program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000400)='configfs\x00', 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) r4 = socket(0x400000000010, 0x3, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x484080, 0x0) write$tun(r5, &(0x7f0000000440)=ANY=[@ANYBLOB="00010800fa040004aaaaa8aaaaaaac1414bbaaa685c510aaaaaaaaaaa7111d5ba250711402ecb7130e0b8c9f44bd23c6ae9945f27760a62848e7285371855ef827ca332832660b0611042e931284ee348bbcc260ebafafd1e3cccd13a64b08ef87a9c51aaefa58b64ad57b52523db011dbf93cdeb246cd1bbc9bb110cea42fcda328a46cad8e0425490240a32c7bb2f68c1b8e440264c80c68c3167030579eeaf24e2c80f07192123979f1"], 0x1c) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000006080)=@newtfilter={0x30, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfb, {0x0, 0x0, 0x0, r7, {0x4}, {}, {0x1, 0xe}}, [@filter_kind_options=@f_fw={{0x7}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x20000010}, 0x80) (async) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000006080)=@newtfilter={0x30, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfb, {0x0, 0x0, 0x0, r7, {0x4}, {}, {0x1, 0xe}}, [@filter_kind_options=@f_fw={{0x7}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x20000010}, 0x80) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=@newqdisc={0x434, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r3, {0x10}, {}, {0xa, 0x8}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x0, 0x1, 0x9, 0x8000, 0x3, 0x5, 0x5, 0xb766, 0x4, 0x40007, 0x8, 0xf, 0x2, 0x80000001, 0x400, 0x1007fc, 0xffff8000, 0x6, 0x403, 0x9, 0x8, 0xffffe4f5, 0xd6, 0x4, 0xfffb, 0x7, 0x0, 0xfffff4f0, 0x9, 0x3b3c, 0xfffffffc, 0x4, 0x1, 0x6f2151b1, 0x9, 0xc, 0x20001000, 0x4, 0x2, 0xb, 0x4, 0x99, 0x9, 0x5, 0x6, 0x7, 0xff7ffff7, 0x6d, 0x2, 0x4, 0xd05, 0x1000044, 0x8, 0x8, 0x1, 0x4, 0x7ff, 0x8, 0x7, 0x7fbffffe, 0x400, 0x8, 0xfffffa72, 0xcd, 0x4, 0x80000000, 0xc, 0x4, 0x65, 0x91, 0x659, 0x9, 0xf, 0x9, 0x7fffffff, 0x9, 0x7, 0x3, 0x401, 0x3, 0x2, 0x7, 0x1, 0x10001, 0x3, 0x1, 0x4, 0x8, 0x8, 0x7, 0x1, 0x1, 0x1, 0x7, 0x40, 0x7, 0x12, 0x87d0, 0x1, 0x4dc, 0x80, 0x3, 0x7fffffff, 0xff, 0x9, 0xa7, 0xf, 0x1, 0xffffffff, 0x3, 0x1001, 0x4, 0x401, 0x7, 0x80000000, 0xffff, 0x6, 0x5, 0x4f, 0xffffffff, 0x80000000, 0x1966f9ad, 0x200, 0x20200, 0xed5, 0xfffffc00, 0x6, 0x4, 0x8, 0x485e, 0xa85, 0x80000040, 0x2, 0x7, 0x7, 0x102, 0x2d5421e8, 0x7, 0x40, 0x2, 0x6, 0x3ff, 0xf04, 0x0, 0x2, 0x5, 0xfffffc00, 0x5, 0x8d, 0x4, 0x401, 0x6, 0x1, 0x3, 0xfffffffb, 0x1, 0x0, 0x3, 0x2, 0x5, 0x8, 0x3, 0x0, 0x800, 0xf06, 0x8, 0x7ff, 0x0, 0x1, 0x6, 0x5, 0x400001, 0x4d15, 0x1ff, 0x7, 0x3, 0x8001, 0x3, 0x0, 0x200, 0x10000005, 0x7, 0x2, 0x8, 0x42ba, 0x4, 0x9, 0x3, 0x8, 0x8, 0x53, 0x6, 0x4, 0x400, 0x8000, 0x0, 0x2c310b18, 0xfff, 0x0, 0x3, 0xcd34, 0x9, 0x81, 0xdf3, 0x2, 0x7, 0x8, 0x40fff, 0x1ff, 0x8000, 0x3, 0x200, 0x80, 0x6, 0x9a6, 0xe4cb, 0x402, 0x1, 0x1ff, 0x5, 0x5, 0x1, 0x8, 0x0, 0x8, 0x0, 0xd, 0x0, 0x4, 0x10, 0x901, 0x5, 0x2, 0x7b, 0xfffffeff, 0x6, 0x6, 0xc, 0x1000, 0x9, 0x9, 0xe6, 0xab, 0x400, 0x7fffffff, 0xed, 0x7ff, 0xd83, 0x10000068, 0x80000001, 0x6, 0x9fd, 0x10000006, 0x200, 0x200002]}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0x40098}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/kmsg\x00', 0x800, 0x0) mount$9p_virtio(0x0, &(0x7f0000000340)='./proc\x00', 0x0, 0x80020, &(0x7f00000003c0)=ANY=[@ANYBLOB='transtio,\x00']) read(r8, &(0x7f0000000200), 0x1000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/functions/uac1_legacy.usb0\x00', 0x1ff) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/functions/uac1_legacy.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) syz_emit_ethernet(0x76, &(0x7f0000000d80)={@link_local, @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f53244", 0x40, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x2, 0x1, 0x0, 0x500, {0x0, 0x6, "000100", 0x0, 0x0, 0x0, @private1={0xfc, 0x1, '\x00', 0x2}, @remote, [@hopopts={0x3a}], "3356d55afb0de3af"}}}}}}}, 0x0) (async) syz_emit_ethernet(0x76, &(0x7f0000000d80)={@link_local, @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f53244", 0x40, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x2, 0x1, 0x0, 0x500, {0x0, 0x6, "000100", 0x0, 0x0, 0x0, @private1={0xfc, 0x1, '\x00', 0x2}, @remote, [@hopopts={0x3a}], "3356d55afb0de3af"}}}}}}}, 0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r9, 0x29, 0x1b, &(0x7f0000000000)={@remote}, 0x20) (async) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r9, 0x29, 0x1b, &(0x7f0000000000)={@remote}, 0x20) symlinkat(&(0x7f0000000200)='./config/usb_gadget/g1/functions/uac1_legacy.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1/uac1_legacy.usb0\x00') (async) symlinkat(&(0x7f0000000200)='./config/usb_gadget/g1/functions/uac1_legacy.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1/uac1_legacy.usb0\x00') openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) (async) r10 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r10, &(0x7f0000000400)='dummy_udc.0\n\x00', 0xc) (async) write(r10, &(0x7f0000000400)='dummy_udc.0\n\x00', 0xc) nanosleep(&(0x7f0000000500)={0x0, 0x2faf080}, 0x0) [ 89.617310][ T5270] Bluetooth: hci0: command tx timeout [ 89.750542][ T5308] proc: Unknown parameter 'transtio' [ 89.780422][ T5308] configfs-gadget.g1 gadget.0: Hardware params: access 3, format 2, channels 2, rate 48000 [ 89.787071][ T5308] udc dummy_udc.0: failed to start g1: -19 [ 89.795472][ T5308] UDC core: g1: couldn't find an available UDC or it's busy [ 89.813540][ T5309] slab filp start ffff888012246540 pointer offset 0 size 352 [ 89.819111][ T5309] VFS: Close: file count is 0 (f_op=snd_ctl_f_ops) [ 89.819366][ T5309] ------------[ cut here ]------------ [ 89.824978][ T5309] kernel BUG at fs/open.c:1515! [ 89.836457][ T5309] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 89.839334][ T5309] CPU: 0 UID: 0 PID: 5309 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 89.843289][ T5309] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 89.847490][ T5309] RIP: 0010:filp_flush+0x184/0x190 [ 89.849810][ T5309] Code: 48 83 c3 48 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 cc 91 ed ff 48 8b 33 48 c7 c7 20 96 1f 8c e8 4d d3 dc fe 90 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 [ 89.858082][ T5309] RSP: 0018:ffffc9000de4f6b8 EFLAGS: 00010246 [ 89.860678][ T5309] RAX: 0000000000000030 RBX: ffff888012246588 RCX: c70334061aca7100 [ 89.864070][ T5309] RDX: 0000000000000000 RSI: 8000000000000000 RDI: 0000000000000000 [ 89.867512][ T5309] RBP: ffffc9000de4f7d8 R08: ffff88801fc246d3 R09: 1ffff11003f848da [ 89.871046][ T5309] R10: dffffc0000000000 R11: ffffed1003f848db R12: dffffc0000000000 [ 89.874507][ T5309] R13: ffff888039590528 R14: 0000000000000000 R15: 0000000000000003 [ 89.877952][ T5309] FS: 00007f4e0c5946c0(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000 [ 89.881525][ T5309] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 89.883963][ T5309] CR2: 00005640dc242008 CR3: 0000000012ce8000 CR4: 0000000000352ef0 [ 89.887419][ T5309] Call Trace: [ 89.888936][ T5309] [ 89.890298][ T5309] filp_close+0x1d/0x40 [ 89.892156][ T5309] gaudio_cleanup+0x54/0xf0 [ 89.894197][ T5309] f_audio_bind+0x4a0/0x630 [ 89.896155][ T5309] ? __pfx_f_audio_bind+0x10/0x10 [ 89.898305][ T5309] ? rcu_is_watching+0x16/0xb0 [ 89.900446][ T5309] ? usb_gadget_set_selfpowered+0xf5/0x260 [ 89.903075][ T5309] usb_add_function+0x2e1/0x9f0 [ 89.905299][ T5309] ? check_remote_wakeup_config+0x58/0x1c0 [ 89.907852][ T5309] configfs_composite_bind+0xde0/0x1410 [ 89.910265][ T5309] ? __pfx_configfs_composite_bind+0x10/0x10 [ 89.912905][ T5309] gadget_bind_driver+0x2ca/0x9e0 [ 89.915067][ T5309] ? __pfx_gadget_bind_driver+0x10/0x10 [ 89.917470][ T5309] really_probe+0x254/0xae0 [ 89.919492][ T5309] __driver_probe_device+0x1e8/0x360 [ 89.921853][ T5309] driver_probe_device+0x4f/0x240 [ 89.923996][ T5309] __driver_attach+0x339/0x600 [ 89.926045][ T5309] bus_for_each_dev+0x23b/0x2c0 [ 89.928167][ T5309] ? __pfx___driver_attach+0x10/0x10 [ 89.930402][ T5309] ? __pfx_bus_for_each_dev+0x10/0x10 [ 89.932700][ T5309] ? do_raw_spin_unlock+0x4d/0x200 [ 89.934959][ T5309] bus_add_driver+0x345/0x670 [ 89.937000][ T5309] driver_register+0x23a/0x320 [ 89.939062][ T5309] usb_gadget_register_driver_owner+0xf9/0x270 [ 89.941809][ T5309] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 89.944295][ T5309] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10 [ 89.946969][ T5309] configfs_write_iter+0x337/0x430 [ 89.949147][ T5309] vfs_write+0x612/0xba0 [ 89.950960][ T5309] ? __pfx_vfs_write+0x10/0x10 [ 89.952957][ T5309] ? __fget_files+0x2a/0x420 [ 89.954851][ T5309] ksys_write+0x150/0x270 [ 89.956616][ T5309] ? __pfx_ksys_write+0x10/0x10 [ 89.958771][ T5309] do_syscall_64+0x166/0x520 [ 89.960776][ T5309] ? trace_irq_disable+0x3b/0x140 [ 89.962946][ T5309] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.965642][ T5309] ? clear_bhb_loop+0x70/0xc0 [ 89.967663][ T5309] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.970257][ T5309] RIP: 0033:0x7f4e0b79e0d9 [ 89.972148][ T5309] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 89.980165][ T5309] RSP: 002b:00007f4e0c593fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 89.983609][ T5309] RAX: ffffffffffffffda RBX: 00007f4e0ba26090 RCX: 00007f4e0b79e0d9 [ 89.986994][ T5309] RDX: 000000000000000c RSI: 0000200000000400 RDI: 000000000000000b [ 89.990475][ T5309] RBP: 00007f4e0b835024 R08: 0000000000000000 R09: 0000000000000000 [ 89.993897][ T5309] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 89.997260][ T5309] R13: 00007f4e0ba26128 R14: 00007f4e0ba26090 R15: 00007ffcebc07048 [ 90.000731][ T5309] [ 90.002118][ T5309] Modules linked in: [ 90.004371][ T5309] ---[ end trace 0000000000000000 ]--- [ 90.044901][ T5309] RIP: 0010:filp_flush+0x184/0x190 [ 90.047256][ T5309] Code: 48 83 c3 48 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 cc 91 ed ff 48 8b 33 48 c7 c7 20 96 1f 8c e8 4d d3 dc fe 90 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 [ 90.056201][ T5309] RSP: 0018:ffffc9000de4f6b8 EFLAGS: 00010246 [ 90.059420][ T5309] RAX: 0000000000000030 RBX: ffff888012246588 RCX: c70334061aca7100 [ 90.063354][ T5309] RDX: 0000000000000000 RSI: 8000000000000000 RDI: 0000000000000000 [ 90.066895][ T5309] RBP: ffffc9000de4f7d8 R08: ffff88801fc246d3 R09: 1ffff11003f848da [ 90.070381][ T5309] R10: dffffc0000000000 R11: ffffed1003f848db R12: dffffc0000000000 [ 90.074556][ T5309] R13: ffff888039590528 R14: 0000000000000000 R15: 0000000000000003 [ 90.078593][ T5309] FS: 00007f4e0c5946c0(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000 [ 90.082652][ T5309] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 90.085634][ T5309] CR2: 000056181eaa2660 CR3: 0000000012ce8000 CR4: 0000000000352ef0 [ 90.089209][ T5309] Kernel panic - not syncing: Fatal exception [ 90.092335][ T5309] Kernel Offset: disabled [ 90.094266][ T5309] Rebooting in 86400 seconds..