program:
r0 = socket$rds(0x15, 0x5, 0x0)
bind$rds(r0, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000003280)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x16, 0xb, &(0x7f0000000140)=@framed={{0x18, 0x5, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x3}, [@printk={@s, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x8}}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r2, 0xfffff000, 0xe, 0x0, &(0x7f0000000300)="882f1242a03c3f98722780b605a7", 0x0, 0x990d, 0x7000000, 0x0, 0x0, 0x0, 0x0}, 0x50)
sendmsg$nl_xfrm(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="fc00000019000100000000000000000000000000000000000000000000000000fc01000000000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000b93760000000000000000000000000000000000000000000200000000000000010000000000000044000500ac141400000000000000000000000000000000003c"], 0xfc}, 0x1, 0x0, 0x0, 0x24008040}, 0x20040000)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}, 0x1, 0x0, 0x0, 0x20048811}, 0x0)
r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0)
ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r5 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
write$tun(r4, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000004000000060ec97000fc83c00fe8000000000000000000000000000aaff02000000000000000000000000000106"], 0xffe)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/direction\x00', 0x1, 0x0)
write(r6, &(0x7f00000002c0)='1', 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/midi2.usb0/ep.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/functions/midi2.usb0/ep.2\x00', 0x1ff)
symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/configs/c.1/midi2.usb0\x00')
r7 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r7, &(0x7f0000000680)='dummy_udc.0', 0xb)
sendmsg$rds(r0, &(0x7f0000000080)={&(0x7f0000000040)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000380)=[@cswp={0x58, 0x114, 0x7, {{0x0, 0x1000}, &(0x7f0000000180)=0xd, 0x0, 0x7, 0x7fffffffffffffff, 0x3, 0x8000, 0x4e, 0x9}}, @cswp={0x58, 0x114, 0x7, {{0x10, 0x3}, 0x0, 0x0, 0x8, 0xe1d7, 0xd, 0x80000001, 0x17, 0x8}}], 0xb0, 0x800}, 0x0)
[ 123.125149][ T5323] syz.0.0 uses obsolete (PF_INET,SOCK_PACKET)
[ 123.152157][ T5323] sound umpC3D1: No UMP Group is found in FB
[ 123.156403][ T5323] sound umpC3D2: No UMP Group is found in FB
[ 123.214824][ T4641] Bluetooth: hci0: command tx timeout
[ 123.614068][ T5319] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 123.765066][ T5319] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.02
[ 123.770405][ T5319] usb 5-1: Dual-Role OTG device on HNP port
[ 123.775429][ T5319] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 123.801466][ T5319] gspca_main: spca501-2.14.0 probing 0000:0000
[ 123.806314][ T5319] gspca_spca501: reg write: error -32
[ 123.808446][ T5319] spca501 5-1:1.0: Reg write failed for 0x02,0x0f,0x05
[ 123.811530][ T5319] spca501 5-1:1.0: probe with driver spca501 failed with error -22
[ 123.820994][ C0] Oops: general protection fault, probably for non-canonical address 0xdffffc00000000e6: 0000 [#1] SMP KASAN NOPTI
[ 123.826072][ C0] KASAN: null-ptr-deref in range [0x0000000000000730-0x0000000000000737]
[ 123.829569][ C0] CPU: 0 UID: 0 PID: 5319 Comm: kworker/0:5 Not tainted syzkaller #0 PREEMPT(full)
[ 123.833232][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 123.837251][ C0] Workqueue: usb_hub_wq hub_event
[ 123.839411][ C0] RIP: 0010:f_midi2_stop_eps+0x28e/0x4d0
[ 123.841831][ C0] Code: 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 57 05 66 fa 41 bf 30 07 00 00 4d 03 3e 4c 89 f8 48 c1 e8 03 48 89 44 24 18 <42> 0f b6 04 28 84 c0 0f 85 12 02 00 00 41 8b 1f 31 ff 89 de e8 99
[ 123.849729][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002
[ 123.852661][ C0] RAX: 00000000000000e6 RBX: ffff888052600120 RCX: ffff888012a78000
[ 123.856470][ C0] RDX: 0000000000000100 RSI: ffffffff8c4bce60 RDI: ffffffff8c4bce20
[ 123.859808][ C0] RBP: ffff888052600100 R08: 00000000c124994f R09: 00000000daaba361
[ 123.863123][ C0] R10: 0000000000000010 R11: ffffffff8eb59c60 R12: ffff888052600730
[ 123.866345][ C0] R13: dffffc0000000000 R14: ffff888052600128 R15: 0000000000000730
[ 123.869583][ C0] FS: 0000000000000000(0000) GS:ffff88808c53e000(0000) knlGS:0000000000000000
[ 123.873279][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 123.876105][ C0] CR2: 00007fc041cae0f5 CR3: 0000000012698000 CR4: 0000000000352ef0
[ 123.879305][ C0] Call Trace:
[ 123.880667][ C0]
[ 123.881861][ C0] f_midi2_set_alt+0x11c/0xf00
[ 123.883778][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 123.885954][ C0] composite_setup+0x1ffd/0x3480
[ 123.888608][ C0] configfs_composite_setup+0xc7/0x100
[ 123.891467][ C0] dummy_timer+0x2f43/0x4cf0
[ 123.893976][ C0] ? __lock_acquire+0x683/0x2cf0
[ 123.896022][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 123.898060][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 123.900201][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 123.902770][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 123.904883][ C0] __hrtimer_run_queues+0x3bc/0xa10
[ 123.907104][ C0] hrtimer_run_softirq+0x17a/0x240
[ 123.909308][ C0] handle_softirqs+0x225/0x840
[ 123.911380][ C0] ? __irq_exit_rcu+0xca/0x220
[ 123.913337][ C0] __irq_exit_rcu+0xca/0x220
[ 123.915195][ C0] irq_exit_rcu+0x9/0x30
[ 123.917027][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0
[ 123.919578][ C0]
[ 123.920791][ C0]
[ 123.922011][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 123.924386][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80
[ 123.926940][ C0] Code: f7 e8 5d 3d cc f5 f7 c3 00 02 00 00 74 05 e8 10 2e f8 f5 9c 58 a9 00 02 00 00 75 27 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 f4 50 bd f5 65 8b 05 bd 00 97 07 85 c0 74 18 5b 41 5e c3 cc cc
[ 123.934674][ C0] RSP: 0018:ffffc9000f5ee7f0 EFLAGS: 00000206
[ 123.937204][ C0] RAX: 0000000000000002 RBX: 0000000000000246 RCX: 0000000080000001
[ 123.940523][ C0] RDX: 0000000000000006 RSI: ffffffff8e22f98c RDI: 0000000000000001
[ 123.943547][ C0] RBP: 0000000000000007 R08: ffffffff9057b437 R09: 1ffffffff20af686
[ 123.947626][ C0] R10: dffffc0000000000 R11: fffffbfff20af687 R12: 0000000000000000
[ 123.951028][ C0] R13: dffffc0000000000 R14: ffff8880342f0000 R15: 1ffff11006884894
[ 123.954426][ C0] dummy_urb_enqueue+0x587/0x780
[ 123.956604][ C0] usb_hcd_submit_urb+0x328/0x1b60
[ 123.958871][ C0] usb_start_wait_urb+0x13f/0x5b0
[ 123.960994][ C0] ? trace_kmalloc+0x2a/0xf0
[ 123.963102][ C0] ? __pfx_usb_start_wait_urb+0x10/0x10
[ 123.965504][ C0] usb_control_msg+0x234/0x3e0
[ 123.967277][ C0] usb_set_interface+0x521/0x1470
[ 123.969021][ C0] snd_usb_midi_v2_create+0x621/0x4ac0
[ 123.970876][ C0] ? __pfx_proc_audio_usbid_read+0x10/0x10
[ 123.972876][ C0] ? snd_card_rw_proc_new+0x10d/0x140
[ 123.974747][ C0] ? __pfx_snd_usb_midi_v2_create+0x10/0x10
[ 123.976790][ C0] ? usb_ifnum_to_if+0x262/0x2f0
[ 123.979145][ C0] snd_usb_create_stream+0x262/0x630
[ 123.981886][ C0] usb_audio_probe+0x1447/0x2280
[ 123.984233][ C0] ? __pfx_usb_audio_probe+0x10/0x10
[ 123.986538][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 123.989066][ C0] usb_probe_interface+0x653/0xc60
[ 123.991341][ C0] ? __pfx_usb_probe_interface+0x10/0x10
[ 123.993765][ C0] really_probe+0x254/0xae0
[ 123.995649][ C0] __driver_probe_device+0x1e8/0x360
[ 123.997832][ C0] driver_probe_device+0x4f/0x240
[ 123.999977][ C0] __device_attach_driver+0x270/0x410
[ 124.002237][ C0] bus_for_each_drv+0x258/0x2f0
[ 124.004264][ C0] ? __pfx___device_attach_driver+0x10/0x10
[ 124.006632][ C0] ? __pfx_bus_for_each_drv+0x10/0x10
[ 124.008856][ C0] ? lockdep_hardirqs_on+0x7a/0x110
[ 124.011067][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 124.013528][ C0] __device_attach+0x2c4/0x450
[ 124.015555][ C0] ? __pfx___device_attach+0x10/0x10
[ 124.017728][ C0] ? do_raw_spin_unlock+0x4d/0x210
[ 124.019807][ C0] ? _raw_spin_unlock+0x28/0x50
[ 124.021819][ C0] device_initial_probe+0xa1/0xd0
[ 124.023994][ C0] bus_probe_device+0x12a/0x220
[ 124.026005][ C0] device_add+0x7d7/0xb80
[ 124.027896][ C0] usb_set_configuration+0x1ad8/0x2180
[ 124.030231][ C0] usb_generic_driver_probe+0x8d/0x150
[ 124.032565][ C0] usb_probe_device+0x1c3/0x3b0
[ 124.034690][ C0] ? __pfx_usb_probe_device+0x10/0x10
[ 124.036859][ C0] really_probe+0x254/0xae0
[ 124.038719][ C0] __driver_probe_device+0x1e8/0x360
[ 124.040903][ C0] driver_probe_device+0x4f/0x240
[ 124.043099][ C0] __device_attach_driver+0x270/0x410
[ 124.045313][ C0] bus_for_each_drv+0x258/0x2f0
[ 124.047353][ C0] ? __pfx___device_attach_driver+0x10/0x10
[ 124.049790][ C0] ? __pfx_bus_for_each_drv+0x10/0x10
[ 124.052126][ C0] ? lockdep_hardirqs_on+0x7a/0x110
[ 124.054369][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 124.056696][ C0] __device_attach+0x2c4/0x450
[ 124.058596][ C0] ? __pfx___device_attach+0x10/0x10
[ 124.060660][ C0] ? do_raw_spin_unlock+0x4d/0x210
[ 124.062741][ C0] ? _raw_spin_unlock+0x28/0x50
[ 124.064660][ C0] device_initial_probe+0xa1/0xd0
[ 124.066764][ C0] bus_probe_device+0x12a/0x220
[ 124.068802][ C0] device_add+0x7d7/0xb80
[ 124.070670][ C0] usb_new_device+0x9aa/0x1690
[ 124.072714][ C0] ? __pfx_usb_new_device+0x10/0x10
[ 124.074961][ C0] ? _raw_spin_unlock_irq+0x23/0x50
[ 124.077166][ C0] hub_event+0x28e8/0x4d30
[ 124.079090][ C0] ? __kasan_slab_free+0x5c/0x80
[ 124.081114][ C0] ? kfree+0x1c5/0x640
[ 124.082882][ C0] ? __pfx_hub_event+0x10/0x10
[ 124.084989][ C0] ? process_scheduled_works+0xa20/0x14e0
[ 124.087485][ C0] ? rcu_is_watching+0x15/0xb0
[ 124.089522][ C0] ? process_scheduled_works+0xa20/0x14e0
[ 124.091868][ C0] process_scheduled_works+0xa8e/0x14e0
[ 124.094191][ C0] ? __pfx_process_scheduled_works+0x10/0x10
[ 124.096710][ C0] ? assign_work+0x3cf/0x5d0
[ 124.098726][ C0] worker_thread+0xa47/0xfb0
[ 124.100719][ C0] ? __kthread_parkme+0x71/0x1f0
[ 124.102896][ C0] kthread+0x388/0x470
[ 124.104659][ C0] ? __pfx_worker_thread+0x10/0x10
[ 124.106840][ C0] ? __pfx_kthread+0x10/0x10
[ 124.108902][ C0] ret_from_fork+0x514/0xb70
[ 124.111087][ C0] ? __pfx_ret_from_fork+0x10/0x10
[ 124.113288][ C0] ? __switch_to+0xc89/0x1420
[ 124.115184][ C0] ? __pfx_kthread+0x10/0x10
[ 124.117163][ C0] ret_from_fork_asm+0x1a/0x30
[ 124.119232][ C0]
[ 124.120635][ C0] Modules linked in:
[ 124.122424][ C0] ---[ end trace 0000000000000000 ]---
[ 124.124687][ C0] RIP: 0010:f_midi2_stop_eps+0x28e/0x4d0
[ 124.127065][ C0] Code: 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 57 05 66 fa 41 bf 30 07 00 00 4d 03 3e 4c 89 f8 48 c1 e8 03 48 89 44 24 18 <42> 0f b6 04 28 84 c0 0f 85 12 02 00 00 41 8b 1f 31 ff 89 de e8 99
[ 124.134789][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002
[ 124.137174][ C0] RAX: 00000000000000e6 RBX: ffff888052600120 RCX: ffff888012a78000
[ 124.140268][ C0] RDX: 0000000000000100 RSI: ffffffff8c4bce60 RDI: ffffffff8c4bce20
[ 124.143342][ C0] RBP: ffff888052600100 R08: 00000000c124994f R09: 00000000daaba361
[ 124.146627][ C0] R10: 0000000000000010 R11: ffffffff8eb59c60 R12: ffff888052600730
[ 124.149943][ C0] R13: dffffc0000000000 R14: ffff888052600128 R15: 0000000000000730
[ 124.153128][ C0] FS: 0000000000000000(0000) GS:ffff88808c53e000(0000) knlGS:0000000000000000
[ 124.156814][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 124.159446][ C0] CR2: 00007fc041cae0f5 CR3: 0000000012698000 CR4: 0000000000352ef0
[ 124.162717][ C0] Kernel panic - not syncing: Fatal exception in interrupt
[ 124.165588][ C0] Kernel Offset: disabled
[ 124.167287][ C0] Rebooting in 86400 seconds..