program:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
mmap(&(0x7f0000871000/0x2000)=nil, 0x2000, 0xd, 0x11, 0xffffffffffffffff, 0xffffd000)
syz_emit_vhci(&(0x7f0000000580)=ANY=[@ANYRESHEX=0x0, @ANYRES16=r0], 0x17)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYBLOB="300000001800010000000000000000000a0000000000000000000000140005000000000000000000000000003b5c66d5"], 0x30}}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/direction\x00', 0x2, 0x0)
write(r2, &(0x7f0000000400)='1', 0x1)
symlinkat(&(0x7f0000000440)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/configs/c.1/midi2.usb0\x00')
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r3, &(0x7f0000000500)='dummy_udc.0', 0xb)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000"], 0xcc}, 0x1, 0x0, 0x0, 0x20048811}, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r4 = socket$nl_crypto(0x10, 0x3, 0x15)
sendmsg$nl_crypto(r4, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="e8000000120000052cbd7000fedbdf25647262675f6e6f70725f686d61635f7368613338340000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000024000000240000000000000000000008000100e40c0000"], 0xe8}}, 0x4800)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x29)
write(r5, &(0x7f0000000000)='7', 0x1)
r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r7 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
write$tun(r6, &(0x7f0000000440)={@val={0x6f01, 0x800}, @val={0x1, 0x4, 0x27, 0x0, 0x27}, @mpls={[], @ipv4=@tcp={{0xa, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffff20, @local, {[@timestamp_addr={0x44, 0x14, 0x5d, 0x1, 0x1, [{@private=0xa010102, 0xc}, {@multicast1, 0x2}]}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0x5, 0xc2, 0x700, 0x0, 0x1b}}}}}, 0x4a)
memfd_secret(0x0)
setns(r5, 0x2000080)
[ 94.711290][ T5287] Bluetooth: hci0: command tx timeout
[ 94.724263][ T5322] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[ 94.724300][ T5322] IPv6: NLM_F_CREATE should be set when creating new route
[ 94.900806][ T5323] netlink: 12 bytes leftover after parsing attributes in process `syz.0.0'.
[ 94.974418][ T5323] syz.0.0 uses obsolete (PF_INET,SOCK_PACKET)
[ 95.249371][ T807] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 95.400038][ T807] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.03
[ 95.405582][ T807] usb 5-1: Dual-Role OTG device on HNP port
[ 95.409101][ T807] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 95.426702][ T807] gspca_main: spca501-2.14.0 probing 0000:0000
[ 95.435785][ T807] gspca_spca501: reg write: error -32
[ 95.440092][ T807] spca501 5-1:1.0: Reg write failed for 0x02,0x0f,0x05
[ 95.443187][ T807] spca501 5-1:1.0: probe with driver spca501 failed with error -22
[ 95.450418][ C0] Oops: general protection fault, probably for non-canonical address 0xdffffc00000000e6: 0000 [#1] SMP KASAN NOPTI
[ 95.455102][ C0] KASAN: null-ptr-deref in range [0x0000000000000730-0x0000000000000737]
[ 95.458421][ C0] CPU: 0 UID: 0 PID: 807 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full)
[ 95.462163][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.466453][ C0] Workqueue: usb_hub_wq hub_event
[ 95.468760][ C0] RIP: 0010:f_midi2_stop_eps+0x28e/0x4d0
[ 95.471230][ C0] Code: 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 67 c6 5a fa 41 bf 30 07 00 00 4d 03 3e 4c 89 f8 48 c1 e8 03 48 89 44 24 18 <42> 0f b6 04 28 84 c0 0f 85 12 02 00 00 41 8b 1f 31 ff 89 de e8 39
[ 95.478951][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002
[ 95.481458][ C0] RAX: 00000000000000e6 RBX: ffff88801d0b8120 RCX: ffff88801d338000
[ 95.484734][ C0] RDX: 0000000000000100 RSI: 0000000000000100 RDI: ffffffff8c6da420
[ 95.487978][ C0] RBP: ffff88801d0b8100 R08: 0000000089eaa1f9 R09: 00000000c0a1fefb
[ 95.491198][ C0] R10: 0000000000000010 R11: ffffffff8ed5c6e0 R12: ffff88801d0b8730
[ 95.494625][ C0] R13: dffffc0000000000 R14: ffff88801d0b8128 R15: 0000000000000730
[ 95.498362][ C0] FS: 0000000000000000(0000) GS:ffff88808c2cd000(0000) knlGS:0000000000000000
[ 95.502069][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 95.504853][ C0] CR2: 00007f28f2bf00f5 CR3: 0000000012ae1000 CR4: 0000000000352ef0
[ 95.507844][ C0] Call Trace:
[ 95.509276][ C0]
[ 95.510525][ C0] f_midi2_set_alt+0x11c/0xf00
[ 95.512270][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 95.514175][ C0] composite_setup+0x1ffd/0x3480
[ 95.515962][ C0] configfs_composite_setup+0xc7/0x100
[ 95.517952][ C0] dummy_timer+0x2f43/0x4cf0
[ 95.519870][ C0] ? lock_acquire+0x115/0x350
[ 95.521894][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 95.524164][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 95.526358][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 95.528769][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 95.530776][ C0] __hrtimer_run_queues+0x3bc/0xa10
[ 95.532964][ C0] hrtimer_run_softirq+0x1e3/0x2e0
[ 95.535116][ C0] handle_softirqs+0x226/0x860
[ 95.537588][ C0] ? __irq_exit_rcu+0xcb/0x220
[ 95.539744][ C0] __irq_exit_rcu+0xcb/0x220
[ 95.541635][ C0] irq_exit_rcu+0x9/0x30
[ 95.543459][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0
[ 95.545757][ C0]
[ 95.546919][ C0]
[ 95.548096][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 95.550736][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80
[ 95.553534][ C0] Code: f7 e8 5d b5 ba f5 f7 c3 00 02 00 00 74 05 e8 60 03 e7 f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 f4 ce ab f5 65 48 8b 05 9c 21 ac 07 48 85 c0 74 18 5b 41 5e c3
[ 95.561624][ C0] RSP: 0018:ffffc90004386730 EFLAGS: 00000206
[ 95.564331][ C0] RAX: 0000000000000006 RBX: 0000000000000246 RCX: 8000000000000001
[ 95.568505][ C0] RDX: 0000000000000006 RSI: ffffffff8e477aa7 RDI: 0000000000000001
[ 95.572122][ C0] RBP: 0000000000000007 R08: ffffffff907a3a7f R09: 1ffffffff20f474f
[ 95.576087][ C0] R10: dffffc0000000000 R11: fffffbfff20f4750 R12: 0000000000000000
[ 95.580137][ C0] R13: dffffc0000000000 R14: ffff8880349ac000 R15: 1ffff11003f3b094
[ 95.583624][ C0] dummy_urb_enqueue+0x587/0x780
[ 95.585957][ C0] usb_hcd_submit_urb+0x328/0x1b60
[ 95.588393][ C0] usb_start_wait_urb+0x13f/0x5b0
[ 95.590602][ C0] ? __pfx_usb_start_wait_urb+0x10/0x10
[ 95.592970][ C0] usb_control_msg+0x234/0x3e0
[ 95.595041][ C0] usb_set_interface+0x521/0x1470
[ 95.597189][ C0] ? __kmalloc_cache_noprof+0x14d/0x600
[ 95.599546][ C0] snd_usb_midi_v2_create+0x621/0x4ac0
[ 95.601803][ C0] ? __pfx_proc_audio_usbid_read+0x10/0x10
[ 95.604143][ C0] ? snd_card_rw_proc_new+0x10d/0x140
[ 95.606502][ C0] ? __pfx_snd_usb_midi_v2_create+0x10/0x10
[ 95.608882][ C0] ? usb_ifnum_to_if+0x262/0x2f0
[ 95.610971][ C0] snd_usb_create_stream+0x262/0x630
[ 95.613175][ C0] usb_audio_probe+0x144c/0x2240
[ 95.615306][ C0] ? __pfx_usb_audio_probe+0x10/0x10
[ 95.617523][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 95.619924][ C0] usb_probe_interface+0x788/0xe50
[ 95.622151][ C0] ? __pfx_usb_probe_interface+0x10/0x10
[ 95.624455][ C0] ? sysfs_do_create_link_sd+0xe0/0x110
[ 95.626968][ C0] ? driver_sysfs_add+0x1fe/0x210
[ 95.629272][ C0] ? __pfx_usb_probe_interface+0x10/0x10
[ 95.631548][ C0] really_probe+0x254/0xae0
[ 95.633510][ C0] __driver_probe_device+0x1e8/0x360
[ 95.636167][ C0] driver_probe_device+0x4f/0x240
[ 95.638889][ C0] __device_attach_driver+0x270/0x410
[ 95.641285][ C0] bus_for_each_drv+0x258/0x2f0
[ 95.643419][ C0] ? __pfx___device_attach_driver+0x10/0x10
[ 95.646039][ C0] ? __pfx_bus_for_each_drv+0x10/0x10
[ 95.648364][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 95.650904][ C0] __device_attach+0x2c4/0x450
[ 95.653039][ C0] ? __pfx___device_attach+0x10/0x10
[ 95.655289][ C0] ? do_raw_spin_unlock+0x4d/0x200
[ 95.657391][ C0] ? _raw_spin_unlock+0x28/0x50
[ 95.659544][ C0] device_initial_probe+0xa1/0xd0
[ 95.661751][ C0] bus_probe_device+0x12a/0x220
[ 95.663922][ C0] device_add+0x7d7/0xb80
[ 95.665771][ C0] usb_set_configuration+0x1ad8/0x2180
[ 95.668058][ C0] usb_generic_driver_probe+0x8d/0x150
[ 95.670295][ C0] usb_probe_device+0x1c3/0x3b0
[ 95.672397][ C0] ? __pfx_usb_probe_device+0x10/0x10
[ 95.674662][ C0] really_probe+0x254/0xae0
[ 95.676627][ C0] __driver_probe_device+0x1e8/0x360
[ 95.678819][ C0] driver_probe_device+0x4f/0x240
[ 95.681034][ C0] __device_attach_driver+0x270/0x410
[ 95.683530][ C0] bus_for_each_drv+0x258/0x2f0
[ 95.685831][ C0] ? __pfx___device_attach_driver+0x10/0x10
[ 95.688449][ C0] ? __pfx_bus_for_each_drv+0x10/0x10
[ 95.690766][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 95.693284][ C0] __device_attach+0x2c4/0x450
[ 95.695321][ C0] ? __pfx___device_attach+0x10/0x10
[ 95.697523][ C0] ? do_raw_spin_unlock+0x4d/0x200
[ 95.699723][ C0] ? _raw_spin_unlock+0x28/0x50
[ 95.701814][ C0] device_initial_probe+0xa1/0xd0
[ 95.703921][ C0] bus_probe_device+0x12a/0x220
[ 95.706054][ C0] device_add+0x7d7/0xb80
[ 95.707920][ C0] usb_new_device+0x9aa/0x1690
[ 95.709984][ C0] ? __pfx_usb_new_device+0x10/0x10
[ 95.712178][ C0] ? _raw_spin_unlock_irq+0x23/0x50
[ 95.714552][ C0] hub_event+0x28e8/0x4d30
[ 95.716522][ C0] ? do_raw_spin_unlock+0x4d/0x200
[ 95.718597][ C0] ? __pfx_hub_event+0x10/0x10
[ 95.720551][ C0] ? rcu_is_watching+0x16/0xb0
[ 95.722495][ C0] ? process_scheduled_works+0x97a/0x1630
[ 95.724774][ C0] process_scheduled_works+0xc3d/0x1630
[ 95.727207][ C0] ? __pfx_process_scheduled_works+0x10/0x10
[ 95.729746][ C0] ? assign_work+0x3cf/0x5d0
[ 95.731781][ C0] worker_thread+0xa47/0xfb0
[ 95.733899][ C0] kthread+0x38b/0x480
[ 95.735708][ C0] ? __pfx_worker_thread+0x10/0x10
[ 95.737782][ C0] ? __pfx_kthread+0x10/0x10
[ 95.739807][ C0] ret_from_fork+0x514/0xb70
[ 95.741821][ C0] ? __pfx_ret_from_fork+0x10/0x10
[ 95.743968][ C0] ? __switch_to+0xc89/0x1420
[ 95.745918][ C0] ? __pfx_kthread+0x10/0x10
[ 95.747823][ C0] ret_from_fork_asm+0x1a/0x30
[ 95.749814][ C0]
[ 95.751158][ C0] Modules linked in:
[ 95.752826][ C0] ---[ end trace 0000000000000000 ]---
[ 95.755174][ C0] RIP: 0010:f_midi2_stop_eps+0x28e/0x4d0
[ 95.755196][ C0] Code: 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 67 c6 5a fa 41 bf 30 07 00 00 4d 03 3e 4c 89 f8 48 c1 e8 03 48 89 44 24 18 <42> 0f b6 04 28 84 c0 0f 85 12 02 00 00 41 8b 1f 31 ff 89 de e8 39
[ 95.755207][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002
[ 95.755218][ C0] RAX: 00000000000000e6 RBX: ffff88801d0b8120 RCX: ffff88801d338000
[ 95.755226][ C0] RDX: 0000000000000100 RSI: 0000000000000100 RDI: ffffffff8c6da420
[ 95.755233][ C0] RBP: ffff88801d0b8100 R08: 0000000089eaa1f9 R09: 00000000c0a1fefb
[ 95.755242][ C0] R10: 0000000000000010 R11: ffffffff8ed5c6e0 R12: ffff88801d0b8730
[ 95.755250][ C0] R13: dffffc0000000000 R14: ffff88801d0b8128 R15: 0000000000000730
[ 95.755257][ C0] FS: 0000000000000000(0000) GS:ffff88808c2cd000(0000) knlGS:0000000000000000
[ 95.755266][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 95.755273][ C0] CR2: 00007f28f2bf00f5 CR3: 0000000012ae1000 CR4: 0000000000352ef0
[ 95.755311][ C0] Kernel panic - not syncing: Fatal exception in interrupt
[ 95.797486][ C0] Kernel Offset: disabled
[ 95.799323][ C0] Rebooting in 86400 seconds..