------------[ cut here ]------------
usb_ep_enable: ep129 (ep1in-bulk) has maxpacket 0
WARNING: CPU: 0 PID: 3491 at drivers/usb/gadget/udc/core.c:125 usb_ep_enable+0x263/0x440 drivers/usb/gadget/udc/core.c:124
Modules linked in:
CPU: 0 PID: 3491 Comm: kworker/u4:12 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Workqueue: events_unbound nsim_dev_trap_report_work
RIP: 0010:usb_ep_enable+0x263/0x440 drivers/usb/gadget/udc/core.c:124
Code: 49 8b 0e 48 c7 c0 20 45 9a 8b 49 c7 c0 40 45 9a 8b 4c 0f 44 c0 48 c7 c7 e0 44 9a 8b 48 c7 c6 b2 21 c9 8c 89 ea e8 bd 05 9a fa <0f> 0b e9 e1 fe ff ff e8 91 57 d0 fa 49 bc 00 00 00 00 00 fc ff df
RSP: 0018:ffffc90000007790 EFLAGS: 00010046
RAX: e13490a801d6b900 RBX: ffff8881437100e0 RCX: ffff88802f6eda00
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002
RBP: 0000000000000081 R08: ffff8880b8c28c53 R09: 1ffff1101718518a
R10: dffffc0000000000 R11: ffffed101718518b R12: dffffc0000000000
R13: ffff88814371010d R14: ffff8881437100e8 R15: ffff88806ce66d3a
FS: 0000000000000000(0000) GS:ffff8880b8c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c3e0030 CR3: 0000000032529000 CR4: 00000000003506f0
Call Trace:
hidg_set_alt+0x12a/0xa10 drivers/usb/gadget/function/f_hid.c:827
set_config+0x735/0xff0 drivers/usb/gadget/composite.c:1018
composite_setup+0x1df4/0x33a0 drivers/usb/gadget/composite.c:1925
configfs_composite_setup+0xc7/0x100 drivers/usb/gadget/configfs.c:1875
dummy_timer+0x130c/0x35d0 drivers/usb/gadget/udc/dummy_hcd.c:1953
__run_hrtimer kernel/time/hrtimer.c:1754 [inline]
__hrtimer_run_queues+0x525/0xc10 kernel/time/hrtimer.c:1818
hrtimer_run_softirq+0x177/0x290 kernel/time/hrtimer.c:1835
handle_softirqs+0x27d/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:202
Code: 00 f3 0f 1e fa 53 48 89 fb 48 83 c7 18 48 8b 74 24 08 e8 1a b2 c8 f6 48 89 df e8 c2 85 c9 f6 e8 ed 9f ed f6 fb bf 01 00 00 00 52 88 bc f6 65 8b 05 13 0e 63 75 85 c0 74 02 5b c3 e8 00 f3 5f
RSP: 0018:ffffc9000ca4fbb0 EFLAGS: 00000282
RAX: e13490a801d6b900 RBX: ffff888019650000 RCX: e13490a801d6b900
RDX: dffffc0000000000 RSI: ffffffff8aead140 RDI: 0000000000000001
RBP: ffffc9000ca4fda8 R08: ffffffff8f8dd86f R09: 1ffffffff1f1bb0d
R10: dffffc0000000000 R11: fffffbfff1f1bb0e R12: ffff888031685800
R13: dffffc0000000000 R14: 0000000000000100 R15: ffff88814c78ab18
process_one_work kernel/workqueue.c:2628 [inline]
process_scheduled_works+0x8b1/0x1600 kernel/workqueue.c:2734
worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
----------------
Code disassembly (best guess):
0: 00 f3 add %dh,%bl
2: 0f 1e fa nop %edx
5: 53 push %rbx
6: 48 89 fb mov %rdi,%rbx
9: 48 83 c7 18 add $0x18,%rdi
d: 48 8b 74 24 08 mov 0x8(%rsp),%rsi
12: e8 1a b2 c8 f6 call 0xf6c8b231
17: 48 89 df mov %rbx,%rdi
1a: e8 c2 85 c9 f6 call 0xf6c985e1
1f: e8 ed 9f ed f6 call 0xf6eda011
24: fb sti
25: bf 01 00 00 00 mov $0x1,%edi
* 2a: e8 52 88 bc f6 call 0xf6bc8881 <-- trapping instruction
2f: 65 8b 05 13 0e 63 75 mov %gs:0x75630e13(%rip),%eax # 0x75630e49
36: 85 c0 test %eax,%eax
38: 74 02 je 0x3c
3a: 5b pop %rbx
3b: c3 ret
3c: e8 .byte 0xe8
3d: 00 f3 add %dh,%bl
3f: 5f pop %rdi