Mass Storage Function, version: 2009/09/11
LUN: removable file: (no medium)
Unable to handle kernel paging request at virtual address dfffffff00000002
Current syz.1.12 pgtable: 4K pagesize, 48-bit VAs, pgdp=0x000000009f470000
[dfffffff00000002] pgd=000000003fffe801, p4d=000000003fffe801, pud=0000000000000000
Oops [#1]
Modules linked in:
CPU: 1 UID: 0 PID: 3958 Comm: syz.1.12 Not tainted syzkaller #0 PREEMPT 
Hardware name: riscv-virtio,qemu (DT)
epc : fsg_common_set_num_buffers+0x76/0x2fa drivers/usb/gadget/function/f_mass_storage.c:2763
 ra : _kmalloc_noprof include/linux/slab.h:985 [inline]
 ra : fsg_common_set_num_buffers+0x70/0x2fa drivers/usb/gadget/function/f_mass_storage.c:2763
epc : ffffffff83f932cc ra : ffffffff83f932c6 sp : ffff8f800a9479f0
 gp : ffffffff8a4a7c60 tp : ffffaf8030e2b580 t0 : fffff5ef03454800
 t1 : 0000000000000001 t2 : ffffffff80c6604e s0 : ffff8f800a947a70
 s1 : 0000000000000000 a0 : ffffaf801a2a0000 a1 : ffffffff86e06ce0
 a2 : 0000000000004000 a3 : 0000000000004000 a4 : 1ffff5f0061c56b0
 a5 : dfffffff00000002 a6 : 0000000000000003 a7 : ffffffff8a5bba40
 s2 : 0000000000000010 s3 : 1ffff1f001528f50 s4 : 0000000000000000
 s5 : 0000000000000010 s6 : ffffaf8014332000 s7 : dfffffff00000000
 s8 : 0000000000000000 s9 : ffffaf801fc58e40 s10: 1ffff5f003f8b1cc
 s11: 0000000000004004 t3 : ffffffff8809bec8 t4 : 0000000000001fff
 t5 : 00000000000000c8 t6 : 0000000000000002 ssp : 0000000000000000
status: 0000000200000120 badaddr: dfffffff00000002 cause: 000000000000000d
[<ffffffff83f932cc>] fsg_common_set_num_buffers+0x76/0x2fa drivers/usb/gadget/function/f_mass_storage.c:2763
[<ffffffff83f936c0>] fsg_opts_num_buffers_store+0x170/0x1ac drivers/usb/gadget/function/f_mass_storage.c:3452
[<ffffffff80fb6806>] flush_write_buffer fs/configfs/file.c:207 [inline]
[<ffffffff80fb6806>] configfs_write_iter+0x284/0x406 fs/configfs/file.c:229
[<ffffffff80ce8248>] new_sync_write fs/read_write.c:595 [inline]
[<ffffffff80ce8248>] vfs_write+0x81a/0x1020 fs/read_write.c:687
[<ffffffff80ce8e58>] ksys_write+0x126/0x244 fs/read_write.c:739
[<ffffffff80ce8fe4>] __do_sys_write fs/read_write.c:750 [inline]
[<ffffffff80ce8fe4>] __se_sys_write fs/read_write.c:747 [inline]
[<ffffffff80ce8fe4>] __riscv_sys_write+0x6e/0xa0 fs/read_write.c:747
[<ffffffff80078f30>] syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112
[<ffffffff8651fb84>] do_trap_ecall_u+0x3e4/0x636 arch/riscv/kernel/traps.c:345
[<ffffffff8654beb0>] handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237
Code: 8593 cc05 6511 c097 fcb8 80e7 3080 5793 0039 97de (c783) 0007 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	cc058593          	addi	a1,a1,-832
   4:	6511                	lui	a0,0x4
   6:	fcb8c097          	auipc	ra,0xfcb8c
   a:	308080e7          	jalr	776(ra) # 0xfcb8c30e
   e:	00395793          	srli	a5,s2,0x3
  12:	97de                	add	a5,a5,s7
* 14:	0007c783          	lbu	a5,0(a5) <-- trapping instruction