general protection fault, probably for non-canonical address 0xdffffc00000000e6: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000730-0x0000000000000737]
CPU: 0 PID: 6743 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:f_midi2_free_ep_reqs drivers/usb/gadget/function/f_midi2.c:1166 [inline]
RIP: 0010:f_midi2_stop_eps+0x286/0x4c0 drivers/usb/gadget/function/f_midi2.c:1247
Code: 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 ef d4 0a fb 41 bf 30 07 00 00 4d 03 3e 4c 89 f8 48 c1 e8 03 48 89 44 24 18 <42> 0f b6 04 28 84 c0 0f 85 05 02 00 00 41 8b 1f 31 ff 89 de e8 01
RSP: 0000:ffffc90000007820 EFLAGS: 00010002
RAX: 00000000000000e6 RBX: ffff88802f348120 RCX: ffff88802fd15a00
RDX: 0000000000000100 RSI: ffffffff8b1d0c80 RDI: ffffffff8b1d0c40
RBP: ffff88802f348100 R08: 0000000000000000 R09: 0000000043795f98
R10: 000000006292258b R11: fffffbfff1d18f5e R12: ffff88802f348730
R13: dffffc0000000000 R14: ffff88802f348128 R15: 0000000000000730
FS:  0000555557dda500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5a51735ff8 CR3: 0000000076680000 CR4: 00000000003506f0
Call Trace:
 <IRQ>
 f_midi2_set_alt+0x100/0x800 drivers/usb/gadget/function/f_midi2.c:1299
 composite_setup+0x1ffe/0x33a0 drivers/usb/gadget/composite.c:1957
 configfs_composite_setup+0xc7/0x100 drivers/usb/gadget/configfs.c:1875
 dummy_timer+0x1324/0x34e0 drivers/usb/gadget/udc/dummy_hcd.c:1949
 __run_hrtimer kernel/time/hrtimer.c:1754 [inline]
 __hrtimer_run_queues+0x525/0xc10 kernel/time/hrtimer.c:1818
 hrtimer_run_softirq+0x177/0x290 kernel/time/hrtimer.c:1835
 handle_softirqs+0x27d/0x820 kernel/softirq.c:578
 __do_softirq kernel/softirq.c:612 [inline]
 invoke_softirq kernel/softirq.c:452 [inline]
 __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:stack_trace_consume_entry+0xe1/0x270 kernel/stacktrace.c:93
Code: b5 e4 69 00 49 89 d9 4c 8b 04 24 4c 89 e2 4c 89 ff 48 8b 74 24 08 48 8b 1f 45 8d 79 01 0f b6 44 15 00 84 c0 0f 85 35 01 00 00 <45> 89 38 4e 8d 3c cb 4c 89 f8 48 c1 e8 03 80 3c 10 00 74 1a 4c 89
RSP: 0000:ffffc90004b076b8 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffffc90004b07840 RCX: ffff88802fd15a00
RDX: dffffc0000000000 RSI: ffffffff81dfcf2c RDI: ffffc90004b077c0
RBP: 1ffff92000960efa R08: ffffc90004b077d0 R09: 0000000000000001
R10: 0000000000000004 R11: 0000000000000000 R12: 0000000000000000
R13: 1ffff92000960ef9 R14: ffffc90004b077c8 R15: 0000000000000002
 arch_stack_walk+0x138/0x190 arch/x86/kernel/stacktrace.c:27
 stack_trace_save+0xaa/0x100 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4e/0x70 mm/kasan/common.c:53
 __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:329
 kasan_slab_alloc include/linux/kasan.h:188 [inline]
 slab_post_alloc_hook+0x6a/0x4d0 mm/slab.h:770
 slab_alloc_node mm/slub.c:3495 [inline]
 slab_alloc mm/slub.c:3503 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3510 [inline]
 kmem_cache_alloc+0x17e/0x2c0 mm/slub.c:3519
 ptlock_alloc+0x20/0x70 mm/memory.c:6177
 ptlock_init include/linux/mm.h:2964 [inline]
 pagetable_pte_ctor include/linux/mm.h:2987 [inline]
 __pte_alloc_one include/asm-generic/pgalloc.h:71 [inline]
 pte_alloc_one+0xcc/0x540 arch/x86/mm/pgtable.c:33
 __pte_alloc+0x22/0x2a0 mm/memory.c:438
 do_anonymous_page mm/memory.c:4120 [inline]
 do_pte_missing mm/memory.c:3687 [inline]
 handle_pte_fault mm/memory.c:5047 [inline]
 __handle_mm_fault mm/memory.c:5188 [inline]
 handle_mm_fault+0x3dc6/0x4a50 mm/memory.c:5353
 do_user_addr_fault+0x736/0x12d0 arch/x86/mm/fault.c:1371
 handle_page_fault arch/x86/mm/fault.c:1463 [inline]
 exc_page_fault+0x64/0x100 arch/x86/mm/fault.c:1516
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0033:0x7f5a5079ee16
Code: 0f 1f 40 00 b8 ea ff ff ff 48 85 ff 74 28 48 85 d2 74 23 49 89 c8 b8 b3 01 00 00 0f 05 48 85 c0 7c 14 74 01 c3 31 ed 4c 89 c7 <ff> d2 48 89 c7 b8 3c 00 00 00 0f 05 48 c7 c1 e8 ff ff ff f7 d8 64
RSP: 002b:00007f5a51736000 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000009000 RCX: 00007f5a5079ee09
RDX: 00007f5a5079b7b0 RSI: 0000000000000058 RDI: 00007ffec0029760
RBP: 0000000000000000 R08: 00007ffec0029760 R09: 0000000000000000
R10: 0000000000000008 R11: 0000000000000202 R12: 00007ffec0029760
R13: 0000000000000000 R14: 00007ffec0029700 R15: 00007ffec0029bd0
 </TASK>
Modules linked in:
Dumping ftrace buffer:
---------------------------------
   <...>-6497      0d..3. 199910080us : myevent: (sched.sched_switch)
---------------------------------
---[ end trace 0000000000000000 ]---
RIP: 0010:f_midi2_free_ep_reqs drivers/usb/gadget/function/f_midi2.c:1166 [inline]
RIP: 0010:f_midi2_stop_eps+0x286/0x4c0 drivers/usb/gadget/function/f_midi2.c:1247
Code: 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 ef d4 0a fb 41 bf 30 07 00 00 4d 03 3e 4c 89 f8 48 c1 e8 03 48 89 44 24 18 <42> 0f b6 04 28 84 c0 0f 85 05 02 00 00 41 8b 1f 31 ff 89 de e8 01
RSP: 0000:ffffc90000007820 EFLAGS: 00010002
RAX: 00000000000000e6 RBX: ffff88802f348120 RCX: ffff88802fd15a00
RDX: 0000000000000100 RSI: ffffffff8b1d0c80 RDI: ffffffff8b1d0c40
RBP: ffff88802f348100 R08: 0000000000000000 R09: 0000000043795f98
R10: 000000006292258b R11: fffffbfff1d18f5e R12: ffff88802f348730
R13: dffffc0000000000 R14: ffff88802f348128 R15: 0000000000000730
FS:  0000555557dda500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5a51735ff8 CR3: 0000000076680000 CR4: 00000000003506f0
----------------
Code disassembly (best guess):
   0:	89 f0                	mov    %esi,%eax
   2:	48 c1 e8 03          	shr    $0x3,%rax
   6:	42 80 3c 28 00       	cmpb   $0x0,(%rax,%r13,1)
   b:	74 08                	je     0x15
   d:	4c 89 f7             	mov    %r14,%rdi
  10:	e8 ef d4 0a fb       	call   0xfb0ad504
  15:	41 bf 30 07 00 00    	mov    $0x730,%r15d
  1b:	4d 03 3e             	add    (%r14),%r15
  1e:	4c 89 f8             	mov    %r15,%rax
  21:	48 c1 e8 03          	shr    $0x3,%rax
  25:	48 89 44 24 18       	mov    %rax,0x18(%rsp)
* 2a:	42 0f b6 04 28       	movzbl (%rax,%r13,1),%eax <-- trapping instruction
  2f:	84 c0                	test   %al,%al
  31:	0f 85 05 02 00 00    	jne    0x23c
  37:	41 8b 1f             	mov    (%r15),%ebx
  3a:	31 ff                	xor    %edi,%edi
  3c:	89 de                	mov    %ebx,%esi
  3e:	e8                   	.byte 0xe8
  3f:	01                   	.byte 0x1