program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000400)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/functions/uac1_legacy.usb0\x00', 0x1ff) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/functions/uac1_legacy.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000000200)='./config/usb_gadget/g1/functions/uac1_legacy.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1/uac1_legacy.usb0\x00') openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='dummy_udc.0\n\x00', 0xc) (async) write(r0, &(0x7f0000000400)='dummy_udc.0\n\x00', 0xc) nanosleep(&(0x7f0000000500)={0x0, 0x2faf080}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'veth1_macvtap\x00'}) syz_mount_image$bfs(&(0x7f0000000000), &(0x7f0000000240)='./bus\x00', 0x8008, &(0x7f0000000100)=ANY=[], 0xf, 0xab, &(0x7f0000010140)="$eJzs1zGKwkAYBeB/s7CbdptFsLBO4x08ilhqI1aK4A3Ei3gVj5DewiKtiCOYiIidRQT5vmLgzWPgtbM7brubIiKtIlLRme7T3Wy+GA8n9Rl8pCwifiMij4jeX50Pg7r7avqyWo7K6vv58c+69b0AAMDrsug/5nNqLk7NL/Aa/m993vI+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgHe7BAAA//+dfyiL") mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x80) mount$9p_virtio(&(0x7f0000000040), &(0x7f0000000080)='./file1\x00', &(0x7f0000000000), 0x211038, &(0x7f0000000100)=ANY=[@ANYBLOB="7472616e732d76697274696f2c63616384653d6e6f6e652c00"]) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) r3 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f00000000c0), 0x22100, 0x0) ioctl$vim2m_VIDIOC_CREATE_BUFS(r3, 0xc100565c, &(0x7f00000003c0)={0xc, 0x7, 0x4, {0x1, @raw_data="daf039b0e74a7cbf7d13373f994b933d51af4f3afede804555a657abe06129d7287cf8b5ac8e7aef39416175a7a3d389cb6a85acb32e56304086a23b3cbfe7213424727c4a24a0c2c40e97586862dcb565a651374baf204bf6783c77fa8f2796a173ff39fbea608f169f84b4d3b9fb787ab11f35495ca739a1a0ab1a2cf89f5baea9a5376a0d7b19850622e8626d3b53d6bfd040ebbd2f7f61523295bf23065e0a919405bb237ba52472805bd83fd8bc1e33d1bde5b4f712da21eacd8a59bb1c13b79b8f151db907"}, 0x3}) (async) ioctl$vim2m_VIDIOC_CREATE_BUFS(r3, 0xc100565c, &(0x7f00000003c0)={0xc, 0x7, 0x4, {0x1, @raw_data="daf039b0e74a7cbf7d13373f994b933d51af4f3afede804555a657abe06129d7287cf8b5ac8e7aef39416175a7a3d389cb6a85acb32e56304086a23b3cbfe7213424727c4a24a0c2c40e97586862dcb565a651374baf204bf6783c77fa8f2796a173ff39fbea608f169f84b4d3b9fb787ab11f35495ca739a1a0ab1a2cf89f5baea9a5376a0d7b19850622e8626d3b53d6bfd040ebbd2f7f61523295bf23065e0a919405bb237ba52472805bd83fd8bc1e33d1bde5b4f712da21eacd8a59bb1c13b79b8f151db907"}, 0x3}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$SG_IO(r2, 0x2285, &(0x7f00000033c0)={0x53, 0x0, 0x6, 0x6b, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000000)="1c3513000000", &(0x7f0000002240)=""/4103, 0x0, 0x30520cf7f25f0c64, 0x0, 0x0}) (async) ioctl$SG_IO(r2, 0x2285, &(0x7f00000033c0)={0x53, 0x0, 0x6, 0x6b, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000000)="1c3513000000", &(0x7f0000002240)=""/4103, 0x0, 0x30520cf7f25f0c64, 0x0, 0x0}) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f0000000300)={0x0, {}, 0x0, {}, 0x20007, 0x0, 0x200040, 0xd, "22536af39b7c7cb7435b0a43852dbc3a9ada34cc97af10fd4fcca15748328c53096c2f359e9ba743d30b59c491a7b3e74d938981061383374a1d79471a2d2dfe", "04106d0c31ef6c1f02a4aa6d0c5aa9263626c0240010f9db74161ccff2c5cf5e", [0x10000004e, 0x6]}) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0) write(r4, &(0x7f0000000200)='wwnn=+x1111111111111111', 0x17) r5 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) setsockopt$llc_int(r5, 0x10c, 0x7, &(0x7f0000000180), 0x4) write(r5, &(0x7f00000004c0)="d3cf7062beb5b333cdaf4db8259e2ba73a19cbe783585dedec0345d20442d4d0ef6fbff964123e2daa42a31987d2c7c4b98ecf94c9caea3e52731295c5d50a89635d5c0769a7f71b4965dad33faa813a44ce2998b4ebe62906b10135c178127dac622efb1b6c9a95fb55e3aad3290fe91d1348b6cdabb90852150b8a1f86d98120a916964401a37eb7f547808a529834dee4c472212eb088c95bfb249aa5c675560781edf200a4619af202", 0xab) (async) write(r5, &(0x7f00000004c0)="d3cf7062beb5b333cdaf4db8259e2ba73a19cbe783585dedec0345d20442d4d0ef6fbff964123e2daa42a31987d2c7c4b98ecf94c9caea3e52731295c5d50a89635d5c0769a7f71b4965dad33faa813a44ce2998b4ebe62906b10135c178127dac622efb1b6c9a95fb55e3aad3290fe91d1348b6cdabb90852150b8a1f86d98120a916964401a37eb7f547808a529834dee4c472212eb088c95bfb249aa5c675560781edf200a4619af202", 0xab) ioctl$F2FS_IOC_SEC_TRIM_FILE(r1, 0x4018f514, &(0x7f0000000180)={0x6, 0x5, 0x1}) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x161442, 0xb6) (async) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x161442, 0xb6) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) [ 86.291535][ T5325] configfs-gadget.g1 gadget.0: Hardware params: access 3, format 2, channels 2, rate 48000 [ 86.299654][ T5325] udc dummy_udc.0: failed to start g1: -19 [ 86.304914][ T5325] UDC core: g1: couldn't find an available UDC or it's busy [ 86.309693][ T5324] slab filp start ffff88803bea51c0 pointer offset 0 size 352 [ 86.314605][ T5324] VFS: Close: file count is 0 (f_op=snd_ctl_f_ops) [ 86.315188][ T5324] ------------[ cut here ]------------ [ 86.321168][ T5324] kernel BUG at fs/open.c:1466! [ 86.328897][ T5324] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 86.331588][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 86.335262][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.339422][ T5324] RIP: 0010:filp_flush+0x184/0x190 [ 86.341642][ T5324] Code: 48 83 c3 48 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 dc 13 ee ff 48 8b 33 48 c7 c7 80 8c fe 8b e8 1d 7e df fe 90 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 [ 86.349308][ T5324] RSP: 0018:ffffc9000f8d76b8 EFLAGS: 00010246 [ 86.351649][ T5324] RAX: 0000000000000030 RBX: ffff88803bea5208 RCX: ca6057bcfd24ba00 [ 86.354675][ T5324] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 86.357737][ T5324] RBP: ffffc9000f8d77d8 R08: 0000000000000003 R09: 0000000000000004 [ 86.360658][ T5324] R10: dffffc0000000000 R11: fffffbfff1d3ca24 R12: dffffc0000000000 [ 86.363697][ T5324] R13: ffff888012d8e528 R14: 0000000000000000 R15: 0000000000000003 [ 86.366721][ T5324] FS: 00007f76215d46c0(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 86.370149][ T5324] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 86.372751][ T5324] CR2: 00007f76215b2fe8 CR3: 00000000123d5000 CR4: 0000000000352ef0 [ 86.375944][ T5324] Call Trace: [ 86.377347][ T5324] [ 86.378539][ T5324] filp_close+0x1d/0x40 [ 86.380280][ T5324] gaudio_cleanup+0x54/0xf0 [ 86.383617][ T5324] f_audio_bind+0x4a0/0x630 [ 86.385439][ T5324] ? __pfx_f_audio_bind+0x10/0x10 [ 86.387534][ T5324] ? rcu_is_watching+0x15/0xb0 [ 86.389351][ T5324] ? usb_gadget_set_selfpowered+0xf5/0x260 [ 86.391679][ T5324] usb_add_function+0x2e1/0x9f0 [ 86.393621][ T5324] ? check_remote_wakeup_config+0x58/0x1c0 [ 86.395913][ T5324] configfs_composite_bind+0xde0/0x1410 [ 86.398057][ T5324] ? __pfx_configfs_composite_bind+0x10/0x10 [ 86.400355][ T5324] gadget_bind_driver+0x2ca/0x9e0 [ 86.402474][ T5324] ? __pfx_gadget_bind_driver+0x10/0x10 [ 86.404505][ T5324] really_probe+0x254/0xae0 [ 86.406268][ T5324] __driver_probe_device+0x1e8/0x360 [ 86.408411][ T5324] driver_probe_device+0x4f/0x240 [ 86.410289][ T5324] __driver_attach+0x339/0x600 [ 86.411995][ T5324] bus_for_each_dev+0x23b/0x2c0 [ 86.413828][ T5324] ? __pfx___driver_attach+0x10/0x10 [ 86.415802][ T5324] ? __pfx_bus_for_each_dev+0x10/0x10 [ 86.418154][ T5324] ? do_raw_spin_unlock+0x4d/0x210 [ 86.420357][ T5324] bus_add_driver+0x345/0x670 [ 86.422348][ T5324] driver_register+0x23a/0x320 [ 86.424338][ T5324] usb_gadget_register_driver_owner+0xf9/0x270 [ 86.426682][ T5324] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 86.428524][ T5324] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10 [ 86.431135][ T5324] configfs_write_iter+0x337/0x430 [ 86.433315][ T5324] vfs_write+0x612/0xba0 [ 86.435144][ T5324] ? __pfx_vfs_write+0x10/0x10 [ 86.437151][ T5324] ? __fget_files+0x2a/0x420 [ 86.439081][ T5324] ksys_write+0x150/0x270 [ 86.440925][ T5324] ? __pfx_ksys_write+0x10/0x10 [ 86.442944][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.445518][ T5324] do_syscall_64+0x174/0x580 [ 86.447460][ T5324] ? trace_irq_disable+0x3b/0x140 [ 86.449616][ T5324] ? clear_bhb_loop+0x70/0xc0 [ 86.451667][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.454199][ T5324] RIP: 0033:0x7f762519e0d9 [ 86.456187][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 86.464289][ T5324] RSP: 002b:00007f76215d3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 86.467823][ T5324] RAX: ffffffffffffffda RBX: 00007f7625426090 RCX: 00007f762519e0d9 [ 86.471152][ T5324] RDX: 000000000000000c RSI: 0000200000000400 RDI: 0000000000000003 [ 86.474396][ T5324] RBP: 00007f7625235024 R08: 0000000000000000 R09: 0000000000000000 [ 86.478221][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 86.481590][ T5324] R13: 00007f7625426128 R14: 00007f7625426090 R15: 00007ffeb497b398 [ 86.484598][ T5324] [ 86.485817][ T5324] Modules linked in: [ 86.487643][ T5324] ---[ end trace 0000000000000000 ]--- [ 86.491159][ T5323] loop0: detected capacity change from 0 to 64 [ 86.493843][ T5323] bfs: Unknown parameter './config/usb_gadget/g1/functions/uac1_legacy.usb0' [ 86.497505][ T5324] RIP: 0010:filp_flush+0x184/0x190 [ 86.501575][ T5324] Code: 48 83 c3 48 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 dc 13 ee ff 48 8b 33 48 c7 c7 80 8c fe 8b e8 1d 7e df fe 90 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 [ 86.509346][ T5324] RSP: 0018:ffffc9000f8d76b8 EFLAGS: 00010246 [ 86.512135][ T5324] RAX: 0000000000000030 RBX: ffff88803bea5208 RCX: ca6057bcfd24ba00 [ 86.515535][ T5324] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 86.519007][ T5324] RBP: ffffc9000f8d77d8 R08: 0000000000000003 R09: 0000000000000004 [ 86.522558][ T5324] R10: dffffc0000000000 R11: fffffbfff1d3ca24 R12: dffffc0000000000 [ 86.525969][ T5324] R13: ffff888012d8e528 R14: 0000000000000000 R15: 0000000000000003 [ 86.529007][ T5324] FS: 00007f76215d46c0(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 86.532999][ T5324] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 86.535866][ T5324] CR2: 0000000000000000 CR3: 00000000123d5000 CR4: 0000000000352ef0 [ 86.539372][ T5324] Kernel panic - not syncing: Fatal exception [ 86.542424][ T5324] Kernel Offset: disabled [ 86.544376][ T5324] Rebooting in 86400 seconds..