program:
r0 = gettid()
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@ipv4_delroute={0x38, 0x19, 0x901, 0x0, 0x2, {0x2, 0x18, 0x80, 0x0, 0xfe, 0x0, 0xfd, 0x1, 0x400}, [@RTA_DST={0x8, 0x1, @dev}, @RTA_GATEWAY={0x8, 0x5, @private=0xa010102}, @RTA_ENCAP={0xc, 0x16, 0x0, 0x1, @LWTUNNEL_IP_TTL={0x5, 0x4, 0x2}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/configs/c1.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000001300)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000001400)='./config/usb_gadget/g1/configs/c1.1/hid.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000001500)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x1ff)
write(r2, &(0x7f0000001600)='dummy_udc.0', 0xb)
mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='dir0/trace_marker\x00', 0x1, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='dir0/per_cpu/cpu0/trace_pipe\x00', 0x0, 0x0)
write(r3, &(0x7f0000000240)="62f5ff6ccf3d2ec97f0e4bc8a900d2e75067a5109d749c", 0x17)
read(r4, &(0x7f0000000b00), 0x64)
ioctl$SG_GET_VERSION_NUM(0xffffffffffffffff, 0x2282, &(0x7f0000000000))
timer_create(0xb, &(0x7f00000000c0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc))
getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r3, 0x84, 0x12, &(0x7f0000000080), &(0x7f0000000180)=0x4)
r5 = syz_open_dev$cec(&(0x7f0000000240), 0x0, 0x2182)
ioctl$CEC_RECEIVE(r5, 0xc0386106, &(0x7f0000000000)={0x4, 0x100000000, 0x80005, 0x0, 0x0, 0x1, "05f50400001400000000000800", 0xc, 0x0, 0x5, 0x0, 0x0, 0x0, 0xe})
timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200), 0x0, 0x0, 0x0, 0x7}, 0x0)
[ 123.277460][ T44] Bluetooth: hci0: command tx timeout
[ 123.704060][ T5309] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 123.854458][ T5309] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[ 123.858733][ T5309] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0
[ 123.864968][ T5309] usb 5-1: Dual-Role OTG device on HNP port
[ 123.868753][ T5309] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.02
[ 123.872809][ T5309] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 123.885826][ C0] ------------[ cut here ]------------
[ 123.888255][ C0] usb_ep_enable: ep129 (ep1in-bulk) has maxpacket 0
[ 123.890990][ C0] WARNING: drivers/usb/gadget/udc/core.c:125 at usb_ep_enable+0x148/0x480, CPU#0: kworker/0:4/5309
[ 123.895519][ C0] Modules linked in:
[ 123.897318][ C0] CPU: 0 UID: 0 PID: 5309 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full)
[ 123.901212][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 123.905296][ C0] Workqueue: usb_hub_wq hub_event
[ 123.907515][ C0] RIP: 0010:usb_ep_enable+0x1bc/0x480
[ 123.909524][ C0] Code: aa 6d 7e fa 49 83 3f 00 48 c7 c0 a0 4b b1 8c 49 c7 c0 c0 4b b1 8c 4c 0f 44 c0 4c 89 f7 48 c7 c6 91 6a 4c 8e 44 89 ea 4c 89 e1 <67> 48 0f b9 3a bd ea ff ff ff 0f 1f 44 00 00 e8 d0 3a 0f fa 65 8b
[ 123.917927][ C0] RSP: 0000:ffffc90000007910 EFLAGS: 00010082
[ 123.920854][ C0] RAX: ffffffff8cb14ba0 RBX: ffff888033f140e0 RCX: ffffffff8cb169c0
[ 123.924123][ C0] RDX: 0000000000000081 RSI: ffffffff8e4c6a91 RDI: ffffffff9065edf0
[ 123.927068][ C0] RBP: dffffc0000000000 R08: ffffffff8cb14bc0 R09: 0000000000000002
[ 123.930298][ C0] R10: 0000000000000003 R11: 0000000000000100 R12: ffffffff8cb169c0
[ 123.933583][ C0] R13: 0000000000000081 R14: ffffffff9065edf0 R15: ffff888033f140f8
[ 123.936858][ C0] FS: 0000000000000000(0000) GS:ffff88808c53f000(0000) knlGS:0000000000000000
[ 123.940525][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 123.943345][ C0] CR2: 00007ffcb9d41f94 CR3: 0000000043561000 CR4: 0000000000352ef0
[ 123.946833][ C0] Call Trace:
[ 123.948259][ C0]
[ 123.949470][ C0] hidg_set_alt+0x12a/0xa60
[ 123.951380][ C0] ? usb_gadget_set_state+0x12c/0x2d0
[ 123.953594][ C0] set_config+0x749/0x1160
[ 123.955410][ C0] composite_setup+0x1de7/0x3480
[ 123.957412][ C0] configfs_composite_setup+0xc7/0x100
[ 123.959400][ C0] dummy_timer+0x2f43/0x4cf0
[ 123.961101][ C0] ? __lock_acquire+0x683/0x2cf0
[ 123.962833][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 123.964796][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 123.966747][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 123.969116][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 123.971203][ C0] __hrtimer_run_queues+0x3bc/0xa10
[ 123.973344][ C0] hrtimer_run_softirq+0x17a/0x240
[ 123.975523][ C0] handle_softirqs+0x225/0x840
[ 123.977517][ C0] ? __irq_exit_rcu+0xca/0x220
[ 123.979609][ C0] __irq_exit_rcu+0xca/0x220
[ 123.981611][ C0] irq_exit_rcu+0x9/0x30
[ 123.983406][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0
[ 123.985710][ C0]
[ 123.986975][ C0]
[ 123.988231][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 123.990813][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80
[ 123.993520][ C0] Code: f7 e8 8d fb cc f5 f7 c3 00 02 00 00 74 05 e8 f0 f0 f8 f5 9c 58 a9 00 02 00 00 75 27 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 24 11 be f5 65 8b 05 1d a1 97 07 85 c0 74 18 5b 41 5e e9 81 48
[ 124.001444][ C0] RSP: 0000:ffffc9000ec86f70 EFLAGS: 00000206
[ 124.004079][ C0] RAX: 0000000000000002 RBX: 0000000000000246 RCX: 0000000080000001
[ 124.007622][ C0] RDX: 0000000000000006 RSI: ffffffff8e231f28 RDI: 0000000000000001
[ 124.010945][ C0] RBP: 0000000000000007 R08: ffffffff9057c237 R09: 1ffffffff20af846
[ 124.014228][ C0] R10: dffffc0000000000 R11: fffffbfff20af847 R12: 0000000000000000
[ 124.017470][ C0] R13: dffffc0000000000 R14: ffff888033f14000 R15: 1ffff11003ef0294
[ 124.020910][ C0] dummy_urb_enqueue+0x587/0x780
[ 124.023077][ C0] usb_hcd_submit_urb+0x328/0x1b60
[ 124.025253][ C0] usb_start_wait_urb+0x13f/0x5b0
[ 124.027449][ C0] ? __pfx_usb_start_wait_urb+0x10/0x10
[ 124.029810][ C0] usb_control_msg+0x234/0x3e0
[ 124.031882][ C0] ? kfree+0x1c5/0x640
[ 124.033693][ C0] usb_set_configuration+0x12b1/0x2180
[ 124.036012][ C0] usb_generic_driver_probe+0x8d/0x150
[ 124.038270][ C0] usb_probe_device+0x1c3/0x3b0
[ 124.040286][ C0] ? __pfx_usb_probe_device+0x10/0x10
[ 124.042559][ C0] really_probe+0x254/0xae0
[ 124.044395][ C0] __driver_probe_device+0x1e8/0x360
[ 124.046663][ C0] driver_probe_device+0x4f/0x240
[ 124.048721][ C0] __device_attach_driver+0x270/0x410
[ 124.050955][ C0] bus_for_each_drv+0x258/0x2f0
[ 124.052840][ C0] ? __pfx___device_attach_driver+0x10/0x10
[ 124.055107][ C0] ? __pfx_bus_for_each_drv+0x10/0x10
[ 124.057223][ C0] ? lockdep_hardirqs_on+0x7a/0x110
[ 124.059250][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 124.061595][ C0] __device_attach+0x2c4/0x450
[ 124.063492][ C0] ? __pfx___device_attach+0x10/0x10
[ 124.065875][ C0] ? do_raw_spin_unlock+0x4d/0x210
[ 124.068148][ C0] ? _raw_spin_unlock+0x28/0x50
[ 124.070191][ C0] device_initial_probe+0xa1/0xd0
[ 124.072460][ C0] bus_probe_device+0x12a/0x220
[ 124.074519][ C0] device_add+0x7d7/0xb80
[ 124.076403][ C0] usb_new_device+0x99d/0x1620
[ 124.078409][ C0] ? __pfx_usb_new_device+0x10/0x10
[ 124.080582][ C0] ? _raw_spin_unlock_irq+0x23/0x50
[ 124.082695][ C0] hub_event+0x28e8/0x4d30
[ 124.084553][ C0] ? do_raw_spin_unlock+0x4d/0x210
[ 124.086734][ C0] ? __pfx_hub_event+0x10/0x10
[ 124.088696][ C0] ? process_scheduled_works+0xa20/0x14e0
[ 124.091144][ C0] ? rcu_is_watching+0x15/0xb0
[ 124.093200][ C0] ? process_scheduled_works+0xa20/0x14e0
[ 124.095424][ C0] process_scheduled_works+0xa8e/0x14e0
[ 124.097797][ C0] ? __pfx_process_scheduled_works+0x10/0x10
[ 124.100430][ C0] ? assign_work+0x3cf/0x5d0
[ 124.102408][ C0] worker_thread+0xa47/0xfb0
[ 124.104334][ C0] ? __kthread_parkme+0x71/0x1f0
[ 124.106512][ C0] kthread+0x388/0x470
[ 124.108241][ C0] ? __pfx_worker_thread+0x10/0x10
[ 124.110437][ C0] ? __pfx_kthread+0x10/0x10
[ 124.112443][ C0] ret_from_fork+0x514/0xb70
[ 124.114426][ C0] ? __pfx_ret_from_fork+0x10/0x10
[ 124.116561][ C0] ? __switch_to+0xc89/0x1420
[ 124.118440][ C0] ? __pfx_kthread+0x10/0x10
[ 124.120238][ C0] ret_from_fork_asm+0x1a/0x30
[ 124.122191][ C0]
[ 124.123482][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 124.126598][ C0] CPU: 0 UID: 0 PID: 5309 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full)
[ 124.130432][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 124.134657][ C0] Workqueue: usb_hub_wq hub_event
[ 124.136869][ C0] Call Trace:
[ 124.138304][ C0]
[ 124.139539][ C0] vpanic+0x56c/0xa60
[ 124.141302][ C0] ? __pfx__printk+0x10/0x10
[ 124.143330][ C0] ? __pfx_vpanic+0x10/0x10
[ 124.145236][ C0] ? is_bpf_text_address+0x292/0x2b0
[ 124.147562][ C0] ? is_bpf_text_address+0x26/0x2b0
[ 124.149763][ C0] panic+0xc5/0xd0
[ 124.151415][ C0] ? __pfx_panic+0x10/0x10
[ 124.153410][ C0] ? ret_from_fork_asm+0x1a/0x30
[ 124.155563][ C0] __warn+0x315/0x4c0
[ 124.157344][ C0] ? usb_ep_enable+0x148/0x480
[ 124.159443][ C0] ? usb_ep_enable+0x148/0x480
[ 124.161526][ C0] __report_bug+0x276/0x570
[ 124.163572][ C0] ? usb_ep_enable+0x148/0x480
[ 124.165680][ C0] ? __pfx___report_bug+0x10/0x10
[ 124.167889][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 124.170429][ C0] ? try_to_wake_up+0x8c5/0x14d0
[ 124.172607][ C0] report_bug_entry+0x19a/0x290
[ 124.174669][ C0] ? usb_ep_enable+0x1bc/0x480
[ 124.176801][ C0] ? usb_ep_enable+0x1c1/0x480
[ 124.178900][ C0] handle_bug+0xce/0x200
[ 124.180789][ C0] exc_invalid_op+0x1a/0x50
[ 124.182747][ C0] asm_exc_invalid_op+0x1a/0x20
[ 124.184890][ C0] RIP: 0010:usb_ep_enable+0x1bc/0x480
[ 124.187390][ C0] Code: aa 6d 7e fa 49 83 3f 00 48 c7 c0 a0 4b b1 8c 49 c7 c0 c0 4b b1 8c 4c 0f 44 c0 4c 89 f7 48 c7 c6 91 6a 4c 8e 44 89 ea 4c 89 e1 <67> 48 0f b9 3a bd ea ff ff ff 0f 1f 44 00 00 e8 d0 3a 0f fa 65 8b
[ 124.195583][ C0] RSP: 0000:ffffc90000007910 EFLAGS: 00010082
[ 124.198203][ C0] RAX: ffffffff8cb14ba0 RBX: ffff888033f140e0 RCX: ffffffff8cb169c0
[ 124.201511][ C0] RDX: 0000000000000081 RSI: ffffffff8e4c6a91 RDI: ffffffff9065edf0
[ 124.204811][ C0] RBP: dffffc0000000000 R08: ffffffff8cb14bc0 R09: 0000000000000002
[ 124.208239][ C0] R10: 0000000000000003 R11: 0000000000000100 R12: ffffffff8cb169c0
[ 124.211555][ C0] R13: 0000000000000081 R14: ffffffff9065edf0 R15: ffff888033f140f8
[ 124.214921][ C0] hidg_set_alt+0x12a/0xa60
[ 124.216971][ C0] ? usb_gadget_set_state+0x12c/0x2d0
[ 124.219245][ C0] set_config+0x749/0x1160
[ 124.221174][ C0] composite_setup+0x1de7/0x3480
[ 124.223294][ C0] configfs_composite_setup+0xc7/0x100
[ 124.225603][ C0] dummy_timer+0x2f43/0x4cf0
[ 124.227664][ C0] ? __lock_acquire+0x683/0x2cf0
[ 124.229818][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 124.232113][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 124.234200][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 124.236674][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 124.238764][ C0] __hrtimer_run_queues+0x3bc/0xa10
[ 124.240930][ C0] hrtimer_run_softirq+0x17a/0x240
[ 124.243064][ C0] handle_softirqs+0x225/0x840
[ 124.245150][ C0] ? __irq_exit_rcu+0xca/0x220
[ 124.247229][ C0] __irq_exit_rcu+0xca/0x220
[ 124.249179][ C0] irq_exit_rcu+0x9/0x30
[ 124.250942][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0
[ 124.253583][ C0]
[ 124.254973][ C0]
[ 124.256227][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 124.258741][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80
[ 124.261346][ C0] Code: f7 e8 8d fb cc f5 f7 c3 00 02 00 00 74 05 e8 f0 f0 f8 f5 9c 58 a9 00 02 00 00 75 27 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 24 11 be f5 65 8b 05 1d a1 97 07 85 c0 74 18 5b 41 5e e9 81 48
[ 124.269117][ C0] RSP: 0000:ffffc9000ec86f70 EFLAGS: 00000206
[ 124.271653][ C0] RAX: 0000000000000002 RBX: 0000000000000246 RCX: 0000000080000001
[ 124.274925][ C0] RDX: 0000000000000006 RSI: ffffffff8e231f28 RDI: 0000000000000001
[ 124.278211][ C0] RBP: 0000000000000007 R08: ffffffff9057c237 R09: 1ffffffff20af846
[ 124.281600][ C0] R10: dffffc0000000000 R11: fffffbfff20af847 R12: 0000000000000000
[ 124.284899][ C0] R13: dffffc0000000000 R14: ffff888033f14000 R15: 1ffff11003ef0294
[ 124.288323][ C0] dummy_urb_enqueue+0x587/0x780
[ 124.290401][ C0] usb_hcd_submit_urb+0x328/0x1b60
[ 124.292587][ C0] usb_start_wait_urb+0x13f/0x5b0
[ 124.294748][ C0] ? __pfx_usb_start_wait_urb+0x10/0x10
[ 124.297158][ C0] usb_control_msg+0x234/0x3e0
[ 124.299219][ C0] ? kfree+0x1c5/0x640
[ 124.300991][ C0] usb_set_configuration+0x12b1/0x2180
[ 124.303402][ C0] usb_generic_driver_probe+0x8d/0x150
[ 124.305796][ C0] usb_probe_device+0x1c3/0x3b0
[ 124.307909][ C0] ? __pfx_usb_probe_device+0x10/0x10
[ 124.310142][ C0] really_probe+0x254/0xae0
[ 124.312323][ C0] __driver_probe_device+0x1e8/0x360
[ 124.315066][ C0] driver_probe_device+0x4f/0x240
[ 124.317557][ C0] __device_attach_driver+0x270/0x410
[ 124.320334][ C0] bus_for_each_drv+0x258/0x2f0
[ 124.322879][ C0] ? __pfx___device_attach_driver+0x10/0x10
[ 124.325428][ C0] ? __pfx_bus_for_each_drv+0x10/0x10
[ 124.327720][ C0] ? lockdep_hardirqs_on+0x7a/0x110
[ 124.330285][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 124.333379][ C0] __device_attach+0x2c4/0x450
[ 124.335934][ C0] ? __pfx___device_attach+0x10/0x10
[ 124.338582][ C0] ? do_raw_spin_unlock+0x4d/0x210
[ 124.341386][ C0] ? _raw_spin_unlock+0x28/0x50
[ 124.344095][ C0] device_initial_probe+0xa1/0xd0
[ 124.346597][ C0] bus_probe_device+0x12a/0x220
[ 124.348618][ C0] device_add+0x7d7/0xb80
[ 124.350397][ C0] usb_new_device+0x99d/0x1620
[ 124.352439][ C0] ? __pfx_usb_new_device+0x10/0x10
[ 124.354675][ C0] ? _raw_spin_unlock_irq+0x23/0x50
[ 124.357126][ C0] hub_event+0x28e8/0x4d30
[ 124.359380][ C0] ? do_raw_spin_unlock+0x4d/0x210
[ 124.361511][ C0] ? __pfx_hub_event+0x10/0x10
[ 124.363460][ C0] ? process_scheduled_works+0xa20/0x14e0
[ 124.365971][ C0] ? rcu_is_watching+0x15/0xb0
[ 124.368441][ C0] ? process_scheduled_works+0xa20/0x14e0
[ 124.371409][ C0] process_scheduled_works+0xa8e/0x14e0
[ 124.374270][ C0] ? __pfx_process_scheduled_works+0x10/0x10
[ 124.377502][ C0] ? assign_work+0x3cf/0x5d0
[ 124.380104][ C0] worker_thread+0xa47/0xfb0
[ 124.382547][ C0] ? __kthread_parkme+0x71/0x1f0
[ 124.384730][ C0] kthread+0x388/0x470
[ 124.386454][ C0] ? __pfx_worker_thread+0x10/0x10
[ 124.388598][ C0] ? __pfx_kthread+0x10/0x10
[ 124.390502][ C0] ret_from_fork+0x514/0xb70
[ 124.392432][ C0] ? __pfx_ret_from_fork+0x10/0x10
[ 124.395031][ C0] ? __switch_to+0xc89/0x1420
[ 124.397379][ C0] ? __pfx_kthread+0x10/0x10
[ 124.399388][ C0] ret_from_fork_asm+0x1a/0x30
[ 124.401445][ C0]
[ 124.403224][ C0] Kernel Offset: disabled
[ 124.405085][ C0] Rebooting in 86400 seconds..