------------[ cut here ]------------
usb_ep_enable: ep129 (ep1in-bulk) has maxpacket 0
WARNING: CPU: 1 PID: 316 at drivers/usb/gadget/udc/core.c:134 usb_ep_enable+0x210/0x3c0 drivers/usb/gadget/udc/core.c:133
Modules linked in:
CPU: 1 UID: 0 PID: 316 Comm: udevd Not tainted syzkaller #0 c6d530d213d6421e3ceaeda0202ca36fa97e3e13
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
RIP: 0010:usb_ep_enable+0x210/0x3c0 drivers/usb/gadget/udc/core.c:133
Code: 4d 00 48 c7 c0 20 bd 6d 86 49 c7 c0 40 bd 6d 86 4c 0f 44 c0 48 c7 c7 e0 bc 6d 86 48 c7 c6 28 c9 1f 87 44 89 f2 e8 40 1e 47 fd <0f> 0b e9 4c ff ff ff e8 c4 28 cc fd 49 bc 00 00 00 00 00 fc ff df
RSP: 0018:ffffc90000230878 EFLAGS: 00010046
RAX: d24da9577cf17800 RBX: ffff88810faec0b0 RCX: ffff88810e320000
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002
RBP: ffffc900002308a0 R08: ffff8881f6d29593 R09: 1ffff1103eda52b2
R10: dffffc0000000000 R11: ffffed103eda52b3 R12: dffffc0000000000
R13: ffff88810faec0b8 R14: 0000000000000081 R15: ffff8881170155ba
FS: 00007f6ffa418880(0000) GS:ffff8881f6d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000001304ea000 CR4: 00000000003526b0
Call Trace:
hidg_set_alt+0x138/0xa70 drivers/usb/gadget/function/f_hid.c:1057
set_config+0x812/0xd10 drivers/usb/gadget/composite.c:1021
composite_setup+0x18b0/0x3320 drivers/usb/gadget/composite.c:1930
configfs_composite_setup+0xc6/0x110 drivers/usb/gadget/configfs.c:1883
dummy_timer+0x2eeb/0x4900 drivers/usb/gadget/udc/dummy_hcd.c:1935
__run_hrtimer kernel/time/hrtimer.c:1758 [inline]
__hrtimer_run_queues+0x3ae/0x8e0 kernel/time/hrtimer.c:1822
hrtimer_run_softirq+0x159/0x560 kernel/time/hrtimer.c:1839
handle_softirqs+0x1ad/0x5b0 kernel/softirq.c:684
__do_softirq kernel/softirq.c:722 [inline]
invoke_softirq kernel/softirq.c:539 [inline]
__irq_exit_rcu+0x47/0xb0 kernel/softirq.c:771
irq_exit_rcu+0xd/0x30 kernel/softirq.c:783
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0x82/0x90 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:702
RIP: 0010:is_kernel_text include/linux/kallsyms.h:29 [inline]
RIP: 0010:core_kernel_text kernel/extable.c:68 [inline]
RIP: 0010:kernel_text_address+0x27/0xe0 kernel/extable.c:99
Code: 90 90 90 66 0f 1f 00 55 48 89 e5 41 57 41 56 53 48 81 ff 00 00 00 81 0f 93 c0 48 81 ff 00 00 e0 85 0f 92 c1 41 be 01 00 00 00 <84> c8 75 0c 48 89 fb e8 fd 02 b2 ff 85 c0 74 0f 44 89 f0 5b 41 5e
RSP: 0018:ffffc9000b7ef820 EFLAGS: 00000283
RAX: 0000000000000001 RBX: ffffffff81cc3b79 RCX: 00000000016fdf01
RDX: ffffc9000b7efc98 RSI: 1ffff920016fdf12 RDI: ffffffff81cc3b79
RBP: ffffc9000b7ef838 R08: ffffc9000b7ef950 R09: ffffc9000b7ef948
R10: 0000000000000003 R11: ffffffff817782a0 R12: ffff88810e320000
R13: 0000000000000000 R14: 0000000000000001 R15: 1ffff920016fdf1a
__kernel_text_address+0x11/0x40 kernel/extable.c:79
unwind_get_return_address+0x51/0x90 arch/x86/kernel/unwind_frame.c:19
arch_stack_walk+0x10a/0x170 arch/x86/kernel/stacktrace.c:26
stack_trace_save+0xaa/0x100 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:49 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:70
kasan_save_free_info+0x44/0x50 mm/kasan/generic.c:579
poison_slab_object mm/kasan/common.c:249 [inline]
__kasan_slab_free+0x5f/0x80 mm/kasan/common.c:266
kasan_slab_free include/linux/kasan.h:234 [inline]
slab_free_hook mm/slub.c:2445 [inline]
slab_free mm/slub.c:4716 [inline]
kfree+0x158/0x440 mm/slub.c:4877
kvfree+0x39/0x50 mm/util.c:716
path_setxattr+0x4eb/0x5a0 fs/xattr.c:668
__do_sys_lsetxattr fs/xattr.c:683 [inline]
__se_sys_lsetxattr fs/xattr.c:679 [inline]
__x64_sys_lsetxattr+0xc6/0xe0 fs/xattr.c:679
x64_sys_call+0x2db8/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:190
do_syscall_x64 arch/x86/entry/common.c:47 [inline]
do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f6ff9d1d57a
Code: 48 83 c4 08 48 89 d8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 66 0f 1f 44 00 00 31 db eb e4 0f 1f 40 00 49 89 ca b8 bd 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 4e 38 0d 00 f7 d8 64 89 01 48
RSP: 002b:00007fff3c0f66f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd
RAX: ffffffffffffffda RBX: 0000561655baf660 RCX: 00007f6ff9d1d57a
RDX: 0000561655baf660 RSI: 00007f6ffa4d829c RDI: 0000561655972660
RBP: 000056165596f8d0 R08: 0000000000000000 R09: 0000000000000030
R10: 000000000000001f R11: 0000000000000246 R12: 0000561655972660
R13: 0000000000000001 R14: 0000561655972660 R15: 0000561655bc5c80
---[ end trace 0000000000000000 ]---
configfs-gadget.g1 gadget.0: Enable IN endpoint FAILED!
----------------
Code disassembly (best guess):
0: 90 nop
1: 90 nop
2: 90 nop
3: 66 0f 1f 00 nopw (%rax)
7: 55 push %rbp
8: 48 89 e5 mov %rsp,%rbp
b: 41 57 push %r15
d: 41 56 push %r14
f: 53 push %rbx
10: 48 81 ff 00 00 00 81 cmp $0xffffffff81000000,%rdi
17: 0f 93 c0 setae %al
1a: 48 81 ff 00 00 e0 85 cmp $0xffffffff85e00000,%rdi
21: 0f 92 c1 setb %cl
24: 41 be 01 00 00 00 mov $0x1,%r14d
* 2a: 84 c8 test %cl,%al <-- trapping instruction
2c: 75 0c jne 0x3a
2e: 48 89 fb mov %rdi,%rbx
31: e8 fd 02 b2 ff call 0xffb20333
36: 85 c0 test %eax,%eax
38: 74 0f je 0x49
3a: 44 89 f0 mov %r14d,%eax
3d: 5b pop %rbx
3e: 41 5e pop %r14