program: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="5000000002060500000000010000000000000000050005000a000000050004000000000005000100070000000900020073797a310000000016000300686173683a6e65742c706f72742c6e6574"], 0x50}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000580)=ANY=[@ANYBLOB="740000000b06010800000000000000000200000305000100070000004c0007801800148014000240fe80000000000000000000000000001f18000180140000000000000000000000060004404e24000010000a003a2f2c243a2d3a282f2b25000900020073797a3100000000000000000010000043c8430a6633f02162847541c1e9309fdc22a40b3b3686dbe7bc898d27fb221bd001bbac09141a452eb5cf88dbd22f9dd2cecfe9bd4a608c3b00f56a31cb63136b0af1a53859f907adfc4513b98d8b7934b420d7c3cb0400b31a5dafd2130e6564b874517af031247fc7e205215355077b82c67abd3496c34cc7ebe04a9e1a1d5285a4510aa44aa7d29d130e7ca0a0d5f03ca502f0466871c0849df41b8177397433cf870528e2411c72bd6dd12056bb236d3505760434ea6149399f646a5ea72ee4e0c98fe35d97628d080be8179bc0435d88a6ac6e5183410f94fc942719e0d04f4faf11bb831fb2ad365000fb97717abed41d7df81a9228932c01f6c461f9678502fdf23e86824b14085dbd85c19d4f6836170b354c9471ad0d6f9f4bc9ec9451d302254f900822853444d77fedfd1dfaca88"], 0x74}, 0x1, 0x0, 0x0, 0x48}, 0x4800) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000b00)=ANY=[@ANYBLOB="5000fc00080211000001080211000000505050505050000000000000000000006400010000060202020202020102dd379eb9c16f52ca823be29f513076a4583fc5b27fe74fd27963d34b8ee6a4b7dcfd5281270d217dcee0aeb23663d915e18d787ccde33e4249ddda974eeae371f9e9f9ed3b4e54366eed3b1b91368b1edaf604833e758e0379e77c08d8314cf9602c4820616eb6a320f8ea245fabdc96334b5c8181505798dd94417ae8d1b58dafd3e3d154d6a6f2e2f4565d60a1bb39103f603432fa8f3c3328aa8b65d6a6dd74f3b20151173611ab8e861ea00bb7d5eba8c1b9755773e253583c67be6dd28ca20518d5c83b9d51de7bb8f7a2ad0b531f8ab267fb35fff709845dbcb99705003a5422de5db58dac030119bf39119f43d10be1df30ba387fa99c047f14f61c455fa21f8aba2a8e4828d510c59a8ef257e641c61859a2ddb0645809aa4ef08876a6b8edbde4e912c1fd3b3a6d17937d61040ac41d36efa570c73cf98f0bff53cb0e0f629b6b0f7b5ae88c0630db4d1b91729ff4f4bfc80925ae88d874984a1c9884a36e4c37a995a8592c77eca746d20faba9d3e4d9d391d38af40e0317655e8bfe50d523236530a0948421d1c1a8eae1d0692f550b44e7afe07ceb72baa4ef1146d94101fdda295cd73b88d7e035825f262d9f0d16f582ba270f5bf753cf66b8fb7e32"], 0x2c9) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f00000003c0)=ANY=[@ANYBLOB="80000000ffffffffffffffffffffffff50505050505000000000000000000000640001000006020202020202010196"], 0x59) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r4, 0x5, 0xfffffffe, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x4004800) r6 = socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) r7 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/direction\x00', 0x1, 0x0) write(r7, &(0x7f0000000600)='2', 0x1) symlinkat(&(0x7f0000000880)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000008c0)='./my_configfs/usb_gadget/g1/configs/c.1/midi2.usb0\x00') r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./my_configfs/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r8, &(0x7f0000000940)='dummy_udc.0', 0xb) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000240)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xd0f, 0x0, 0x4, {0x60, 0x0, 0x0, r9, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_ATM={0x8, 0x4, 0x2}]}}]}, 0x3c}}, 0x0) r10 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r6, 0x0, 0x40, &(0x7f0000000340)={'filter\x00', 0x0, [0x6, 0x1, 0xfffffff8, 0x6, 0x7f]}, &(0x7f0000000400)=0x54) sendmmsg$inet6(r10, &(0x7f0000000300)=[{{&(0x7f00000009c0)={0xa, 0x4e20, 0x59c9, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c, 0x0}}], 0x1, 0x40) sendmsg$NL80211_CMD_CONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x28, r4, 0x5, 0x0, 0x4, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}]}, 0x28}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) [ 76.383427][ T5267] Bluetooth: hci0: command tx timeout [ 76.390609][ T1324] ieee802154 phy0 wpan0: encryption failed: -22 [ 76.393748][ T1324] ieee802154 phy1 wpan1: encryption failed: -22 [ 76.523430][ T5302] netlink: 12 bytes leftover after parsing attributes in process `syz.0.0'. [ 76.533157][ T5302] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 76.541985][ T5302] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 76.691317][ T5303] wlan1: required basic rate or BSS membership selectors not supported or disabled, rejecting connection [ 77.070895][ T1367] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 77.221233][ T1367] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.02 [ 77.227441][ T1367] usb 5-1: Dual-Role OTG device on HNP port [ 77.230712][ T1367] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 77.252551][ T1367] gspca_main: spca501-2.14.0 probing 0000:0000 [ 77.258149][ T1367] gspca_spca501: reg write: error -32 [ 77.261855][ T1367] spca501 5-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 77.265501][ T1367] spca501 5-1:1.0: probe with driver spca501 failed with error -22 [ 77.276436][ C0] Oops: general protection fault, probably for non-canonical address 0xdffffc00000000e6: 0000 [#1] SMP KASAN NOPTI [ 77.281269][ C0] KASAN: null-ptr-deref in range [0x0000000000000730-0x0000000000000737] [ 77.284746][ C0] CPU: 0 UID: 0 PID: 1367 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(full) [ 77.288599][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 77.292851][ C0] Workqueue: usb_hub_wq hub_event [ 77.295075][ C0] RIP: 0010:f_midi2_stop_eps+0x5f/0x4d0 [ 77.297270][ C0] Code: e8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 ef e8 77 f9 63 fa 41 bc 30 07 00 00 4c 03 65 00 4c 89 e0 48 c1 e8 03 48 89 44 24 10 <42> 0f b6 04 28 84 c0 0f 85 23 04 00 00 41 8b 1c 24 31 ff 89 de e8 [ 77.305196][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002 [ 77.307724][ C0] RAX: 00000000000000e6 RBX: 0000000000000001 RCX: ffff8880341a2580 [ 77.311807][ C0] RDX: 8000000000000100 RSI: 0000000000000100 RDI: ffff8880129e4148 [ 77.315187][ C0] RBP: ffff8880129e40f0 R08: ffff8880129e414f R09: 1ffff1100253c829 [ 77.318491][ C0] R10: dffffc0000000000 R11: ffffed100253c82a R12: 0000000000000730 [ 77.321712][ C0] R13: dffffc0000000000 R14: ffff8880129e4128 R15: 0000000000000001 [ 77.324978][ C0] FS: 0000000000000000(0000) GS:ffff88808c519000(0000) knlGS:0000000000000000 [ 77.328698][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 77.331353][ C0] CR2: 00007ff205e1c0f5 CR3: 000000001270c000 CR4: 0000000000352ef0 [ 77.334591][ C0] Call Trace: [ 77.335979][ C0] [ 77.337113][ C0] f_midi2_set_alt+0x11c/0xf00 [ 77.339049][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 77.341251][ C0] composite_setup+0x1ffd/0x3480 [ 77.343277][ C0] configfs_composite_setup+0xc7/0x100 [ 77.345516][ C0] dummy_timer+0x2f43/0x4cf0 [ 77.347483][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 77.349683][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 77.351811][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 77.354326][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 77.356409][ C0] __hrtimer_run_queues+0x3bc/0xa10 [ 77.358616][ C0] hrtimer_run_softirq+0x1e3/0x2e0 [ 77.360657][ C0] handle_softirqs+0x226/0x860 [ 77.362592][ C0] ? __irq_exit_rcu+0xcb/0x220 [ 77.364591][ C0] __irq_exit_rcu+0xcb/0x220 [ 77.366575][ C0] irq_exit_rcu+0x9/0x30 [ 77.368382][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 77.370691][ C0] [ 77.371982][ C0] [ 77.373237][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 77.375748][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 [ 77.378521][ C0] Code: f7 e8 bd 06 c6 f5 f7 c3 00 02 00 00 74 05 e8 b0 25 f2 f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 a4 28 b7 f5 65 48 8b 05 4c 40 93 07 48 85 c0 74 18 5b 41 5e e9 [ 77.386415][ C0] RSP: 0018:ffffc900024ee608 EFLAGS: 00000206 [ 77.389043][ C0] RAX: 0000000000000006 RBX: 0000000000000287 RCX: 8000000000000001 [ 77.392416][ C0] RDX: 0000000000000006 RSI: ffffffff8e25bbee RDI: 0000000000000001 [ 77.395672][ C0] RBP: dffffc0000000000 R08: ffffffff9058b737 R09: 1ffffffff20b16e6 [ 77.399539][ C0] R10: dffffc0000000000 R11: fffffbfff20b16e7 R12: ffff88801fc26000 [ 77.402856][ C0] R13: 0000000000000000 R14: ffff88801fc26000 R15: 0000000000000287 [ 77.406025][ C0] __mod_timer+0xb53/0xed0 [ 77.407852][ C0] schedule_timeout+0x14d/0x2c0 [ 77.409801][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 77.411929][ C0] ? __pfx_process_timeout+0x10/0x10 [ 77.413859][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 77.415977][ C0] wait_for_completion_timeout+0x2cf/0x610 [ 77.418515][ C0] ? wait_for_completion_timeout+0x265/0x610 [ 77.421083][ C0] ? __pfx_wait_for_completion_timeout+0x10/0x10 [ 77.423827][ C0] usb_start_wait_urb+0x1e9/0x5b0 [ 77.425923][ C0] ? trace_kmalloc+0x2a/0xf0 [ 77.427895][ C0] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 77.430099][ C0] usb_control_msg+0x234/0x3e0 [ 77.432129][ C0] usb_set_interface+0x521/0x1470 [ 77.434245][ C0] snd_usb_midi_v2_create+0x621/0x4ac0 [ 77.436456][ C0] ? __pfx_proc_audio_usbid_read+0x10/0x10 [ 77.438856][ C0] ? snd_card_rw_proc_new+0x10d/0x140 [ 77.441052][ C0] ? __pfx_snd_usb_midi_v2_create+0x10/0x10 [ 77.443407][ C0] ? usb_ifnum_to_if+0x262/0x2f0 [ 77.445396][ C0] snd_usb_create_stream+0x262/0x630 [ 77.447597][ C0] usb_audio_probe+0x144c/0x2240 [ 77.449712][ C0] ? __pfx_usb_audio_probe+0x10/0x10 [ 77.452074][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 77.454458][ C0] usb_probe_interface+0x653/0xc60 [ 77.456392][ C0] ? __pfx_usb_probe_interface+0x10/0x10 [ 77.458782][ C0] really_probe+0x254/0xae0 [ 77.460601][ C0] __driver_probe_device+0x1e8/0x360 [ 77.462748][ C0] driver_probe_device+0x4f/0x240 [ 77.464888][ C0] __device_attach_driver+0x270/0x410 [ 77.467154][ C0] bus_for_each_drv+0x258/0x2f0 [ 77.469016][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 77.471428][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 77.473575][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 77.475955][ C0] __device_attach+0x2c4/0x450 [ 77.477974][ C0] ? __pfx___device_attach+0x10/0x10 [ 77.480130][ C0] ? do_raw_spin_unlock+0x4d/0x200 [ 77.482275][ C0] ? _raw_spin_unlock+0x28/0x50 [ 77.484306][ C0] device_initial_probe+0xa1/0xd0 [ 77.486405][ C0] bus_probe_device+0x12a/0x220 [ 77.488398][ C0] device_add+0x7d7/0xb80 [ 77.490282][ C0] usb_set_configuration+0x1ad8/0x2180 [ 77.492592][ C0] usb_generic_driver_probe+0x8d/0x150 [ 77.494881][ C0] usb_probe_device+0x1c3/0x3b0 [ 77.496919][ C0] ? __pfx_usb_probe_device+0x10/0x10 [ 77.499164][ C0] really_probe+0x254/0xae0 [ 77.501069][ C0] __driver_probe_device+0x1e8/0x360 [ 77.503249][ C0] driver_probe_device+0x4f/0x240 [ 77.505413][ C0] __device_attach_driver+0x270/0x410 [ 77.507974][ C0] bus_for_each_drv+0x258/0x2f0 [ 77.509997][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 77.512433][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 77.514828][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 77.517367][ C0] __device_attach+0x2c4/0x450 [ 77.519400][ C0] ? __pfx___device_attach+0x10/0x10 [ 77.521607][ C0] ? do_raw_spin_unlock+0x4d/0x200 [ 77.523758][ C0] ? _raw_spin_unlock+0x28/0x50 [ 77.525790][ C0] device_initial_probe+0xa1/0xd0 [ 77.527845][ C0] bus_probe_device+0x12a/0x220 [ 77.529826][ C0] device_add+0x7d7/0xb80 [ 77.531588][ C0] usb_new_device+0x9aa/0x1690 [ 77.533695][ C0] ? __pfx_usb_new_device+0x10/0x10 [ 77.535794][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 77.537906][ C0] hub_event+0x28e8/0x4d30 [ 77.539786][ C0] ? __pfx_hub_event+0x10/0x10 [ 77.541787][ C0] ? process_scheduled_works+0xa1a/0x14c0 [ 77.544047][ C0] ? rcu_is_watching+0x16/0xb0 [ 77.546002][ C0] ? process_scheduled_works+0xa1a/0x14c0 [ 77.548415][ C0] process_scheduled_works+0xa88/0x14c0 [ 77.550615][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 77.553033][ C0] ? assign_work+0x3cf/0x5d0 [ 77.554850][ C0] worker_thread+0xa47/0xfb0 [ 77.556769][ C0] ? __kthread_parkme+0x71/0x1f0 [ 77.558847][ C0] kthread+0x38b/0x480 [ 77.560520][ C0] ? __pfx_worker_thread+0x10/0x10 [ 77.562584][ C0] ? __pfx_kthread+0x10/0x10 [ 77.564459][ C0] ret_from_fork+0x514/0xb70 [ 77.566409][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 77.569010][ C0] ? __switch_to+0xc89/0x1420 [ 77.571363][ C0] ? __pfx_kthread+0x10/0x10 [ 77.573696][ C0] ret_from_fork_asm+0x1a/0x30 [ 77.575722][ C0] [ 77.577023][ C0] Modules linked in: [ 77.578658][ C0] ---[ end trace 0000000000000000 ]--- [ 77.580811][ C0] RIP: 0010:f_midi2_stop_eps+0x5f/0x4d0 [ 77.583036][ C0] Code: e8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 ef e8 77 f9 63 fa 41 bc 30 07 00 00 4c 03 65 00 4c 89 e0 48 c1 e8 03 48 89 44 24 10 <42> 0f b6 04 28 84 c0 0f 85 23 04 00 00 41 8b 1c 24 31 ff 89 de e8 [ 77.591048][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002 [ 77.593604][ C0] RAX: 00000000000000e6 RBX: 0000000000000001 RCX: ffff8880341a2580 [ 77.596788][ C0] RDX: 8000000000000100 RSI: 0000000000000100 RDI: ffff8880129e4148 [ 77.599811][ C0] RBP: ffff8880129e40f0 R08: ffff8880129e414f R09: 1ffff1100253c829 [ 77.602930][ C0] R10: dffffc0000000000 R11: ffffed100253c82a R12: 0000000000000730 [ 77.605948][ C0] R13: dffffc0000000000 R14: ffff8880129e4128 R15: 0000000000000001 [ 77.609034][ C0] FS: 0000000000000000(0000) GS:ffff88808c519000(0000) knlGS:0000000000000000 [ 77.612557][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 77.615199][ C0] CR2: 00007ff205e1c0f5 CR3: 000000001270c000 CR4: 0000000000352ef0 [ 77.618483][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 77.621691][ C0] Kernel Offset: disabled [ 77.623449][ C0] Rebooting in 86400 seconds..