program: mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'ip6_vti0\x00'}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'syzkaller0\x00', 0x1}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'syzkaller0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000180)={@local, 0x40, r2}) nanosleep(&(0x7f0000000200)={0x0, 0xbebc200}, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0x14c, 0x10, 0x401, 0x0, 0x0, {{@in6=@local, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0xa}, {@in6=@local, 0x4d2, 0x33}, @in6=@remote, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth_trunc={0x5c, 0x1, {{'sha1\x00'}, 0x80, 0x60, "00112233445566778899aabbccddeeff"}}]}, 0x14c}}, 0x0) write$tun(r0, &(0x7f0000000500)={@void, @void, @ipv6=@generic={0x0, 0x6, '\x00', 0x18, 0x33, 0x40, @remote, @local, {[], "3b010000000004d20000000100"/24}}}, 0x40) mount(0x0, &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/direction\x00', 0x1, 0x0) write(r4, &(0x7f0000000600)='2', 0x1) symlinkat(&(0x7f0000000880)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000008c0)='./my_configfs/usb_gadget/g1/configs/c.1/midi2.usb0\x00') r5 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./my_configfs/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r5, &(0x7f0000000940)='dummy_udc.0', 0xb) [ 93.439187][ T4640] Bluetooth: hci0: command tx timeout [ 93.943121][ T5292] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 94.093389][ T5292] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.02 [ 94.100299][ T5292] usb 5-1: Dual-Role OTG device on HNP port [ 94.104375][ T5292] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 94.131274][ T5292] gspca_main: spca501-2.14.0 probing 0000:0000 [ 94.135667][ T5292] gspca_spca501: reg write: error -32 [ 94.138193][ T5292] spca501 5-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 94.141227][ T5292] spca501 5-1:1.0: probe with driver spca501 failed with error -22 [ 94.148364][ C0] Oops: general protection fault, probably for non-canonical address 0xdffffc00000000e6: 0000 [#1] SMP KASAN NOPTI [ 94.152791][ C0] KASAN: null-ptr-deref in range [0x0000000000000730-0x0000000000000737] [ 94.156249][ C0] CPU: 0 UID: 0 PID: 5292 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full) [ 94.160117][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.164198][ C0] Workqueue: usb_hub_wq hub_event [ 94.166458][ C0] RIP: 0010:f_midi2_stop_eps+0x5f/0x4d0 [ 94.168778][ C0] Code: e8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 ef e8 97 fe 63 fa 41 bc 30 07 00 00 4c 03 65 00 4c 89 e0 48 c1 e8 03 48 89 44 24 10 <42> 0f b6 04 28 84 c0 0f 85 23 04 00 00 41 8b 1c 24 31 ff 89 de e8 [ 94.176685][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002 [ 94.179319][ C0] RAX: 00000000000000e6 RBX: 0000000000000001 RCX: ffff88801fafa580 [ 94.182750][ C0] RDX: 8000000000000100 RSI: 0000000000000100 RDI: ffff888052078148 [ 94.186076][ C0] RBP: ffff8880520780f0 R08: ffff88805207814f R09: 1ffff1100a40f029 [ 94.189425][ C0] R10: dffffc0000000000 R11: ffffed100a40f02a R12: 0000000000000730 [ 94.192737][ C0] R13: dffffc0000000000 R14: ffff888052078128 R15: 0000000000000001 [ 94.196173][ C0] FS: 0000000000000000(0000) GS:ffff88808c533000(0000) knlGS:0000000000000000 [ 94.199856][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.202320][ C0] CR2: 00007fac9e16d690 CR3: 00000000125d9000 CR4: 0000000000352ef0 [ 94.205575][ C0] Call Trace: [ 94.207083][ C0] [ 94.208386][ C0] f_midi2_set_alt+0x11c/0xf00 [ 94.210527][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 94.212912][ C0] composite_setup+0x1ffd/0x3480 [ 94.215023][ C0] configfs_composite_setup+0xc7/0x100 [ 94.217350][ C0] dummy_timer+0x2f43/0x4cf0 [ 94.219347][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 94.221464][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 94.223488][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 94.225785][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 94.228009][ C0] __hrtimer_run_queues+0x3bc/0xa10 [ 94.230123][ C0] hrtimer_run_softirq+0x1e3/0x2e0 [ 94.232196][ C0] handle_softirqs+0x226/0x860 [ 94.234161][ C0] ? __irq_exit_rcu+0xcb/0x220 [ 94.236071][ C0] __irq_exit_rcu+0xcb/0x220 [ 94.237930][ C0] irq_exit_rcu+0x9/0x30 [ 94.239709][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 94.241962][ C0] [ 94.243212][ C0] [ 94.244439][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 94.246942][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 [ 94.249439][ C0] Code: f7 e8 dd de c9 f5 f7 c3 00 02 00 00 74 05 e8 70 f3 f5 f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 c4 00 bb f5 65 48 8b 05 4c 60 95 07 48 85 c0 74 18 5b 41 5e e9 [ 94.257021][ C0] RSP: 0018:ffffc9000ea667f0 EFLAGS: 00000206 [ 94.259477][ C0] RAX: 0000000000000006 RBX: 0000000000000246 RCX: 8000000000000001 [ 94.262596][ C0] RDX: 0000000000000006 RSI: ffffffff8e234a87 RDI: 0000000000000001 [ 94.265763][ C0] RBP: 0000000000000007 R08: ffffffff9057d337 R09: 1ffffffff20afa66 [ 94.268941][ C0] R10: dffffc0000000000 R11: fffffbfff20afa67 R12: 0000000000000000 [ 94.271962][ C0] R13: dffffc0000000000 R14: ffff888034bd4000 R15: 1ffff11003ef6494 [ 94.274989][ C0] dummy_urb_enqueue+0x587/0x780 [ 94.276831][ C0] usb_hcd_submit_urb+0x328/0x1b60 [ 94.278908][ C0] usb_start_wait_urb+0x13f/0x5b0 [ 94.281007][ C0] ? trace_kmalloc+0x2a/0xf0 [ 94.282918][ C0] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 94.285105][ C0] usb_control_msg+0x234/0x3e0 [ 94.287001][ C0] usb_set_interface+0x521/0x1470 [ 94.288998][ C0] snd_usb_midi_v2_create+0x621/0x4ac0 [ 94.291115][ C0] ? __pfx_proc_audio_usbid_read+0x10/0x10 [ 94.293516][ C0] ? snd_card_rw_proc_new+0x10d/0x140 [ 94.295781][ C0] ? __pfx_snd_usb_midi_v2_create+0x10/0x10 [ 94.298202][ C0] ? usb_ifnum_to_if+0x262/0x2f0 [ 94.300231][ C0] snd_usb_create_stream+0x262/0x630 [ 94.302468][ C0] usb_audio_probe+0x1447/0x2280 [ 94.304492][ C0] ? __pfx_usb_audio_probe+0x10/0x10 [ 94.306614][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 94.308929][ C0] usb_probe_interface+0x653/0xc60 [ 94.310995][ C0] ? __pfx_usb_probe_interface+0x10/0x10 [ 94.313399][ C0] really_probe+0x254/0xae0 [ 94.315313][ C0] __driver_probe_device+0x1e8/0x360 [ 94.317507][ C0] driver_probe_device+0x4f/0x240 [ 94.319577][ C0] __device_attach_driver+0x270/0x410 [ 94.321844][ C0] bus_for_each_drv+0x258/0x2f0 [ 94.323659][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 94.326000][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 94.328344][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 94.330817][ C0] __device_attach+0x2c4/0x450 [ 94.332908][ C0] ? __pfx___device_attach+0x10/0x10 [ 94.335231][ C0] ? do_raw_spin_unlock+0x4d/0x200 [ 94.337407][ C0] ? _raw_spin_unlock+0x28/0x50 [ 94.339538][ C0] device_initial_probe+0xa1/0xd0 [ 94.341576][ C0] bus_probe_device+0x12a/0x220 [ 94.343503][ C0] device_add+0x7d7/0xb80 [ 94.345318][ C0] usb_set_configuration+0x1ad8/0x2180 [ 94.347612][ C0] usb_generic_driver_probe+0x8d/0x150 [ 94.349962][ C0] usb_probe_device+0x1c3/0x3b0 [ 94.352222][ C0] ? __pfx_usb_probe_device+0x10/0x10 [ 94.354763][ C0] really_probe+0x254/0xae0 [ 94.356806][ C0] __driver_probe_device+0x1e8/0x360 [ 94.359095][ C0] driver_probe_device+0x4f/0x240 [ 94.361206][ C0] __device_attach_driver+0x270/0x410 [ 94.363399][ C0] bus_for_each_drv+0x258/0x2f0 [ 94.365434][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 94.367968][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 94.370191][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 94.372671][ C0] __device_attach+0x2c4/0x450 [ 94.374696][ C0] ? __pfx___device_attach+0x10/0x10 [ 94.376804][ C0] ? do_raw_spin_unlock+0x4d/0x200 [ 94.378795][ C0] ? _raw_spin_unlock+0x28/0x50 [ 94.380851][ C0] device_initial_probe+0xa1/0xd0 [ 94.382918][ C0] bus_probe_device+0x12a/0x220 [ 94.385082][ C0] device_add+0x7d7/0xb80 [ 94.386979][ C0] usb_new_device+0x9aa/0x1690 [ 94.389042][ C0] ? __pfx_usb_new_device+0x10/0x10 [ 94.391345][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 94.393530][ C0] hub_event+0x28e8/0x4d30 [ 94.395320][ C0] ? do_raw_spin_unlock+0x4d/0x200 [ 94.397093][ C0] ? __pfx_hub_event+0x10/0x10 [ 94.398789][ C0] ? process_scheduled_works+0xa1a/0x14c0 [ 94.401070][ C0] ? rcu_is_watching+0x16/0xb0 [ 94.403075][ C0] ? process_scheduled_works+0xa1a/0x14c0 [ 94.405369][ C0] process_scheduled_works+0xa88/0x14c0 [ 94.407619][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 94.410013][ C0] ? assign_work+0x3cf/0x5d0 [ 94.411835][ C0] worker_thread+0xa47/0xfb0 [ 94.413557][ C0] ? __kthread_parkme+0x71/0x1f0 [ 94.415503][ C0] kthread+0x38b/0x480 [ 94.417200][ C0] ? __pfx_worker_thread+0x10/0x10 [ 94.419459][ C0] ? __pfx_kthread+0x10/0x10 [ 94.421488][ C0] ret_from_fork+0x514/0xb70 [ 94.423523][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 94.425681][ C0] ? __switch_to+0xc89/0x1420 [ 94.427785][ C0] ? __pfx_kthread+0x10/0x10 [ 94.429754][ C0] ret_from_fork_asm+0x1a/0x30 [ 94.431801][ C0] [ 94.433163][ C0] Modules linked in: [ 94.434853][ C0] ---[ end trace 0000000000000000 ]--- [ 94.437216][ C0] RIP: 0010:f_midi2_stop_eps+0x5f/0x4d0 [ 94.439628][ C0] Code: e8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 ef e8 97 fe 63 fa 41 bc 30 07 00 00 4c 03 65 00 4c 89 e0 48 c1 e8 03 48 89 44 24 10 <42> 0f b6 04 28 84 c0 0f 85 23 04 00 00 41 8b 1c 24 31 ff 89 de e8 [ 94.447172][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002 [ 94.449531][ C0] RAX: 00000000000000e6 RBX: 0000000000000001 RCX: ffff88801fafa580 [ 94.452654][ C0] RDX: 8000000000000100 RSI: 0000000000000100 RDI: ffff888052078148 [ 94.455816][ C0] RBP: ffff8880520780f0 R08: ffff88805207814f R09: 1ffff1100a40f029 [ 94.459235][ C0] R10: dffffc0000000000 R11: ffffed100a40f02a R12: 0000000000000730 [ 94.462680][ C0] R13: dffffc0000000000 R14: ffff888052078128 R15: 0000000000000001 [ 94.465939][ C0] FS: 0000000000000000(0000) GS:ffff88808c533000(0000) knlGS:0000000000000000 [ 94.469426][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.472149][ C0] CR2: 00007fac9e16d690 CR3: 00000000125d9000 CR4: 0000000000352ef0 [ 94.475457][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 94.478596][ C0] Kernel Offset: disabled [ 94.480245][ C0] Rebooting in 86400 seconds..