program:
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0xef, 0x0, 0x0, 0x3, 0x0, 0x2000000000000003, 0xa8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x11a8, 0x0, 0x0, 0x0, 0x0, 0x14ca}, 0x0, 0x0, 0xffffffffffffffff, 0x3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/direction\x00', 0x1, 0x0)
write(r0, &(0x7f0000000600)='2', 0x1)
symlinkat(&(0x7f0000000880)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000008c0)='./my_configfs/usb_gadget/g1/configs/c.1/midi2.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./my_configfs/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r1, &(0x7f0000000940)='dummy_udc.0', 0xb)
bpf$BPF_PROG_ATTACH(0x9, &(0x7f0000000240)=ANY=[@ANYRES32, @ANYRES32, @ANYRES32=r1, @ANYRES32, @ANYRES64=r1, @ANYRES32, @ANYRES8=r0, @ANYRES64=0x0], 0x11)
socket$kcm(0x10, 0x2, 0x0)
syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000280)={0x2c, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="000f16000000050f1600020a10030006000000ffff07100208740400b6fde4640778f78477eb13d23bc034800ef8ed5b73"], 0x0, 0x0}, 0x0)
r2 = socket$inet_mptcp(0x2, 0x1, 0x106)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000001100)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x1, 0x1ff)
write(r3, &(0x7f0000001200)="05010906a101", 0x6)
ioctl$int_in(r2, 0x5452, &(0x7f0000000180)=0x401)
listen(r2, 0x0)
shutdown(r2, 0x0)
r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x11, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="1801000082e6da47b667a98b6202850000000f000000954f21841c3a956967e484d93d268322f033ddf76996f5ff3554ca13bf5db3685c99dd4965538c959549b629dc22b4392028da6006d416404f643fe58d761e9418c4015717661451591f8248267cea31ed7c2f5db92459d6f918b9ffcd330eec272fab9d64f6b00347ee326491cf4bbdaa482811a8b77b5f9db1bf9f758e58de4d6dc936f9c700"/169], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='smbus_result\x00', r4, 0x0, 0x6}, 0x18)
r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x18, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='smbus_result\x00', r5, 0x0, 0x6}, 0x18)
r6 = syz_open_dev$I2C(&(0x7f0000000040), 0x0, 0x0)
ioctl$I2C_SMBUS(r6, 0x720, &(0x7f00000000c0)={0x0, 0x2, 0x5, &(0x7f0000000080)={0x8, "90f541a5e64f61909103f1fbbc2bd3c9f144d76e44c7b2986eb5e52829e7cb8393"}})
[ 95.513138][ T4648] Bluetooth: hci0: command tx timeout
[ 96.235888][ T1078] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 96.388724][ T1078] usb 5-1: Dual-Role OTG device on HNP port
[ 96.396647][ T1078] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.02
[ 96.403443][ T1078] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 96.436669][ T1078] gspca_main: spca501-2.14.0 probing 0000:0000
[ 96.441202][ T1078] gspca_spca501: reg write: error -32
[ 96.443616][ T1078] spca501 5-1:1.0: Reg write failed for 0x02,0x0f,0x05
[ 96.450038][ T1078] spca501 5-1:1.0: probe with driver spca501 failed with error -22
[ 96.458623][ C0] Oops: general protection fault, probably for non-canonical address 0xdffffc00000000e6: 0000 [#1] SMP KASAN NOPTI
[ 96.463510][ C0] KASAN: null-ptr-deref in range [0x0000000000000730-0x0000000000000737]
[ 96.467009][ C0] CPU: 0 UID: 0 PID: 1078 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(full)
[ 96.470952][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 96.475267][ C0] Workqueue: usb_hub_wq hub_event
[ 96.477582][ C0] RIP: 0010:f_midi2_stop_eps+0x5f/0x4d0
[ 96.479937][ C0] Code: e8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 ef e8 67 e7 63 fa 41 bc 30 07 00 00 4c 03 65 00 4c 89 e0 48 c1 e8 03 48 89 44 24 10 <42> 0f b6 04 28 84 c0 0f 85 23 04 00 00 41 8b 1c 24 31 ff 89 de e8
[ 96.488016][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002
[ 96.490572][ C0] RAX: 00000000000000e6 RBX: 0000000000000001 RCX: ffff888036b98000
[ 96.493901][ C0] RDX: 0000000000000100 RSI: 0000000000000008 RDI: ffff88804b63c148
[ 96.497274][ C0] RBP: ffff88804b63c0f0 R08: ffff88804b63c14f R09: 1ffff110096c7829
[ 96.500563][ C0] R10: dffffc0000000000 R11: ffffed10096c782a R12: 0000000000000730
[ 96.503810][ C0] R13: dffffc0000000000 R14: ffff88804b63c128 R15: 0000000000000001
[ 96.507014][ C0] FS: 0000000000000000(0000) GS:ffff88808c53f000(0000) knlGS:0000000000000000
[ 96.510673][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 96.513389][ C0] CR2: 00007fdcba2bf0f5 CR3: 00000000127b7000 CR4: 0000000000352ef0
[ 96.516695][ C0] Call Trace:
[ 96.518118][ C0]
[ 96.519362][ C0] f_midi2_set_alt+0x11c/0xf00
[ 96.521360][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 96.523606][ C0] composite_setup+0x1ffd/0x3480
[ 96.525722][ C0] configfs_composite_setup+0xc7/0x100
[ 96.527931][ C0] dummy_timer+0x2f43/0x4cf0
[ 96.529914][ C0] ? __lock_acquire+0x683/0x2cf0
[ 96.532000][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 96.534341][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 96.536464][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 96.538881][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 96.540969][ C0] __hrtimer_run_queues+0x3bc/0xa10
[ 96.543198][ C0] hrtimer_run_softirq+0x17a/0x240
[ 96.545444][ C0] handle_softirqs+0x225/0x840
[ 96.547554][ C0] ? __irq_exit_rcu+0xca/0x220
[ 96.549708][ C0] __irq_exit_rcu+0xca/0x220
[ 96.551771][ C0] irq_exit_rcu+0x9/0x30
[ 96.553688][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0
[ 96.556248][ C0]
[ 96.557618][ C0]
[ 96.558944][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 96.561589][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80
[ 96.564339][ C0] Code: f7 e8 8d fb cc f5 f7 c3 00 02 00 00 74 05 e8 f0 f0 f8 f5 9c 58 a9 00 02 00 00 75 27 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 24 11 be f5 65 8b 05 1d a1 97 07 85 c0 74 18 5b 41 5e e9 81 48
[ 96.572693][ C0] RSP: 0018:ffffc90000ade7f0 EFLAGS: 00000206
[ 96.575391][ C0] RAX: 0000000000000002 RBX: 0000000000000246 RCX: 0000000080000001
[ 96.578908][ C0] RDX: 0000000000000006 RSI: ffffffff8e231f88 RDI: 0000000000000001
[ 96.582367][ C0] RBP: 0000000000000007 R08: ffffffff9057c237 R09: 1ffffffff20af846
[ 96.585790][ C0] R10: dffffc0000000000 R11: fffffbfff20af847 R12: 0000000000000000
[ 96.589278][ C0] R13: dffffc0000000000 R14: ffff88803424c000 R15: 1ffff11003f73294
[ 96.592759][ C0] dummy_urb_enqueue+0x587/0x780
[ 96.594945][ C0] usb_hcd_submit_urb+0x328/0x1b60
[ 96.597240][ C0] usb_start_wait_urb+0x13f/0x5b0
[ 96.599478][ C0] ? trace_kmalloc+0x2a/0xf0
[ 96.601488][ C0] ? __pfx_usb_start_wait_urb+0x10/0x10
[ 96.603889][ C0] usb_control_msg+0x234/0x3e0
[ 96.606047][ C0] usb_set_interface+0x521/0x1470
[ 96.608321][ C0] snd_usb_midi_v2_create+0x621/0x4ac0
[ 96.610356][ C0] ? __pfx_proc_audio_usbid_read+0x10/0x10
[ 96.612521][ C0] ? snd_card_rw_proc_new+0x10d/0x140
[ 96.614666][ C0] ? __pfx_snd_usb_midi_v2_create+0x10/0x10
[ 96.617318][ C0] ? usb_ifnum_to_if+0x262/0x2f0
[ 96.619515][ C0] snd_usb_create_stream+0x262/0x630
[ 96.621854][ C0] usb_audio_probe+0x1447/0x2280
[ 96.624016][ C0] ? __pfx_usb_audio_probe+0x10/0x10
[ 96.626390][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 96.628980][ C0] usb_probe_interface+0x653/0xc60
[ 96.631265][ C0] ? __pfx_usb_probe_interface+0x10/0x10
[ 96.633740][ C0] really_probe+0x254/0xae0
[ 96.635755][ C0] __driver_probe_device+0x1e8/0x360
[ 96.638114][ C0] driver_probe_device+0x4f/0x240
[ 96.640352][ C0] __device_attach_driver+0x270/0x410
[ 96.642693][ C0] bus_for_each_drv+0x258/0x2f0
[ 96.644783][ C0] ? __pfx___device_attach_driver+0x10/0x10
[ 96.647296][ C0] ? __pfx_bus_for_each_drv+0x10/0x10
[ 96.649688][ C0] ? lockdep_hardirqs_on+0x7a/0x110
[ 96.651993][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 96.654488][ C0] __device_attach+0x2c4/0x450
[ 96.656503][ C0] ? __pfx___device_attach+0x10/0x10
[ 96.658687][ C0] ? do_raw_spin_unlock+0x4d/0x210
[ 96.660852][ C0] ? _raw_spin_unlock+0x28/0x50
[ 96.662966][ C0] device_initial_probe+0xa1/0xd0
[ 96.665081][ C0] bus_probe_device+0x12a/0x220
[ 96.667241][ C0] device_add+0x7d7/0xb80
[ 96.669130][ C0] usb_set_configuration+0x1ad8/0x2180
[ 96.671484][ C0] usb_generic_driver_probe+0x8d/0x150
[ 96.673778][ C0] usb_probe_device+0x1c3/0x3b0
[ 96.675832][ C0] ? __pfx_usb_probe_device+0x10/0x10
[ 96.678226][ C0] really_probe+0x254/0xae0
[ 96.680203][ C0] __driver_probe_device+0x1e8/0x360
[ 96.682470][ C0] driver_probe_device+0x4f/0x240
[ 96.684650][ C0] __device_attach_driver+0x270/0x410
[ 96.686872][ C0] bus_for_each_drv+0x258/0x2f0
[ 96.688993][ C0] ? __pfx___device_attach_driver+0x10/0x10
[ 96.691600][ C0] ? __pfx_bus_for_each_drv+0x10/0x10
[ 96.693856][ C0] ? lockdep_hardirqs_on+0x7a/0x110
[ 96.695941][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 96.698319][ C0] __device_attach+0x2c4/0x450
[ 96.700295][ C0] ? __pfx___device_attach+0x10/0x10
[ 96.702470][ C0] ? do_raw_spin_unlock+0x4d/0x210
[ 96.704693][ C0] ? _raw_spin_unlock+0x28/0x50
[ 96.706871][ C0] device_initial_probe+0xa1/0xd0
[ 96.710058][ C0] bus_probe_device+0x12a/0x220
[ 96.712256][ C0] device_add+0x7d7/0xb80
[ 96.714153][ C0] usb_new_device+0x99d/0x1620
[ 96.716236][ C0] ? __pfx_usb_new_device+0x10/0x10
[ 96.718541][ C0] ? _raw_spin_unlock_irq+0x23/0x50
[ 96.720750][ C0] hub_event+0x28e8/0x4d30
[ 96.722664][ C0] ? do_raw_spin_unlock+0x4d/0x210
[ 96.724865][ C0] ? __pfx_hub_event+0x10/0x10
[ 96.727010][ C0] ? process_scheduled_works+0xa20/0x14e0
[ 96.729436][ C0] ? rcu_is_watching+0x15/0xb0
[ 96.731497][ C0] ? process_scheduled_works+0xa20/0x14e0
[ 96.733960][ C0] process_scheduled_works+0xa8e/0x14e0
[ 96.736339][ C0] ? __pfx_process_scheduled_works+0x10/0x10
[ 96.738852][ C0] ? assign_work+0x3cf/0x5d0
[ 96.740844][ C0] worker_thread+0xa47/0xfb0
[ 96.742836][ C0] ? __kthread_parkme+0x71/0x1f0
[ 96.744882][ C0] kthread+0x388/0x470
[ 96.746638][ C0] ? __pfx_worker_thread+0x10/0x10
[ 96.748796][ C0] ? __pfx_kthread+0x10/0x10
[ 96.750897][ C0] ret_from_fork+0x514/0xb70
[ 96.752908][ C0] ? __pfx_ret_from_fork+0x10/0x10
[ 96.755091][ C0] ? __switch_to+0xc89/0x1420
[ 96.757134][ C0] ? __pfx_kthread+0x10/0x10
[ 96.759119][ C0] ret_from_fork_asm+0x1a/0x30
[ 96.761171][ C0]
[ 96.762559][ C0] Modules linked in:
[ 96.764268][ C0] ---[ end trace 0000000000000000 ]---
[ 96.766654][ C0] RIP: 0010:f_midi2_stop_eps+0x5f/0x4d0
[ 96.769045][ C0] Code: e8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 ef e8 67 e7 63 fa 41 bc 30 07 00 00 4c 03 65 00 4c 89 e0 48 c1 e8 03 48 89 44 24 10 <42> 0f b6 04 28 84 c0 0f 85 23 04 00 00 41 8b 1c 24 31 ff 89 de e8
[ 96.777218][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002
[ 96.779812][ C0] RAX: 00000000000000e6 RBX: 0000000000000001 RCX: ffff888036b98000
[ 96.783168][ C0] RDX: 0000000000000100 RSI: 0000000000000008 RDI: ffff88804b63c148
[ 96.786255][ C0] RBP: ffff88804b63c0f0 R08: ffff88804b63c14f R09: 1ffff110096c7829
[ 96.789593][ C0] R10: dffffc0000000000 R11: ffffed10096c782a R12: 0000000000000730
[ 96.792968][ C0] R13: dffffc0000000000 R14: ffff88804b63c128 R15: 0000000000000001
[ 96.796168][ C0] FS: 0000000000000000(0000) GS:ffff88808c53f000(0000) knlGS:0000000000000000
[ 96.799874][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 96.802426][ C0] CR2: 00007fdcba2bf0f5 CR3: 00000000127b7000 CR4: 0000000000352ef0
[ 96.805547][ C0] Kernel panic - not syncing: Fatal exception in interrupt
[ 96.808828][ C0] Kernel Offset: disabled
[ 96.810501][ C0] Rebooting in 86400 seconds..