av+0x0/0x11e0 security/selinux/ss/services.c:1129
Code: 24 60 e8 d3 e9 a0 fd e9 c1 f6 ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <0f> 1f 40 d6 41 57 41 89 ff 41 56 41 55 49 89 cd 41 54 41 89 d4 55
RSP: 0018:ffffc900031bf6d0 EFLAGS: 00000246
RAX: dffffc0000000000 RBX: 0000000000000008 RCX: ffffc900031bf8e0
RDX: 0000000000000008 RSI: 000000000000002d RDI: 0000000000000046
RBP: 0000000000000046 R08: ffffc900031bf770 R09: ffffc900031bf8e0
R10: 0000000000000001 R11: 0000000000000000 R12: ffffc900031bf770
R13: ffffc900031bf798 R14: 000000000000002d R15: ffffc900031bf8e0
avc_compute_av+0x84/0x820 security/selinux/avc.c:992
avc_perm_nonode+0xb1/0x180 security/selinux/avc.c:1117
avc_has_perm_noaudit+0x2d4/0x3b0 security/selinux/avc.c:1160
selinux_inode_permission+0x8d4/0x1130 security/selinux/hooks.c:3280
security_inode_permission+0xda/0x250 security/security.c:1842
inode_permission+0x36c/0x620 fs/namei.c:661
lookup_inode_permission_may_exec fs/namei.c:696 [inline]
may_lookup fs/namei.c:1976 [inline]
link_path_walk+0x152d/0x1cc0 fs/namei.c:2604
path_openat+0x1c9/0x4280 fs/namei.c:4859
do_file_open+0x20e/0x430 fs/namei.c:4892
do_sys_openat2+0x10f/0x1e0 fs/open.c:1368
do_sys_open fs/open.c:1374 [inline]
__do_sys_openat fs/open.c:1390 [inline]
__se_sys_openat fs/open.c:1385 [inline]
__x64_sys_openat+0x12d/0x210 fs/open.c:1385
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1230ca7407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffe093472d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f123136c880 RCX: 00007f1230ca7407
RDX: 0000000000080000 RSI: 00007ffe09347450 RDI: ffffffffffffff9c
RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 000055ec2de8f7f5
R13: 000055ec2de8f7f5 R14: 0000000000000001 R15: 000055ec2deaa140
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:f_midi2_free_ep_reqs+0x56/0x2b0 drivers/usb/gadget/function/f_midi2.c:1166
Code: 85 6a 02 00 00 49 8b 45 00 48 89 44 24 18 48 05 30 07 00 00 48 89 c2 48 89 44 24 20 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e b5 01 00 00 48 8b 44 24 18 31
RSP: 0018:ffffc90000a089e8 EFLAGS: 00010002
RAX: dffffc0000000000 RBX: ffff888048bb8000 RCX: ffffffff87e79339
RDX: 00000000000000e6 RSI: ffffffff87e79176 RDI: ffff888048bb8128
RBP: ffff888048bb8128 R08: 0000000000000004 R09: 0000000000000020
R10: 0000000000000020 R11: 0000000000000000 R12: ffff888048bb80f0
R13: ffff888048bb8128 R14: ffff888048bb8740 R15: 0000000000000001
FS: 00007f123136c880(0000) GS:ffff888123ede000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000002ae85000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
0: 85 6a 02 test %ebp,0x2(%rdx)
3: 00 00 add %al,(%rax)
5: 49 8b 45 00 mov 0x0(%r13),%rax
9: 48 89 44 24 18 mov %rax,0x18(%rsp)
e: 48 05 30 07 00 00 add $0x730,%rax
14: 48 89 c2 mov %rax,%rdx
17: 48 89 44 24 20 mov %rax,0x20(%rsp)
1c: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
23: fc ff df
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax <-- trapping instruction
2e: 84 c0 test %al,%al
30: 74 08 je 0x3a
32: 3c 03 cmp $0x3,%al
34: 0f 8e b5 01 00 00 jle 0x1ef
3a: 48 8b 44 24 18 mov 0x18(%rsp),%rax
3f: 31 .byte 0x31