program:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x3000004, 0x3032, 0xffffffffffffffff, 0xad7e0000)
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000240)={0x1, 0x0, [{0x4b564d00, 0x0, 0xfff}]})
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/direction\x00', 0x1, 0x0)
write(r4, &(0x7f00000002c0)='1', 0x1)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/num_groups\x00', 0x1, 0x0)
write(r5, &(0x7f0000000380)='2', 0x1)
r6 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/midi1_num_groups\x00', 0x1, 0x0)
write(r6, &(0x7f0000000440)='2', 0x1)
symlinkat(&(0x7f0000000880)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000008c0)='./my_configfs/usb_gadget/g1/configs/c.1/midi2.usb0\x00')
r7 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./my_configfs/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r7, &(0x7f0000000940)='dummy_udc.0', 0xb)
r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000cc0), r0)
sendmsg$IEEE802154_LIST_IFACE(r0, &(0x7f0000000dc0)={0x0, 0x0, &(0x7f0000000d80)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c00008aa09fbbf8033afdfa039700", @ANYRES64=0x0, @ANYBLOB="010028bd7000f9dbdf251f00000008000200fbd762c4919a03fb9d2fd28019d3db58dfc4440530c91e0b1d4328a699537d4b69873e3eb6f15d17a4b269bbabf98de545a2e9e3d327298853263b750e154d307857f8f54ea9e200de5d86caee1eef2ef85d9c", @ANYRESDEC=0x0, @ANYBLOB="5552c107c3dc22e1c954da65da6a37de337025f4940d1944b49f1f1b655f2d807218055515ef5bd671fde25b520598e85d16ff87c7af2a46988292258c3d36f6c1c92ad2d368846b1cc4dcad4840212102594e10a9347c6750e5deec7bbcaa1236dd8566461f82968382aaa4a36e2dce67e4e43eb0c7af3fee8628ce5cb65eb7fd8b773bfe173df012f415ed6491130926df680d1b97cabf89e7df6a0f72761ec0c18de51147212aec83fe163f79d5896690e01afa"], 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
r9 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r0)
sendmsg$NFC_CMD_VENDOR(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r9, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@NFC_ATTR_VENDOR_SUBCMD={0x8, 0x1e, 0x8000}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20008000}, 0x4000)
syz_usb_connect$hid(0x0, 0x36, &(0x7f00000002c0)=ANY=[@ANYBLOB="39be267d7137c40a14f986a4ad23d0c43e4f3892ec08084be1dc1bc4235e13902e4e4f93a339d13a490c6b5a729df254f6fa3c06e790ea34c324bbaf581e6ba3ad56a398a8cf6a3fc980f9074163db15928a6dc78be20405b4ed0173b1abcf930f28c2de3f94581f32b56b54ecb493ce9a9afef9e35a554580ffd31e99eb648758bf596cb7b03776a6e693915f590293d18300f7e3f783c45daf102630b17e317d3f41cbefc9c52316b76a3bb5e64359d64baa2c7bab0e2dc75b69c1cf5c8bc6df8d8f75170fdf09e4b4e8f53df094985a7671b888957764f0912bf3f879f56232dac979496067481afe0da6addc632977f3baa5fb9e4c5aaf", @ANYRES16=r8], 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x34202)
r10 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x1021, 0x800000000004, @tid=r10}, &(0x7f0000000040))
openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x200)
[ 92.485715][ T4643] Bluetooth: hci0: command tx timeout
[ 92.526115][ T9] cfg80211: failed to load regulatory.db
[ 92.969018][ T5319] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 92.981616][ T5319] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 93.204321][ T10] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 93.355243][ T10] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.02
[ 93.360540][ T10] usb 5-1: Dual-Role OTG device on HNP port
[ 93.363576][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 93.393834][ T10] gspca_main: spca501-2.14.0 probing 0000:0000
[ 93.397849][ T10] gspca_spca501: reg write: error -32
[ 93.400097][ T10] spca501 5-1:1.0: Reg write failed for 0x02,0x0f,0x05
[ 93.403044][ T10] spca501 5-1:1.0: probe with driver spca501 failed with error -22
[ 93.413210][ C0] Oops: general protection fault, probably for non-canonical address 0xdffffc00000000e6: 0000 [#1] SMP KASAN NOPTI
[ 93.418076][ C0] KASAN: null-ptr-deref in range [0x0000000000000730-0x0000000000000737]
[ 93.421522][ C0] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full)
[ 93.425448][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 93.429684][ C0] Workqueue: usb_hub_wq hub_event
[ 93.431843][ C0] RIP: 0010:f_midi2_stop_eps+0x28e/0x4d0
[ 93.434220][ C0] Code: 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 b7 42 65 fa 41 bf 30 07 00 00 4d 03 3e 4c 89 f8 48 c1 e8 03 48 89 44 24 18 <42> 0f b6 04 28 84 c0 0f 85 12 02 00 00 41 8b 1f 31 ff 89 de e8 89
[ 93.442106][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002
[ 93.444672][ C0] RAX: 00000000000000e6 RBX: ffff888012fe4120 RCX: ffff88801bf1a580
[ 93.447923][ C0] RDX: 0000000000000100 RSI: ffffffff8c4be660 RDI: ffffffff8c4be620
[ 93.451086][ C0] RBP: ffff888012fe4100 R08: 000000006310b934 R09: 00000000ea41176d
[ 93.454164][ C0] R10: 0000000000000010 R11: ffffffff8eb59d60 R12: ffff888012fe4730
[ 93.457296][ C0] R13: dffffc0000000000 R14: ffff888012fe4128 R15: 0000000000000730
[ 93.460512][ C0] FS: 0000000000000000(0000) GS:ffff88808c539000(0000) knlGS:0000000000000000
[ 93.463796][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 93.466313][ C0] CR2: 00007f32b2d300f5 CR3: 00000000127cf000 CR4: 0000000000352ef0
[ 93.469166][ C0] Call Trace:
[ 93.470419][ C0]
[ 93.471458][ C0] f_midi2_set_alt+0x11c/0xf00
[ 93.473147][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 93.475088][ C0] composite_setup+0x1ffd/0x3480
[ 93.476887][ C0] configfs_composite_setup+0xc7/0x100
[ 93.478903][ C0] dummy_timer+0x2f43/0x4cf0
[ 93.480717][ C0] ? __lock_acquire+0x683/0x2cf0
[ 93.482705][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 93.484869][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 93.486904][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 93.489235][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 93.491287][ C0] __hrtimer_run_queues+0x3bc/0xa10
[ 93.493447][ C0] hrtimer_run_softirq+0x17a/0x240
[ 93.495513][ C0] handle_softirqs+0x225/0x840
[ 93.497437][ C0] ? __irq_exit_rcu+0xca/0x220
[ 93.499426][ C0] __irq_exit_rcu+0xca/0x220
[ 93.501254][ C0] irq_exit_rcu+0x9/0x30
[ 93.502986][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0
[ 93.505291][ C0]
[ 93.506472][ C0]
[ 93.507754][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 93.510291][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80
[ 93.512961][ C0] Code: f7 e8 9d 6d cb f5 f7 c3 00 02 00 00 74 05 e8 90 5e f7 f5 9c 58 a9 00 02 00 00 75 27 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 34 81 bc f5 65 8b 05 fd 7f 96 07 85 c0 74 18 5b 41 5e c3 cc cc
[ 93.521407][ C0] RSP: 0018:ffffc9000023e668 EFLAGS: 00000206
[ 93.524016][ C0] RAX: 0000000000000006 RBX: 0000000000000292 RCX: 0000000080000001
[ 93.527536][ C0] RDX: 0000000000000006 RSI: ffffffff8e2307bd RDI: 0000000000000001
[ 93.530808][ C0] RBP: 0000000000000000 R08: ffffffff9057ad37 R09: 1ffffffff20af5a6
[ 93.534259][ C0] R10: dffffc0000000000 R11: fffffbfff20af5a7 R12: ffffffff81b3e7c0
[ 93.537583][ C0] R13: ffffc9000023e6e0 R14: ffffffff9a9acce0 R15: ffffc9000023e6e0
[ 93.540902][ C0] ? __pfx_process_timeout+0x10/0x10
[ 93.543197][ C0] timer_init_key_on_stack+0x3c/0x110
[ 93.545432][ C0] schedule_timeout+0x140/0x2c0
[ 93.547462][ C0] ? __pfx_schedule_timeout+0x10/0x10
[ 93.549503][ C0] ? _raw_spin_unlock_irq+0x23/0x50
[ 93.551480][ C0] wait_for_completion_timeout+0x2cf/0x610
[ 93.553671][ C0] ? wait_for_completion_timeout+0x265/0x610
[ 93.556112][ C0] ? __pfx_wait_for_completion_timeout+0x10/0x10
[ 93.558680][ C0] usb_start_wait_urb+0x1e9/0x5b0
[ 93.560726][ C0] ? trace_kmalloc+0x2a/0xf0
[ 93.562709][ C0] ? __pfx_usb_start_wait_urb+0x10/0x10
[ 93.565007][ C0] usb_control_msg+0x234/0x3e0
[ 93.566933][ C0] usb_set_interface+0x521/0x1470
[ 93.569021][ C0] snd_usb_midi_v2_create+0x621/0x4ac0
[ 93.570984][ C0] ? __pfx_proc_audio_usbid_read+0x10/0x10
[ 93.573445][ C0] ? snd_card_rw_proc_new+0x10d/0x140
[ 93.575730][ C0] ? __pfx_snd_usb_midi_v2_create+0x10/0x10
[ 93.578156][ C0] ? usb_ifnum_to_if+0x262/0x2f0
[ 93.580137][ C0] snd_usb_create_stream+0x262/0x630
[ 93.582368][ C0] usb_audio_probe+0x1447/0x2280
[ 93.584424][ C0] ? __pfx_usb_audio_probe+0x10/0x10
[ 93.586577][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 93.589024][ C0] usb_probe_interface+0x653/0xc60
[ 93.591254][ C0] ? __pfx_usb_probe_interface+0x10/0x10
[ 93.593653][ C0] really_probe+0x254/0xae0
[ 93.595624][ C0] __driver_probe_device+0x1e8/0x360
[ 93.597907][ C0] driver_probe_device+0x4f/0x240
[ 93.600056][ C0] __device_attach_driver+0x270/0x410
[ 93.602408][ C0] bus_for_each_drv+0x258/0x2f0
[ 93.604548][ C0] ? __pfx___device_attach_driver+0x10/0x10
[ 93.607092][ C0] ? __pfx_bus_for_each_drv+0x10/0x10
[ 93.609412][ C0] ? lockdep_hardirqs_on+0x7a/0x110
[ 93.611666][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 93.614142][ C0] __device_attach+0x2c4/0x450
[ 93.616262][ C0] ? __pfx___device_attach+0x10/0x10
[ 93.618554][ C0] ? do_raw_spin_unlock+0x4d/0x210
[ 93.620681][ C0] ? _raw_spin_unlock+0x28/0x50
[ 93.622763][ C0] device_initial_probe+0xa1/0xd0
[ 93.624939][ C0] bus_probe_device+0x12a/0x220
[ 93.627009][ C0] device_add+0x7d7/0xb80
[ 93.628833][ C0] usb_set_configuration+0x1ad8/0x2180
[ 93.631009][ C0] usb_generic_driver_probe+0x8d/0x150
[ 93.633238][ C0] usb_probe_device+0x1c3/0x3b0
[ 93.635362][ C0] ? __pfx_usb_probe_device+0x10/0x10
[ 93.637634][ C0] really_probe+0x254/0xae0
[ 93.639639][ C0] __driver_probe_device+0x1e8/0x360
[ 93.641883][ C0] driver_probe_device+0x4f/0x240
[ 93.644023][ C0] __device_attach_driver+0x270/0x410
[ 93.646389][ C0] bus_for_each_drv+0x258/0x2f0
[ 93.648362][ C0] ? __pfx___device_attach_driver+0x10/0x10
[ 93.650875][ C0] ? __pfx_bus_for_each_drv+0x10/0x10
[ 93.653093][ C0] ? lockdep_hardirqs_on+0x7a/0x110
[ 93.655359][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 93.657759][ C0] __device_attach+0x2c4/0x450
[ 93.659775][ C0] ? __pfx___device_attach+0x10/0x10
[ 93.662018][ C0] ? do_raw_spin_unlock+0x4d/0x210
[ 93.664210][ C0] ? _raw_spin_unlock+0x28/0x50
[ 93.666284][ C0] device_initial_probe+0xa1/0xd0
[ 93.668437][ C0] bus_probe_device+0x12a/0x220
[ 93.670512][ C0] device_add+0x7d7/0xb80
[ 93.672408][ C0] usb_new_device+0x9aa/0x1690
[ 93.674415][ C0] ? __pfx_usb_new_device+0x10/0x10
[ 93.676516][ C0] ? _raw_spin_unlock_irq+0x23/0x50
[ 93.678614][ C0] hub_event+0x28e8/0x4d30
[ 93.680497][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 93.682927][ C0] ? __pfx_hub_event+0x10/0x10
[ 93.685024][ C0] ? process_scheduled_works+0xa20/0x14e0
[ 93.687423][ C0] ? rcu_is_watching+0x15/0xb0
[ 93.689407][ C0] ? process_scheduled_works+0xa20/0x14e0
[ 93.691655][ C0] process_scheduled_works+0xa8e/0x14e0
[ 93.693867][ C0] ? __pfx_process_scheduled_works+0x10/0x10
[ 93.696487][ C0] ? assign_work+0x3cf/0x5d0
[ 93.698531][ C0] worker_thread+0xa47/0xfb0
[ 93.700507][ C0] kthread+0x388/0x470
[ 93.702250][ C0] ? __pfx_worker_thread+0x10/0x10
[ 93.704356][ C0] ? __pfx_kthread+0x10/0x10
[ 93.706217][ C0] ret_from_fork+0x514/0xb70
[ 93.708088][ C0] ? __pfx_ret_from_fork+0x10/0x10
[ 93.710120][ C0] ? __switch_to+0xc89/0x1420
[ 93.712119][ C0] ? __pfx_kthread+0x10/0x10
[ 93.714054][ C0] ret_from_fork_asm+0x1a/0x30
[ 93.716063][ C0]
[ 93.717316][ C0] Modules linked in:
[ 93.718941][ C0] ---[ end trace 0000000000000000 ]---
[ 93.721174][ C0] RIP: 0010:f_midi2_stop_eps+0x28e/0x4d0
[ 93.723472][ C0] Code: 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 b7 42 65 fa 41 bf 30 07 00 00 4d 03 3e 4c 89 f8 48 c1 e8 03 48 89 44 24 18 <42> 0f b6 04 28 84 c0 0f 85 12 02 00 00 41 8b 1f 31 ff 89 de e8 89
[ 93.731502][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002
[ 93.734063][ C0] RAX: 00000000000000e6 RBX: ffff888012fe4120 RCX: ffff88801bf1a580
[ 93.737421][ C0] RDX: 0000000000000100 RSI: ffffffff8c4be660 RDI: ffffffff8c4be620
[ 93.740584][ C0] RBP: ffff888012fe4100 R08: 000000006310b934 R09: 00000000ea41176d
[ 93.743756][ C0] R10: 0000000000000010 R11: ffffffff8eb59d60 R12: ffff888012fe4730
[ 93.746961][ C0] R13: dffffc0000000000 R14: ffff888012fe4128 R15: 0000000000000730
[ 93.750055][ C0] FS: 0000000000000000(0000) GS:ffff88808c539000(0000) knlGS:0000000000000000
[ 93.753531][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 93.756160][ C0] CR2: 00007f32b2d300f5 CR3: 00000000127cf000 CR4: 0000000000352ef0
[ 93.759337][ C0] Kernel panic - not syncing: Fatal exception in interrupt
[ 93.762636][ C0] Kernel Offset: disabled
[ 93.764418][ C0] Rebooting in 86400 seconds..