------------[ cut here ]------------ usb_ep_enable: ep129 (ep1in-bulk) has maxpacket 0 WARNING: drivers/usb/gadget/udc/core.c:125 at usb_ep_enable+0x148/0x480 drivers/usb/gadget/udc/core.c:124, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:usb_ep_enable+0x1bc/0x480 drivers/usb/gadget/udc/core.c:124 Code: 8a 0b 02 fb 49 83 3f 00 48 c7 c0 80 b6 1f 8c 49 c7 c0 a0 b6 1f 8c 4c 0f 44 c0 4c 89 f7 48 c7 c6 d1 56 b0 8d 44 89 ea 4c 89 e1 <67> 48 0f b9 3a bd ea ff ff ff 0f 1f 44 00 00 e8 70 98 98 fa 65 8b RSP: 0018:ffffc900001576b8 EFLAGS: 00010282 RAX: ffffffff8c1fb680 RBX: ffff888024c6c120 RCX: ffffffff8c1fd500 RDX: 0000000000000081 RSI: ffffffff8db056d1 RDI: ffffffff8fbca760 RBP: dffffc0000000000 R08: ffffffff8c1fb6a0 R09: 0000000000000100 R10: 0000000000000100 R11: 0000000000000003 R12: ffffffff8c1fd500 R13: 0000000000000081 R14: ffffffff8fbca760 R15: ffff888024c6c138 FS: 0000000000000000(0000) GS:ffff888125c3e000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f00a72cb700 CR3: 000000003ca22000 CR4: 00000000003526f0 Call Trace: hidg_set_alt+0x12a/0xa50 drivers/usb/gadget/function/f_hid.c:1042 set_config+0x749/0x1160 drivers/usb/gadget/composite.c:1018 composite_setup+0x1de7/0x3480 drivers/usb/gadget/composite.c:1901 configfs_composite_setup+0xbd/0x100 drivers/usb/gadget/configfs.c:1877 dummy_timer+0x2f77/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:1951 __run_hrtimer kernel/time/hrtimer.c:2032 [inline] __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2096 hrtimer_run_softirq+0x18f/0x260 kernel/time/hrtimer.c:2113 handle_softirqs+0x1d9/0x6c0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x57c/0xa80 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ---------------- Code disassembly (best guess): 0: 8a 0b mov (%rbx),%cl 2: 02 fb add %bl,%bh 4: 49 83 3f 00 cmpq $0x0,(%r15) 8: 48 c7 c0 80 b6 1f 8c mov $0xffffffff8c1fb680,%rax f: 49 c7 c0 a0 b6 1f 8c mov $0xffffffff8c1fb6a0,%r8 16: 4c 0f 44 c0 cmove %rax,%r8 1a: 4c 89 f7 mov %r14,%rdi 1d: 48 c7 c6 d1 56 b0 8d mov $0xffffffff8db056d1,%rsi 24: 44 89 ea mov %r13d,%edx 27: 4c 89 e1 mov %r12,%rcx * 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction 2f: bd ea ff ff ff mov $0xffffffea,%ebp 34: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) 39: e8 70 98 98 fa call 0xfa9898ae 3e: 65 gs 3f: 8b .byte 0x8b