program: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x15, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000f0ffffff6a0af0ff1100000079a4f0ff00000000b706000000000081ad64020000000000450404005400ff0f1704000001130a00b7050000010000006a0af2fe0000000085000000a3000000b70000000000000095"], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x16ab}, 0x94) ioctl$VIDIOC_S_INPUT(0xffffffffffffffff, 0xc0045627, &(0x7f0000000080)=0x1) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000580)={{0x1, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000040)=r0}, 0x20) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/direction\x00', 0x1, 0x0) write(r2, &(0x7f00000002c0)='1', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1/direction\x00', 0x1, 0x0) write(r3, &(0x7f0000000540)='2', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1/first_group\x00', 0x1, 0x0) write(r4, &(0x7f0000000600)='2', 0x1) r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1/num_groups\x00', 0x1, 0x0) write(r5, &(0x7f00000006c0)='3', 0x1) r6 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1/midi1_first_group\x00', 0x1, 0x0) write(r6, &(0x7f0000000780)='2', 0x1) r7 = openat(0xffffffffffffff9c, &(0x7f00000007c0)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1/midi1_num_groups\x00', 0x1, 0x0) write(r7, &(0x7f0000000840)='3', 0x1) symlinkat(&(0x7f0000000880)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000008c0)='./my_configfs/usb_gadget/g1/configs/c.1/midi2.usb0\x00') r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./my_configfs/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r8, &(0x7f0000000940)='dummy_udc.0', 0xb) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000640)={{r1}, &(0x7f00000005c0), &(0x7f0000000600)=r0}, 0x20) capset(&(0x7f0000000100)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffffb}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000180)={0x0, 0x4, 0x8, 0x1}) r9 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000000000040ac054382408b0b00000109022400010000002009040000fd0301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r9, 0x0, 0x0) [ 94.096341][ T4648] Bluetooth: hci0: command tx timeout [ 94.218975][ T5322] capability: warning: `syz.0.0' uses deprecated v2 capabilities in a way that may be insecure [ 94.594059][ T5327] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 94.615382][ T5327] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 94.813756][ T941] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 94.966019][ T941] usb 5-1: config 1 interface 1 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 94.971391][ T941] usb 5-1: Dual-Role OTG device on HNP port [ 94.977365][ T941] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.02 [ 94.981569][ T941] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.020319][ T941] gspca_main: spca501-2.14.0 probing 0000:0000 [ 95.025234][ T941] gspca_spca501: reg write: error -32 [ 95.027291][ T941] spca501 5-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 95.030090][ T941] spca501 5-1:1.0: probe with driver spca501 failed with error -22 [ 95.038556][ C0] Oops: general protection fault, probably for non-canonical address 0xdffffc00000000e6: 0000 [#1] SMP KASAN NOPTI [ 95.043669][ C0] KASAN: null-ptr-deref in range [0x0000000000000730-0x0000000000000737] [ 95.047220][ C0] CPU: 0 UID: 0 PID: 941 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(full) [ 95.051200][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.055631][ C0] Workqueue: usb_hub_wq hub_event [ 95.057971][ C0] RIP: 0010:f_midi2_stop_eps+0x28e/0x4d0 [ 95.060364][ C0] Code: 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 47 eb 63 fa 41 bf 30 07 00 00 4d 03 3e 4c 89 f8 48 c1 e8 03 48 89 44 24 18 <42> 0f b6 04 28 84 c0 0f 85 12 02 00 00 41 8b 1f 31 ff 89 de e8 79 [ 95.068203][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002 [ 95.070707][ C0] RAX: 00000000000000e6 RBX: ffff888052038120 RCX: ffff88801d350000 [ 95.073931][ C0] RDX: 0000000000000100 RSI: ffffffff8c4bed60 RDI: ffffffff8c4bed20 [ 95.076876][ C0] RBP: ffff888052038100 R08: 0000000072205dfe R09: 000000005eb7409a [ 95.079825][ C0] R10: 0000000000000010 R11: ffffffff8eb59c60 R12: ffff888052038730 [ 95.083072][ C0] R13: dffffc0000000000 R14: ffff888052038128 R15: 0000000000000730 [ 95.086099][ C0] FS: 0000000000000000(0000) GS:ffff88808c53f000(0000) knlGS:0000000000000000 [ 95.089392][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.091628][ C0] CR2: 00007ffc2e6e0fb0 CR3: 0000000012b9b000 CR4: 0000000000352ef0 [ 95.094471][ C0] Call Trace: [ 95.095809][ C0] [ 95.096942][ C0] f_midi2_set_alt+0x11c/0xf00 [ 95.098793][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 95.100911][ C0] composite_setup+0x1ffd/0x3480 [ 95.102822][ C0] configfs_composite_setup+0xc7/0x100 [ 95.105020][ C0] dummy_timer+0x2f43/0x4cf0 [ 95.106979][ C0] ? __lock_acquire+0x683/0x2cf0 [ 95.109044][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 95.111210][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 95.113251][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 95.115525][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 95.117666][ C0] __hrtimer_run_queues+0x3bc/0xa10 [ 95.119821][ C0] hrtimer_run_softirq+0x17a/0x240 [ 95.121894][ C0] handle_softirqs+0x225/0x840 [ 95.123612][ C0] ? __irq_exit_rcu+0xca/0x220 [ 95.125249][ C0] __irq_exit_rcu+0xca/0x220 [ 95.127110][ C0] irq_exit_rcu+0x9/0x30 [ 95.128865][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 95.131228][ C0] [ 95.132603][ C0] [ 95.133868][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 95.136327][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 [ 95.139066][ C0] Code: f7 e8 8d 0b cd f5 f7 c3 00 02 00 00 74 05 e8 b0 00 f9 f5 9c 58 a9 00 02 00 00 75 27 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 24 21 be f5 65 8b 05 1d b1 97 07 85 c0 74 18 5b 41 5e e9 81 48 [ 95.147100][ C0] RSP: 0018:ffffc90004b767f0 EFLAGS: 00000206 [ 95.149726][ C0] RAX: 0000000000000006 RBX: 0000000000000246 RCX: 0000000080000001 [ 95.153118][ C0] RDX: 0000000000000006 RSI: ffffffff8e231249 RDI: 0000000000000001 [ 95.156525][ C0] RBP: 0000000000000007 R08: ffffffff9057be37 R09: 1ffffffff20af7c6 [ 95.160026][ C0] R10: dffffc0000000000 R11: fffffbfff20af7c7 R12: 0000000000000000 [ 95.163093][ C0] R13: dffffc0000000000 R14: ffff88803418c000 R15: 1ffff11003eef294 [ 95.166656][ C0] dummy_urb_enqueue+0x587/0x780 [ 95.168691][ C0] usb_hcd_submit_urb+0x328/0x1b60 [ 95.170901][ C0] usb_start_wait_urb+0x13f/0x5b0 [ 95.172632][ C0] ? trace_kmalloc+0x2a/0xf0 [ 95.174497][ C0] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 95.176634][ C0] usb_control_msg+0x234/0x3e0 [ 95.178536][ C0] usb_set_interface+0x521/0x1470 [ 95.180500][ C0] snd_usb_midi_v2_create+0x621/0x4ac0 [ 95.182605][ C0] ? __pfx_proc_audio_usbid_read+0x10/0x10 [ 95.184859][ C0] ? snd_card_rw_proc_new+0x10d/0x140 [ 95.187265][ C0] ? __pfx_snd_usb_midi_v2_create+0x10/0x10 [ 95.190069][ C0] ? usb_ifnum_to_if+0x262/0x2f0 [ 95.192351][ C0] snd_usb_create_stream+0x262/0x630 [ 95.194416][ C0] usb_audio_probe+0x1447/0x2280 [ 95.196128][ C0] ? __pfx_usb_audio_probe+0x10/0x10 [ 95.198263][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 95.200614][ C0] usb_probe_interface+0x653/0xc60 [ 95.202689][ C0] ? __pfx_usb_probe_interface+0x10/0x10 [ 95.204622][ C0] really_probe+0x254/0xae0 [ 95.206215][ C0] __driver_probe_device+0x1e8/0x360 [ 95.208013][ C0] driver_probe_device+0x4f/0x240 [ 95.209805][ C0] __device_attach_driver+0x270/0x410 [ 95.212004][ C0] bus_for_each_drv+0x258/0x2f0 [ 95.214109][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 95.216570][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 95.218622][ C0] ? lockdep_hardirqs_on+0x7a/0x110 [ 95.220375][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 95.222370][ C0] __device_attach+0x2c4/0x450 [ 95.223983][ C0] ? __pfx___device_attach+0x10/0x10 [ 95.226075][ C0] ? do_raw_spin_unlock+0x4d/0x210 [ 95.228240][ C0] ? _raw_spin_unlock+0x28/0x50 [ 95.230289][ C0] device_initial_probe+0xa1/0xd0 [ 95.232360][ C0] bus_probe_device+0x12a/0x220 [ 95.234435][ C0] device_add+0x7d7/0xb80 [ 95.236284][ C0] usb_set_configuration+0x1ad8/0x2180 [ 95.238703][ C0] usb_generic_driver_probe+0x8d/0x150 [ 95.241339][ C0] usb_probe_device+0x1c3/0x3b0 [ 95.243447][ C0] ? __pfx_usb_probe_device+0x10/0x10 [ 95.246072][ C0] really_probe+0x254/0xae0 [ 95.248217][ C0] __driver_probe_device+0x1e8/0x360 [ 95.250527][ C0] driver_probe_device+0x4f/0x240 [ 95.252794][ C0] __device_attach_driver+0x270/0x410 [ 95.255257][ C0] bus_for_each_drv+0x258/0x2f0 [ 95.257475][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 95.260123][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 95.262368][ C0] ? lockdep_hardirqs_on+0x7a/0x110 [ 95.264431][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 95.266782][ C0] __device_attach+0x2c4/0x450 [ 95.268734][ C0] ? __pfx___device_attach+0x10/0x10 [ 95.271021][ C0] ? do_raw_spin_unlock+0x4d/0x210 [ 95.273308][ C0] ? _raw_spin_unlock+0x28/0x50 [ 95.275479][ C0] device_initial_probe+0xa1/0xd0 [ 95.277734][ C0] bus_probe_device+0x12a/0x220 [ 95.279889][ C0] device_add+0x7d7/0xb80 [ 95.281791][ C0] usb_new_device+0x99d/0x1620 [ 95.283630][ C0] ? __pfx_usb_new_device+0x10/0x10 [ 95.285736][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 95.287799][ C0] hub_event+0x28e8/0x4d30 [ 95.289756][ C0] ? do_raw_spin_unlock+0x4d/0x210 [ 95.291970][ C0] ? __pfx_hub_event+0x10/0x10 [ 95.294108][ C0] ? process_scheduled_works+0xa20/0x14e0 [ 95.296594][ C0] ? rcu_is_watching+0x15/0xb0 [ 95.298678][ C0] ? process_scheduled_works+0xa20/0x14e0 [ 95.301174][ C0] process_scheduled_works+0xa8e/0x14e0 [ 95.303459][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 95.305993][ C0] ? assign_work+0x3cf/0x5d0 [ 95.308002][ C0] worker_thread+0xa47/0xfb0 [ 95.310089][ C0] kthread+0x388/0x470 [ 95.311668][ C0] ? __pfx_worker_thread+0x10/0x10 [ 95.313488][ C0] ? __pfx_kthread+0x10/0x10 [ 95.315434][ C0] ret_from_fork+0x514/0xb70 [ 95.317458][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 95.320241][ C0] ? __switch_to+0xc89/0x1420 [ 95.322866][ C0] ? __pfx_kthread+0x10/0x10 [ 95.325461][ C0] ret_from_fork_asm+0x1a/0x30 [ 95.328070][ C0] [ 95.329782][ C0] Modules linked in: [ 95.331651][ C0] ---[ end trace 0000000000000000 ]--- [ 95.333953][ C0] RIP: 0010:f_midi2_stop_eps+0x28e/0x4d0 [ 95.336200][ C0] Code: 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 47 eb 63 fa 41 bf 30 07 00 00 4d 03 3e 4c 89 f8 48 c1 e8 03 48 89 44 24 18 <42> 0f b6 04 28 84 c0 0f 85 12 02 00 00 41 8b 1f 31 ff 89 de e8 79 [ 95.344187][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002 [ 95.346736][ C0] RAX: 00000000000000e6 RBX: ffff888052038120 RCX: ffff88801d350000 [ 95.350085][ C0] RDX: 0000000000000100 RSI: ffffffff8c4bed60 RDI: ffffffff8c4bed20 [ 95.353374][ C0] RBP: ffff888052038100 R08: 0000000072205dfe R09: 000000005eb7409a [ 95.356371][ C0] R10: 0000000000000010 R11: ffffffff8eb59c60 R12: ffff888052038730 [ 95.359673][ C0] R13: dffffc0000000000 R14: ffff888052038128 R15: 0000000000000730 [ 95.363110][ C0] FS: 0000000000000000(0000) GS:ffff88808c53f000(0000) knlGS:0000000000000000 [ 95.366875][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.369736][ C0] CR2: 00007ffc2e6e0fb0 CR3: 0000000012b9b000 CR4: 0000000000352ef0 [ 95.373158][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 95.376585][ C0] Kernel Offset: disabled [ 95.378377][ C0] Rebooting in 86400 seconds..