Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 2 UID: 0 PID: 7207 Comm: syz.2.378 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:fsg_common_set_num_buffers+0xad/0x340 drivers/usb/gadget/function/f_mass_storage.c:2763
Code: 42 80 3c 30 00 0f 85 52 02 00 00 48 89 6d e0 e8 69 19 2e fa be c0 0c 00 00 bf 00 40 00 00 e8 da 43 91 fa 48 89 ea 48 c1 ea 03 <42> 80 3c 32 00 0f 85 04 02 00 00 48 89 45 00 48 85 c0 75 95 e8 3a
RSP: 0018:ffffc900070bfba8 EFLAGS: 00010202
RAX: ffff8880746b8000 RBX: 0000000000000000 RCX: 0000000000004000
RDX: 0000000000000002 RSI: ffffffff8c3fe500 RDI: ffffffff8e466930
RBP: 0000000000000010 R08: 0000000000000cc0 R09: 00000000ffffffff
R10: ffffed100e8d7800 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000010 R14: dffffc0000000000 R15: ffff88802433a000
FS:  0000000000000000(0000) GS:ffff888096df3000(0063) knlGS:00000000f541cb40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f541bff4 CR3: 0000000073d56000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 fsg_opts_num_buffers_store+0x168/0x1b0 drivers/usb/gadget/function/f_mass_storage.c:3452
 flush_write_buffer fs/configfs/file.c:207 [inline]
 configfs_write_iter+0x302/0x4e0 fs/configfs/file.c:229
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x6ac/0x1050 fs/read_write.c:687
 ksys_write+0x12a/0x250 fs/read_write.c:739
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
 __do_fast_syscall_32+0xe7/0x970 arch/x86/entry/syscall_32.c:307
 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:332
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf704efec
Code: Unable to access opcode bytes at 0xf704efc2.
RSP: 002b:00000000f541c50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080003700
RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:fsg_common_set_num_buffers+0xad/0x340 drivers/usb/gadget/function/f_mass_storage.c:2763
Code: 42 80 3c 30 00 0f 85 52 02 00 00 48 89 6d e0 e8 69 19 2e fa be c0 0c 00 00 bf 00 40 00 00 e8 da 43 91 fa 48 89 ea 48 c1 ea 03 <42> 80 3c 32 00 0f 85 04 02 00 00 48 89 45 00 48 85 c0 75 95 e8 3a
RSP: 0018:ffffc900070bfba8 EFLAGS: 00010202
RAX: ffff8880746b8000 RBX: 0000000000000000 RCX: 0000000000004000
RDX: 0000000000000002 RSI: ffffffff8c3fe500 RDI: ffffffff8e466930
RBP: 0000000000000010 R08: 0000000000000cc0 R09: 00000000ffffffff
R10: ffffed100e8d7800 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000010 R14: dffffc0000000000 R15: ffff88802433a000
FS:  0000000000000000(0000) GS:ffff888096bf3000(0063) knlGS:00000000f541cb40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000033403ff8 CR3: 0000000073d56000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
   0:	42 80 3c 30 00       	cmpb   $0x0,(%rax,%r14,1)
   5:	0f 85 52 02 00 00    	jne    0x25d
   b:	48 89 6d e0          	mov    %rbp,-0x20(%rbp)
   f:	e8 69 19 2e fa       	call   0xfa2e197d
  14:	be c0 0c 00 00       	mov    $0xcc0,%esi
  19:	bf 00 40 00 00       	mov    $0x4000,%edi
  1e:	e8 da 43 91 fa       	call   0xfa9143fd
  23:	48 89 ea             	mov    %rbp,%rdx
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	42 80 3c 32 00       	cmpb   $0x0,(%rdx,%r14,1) <-- trapping instruction
  2f:	0f 85 04 02 00 00    	jne    0x239
  35:	48 89 45 00          	mov    %rax,0x0(%rbp)
  39:	48 85 c0             	test   %rax,%rax
  3c:	75 95                	jne    0xffffffd3
  3e:	e8                   	.byte 0xe8
  3f:	3a                   	.byte 0x3a