program: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x1c, 0x0, 0x0, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x4000004) ioctl$sock_SIOCBRDELBR(r0, 0x89a2, &(0x7f0000000000)='bridge0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/direction\x00', 0x2, 0x0) write(r1, &(0x7f0000000400)='1', 0x1) symlinkat(&(0x7f0000000440)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/configs/c.1/midi2.usb0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r2, &(0x7f0000000500)='dummy_udc.0', 0xb) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x44b, 0x0, 0x0, {0x7a, 0x0, 0x0, r5}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_VLAN_FILTERING={0x5, 0x7, 0x7}]}}}]}, 0x3c}}, 0x0) syz_emit_ethernet(0x22, &(0x7f0000002700)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xc}, @random="6a2ddcf6177a", @void, {@ipv4={0x8864, @generic={{0x5, 0x4, 0x1, 0x2, 0x14, 0x66, 0x57, 0x6, 0x4, 0x0, @private=0xa010101, @remote}}}}}, 0x0) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0xc0205826, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) r7 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r7, 0x0, 0x0) syz_usb_control_io$printer(r7, 0x0, 0x0) r8 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r8, 0x80015b1b, 0x0) syz_usb_connect$cdc_ncm(0x4, 0x6e, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000020000002505a1a4400001"], 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) syz_usb_connect$hid(0x0, 0x3f, 0x0, 0x0) [ 94.908399][ T5281] Bluetooth: hci0: command tx timeout [ 94.942302][ T5318] bridge0: port 3(syz_tun) entered blocking state [ 94.950073][ T5318] bridge0: port 3(syz_tun) entered disabled state [ 94.958333][ T5318] syz_tun: entered allmulticast mode [ 94.970763][ T5318] syz_tun: entered promiscuous mode [ 94.971547][ T5318] bridge0: port 3(syz_tun) entered blocking state [ 94.971660][ T5318] bridge0: port 3(syz_tun) entered forwarding state [ 95.138411][ T26] audit: type=1800 audit(1788543093.344:2): pid=5318 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="direction" dev="configfs" ino=4270 res=0 errno=0 [ 95.175360][ T26] audit: type=1800 audit(1788543093.384:3): pid=5318 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="UDC" dev="configfs" ino=4277 res=0 errno=0 [ 95.431643][ T5318] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 95.431944][ T5318] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 95.667866][ T808] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 95.820214][ T808] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.03 [ 95.826112][ T808] usb 5-1: Dual-Role OTG device on HNP port [ 95.830045][ T808] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.854978][ T808] gspca_main: spca501-2.14.0 probing 0000:0000 [ 95.859200][ T808] gspca_spca501: reg write: error -32 [ 95.861751][ T808] spca501 5-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 95.864984][ T808] spca501 5-1:1.0: probe with driver spca501 failed with error -22 [ 95.874279][ C0] Oops: general protection fault, probably for non-canonical address 0xdffffc00000000e6: 0000 [#1] SMP KASAN NOPTI [ 95.879016][ C0] KASAN: null-ptr-deref in range [0x0000000000000730-0x0000000000000737] [ 95.882186][ C0] CPU: 0 UID: 0 PID: 808 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full) [ 95.885765][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.889897][ C0] Workqueue: usb_hub_wq hub_event [ 95.892236][ C0] RIP: 0010:f_midi2_stop_eps+0x28e/0x4d0 [ 95.894650][ C0] Code: 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 27 d0 5a fa 41 bf 30 07 00 00 4d 03 3e 4c 89 f8 48 c1 e8 03 48 89 44 24 18 <42> 0f b6 04 28 84 c0 0f 85 12 02 00 00 41 8b 1f 31 ff 89 de e8 a9 [ 95.902250][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002 [ 95.904796][ C0] RAX: 00000000000000e6 RBX: ffff888052874120 RCX: ffff88801d340000 [ 95.908136][ C0] RDX: 8000000000000100 RSI: 0000000000000100 RDI: ffffffff8c6da420 [ 95.911296][ C0] RBP: ffff888052874100 R08: 00000000816c8eeb R09: 00000000025d5976 [ 95.914437][ C0] R10: 0000000000000010 R11: ffffffff8ed5c6e0 R12: ffff888052874730 [ 95.917745][ C0] R13: dffffc0000000000 R14: ffff888052874128 R15: 0000000000000730 [ 95.921018][ C0] FS: 0000000000000000(0000) GS:ffff88808c2cd000(0000) knlGS:0000000000000000 [ 95.924539][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.927156][ C0] CR2: 00007f23d2f040f5 CR3: 0000000050d0c000 CR4: 0000000000352ef0 [ 95.930271][ C0] Call Trace: [ 95.931676][ C0] [ 95.932838][ C0] f_midi2_set_alt+0x11c/0xf00 [ 95.934848][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 95.937074][ C0] composite_setup+0x1ffd/0x3480 [ 95.939165][ C0] configfs_composite_setup+0xc7/0x100 [ 95.941410][ C0] dummy_timer+0x2f43/0x4cf0 [ 95.943257][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 95.945507][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 95.947577][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 95.950017][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 95.952086][ C0] __hrtimer_run_queues+0x3bc/0xa10 [ 95.954304][ C0] hrtimer_run_softirq+0x1e3/0x2e0 [ 95.956436][ C0] handle_softirqs+0x226/0x860 [ 95.958411][ C0] ? __irq_exit_rcu+0xcb/0x220 [ 95.960774][ C0] __irq_exit_rcu+0xcb/0x220 [ 95.962597][ C0] irq_exit_rcu+0x9/0x30 [ 95.964393][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 95.966638][ C0] [ 95.967920][ C0] [ 95.969184][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 95.971679][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 [ 95.974403][ C0] Code: f7 e8 5d b5 ba f5 f7 c3 00 02 00 00 74 05 e8 60 03 e7 f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 f4 ce ab f5 65 48 8b 05 9c 21 ac 07 48 85 c0 74 18 5b 41 5e c3 [ 95.981771][ C0] RSP: 0018:ffffc90003efe730 EFLAGS: 00000206 [ 95.984155][ C0] RAX: 0000000000000002 RBX: 0000000000000246 RCX: 8000000000000001 [ 95.987028][ C0] RDX: 0000000000000006 RSI: ffffffff8e4777fa RDI: 0000000000000001 [ 95.990071][ C0] RBP: 0000000000000007 R08: ffffffff907a3a7f R09: 1ffffffff20f474f [ 95.993134][ C0] R10: dffffc0000000000 R11: fffffbfff20f4750 R12: 0000000000000000 [ 95.996244][ C0] R13: dffffc0000000000 R14: ffff8880342f4000 R15: 1ffff11006800094 [ 95.999457][ C0] dummy_urb_enqueue+0x587/0x780 [ 96.001475][ C0] usb_hcd_submit_urb+0x328/0x1b60 [ 96.003716][ C0] usb_start_wait_urb+0x13f/0x5b0 [ 96.005749][ C0] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 96.008094][ C0] usb_control_msg+0x234/0x3e0 [ 96.010097][ C0] usb_set_interface+0x521/0x1470 [ 96.012130][ C0] ? __kmalloc_cache_noprof+0x14d/0x600 [ 96.014407][ C0] snd_usb_midi_v2_create+0x621/0x4ac0 [ 96.016481][ C0] ? __pfx_proc_audio_usbid_read+0x10/0x10 [ 96.018828][ C0] ? snd_card_rw_proc_new+0x10d/0x140 [ 96.021043][ C0] ? __pfx_snd_usb_midi_v2_create+0x10/0x10 [ 96.023410][ C0] ? usb_ifnum_to_if+0x262/0x2f0 [ 96.025479][ C0] snd_usb_create_stream+0x262/0x630 [ 96.027641][ C0] usb_audio_probe+0x144c/0x2240 [ 96.029771][ C0] ? __pfx_usb_audio_probe+0x10/0x10 [ 96.031964][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 96.034257][ C0] usb_probe_interface+0x788/0xe50 [ 96.036496][ C0] ? __pfx_usb_probe_interface+0x10/0x10 [ 96.038800][ C0] ? sysfs_do_create_link_sd+0xe0/0x110 [ 96.041170][ C0] ? driver_sysfs_add+0x1fe/0x210 [ 96.043372][ C0] ? __pfx_usb_probe_interface+0x10/0x10 [ 96.045753][ C0] really_probe+0x254/0xae0 [ 96.047707][ C0] __driver_probe_device+0x1e8/0x360 [ 96.050060][ C0] driver_probe_device+0x4f/0x240 [ 96.052283][ C0] __device_attach_driver+0x270/0x410 [ 96.054543][ C0] bus_for_each_drv+0x258/0x2f0 [ 96.056675][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 96.059310][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 96.061626][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 96.064190][ C0] __device_attach+0x2c4/0x450 [ 96.066218][ C0] ? __pfx___device_attach+0x10/0x10 [ 96.068420][ C0] ? do_raw_spin_unlock+0x4d/0x200 [ 96.070671][ C0] ? _raw_spin_unlock+0x28/0x50 [ 96.072868][ C0] device_initial_probe+0xa1/0xd0 [ 96.074996][ C0] bus_probe_device+0x12a/0x220 [ 96.077117][ C0] device_add+0x7d7/0xb80 [ 96.078874][ C0] usb_set_configuration+0x1ad8/0x2180 [ 96.081189][ C0] usb_generic_driver_probe+0x8d/0x150 [ 96.083553][ C0] usb_probe_device+0x1c3/0x3b0 [ 96.085609][ C0] ? __pfx_usb_probe_device+0x10/0x10 [ 96.087908][ C0] really_probe+0x254/0xae0 [ 96.089950][ C0] __driver_probe_device+0x1e8/0x360 [ 96.092280][ C0] driver_probe_device+0x4f/0x240 [ 96.094455][ C0] __device_attach_driver+0x270/0x410 [ 96.096730][ C0] bus_for_each_drv+0x258/0x2f0 [ 96.098500][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 96.100851][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 96.103163][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 96.105453][ C0] __device_attach+0x2c4/0x450 [ 96.107404][ C0] ? __pfx___device_attach+0x10/0x10 [ 96.109698][ C0] ? do_raw_spin_unlock+0x4d/0x200 [ 96.111854][ C0] ? _raw_spin_unlock+0x28/0x50 [ 96.113851][ C0] device_initial_probe+0xa1/0xd0 [ 96.115862][ C0] bus_probe_device+0x12a/0x220 [ 96.117840][ C0] device_add+0x7d7/0xb80 [ 96.119687][ C0] usb_new_device+0x9aa/0x1690 [ 96.121603][ C0] ? __pfx_usb_new_device+0x10/0x10 [ 96.123754][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 96.125890][ C0] hub_event+0x28e8/0x4d30 [ 96.127733][ C0] ? do_raw_spin_unlock+0x4d/0x200 [ 96.129888][ C0] ? __pfx_hub_event+0x10/0x10 [ 96.131956][ C0] ? rcu_is_watching+0x16/0xb0 [ 96.133954][ C0] ? process_scheduled_works+0x97a/0x1630 [ 96.136363][ C0] process_scheduled_works+0xc3d/0x1630 [ 96.138702][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 96.141272][ C0] ? assign_work+0x3cf/0x5d0 [ 96.143202][ C0] worker_thread+0xa47/0xfb0 [ 96.145087][ C0] ? __kthread_parkme+0x71/0x1f0 [ 96.146989][ C0] kthread+0x38b/0x480 [ 96.148667][ C0] ? __pfx_worker_thread+0x10/0x10 [ 96.150756][ C0] ? __pfx_kthread+0x10/0x10 [ 96.152579][ C0] ret_from_fork+0x514/0xb70 [ 96.154457][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 96.156602][ C0] ? __switch_to+0xc89/0x1420 [ 96.158520][ C0] ? __pfx_kthread+0x10/0x10 [ 96.160492][ C0] ret_from_fork_asm+0x1a/0x30 [ 96.162504][ C0] [ 96.163898][ C0] Modules linked in: [ 96.165642][ C0] ---[ end trace 0000000000000000 ]--- [ 96.167933][ C0] RIP: 0010:f_midi2_stop_eps+0x28e/0x4d0 [ 96.167956][ C0] Code: 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 27 d0 5a fa 41 bf 30 07 00 00 4d 03 3e 4c 89 f8 48 c1 e8 03 48 89 44 24 18 <42> 0f b6 04 28 84 c0 0f 85 12 02 00 00 41 8b 1f 31 ff 89 de e8 a9 [ 96.167966][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002 [ 96.167978][ C0] RAX: 00000000000000e6 RBX: ffff888052874120 RCX: ffff88801d340000 [ 96.167987][ C0] RDX: 8000000000000100 RSI: 0000000000000100 RDI: ffffffff8c6da420 [ 96.167995][ C0] RBP: ffff888052874100 R08: 00000000816c8eeb R09: 00000000025d5976 [ 96.168002][ C0] R10: 0000000000000010 R11: ffffffff8ed5c6e0 R12: ffff888052874730 [ 96.168010][ C0] R13: dffffc0000000000 R14: ffff888052874128 R15: 0000000000000730 [ 96.168025][ C0] FS: 0000000000000000(0000) GS:ffff88808c2cd000(0000) knlGS:0000000000000000 [ 96.168034][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 96.168042][ C0] CR2: 00007f23d2f040f5 CR3: 0000000050d0c000 CR4: 0000000000352ef0 [ 96.168077][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 96.210917][ C0] Kernel Offset: disabled [ 96.212740][ C0] Rebooting in 86400 seconds..