------------[ cut here ]------------
usb_ep_enable: ep129 (ep1in-bulk) has maxpacket 0
WARNING: drivers/usb/gadget/udc/core.c:124 at usb_ep_enable+0x3e6/0x490 drivers/usb/gadget/udc/core.c:124, CPU#1: syz.2.607/7982
Modules linked in:
CPU: 1 UID: 0 PID: 7982 Comm: syz.2.607 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:usb_ep_enable+0x3f8/0x490 drivers/usb/gadget/udc/core.c:124
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 93 00 00 00 48 8d 3d 7a ff 63 09 48 8b 4b 08 40 0f b6 d5 4d 89 e0 48 c7 c6 c0 34 b7 8c <67> 48 0f b9 3a bd ea ff ff ff e9 8e fd ff ff 49 c7 c4 60 27 b7 8c
RSP: 0000:ffffc90000590a10 EFLAGS: 00010046
RAX: dffffc0000000000 RBX: ffff8880225e80e0 RCX: ffffffff8cb76b60
RDX: 0000000000000081 RSI: ffffffff8cb734c0 RDI: ffffffff912f7360
RBP: 0000000000000081 R08: ffffffff8cb727a0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffffffff8cb727a0
R13: 0000000000000000 R14: ffff8880225e80e0 R15: ffff88804bb1bc20
FS: 0000000000000000(0000) GS:ffff888096cf4000(0063) knlGS:0000000056f16480
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f73a82f0 CR3: 0000000025cb4000 CR4: 0000000000352ef0
Call Trace:
hidg_set_alt+0x190/0xa10 drivers/usb/gadget/function/f_hid.c:1042
set_config drivers/usb/gadget/composite.c:1018 [inline]
composite_setup+0x2ccf/0x9290 drivers/usb/gadget/composite.c:1901
configfs_composite_setup+0xfb/0x130 drivers/usb/gadget/configfs.c:1877
dummy_timer+0x2045/0x36f0 drivers/usb/gadget/udc/dummy_hcd.c:1951
__run_hrtimer kernel/time/hrtimer.c:2032 [inline]
__hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2096
hrtimer_run_softirq+0x17d/0x2c0 kernel/time/hrtimer.c:2113
handle_softirqs+0x1ea/0x9b0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x162/0x210 kernel/softirq.c:735
irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:finish_task_switch.isra.0+0x2cd/0x10c0 kernel/sched/core.c:5361
Code: ab 0a 00 00 41 c7 87 20 0e 00 00 00 00 00 00 e9 47 04 00 00 49 8d 7f 48 e8 60 6d e5 09 e8 4b 94 3c 00 fb 48 8d bb f8 16 00 00 <48> b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 04 02 84
RSP: 0000:ffffc9000c42fd10 EFLAGS: 00000206
RAX: 000000000000398d RBX: ffff8880250f2540 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8e1a260e RDI: ffff8880250f3c38
RBP: ffffc9000c42fd68 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff88802472ca80
R13: 0000000000000001 R14: ffffffff9121eb84 R15: ffff88802b33b600
context_switch kernel/sched/core.c:5513 [inline]
__schedule+0x1264/0x6730 kernel/sched/core.c:7234
__schedule_loop kernel/sched/core.c:7311 [inline]
schedule+0xdd/0x2c0 kernel/sched/core.c:7326
__exit_to_user_mode_loop kernel/entry/common.c:55 [inline]
exit_to_user_mode_loop kernel/entry/common.c:101 [inline]
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
irqentry_exit_to_user_mode_prepare include/linux/irq-entry-common.h:244 [inline]
irqentry_exit_to_user_mode include/linux/irq-entry-common.h:315 [inline]
irqentry_exit+0x37f/0xa00 kernel/entry/common.c:165
asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:679
RIP: 0023:0xf704f0ba
Code: d8 31 d0 69 c0 2d eb d4 27 89 c2 c1 ea 0f 31 d0 31 d2 25 ff 0f 00 00 89 d3 33 5c 24 04 89 c1 33 0c 24 89 5c 24 0c 89 4c 24 08 <8b> 5c 24 20 8b 44 24 10 80 7c 03 14 00 0f 84 43 01 00 00 8b 90 28
RSP: 002b:00000000ffa5d9a0 EFLAGS: 00000286
RAX: 00000000000008ac RBX: 00000000ffffffff RCX: 000000008202246c
RDX: 0000000000000000 RSI: 000000000001b154 RDI: 00000000f7404fe8
RBP: 00000000f7f35610 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
----------------
Code disassembly (best guess):
0: 48 89 fa mov %rdi,%rdx
3: 48 c1 ea 03 shr $0x3,%rdx
7: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
b: 0f 85 93 00 00 00 jne 0xa4
11: 48 8d 3d 7a ff 63 09 lea 0x963ff7a(%rip),%rdi # 0x963ff92
18: 48 8b 4b 08 mov 0x8(%rbx),%rcx
1c: 40 0f b6 d5 movzbl %bpl,%edx
20: 4d 89 e0 mov %r12,%r8
23: 48 c7 c6 c0 34 b7 8c mov $0xffffffff8cb734c0,%rsi
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: bd ea ff ff ff mov $0xffffffea,%ebp
34: e9 8e fd ff ff jmp 0xfffffdc7
39: 49 c7 c4 60 27 b7 8c mov $0xffffffff8cb72760,%r12