Oops: general protection fault, probably for non-canonical address 0xdffffc00000000e6: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000730-0x0000000000000737]
CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: usb_hub_wq hub_event
RIP: 0010:f_midi2_free_ep_reqs drivers/usb/gadget/function/f_midi2.c:1166 [inline]
RIP: 0010:f_midi2_stop_eps+0x5f/0x4d0 drivers/usb/gadget/function/f_midi2.c:1245
Code: e8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 ef e8 e7 5d 64 fa 41 bc 30 07 00 00 4c 03 65 00 4c 89 e0 48 c1 e8 03 48 89 44 24 10 <42> 0f b6 04 28 84 c0 0f 85 23 04 00 00 41 8b 1c 24 31 ff 89 de e8
RSP: 0018:ffffc90000007930 EFLAGS: 00010002
RAX: 00000000000000e6 RBX: 0000000000000001 RCX: ffff88801bf0a540
RDX: 0000000000000100 RSI: 0000000000000008 RDI: ffff88801fd08148
RBP: ffff88801fd080f0 R08: ffff88801fd0814f R09: 1ffff11003fa1029
R10: dffffc0000000000 R11: ffffed1003fa102a R12: 0000000000000730
R13: dffffc0000000000 R14: ffff88801fd08128 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f52915e80f5 CR3: 0000000012486000 CR4: 0000000000352ef0
Call Trace:
 <IRQ>
 f_midi2_set_alt+0x11c/0xf00 drivers/usb/gadget/function/f_midi2.c:1296
 composite_setup+0x1ffd/0x3480 drivers/usb/gadget/composite.c:1933
 configfs_composite_setup+0xc7/0x100 drivers/usb/gadget/configfs.c:1877
 dummy_timer+0x2f43/0x4cf0 drivers/usb/gadget/udc/dummy_hcd.c:1951
 __run_hrtimer kernel/time/hrtimer.c:2032 [inline]
 __hrtimer_run_queues+0x3bc/0xa10 kernel/time/hrtimer.c:2096
 hrtimer_run_softirq+0x17a/0x240 kernel/time/hrtimer.c:2113
 handle_softirqs+0x225/0x840 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xca/0x220 kernel/softirq.c:735
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysv[   92.889402][ T4652] Bluetooth: hci0: command tx timeout
----------------
Code disassembly (best guess):
   0:	e8 48 c1 e8 03       	call   0x3e8c14d
   5:	42 80 3c 28 00       	cmpb   $0x0,(%rax,%r13,1)
   a:	74 08                	je     0x14
   c:	48 89 ef             	mov    %rbp,%rdi
   f:	e8 e7 5d 64 fa       	call   0xfa645dfb
  14:	41 bc 30 07 00 00    	mov    $0x730,%r12d
  1a:	4c 03 65 00          	add    0x0(%rbp),%r12
  1e:	4c 89 e0             	mov    %r12,%rax
  21:	48 c1 e8 03          	shr    $0x3,%rax
  25:	48 89 44 24 10       	mov    %rax,0x10(%rsp)
* 2a:	42 0f b6 04 28       	movzbl (%rax,%r13,1),%eax <-- trapping instruction
  2f:	84 c0                	test   %al,%al
  31:	0f 85 23 04 00 00    	jne    0x45a
  37:	41 8b 1c 24          	mov    (%r12),%ebx
  3b:	31 ff                	xor    %edi,%edi
  3d:	89 de                	mov    %ebx,%esi
  3f:	e8                   	.byte 0xe8