------------[ cut here ]------------
usb_ep_enable: ep129 (ep1in-bulk) has maxpacket 0
WARNING: CPU: 0 PID: 11220 at drivers/usb/gadget/udc/core.c:125 usb_ep_enable+0x27c/0x4d0 drivers/usb/gadget/udc/core.c:124
Modules linked in:
CPU: 0 PID: 11220 Comm: kworker/0:3 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: wg-crypt-wg1 wg_packet_decrypt_worker
RIP: 0010:usb_ep_enable+0x27c/0x4d0 drivers/usb/gadget/udc/core.c:124
Code: 49 8b 0e 48 c7 c0 80 cf 3e 8b 49 c7 c0 a0 cf 3e 8b 4c 0f 44 c0 48 c7 c7 40 cf 3e 8b 48 c7 c6 19 aa 63 8c 89 ea e8 d4 f4 ce fa <0f> 0b e9 c4 fe ff ff e8 78 6a 03 fb 49 bc 00 00 00 00 00 fc ff df
RSP: 0018:ffffc90000007788 EFLAGS: 00010046
RAX: c28656bb63374800 RBX: ffff888144fb00e0 RCX: ffff8880288f8000
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002
RBP: 0000000000000081 R08: ffff8880b8e279db R09: 1ffff110171c4f3b
R10: dffffc0000000000 R11: ffffed10171c4f3c R12: dffffc0000000000
R13: ffff888144fb010d R14: ffff888144fb00e8 R15: ffff888077fef73a
FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f87bb52b663 CR3: 000000007e41a000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
hidg_set_alt+0x126/0xa00 drivers/usb/gadget/function/f_hid.c:822
set_config+0x6e8/0xf70 drivers/usb/gadget/composite.c:986
composite_setup+0x194c/0x2b00 drivers/usb/gadget/composite.c:1893
configfs_composite_setup+0xc3/0x100 drivers/usb/gadget/configfs.c:1484
dummy_timer+0x12ea/0x3420 drivers/usb/gadget/udc/dummy_hcd.c:1936
__run_hrtimer kernel/time/hrtimer.c:1751 [inline]
__hrtimer_run_queues+0x522/0xc90 kernel/time/hrtimer.c:1815
hrtimer_run_softirq+0x173/0x290 kernel/time/hrtimer.c:1832
handle_softirqs+0x291/0x910 kernel/softirq.c:596
__do_softirq kernel/softirq.c:630 [inline]
invoke_softirq kernel/softirq.c:470 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x25/0x40 kernel/locking/spinlock.c:202
Code: 00 00 00 66 90 53 48 89 fb 48 83 c7 18 48 8b 74 24 08 e8 ae 45 2a f7 48 89 df e8 36 0d 2b f7 e8 21 5e 4e f7 fb bf 01 00 00 00 b6 88 1e f7 65 8b 05 27 3a c8 75 85 c0 74 02 5b c3 e8 34 4e c6
RSP: 0018:ffffc90005dafc30 EFLAGS: 00000286
RAX: c28656bb63374800 RBX: ffff8880b8e3a540 RCX: c28656bb63374800
RDX: dffffc0000000000 RSI: ffffffff8a8c17a0 RDI: 0000000000000001
RBP: ffffc90005dafdb8 R08: ffff8880b8e3a543 R09: 1ffff110171c74a8
R10: dffffc0000000000 R11: ffffed10171c74a9 R12: ffff8880b8e3a5a0
R13: dffffc0000000000 R14: 0000000000000000 R15: ffffe8ffffc92608
process_one_work+0x78c/0x1160 kernel/workqueue.c:2265
worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 00 66 90 add %ah,-0x70(%rsi)
5: 53 push %rbx
6: 48 89 fb mov %rdi,%rbx
9: 48 83 c7 18 add $0x18,%rdi
d: 48 8b 74 24 08 mov 0x8(%rsp),%rsi
12: e8 ae 45 2a f7 call 0xf72a45c5
17: 48 89 df mov %rbx,%rdi
1a: e8 36 0d 2b f7 call 0xf72b0d55
1f: e8 21 5e 4e f7 call 0xf74e5e45
24: fb sti
25: bf 01 00 00 00 mov $0x1,%edi
* 2a: e8 b6 88 1e f7 call 0xf71e88e5 <-- trapping instruction
2f: 65 8b 05 27 3a c8 75 mov %gs:0x75c83a27(%rip),%eax # 0x75c83a5d
36: 85 c0 test %eax,%eax
38: 74 02 je 0x3c
3a: 5b pop %rbx
3b: c3 ret
3c: e8 .byte 0xe8
3d: 34 4e xor $0x4e,%al
3f: c6 .byte 0xc6