program: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[], &(0x7f0000000040)=""/249, 0x46, 0xf9, 0x6}, 0x20) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/no_out_endpoint\x00', 0x2, 0x0) write(r3, &(0x7f0000000340)='1', 0x1) symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r4, &(0x7f0000000440)='dummy_udc.0', 0xb) mount(0x0, 0x0, &(0x7f0000000080)='proc\x00', 0x0, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1900000003000800080000000200000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000006c0)) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000700)={r5, &(0x7f0000000740), &(0x7f0000000780)=""/10, 0x2}, 0x20) r6 = syz_open_dev$sg(&(0x7f0000000500), 0x0, 0x5) ioctl$SG_IO(r6, 0x2285, 0x0) writev(r6, &(0x7f0000000540)=[{&(0x7f00000005c0)="aefdda9d240300005a90f57f07703aeff0f64ebbee07962c22772e377a9817069659253e4b11b44e65d7b5caca8b", 0x2e}, {&(0x7f0000000600)="aa1d484e0a4e000000008133d576983340cb31a5fc977c2e4891f7c08bfcd111fbdf23ea32db0e8f20d5bc27bd80634b8e695f", 0x33}], 0x2) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a010100000100000000000200fffc0900010073797a30000000000800024000000001cc000000030a01020000000000000000020000000900010073797a3000000000aa000300", @ANYRESDEC=r6], 0x1e4}, 0x1, 0x0, 0x0, 0x8000}, 0x0) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x7fff, 0x0) [ 133.213192][ T5309] Bluetooth: hci0: command tx timeout [ 133.372166][ T5361] sg_write: data in/out 19942/5 bytes for SCSI command 0x32-- guessing data in; [ 133.372166][ T5361] program syz.0.0 not setting count and/or reply_len properly [ 133.590369][ T9] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 133.753449][ T9] usb 5-1: New USB device found: idVendor=0000, idProduct=0000, bcdDevice=7.04 [ 133.754926][ T9] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 133.754976][ T9] usb 5-1: Dual-Role OTG device on HNP port [ 133.755350][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 133.792202][ C0] ------------[ cut here ]------------ [ 133.792215][ C0] usb_ep_enable: ep129 (ep1in-bulk) has maxpacket 0 [ 133.792247][ C0] WARNING: drivers/usb/gadget/udc/core.c:125 at usb_ep_enable+0x148/0x480, CPU#0: kworker/0:0/9 [ 133.802102][ C0] Modules linked in: [ 133.803737][ C0] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full) [ 133.807099][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 133.811165][ C0] Workqueue: usb_hub_wq hub_event [ 133.813374][ C0] RIP: 0010:usb_ep_enable+0x1bc/0x480 [ 133.815684][ C0] Code: 7a 7a 67 fa 49 83 3f 00 48 c7 c0 a0 d0 f4 8c 49 c7 c0 c0 d0 f4 8c 4c 0f 44 c0 4c 89 f7 48 c7 c6 2f 96 94 8e 44 89 ea 4c 89 e1 <67> 48 0f b9 3a bd ea ff ff ff 0f 1f 44 00 00 e8 90 74 ee f9 65 8b [ 133.823296][ C0] RSP: 0018:ffffc90000007910 EFLAGS: 00010086 [ 133.825854][ C0] RAX: ffffffff8cf4d0a0 RBX: ffff888035b340e0 RCX: ffffffff8cf4ef80 [ 133.829172][ C0] RDX: 0000000000000081 RSI: ffffffff8e94962f RDI: ffffffff91cc2a90 [ 133.832475][ C0] RBP: dffffc0000000000 R08: ffffffff8cf4d0c0 R09: 0000000000000002 [ 133.835922][ C0] R10: 0000000000000003 R11: 0000000000000100 R12: ffffffff8cf4ef80 [ 133.839354][ C0] R13: 0000000000000081 R14: ffffffff91cc2a90 R15: ffff888035b340f8 [ 133.842747][ C0] FS: 0000000000000000(0000) GS:ffff88808a9fe000(0000) knlGS:0000000000000000 [ 133.846435][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 133.849100][ C0] CR2: 00007f7aa5f285e0 CR3: 00000000344da000 CR4: 0000000000352ef0 [ 133.852200][ C0] Call Trace: [ 133.853606][ C0] [ 133.854879][ C0] hidg_set_alt+0x12a/0xa60 [ 133.856748][ C0] ? usb_gadget_set_state+0x12c/0x2d0 [ 133.858991][ C0] set_config+0x749/0x1160 [ 133.860892][ C0] composite_setup+0x1de7/0x3480 [ 133.863033][ C0] configfs_composite_setup+0xc7/0x100 [ 133.865287][ C0] dummy_timer+0x2f30/0x4ce0 [ 133.867236][ C0] ? rcu_is_watching+0x16/0xb0 [ 133.869270][ C0] ? __lock_acquire+0x747/0x2de0 [ 133.871243][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 133.873474][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 133.875588][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 133.878228][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 133.880401][ C0] __hrtimer_run_queues+0x3bc/0xa10 [ 133.882646][ C0] hrtimer_run_softirq+0x1e3/0x2e0 [ 133.884919][ C0] handle_softirqs+0x265/0x8d0 [ 133.887037][ C0] __irq_exit_rcu+0xc6/0x220 [ 133.889063][ C0] irq_exit_rcu+0x9/0x30 [ 133.890819][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 133.893305][ C0] [ 133.894699][ C0] [ 133.896008][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 133.898747][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 [ 133.901609][ C0] Code: f7 e8 6d 9f 9a f5 f7 c3 00 02 00 00 74 05 e8 20 52 c7 f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 a4 93 8b f5 65 48 8b 05 ac 01 d8 08 48 85 c0 74 18 5b 41 5e c3 [ 133.909570][ C0] RSP: 0018:ffffc9000022ef50 EFLAGS: 00000206 [ 133.912118][ C0] RAX: 0000000000000006 RBX: 0000000000000246 RCX: 8000000000000001 [ 133.915296][ C0] RDX: 0000000000000006 RSI: ffffffff8e6add33 RDI: 0000000000000001 [ 133.918623][ C0] RBP: 0000000000000007 R08: ffffffff91be2abf R09: 1ffffffff237c557 [ 133.922005][ C0] R10: dffffc0000000000 R11: fffffbfff237c558 R12: 1ffff11006944c95 [ 133.925427][ C0] R13: dffffc0000000000 R14: ffff888035b34000 R15: 0000000000000000 [ 133.928819][ C0] dummy_urb_enqueue+0x5a2/0x7a0 [ 133.930922][ C0] usb_hcd_submit_urb+0x328/0x1b60 [ 133.933127][ C0] usb_start_wait_urb+0x13f/0x5b0 [ 133.935267][ C0] ? rcu_is_watching+0x16/0xb0 [ 133.937027][ C0] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 133.939000][ C0] usb_control_msg+0x234/0x3e0 [ 133.940779][ C0] ? kfree+0x1c5/0x650 [ 133.942375][ C0] usb_set_configuration+0x12c5/0x2260 [ 133.944498][ C0] usb_generic_driver_probe+0x8d/0x150 [ 133.946865][ C0] usb_probe_device+0x1c3/0x3b0 [ 133.948952][ C0] ? __pfx_usb_probe_device+0x10/0x10 [ 133.951233][ C0] really_probe+0x254/0xae0 [ 133.953281][ C0] __driver_probe_device+0x1e8/0x360 [ 133.955604][ C0] driver_probe_device+0x4f/0x240 [ 133.957805][ C0] __device_attach_driver+0x270/0x410 [ 133.960021][ C0] bus_for_each_drv+0x258/0x2f0 [ 133.962134][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 133.964588][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 133.966900][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 133.969453][ C0] __device_attach+0x2bd/0x430 [ 133.971469][ C0] ? __pfx___device_attach+0x10/0x10 [ 133.973705][ C0] ? do_raw_spin_unlock+0x4d/0x200 [ 133.975929][ C0] ? _raw_spin_unlock+0x28/0x50 [ 133.978077][ C0] device_initial_probe+0x9c/0x100 [ 133.980197][ C0] __bus_probe_device+0x126/0x220 [ 133.982296][ C0] ? bus_probe_device+0xd/0x20 [ 133.984456][ C0] device_add+0x7d7/0xb80 [ 133.986261][ C0] usb_new_device+0x9aa/0x1690 [ 133.988249][ C0] ? __pfx_usb_new_device+0x10/0x10 [ 133.990451][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 133.992605][ C0] hub_event+0x28e8/0x4d30 [ 133.994547][ C0] ? do_raw_spin_unlock+0x4d/0x200 [ 133.996765][ C0] ? __pfx_hub_event+0x10/0x10 [ 133.998855][ C0] ? rcu_is_watching+0x16/0xb0 [ 134.000915][ C0] ? process_scheduled_works+0x97a/0x1630 [ 134.003393][ C0] process_scheduled_works+0xc3d/0x1630 [ 134.005748][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 134.008312][ C0] ? assign_work+0x3cf/0x5d0 [ 134.010292][ C0] worker_thread+0xa47/0xfb0 [ 134.012293][ C0] kthread+0x38b/0x480 [ 134.014115][ C0] ? __pfx_worker_thread+0x10/0x10 [ 134.016282][ C0] ? __pfx_kthread+0x10/0x10 [ 134.018311][ C0] ret_from_fork+0x514/0xb70 [ 134.020413][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 134.022674][ C0] ? __switch_to+0xc78/0x1410 [ 134.024727][ C0] ? __pfx_kthread+0x10/0x10 [ 134.026970][ C0] ret_from_fork_asm+0x1a/0x30 [ 134.029058][ C0] [ 134.030443][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 134.033506][ C0] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full) [ 134.037423][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 134.041648][ C0] Workqueue: usb_hub_wq hub_event [ 134.043850][ C0] Call Trace: [ 134.045363][ C0] [ 134.046602][ C0] vpanic+0x26f/0x710 [ 134.048390][ C0] panic+0xc5/0xd0 [ 134.050063][ C0] ? __pfx_panic+0x10/0x10 [ 134.051923][ C0] ? ret_from_fork_asm+0x1a/0x30 [ 134.053949][ C0] __warn+0x315/0x4c0 [ 134.055709][ C0] ? usb_ep_enable+0x148/0x480 [ 134.057760][ C0] ? usb_ep_enable+0x148/0x480 [ 134.059850][ C0] __report_bug+0x276/0x570 [ 134.061766][ C0] ? __driver_probe_device+0x1e8/0x360 [ 134.064060][ C0] ? driver_probe_device+0x4f/0x240 [ 134.066406][ C0] ? __device_attach_driver+0x270/0x410 [ 134.068884][ C0] ? usb_ep_enable+0x148/0x480 [ 134.071003][ C0] ? __pfx___report_bug+0x10/0x10 [ 134.073209][ C0] report_bug_entry+0x19b/0x290 [ 134.075364][ C0] ? usb_ep_enable+0x1bc/0x480 [ 134.077443][ C0] ? usb_ep_enable+0x1c1/0x480 [ 134.079556][ C0] handle_bug+0xce/0x200 [ 134.081422][ C0] exc_invalid_op+0x1a/0x50 [ 134.083484][ C0] asm_exc_invalid_op+0x1a/0x20 [ 134.085698][ C0] RIP: 0010:usb_ep_enable+0x1bc/0x480 [ 134.087992][ C0] Code: 7a 7a 67 fa 49 83 3f 00 48 c7 c0 a0 d0 f4 8c 49 c7 c0 c0 d0 f4 8c 4c 0f 44 c0 4c 89 f7 48 c7 c6 2f 96 94 8e 44 89 ea 4c 89 e1 <67> 48 0f b9 3a bd ea ff ff ff 0f 1f 44 00 00 e8 90 74 ee f9 65 8b [ 134.096135][ C0] RSP: 0018:ffffc90000007910 EFLAGS: 00010086 [ 134.098797][ C0] RAX: ffffffff8cf4d0a0 RBX: ffff888035b340e0 RCX: ffffffff8cf4ef80 [ 134.102171][ C0] RDX: 0000000000000081 RSI: ffffffff8e94962f RDI: ffffffff91cc2a90 [ 134.105612][ C0] RBP: dffffc0000000000 R08: ffffffff8cf4d0c0 R09: 0000000000000002 [ 134.108918][ C0] R10: 0000000000000003 R11: 0000000000000100 R12: ffffffff8cf4ef80 [ 134.112278][ C0] R13: 0000000000000081 R14: ffffffff91cc2a90 R15: ffff888035b340f8 [ 134.115575][ C0] hidg_set_alt+0x12a/0xa60 [ 134.117455][ C0] ? usb_gadget_set_state+0x12c/0x2d0 [ 134.119734][ C0] set_config+0x749/0x1160 [ 134.121647][ C0] composite_setup+0x1de7/0x3480 [ 134.123765][ C0] configfs_composite_setup+0xc7/0x100 [ 134.125996][ C0] dummy_timer+0x2f30/0x4ce0 [ 134.127938][ C0] ? rcu_is_watching+0x16/0xb0 [ 134.129884][ C0] ? __lock_acquire+0x747/0x2de0 [ 134.132011][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 134.134279][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 134.136383][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 134.138893][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 134.141073][ C0] __hrtimer_run_queues+0x3bc/0xa10 [ 134.143335][ C0] hrtimer_run_softirq+0x1e3/0x2e0 [ 134.145655][ C0] handle_softirqs+0x265/0x8d0 [ 134.147810][ C0] __irq_exit_rcu+0xc6/0x220 [ 134.149892][ C0] irq_exit_rcu+0x9/0x30 [ 134.151686][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 134.153943][ C0] [ 134.155259][ C0] [ 134.156428][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 134.158942][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 [ 134.161743][ C0] Code: f7 e8 6d 9f 9a f5 f7 c3 00 02 00 00 74 05 e8 20 52 c7 f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 a4 93 8b f5 65 48 8b 05 ac 01 d8 08 48 85 c0 74 18 5b 41 5e c3 [ 134.169770][ C0] RSP: 0018:ffffc9000022ef50 EFLAGS: 00000206 [ 134.172387][ C0] RAX: 0000000000000006 RBX: 0000000000000246 RCX: 8000000000000001 [ 134.175757][ C0] RDX: 0000000000000006 RSI: ffffffff8e6add33 RDI: 0000000000000001 [ 134.179056][ C0] RBP: 0000000000000007 R08: ffffffff91be2abf R09: 1ffffffff237c557 [ 134.182357][ C0] R10: dffffc0000000000 R11: fffffbfff237c558 R12: 1ffff11006944c95 [ 134.185779][ C0] R13: dffffc0000000000 R14: ffff888035b34000 R15: 0000000000000000 [ 134.189093][ C0] dummy_urb_enqueue+0x5a2/0x7a0 [ 134.191241][ C0] usb_hcd_submit_urb+0x328/0x1b60 [ 134.193449][ C0] usb_start_wait_urb+0x13f/0x5b0 [ 134.195666][ C0] ? rcu_is_watching+0x16/0xb0 [ 134.197787][ C0] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 134.200252][ C0] usb_control_msg+0x234/0x3e0 [ 134.202267][ C0] ? kfree+0x1c5/0x650 [ 134.204071][ C0] usb_set_configuration+0x12c5/0x2260 [ 134.206414][ C0] usb_generic_driver_probe+0x8d/0x150 [ 134.208737][ C0] usb_probe_device+0x1c3/0x3b0 [ 134.210647][ C0] ? __pfx_usb_probe_device+0x10/0x10 [ 134.212799][ C0] really_probe+0x254/0xae0 [ 134.214655][ C0] __driver_probe_device+0x1e8/0x360 [ 134.216740][ C0] driver_probe_device+0x4f/0x240 [ 134.218820][ C0] __device_attach_driver+0x270/0x410 [ 134.220957][ C0] bus_for_each_drv+0x258/0x2f0 [ 134.222834][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 134.225357][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 134.227530][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 134.229909][ C0] __device_attach+0x2bd/0x430 [ 134.231989][ C0] ? __pfx___device_attach+0x10/0x10 [ 134.234286][ C0] ? do_raw_spin_unlock+0x4d/0x200 [ 134.236539][ C0] ? _raw_spin_unlock+0x28/0x50 [ 134.239103][ C0] device_initial_probe+0x9c/0x100 [ 134.241401][ C0] __bus_probe_device+0x126/0x220 [ 134.243513][ C0] ? bus_probe_device+0xd/0x20 [ 134.247375][ C0] device_add+0x7d7/0xb80 [ 134.249320][ C0] usb_new_device+0x9aa/0x1690 [ 134.251485][ C0] ? __pfx_usb_new_device+0x10/0x10 [ 134.253723][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 134.255746][ C0] hub_event+0x28e8/0x4d30 [ 134.257666][ C0] ? do_raw_spin_unlock+0x4d/0x200 [ 134.260034][ C0] ? __pfx_hub_event+0x10/0x10 [ 134.262154][ C0] ? rcu_is_watching+0x16/0xb0 [ 134.264339][ C0] ? process_scheduled_works+0x97a/0x1630 [ 134.266872][ C0] process_scheduled_works+0xc3d/0x1630 [ 134.269383][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 134.272030][ C0] ? assign_work+0x3cf/0x5d0 [ 134.274071][ C0] worker_thread+0xa47/0xfb0 [ 134.276168][ C0] kthread+0x38b/0x480 [ 134.278041][ C0] ? __pfx_worker_thread+0x10/0x10 [ 134.280281][ C0] ? __pfx_kthread+0x10/0x10 [ 134.282400][ C0] ret_from_fork+0x514/0xb70 [ 134.284519][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 134.286797][ C0] ? __switch_to+0xc78/0x1410 [ 134.288898][ C0] ? __pfx_kthread+0x10/0x10 [ 134.290899][ C0] ret_from_fork_asm+0x1a/0x30 [ 134.292976][ C0] [ 134.294807][ C0] Kernel Offset: disabled [ 134.296788][ C0] Rebooting in 86400 seconds..