==================================================================
BUG: KASAN: invalid-access in find_endpoint drivers/usb/gadget/udc/dummy_hcd.c:1616 [inline]
BUG: KASAN: invalid-access in find_endpoint+0x64/0x88 drivers/usb/gadget/udc/dummy_hcd.c:1602
Read at addr f1f000000b1410e8 by task swapper/0/0
Pointer tag: [f1], memory tag: [f0]

CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G        W           syzkaller #0 PREEMPT 
Tainted: [W]=WARN
Hardware name: linux,dummy-virt (DT)
Call trace:
 dump_backtrace arch/arm64/kernel/stacktrace.c:498 [inline] (C)
 show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x60/0x80 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x1c4/0x4b0 mm/kasan/report.c:482
 kasan_report+0x84/0xac mm/kasan/report.c:595
 report_tag_fault arch/arm64/mm/fault.c:368 [inline]
 do_tag_recovery arch/arm64/mm/fault.c:380 [inline]
 __do_kernel_fault+0x1b4/0x220 arch/arm64/mm/fault.c:424
 do_bad_area+0x68/0x80 arch/arm64/mm/fault.c:529
 do_tag_check_fault+0x34/0x44 arch/arm64/mm/fault.c:909
 do_mem_abort+0x40/0x90 arch/arm64/mm/fault.c:985
 el1_abort+0x44/0x64 arch/arm64/kernel/entry-common.c:342
 el1h_64_sync_handler+0x50/0xac arch/arm64/kernel/entry-common.c:469
 el1h_64_sync+0x6c/0x70 arch/arm64/kernel/entry.S:585
 find_endpoint drivers/usb/gadget/udc/dummy_hcd.c:1616 [inline] (P)
 find_endpoint+0x64/0x88 drivers/usb/gadget/udc/dummy_hcd.c:1602 (P)
 __run_hrtimer kernel/time/hrtimer.c:2067 [inline]
 __hrtimer_run_queues+0x100/0x170 kernel/time/hrtimer.c:2124
 hrtimer_run_softirq+0x6c/0xac kernel/time/hrtimer.c:2141
 handle_softirqs+0x100/0x248 kernel/softirq.c:645
 __do_softirq+0x14/0x20 kernel/softirq.c:679
 ____do_softirq+0x10/0x20 arch/arm64/kernel/irq.c:78
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:885
 do_softirq_own_stack+0x1c/0x40 arch/arm64/kernel/irq.c:83
 invoke_softirq kernel/softirq.c:526 [inline]
 __irq_exit_rcu+0xe8/0x120 kernel/softirq.c:767
 irq_exit_rcu+0x10/0x20 kernel/softirq.c:784
 __el1_irq arch/arm64/kernel/entry-common.c:531 [inline]
 el1_interrupt+0x40/0x60 arch/arm64/kernel/entry-common.c:543
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:548
 el1h_64_irq+0x6c/0x70 arch/arm64/kernel/entry.S:586
 __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:26 [inline] (P)
 arch_local_irq_enable arch/arm64/include/asm/irqflags.h:48 [inline] (P)
 raw_spin_rq_unlock_irq kernel/sched/sched.h:1698 [inline] (P)
 finish_lock_switch kernel/sched/core.c:5251 [inline] (P)
 finish_task_switch.isra.0+0x90/0x2fc kernel/sched/core.c:5369 (P)
 context_switch kernel/sched/core.c:5523 [inline]
 __schedule+0x404/0xdc8 kernel/sched/core.c:7270
 schedule_idle+0x28/0x48 kernel/sched/core.c:7388
 do_idle+0x1a0/0x300 kernel/sched/idle.c:384
 cpu_startup_entry+0x34/0x3c kernel/sched/idle.c:454
 kernel_init+0x0/0x130 init/main.c:723
 console_on_rootfs+0x0/0x6c init/main.c:1181
 __primary_switched+0x88/0x90 arch/arm64/kernel/head.S:246

The buggy address belongs to the object at fff000000b141000
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 232 bytes inside of
 512-byte region [fff000000b141000, fff000000b141200)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xf6f000000b141400 pfn:0x4b140
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x1ffc00000000240(workingset|head|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0)
page_type: f5(slab)
raw: 01ffc00000000240 f9f0000003401900 ffffc1ffc02d6b10 ffffc1ffc0268890
raw: f6f000000b141400 000000080010000a 00000000f5000000 0000000000000000
head: 01ffc00000000240 f9f0000003401900 ffffc1ffc02d6b10 ffffc1ffc0268890
head: f6f000000b141400 000000080010000a 00000000f5000000 0000000000000000
head: 01ffc00000000001 ffffc1ffc02c5001 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 fff000000b140e00: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2
 fff000000b140f00: f2 f2 f2 f2 f2 f2 f2 f2 fe fe fe fe fe fe fe fe
>fff000000b141000: f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0
                                                             ^
 fff000000b141100: f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0
 fff000000b141200: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
==================================================================