program: r0 = socket(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/direction\x00', 0x1, 0x0) write(r2, &(0x7f00000002c0)='1', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/midi2.usb0/ep.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/functions/midi2.usb0/ep.2\x00', 0x1ff) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/configs/c.1/midi2.usb0\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r3, &(0x7f0000000680)='dummy_udc.0', 0xb) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYRES32=r4, @ANYBLOB="000000000000000010011a801000f4800400058008000900000000000800038030000180050006000000000014000500714abbd2547de97cbbf6efb226f19bf90d0002003a288e5e5b5b5a40000000006000078014000400293a02149f3b75a67093c28fd6f55a2314000400e48f01e49713f0c2d839f940d9f088d80500060000000000130002006272696467655f736c6176655f30000007000200293a00000500060000000000080001000000000018000180140004004d2906d0880fc8acc30fe2020f9849675000018014000500a1085e7df341b9dc3d8008a2fe5bdaad140004009c7e472c916020fe41bcc5aa8f56c9471400050080ab8be51421cfa3c9e5cbfe8217e0af080001000000000008000100000000006000018005000600000000000500060000000000080001000000000005000600000000000c00020073797a746e6c30000800010000000000130002006272696467655f736c6176655f30000014000500e078d277f38ed3a40a448f3f6b6763e83c000c"], 0x270}}, 0x0) r5 = socket(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000040)={'vxcan1\x00', 0x0}) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000080)={'vxcan0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@can_newroute={0x24, 0x18, 0x1, 0x0, 0x200, {0x1d, 0x1, 0x8}, [@CGW_DST_IF={0x8, 0xa, r7}, @CGW_SRC_IF={0x8, 0x9, r8}]}, 0x24}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=@getchain={0x24, 0x11, 0x839, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r8, {0x1, 0xffff}, {0xffff}, {0x1, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x8084}, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0xfc) [ 92.992164][ T45] Bluetooth: hci0: command tx timeout [ 93.008267][ T10] cfg80211: failed to load regulatory.db [ 93.235097][ T5317] sound umpC3D1: No UMP Group is found in FB [ 93.239170][ T5317] sound umpC3D2: No UMP Group is found in FB [ 93.331407][ T5318] netlink: 4 bytes leftover after parsing attributes in process `syz.0.0'. [ 93.397504][ T5326] netlink: 4 bytes leftover after parsing attributes in process `syz.0.0'. [ 93.511941][ T5326] Zero length message leads to an empty skb [ 93.788581][ T10] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 93.938314][ T10] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.02 [ 93.944403][ T10] usb 5-1: Dual-Role OTG device on HNP port [ 93.947425][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 93.975652][ T10] gspca_main: spca501-2.14.0 probing 0000:0000 [ 93.980126][ T10] gspca_spca501: reg write: error -32 [ 93.982477][ T10] spca501 5-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 93.985666][ T10] spca501 5-1:1.0: probe with driver spca501 failed with error -22 [ 93.995080][ C0] Oops: general protection fault, probably for non-canonical address 0xdffffc00000000e6: 0000 [#1] SMP KASAN NOPTI [ 94.000304][ C0] KASAN: null-ptr-deref in range [0x0000000000000730-0x0000000000000737] [ 94.003839][ C0] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full) [ 94.007347][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.011393][ C0] Workqueue: usb_hub_wq hub_event [ 94.013559][ C0] RIP: 0010:f_midi2_stop_eps+0x28e/0x4d0 [ 94.015920][ C0] Code: 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 47 49 61 fa 41 bf 30 07 00 00 4d 03 3e 4c 89 f8 48 c1 e8 03 48 89 44 24 18 <42> 0f b6 04 28 84 c0 0f 85 12 02 00 00 41 8b 1f 31 ff 89 de e8 b9 [ 94.023622][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002 [ 94.026259][ C0] RAX: 00000000000000e6 RBX: ffff888052a08120 RCX: ffff88801b732580 [ 94.029689][ C0] RDX: 0000000000000100 RSI: 0000000000000100 RDI: ffffffff8c6d1520 [ 94.033071][ C0] RBP: ffff888052a08100 R08: 000000001e6d8e3a R09: 00000000c0995c85 [ 94.036339][ C0] R10: 0000000000000010 R11: ffffffff8ed5a360 R12: ffff888052a08730 [ 94.039398][ C0] R13: dffffc0000000000 R14: ffff888052a08128 R15: 0000000000000730 [ 94.042873][ C0] FS: 0000000000000000(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000 [ 94.046686][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.049492][ C0] CR2: 00007f9bc29b00f5 CR3: 000000003ff00000 CR4: 0000000000352ef0 [ 94.052892][ C0] Call Trace: [ 94.054366][ C0] [ 94.055619][ C0] f_midi2_set_alt+0x11c/0xf00 [ 94.057778][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 94.060006][ C0] composite_setup+0x1ffd/0x3480 [ 94.062038][ C0] configfs_composite_setup+0xc7/0x100 [ 94.064311][ C0] dummy_timer+0x2f43/0x4cf0 [ 94.066216][ C0] ? update_se+0x90/0x1020 [ 94.068125][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 94.070338][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 94.072453][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 94.074985][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 94.077130][ C0] __hrtimer_run_queues+0x3bc/0xa10 [ 94.079327][ C0] hrtimer_run_softirq+0x1e3/0x2e0 [ 94.081298][ C0] handle_softirqs+0x226/0x860 [ 94.082896][ C0] ? __irq_exit_rcu+0xcb/0x220 [ 94.084846][ C0] __irq_exit_rcu+0xcb/0x220 [ 94.086693][ C0] irq_exit_rcu+0x9/0x30 [ 94.088413][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 94.090605][ C0] [ 94.091836][ C0] [ 94.093133][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 94.095521][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 [ 94.097954][ C0] Code: f7 e8 ad b6 c2 f5 f7 c3 00 02 00 00 74 05 e8 b0 e7 ee f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 b4 d6 b3 f5 65 48 8b 05 2c ce b0 07 48 85 c0 74 18 5b 41 5e c3 [ 94.105299][ C0] RSP: 0018:ffffc9000023e7d0 EFLAGS: 00000206 [ 94.107563][ C0] RAX: 0000000000000006 RBX: 0000000000000246 RCX: 8000000000000001 [ 94.110692][ C0] RDX: 0000000000000006 RSI: ffffffff8e460b06 RDI: 0000000000000001 [ 94.113850][ C0] RBP: 0000000000000007 R08: ffffffff9078fa37 R09: 1ffffffff20f1f46 [ 94.117089][ C0] R10: dffffc0000000000 R11: fffffbfff20f1f47 R12: 0000000000000000 [ 94.120369][ C0] R13: dffffc0000000000 R14: ffff8880344f8000 R15: 1ffff11003efbe94 [ 94.123618][ C0] dummy_urb_enqueue+0x587/0x780 [ 94.125663][ C0] usb_hcd_submit_urb+0x328/0x1b60 [ 94.127810][ C0] usb_start_wait_urb+0x13f/0x5b0 [ 94.130589][ C0] ? trace_kmalloc+0x2a/0xf0 [ 94.132435][ C0] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 94.134572][ C0] usb_control_msg+0x234/0x3e0 [ 94.136417][ C0] usb_set_interface+0x521/0x1470 [ 94.138401][ C0] snd_usb_midi_v2_create+0x621/0x4ac0 [ 94.140565][ C0] ? __pfx_proc_audio_usbid_read+0x10/0x10 [ 94.142823][ C0] ? snd_card_rw_proc_new+0x10d/0x140 [ 94.144918][ C0] ? __pfx_snd_usb_midi_v2_create+0x10/0x10 [ 94.147300][ C0] ? usb_ifnum_to_if+0x262/0x2f0 [ 94.149334][ C0] snd_usb_create_stream+0x262/0x630 [ 94.151280][ C0] usb_audio_probe+0x144c/0x2240 [ 94.153498][ C0] ? __pfx_usb_audio_probe+0x10/0x10 [ 94.155596][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 94.157839][ C0] usb_probe_interface+0x653/0xc60 [ 94.159954][ C0] ? __pfx_usb_probe_interface+0x10/0x10 [ 94.162174][ C0] really_probe+0x254/0xae0 [ 94.164014][ C0] __driver_probe_device+0x1e8/0x360 [ 94.166108][ C0] driver_probe_device+0x4f/0x240 [ 94.168202][ C0] __device_attach_driver+0x270/0x410 [ 94.170429][ C0] bus_for_each_drv+0x258/0x2f0 [ 94.172505][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 94.174925][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 94.177118][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 94.179457][ C0] __device_attach+0x2c4/0x450 [ 94.181234][ C0] ? __pfx___device_attach+0x10/0x10 [ 94.183156][ C0] ? do_raw_spin_unlock+0x4d/0x200 [ 94.185010][ C0] ? _raw_spin_unlock+0x28/0x50 [ 94.186763][ C0] device_initial_probe+0xa1/0xd0 [ 94.188672][ C0] bus_probe_device+0x12a/0x220 [ 94.190484][ C0] device_add+0x7d7/0xb80 [ 94.192203][ C0] usb_set_configuration+0x1ad8/0x2180 [ 94.194423][ C0] usb_generic_driver_probe+0x8d/0x150 [ 94.196716][ C0] usb_probe_device+0x1c3/0x3b0 [ 94.198829][ C0] ? __pfx_usb_probe_device+0x10/0x10 [ 94.201169][ C0] really_probe+0x254/0xae0 [ 94.203075][ C0] __driver_probe_device+0x1e8/0x360 [ 94.205313][ C0] driver_probe_device+0x4f/0x240 [ 94.207418][ C0] __device_attach_driver+0x270/0x410 [ 94.209608][ C0] bus_for_each_drv+0x258/0x2f0 [ 94.211514][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 94.214062][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 94.216268][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 94.218769][ C0] __device_attach+0x2c4/0x450 [ 94.220776][ C0] ? __pfx___device_attach+0x10/0x10 [ 94.222867][ C0] ? do_raw_spin_unlock+0x4d/0x200 [ 94.224984][ C0] ? _raw_spin_unlock+0x28/0x50 [ 94.227028][ C0] device_initial_probe+0xa1/0xd0 [ 94.229050][ C0] bus_probe_device+0x12a/0x220 [ 94.231043][ C0] device_add+0x7d7/0xb80 [ 94.232897][ C0] usb_new_device+0x9aa/0x1690 [ 94.234899][ C0] ? __pfx_usb_new_device+0x10/0x10 [ 94.237060][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 94.239564][ C0] hub_event+0x28e8/0x4d30 [ 94.241581][ C0] ? do_raw_spin_unlock+0x4d/0x200 [ 94.243874][ C0] ? __pfx_hub_event+0x10/0x10 [ 94.246089][ C0] ? process_scheduled_works+0x97a/0x1630 [ 94.248526][ C0] ? rcu_is_watching+0x16/0xb0 [ 94.250733][ C0] ? process_scheduled_works+0x97a/0x1630 [ 94.253189][ C0] process_scheduled_works+0xc3d/0x1630 [ 94.255495][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 94.258091][ C0] ? assign_work+0x3cf/0x5d0 [ 94.260187][ C0] worker_thread+0xa47/0xfb0 [ 94.262145][ C0] kthread+0x38b/0x480 [ 94.263969][ C0] ? __pfx_worker_thread+0x10/0x10 [ 94.266017][ C0] ? __pfx_kthread+0x10/0x10 [ 94.268118][ C0] ret_from_fork+0x514/0xb70 [ 94.270103][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 94.272282][ C0] ? __switch_to+0xc89/0x1420 [ 94.274289][ C0] ? __pfx_kthread+0x10/0x10 [ 94.276526][ C0] ret_from_fork_asm+0x1a/0x30 [ 94.278603][ C0] [ 94.279945][ C0] Modules linked in: [ 94.281656][ C0] ---[ end trace 0000000000000000 ]--- [ 94.284117][ C0] RIP: 0010:f_midi2_stop_eps+0x28e/0x4d0 [ 94.286498][ C0] Code: 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 47 49 61 fa 41 bf 30 07 00 00 4d 03 3e 4c 89 f8 48 c1 e8 03 48 89 44 24 18 <42> 0f b6 04 28 84 c0 0f 85 12 02 00 00 41 8b 1f 31 ff 89 de e8 b9 [ 94.294576][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002 [ 94.297269][ C0] RAX: 00000000000000e6 RBX: ffff888052a08120 RCX: ffff88801b732580 [ 94.300578][ C0] RDX: 0000000000000100 RSI: 0000000000000100 RDI: ffffffff8c6d1520 [ 94.303984][ C0] RBP: ffff888052a08100 R08: 000000001e6d8e3a R09: 00000000c0995c85 [ 94.307286][ C0] R10: 0000000000000010 R11: ffffffff8ed5a360 R12: ffff888052a08730 [ 94.310420][ C0] R13: dffffc0000000000 R14: ffff888052a08128 R15: 0000000000000730 [ 94.313480][ C0] FS: 0000000000000000(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000 [ 94.317305][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.320042][ C0] CR2: 00007f9bc29b00f5 CR3: 000000003ff00000 CR4: 0000000000352ef0 [ 94.322878][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 94.326284][ C0] Kernel Offset: disabled [ 94.328172][ C0] Rebooting in 86400 seconds..