program: mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/direction\x00', 0x1, 0x0) write(r0, &(0x7f00000002c0)='1', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/midi2.usb0/ep.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/functions/midi2.usb0/ep.2\x00', 0x1ff) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/configs/c.1/midi2.usb0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r1, &(0x7f0000000680)='dummy_udc.0', 0xb) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=ANY=[@ANYBLOB="7000000010000304000080000000000000007400", @ANYRES32, @ANYBLOB="0000000003120100500012800b000100627269646765000040000280080005000100000006002700000000000800010015000800050025000000000008000400000000000c002e"], 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x40) r2 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3400000013000100000000000000000007000000", @ANYRES32=r4], 0x34}, 0x1, 0x0, 0x0, 0x60}, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000800)={'ip6tnl0\x00', &(0x7f0000000780)={'ip6tnl0\x00', 0x0, 0x29, 0x4f, 0x4, 0x2, 0x40, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @local, 0x40, 0x20, 0x200}}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000006800e9780000000000dbdf250a0000000000000008000500", @ANYRES32=r8], 0x20}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000940)={'sit0\x00', &(0x7f0000000840)={'syztnl0\x00', 0x0, 0x20, 0x8, 0xc, 0x0, {{0x2f, 0x4, 0x3, 0x3, 0xbc, 0x65, 0x0, 0x58, 0x2f, 0x0, @broadcast, @multicast1, {[@generic={0x88, 0xd, "7ac40cbd6dc7e60b48d4bf"}, @ra={0x94, 0x4}, @timestamp_prespec={0x44, 0x2c, 0xa6, 0x3, 0xe, [{@local, 0xfff}, {@loopback, 0x6}, {@loopback, 0x3}, {@rand_addr=0x64010100}, {@rand_addr=0x64010102, 0x5}]}, @cipso={0x86, 0x21, 0x3, [{0x6, 0x9, "0fa2a9f5238817"}, {0x0, 0x5, "12c0b6"}, {0x1, 0xd, "e8ed0242f9d4caf9ad45fd"}]}, @noop, @generic={0x94, 0x8, "4c7dbda6be65"}, @ssrr={0x89, 0xf, 0xda, [@remote, @multicast1, @multicast1]}, @generic={0x86, 0x11, "fdc31a4eb9f6e195b7701c242abc75"}, @rr={0x7, 0x13, 0x46, [@rand_addr=0x64010102, @broadcast, @empty, @dev={0xac, 0x14, 0x14, 0xc}]}, @generic={0x88, 0xd, "7df772bcb74632f8896871"}]}}}}}) sendmsg$ETHTOOL_MSG_EEE_GET(0xffffffffffffffff, &(0x7f0000000b80)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000b40)={&(0x7f0000000980)={0x1a4, 0x0, 0x200, 0x70bd2d, 0x25dfdbfe, {}, [@HEADER={0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0x4}, @HEADER={0x7c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'tunl0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_hsr\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}, @HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_hsr\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}]}]}, 0x1a4}}, 0xc001) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc), 0xc, 0x1, 0x0, &(0x7f0000048000)=0x1, 0x0) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc), 0xc, 0x1, 0x0, &(0x7f0000048000)=0x1, 0x0) [ 101.959982][ T5284] Bluetooth: hci0: command tx timeout [ 102.065251][ T5320] sound umpC3D1: No UMP Group is found in FB [ 102.068737][ T5320] sound umpC3D2: No UMP Group is found in FB [ 102.642466][ T1367] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 102.792287][ T1367] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.02 [ 102.797777][ T1367] usb 5-1: Dual-Role OTG device on HNP port [ 102.801102][ T1367] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.832985][ T1367] gspca_main: spca501-2.14.0 probing 0000:0000 [ 102.837357][ T1367] gspca_spca501: reg write: error -32 [ 102.839741][ T1367] spca501 5-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 102.844199][ T1367] spca501 5-1:1.0: probe with driver spca501 failed with error -22 [ 102.853092][ C0] Oops: general protection fault, probably for non-canonical address 0xdffffc00000000e6: 0000 [#1] SMP KASAN NOPTI [ 102.858918][ C0] KASAN: null-ptr-deref in range [0x0000000000000730-0x0000000000000737] [ 102.862677][ C0] CPU: 0 UID: 0 PID: 1367 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full) [ 102.866862][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.871429][ C0] Workqueue: usb_hub_wq hub_event [ 102.873792][ C0] RIP: 0010:f_midi2_stop_eps+0x28e/0x4d0 [ 102.876291][ C0] Code: 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 47 49 61 fa 41 bf 30 07 00 00 4d 03 3e 4c 89 f8 48 c1 e8 03 48 89 44 24 18 <42> 0f b6 04 28 84 c0 0f 85 12 02 00 00 41 8b 1f 31 ff 89 de e8 b9 [ 102.884342][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002 [ 102.887016][ C0] RAX: 00000000000000e6 RBX: ffff888012118120 RCX: ffff8880344b4b00 [ 102.890484][ C0] RDX: 0000000000000100 RSI: 0000000000000100 RDI: ffffffff8c6d1520 [ 102.893911][ C0] RBP: ffff888012118100 R08: 000000001e6d8e3a R09: 00000000c0995c85 [ 102.897403][ C0] R10: 0000000000000010 R11: ffffffff8ed5a360 R12: ffff888012118730 [ 102.900821][ C0] R13: dffffc0000000000 R14: ffff888012118128 R15: 0000000000000730 [ 102.904133][ C0] FS: 0000000000000000(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000 [ 102.907955][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 102.910828][ C0] CR2: 00007f704ad9e0f5 CR3: 0000000042eda000 CR4: 0000000000352ef0 [ 102.914287][ C0] Call Trace: [ 102.915808][ C0] [ 102.917091][ C0] f_midi2_set_alt+0x11c/0xf00 [ 102.919177][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 102.921519][ C0] composite_setup+0x1ffd/0x3480 [ 102.923681][ C0] configfs_composite_setup+0xc7/0x100 [ 102.926105][ C0] dummy_timer+0x2f43/0x4cf0 [ 102.928185][ C0] ? call_timer_fn+0xd5/0x5f0 [ 102.930241][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 102.932564][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 102.934758][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 102.937244][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 102.939290][ C0] __hrtimer_run_queues+0x3bc/0xa10 [ 102.941451][ C0] hrtimer_run_softirq+0x1e3/0x2e0 [ 102.943586][ C0] handle_softirqs+0x226/0x860 [ 102.945708][ C0] ? __irq_exit_rcu+0xcb/0x220 [ 102.947770][ C0] __irq_exit_rcu+0xcb/0x220 [ 102.949792][ C0] irq_exit_rcu+0x9/0x30 [ 102.951614][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 102.953955][ C0] [ 102.955179][ C0] [ 102.956418][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 102.958864][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 [ 102.961601][ C0] Code: f7 e8 ad b6 c2 f5 f7 c3 00 02 00 00 74 05 e8 b0 e7 ee f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 b4 d6 b3 f5 65 48 8b 05 2c ce b0 07 48 85 c0 74 18 5b 41 5e c3 [ 102.969137][ C0] RSP: 0018:ffffc900022267d0 EFLAGS: 00000206 [ 102.971550][ C0] RAX: 0000000000000006 RBX: 0000000000000246 RCX: 8000000000000001 [ 102.974713][ C0] RDX: 0000000000000006 RSI: ffffffff8e460b06 RDI: 0000000000000001 [ 102.978021][ C0] RBP: 0000000000000007 R08: ffffffff9078fa37 R09: 1ffffffff20f1f46 [ 102.981416][ C0] R10: dffffc0000000000 R11: fffffbfff20f1f47 R12: 0000000000000000 [ 102.985355][ C0] R13: dffffc0000000000 R14: ffff8880345a8000 R15: 1ffff11003f76e94 [ 102.989581][ C0] dummy_urb_enqueue+0x587/0x780 [ 102.992139][ C0] usb_hcd_submit_urb+0x328/0x1b60 [ 102.994325][ C0] usb_start_wait_urb+0x13f/0x5b0 [ 102.996430][ C0] ? trace_kmalloc+0x2a/0xf0 [ 102.998311][ C0] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 103.000882][ C0] usb_control_msg+0x234/0x3e0 [ 103.002834][ C0] usb_set_interface+0x521/0x1470 [ 103.005072][ C0] snd_usb_midi_v2_create+0x621/0x4ac0 [ 103.007459][ C0] ? __pfx_proc_audio_usbid_read+0x10/0x10 [ 103.010274][ C0] ? snd_card_rw_proc_new+0x10d/0x140 [ 103.012948][ C0] ? __pfx_snd_usb_midi_v2_create+0x10/0x10 [ 103.015367][ C0] ? usb_ifnum_to_if+0x262/0x2f0 [ 103.017434][ C0] snd_usb_create_stream+0x262/0x630 [ 103.019617][ C0] usb_audio_probe+0x144c/0x2240 [ 103.021688][ C0] ? __pfx_usb_audio_probe+0x10/0x10 [ 103.023947][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 103.026498][ C0] usb_probe_interface+0x653/0xc60 [ 103.028691][ C0] ? __pfx_usb_probe_interface+0x10/0x10 [ 103.031143][ C0] really_probe+0x254/0xae0 [ 103.033148][ C0] __driver_probe_device+0x1e8/0x360 [ 103.035318][ C0] driver_probe_device+0x4f/0x240 [ 103.037490][ C0] __device_attach_driver+0x270/0x410 [ 103.039725][ C0] bus_for_each_drv+0x258/0x2f0 [ 103.041827][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 103.044336][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 103.046599][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 103.048949][ C0] __device_attach+0x2c4/0x450 [ 103.051040][ C0] ? __pfx___device_attach+0x10/0x10 [ 103.053292][ C0] ? do_raw_spin_unlock+0x4d/0x200 [ 103.055487][ C0] ? _raw_spin_unlock+0x28/0x50 [ 103.057588][ C0] device_initial_probe+0xa1/0xd0 [ 103.059739][ C0] bus_probe_device+0x12a/0x220 [ 103.062036][ C0] device_add+0x7d7/0xb80 [ 103.063870][ C0] usb_set_configuration+0x1ad8/0x2180 [ 103.066153][ C0] usb_generic_driver_probe+0x8d/0x150 [ 103.068513][ C0] usb_probe_device+0x1c3/0x3b0 [ 103.070682][ C0] ? __pfx_usb_probe_device+0x10/0x10 [ 103.073060][ C0] really_probe+0x254/0xae0 [ 103.075132][ C0] __driver_probe_device+0x1e8/0x360 [ 103.077404][ C0] driver_probe_device+0x4f/0x240 [ 103.079484][ C0] __device_attach_driver+0x270/0x410 [ 103.081658][ C0] bus_for_each_drv+0x258/0x2f0 [ 103.083697][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 103.086279][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 103.088476][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 103.090836][ C0] __device_attach+0x2c4/0x450 [ 103.092724][ C0] ? __pfx___device_attach+0x10/0x10 [ 103.094917][ C0] ? do_raw_spin_unlock+0x4d/0x200 [ 103.096963][ C0] ? _raw_spin_unlock+0x28/0x50 [ 103.099090][ C0] device_initial_probe+0xa1/0xd0 [ 103.101283][ C0] bus_probe_device+0x12a/0x220 [ 103.103397][ C0] device_add+0x7d7/0xb80 [ 103.105339][ C0] usb_new_device+0x9aa/0x1690 [ 103.107409][ C0] ? __pfx_usb_new_device+0x10/0x10 [ 103.109617][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 103.111887][ C0] hub_event+0x28e8/0x4d30 [ 103.113920][ C0] ? do_raw_spin_unlock+0x4d/0x200 [ 103.116122][ C0] ? __pfx_hub_event+0x10/0x10 [ 103.118140][ C0] ? process_scheduled_works+0x97a/0x1630 [ 103.120533][ C0] ? rcu_is_watching+0x16/0xb0 [ 103.122543][ C0] ? process_scheduled_works+0x97a/0x1630 [ 103.124912][ C0] process_scheduled_works+0xc3d/0x1630 [ 103.127180][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 103.129652][ C0] ? assign_work+0x3cf/0x5d0 [ 103.131585][ C0] worker_thread+0xa47/0xfb0 [ 103.133466][ C0] ? __kthread_parkme+0x71/0x1f0 [ 103.135497][ C0] kthread+0x38b/0x480 [ 103.137258][ C0] ? __pfx_worker_thread+0x10/0x10 [ 103.139447][ C0] ? __pfx_kthread+0x10/0x10 [ 103.141454][ C0] ret_from_fork+0x514/0xb70 [ 103.143563][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 103.145987][ C0] ? __switch_to+0xc89/0x1420 [ 103.147939][ C0] ? __pfx_kthread+0x10/0x10 [ 103.149885][ C0] ret_from_fork_asm+0x1a/0x30 [ 103.151829][ C0] [ 103.153151][ C0] Modules linked in: [ 103.154858][ C0] ---[ end trace 0000000000000000 ]--- [ 103.157103][ C0] RIP: 0010:f_midi2_stop_eps+0x28e/0x4d0 [ 103.159458][ C0] Code: 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 47 49 61 fa 41 bf 30 07 00 00 4d 03 3e 4c 89 f8 48 c1 e8 03 48 89 44 24 18 <42> 0f b6 04 28 84 c0 0f 85 12 02 00 00 41 8b 1f 31 ff 89 de e8 b9 [ 103.166798][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002 [ 103.169231][ C0] RAX: 00000000000000e6 RBX: ffff888012118120 RCX: ffff8880344b4b00 [ 103.172468][ C0] RDX: 0000000000000100 RSI: 0000000000000100 RDI: ffffffff8c6d1520 [ 103.175796][ C0] RBP: ffff888012118100 R08: 000000001e6d8e3a R09: 00000000c0995c85 [ 103.179322][ C0] R10: 0000000000000010 R11: ffffffff8ed5a360 R12: ffff888012118730 [ 103.182510][ C0] R13: dffffc0000000000 R14: ffff888012118128 R15: 0000000000000730 [ 103.185801][ C0] FS: 0000000000000000(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000 [ 103.189657][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 103.192403][ C0] CR2: 00007f704ad9e0f5 CR3: 0000000042eda000 CR4: 0000000000352ef0 [ 103.195815][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 103.199105][ C0] Kernel Offset: disabled [ 103.200951][ C0] Rebooting in 86400 seconds..