------------[ cut here ]------------
usb_ep_enable: ep129 (ep1in-bulk) has maxpacket 0
WARNING: CPU: 1 PID: 5056 at drivers/usb/gadget/udc/core.c:125 usb_ep_enable+0x27c/0x4d0 drivers/usb/gadget/udc/core.c:124
Modules linked in:
CPU: 1 PID: 5056 Comm: kworker/1:8 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: pm hcd_resume_work
RIP: 0010:usb_ep_enable+0x27c/0x4d0 drivers/usb/gadget/udc/core.c:124
Code: 49 8b 0e 48 c7 c0 80 cf 3e 8b 49 c7 c0 a0 cf 3e 8b 4c 0f 44 c0 48 c7 c7 40 cf 3e 8b 48 c7 c6 19 aa 63 8c 89 ea e8 d4 f4 ce fa <0f> 0b e9 c4 fe ff ff e8 78 6a 03 fb 49 bc 00 00 00 00 00 fc ff df
RSP: 0018:ffffc900001e0788 EFLAGS: 00010046
RAX: d58bf64ae7d7f200 RBX: ffff8881453400e0 RCX: ffff88802e538000
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002
RBP: 0000000000000081 R08: ffff8880b8f279db R09: 1ffff110171e4f3b
R10: dffffc0000000000 R11: ffffed10171e4f3c R12: dffffc0000000000
R13: ffff88814534010d R14: ffff8881453400e8 R15: ffff88807a0ba5ba
FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb561a21a90 CR3: 000000002eb79000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
hidg_set_alt+0x126/0xa00 drivers/usb/gadget/function/f_hid.c:822
set_config+0x6e8/0xf70 drivers/usb/gadget/composite.c:986
composite_setup+0x194c/0x2b00 drivers/usb/gadget/composite.c:1893
configfs_composite_setup+0xc3/0x100 drivers/usb/gadget/configfs.c:1484
dummy_timer+0x12ea/0x3420 drivers/usb/gadget/udc/dummy_hcd.c:1936
__run_hrtimer kernel/time/hrtimer.c:1751 [inline]
__hrtimer_run_queues+0x522/0xc90 kernel/time/hrtimer.c:1815
hrtimer_run_softirq+0x173/0x290 kernel/time/hrtimer.c:1832
handle_softirqs+0x291/0x910 kernel/softirq.c:596
__do_softirq kernel/softirq.c:630 [inline]
invoke_softirq kernel/softirq.c:470 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:on_stack arch/x86/include/asm/stacktrace.h:60 [inline]
RIP: 0010:unwind_next_frame+0x1694/0x1fd0 arch/x86/kernel/unwind_orc.c:622
Code: 03 42 80 3c 28 00 74 08 4c 89 f7 e8 c6 49 9a 00 49 8b 06 4d 39 fc 0f 96 c1 4c 39 f8 0f 97 c2 20 ca 80 fa 01 75 7f 49 8d 4f 08 <4c> 39 e1 76 76 48 39 c1 77 71 4c 3b 7c 24 68 77 6a 4c 8d 73 28 4c
RSP: 0018:ffffc9001aeaefe0 EFLAGS: 00000246
RAX: ffffc9001aeb0000 RBX: ffffc9001aeaf088 RCX: ffffc9001aeaff18
RDX: ffffc9001aeaf001 RSI: dffffc0000000000 RDI: ffffc9001aeaf090
RBP: dffffc0000000000 R08: ffffc9001aeaff00 R09: ffffc9001aeaf0d8
R10: dffffc0000000000 R11: fffff520035d5e1d R12: ffffc9001aea8000
R13: dffffc0000000000 R14: ffffc9001aeaf098 R15: ffffc9001aeaff10
arch_stack_walk+0x10c/0x140 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0xa6/0xf0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:46 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:516
____kasan_slab_free+0x126/0x1f0 mm/kasan/common.c:237
kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1729 [inline]
slab_free_freelist_hook+0x133/0x1b0 mm/slub.c:1755
slab_free mm/slub.c:3687 [inline]
__kmem_cache_free+0xb6/0x200 mm/slub.c:3700
rh_call_control drivers/usb/core/hcd.c:730 [inline]
rh_urb_enqueue drivers/usb/core/hcd.c:846 [inline]
usb_hcd_submit_urb+0x1126/0x1970 drivers/usb/core/hcd.c:1554
usb_start_wait_urb+0x13c/0x580 drivers/usb/core/message.c:61
usb_internal_control_msg drivers/usb/core/message.c:116 [inline]
usb_control_msg+0x231/0x3e0 drivers/usb/core/message.c:166
get_port_status drivers/usb/core/hub.c:609 [inline]
hub_ext_port_status+0x103/0x6c0 drivers/usb/core/hub.c:626
usb_hub_port_status drivers/usb/core/hub.c:648 [inline]
hub_activate+0x73e/0x1ae0 drivers/usb/core/hub.c:1159
hub_resume+0xa2/0x360 drivers/usb/core/hub.c:3999
usb_resume_interface drivers/usb/core/driver.c:1359 [inline]
usb_resume_both+0x5e7/0xaf0 drivers/usb/core/driver.c:1519
__rpm_callback+0x2fd/0x790 drivers/base/power/runtime.c:395
rpm_callback drivers/base/power/runtime.c:532 [inline]
rpm_resume+0x10fa/0x1b90 drivers/base/power/runtime.c:912
__pm_runtime_resume+0x118/0x170 drivers/base/power/runtime.c:1170
pm_runtime_get_sync include/linux/pm_runtime.h:435 [inline]
usb_autoresume_device+0x1f/0x60 drivers/usb/core/driver.c:1707
usb_remote_wakeup+0x66/0xf0 drivers/usb/core/hub.c:3837
process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
----------------
Code disassembly (best guess):
0: 03 42 80 add -0x80(%rdx),%eax
3: 3c 28 cmp $0x28,%al
5: 00 74 08 4c add %dh,0x4c(%rax,%rcx,1)
9: 89 f7 mov %esi,%edi
b: e8 c6 49 9a 00 call 0x9a49d6
10: 49 8b 06 mov (%r14),%rax
13: 4d 39 fc cmp %r15,%r12
16: 0f 96 c1 setbe %cl
19: 4c 39 f8 cmp %r15,%rax
1c: 0f 97 c2 seta %dl
1f: 20 ca and %cl,%dl
21: 80 fa 01 cmp $0x1,%dl
24: 75 7f jne 0xa5
26: 49 8d 4f 08 lea 0x8(%r15),%rcx
* 2a: 4c 39 e1 cmp %r12,%rcx <-- trapping instruction
2d: 76 76 jbe 0xa5
2f: 48 39 c1 cmp %rax,%rcx
32: 77 71 ja 0xa5
34: 4c 3b 7c 24 68 cmp 0x68(%rsp),%r15
39: 77 6a ja 0xa5
3b: 4c 8d 73 28 lea 0x28(%rbx),%r14
3f: 4c rex.WR