program: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c0000001c0001000000000004086aa42d"], 0x30}}, 0x0) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/direction\x00', 0x1, 0x0) write(r4, &(0x7f0000000600)='2', 0x1) symlinkat(&(0x7f0000000880)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000008c0)='./my_configfs/usb_gadget/g1/configs/c.1/midi2.usb0\x00') r5 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./my_configfs/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r5, &(0x7f0000000940)='dummy_udc.0', 0xb) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)={{0x14}, [@NFT_MSG_NEWRULE={0x84, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x58, 0x4, 0x0, 0x1, [{0x54, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x44, 0x2, 0x0, 0x1, [@NFTA_MATCH_REV={0x8}, @NFTA_MATCH_INFO={0x2c, 0x3, "5c8f022482395afa4d23edfcbe6d55b57cb15e63c15c46395916e2b388abc3d6ce2316334e8278ad"}, @NFTA_MATCH_NAME={0xa, 0x1, 'limit\x00'}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xac}, 0x1, 0x0, 0x0, 0x2000094}, 0x4000800) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)={{0x14}, [@NFT_MSG_DELSET={0x20, 0xb, 0xa, 0x101, 0x0, 0x0, {0x3, 0x0, 0x2}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14}}, 0x48}}, 0x8010) [ 94.002088][ T5275] Bluetooth: hci0: command tx timeout [ 94.257818][ T5321] xt_limit: Overflow, try lower: 604147548/4200216962 [ 94.592902][ T805] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 94.743575][ T805] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.02 [ 94.748367][ T805] usb 5-1: Dual-Role OTG device on HNP port [ 94.751053][ T805] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 94.786607][ T805] gspca_main: spca501-2.14.0 probing 0000:0000 [ 94.791103][ T805] gspca_spca501: reg write: error -32 [ 94.794876][ T805] spca501 5-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 94.797745][ T805] spca501 5-1:1.0: probe with driver spca501 failed with error -22 [ 94.806902][ C0] Oops: general protection fault, probably for non-canonical address 0xdffffc00000000e6: 0000 [#1] SMP KASAN NOPTI [ 94.811734][ C0] KASAN: null-ptr-deref in range [0x0000000000000730-0x0000000000000737] [ 94.815170][ C0] CPU: 0 UID: 0 PID: 805 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full) [ 94.818763][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.822128][ C0] Workqueue: usb_hub_wq hub_event [ 94.824716][ C0] RIP: 0010:f_midi2_stop_eps+0x5f/0x4d0 [ 94.827057][ C0] Code: e8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 ef e8 77 4b 61 fa 41 bc 30 07 00 00 4c 03 65 00 4c 89 e0 48 c1 e8 03 48 89 44 24 10 <42> 0f b6 04 28 84 c0 0f 85 23 04 00 00 41 8b 1c 24 31 ff 89 de e8 [ 94.834944][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002 [ 94.837490][ C0] RAX: 00000000000000e6 RBX: 0000000000000001 RCX: ffff88801d210000 [ 94.840756][ C0] RDX: 8000000000000100 RSI: 0000000000000100 RDI: ffff88800bf94148 [ 94.843468][ C0] RBP: ffff88800bf940f0 R08: ffff88800bf9414f R09: 1ffff110017f2829 [ 94.846788][ C0] R10: dffffc0000000000 R11: ffffed10017f282a R12: 0000000000000730 [ 94.850154][ C0] R13: dffffc0000000000 R14: ffff88800bf94128 R15: 0000000000000001 [ 94.853401][ C0] FS: 0000000000000000(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000 [ 94.857123][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.859809][ C0] CR2: 00007f16b30fb0f5 CR3: 0000000012c9c000 CR4: 0000000000352ef0 [ 94.863137][ C0] Call Trace: [ 94.864604][ C0] [ 94.865878][ C0] f_midi2_set_alt+0x11c/0xf00 [ 94.867837][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 94.870108][ C0] composite_setup+0x1ffd/0x3480 [ 94.872214][ C0] configfs_composite_setup+0xc7/0x100 [ 94.874256][ C0] dummy_timer+0x2f43/0x4cf0 [ 94.876003][ C0] ? update_se+0x90/0x1020 [ 94.877785][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 94.879812][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 94.881911][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 94.884446][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 94.886557][ C0] __hrtimer_run_queues+0x3bc/0xa10 [ 94.888784][ C0] hrtimer_run_softirq+0x1e3/0x2e0 [ 94.890853][ C0] handle_softirqs+0x226/0x860 [ 94.892680][ C0] ? __irq_exit_rcu+0xcb/0x220 [ 94.894697][ C0] __irq_exit_rcu+0xcb/0x220 [ 94.896668][ C0] irq_exit_rcu+0x9/0x30 [ 94.898478][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 94.900811][ C0] [ 94.902111][ C0] [ 94.903370][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 94.905965][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 [ 94.908640][ C0] Code: f7 e8 ad b6 c2 f5 f7 c3 00 02 00 00 74 05 e8 b0 e7 ee f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 b4 d6 b3 f5 65 48 8b 05 2c ce b0 07 48 85 c0 74 18 5b 41 5e c3 [ 94.916749][ C0] RSP: 0018:ffffc900043ae7d0 EFLAGS: 00000206 [ 94.919349][ C0] RAX: 0000000000000002 RBX: 0000000000000246 RCX: 8000000000000001 [ 94.922646][ C0] RDX: 0000000000000006 RSI: ffffffff8e460b06 RDI: 0000000000000001 [ 94.926067][ C0] RBP: 0000000000000007 R08: ffffffff9078fa37 R09: 1ffffffff20f1f46 [ 94.929547][ C0] R10: dffffc0000000000 R11: fffffbfff20f1f47 R12: 0000000000000000 [ 94.932726][ C0] R13: dffffc0000000000 R14: ffff8880342a8000 R15: 1ffff11003f0cc94 [ 94.936187][ C0] dummy_urb_enqueue+0x587/0x780 [ 94.938317][ C0] usb_hcd_submit_urb+0x328/0x1b60 [ 94.940426][ C0] usb_start_wait_urb+0x13f/0x5b0 [ 94.942505][ C0] ? trace_kmalloc+0x2a/0xf0 [ 94.944345][ C0] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 94.946811][ C0] usb_control_msg+0x234/0x3e0 [ 94.948686][ C0] usb_set_interface+0x521/0x1470 [ 94.950628][ C0] snd_usb_midi_v2_create+0x621/0x4ac0 [ 94.953036][ C0] ? __pfx_proc_audio_usbid_read+0x10/0x10 [ 94.955628][ C0] ? snd_card_rw_proc_new+0x10d/0x140 [ 94.958052][ C0] ? __pfx_snd_usb_midi_v2_create+0x10/0x10 [ 94.960589][ C0] ? usb_ifnum_to_if+0x262/0x2f0 [ 94.962704][ C0] snd_usb_create_stream+0x262/0x630 [ 94.964879][ C0] usb_audio_probe+0x144c/0x2240 [ 94.966989][ C0] ? __pfx_usb_audio_probe+0x10/0x10 [ 94.968971][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 94.971349][ C0] usb_probe_interface+0x653/0xc60 [ 94.973567][ C0] ? __pfx_usb_probe_interface+0x10/0x10 [ 94.975915][ C0] really_probe+0x254/0xae0 [ 94.977899][ C0] __driver_probe_device+0x1e8/0x360 [ 94.979981][ C0] driver_probe_device+0x4f/0x240 [ 94.982028][ C0] __device_attach_driver+0x270/0x410 [ 94.984447][ C0] bus_for_each_drv+0x258/0x2f0 [ 94.986782][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 94.989283][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 94.991375][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 94.993826][ C0] __device_attach+0x2c4/0x450 [ 94.995916][ C0] ? __pfx___device_attach+0x10/0x10 [ 94.998095][ C0] ? do_raw_spin_unlock+0x4d/0x200 [ 95.000130][ C0] ? _raw_spin_unlock+0x28/0x50 [ 95.002152][ C0] device_initial_probe+0xa1/0xd0 [ 95.004229][ C0] bus_probe_device+0x12a/0x220 [ 95.006269][ C0] device_add+0x7d7/0xb80 [ 95.008071][ C0] usb_set_configuration+0x1ad8/0x2180 [ 95.010314][ C0] usb_generic_driver_probe+0x8d/0x150 [ 95.012488][ C0] usb_probe_device+0x1c3/0x3b0 [ 95.014563][ C0] ? __pfx_usb_probe_device+0x10/0x10 [ 95.016796][ C0] really_probe+0x254/0xae0 [ 95.018655][ C0] __driver_probe_device+0x1e8/0x360 [ 95.020853][ C0] driver_probe_device+0x4f/0x240 [ 95.023001][ C0] __device_attach_driver+0x270/0x410 [ 95.025310][ C0] bus_for_each_drv+0x258/0x2f0 [ 95.027432][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 95.029916][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 95.032198][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 95.034775][ C0] __device_attach+0x2c4/0x450 [ 95.036774][ C0] ? __pfx___device_attach+0x10/0x10 [ 95.039051][ C0] ? do_raw_spin_unlock+0x4d/0x200 [ 95.041150][ C0] ? _raw_spin_unlock+0x28/0x50 [ 95.043164][ C0] device_initial_probe+0xa1/0xd0 [ 95.045203][ C0] bus_probe_device+0x12a/0x220 [ 95.047170][ C0] device_add+0x7d7/0xb80 [ 95.049003][ C0] usb_new_device+0x9aa/0x1690 [ 95.051001][ C0] ? __pfx_usb_new_device+0x10/0x10 [ 95.053051][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 95.055176][ C0] hub_event+0x28e8/0x4d30 [ 95.056937][ C0] ? do_raw_spin_unlock+0x4d/0x200 [ 95.059068][ C0] ? __pfx_hub_event+0x10/0x10 [ 95.061035][ C0] ? process_scheduled_works+0x97a/0x1630 [ 95.063251][ C0] ? rcu_is_watching+0x16/0xb0 [ 95.065230][ C0] ? process_scheduled_works+0x97a/0x1630 [ 95.067666][ C0] process_scheduled_works+0xc3d/0x1630 [ 95.070037][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 95.072521][ C0] ? assign_work+0x3cf/0x5d0 [ 95.074433][ C0] worker_thread+0xa47/0xfb0 [ 95.076324][ C0] kthread+0x38b/0x480 [ 95.077908][ C0] ? __pfx_worker_thread+0x10/0x10 [ 95.080038][ C0] ? __pfx_kthread+0x10/0x10 [ 95.082026][ C0] ret_from_fork+0x514/0xb70 [ 95.083915][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 95.086115][ C0] ? __switch_to+0xc89/0x1420 [ 95.088084][ C0] ? __pfx_kthread+0x10/0x10 [ 95.089991][ C0] ret_from_fork_asm+0x1a/0x30 [ 95.091960][ C0] [ 95.093270][ C0] Modules linked in: [ 95.094933][ C0] ---[ end trace 0000000000000000 ]--- [ 95.097155][ C0] RIP: 0010:f_midi2_stop_eps+0x5f/0x4d0 [ 95.099445][ C0] Code: e8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 ef e8 77 4b 61 fa 41 bc 30 07 00 00 4c 03 65 00 4c 89 e0 48 c1 e8 03 48 89 44 24 10 <42> 0f b6 04 28 84 c0 0f 85 23 04 00 00 41 8b 1c 24 31 ff 89 de e8 [ 95.107258][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002 [ 95.109955][ C0] RAX: 00000000000000e6 RBX: 0000000000000001 RCX: ffff88801d210000 [ 95.113275][ C0] RDX: 8000000000000100 RSI: 0000000000000100 RDI: ffff88800bf94148 [ 95.116523][ C0] RBP: ffff88800bf940f0 R08: ffff88800bf9414f R09: 1ffff110017f2829 [ 95.119872][ C0] R10: dffffc0000000000 R11: ffffed10017f282a R12: 0000000000000730 [ 95.123103][ C0] R13: dffffc0000000000 R14: ffff88800bf94128 R15: 0000000000000001 [ 95.126344][ C0] FS: 0000000000000000(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000 [ 95.129982][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.132545][ C0] CR2: 00007f16b30fb0f5 CR3: 0000000012c9c000 CR4: 0000000000352ef0 [ 95.135730][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 95.139301][ C0] Kernel Offset: disabled [ 95.141018][ C0] Rebooting in 86400 seconds..