program:
r0 = io_uring_setup(0x8, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
io_uring_register$IORING_REGISTER_NAPI(r0, 0x1b, &(0x7f0000000400)={0x3e8, 0x1, 0x0, '\x00', 0x1}, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config\x00', 0x1ed)
mount(0x0, &(0x7f0000000480)='./config\x00', &(0x7f00000004c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nullb/nullb1\x00', 0x1ed)
r1 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nullb/nullb1/submit_queues\x00', 0x1, 0x0)
write(r1, &(0x7f0000000600)='2', 0x1)
symlinkat(&(0x7f0000000180)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='dummy_udc.0', 0xb)
unlinkat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x200)
io_uring_register$IORING_REGISTER_NAPI(r0, 0x1b, &(0x7f0000000440)={0x100, 0x2, 0x1, '\x00', 0xad}, 0x1)
io_uring_register$IORING_REGISTER_NAPI(r0, 0x1b, &(0x7f0000000500)={0x1, 0x5, 0x1, '\x00', 0x4388}, 0x1)
r3 = openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1\x00', 0x880, 0x0)
fanotify_mark(r2, 0x1, 0x8000020, r3, &(0x7f0000000300)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
io_uring_enter(r0, 0x0, 0x1, 0x9, &(0x7f0000000580), 0x18)
[ 85.167892][ T48] Bluetooth: hci0: command tx timeout
[ 85.638200][ T1972] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 85.789255][ T1972] usb 5-1: New USB device found: idVendor=0000, idProduct=0000, bcdDevice=7.04
[ 85.790285][ T1972] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[ 85.790300][ T1972] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0
[ 85.790329][ T1972] usb 5-1: Dual-Role OTG device on HNP port
[ 85.790673][ T1972] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 85.833887][ C0] ------------[ cut here ]------------
[ 85.833899][ C0] usb_ep_enable: ep129 (ep1in-bulk) has maxpacket 0
[ 85.833909][ C0] WARNING: drivers/usb/gadget/udc/core.c:125 at usb_ep_enable+0x148/0x480, CPU#0: syz.0.0/5343
[ 85.843675][ C0] Modules linked in:
[ 85.845433][ C0] CPU: 0 UID: 0 PID: 5343 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 85.849270][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 85.853405][ C0] RIP: 0010:usb_ep_enable+0x1bc/0x480
[ 85.855733][ C0] Code: 8a 07 67 fa 49 83 3f 00 48 c7 c0 00 d5 f4 8c 49 c7 c0 20 d5 f4 8c 4c 0f 44 c0 4c 89 f7 48 c7 c6 69 a7 94 8e 44 89 ea 4c 89 e1 <67> 48 0f b9 3a bd ea ff ff ff 0f 1f 44 00 00 e8 70 b7 ed f9 65 8b
[ 85.863800][ C0] RSP: 0018:ffffc90000007910 EFLAGS: 00010086
[ 85.866392][ C0] RAX: ffffffff8cf4d500 RBX: ffff8880358dc0e0 RCX: ffffffff8cf4f3e0
[ 85.869668][ C0] RDX: 0000000000000081 RSI: ffffffff8e94a769 RDI: ffffffff91cc4100
[ 85.872985][ C0] RBP: dffffc0000000000 R08: ffffffff8cf4d520 R09: 0000000000000002
[ 85.876317][ C0] R10: 0000000000000003 R11: 8000000000000100 R12: ffffffff8cf4f3e0
[ 85.879603][ C0] R13: 0000000000000081 R14: ffffffff91cc4100 R15: ffff8880358dc0f8
[ 85.882759][ C0] FS: 000055556c3fb540(0000) GS:ffff88808a9f9000(0000) knlGS:0000000000000000
[ 85.886457][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 85.889197][ C0] CR2: 00007ffd27881ef8 CR3: 0000000013fd7000 CR4: 0000000000352ef0
[ 85.892546][ C0] Call Trace:
[ 85.894036][ C0]
[ 85.895346][ C0] hidg_set_alt+0x12a/0xa60
[ 85.897294][ C0] ? usb_gadget_set_state+0x12c/0x2d0
[ 85.899599][ C0] set_config+0x749/0x1160
[ 85.901480][ C0] composite_setup+0x1de7/0x3480
[ 85.903625][ C0] configfs_composite_setup+0xc7/0x100
[ 85.905925][ C0] dummy_timer+0x2f30/0x4ce0
[ 85.907938][ C0] ? update_se+0x90/0x1080
[ 85.909879][ C0] ? __lock_acquire+0x747/0x2de0
[ 85.911940][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 85.914008][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 85.916243][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 85.918839][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 85.920970][ C0] __hrtimer_run_queues+0x3bc/0xa10
[ 85.923285][ C0] hrtimer_run_softirq+0x1e3/0x2e0
[ 85.925508][ C0] handle_softirqs+0x265/0x8d0
[ 85.927659][ C0] __irq_exit_rcu+0xc6/0x220
[ 85.929669][ C0] irq_exit_rcu+0x9/0x30
[ 85.931438][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0
[ 85.933860][ C0]
[ 85.935116][ C0]
[ 85.936476][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 85.938974][ C0] RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x80
[ 85.941550][ C0] Code: 89 fb e8 23 00 00 00 48 8b 3d 34 2e cf 0c 48 89 de 5b e9 23 80 6d 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 48 8b 04 24 65 48 8b 0d c8 3d 19 13 65 48 8b 15 c8 3d
[ 85.948848][ C0] RSP: 0018:ffffc9000f97fb98 EFLAGS: 00000286
[ 85.951347][ C0] RAX: 0000000000400040 RBX: ffffc9000f97fd90 RCX: ffffffff9bebba01
[ 85.954768][ C0] RDX: 0000000000000001 RSI: ffffffff8c8ec360 RDI: ffffc9000f97fd40
[ 85.958266][ C0] RBP: ffffc9000f97fcf0 R08: ffffffff91be3cbf R09: 1ffffffff237c797
[ 85.961502][ C0] R10: dffffc0000000000 R11: fffffbfff237c798 R12: dffffc0000000000
[ 85.964888][ C0] R13: ffffc9000f97fd40 R14: ffff888037ada580 R15: ffffc9000f97fd40
[ 85.968282][ C0] hrtimer_try_to_cancel+0x24/0x680
[ 85.970602][ C0] ? schedule+0x16e/0x2b0
[ 85.972549][ C0] do_nanosleep+0x236/0x710
[ 85.974519][ C0] ? do_nanosleep+0x7e/0x710
[ 85.976597][ C0] ? __pfx_do_nanosleep+0x10/0x10
[ 85.978781][ C0] ? __asan_memset+0x22/0x50
[ 85.980851][ C0] ? __hrtimer_setup+0x1b7/0x260
[ 85.983028][ C0] ? __pfx_hrtimer_wakeup+0x10/0x10
[ 85.985348][ C0] hrtimer_nanosleep+0x18f/0x3a0
[ 85.987499][ C0] ? __pfx_hrtimer_nanosleep+0x10/0x10
[ 85.989915][ C0] ? __pfx_hrtimer_wakeup+0x10/0x10
[ 85.992202][ C0] __se_sys_clock_nanosleep+0x35b/0x3b0
[ 85.994640][ C0] ? __pfx___se_sys_clock_nanosleep+0x10/0x10
[ 85.997295][ C0] do_syscall_64+0x16a/0x530
[ 85.999412][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.002011][ C0] ? clear_bhb_loop+0x70/0xc0
[ 86.004100][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.006609][ C0] RIP: 0033:0x7f672356034e
[ 86.008606][ C0] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[ 86.017004][ C0] RSP: 002b:00007ffd27881ef8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6
[ 86.020692][ C0] RAX: ffffffffffffffda RBX: 000055556c3fb540 RCX: 00007f672356034e
[ 86.024196][ C0] RDX: 00007ffd27881f50 RSI: 0000000000000000 RDI: 0000000000000000
[ 86.027551][ C0] RBP: 00007f6723827da0 R08: 0000000000000000 R09: 0000000000000000
[ 86.031129][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000014f58
[ 86.034675][ C0] R13: 00007f672382609c R14: 0000000000014d4f R15: 00007ffd27882080
[ 86.038285][ C0]
[ 86.039702][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 86.042880][ C0] CPU: 0 UID: 0 PID: 5343 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 86.046876][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.051285][ C0] Call Trace:
[ 86.052806][ C0]
[ 86.054101][ C0] vpanic+0x26f/0x710
[ 86.055937][ C0] panic+0xc5/0xd0
[ 86.057611][ C0] ? __pfx_panic+0x10/0x10
[ 86.059587][ C0] __warn+0x315/0x4c0
[ 86.061339][ C0] ? usb_ep_enable+0x148/0x480
[ 86.063225][ C0] ? usb_ep_enable+0x148/0x480
[ 86.065103][ C0] __report_bug+0x276/0x570
[ 86.066813][ C0] ? usb_ep_enable+0x148/0x480
[ 86.068717][ C0] ? __pfx___report_bug+0x10/0x10
[ 86.070916][ C0] report_bug_entry+0x19b/0x290
[ 86.073018][ C0] ? usb_ep_enable+0x1bc/0x480
[ 86.074953][ C0] ? usb_ep_enable+0x1c1/0x480
[ 86.077074][ C0] handle_bug+0xce/0x200
[ 86.078943][ C0] exc_invalid_op+0x1a/0x50
[ 86.080880][ C0] asm_exc_invalid_op+0x1a/0x20
[ 86.083003][ C0] RIP: 0010:usb_ep_enable+0x1bc/0x480
[ 86.085293][ C0] Code: 8a 07 67 fa 49 83 3f 00 48 c7 c0 00 d5 f4 8c 49 c7 c0 20 d5 f4 8c 4c 0f 44 c0 4c 89 f7 48 c7 c6 69 a7 94 8e 44 89 ea 4c 89 e1 <67> 48 0f b9 3a bd ea ff ff ff 0f 1f 44 00 00 e8 70 b7 ed f9 65 8b
[ 86.093336][ C0] RSP: 0018:ffffc90000007910 EFLAGS: 00010086
[ 86.095889][ C0] RAX: ffffffff8cf4d500 RBX: ffff8880358dc0e0 RCX: ffffffff8cf4f3e0
[ 86.099310][ C0] RDX: 0000000000000081 RSI: ffffffff8e94a769 RDI: ffffffff91cc4100
[ 86.102594][ C0] RBP: dffffc0000000000 R08: ffffffff8cf4d520 R09: 0000000000000002
[ 86.105788][ C0] R10: 0000000000000003 R11: 8000000000000100 R12: ffffffff8cf4f3e0
[ 86.109017][ C0] R13: 0000000000000081 R14: ffffffff91cc4100 R15: ffff8880358dc0f8
[ 86.112289][ C0] hidg_set_alt+0x12a/0xa60
[ 86.114156][ C0] ? usb_gadget_set_state+0x12c/0x2d0
[ 86.116387][ C0] set_config+0x749/0x1160
[ 86.118308][ C0] composite_setup+0x1de7/0x3480
[ 86.120549][ C0] configfs_composite_setup+0xc7/0x100
[ 86.122930][ C0] dummy_timer+0x2f30/0x4ce0
[ 86.124958][ C0] ? update_se+0x90/0x1080
[ 86.126881][ C0] ? __lock_acquire+0x747/0x2de0
[ 86.129040][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 86.131370][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 86.133488][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 86.135907][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 86.138001][ C0] __hrtimer_run_queues+0x3bc/0xa10
[ 86.140182][ C0] hrtimer_run_softirq+0x1e3/0x2e0
[ 86.142343][ C0] handle_softirqs+0x265/0x8d0
[ 86.144375][ C0] __irq_exit_rcu+0xc6/0x220
[ 86.146347][ C0] irq_exit_rcu+0x9/0x30
[ 86.147889][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0
[ 86.150224][ C0]
[ 86.151551][ C0]
[ 86.152879][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 86.155446][ C0] RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x80
[ 86.158065][ C0] Code: 89 fb e8 23 00 00 00 48 8b 3d 34 2e cf 0c 48 89 de 5b e9 23 80 6d 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 48 8b 04 24 65 48 8b 0d c8 3d 19 13 65 48 8b 15 c8 3d
[ 86.166267][ C0] RSP: 0018:ffffc9000f97fb98 EFLAGS: 00000286
[ 86.168868][ C0] RAX: 0000000000400040 RBX: ffffc9000f97fd90 RCX: ffffffff9bebba01
[ 86.172355][ C0] RDX: 0000000000000001 RSI: ffffffff8c8ec360 RDI: ffffc9000f97fd40
[ 86.175693][ C0] RBP: ffffc9000f97fcf0 R08: ffffffff91be3cbf R09: 1ffffffff237c797
[ 86.178992][ C0] R10: dffffc0000000000 R11: fffffbfff237c798 R12: dffffc0000000000
[ 86.182339][ C0] R13: ffffc9000f97fd40 R14: ffff888037ada580 R15: ffffc9000f97fd40
[ 86.185722][ C0] hrtimer_try_to_cancel+0x24/0x680
[ 86.187960][ C0] ? schedule+0x16e/0x2b0
[ 86.189816][ C0] do_nanosleep+0x236/0x710
[ 86.191768][ C0] ? do_nanosleep+0x7e/0x710
[ 86.193742][ C0] ? __pfx_do_nanosleep+0x10/0x10
[ 86.195886][ C0] ? __asan_memset+0x22/0x50
[ 86.197861][ C0] ? __hrtimer_setup+0x1b7/0x260
[ 86.199983][ C0] ? __pfx_hrtimer_wakeup+0x10/0x10
[ 86.202233][ C0] hrtimer_nanosleep+0x18f/0x3a0
[ 86.204395][ C0] ? __pfx_hrtimer_nanosleep+0x10/0x10
[ 86.206699][ C0] ? __pfx_hrtimer_wakeup+0x10/0x10
[ 86.208862][ C0] __se_sys_clock_nanosleep+0x35b/0x3b0
[ 86.211103][ C0] ? __pfx___se_sys_clock_nanosleep+0x10/0x10
[ 86.213751][ C0] do_syscall_64+0x16a/0x530
[ 86.215822][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.218275][ C0] ? clear_bhb_loop+0x70/0xc0
[ 86.220179][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.222573][ C0] RIP: 0033:0x7f672356034e
[ 86.224495][ C0] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[ 86.232372][ C0] RSP: 002b:00007ffd27881ef8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6
[ 86.235794][ C0] RAX: ffffffffffffffda RBX: 000055556c3fb540 RCX: 00007f672356034e
[ 86.239030][ C0] RDX: 00007ffd27881f50 RSI: 0000000000000000 RDI: 0000000000000000
[ 86.242249][ C0] RBP: 00007f6723827da0 R08: 0000000000000000 R09: 0000000000000000
[ 86.245479][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000014f58
[ 86.248688][ C0] R13: 00007f672382609c R14: 0000000000014d4f R15: 00007ffd27882080
[ 86.251852][ C0]
[ 86.254434][ C0] Kernel Offset: disabled
[ 86.256281][ C0] Rebooting in 86400 seconds..