8<--- cut here ---
Unable to handle kernel NULL pointer dereference at virtual address 00000010 when write
[00000010] *pgd=85f53003, *pmd=df60c003
Internal error: Oops: a05 [#1] SMP ARM
Modules linked in:
CPU: 1 UID: 0 PID: 7355 Comm: syz.0.1135 Not tainted syzkaller #0 PREEMPT 
Hardware name: ARM-Versatile Express
PC is at fsg_common_set_num_buffers+0x60/0xf4 drivers/usb/gadget/function/f_mass_storage.c:2763
LR is at __kmalloc_large_noprof+0x60/0x6c mm/slub.c:5297
pc : [<81105094>]    lr : [<8053e03c>]    psr: a0000013
sp : dfcb1e58  ip : dfcb1e30  fp : dfcb1e84
r10: 81c2dadc  r9 : 85d56f80  r8 : 868c9400
r7 : 00000000  r6 : 00000010  r5 : 00000000  r4 : 00000010
r3 : 00004000  r2 : 00004000  r1 : 86ec0000  r0 : 86ec0000
Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
Control: 30c5387d  Table: 86f58500  DAC: 00000000
Register r0 information: non-slab/vmalloc memory
Register r1 information: non-slab/vmalloc memory
Register r2 information: non-paged memory
Register r3 information: non-paged memory
Register r4 information: zero-size pointer
Register r5 information: NULL pointer
Register r6 information: zero-size pointer
Register r7 information: NULL pointer
Register r8 information: slab kmalloc-512 start 868c9400 pointer offset 0 size 512
Register r9 information: slab kmalloc-64 start 85d56f80 pointer offset 0 size 64
Register r10 information: non-slab/vmalloc memory
Register r11 information: 2-page vmalloc region starting at 0xdfcb0000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2766
Register r12 information: 2-page vmalloc region starting at 0xdfcb0000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2766
Process syz.0.1135 (pid: 7355, stack limit = 0xdfcb0000)
Stack: (0xdfcb1e58 to 0xdfcb2000)
1e40:                                                       84fc0000 865fdb04
1e60: 00000000 865fdbcc 00000012 85d56f84 85d56f80 81c2dadc dfcb1eac dfcb1e88
1e80: 81105194 81105040 00cb1eac 796edee4 00000012 8596ce00 dfcb1f08 8596ce18
1ea0: dfcb1ed4 dfcb1eb0 80680750 81105134 00000012 868eee00 20000300 dfcb1f68
1ec0: 806806a0 84fc0000 dfcb1f64 dfcb1ed8 805a1390 806806ac dfcb1f04 dfcb1ee8
1ee0: 8022bb80 8022cb78 00000000 00000000 00010000 00000012 20000300 00000000
1f00: 00000001 00000000 868eee00 00000000 00000000 00000000 00000000 00000000
1f20: 00000000 00004004 00000000 00000000 dfcb1f54 796edee4 dfcb1f64 868eee03
1f40: 868eee00 00000000 00000000 8020029c 84fc0000 00000004 dfcb1f94 dfcb1f68
1f60: 805a16b4 805a1120 00000000 00000000 00000000 796edee4 00000000 00000000
1f80: 00356310 00000004 dfcb1fa4 dfcb1f98 805a173c 805a164c 00000000 dfcb1fa8
1fa0: 80200060 805a1738 00000000 00000000 00000003 20000300 00000012 00000000
1fc0: 00000000 00000000 00356310 00000004 003562d8 00000000 00000001 76f200dc
1fe0: 76f1fe88 76f1fe78 00018fa0 00130a50 60000010 00000003 00000000 00000000
Call trace: 
[<81105034>] (fsg_common_set_num_buffers) from [<81105194>] (fsg_opts_num_buffers_store+0x6c/0xb0 drivers/usb/gadget/function/f_mass_storage.c:3452)
 r10:81c2dadc r9:85d56f80 r8:85d56f84 r7:00000012 r6:865fdbcc r5:00000000
 r4:865fdb04 r3:84fc0000
[<81105128>] (fsg_opts_num_buffers_store) from [<80680750>] (flush_write_buffer fs/configfs/file.c:207 [inline])
[<81105128>] (fsg_opts_num_buffers_store) from [<80680750>] (configfs_write_iter+0xb0/0x124 fs/configfs/file.c:229)
 r7:8596ce18 r6:dfcb1f08 r5:8596ce00 r4:00000012
[<806806a0>] (configfs_write_iter) from [<805a1390>] (new_sync_write fs/read_write.c:595 [inline])
[<806806a0>] (configfs_write_iter) from [<805a1390>] (vfs_write fs/read_write.c:687 [inline])
[<806806a0>] (configfs_write_iter) from [<805a1390>] (vfs_write+0x27c/0x42c fs/read_write.c:667)
 r9:84fc0000 r8:806806a0 r7:dfcb1f68 r6:20000300 r5:868eee00 r4:00000012
[<805a1114>] (vfs_write) from [<805a16b4>] (ksys_write+0x74/0xec fs/read_write.c:739)
 r10:00000004 r9:84fc0000 r8:8020029c r7:00000000 r6:00000000 r5:868eee00
 r4:868eee03
[<805a1640>] (ksys_write) from [<805a173c>] (__do_sys_write fs/read_write.c:750 [inline])
[<805a1640>] (ksys_write) from [<805a173c>] (sys_write+0x10/0x14 fs/read_write.c:747)
 r7:00000004 r6:00356310 r5:00000000 r4:00000000
[<805a172c>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xdfcb1fa8 to 0xdfcb1ff0)
1fa0:                   00000000 00000000 00000003 20000300 00000012 00000000
1fc0: 00000000 00000000 00356310 00000004 003562d8 00000000 00000001 76f200dc
1fe0: 76f1fe88 76f1fe78 00018fa0 00130a50
Code: e3a01d33 e3a00901 ebd0e3d2 e3500000 (e5840000) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	e3a01d33 	mov	r1, #3264	@ 0xcc0
   4:	e3a00901 	mov	r0, #16384	@ 0x4000
   8:	ebd0e3d2 	bl	0xff438f58
   c:	e3500000 	cmp	r0, #0
* 10:	e5840000 	str	r0, [r4] <-- trapping instruction