program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
open$dir(&(0x7f00000003c0)='./config/usb_gadget/g1\x00', 0x10000, 0x18)
rmdir(0x0)
rmdir(0x0)
rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00')
syz_mount_image$fuse(0x0, 0x0, 0x8, &(0x7f0000000280)=ANY=[@ANYRESHEX], 0x0, 0x0, 0x0)
syz_emit_ethernet(0x2a, &(0x7f0000000400)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x33, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0xb}}, {0x0, 0x0, 0x8}}}}}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/direction\x00', 0x1, 0x0)
write(r0, &(0x7f0000000600)='2', 0x1)
symlinkat(&(0x7f0000000880)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000008c0)='./my_configfs/usb_gadget/g1/configs/c.1/midi2.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./my_configfs/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r1, &(0x7f0000000940)='dummy_udc.0', 0xb)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
unshare(0x64000600)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x70bd26, 0x25dfdbfc, {0x2, 0x14, 0x10, 0x0, 0xfd, 0x0, 0x0, 0x6, 0x20002200}, [@RTA_TABLE={0x8, 0xf, 0x7fe}]}, 0x24}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010)
r4 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCDELRT(r4, 0x890c, &(0x7f0000000080)={0x0, {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0xd}}, {0x2, 0x4e22, @multicast1}, {0x2, 0x4e20, @broadcast}, 0x1, 0x0, 0x0, 0x0, 0x7, 0x0, 0xff, 0x8, 0x401})
sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYRES32=r3], 0x7c}, 0x1, 0x0, 0x0, 0x40041}, 0x4040850)
sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003080005400000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840)
close(0x3)
syz_emit_vhci(&(0x7f0000000280)=ANY=[@ANYBLOB="043e1f0a00"], 0x22)
openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200), 0x400, 0x0)
[ 102.410276][ T5279] Bluetooth: hci0: command tx timeout
[ 102.911472][ T5063] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 103.064383][ T5063] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.02
[ 103.069909][ T5063] usb 5-1: Dual-Role OTG device on HNP port
[ 103.076309][ T5063] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 103.118703][ T5063] gspca_main: spca501-2.14.0 probing 0000:0000
[ 103.125281][ T5063] gspca_spca501: reg write: error -32
[ 103.128032][ T5063] spca501 5-1:1.0: Reg write failed for 0x02,0x0f,0x05
[ 103.132008][ T5063] spca501 5-1:1.0: probe with driver spca501 failed with error -22
[ 103.141351][ C0] Oops: general protection fault, probably for non-canonical address 0xdffffc00000000e6: 0000 [#1] SMP KASAN NOPTI
[ 103.146416][ C0] KASAN: null-ptr-deref in range [0x0000000000000730-0x0000000000000737]
[ 103.150041][ C0] CPU: 0 UID: 0 PID: 5063 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full)
[ 103.154006][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 103.158603][ C0] Workqueue: usb_hub_wq hub_event
[ 103.160889][ C0] RIP: 0010:f_midi2_stop_eps+0x5f/0x4d0
[ 103.163398][ C0] Code: e8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 ef e8 77 4b 61 fa 41 bc 30 07 00 00 4c 03 65 00 4c 89 e0 48 c1 e8 03 48 89 44 24 10 <42> 0f b6 04 28 84 c0 0f 85 23 04 00 00 41 8b 1c 24 31 ff 89 de e8
[ 103.171617][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002
[ 103.174187][ C0] RAX: 00000000000000e6 RBX: 0000000000000001 RCX: ffff888000278000
[ 103.177558][ C0] RDX: 0000000000000100 RSI: 0000000000000100 RDI: ffff888052874148
[ 103.180869][ C0] RBP: ffff8880528740f0 R08: ffff88805287414f R09: 1ffff1100a50e829
[ 103.184252][ C0] R10: dffffc0000000000 R11: ffffed100a50e82a R12: 0000000000000730
[ 103.187623][ C0] R13: dffffc0000000000 R14: ffff888052874128 R15: 0000000000000001
[ 103.191065][ C0] FS: 0000000000000000(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000
[ 103.194769][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 103.197614][ C0] CR2: 00007f5f2e88e0f5 CR3: 00000000123bc000 CR4: 0000000000352ef0
[ 103.201063][ C0] Call Trace:
[ 103.202553][ C0]
[ 103.203826][ C0] f_midi2_set_alt+0x11c/0xf00
[ 103.205824][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 103.208136][ C0] composite_setup+0x1ffd/0x3480
[ 103.210261][ C0] configfs_composite_setup+0xc7/0x100
[ 103.212669][ C0] dummy_timer+0x2f43/0x4cf0
[ 103.214767][ C0] ? update_se+0x90/0x1020
[ 103.216586][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 103.218728][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 103.220689][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 103.222979][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 103.224948][ C0] __hrtimer_run_queues+0x3bc/0xa10
[ 103.227095][ C0] hrtimer_run_softirq+0x1e3/0x2e0
[ 103.229243][ C0] handle_softirqs+0x226/0x860
[ 103.231378][ C0] ? __irq_exit_rcu+0xcb/0x220
[ 103.233375][ C0] __irq_exit_rcu+0xcb/0x220
[ 103.235414][ C0] irq_exit_rcu+0x9/0x30
[ 103.237235][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0
[ 103.239679][ C0]
[ 103.240998][ C0]
[ 103.242356][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 103.244931][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80
[ 103.247826][ C0] Code: f7 e8 ad b6 c2 f5 f7 c3 00 02 00 00 74 05 e8 b0 e7 ee f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 b4 d6 b3 f5 65 48 8b 05 2c ce b0 07 48 85 c0 74 18 5b 41 5e c3
[ 103.256153][ C0] RSP: 0018:ffffc9000d8967d0 EFLAGS: 00000206
[ 103.258755][ C0] RAX: 0000000000000002 RBX: 0000000000000246 RCX: 8000000000000001
[ 103.262129][ C0] RDX: 0000000000000006 RSI: ffffffff8e460b06 RDI: 0000000000000001
[ 103.265598][ C0] RBP: 0000000000000007 R08: ffffffff9078fa37 R09: 1ffffffff20f1f46
[ 103.268987][ C0] R10: dffffc0000000000 R11: fffffbfff20f1f47 R12: 0000000000000000
[ 103.272048][ C0] R13: dffffc0000000000 R14: ffff888034c3c000 R15: 1ffff11003a4bc94
[ 103.275234][ C0] dummy_urb_enqueue+0x587/0x780
[ 103.277340][ C0] usb_hcd_submit_urb+0x328/0x1b60
[ 103.279577][ C0] usb_start_wait_urb+0x13f/0x5b0
[ 103.282062][ C0] ? trace_kmalloc+0x2a/0xf0
[ 103.283883][ C0] ? __pfx_usb_start_wait_urb+0x10/0x10
[ 103.286060][ C0] usb_control_msg+0x234/0x3e0
[ 103.288005][ C0] usb_set_interface+0x521/0x1470
[ 103.290002][ C0] snd_usb_midi_v2_create+0x621/0x4ac0
[ 103.292151][ C0] ? __pfx_proc_audio_usbid_read+0x10/0x10
[ 103.294397][ C0] ? snd_card_rw_proc_new+0x10d/0x140
[ 103.296551][ C0] ? __pfx_snd_usb_midi_v2_create+0x10/0x10
[ 103.298810][ C0] ? usb_ifnum_to_if+0x262/0x2f0
[ 103.300721][ C0] snd_usb_create_stream+0x262/0x630
[ 103.302725][ C0] usb_audio_probe+0x144c/0x2240
[ 103.304716][ C0] ? __pfx_usb_audio_probe+0x10/0x10
[ 103.306956][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 103.309492][ C0] usb_probe_interface+0x653/0xc60
[ 103.311569][ C0] ? __pfx_usb_probe_interface+0x10/0x10
[ 103.313926][ C0] really_probe+0x254/0xae0
[ 103.315979][ C0] __driver_probe_device+0x1e8/0x360
[ 103.318223][ C0] driver_probe_device+0x4f/0x240
[ 103.320336][ C0] __device_attach_driver+0x270/0x410
[ 103.322650][ C0] bus_for_each_drv+0x258/0x2f0
[ 103.324627][ C0] ? __pfx___device_attach_driver+0x10/0x10
[ 103.327115][ C0] ? __pfx_bus_for_each_drv+0x10/0x10
[ 103.329553][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 103.332362][ C0] __device_attach+0x2c4/0x450
[ 103.334650][ C0] ? __pfx___device_attach+0x10/0x10
[ 103.336814][ C0] ? do_raw_spin_unlock+0x4d/0x200
[ 103.338965][ C0] ? _raw_spin_unlock+0x28/0x50
[ 103.341046][ C0] device_initial_probe+0xa1/0xd0
[ 103.343207][ C0] bus_probe_device+0x12a/0x220
[ 103.345283][ C0] device_add+0x7d7/0xb80
[ 103.347143][ C0] usb_set_configuration+0x1ad8/0x2180
[ 103.349394][ C0] usb_generic_driver_probe+0x8d/0x150
[ 103.352004][ C0] usb_probe_device+0x1c3/0x3b0
[ 103.354211][ C0] ? __pfx_usb_probe_device+0x10/0x10
[ 103.356624][ C0] really_probe+0x254/0xae0
[ 103.358513][ C0] __driver_probe_device+0x1e8/0x360
[ 103.360641][ C0] driver_probe_device+0x4f/0x240
[ 103.362751][ C0] __device_attach_driver+0x270/0x410
[ 103.364933][ C0] bus_for_each_drv+0x258/0x2f0
[ 103.367052][ C0] ? __pfx___device_attach_driver+0x10/0x10
[ 103.369639][ C0] ? __pfx_bus_for_each_drv+0x10/0x10
[ 103.371993][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 103.374485][ C0] __device_attach+0x2c4/0x450
[ 103.376519][ C0] ? __pfx___device_attach+0x10/0x10
[ 103.378850][ C0] ? do_raw_spin_unlock+0x4d/0x200
[ 103.381130][ C0] ? _raw_spin_unlock+0x28/0x50
[ 103.383329][ C0] device_initial_probe+0xa1/0xd0
[ 103.385479][ C0] bus_probe_device+0x12a/0x220
[ 103.387501][ C0] device_add+0x7d7/0xb80
[ 103.389289][ C0] usb_new_device+0x9aa/0x1690
[ 103.391310][ C0] ? __pfx_usb_new_device+0x10/0x10
[ 103.393436][ C0] ? _raw_spin_unlock_irq+0x23/0x50
[ 103.395359][ C0] hub_event+0x28e8/0x4d30
[ 103.397150][ C0] ? do_raw_spin_unlock+0x4d/0x200
[ 103.399296][ C0] ? __pfx_hub_event+0x10/0x10
[ 103.401217][ C0] ? process_scheduled_works+0x97a/0x1630
[ 103.403527][ C0] ? rcu_is_watching+0x16/0xb0
[ 103.405464][ C0] ? process_scheduled_works+0x97a/0x1630
[ 103.407887][ C0] process_scheduled_works+0xc3d/0x1630
[ 103.410155][ C0] ? __pfx_process_scheduled_works+0x10/0x10
[ 103.412518][ C0] ? assign_work+0x3cf/0x5d0
[ 103.414419][ C0] worker_thread+0xa47/0xfb0
[ 103.416307][ C0] ? __kthread_parkme+0x71/0x1f0
[ 103.418315][ C0] kthread+0x38b/0x480
[ 103.420091][ C0] ? __pfx_worker_thread+0x10/0x10
[ 103.422253][ C0] ? __pfx_kthread+0x10/0x10
[ 103.424286][ C0] ret_from_fork+0x514/0xb70
[ 103.426308][ C0] ? __pfx_ret_from_fork+0x10/0x10
[ 103.428542][ C0] ? __switch_to+0xc89/0x1420
[ 103.430503][ C0] ? __pfx_kthread+0x10/0x10
[ 103.432549][ C0] ret_from_fork_asm+0x1a/0x30
[ 103.434537][ C0]
[ 103.435882][ C0] Modules linked in:
[ 103.437495][ C0] ---[ end trace 0000000000000000 ]---
[ 103.439807][ C0] RIP: 0010:f_midi2_stop_eps+0x5f/0x4d0
[ 103.442230][ C0] Code: e8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 ef e8 77 4b 61 fa 41 bc 30 07 00 00 4c 03 65 00 4c 89 e0 48 c1 e8 03 48 89 44 24 10 <42> 0f b6 04 28 84 c0 0f 85 23 04 00 00 41 8b 1c 24 31 ff 89 de e8
[ 103.450229][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002
[ 103.452844][ C0] RAX: 00000000000000e6 RBX: 0000000000000001 RCX: ffff888000278000
[ 103.456220][ C0] RDX: 0000000000000100 RSI: 0000000000000100 RDI: ffff888052874148
[ 103.459576][ C0] RBP: ffff8880528740f0 R08: ffff88805287414f R09: 1ffff1100a50e829
[ 103.463573][ C0] R10: dffffc0000000000 R11: ffffed100a50e82a R12: 0000000000000730
[ 103.467656][ C0] R13: dffffc0000000000 R14: ffff888052874128 R15: 0000000000000001
[ 103.471178][ C0] FS: 0000000000000000(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000
[ 103.474962][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 103.477567][ C0] CR2: 00007f5f2e88e0f5 CR3: 00000000123bc000 CR4: 0000000000352ef0
[ 103.480907][ C0] Kernel panic - not syncing: Fatal exception in interrupt
[ 103.484482][ C0] Kernel Offset: disabled
[ 103.486422][ C0] Rebooting in 86400 seconds..