Unable to handle kernel paging request at virtual address dfff80000000000c
KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]
Mem abort info:
  ESR = 0x0000000096000005
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x05: level 1 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0
[dfff80000000000c] address between user and kernel address ranges
Internal error: Oops: 0000000096000005 [#1]  SMP
Modules linked in:
CPU: 1 UID: 0 PID: 24 Comm: kworker/1:0 Tainted: G             L      syzkaller #0 PREEMPT 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
Workqueue: mld mld_ifc_work
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : dummy_queue+0x16c/0x6e4 drivers/usb/gadget/udc/dummy_hcd.c:718
lr : gadget_to_dummy_hcd drivers/usb/gadget/udc/dummy_hcd.c:317 [inline]
lr : dummy_queue+0x138/0x6e4 drivers/usb/gadget/udc/dummy_hcd.c:717
sp : ffff80008ed27110
x29: ffff80008ed27140 x28: 1fffe00019183848 x27: ffff0000c8c1cc00
x26: ffff0000ead10200 x25: dfff800000000000 x24: ffff0000c8c1c240
x23: dfff800000000000 x22: 1fffe0001d5a2040 x21: 0000000000000060
x20: ffff0000c8c1c248 x19: ffff0000ead10210 x18: 1fffe00035bc9e28
x17: 0000000000020010 x16: 0040dd8600000000 x15: 00000000000000d4
x14: 00000000ffff8000 x13: 0000000000000001 x12: 0000000000000000
x11: ffff80008a590e28 x10: 0000000000000203 x9 : 00000000000006a8
x8 : 000000000000000c x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000001 x4 : 0000000000000008 x3 : ffff8000835b74fc
x2 : 0000000000000003 x1 : ffff0000c1b2d7c0 x0 : 0000000000000000
Call trace:
 dummy_queue+0x16c/0x6e4 drivers/usb/gadget/udc/dummy_hcd.c:718 (P)
 usb_ep_queue+0xe4/0x578 drivers/usb/gadget/udc/core.c:305
 eth_start_xmit+0x78c/0xe14 drivers/usb/gadget/function/u_ether.c:579
 __netdev_start_xmit include/linux/netdevice.h:5400 [inline]
 netdev_start_xmit include/linux/netdevice.h:5409 [inline]
 xmit_one net/core/dev.c:3889 [inline]
 dev_hard_start_xmit+0x1dc/0x9d4 net/core/dev.c:3905
 sch_direct_xmit+0x1ac/0x3b0 net/sched/sch_generic.c:372
 __dev_xmit_skb net/core/dev.c:4214 [inline]
 __dev_queue_xmit+0x1130/0x2bc0 net/core/dev.c:4836
 dev_queue_xmit include/linux/netdevice.h:3446 [inline]
 neigh_hh_output include/net/neighbour.h:544 [inline]
 neigh_output include/net/neighbour.h:558 [inline]
 ip6_finish_output2+0xccc/0x1ab4 net/ipv6/ip6_output.c:136
 __ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
 ip6_finish_output+0x230/0x618 net/ipv6/ip6_output.c:219
 NF_HOOK_COND include/linux/netfilter.h:307 [inline]
 ip6_output+0x2d0/0x644 net/ipv6/ip6_output.c:246
 dst_output include/net/dst.h:470 [inline]
 NF_HOOK+0x14c/0x464 include/linux/netfilter.h:318
 mld_sendpack+0x80c/0xffc net/ipv6/mcast.c:1869
 mld_send_cr net/ipv6/mcast.c:2170 [inline]
 mld_ifc_work+0x76c/0x9e4 net/ipv6/mcast.c:2710
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0x788/0x10b8 kernel/workqueue.c:3405
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3486
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:842
Code: 97579421 f94002a8 91018115 d343fea8 (38f96908) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	97579421 	bl	0xfffffffffd5e5084
   4:	f94002a8 	ldr	x8, [x21]
   8:	91018115 	add	x21, x8, #0x60
   c:	d343fea8 	lsr	x8, x21, #3
* 10:	38f96908 	ldrsb	w8, [x8, x25] <-- trapping instruction