program:
r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0)
sendmsg(r0, &(0x7f0000001800)={&(0x7f0000000180)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x1, 0x0, 0x1, 0x0, {0xa, 0x4e24, 0x7, @mcast2}}}, 0x80, 0x0}, 0x8080)
r1 = socket(0x400000000010, 0x3, 0x0)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000140)={'ip6_vti0\x00', &(0x7f0000000180)={'syztnl2\x00', 0x0, 0x0, 0x0, 0x0, 0x8548e, 0x0, @local, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x40, 0x80, 0x2, 0x8cc}})
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/direction\x00', 0x1, 0x0)
write(r2, &(0x7f00000002c0)='1', 0x1)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/num_groups\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/midi1_num_groups\x00', 0x1, 0x0)
write(r4, &(0x7f0000000440)='2', 0x1)
symlinkat(&(0x7f0000000880)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000008c0)='./my_configfs/usb_gadget/g1/configs/c.1/midi2.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./my_configfs/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000940)='dummy_udc.0', 0xb)
r6 = fsopen(&(0x7f0000000240)='ramfs\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0)
r7 = fsmount(r6, 0x0, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r8, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x24, 0x32, 0x701, 0x40, 0xffffffff, {0xa}, [@typed={0x8, 0x1, 0x0, 0x0, @u32=0x1ff}, @typed={0x8, 0xa, 0x0, 0x0, @fd=r7}]}, 0x24}}, 0x20008080)
ioctl$FBIOPUT_CON2FBMAP(r7, 0x4610, &(0x7f0000000100)={0x3d, 0x1})
syz_emit_ethernet(0x76, &(0x7f0000000080)={@link_local, @random="86082b9827c1", @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "cb3e02", 0x40, 0x3a, 0x0, @private2, @mcast2, {[], @param_prob={0x4, 0x0, 0x0, 0x0, {0x0, 0x6, "974367", 0x0, 0x11, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @local, [@dstopts={0x0, 0x1, '\x00', [@padn={0x1, 0x33, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}]}]}}}}}}}, 0x0)
r9 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
getsockopt$bt_BT_DEFER_SETUP(r9, 0x112, 0x7, 0x0, &(0x7f0000000040))
connect$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x0, 0x0, 0x0, 0x0, @remote}, 0x10)
[ 94.544617][ T5283] Bluetooth: hci0: command tx timeout
[ 95.106759][ T5307] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 95.254703][ T5307] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.02
[ 95.260087][ T5307] usb 5-1: Dual-Role OTG device on HNP port
[ 95.263299][ T5307] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 95.294896][ T5307] gspca_main: spca501-2.14.0 probing 0000:0000
[ 95.303135][ T5307] gspca_spca501: reg write: error -32
[ 95.303182][ T5307] spca501 5-1:1.0: Reg write failed for 0x02,0x0f,0x05
[ 95.303254][ T5307] spca501 5-1:1.0: probe with driver spca501 failed with error -22
[ 95.324882][ C0] Oops: general protection fault, probably for non-canonical address 0xdffffc00000000e6: 0000 [#1] SMP KASAN NOPTI
[ 95.330009][ C0] KASAN: null-ptr-deref in range [0x0000000000000730-0x0000000000000737]
[ 95.333417][ C0] CPU: 0 UID: 0 PID: 5307 Comm: kworker/0:5 Not tainted syzkaller #0 PREEMPT(full)
[ 95.337366][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.341764][ C0] Workqueue: usb_hub_wq hub_event
[ 95.343990][ C0] RIP: 0010:f_midi2_stop_eps+0x28e/0x4d0
[ 95.346348][ C0] Code: 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 77 0b 5b fa 41 bf 30 07 00 00 4d 03 3e 4c 89 f8 48 c1 e8 03 48 89 44 24 18 <42> 0f b6 04 28 84 c0 0f 85 12 02 00 00 41 8b 1f 31 ff 89 de e8 09
[ 95.354556][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002
[ 95.357078][ C0] RAX: 00000000000000e6 RBX: ffff888052a3c120 RCX: ffff8880127a0000
[ 95.360463][ C0] RDX: 8000000000000100 RSI: 0000000000000100 RDI: ffffffff8c6da320
[ 95.363673][ C0] RBP: ffff888052a3c100 R08: 00000000a0cf4f91 R09: 0000000049415aa8
[ 95.367108][ C0] R10: 0000000000000010 R11: ffffffff8ed5c6e0 R12: ffff888052a3c730
[ 95.370541][ C0] R13: dffffc0000000000 R14: ffff888052a3c128 R15: 0000000000000730
[ 95.373939][ C0] FS: 0000000000000000(0000) GS:ffff88808c2d1000(0000) knlGS:0000000000000000
[ 95.377995][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 95.380998][ C0] CR2: 00007f59526d0c25 CR3: 000000001fba8000 CR4: 0000000000352ef0
[ 95.384277][ C0] Call Trace:
[ 95.385660][ C0]
[ 95.386868][ C0] f_midi2_set_alt+0x11c/0xf00
[ 95.388862][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 95.391092][ C0] composite_setup+0x1ffd/0x3480
[ 95.393349][ C0] configfs_composite_setup+0xc7/0x100
[ 95.395680][ C0] dummy_timer+0x2f43/0x4cf0
[ 95.397579][ C0] ? update_se+0x90/0x1020
[ 95.399383][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 95.401618][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 95.403745][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 95.406167][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 95.408356][ C0] __hrtimer_run_queues+0x3bc/0xa10
[ 95.410650][ C0] hrtimer_run_softirq+0x1e3/0x2e0
[ 95.412751][ C0] handle_softirqs+0x226/0x860
[ 95.414836][ C0] ? __irq_exit_rcu+0xcb/0x220
[ 95.416957][ C0] __irq_exit_rcu+0xcb/0x220
[ 95.418829][ C0] irq_exit_rcu+0x9/0x30
[ 95.420636][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0
[ 95.423000][ C0]
[ 95.424278][ C0]
[ 95.425571][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 95.428170][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80
[ 95.430949][ C0] Code: f7 e8 fd 62 bb f5 f7 c3 00 02 00 00 74 05 e8 00 ab e7 f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 94 7c ac f5 65 48 8b 05 5c 92 ac 07 48 85 c0 74 18 5b 41 5e c3
[ 95.438799][ C0] RSP: 0018:ffffc9000f5ee730 EFLAGS: 00000206
[ 95.441371][ C0] RAX: 0000000000000002 RBX: 0000000000000246 RCX: 8000000000000001
[ 95.444503][ C0] RDX: 0000000000000006 RSI: ffffffff8e476c30 RDI: 0000000000000001
[ 95.447534][ C0] RBP: 0000000000000007 R08: ffffffff907a357f R09: 1ffffffff20f46af
[ 95.450597][ C0] R10: dffffc0000000000 R11: fffffbfff20f46b0 R12: 0000000000000000
[ 95.453602][ C0] R13: dffffc0000000000 R14: ffff888034180000 R15: 1ffff11003f3e494
[ 95.456875][ C0] dummy_urb_enqueue+0x587/0x780
[ 95.458940][ C0] usb_hcd_submit_urb+0x328/0x1b60
[ 95.461247][ C0] usb_start_wait_urb+0x13f/0x5b0
[ 95.463379][ C0] ? __pfx_usb_start_wait_urb+0x10/0x10
[ 95.465769][ C0] usb_control_msg+0x234/0x3e0
[ 95.468003][ C0] usb_set_interface+0x521/0x1470
[ 95.470240][ C0] ? __kmalloc_cache_noprof+0x14d/0x600
[ 95.472589][ C0] snd_usb_midi_v2_create+0x621/0x4ac0
[ 95.474852][ C0] ? __pfx_proc_audio_usbid_read+0x10/0x10
[ 95.477417][ C0] ? snd_card_rw_proc_new+0x10d/0x140
[ 95.479810][ C0] ? __pfx_snd_usb_midi_v2_create+0x10/0x10
[ 95.482048][ C0] ? usb_ifnum_to_if+0x262/0x2f0
[ 95.484006][ C0] snd_usb_create_stream+0x262/0x630
[ 95.486299][ C0] usb_audio_probe+0x144c/0x2240
[ 95.488589][ C0] ? __pfx_usb_audio_probe+0x10/0x10
[ 95.490847][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 95.493248][ C0] usb_probe_interface+0x788/0xe50
[ 95.495371][ C0] ? __pfx_usb_probe_interface+0x10/0x10
[ 95.497822][ C0] ? sysfs_do_create_link_sd+0xe0/0x110
[ 95.500077][ C0] ? driver_sysfs_add+0x1fe/0x210
[ 95.502356][ C0] ? __pfx_usb_probe_interface+0x10/0x10
[ 95.504713][ C0] really_probe+0x254/0xae0
[ 95.506733][ C0] __driver_probe_device+0x1e8/0x360
[ 95.509061][ C0] driver_probe_device+0x4f/0x240
[ 95.511307][ C0] __device_attach_driver+0x270/0x410
[ 95.513655][ C0] bus_for_each_drv+0x258/0x2f0
[ 95.515796][ C0] ? __pfx___device_attach_driver+0x10/0x10
[ 95.518361][ C0] ? __pfx_bus_for_each_drv+0x10/0x10
[ 95.520722][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 95.523163][ C0] __device_attach+0x2c4/0x450
[ 95.525258][ C0] ? __pfx___device_attach+0x10/0x10
[ 95.527802][ C0] ? do_raw_spin_unlock+0x4d/0x200
[ 95.530023][ C0] ? _raw_spin_unlock+0x28/0x50
[ 95.532030][ C0] device_initial_probe+0xa1/0xd0
[ 95.534290][ C0] bus_probe_device+0x12a/0x220
[ 95.536457][ C0] device_add+0x7d7/0xb80
[ 95.538420][ C0] usb_set_configuration+0x1ad8/0x2180
[ 95.540874][ C0] usb_generic_driver_probe+0x8d/0x150
[ 95.543249][ C0] usb_probe_device+0x1c3/0x3b0
[ 95.545341][ C0] ? __pfx_usb_probe_device+0x10/0x10
[ 95.547706][ C0] really_probe+0x254/0xae0
[ 95.549734][ C0] __driver_probe_device+0x1e8/0x360
[ 95.552070][ C0] driver_probe_device+0x4f/0x240
[ 95.554235][ C0] __device_attach_driver+0x270/0x410
[ 95.556334][ C0] bus_for_each_drv+0x258/0x2f0
[ 95.558445][ C0] ? __pfx___device_attach_driver+0x10/0x10
[ 95.560956][ C0] ? __pfx_bus_for_each_drv+0x10/0x10
[ 95.563321][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 95.565908][ C0] __device_attach+0x2c4/0x450
[ 95.568116][ C0] ? __pfx___device_attach+0x10/0x10
[ 95.570437][ C0] ? do_raw_spin_unlock+0x4d/0x200
[ 95.572690][ C0] ? _raw_spin_unlock+0x28/0x50
[ 95.574755][ C0] device_initial_probe+0xa1/0xd0
[ 95.577081][ C0] bus_probe_device+0x12a/0x220
[ 95.579224][ C0] device_add+0x7d7/0xb80
[ 95.581157][ C0] usb_new_device+0x9aa/0x1690
[ 95.583268][ C0] ? __pfx_usb_new_device+0x10/0x10
[ 95.585539][ C0] ? _raw_spin_unlock_irq+0x23/0x50
[ 95.588116][ C0] hub_event+0x28e8/0x4d30
[ 95.590123][ C0] ? do_raw_spin_unlock+0x4d/0x200
[ 95.592368][ C0] ? __pfx_hub_event+0x10/0x10
[ 95.594500][ C0] ? rcu_is_watching+0x16/0xb0
[ 95.596670][ C0] ? process_scheduled_works+0x97a/0x1630
[ 95.599088][ C0] process_scheduled_works+0xc3d/0x1630
[ 95.601480][ C0] ? __pfx_process_scheduled_works+0x10/0x10
[ 95.604104][ C0] ? assign_work+0x3cf/0x5d0
[ 95.606371][ C0] worker_thread+0xa47/0xfb0
[ 95.608463][ C0] ? __kthread_parkme+0x71/0x1f0
[ 95.610835][ C0] kthread+0x38b/0x480
[ 95.612614][ C0] ? __pfx_worker_thread+0x10/0x10
[ 95.614866][ C0] ? __pfx_kthread+0x10/0x10
[ 95.617009][ C0] ret_from_fork+0x514/0xb70
[ 95.618955][ C0] ? __pfx_ret_from_fork+0x10/0x10
[ 95.621212][ C0] ? __switch_to+0xc89/0x1420
[ 95.623245][ C0] ? __pfx_kthread+0x10/0x10
[ 95.625325][ C0] ret_from_fork_asm+0x1a/0x30
[ 95.627453][ C0]
[ 95.628849][ C0] Modules linked in:
[ 95.630574][ C0] ---[ end trace 0000000000000000 ]---
[ 95.632992][ C0] RIP: 0010:f_midi2_stop_eps+0x28e/0x4d0
[ 95.633016][ C0] Code: 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 77 0b 5b fa 41 bf 30 07 00 00 4d 03 3e 4c 89 f8 48 c1 e8 03 48 89 44 24 18 <42> 0f b6 04 28 84 c0 0f 85 12 02 00 00 41 8b 1f 31 ff 89 de e8 09
[ 95.633027][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002
[ 95.633039][ C0] RAX: 00000000000000e6 RBX: ffff888052a3c120 RCX: ffff8880127a0000
[ 95.633048][ C0] RDX: 8000000000000100 RSI: 0000000000000100 RDI: ffffffff8c6da320
[ 95.633057][ C0] RBP: ffff888052a3c100 R08: 00000000a0cf4f91 R09: 0000000049415aa8
[ 95.633065][ C0] R10: 0000000000000010 R11: ffffffff8ed5c6e0 R12: ffff888052a3c730
[ 95.633073][ C0] R13: dffffc0000000000 R14: ffff888052a3c128 R15: 0000000000000730
[ 95.633082][ C0] FS: 0000000000000000(0000) GS:ffff88808c2d1000(0000) knlGS:0000000000000000
[ 95.633092][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 95.633100][ C0] CR2: 00007f59526d0c25 CR3: 000000001fba8000 CR4: 0000000000352ef0
[ 95.633138][ C0] Kernel panic - not syncing: Fatal exception in interrupt
[ 95.674295][ C0] Kernel Offset: disabled
[ 95.676038][ C0] Rebooting in 86400 seconds..