program: r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f00000000c0), 0x8001, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) r3 = socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/direction\x00', 0x1, 0x0) write(r4, &(0x7f00000002c0)='1', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/midi2.usb0/ep.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/functions/midi2.usb0/ep.2\x00', 0x1ff) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/configs/c.1/midi2.usb0\x00') r5 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r5, &(0x7f0000000680)='dummy_udc.0', 0xb) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r6, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x14, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x3}, @TCA_FQ_CODEL_CE_THRESHOLD_MASK={0x5, 0xb, 0x6}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x240040e1}, 0x4890) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r7, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r7, &(0x7f00000002c0)="05031c00d3fc140000004788031c09102c28", 0x12, 0x4, &(0x7f0000000140)={0x11, 0x15, r8, 0x1, 0x0, 0x6, @local}, 0x14) write$FUSE_INIT(r0, 0x0, 0x0) lseek(r7, 0xe, 0x3) [ 95.512269][ T4643] Bluetooth: hci0: command tx timeout [ 95.726169][ T5313] sound umpC3D1: No UMP Group is found in FB [ 95.729417][ T5313] sound umpC3D2: No UMP Group is found in FB [ 95.799240][ T5314] syzkaller0: entered promiscuous mode [ 95.827806][ T5314] syzkaller0: entered allmulticast mode [ 96.303072][ T4693] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 96.454848][ T4693] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.02 [ 96.460636][ T4693] usb 5-1: Dual-Role OTG device on HNP port [ 96.464022][ T4693] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 96.501070][ T4693] gspca_main: spca501-2.14.0 probing 0000:0000 [ 96.507002][ T4693] gspca_spca501: reg write: error -32 [ 96.509746][ T4693] spca501 5-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 96.513882][ T4693] spca501 5-1:1.0: probe with driver spca501 failed with error -22 [ 96.522099][ C0] Oops: general protection fault, probably for non-canonical address 0xdffffc00000000e6: 0000 [#1] SMP KASAN NOPTI [ 96.527106][ C0] KASAN: null-ptr-deref in range [0x0000000000000730-0x0000000000000737] [ 96.530695][ C0] CPU: 0 UID: 0 PID: 4693 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full) [ 96.534785][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 96.539315][ C0] Workqueue: usb_hub_wq hub_event [ 96.541592][ C0] RIP: 0010:f_midi2_stop_eps+0x28e/0x4d0 [ 96.544104][ C0] Code: 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 97 49 64 fa 41 bf 30 07 00 00 4d 03 3e 4c 89 f8 48 c1 e8 03 48 89 44 24 18 <42> 0f b6 04 28 84 c0 0f 85 12 02 00 00 41 8b 1f 31 ff 89 de e8 69 [ 96.552504][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002 [ 96.555299][ C0] RAX: 00000000000000e6 RBX: ffff888012814120 RCX: ffff888000f18000 [ 96.558769][ C0] RDX: 8000000000000100 RSI: 0000000000000100 RDI: ffffffff8c4c0720 [ 96.562168][ C0] RBP: ffff888012814100 R08: 000000007c1ad9e0 R09: 000000001f829461 [ 96.565783][ C0] R10: 0000000000000010 R11: ffffffff8eb5a120 R12: ffff888012814730 [ 96.569278][ C0] R13: dffffc0000000000 R14: ffff888012814128 R15: 0000000000000730 [ 96.573013][ C0] FS: 0000000000000000(0000) GS:ffff88808c526000(0000) knlGS:0000000000000000 [ 96.577133][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 96.579894][ C0] CR2: 00007fd56c7c80f5 CR3: 000000004f710000 CR4: 0000000000352ef0 [ 96.583318][ C0] Call Trace: [ 96.584835][ C0] [ 96.586105][ C0] f_midi2_set_alt+0x11c/0xf00 [ 96.588273][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 96.590528][ C0] composite_setup+0x1ffd/0x3480 [ 96.592684][ C0] configfs_composite_setup+0xc7/0x100 [ 96.595325][ C0] dummy_timer+0x2f43/0x4cf0 [ 96.597490][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 96.599767][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 96.601814][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 96.604172][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 96.606301][ C0] __hrtimer_run_queues+0x3bc/0xa10 [ 96.608689][ C0] hrtimer_run_softirq+0x1e3/0x2e0 [ 96.610881][ C0] handle_softirqs+0x226/0x860 [ 96.613032][ C0] ? __irq_exit_rcu+0xcb/0x220 [ 96.615138][ C0] __irq_exit_rcu+0xcb/0x220 [ 96.617012][ C0] irq_exit_rcu+0x9/0x30 [ 96.618855][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 96.621273][ C0] [ 96.622656][ C0] [ 96.623967][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 96.626683][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 [ 96.629761][ C0] Code: f7 e8 bd 1d c9 f5 f7 c3 00 02 00 00 74 05 e8 f0 3b f5 f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 a4 3f ba f5 65 48 8b 05 4c 80 95 07 48 85 c0 74 18 5b 41 5e e9 [ 96.638151][ C0] RSP: 0018:ffffc9000252e7f0 EFLAGS: 00000206 [ 96.641194][ C0] RAX: 0000000000000006 RBX: 0000000000000246 RCX: 8000000000000001 [ 96.644661][ C0] RDX: 0000000000000006 RSI: ffffffff8e23bfbe RDI: 0000000000000001 [ 96.648278][ C0] RBP: 0000000000000007 R08: ffffffff90585b37 R09: 1ffffffff20b0b66 [ 96.651897][ C0] R10: dffffc0000000000 R11: fffffbfff20b0b67 R12: 0000000000000000 [ 96.655094][ C0] R13: dffffc0000000000 R14: ffff888034038000 R15: 1ffff11006871094 [ 96.658681][ C0] dummy_urb_enqueue+0x587/0x780 [ 96.660850][ C0] usb_hcd_submit_urb+0x328/0x1b60 [ 96.663650][ C0] usb_start_wait_urb+0x13f/0x5b0 [ 96.666419][ C0] ? trace_kmalloc+0x2a/0xf0 [ 96.668489][ C0] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 96.670834][ C0] usb_control_msg+0x234/0x3e0 [ 96.672817][ C0] usb_set_interface+0x521/0x1470 [ 96.674974][ C0] snd_usb_midi_v2_create+0x621/0x4ac0 [ 96.677451][ C0] ? __pfx_proc_audio_usbid_read+0x10/0x10 [ 96.680081][ C0] ? snd_card_rw_proc_new+0x10d/0x140 [ 96.682414][ C0] ? __pfx_snd_usb_midi_v2_create+0x10/0x10 [ 96.685011][ C0] ? usb_ifnum_to_if+0x262/0x2f0 [ 96.687092][ C0] snd_usb_create_stream+0x262/0x630 [ 96.689409][ C0] usb_audio_probe+0x144c/0x2240 [ 96.691546][ C0] ? __pfx_usb_audio_probe+0x10/0x10 [ 96.693886][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 96.696597][ C0] usb_probe_interface+0x653/0xc60 [ 96.698832][ C0] ? __pfx_usb_probe_interface+0x10/0x10 [ 96.701275][ C0] really_probe+0x254/0xae0 [ 96.703206][ C0] __driver_probe_device+0x1e8/0x360 [ 96.705498][ C0] driver_probe_device+0x4f/0x240 [ 96.707778][ C0] __device_attach_driver+0x270/0x410 [ 96.710158][ C0] bus_for_each_drv+0x258/0x2f0 [ 96.712247][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 96.714782][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 96.717030][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 96.719609][ C0] __device_attach+0x2c4/0x450 [ 96.721760][ C0] ? __pfx___device_attach+0x10/0x10 [ 96.724171][ C0] ? do_raw_spin_unlock+0x4d/0x200 [ 96.726603][ C0] ? _raw_spin_unlock+0x28/0x50 [ 96.728846][ C0] device_initial_probe+0xa1/0xd0 [ 96.731018][ C0] bus_probe_device+0x12a/0x220 [ 96.733166][ C0] device_add+0x7d7/0xb80 [ 96.735069][ C0] usb_set_configuration+0x1ad8/0x2180 [ 96.737615][ C0] usb_generic_driver_probe+0x8d/0x150 [ 96.740320][ C0] usb_probe_device+0x1c3/0x3b0 [ 96.742318][ C0] ? __pfx_usb_probe_device+0x10/0x10 [ 96.744448][ C0] really_probe+0x254/0xae0 [ 96.746205][ C0] __driver_probe_device+0x1e8/0x360 [ 96.748406][ C0] driver_probe_device+0x4f/0x240 [ 96.750475][ C0] __device_attach_driver+0x270/0x410 [ 96.752847][ C0] bus_for_each_drv+0x258/0x2f0 [ 96.754923][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 96.757445][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 96.759914][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 96.762587][ C0] __device_attach+0x2c4/0x450 [ 96.764681][ C0] ? __pfx___device_attach+0x10/0x10 [ 96.766753][ C0] ? do_raw_spin_unlock+0x4d/0x200 [ 96.768894][ C0] ? _raw_spin_unlock+0x28/0x50 [ 96.770993][ C0] device_initial_probe+0xa1/0xd0 [ 96.773219][ C0] bus_probe_device+0x12a/0x220 [ 96.775342][ C0] device_add+0x7d7/0xb80 [ 96.777210][ C0] usb_new_device+0x9aa/0x1690 [ 96.779374][ C0] ? __pfx_usb_new_device+0x10/0x10 [ 96.781791][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 96.784309][ C0] hub_event+0x28e8/0x4d30 [ 96.786352][ C0] ? do_raw_spin_unlock+0x4d/0x200 [ 96.788690][ C0] ? __pfx_hub_event+0x10/0x10 [ 96.790689][ C0] ? process_scheduled_works+0xa1a/0x14c0 [ 96.793186][ C0] ? rcu_is_watching+0x16/0xb0 [ 96.795186][ C0] ? process_scheduled_works+0xa1a/0x14c0 [ 96.797751][ C0] process_scheduled_works+0xa88/0x14c0 [ 96.800177][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 96.802742][ C0] ? assign_work+0x3cf/0x5d0 [ 96.804826][ C0] worker_thread+0xa47/0xfb0 [ 96.807041][ C0] kthread+0x38b/0x480 [ 96.808979][ C0] ? __pfx_worker_thread+0x10/0x10 [ 96.811139][ C0] ? __pfx_kthread+0x10/0x10 [ 96.813055][ C0] ret_from_fork+0x514/0xb70 [ 96.814943][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 96.817186][ C0] ? __switch_to+0xc89/0x1420 [ 96.819289][ C0] ? __pfx_kthread+0x10/0x10 [ 96.821696][ C0] ret_from_fork_asm+0x1a/0x30 [ 96.823918][ C0] [ 96.825358][ C0] Modules linked in: [ 96.827149][ C0] ---[ end trace 0000000000000000 ]--- [ 96.829560][ C0] RIP: 0010:f_midi2_stop_eps+0x28e/0x4d0 [ 96.832018][ C0] Code: 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 97 49 64 fa 41 bf 30 07 00 00 4d 03 3e 4c 89 f8 48 c1 e8 03 48 89 44 24 18 <42> 0f b6 04 28 84 c0 0f 85 12 02 00 00 41 8b 1f 31 ff 89 de e8 69 [ 96.840376][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002 [ 96.842806][ C0] RAX: 00000000000000e6 RBX: ffff888012814120 RCX: ffff888000f18000 [ 96.846153][ C0] RDX: 8000000000000100 RSI: 0000000000000100 RDI: ffffffff8c4c0720 [ 96.849741][ C0] RBP: ffff888012814100 R08: 000000007c1ad9e0 R09: 000000001f829461 [ 96.853227][ C0] R10: 0000000000000010 R11: ffffffff8eb5a120 R12: ffff888012814730 [ 96.856619][ C0] R13: dffffc0000000000 R14: ffff888012814128 R15: 0000000000000730 [ 96.859823][ C0] FS: 0000000000000000(0000) GS:ffff88808c526000(0000) knlGS:0000000000000000 [ 96.863420][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 96.865985][ C0] CR2: 00007fd56c7c80f5 CR3: 000000004f710000 CR4: 0000000000352ef0 [ 96.869449][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 96.872964][ C0] Kernel Offset: disabled [ 96.874901][ C0] Rebooting in 86400 seconds..