program:
io_setup(0x7e, &(0x7f0000000040))
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/direction\x00', 0x1, 0x0)
write(r1, &(0x7f0000000600)='2', 0x1)
symlinkat(&(0x7f0000000880)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000008c0)='./my_configfs/usb_gadget/g1/configs/c.1/midi2.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./my_configfs/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000000940)='dummy_udc.0', 0xb)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syz_tun\x00', 0x7c2})
openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/devices.allow\x00', 0x2, 0x48)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc)
connect$inet6(r3, &(0x7f0000000100)={0xa, 0x0, 0x8, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1d}}, 0x1}, 0x1c)
setsockopt$sock_int(r3, 0x1, 0xa, &(0x7f0000000000)=0x4, 0x4)
setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000240), 0x3)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4)
openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x900, 0x0)
syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e"], 0x22)
setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28)
r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)
write$tun(r4, &(0x7f0000000340)=ANY=[], 0x141)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r4, 0x0)
setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600"}, 0x28)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
recvmmsg(r3, &(0x7f0000002c80)=[{{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000440)=""/177, 0xb1}], 0x1}, 0x9}], 0x1, 0x23, 0x0)
writev(r3, &(0x7f0000001540)=[{&(0x7f0000000300)='.', 0x1}], 0x1)
[ 94.258138][ T4642] Bluetooth: hci0: command tx timeout
[ 94.902111][ T5302] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 95.052465][ T5302] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.02
[ 95.057982][ T5302] usb 5-1: Dual-Role OTG device on HNP port
[ 95.060925][ T5302] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 95.090705][ T5319] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[ 95.105680][ T5302] gspca_main: spca501-2.14.0 probing 0000:0000
[ 95.110334][ T5302] gspca_spca501: reg write: error -32
[ 95.114045][ T5302] spca501 5-1:1.0: Reg write failed for 0x02,0x0f,0x05
[ 95.119863][ T5319] Bluetooth: hci0: Opcode 0x0406 failed: -4
[ 95.123837][ T5302] spca501 5-1:1.0: probe with driver spca501 failed with error -22
[ 95.148911][ C0] Oops: general protection fault, probably for non-canonical address 0xdffffc00000000e6: 0000 [#1] SMP KASAN NOPTI
[ 95.153497][ C0] KASAN: null-ptr-deref in range [0x0000000000000730-0x0000000000000737]
[ 95.156722][ C0] CPU: 0 UID: 0 PID: 5302 Comm: kworker/0:5 Not tainted syzkaller #0 PREEMPT(full)
[ 95.160296][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.164336][ C0] Workqueue: usb_hub_wq hub_event
[ 95.166704][ C0] RIP: 0010:f_midi2_stop_eps+0x5f/0x4d0
[ 95.169060][ C0] Code: e8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 ef e8 77 4b 61 fa 41 bc 30 07 00 00 4c 03 65 00 4c 89 e0 48 c1 e8 03 48 89 44 24 10 <42> 0f b6 04 28 84 c0 0f 85 23 04 00 00 41 8b 1c 24 31 ff 89 de e8
[ 95.176868][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002
[ 95.179710][ C0] RAX: 00000000000000e6 RBX: 0000000000000001 RCX: ffff88801fb82580
[ 95.183509][ C0] RDX: 0000000000000100 RSI: 0000000000000100 RDI: ffff888052400148
[ 95.187125][ C0] RBP: ffff8880524000f0 R08: ffff88805240014f R09: 1ffff1100a480029
[ 95.190581][ C0] R10: dffffc0000000000 R11: ffffed100a48002a R12: 0000000000000730
[ 95.193734][ C0] R13: dffffc0000000000 R14: ffff888052400128 R15: 0000000000000001
[ 95.196972][ C0] FS: 0000000000000000(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000
[ 95.200490][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 95.203135][ C0] CR2: 00007f023fcec0f5 CR3: 000000000be9d000 CR4: 0000000000352ef0
[ 95.206409][ C0] Call Trace:
[ 95.207865][ C0]
[ 95.209135][ C0] f_midi2_set_alt+0x11c/0xf00
[ 95.211166][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 95.213249][ C0] composite_setup+0x1ffd/0x3480
[ 95.215241][ C0] configfs_composite_setup+0xc7/0x100
[ 95.217482][ C0] dummy_timer+0x2f43/0x4cf0
[ 95.219565][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 95.221660][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 95.223669][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 95.226047][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 95.227967][ C0] __hrtimer_run_queues+0x3bc/0xa10
[ 95.229954][ C0] hrtimer_run_softirq+0x1e3/0x2e0
[ 95.231896][ C0] handle_softirqs+0x226/0x860
[ 95.233604][ C0] ? __irq_exit_rcu+0xcb/0x220
[ 95.235430][ C0] __irq_exit_rcu+0xcb/0x220
[ 95.237422][ C0] irq_exit_rcu+0x9/0x30
[ 95.239278][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0
[ 95.241627][ C0]
[ 95.242868][ C0]
[ 95.244106][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 95.246777][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80
[ 95.249379][ C0] Code: f7 e8 ad b6 c2 f5 f7 c3 00 02 00 00 74 05 e8 b0 e7 ee f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 b4 d6 b3 f5 65 48 8b 05 2c ce b0 07 48 85 c0 74 18 5b 41 5e c3
[ 95.257416][ C0] RSP: 0018:ffffc9000e0467d0 EFLAGS: 00000206
[ 95.259947][ C0] RAX: 0000000000000006 RBX: 0000000000000246 RCX: 8000000000000001
[ 95.263106][ C0] RDX: 0000000000000006 RSI: ffffffff8e460b06 RDI: 0000000000000001
[ 95.266233][ C0] RBP: 0000000000000007 R08: ffffffff9078fa37 R09: 1ffffffff20f1f46
[ 95.269450][ C0] R10: dffffc0000000000 R11: fffffbfff20f1f47 R12: 0000000000000000
[ 95.272669][ C0] R13: dffffc0000000000 R14: ffff888034610000 R15: 1ffff11006896094
[ 95.275892][ C0] dummy_urb_enqueue+0x587/0x780
[ 95.278065][ C0] usb_hcd_submit_urb+0x328/0x1b60
[ 95.280319][ C0] usb_start_wait_urb+0x13f/0x5b0
[ 95.282273][ C0] ? trace_kmalloc+0x2a/0xf0
[ 95.284240][ C0] ? __pfx_usb_start_wait_urb+0x10/0x10
[ 95.286426][ C0] usb_control_msg+0x234/0x3e0
[ 95.288574][ C0] usb_set_interface+0x521/0x1470
[ 95.290672][ C0] snd_usb_midi_v2_create+0x621/0x4ac0
[ 95.292798][ C0] ? __pfx_proc_audio_usbid_read+0x10/0x10
[ 95.295091][ C0] ? snd_card_rw_proc_new+0x10d/0x140
[ 95.297173][ C0] ? __pfx_snd_usb_midi_v2_create+0x10/0x10
[ 95.299537][ C0] ? usb_ifnum_to_if+0x262/0x2f0
[ 95.301489][ C0] snd_usb_create_stream+0x262/0x630
[ 95.303612][ C0] usb_audio_probe+0x144c/0x2240
[ 95.305659][ C0] ? __pfx_usb_audio_probe+0x10/0x10
[ 95.307908][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 95.310196][ C0] usb_probe_interface+0x653/0xc60
[ 95.312186][ C0] ? __pfx_usb_probe_interface+0x10/0x10
[ 95.314305][ C0] really_probe+0x254/0xae0
[ 95.316114][ C0] __driver_probe_device+0x1e8/0x360
[ 95.318234][ C0] driver_probe_device+0x4f/0x240
[ 95.320292][ C0] __device_attach_driver+0x270/0x410
[ 95.322500][ C0] bus_for_each_drv+0x258/0x2f0
[ 95.324522][ C0] ? __pfx___device_attach_driver+0x10/0x10
[ 95.326981][ C0] ? __pfx_bus_for_each_drv+0x10/0x10
[ 95.329244][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 95.331690][ C0] __device_attach+0x2c4/0x450
[ 95.333729][ C0] ? __pfx___device_attach+0x10/0x10
[ 95.335909][ C0] ? do_raw_spin_unlock+0x4d/0x200
[ 95.338284][ C0] ? _raw_spin_unlock+0x28/0x50
[ 95.340364][ C0] device_initial_probe+0xa1/0xd0
[ 95.342554][ C0] bus_probe_device+0x12a/0x220
[ 95.344597][ C0] device_add+0x7d7/0xb80
[ 95.346499][ C0] usb_set_configuration+0x1ad8/0x2180
[ 95.348821][ C0] usb_generic_driver_probe+0x8d/0x150
[ 95.351004][ C0] usb_probe_device+0x1c3/0x3b0
[ 95.352990][ C0] ? __pfx_usb_probe_device+0x10/0x10
[ 95.355286][ C0] really_probe+0x254/0xae0
[ 95.357179][ C0] __driver_probe_device+0x1e8/0x360
[ 95.359321][ C0] driver_probe_device+0x4f/0x240
[ 95.361334][ C0] __device_attach_driver+0x270/0x410
[ 95.363603][ C0] bus_for_each_drv+0x258/0x2f0
[ 95.365640][ C0] ? __pfx___device_attach_driver+0x10/0x10
[ 95.368109][ C0] ? __pfx_bus_for_each_drv+0x10/0x10
[ 95.370330][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 95.372648][ C0] __device_attach+0x2c4/0x450
[ 95.374713][ C0] ? __pfx___device_attach+0x10/0x10
[ 95.376870][ C0] ? do_raw_spin_unlock+0x4d/0x200
[ 95.378991][ C0] ? _raw_spin_unlock+0x28/0x50
[ 95.381013][ C0] device_initial_probe+0xa1/0xd0
[ 95.383100][ C0] bus_probe_device+0x12a/0x220
[ 95.385027][ C0] device_add+0x7d7/0xb80
[ 95.386791][ C0] usb_new_device+0x9aa/0x1690
[ 95.388722][ C0] ? __pfx_usb_new_device+0x10/0x10
[ 95.390859][ C0] ? _raw_spin_unlock_irq+0x23/0x50
[ 95.392802][ C0] hub_event+0x28e8/0x4d30
[ 95.394440][ C0] ? do_raw_spin_unlock+0x4d/0x200
[ 95.396597][ C0] ? __pfx_hub_event+0x10/0x10
[ 95.398625][ C0] ? process_scheduled_works+0x97a/0x1630
[ 95.400849][ C0] ? rcu_is_watching+0x16/0xb0
[ 95.402915][ C0] ? process_scheduled_works+0x97a/0x1630
[ 95.405239][ C0] process_scheduled_works+0xc3d/0x1630
[ 95.407637][ C0] ? __pfx_process_scheduled_works+0x10/0x10
[ 95.410118][ C0] ? assign_work+0x3cf/0x5d0
[ 95.412021][ C0] worker_thread+0xa47/0xfb0
[ 95.413924][ C0] ? __kthread_parkme+0x71/0x1f0
[ 95.415994][ C0] kthread+0x38b/0x480
[ 95.417748][ C0] ? __pfx_worker_thread+0x10/0x10
[ 95.419888][ C0] ? __pfx_kthread+0x10/0x10
[ 95.421827][ C0] ret_from_fork+0x514/0xb70
[ 95.423776][ C0] ? __pfx_ret_from_fork+0x10/0x10
[ 95.425908][ C0] ? __switch_to+0xc89/0x1420
[ 95.427901][ C0] ? __pfx_kthread+0x10/0x10
[ 95.429833][ C0] ret_from_fork_asm+0x1a/0x30
[ 95.431915][ C0]
[ 95.433197][ C0] Modules linked in:
[ 95.434809][ C0] ---[ end trace 0000000000000000 ]---
[ 95.437158][ C0] RIP: 0010:f_midi2_stop_eps+0x5f/0x4d0
[ 95.439506][ C0] Code: e8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 ef e8 77 4b 61 fa 41 bc 30 07 00 00 4c 03 65 00 4c 89 e0 48 c1 e8 03 48 89 44 24 10 <42> 0f b6 04 28 84 c0 0f 85 23 04 00 00 41 8b 1c 24 31 ff 89 de e8
[ 95.447241][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002
[ 95.449633][ C0] RAX: 00000000000000e6 RBX: 0000000000000001 RCX: ffff88801fb82580
[ 95.452709][ C0] RDX: 0000000000000100 RSI: 0000000000000100 RDI: ffff888052400148
[ 95.455804][ C0] RBP: ffff8880524000f0 R08: ffff88805240014f R09: 1ffff1100a480029
[ 95.458638][ C0] R10: dffffc0000000000 R11: ffffed100a48002a R12: 0000000000000730
[ 95.461836][ C0] R13: dffffc0000000000 R14: ffff888052400128 R15: 0000000000000001
[ 95.464809][ C0] FS: 0000000000000000(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000
[ 95.468536][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 95.471318][ C0] CR2: 00007f023fcec0f5 CR3: 000000000be9d000 CR4: 0000000000352ef0
[ 95.474559][ C0] Kernel panic - not syncing: Fatal exception in interrupt
[ 95.477807][ C0] Kernel Offset: disabled
[ 95.479623][ C0] Rebooting in 86400 seconds..