8<--- cut here --- Unable to handle kernel NULL pointer dereference at virtual address 00000544 when read [00000544] *pgd=80000080004003, *pmd=00000000 Internal error: Oops: 205 [#1] SMP ARM Modules linked in: CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Tainted: G L syzkaller #0 PREEMPT Tainted: [L]=SOFTLOCKUP Hardware name: ARM-Versatile Express Workqueue: usb_hub_wq hub_event PC is at f_midi2_free_ep_reqs+0x18/0xb8 drivers/usb/gadget/function/f_midi2.c:1166 LR is at f_midi2_stop_eps drivers/usb/gadget/function/f_midi2.c:1246 [inline] LR is at f_midi2_set_alt+0x9c/0x190 drivers/usb/gadget/function/f_midi2.c:1296 pc : [<81111a30>] lr : [<811131b8>] psr: 60000193 sp : df801ce8 ip : df801d20 fp : df801d1c r10: 8625b418 r9 : 83baa6b0 r8 : 892add88 r7 : 00000001 r6 : 869e8094 r5 : 869e8000 r4 : 869e8094 r3 : 869e8000 r2 : 00000000 r1 : 00000020 r0 : 869e8094 Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 85b823c0 DAC: fffffffd Register r0 information: non-slab/vmalloc memory Register r1 information: non-paged memory Register r2 information: NULL pointer Register r3 information: non-slab/vmalloc memory Register r4 information: non-slab/vmalloc memory Register r5 information: non-slab/vmalloc memory Register r6 information: non-slab/vmalloc memory Register r7 information: non-paged memory Register r8 information: slab kmalloc-128 start 892add80 pointer offset 8 size 128 Register r9 information: slab kmalloc-4k start 83baa000 pointer offset 1712 size 4096 Register r10 information: slab kmalloc-2k start 8625b000 pointer offset 1048 size 2048 Register r11 information: 2-page vmalloc region starting at 0xdf800000 allocated at start_kernel+0x690/0x844 init/main.c:1079 Register r12 information: 2-page vmalloc region starting at 0xdf800000 allocated at start_kernel+0x690/0x844 init/main.c:1079 Process kworker/0:1 (pid: 11, stack limit = 0xdf844000) Stack: (0xdf801ce8 to 0xdf802000) 1ce0: 802a69dc 869e8000 df801d64 869e8094 869e8000 869e8078 1d00: 00000001 892add88 83baa6b0 8625b418 df801d44 df801d20 811131b8 81111a24 1d20: 8625b2b0 00000001 8111311c 00000001 892add88 83baa6b0 df801dcc df801d48 1d40: 810b45b0 81113128 00000294 cb7e8e85 df801d9c df801d60 802a05e4 8029da64 1d60: 00000000 83184bc0 df801d9c df801d78 802a5eb0 83184bc0 869e8000 00000000 1d80: dddd1580 00000000 00000001 dddd1600 df801dcc df801da0 802a9a78 882e6e51 1da0: a0000193 83baa6b0 8625b2b0 a0000193 df801e6c 8625b53c 810c12fc 86a5a6c0 1dc0: df801df4 df801dd0 810b7a08 810b4110 868afcc4 83baa000 868afcc0 00000000 1de0: 000000c0 810c12fc df801ea4 df801df8 810c1bfc 810b79a8 dddc6288 828c928c 1e00: df801edc 83184980 00000000 80000113 82a03d80 00000000 82c0e23c 83baa004 1e20: 82c0f34f 83baa000 845ecfb8 0000d000 20000193 82d08898 df801e5c 845ecfb4 1e40: 82a03d80 df801e50 81b67d44 8028e490 845ecf68 dddc81ec 845ecf68 df801e68 1e60: 81b49e28 83baa004 845ecf68 00010b01 00000001 882e6e51 80330760 845ecf68 1e80: dddc81d0 dddc80c0 00000181 000000c0 810c12fc 00000181 df801efc df801ea8 1ea0: 80330fec 810c1308 813cca78 00000181 aea8d210 00000010 00000004 813cca68 1ec0: 82a0b150 83184980 81c05a1c aea8d210 20000113 dddc80c0 20000113 000000f0 1ee0: 00000020 00000000 00000000 83184980 df801f2c df801f00 803312b4 80330e90 1f00: 20000113 000000f0 00000009 82a030a0 00000008 00000009 00000101 00000100 1f20: df801fac df801f30 8025a0dc 80331234 000129f0 00000000 df801f54 04208060 1f40: 82a03d80 000211e3 82521940 00000000 828d3e80 0000000a dddc62a8 82c10038 1f60: 82aff7a4 82a0b150 82512d54 828c9258 82a03080 df801f30 802bc6cc 802b14e4 1f80: 83184980 83184980 82521940 824e64d4 df845640 00000000 83184980 df845778 1fa0: df801fc4 df801fb0 8025a5fc 80259f88 828d3e6c 82521940 df801fd4 df801fc8 1fc0: 8025a934 8025a4b8 df801ffc df801fd8 81b59abc 8025a930 81b67ce8 00000113 1fe0: ffffffff df845674 df845724 83184980 df84563c df802000 81b26744 81b59a4c Call trace: frame pointer underflow [<81111a18>] (f_midi2_free_ep_reqs) from [<811131b8>] (f_midi2_stop_eps drivers/usb/gadget/function/f_midi2.c:1246 [inline]) [<81111a18>] (f_midi2_free_ep_reqs) from [<811131b8>] (f_midi2_set_alt+0x9c/0x190 drivers/usb/gadget/function/f_midi2.c:1296) r10:8625b418 r9:83baa6b0 r8:892add88 r7:00000001 r6:869e8078 r5:869e8000 r4:869e8094 [<8111311c>] (f_midi2_set_alt) from [<810b45b0>] (composite_setup+0x4ac/0x2160 drivers/usb/gadget/composite.c:1933) r9:83baa6b0 r8:892add88 r7:00000001 r6:8111311c r5:00000001 r4:8625b2b0 [<810b4104>] (composite_setup) from [<810b7a08>] (configfs_composite_setup+0x6c/0x84 drivers/usb/gadget/configfs.c:1877) r10:86a5a6c0 r9:810c12fc r8:8625b53c r7:df801e6c r6:a0000193 r5:8625b2b0 r4:83baa6b0 [<810b799c>] (configfs_composite_setup) from [<810c1bfc>] (dummy_timer+0x900/0xfd4 drivers/usb/gadget/udc/dummy_hcd.c:1937) r9:810c12fc r8:000000c0 r7:00000000 r6:868afcc0 r5:83baa000 r4:868afcc4 [<810c12fc>] (dummy_timer) from [<80330fec>] (__run_hrtimer kernel/time/hrtimer.c:2032 [inline]) [<810c12fc>] (dummy_timer) from [<80330fec>] (__hrtimer_run_queues+0x168/0x3a4 kernel/time/hrtimer.c:2096) r10:00000181 r9:810c12fc r8:000000c0 r7:00000181 r6:dddc80c0 r5:dddc81d0 r4:845ecf68 [<80330e84>] (__hrtimer_run_queues) from [<803312b4>] (hrtimer_run_softirq+0x8c/0xc8 kernel/time/hrtimer.c:2113) r10:83184980 r9:00000000 r8:00000000 r7:00000020 r6:000000f0 r5:20000113 r4:dddc80c0 [<80331228>] (hrtimer_run_softirq) from [<8025a0dc>] (handle_softirqs+0x160/0x4e4 kernel/softirq.c:622) r9:00000100 r8:00000101 r6:00000009 r5:00000008 r4:82a030a0 [<80259f7c>] (handle_softirqs) from [<8025a5fc>] (__do_softirq kernel/softirq.c:656 [inline]) [<80259f7c>] (handle_softirqs) from [<8025a5fc>] (invoke_softirq kernel/softirq.c:496 [inline]) [<80259f7c>] (handle_softirqs) from [<8025a5fc>] (__irq_exit_rcu+0x150/0x1d0 kernel/softirq.c:735) r10:df845778 r9:83184980 r8:00000000 r7:df845640 r6:824e64d4 r5:82521940 r4:83184980 [<8025a4ac>] (__irq_exit_rcu) from [<8025a934>] (irq_exit+0x10/0x18 kernel/softirq.c:764) r5:82521940 r4:828d3e6c [<8025a924>] (irq_exit) from [<81b59abc>] (generic_handle_arch_irq+0x7c/0x80 kernel/irq/handle.c:293) [<81b59a40>] (generic_handle_arch_irq) from [<81b26744>] (call_with_stack+0x1c/0x20 arch/arm/lib/call_with_stack.S:40) r9:83184980 r8:df845724 r7:df845674 r6:ffffffff r5:00000113 r4:81b67ce8 [<81b26728>] (call_with_stack) from [<80200bec>] (__irq_svc+0x8c/0xbc arch/arm/kernel/entry-armv.S:228) Exception stack(0xdf845640 to 0xdf845688) 5640: dddd0f00 00000000 8302fe00 0000bbcc 83015b80 dddd0f00 83184980 df845770 5660: df845724 00000002 df845778 df84569c df8456a0 df845690 802796f4 81b67ce8 5680: 00000113 ffffffff [<81b67cc0>] (_raw_spin_unlock_irq) from [<802796f4>] (wq_worker_sleeping+0x8c/0x90 kernel/workqueue.c:1489) [<80279668>] (wq_worker_sleeping) from [<81b5e8fc>] (sched_submit_work kernel/sched/core.c:7277 [inline]) [<80279668>] (wq_worker_sleeping) from [<81b5e8fc>] (schedule+0xb4/0xec kernel/sched/core.c:7325) r5:82a03d80 r4:83184980 [<81b5e848>] (schedule) from [<81b66b54>] (schedule_timeout+0x8c/0x114 kernel/time/sleep_timeout.c:99) r5:82a03d80 r4:000213d6 [<81b66ac8>] (schedule_timeout) from [<81b5f50c>] (do_wait_for_common kernel/sched/completion.c:100 [inline]) [<81b66ac8>] (schedule_timeout) from [<81b5f50c>] (__wait_for_common kernel/sched/completion.c:121 [inline]) [<81b66ac8>] (schedule_timeout) from [<81b5f50c>] (wait_for_common kernel/sched/completion.c:132 [inline]) [<81b66ac8>] (schedule_timeout) from [<81b5f50c>] (wait_for_completion_timeout+0x70/0x138 kernel/sched/completion.c:172) r6:83184980 r5:df845774 r4:000001f4 [<81b5f49c>] (wait_for_completion_timeout) from [<80f4bb34>] (usb_start_wait_urb+0x12c/0x1c4 drivers/usb/core/message.c:72) r10:00001388 r9:83184980 r8:00000000 r7:df8457c0 r6:df845770 r5:00000000 r4:86a5a6c0 [<80f4ba08>] (usb_start_wait_urb) from [<80f4bc9c>] (usb_internal_control_msg drivers/usb/core/message.c:117 [inline]) [<80f4ba08>] (usb_start_wait_urb) from [<80f4bc9c>] (usb_control_msg+0xd0/0x130 drivers/usb/core/message.c:167) r10:00000001 r9:00000001 r8:00000000 r7:00000001 r6:00000000 r5:892cf000 r4:868afb00 [<80f4bbcc>] (usb_control_msg) from [<80f4def0>] (usb_control_msg_send drivers/usb/core/message.c:226 [inline]) [<80f4bbcc>] (usb_control_msg) from [<80f4def0>] (usb_set_interface+0x184/0x3e8 drivers/usb/core/message.c:1649) r10:845ece00 r9:00000001 r8:00000000 r7:00000000 r6:87c2c424 r5:86ba4c00 r4:892cf000 [<80f4dd6c>] (usb_set_interface) from [<815afb64>] (set_altset+0x30/0x80 sound/usb/midi2.c:1025) r10:892adf95 r9:85b64470 r8:868affc0 r7:85b6453c r6:868affe8 r5:85b6453c r4:868affc0 [<815afb34>] (set_altset) from [<815b097c>] (snd_usb_midi_v2_create+0x200/0x10e0 sound/usb/midi2.c:1120) r5:85b6453c r4:868affd8 [<815b077c>] (snd_usb_midi_v2_create) from [<81584710>] (snd_usb_create_stream+0x148/0x220 sound/usb/card.c:290) r10:892adf95 r9:892adf9d r8:892cf000 r7:00000000 r6:86ba4c00 r5:85b64470 r4:00000001 [<815845c8>] (snd_usb_create_stream) from [<81585324>] (snd_usb_create_streams sound/usb/card.c:392 [inline]) [<815845c8>] (snd_usb_create_stream) from [<81585324>] (usb_audio_probe+0x4cc/0x10e8 sound/usb/card.c:1031) r9:892adf9d r8:892adf9c r7:00000000 r6:85b644d8 r5:00000000 r4:85b64470 [<81584e58>] (usb_audio_probe) from [<80f5086c>] (usb_probe_interface+0x148/0x380 drivers/usb/core/driver.c:396) r10:824257e0 r9:82be11ec r8:892cf088 r7:00000001 r6:81e463d0 r5:86848030 r4:ffffffed [<80f50724>] (usb_probe_interface) from [<80bd481c>] (call_driver_probe drivers/base/dd.c:628 [inline]) [<80f50724>] (usb_probe_interface) from [<80bd481c>] (really_probe+0xd8/0x40c drivers/base/dd.c:706) r10:824257e0 r9:82b618bc r8:000000e3 r7:00000000 r6:82be11ec r5:00000000 r4:86848030 [<80bd4744>] (really_probe) from [<80bd4bf0>] (__driver_probe_device+0xa0/0x21c drivers/base/dd.c:868) r8:000000e3 r7:86848030 r6:df845ab4 r5:82be11ec r4:86848030 [<80bd4b50>] (__driver_probe_device) from [<80bd4e4c>] (driver_probe_device+0x3c/0xc0 drivers/base/dd.c:898) r9:82b618bc r8:000000e3 r7:86848030 r6:df845ab4 r5:82d25004 r4:82d24ff4 [<80bd4e10>] (driver_probe_device) from [<80bd4f70>] (__device_attach_driver+0xa0/0x138 drivers/base/dd.c:1026) r9:82b618bc r8:8385b340 r7:86848030 r6:df845ab4 r5:82be11ec r4:00000001 [<80bd4ed0>] (__device_attach_driver) from [<80bd2428>] (bus_for_each_drv+0x98/0xec drivers/base/bus.c:500) r7:8385b300 r6:80bd4ed0 r5:df845ab4 r4:00000000 [<80bd2390>] (bus_for_each_drv) from [<80bd538c>] (__device_attach+0xb0/0x1e4 drivers/base/dd.c:1098) r7:8385b300 r6:8684807c r5:00000001 r4:86848030 [<80bd52dc>] (__device_attach) from [<80bd5684>] (device_initial_probe+0x44/0x48 drivers/base/dd.c:1153) r6:8385b300 r5:86848030 r4:8385b300 [<80bd5640>] (device_initial_probe) from [<80bd34f0>] (bus_probe_device+0x30/0x84 drivers/base/bus.c:620) r5:86848030 r4:86848030 [<80bd34c0>] (bus_probe_device) from [<80bd071c>] (device_add+0x610/0x834 drivers/base/core.c:3772) r9:82b618bc r8:81da8f4c r7:892cf088 r6:8684807c r5:00000000 r4:86848030 [<80bd010c>] (device_add) from [<80f4e944>] (usb_set_configuration+0x5d8/0x938 drivers/usb/core/message.c:2268) r10:824257e0 r9:82c35298 r8:892cf088 r7:84e7f454 r6:00000001 r5:84e7f450 r4:86848000 [<80f4e36c>] (usb_set_configuration) from [<80f5bb14>] (usb_generic_driver_probe+0x48/0x84 drivers/usb/core/generic.c:250) r10:845ec328 r9:82b618bc r8:000000e3 r7:892cf000 r6:82b88d80 r5:00000001 r4:892cf000 [<80f5bacc>] (usb_generic_driver_probe) from [<80f4fcec>] (usb_probe_device+0x44/0x14c drivers/usb/core/driver.c:291) r5:00000001 r4:892cf088 [<80f4fca8>] (usb_probe_device) from [<80bd481c>] (call_driver_probe drivers/base/dd.c:628 [inline]) [<80f4fca8>] (usb_probe_device) from [<80bd481c>] (really_probe+0xd8/0x40c drivers/base/dd.c:706) r7:00000000 r6:82b88d80 r5:00000000 r4:892cf088 [<80bd4744>] (really_probe) from [<80bd4bf0>] (__driver_probe_device+0xa0/0x21c drivers/base/dd.c:868) r8:000000e3 r7:892cf088 r6:df845d1c r5:82b88d80 r4:892cf088 [<80bd4b50>] (__driver_probe_device) from [<80bd4e4c>] (driver_probe_device+0x3c/0xc0 drivers/base/dd.c:898) r9:82b618bc r8:000000e3 r7:892cf088 r6:df845d1c r5:82d25004 r4:82d24ff4 [<80bd4e10>] (driver_probe_device) from [<80bd4f70>] (__device_attach_driver+0xa0/0x138 drivers/base/dd.c:1026) r9:82b618bc r8:8385b340 r7:892cf088 r6:df845d1c r5:82b88d80 r4:00000001 [<80bd4ed0>] (__device_attach_driver) from [<80bd2428>] (bus_for_each_drv+0x98/0xec drivers/base/bus.c:500) r7:8385b300 r6:80bd4ed0 r5:df845d1c r4:00000000 [<80bd2390>] (bus_for_each_drv) from [<80bd538c>] (__device_attach+0xb0/0x1e4 drivers/base/dd.c:1098) r7:8385b300 r6:892cf0d4 r5:00000001 r4:892cf088 [<80bd52dc>] (__device_attach) from [<80bd5684>] (device_initial_probe+0x44/0x48 drivers/base/dd.c:1153) r6:8385b300 r5:892cf088 r4:8385b300 [<80bd5640>] (device_initial_probe) from [<80bd34f0>] (bus_probe_device+0x30/0x84 drivers/base/bus.c:620) r5:892cf088 r4:892cf088 [<80bd34c0>] (bus_probe_device) from [<80bd071c>] (device_add+0x610/0x834 drivers/base/core.c:3772) r9:82b618bc r8:00000000 r7:839d9488 r6:892cf0d4 r5:00000000 r4:892cf088 [<80bd010c>] (device_add) from [<80f428dc>] (usb_new_device+0x28c/0x6b8 drivers/usb/core/hub.c:2695) r10:845ec328 r9:00000003 r8:00000000 r7:00000000 r6:00000000 r5:892cf088 r4:892cf000 [<80f42650>] (usb_new_device) from [<80f45190>] (hub_port_connect drivers/usb/core/hub.c:5567 [inline]) [<80f42650>] (usb_new_device) from [<80f45190>] (hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]) [<80f42650>] (usb_new_device) from [<80f45190>] (port_event drivers/usb/core/hub.c:5871 [inline]) [<80f42650>] (usb_new_device) from [<80f45190>] (hub_event+0x11ec/0x1b80 drivers/usb/core/hub.c:5953) r10:845ec328 r9:892cf000 r8:839d9400 r7:00000001 r6:845ece00 r5:00000000 r4:00000003 [<80f43fa4>] (hub_event) from [<802761e8>] (process_one_work+0x1c8/0x580 kernel/workqueue.c:3322) r10:8302fe05 r9:83184980 r8:00800000 r7:dddd0f00 r6:8302fe00 r5:845ec328 r4:83015b80 [<80276020>] (process_one_work) from [<80276e94>] (process_scheduled_works kernel/workqueue.c:3405 [inline]) [<80276020>] (process_one_work) from [<80276e94>] (worker_thread+0x16c/0x318 kernel/workqueue.c:3486) r10:dddd0f00 r9:83015bb0 r8:83184980 r7:82a03d80 r6:dddd0f20 r5:dddd0f00 r4:83015b80 [<80276d28>] (worker_thread) from [<80281710>] (kthread+0x11c/0x154 kernel/kthread.c:436) r10:00000000 r9:df83de88 r8:83015a80 r7:83015b80 r6:80276d28 r5:83184980 r4:830f39c0 [<802815f4>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:137) Exception stack(0xdf845fb0 to 0xdf845ff8) 5fa0: 00000000 00000000 00000000 00000000 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:802815f4 r4:830f39c0 Code: e24cb004 e24dd00c e5902000 e1a06000 (e5921544) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e24cb004 sub fp, ip, #4 4: e24dd00c sub sp, sp, #12 8: e5902000 ldr r2, [r0] c: e1a06000 mov r6, r0 * 10: e5921544 ldr r1, [r2, #1348] @ 0x544 <-- trapping instruction