LUN: removable file: (no medium)
Unable to handle kernel paging request at virtual address dfff800000000002
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
Mem abort info:
  ESR = 0x0000000096000005
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x05: level 1 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0
[dfff800000000002] address between user and kernel address ranges
Internal error: Oops: 0000000096000005 [#1]  SMP
Modules linked in:
CPU: 1 UID: 0 PID: 5647 Comm: syz.2.806 Tainted: G        W           syzkaller #0 PREEMPT 
Tainted: [W]=WARN
Hardware name: linux,dummy-virt (DT)
pstate: 10000005 (nzcV daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : fsg_common_set_num_buffers+0x74/0x268 drivers/usb/gadget/function/f_mass_storage.c:2762
lr : _kmalloc_noprof include/linux/slab.h:988 [inline]
lr : fsg_common_set_num_buffers+0x6c/0x268 drivers/usb/gadget/function/f_mass_storage.c:2762
sp : ffff80008ef279f0
x29: ffff80008ef279f0 x28: 1fffe000034f58ec x27: ffff000014bcc008
x26: dfff800000000000 x25: ffff000022463800 x24: 0000000000000000
x23: 0000000000000010 x22: 00000000ffffffff x21: 0000002fffffffe0
x20: ffff000028d20000 x19: 0000000000000010 x18: 0000000000000000
x17: ffff800080c28bc0 x16: ffff800080c28164 x15: 1ffff00011de4ec0
x14: 0000000000000801 x13: ffff800089ed40a8 x12: ffff60000d7f2971
x11: 1fffe0000d7f2970 x10: ffff60000d7f2970 x9 : dfff800000000000
x8 : ffff6000051a4800 x7 : fefefefefefefefe x6 : ffff60000d7f2970
x5 : 00000000ffffffff x4 : 0000000000000cc0 x3 : 1fffe0000d7f0f5d
x2 : 0000000000000002 x1 : 0000000100000000 x0 : ffff000028d20000
Call trace:
 fsg_common_set_num_buffers+0x74/0x268 drivers/usb/gadget/function/f_mass_storage.c:2762 (P)
 fsg_opts_num_buffers_store+0x154/0x178 drivers/usb/gadget/function/f_mass_storage.c:3451
 flush_write_buffer fs/configfs/file.c:207 [inline]
 configfs_write_iter+0x244/0x398 fs/configfs/file.c:229
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x4c0/0xbac fs/read_write.c:687
 ksys_write+0xf0/0x1e0 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __arm64_sys_write+0x70/0xa0 fs/read_write.c:747
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x74/0x240 arch/arm64/kernel/syscall.c:49
 el0_svc_common.constprop.0+0xac/0x230 arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x40/0x58 arch/arm64/kernel/syscall.c:140
 el0_svc+0x58/0x2a4 arch/arm64/kernel/entry-common.c:758
 el0t_64_sync_handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:777
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590
Code: d2880000 9745b658 aa0003f4 d343fe62 (38fa6840) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	d2880000 	mov	x0, #0x4000                	// #16384
   4:	9745b658 	bl	0xfffffffffd16d964
   8:	aa0003f4 	mov	x20, x0
   c:	d343fe62 	lsr	x2, x19, #3
* 10:	38fa6840 	ldrsb	w0, [x2, x26] <-- trapping instruction