program: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xa, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x69, 0x10, 0xb0}, [@ldst={0x5, 0x3, 0x3, 0x5}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x3}, 0x48) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.effective_mems\x00', 0x275a, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)) pipe2(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/direction\x00', 0x1, 0x0) write(r2, &(0x7f00000002c0)='1', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/midi2.usb0/ep.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/functions/midi2.usb0/ep.2\x00', 0x1ff) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/configs/c.1/midi2.usb0\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r3, &(0x7f0000000680)='dummy_udc.0', 0xb) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000000)=ANY=[@ANYBLOB='&'], 0x26) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x2, &(0x7f0000002880)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) splice(r0, 0x0, r4, 0x0, 0x26, 0x0) [ 94.563308][ T4637] Bluetooth: hci0: command tx timeout [ 94.713672][ T5312] sound umpC3D1: No UMP Group is found in FB [ 94.716888][ T5312] sound umpC3D2: No UMP Group is found in FB [ 95.200968][ T5295] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 95.351291][ T5295] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.02 [ 95.357726][ T5295] usb 5-1: Dual-Role OTG device on HNP port [ 95.361223][ T5295] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.388974][ T5295] gspca_main: spca501-2.14.0 probing 0000:0000 [ 95.398580][ T5295] gspca_spca501: reg write: error -32 [ 95.401703][ T5295] spca501 5-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 95.412111][ T5295] spca501 5-1:1.0: probe with driver spca501 failed with error -22 [ 95.431036][ C0] Oops: general protection fault, probably for non-canonical address 0xdffffc00000000e6: 0000 [#1] SMP KASAN NOPTI [ 95.436039][ C0] KASAN: null-ptr-deref in range [0x0000000000000730-0x0000000000000737] [ 95.439330][ C0] CPU: 0 UID: 0 PID: 5295 Comm: kworker/0:5 Not tainted syzkaller #0 PREEMPT(full) [ 95.442903][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.446721][ C0] Workqueue: usb_hub_wq hub_event [ 95.448692][ C0] RIP: 0010:f_midi2_stop_eps+0x28e/0x4d0 [ 95.450881][ C0] Code: 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 47 49 61 fa 41 bf 30 07 00 00 4d 03 3e 4c 89 f8 48 c1 e8 03 48 89 44 24 18 <42> 0f b6 04 28 84 c0 0f 85 12 02 00 00 41 8b 1f 31 ff 89 de e8 b9 [ 95.458458][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002 [ 95.460819][ C0] RAX: 00000000000000e6 RBX: ffff888012a88120 RCX: ffff888012550000 [ 95.464048][ C0] RDX: 8000000000000100 RSI: 0000000000000100 RDI: ffffffff8c6d1520 [ 95.467492][ C0] RBP: ffff888012a88100 R08: 000000001e6d8e3a R09: 00000000c0995c85 [ 95.470796][ C0] R10: 0000000000000010 R11: ffffffff8ed5a360 R12: ffff888012a88730 [ 95.474216][ C0] R13: dffffc0000000000 R14: ffff888012a88128 R15: 0000000000000730 [ 95.477805][ C0] FS: 0000000000000000(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000 [ 95.481584][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.484370][ C0] CR2: 00007f950d8cb0f5 CR3: 000000005181d000 CR4: 0000000000352ef0 [ 95.487485][ C0] Call Trace: [ 95.488849][ C0] [ 95.490074][ C0] f_midi2_set_alt+0x11c/0xf00 [ 95.492138][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 95.494324][ C0] composite_setup+0x1ffd/0x3480 [ 95.496466][ C0] configfs_composite_setup+0xc7/0x100 [ 95.498715][ C0] dummy_timer+0x2f43/0x4cf0 [ 95.500673][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 95.502978][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 95.504992][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 95.507240][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 95.509108][ C0] __hrtimer_run_queues+0x3bc/0xa10 [ 95.511091][ C0] hrtimer_run_softirq+0x1e3/0x2e0 [ 95.513087][ C0] handle_softirqs+0x226/0x860 [ 95.514976][ C0] ? __irq_exit_rcu+0xcb/0x220 [ 95.516771][ C0] __irq_exit_rcu+0xcb/0x220 [ 95.518720][ C0] irq_exit_rcu+0x9/0x30 [ 95.520555][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 95.522707][ C0] [ 95.523894][ C0] [ 95.525153][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 95.527467][ C0] RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 [ 95.529824][ C0] Code: 90 f3 0f 1e fa 53 48 89 fb 48 83 c7 18 48 8b 74 24 08 e8 ca 40 c2 f5 48 89 df e8 22 b6 c2 f5 e8 2d e7 ee f5 fb bf 01 00 00 00 42 d6 b3 f5 65 48 8b 05 ba cd b0 07 48 85 c0 74 07 5b e9 bf 49 [ 95.537450][ C0] RSP: 0018:ffffc9000e77e790 EFLAGS: 00000202 [ 95.540003][ C0] RAX: 0000000000003785 RBX: ffffc9000e77e948 RCX: 8000000000000001 [ 95.543310][ C0] RDX: 0000000000000006 RSI: ffffffff8e460b06 RDI: 0000000000000001 [ 95.546817][ C0] RBP: ffffc9000e77e8d0 R08: ffffffff9078fa37 R09: 1ffffffff20f1f46 [ 95.550242][ C0] R10: dffffc0000000000 R11: fffffbfff20f1f47 R12: dffffc0000000000 [ 95.553616][ C0] R13: ffff888012551880 R14: ffffc9000e77e848 R15: ffffc9000e77e940 [ 95.556970][ C0] wait_for_completion_timeout+0x2c5/0x610 [ 95.559537][ C0] ? wait_for_completion_timeout+0x265/0x610 [ 95.561992][ C0] ? __pfx_wait_for_completion_timeout+0x10/0x10 [ 95.564462][ C0] usb_start_wait_urb+0x1e9/0x5b0 [ 95.566501][ C0] ? trace_kmalloc+0x2a/0xf0 [ 95.568361][ C0] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 95.570644][ C0] usb_control_msg+0x234/0x3e0 [ 95.572705][ C0] usb_set_interface+0x521/0x1470 [ 95.574729][ C0] snd_usb_midi_v2_create+0x621/0x4ac0 [ 95.576873][ C0] ? __pfx_proc_audio_usbid_read+0x10/0x10 [ 95.579208][ C0] ? snd_card_rw_proc_new+0x10d/0x140 [ 95.582038][ C0] ? __pfx_snd_usb_midi_v2_create+0x10/0x10 [ 95.584732][ C0] ? usb_ifnum_to_if+0x262/0x2f0 [ 95.586840][ C0] snd_usb_create_stream+0x262/0x630 [ 95.589360][ C0] usb_audio_probe+0x144c/0x2240 [ 95.591535][ C0] ? __pfx_usb_audio_probe+0x10/0x10 [ 95.593781][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 95.596287][ C0] usb_probe_interface+0x653/0xc60 [ 95.598497][ C0] ? __pfx_usb_probe_interface+0x10/0x10 [ 95.600822][ C0] really_probe+0x254/0xae0 [ 95.602732][ C0] __driver_probe_device+0x1e8/0x360 [ 95.604880][ C0] driver_probe_device+0x4f/0x240 [ 95.607104][ C0] __device_attach_driver+0x270/0x410 [ 95.609330][ C0] bus_for_each_drv+0x258/0x2f0 [ 95.611283][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 95.613596][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 95.615615][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 95.617807][ C0] __device_attach+0x2c4/0x450 [ 95.619599][ C0] ? __pfx___device_attach+0x10/0x10 [ 95.621624][ C0] ? do_raw_spin_unlock+0x4d/0x200 [ 95.623654][ C0] ? _raw_spin_unlock+0x28/0x50 [ 95.625556][ C0] device_initial_probe+0xa1/0xd0 [ 95.627559][ C0] bus_probe_device+0x12a/0x220 [ 95.629550][ C0] device_add+0x7d7/0xb80 [ 95.631350][ C0] usb_set_configuration+0x1ad8/0x2180 [ 95.633473][ C0] usb_generic_driver_probe+0x8d/0x150 [ 95.635710][ C0] usb_probe_device+0x1c3/0x3b0 [ 95.637767][ C0] ? __pfx_usb_probe_device+0x10/0x10 [ 95.639940][ C0] really_probe+0x254/0xae0 [ 95.641868][ C0] __driver_probe_device+0x1e8/0x360 [ 95.644021][ C0] driver_probe_device+0x4f/0x240 [ 95.646205][ C0] __device_attach_driver+0x270/0x410 [ 95.648459][ C0] bus_for_each_drv+0x258/0x2f0 [ 95.650542][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 95.653005][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 95.655242][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 95.657649][ C0] __device_attach+0x2c4/0x450 [ 95.659668][ C0] ? __pfx___device_attach+0x10/0x10 [ 95.661954][ C0] ? do_raw_spin_unlock+0x4d/0x200 [ 95.664214][ C0] ? _raw_spin_unlock+0x28/0x50 [ 95.667058][ C0] device_initial_probe+0xa1/0xd0 [ 95.669662][ C0] bus_probe_device+0x12a/0x220 [ 95.671932][ C0] device_add+0x7d7/0xb80 [ 95.673804][ C0] usb_new_device+0x9aa/0x1690 [ 95.675786][ C0] ? __pfx_usb_new_device+0x10/0x10 [ 95.677926][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 95.680094][ C0] hub_event+0x28e8/0x4d30 [ 95.681926][ C0] ? do_raw_spin_unlock+0x4d/0x200 [ 95.684108][ C0] ? __pfx_hub_event+0x10/0x10 [ 95.686307][ C0] ? process_scheduled_works+0x97a/0x1630 [ 95.688679][ C0] ? rcu_is_watching+0x16/0xb0 [ 95.690631][ C0] ? process_scheduled_works+0x97a/0x1630 [ 95.693117][ C0] process_scheduled_works+0xc3d/0x1630 [ 95.695398][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 95.697902][ C0] ? assign_work+0x3cf/0x5d0 [ 95.699913][ C0] worker_thread+0xa47/0xfb0 [ 95.701923][ C0] ? __kthread_parkme+0x71/0x1f0 [ 95.704124][ C0] kthread+0x38b/0x480 [ 95.705987][ C0] ? __pfx_worker_thread+0x10/0x10 [ 95.708203][ C0] ? __pfx_kthread+0x10/0x10 [ 95.710153][ C0] ret_from_fork+0x514/0xb70 [ 95.712041][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 95.714126][ C0] ? __switch_to+0xc89/0x1420 [ 95.715833][ C0] ? __pfx_kthread+0x10/0x10 [ 95.717484][ C0] ret_from_fork_asm+0x1a/0x30 [ 95.719237][ C0] [ 95.720478][ C0] Modules linked in: [ 95.722131][ C0] ---[ end trace 0000000000000000 ]--- [ 95.724255][ C0] RIP: 0010:f_midi2_stop_eps+0x28e/0x4d0 [ 95.726371][ C0] Code: 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 47 49 61 fa 41 bf 30 07 00 00 4d 03 3e 4c 89 f8 48 c1 e8 03 48 89 44 24 18 <42> 0f b6 04 28 84 c0 0f 85 12 02 00 00 41 8b 1f 31 ff 89 de e8 b9 [ 95.734227][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002 [ 95.737001][ C0] RAX: 00000000000000e6 RBX: ffff888012a88120 RCX: ffff888012550000 [ 95.740307][ C0] RDX: 8000000000000100 RSI: 0000000000000100 RDI: ffffffff8c6d1520 [ 95.743814][ C0] RBP: ffff888012a88100 R08: 000000001e6d8e3a R09: 00000000c0995c85 [ 95.747171][ C0] R10: 0000000000000010 R11: ffffffff8ed5a360 R12: ffff888012a88730 [ 95.750611][ C0] R13: dffffc0000000000 R14: ffff888012a88128 R15: 0000000000000730 [ 95.754068][ C0] FS: 0000000000000000(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000 [ 95.757810][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.760544][ C0] CR2: 00007f950d8cb0f5 CR3: 000000005181d000 CR4: 0000000000352ef0 [ 95.763997][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 95.767339][ C0] Kernel Offset: disabled [ 95.769222][ C0] Rebooting in 86400 seconds..