program: mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/direction\x00', 0x1, 0x0) write(r0, &(0x7f00000002c0)='1', 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/num_groups\x00', 0x1, 0x0) write(r1, &(0x7f0000000380)='2', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/midi1_num_groups\x00', 0x1, 0x0) write(r2, &(0x7f0000000440)='2', 0x1) symlinkat(&(0x7f0000000880)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000008c0)='./my_configfs/usb_gadget/g1/configs/c.1/midi2.usb0\x00') r3 = socket(0x1, 0x5, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000200)=0x5) setreuid(r4, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xfc778000) futex(&(0x7f000000cffc)=0x4, 0x9, 0x4, 0x0, 0x0, 0x80000000) setpriority(0x2, 0xff, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./my_configfs/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r5, &(0x7f0000000940)='dummy_udc.0', 0xb) [ 103.871890][ T5291] Bluetooth: hci0: command tx timeout [ 104.535440][ T9] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 104.689061][ T9] usb 5-1: Dual-Role OTG device on HNP port [ 104.692914][ T9] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.02 [ 104.698564][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 104.751816][ T9] gspca_main: spca501-2.14.0 probing 0000:0000 [ 104.759404][ T9] gspca_spca501: reg write: error -32 [ 104.763725][ T9] spca501 5-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 104.768276][ T9] spca501 5-1:1.0: probe with driver spca501 failed with error -22 [ 104.781884][ C0] Oops: general protection fault, probably for non-canonical address 0xdffffc00000000e6: 0000 [#1] SMP KASAN NOPTI [ 104.788075][ C0] KASAN: null-ptr-deref in range [0x0000000000000730-0x0000000000000737] [ 104.792570][ C0] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full) [ 104.798420][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 104.805004][ C0] Workqueue: usb_hub_wq hub_event [ 104.808404][ C0] RIP: 0010:f_midi2_stop_eps+0x28e/0x4d0 [ 104.811525][ C0] Code: 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 e7 57 64 fa 41 bf 30 07 00 00 4d 03 3e 4c 89 f8 48 c1 e8 03 48 89 44 24 18 <42> 0f b6 04 28 84 c0 0f 85 12 02 00 00 41 8b 1f 31 ff 89 de e8 59 [ 104.821320][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002 [ 104.824366][ C0] RAX: 00000000000000e6 RBX: ffff88801fcb4120 RCX: ffff88801bf0ca80 [ 104.828295][ C0] RDX: 0000000000000100 RSI: ffffffff8c4bed60 RDI: ffffffff8c4bed20 [ 104.832399][ C0] RBP: ffff88801fcb4100 R08: 00000000eec25786 R09: 00000000d502b5d3 [ 104.836349][ C0] R10: 0000000000000010 R11: ffffffff8eb59c60 R12: ffff88801fcb4730 [ 104.840178][ C0] R13: dffffc0000000000 R14: ffff88801fcb4128 R15: 0000000000000730 [ 104.844158][ C0] FS: 0000000000000000(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 104.848768][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 104.851810][ C0] CR2: 00007f46154400f5 CR3: 000000001f5a5000 CR4: 0000000000352ef0 [ 104.855780][ C0] Call Trace: [ 104.857537][ C0] [ 104.858973][ C0] f_midi2_set_alt+0x11c/0xf00 [ 104.861531][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 104.864248][ C0] composite_setup+0x1ffd/0x3480 [ 104.866795][ C0] configfs_composite_setup+0xc7/0x100 [ 104.869651][ C0] dummy_timer+0x2f43/0x4cf0 [ 104.871938][ C0] ? __lock_acquire+0x683/0x2cf0 [ 104.874238][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 104.876650][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 104.878988][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 104.881901][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 104.884307][ C0] __hrtimer_run_queues+0x3bc/0xa10 [ 104.886839][ C0] hrtimer_run_softirq+0x17a/0x240 [ 104.889148][ C0] handle_softirqs+0x225/0x840 [ 104.891371][ C0] ? __irq_exit_rcu+0xca/0x220 [ 104.893597][ C0] __irq_exit_rcu+0xca/0x220 [ 104.895696][ C0] irq_exit_rcu+0x9/0x30 [ 104.897624][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 104.900052][ C0] [ 104.901440][ C0] [ 104.902972][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 104.905764][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 [ 104.908649][ C0] Code: f7 e8 8d 6d cd f5 f7 c3 00 02 00 00 74 05 e8 b0 5e f9 f5 9c 58 a9 00 02 00 00 75 27 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 24 81 be f5 65 8b 05 1d 01 98 07 85 c0 74 18 5b 41 5e e9 81 48 [ 104.917170][ C0] RSP: 0018:ffffc9000022e7f0 EFLAGS: 00000206 [ 104.920020][ C0] RAX: 0000000000000002 RBX: 0000000000000246 RCX: 0000000080000001 [ 104.923757][ C0] RDX: 0000000000000006 RSI: ffffffff8e231fc8 RDI: 0000000000000001 [ 104.927179][ C0] RBP: 0000000000000007 R08: ffffffff9057c237 R09: 1ffffffff20af846 [ 104.930695][ C0] R10: dffffc0000000000 R11: fffffbfff20af847 R12: 0000000000000000 [ 104.934446][ C0] R13: dffffc0000000000 R14: ffff8880340a4000 R15: 1ffff11003ef6694 [ 104.937970][ C0] dummy_urb_enqueue+0x587/0x780 [ 104.940208][ C0] usb_hcd_submit_urb+0x328/0x1b60 [ 104.942549][ C0] usb_start_wait_urb+0x13f/0x5b0 [ 104.945000][ C0] ? trace_kmalloc+0x2a/0xf0 [ 104.947578][ C0] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 104.950468][ C0] usb_control_msg+0x234/0x3e0 [ 104.953082][ C0] usb_set_interface+0x521/0x1470 [ 104.955368][ C0] snd_usb_midi_v2_create+0x621/0x4ac0 [ 104.957930][ C0] ? __pfx_proc_audio_usbid_read+0x10/0x10 [ 104.960707][ C0] ? snd_card_rw_proc_new+0x10d/0x140 [ 104.963493][ C0] ? __pfx_snd_usb_midi_v2_create+0x10/0x10 [ 104.966738][ C0] ? usb_ifnum_to_if+0x262/0x2f0 [ 104.969245][ C0] snd_usb_create_stream+0x262/0x630 [ 104.971634][ C0] usb_audio_probe+0x1447/0x2280 [ 104.974385][ C0] ? __pfx_usb_audio_probe+0x10/0x10 [ 104.977838][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 104.981145][ C0] usb_probe_interface+0x653/0xc60 [ 104.983354][ C0] ? __pfx_usb_probe_interface+0x10/0x10 [ 104.985819][ C0] really_probe+0x254/0xae0 [ 104.987966][ C0] __driver_probe_device+0x1e8/0x360 [ 104.990379][ C0] driver_probe_device+0x4f/0x240 [ 104.992605][ C0] __device_attach_driver+0x270/0x410 [ 104.994921][ C0] bus_for_each_drv+0x258/0x2f0 [ 104.997062][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 104.999921][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 105.002458][ C0] ? lockdep_hardirqs_on+0x7a/0x110 [ 105.005168][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 105.007952][ C0] __device_attach+0x2c4/0x450 [ 105.010091][ C0] ? __pfx___device_attach+0x10/0x10 [ 105.012885][ C0] ? do_raw_spin_unlock+0x4d/0x210 [ 105.015588][ C0] ? _raw_spin_unlock+0x28/0x50 [ 105.017912][ C0] device_initial_probe+0xa1/0xd0 [ 105.020143][ C0] bus_probe_device+0x12a/0x220 [ 105.022254][ C0] device_add+0x7d7/0xb80 [ 105.024558][ C0] usb_set_configuration+0x1ad8/0x2180 [ 105.027605][ C0] usb_generic_driver_probe+0x8d/0x150 [ 105.030383][ C0] usb_probe_device+0x1c3/0x3b0 [ 105.032477][ C0] ? __pfx_usb_probe_device+0x10/0x10 [ 105.034923][ C0] really_probe+0x254/0xae0 [ 105.036858][ C0] __driver_probe_device+0x1e8/0x360 [ 105.039368][ C0] driver_probe_device+0x4f/0x240 [ 105.041982][ C0] __device_attach_driver+0x270/0x410 [ 105.044993][ C0] bus_for_each_drv+0x258/0x2f0 [ 105.047197][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 105.049667][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 105.051945][ C0] ? lockdep_hardirqs_on+0x7a/0x110 [ 105.054227][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 105.056939][ C0] __device_attach+0x2c4/0x450 [ 105.059295][ C0] ? __pfx___device_attach+0x10/0x10 [ 105.061619][ C0] ? do_raw_spin_unlock+0x4d/0x210 [ 105.063834][ C0] ? _raw_spin_unlock+0x28/0x50 [ 105.065855][ C0] device_initial_probe+0xa1/0xd0 [ 105.067843][ C0] bus_probe_device+0x12a/0x220 [ 105.069797][ C0] device_add+0x7d7/0xb80 [ 105.071967][ C0] usb_new_device+0x99d/0x1620 [ 105.074399][ C0] ? __pfx_usb_new_device+0x10/0x10 [ 105.077111][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 105.079637][ C0] hub_event+0x28e8/0x4d30 [ 105.081588][ C0] ? do_raw_spin_unlock+0x4d/0x210 [ 105.083633][ C0] ? __pfx_hub_event+0x10/0x10 [ 105.085793][ C0] ? process_scheduled_works+0xa20/0x14e0 [ 105.088646][ C0] ? rcu_is_watching+0x15/0xb0 [ 105.091096][ C0] ? process_scheduled_works+0xa20/0x14e0 [ 105.094015][ C0] process_scheduled_works+0xa8e/0x14e0 [ 105.097122][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 105.100654][ C0] ? assign_work+0x3cf/0x5d0 [ 105.103126][ C0] worker_thread+0xa47/0xfb0 [ 105.105263][ C0] kthread+0x388/0x470 [ 105.107922][ C0] ? __pfx_worker_thread+0x10/0x10 [ 105.111092][ C0] ? __pfx_kthread+0x10/0x10 [ 105.113400][ C0] ret_from_fork+0x514/0xb70 [ 105.115452][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 105.117813][ C0] ? __switch_to+0xc89/0x1420 [ 105.120141][ C0] ? __pfx_kthread+0x10/0x10 [ 105.122559][ C0] ret_from_fork_asm+0x1a/0x30 [ 105.125286][ C0] [ 105.127011][ C0] Modules linked in: [ 105.128942][ C0] ---[ end trace 0000000000000000 ]--- [ 105.131299][ C0] RIP: 0010:f_midi2_stop_eps+0x28e/0x4d0 [ 105.133822][ C0] Code: 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 e7 57 64 fa 41 bf 30 07 00 00 4d 03 3e 4c 89 f8 48 c1 e8 03 48 89 44 24 18 <42> 0f b6 04 28 84 c0 0f 85 12 02 00 00 41 8b 1f 31 ff 89 de e8 59 [ 105.143935][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002 [ 105.146678][ C0] RAX: 00000000000000e6 RBX: ffff88801fcb4120 RCX: ffff88801bf0ca80 [ 105.150014][ C0] RDX: 0000000000000100 RSI: ffffffff8c4bed60 RDI: ffffffff8c4bed20 [ 105.153588][ C0] RBP: ffff88801fcb4100 R08: 00000000eec25786 R09: 00000000d502b5d3 [ 105.157791][ C0] R10: 0000000000000010 R11: ffffffff8eb59c60 R12: ffff88801fcb4730 [ 105.162307][ C0] R13: dffffc0000000000 R14: ffff88801fcb4128 R15: 0000000000000730 [ 105.165897][ C0] FS: 0000000000000000(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 105.170265][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 105.174404][ C0] CR2: 00007f46154400f5 CR3: 000000001f5a5000 CR4: 0000000000352ef0 [ 105.178893][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 105.182507][ C0] Kernel Offset: disabled [ 105.184819][ C0] Rebooting in 86400 seconds..