program: mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000380)={'vxcan1\x00', 0x0}) r5 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'gretap0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=@newqdisc={0x2c, 0x24, 0xd0f, 0x70bd2d, 0x100000, {0x60, 0x0, 0x0, r7, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x4090) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000840)=@newqdisc={0x34, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x20000000) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r11, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0xb, 0xffffff95, 0xfffffffd, 0xe9ae, 0x3, 0x3, 0x6, 0x8}}}}]}, 0x58}}, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="364000002600913e"], 0xfe33) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) r12 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/direction\x00', 0x1, 0x0) write(r12, &(0x7f0000000600)='2', 0x1) symlinkat(&(0x7f0000000880)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000008c0)='./my_configfs/usb_gadget/g1/configs/c.1/midi2.usb0\x00') r13 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./my_configfs/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r13, &(0x7f0000000940)='dummy_udc.0', 0xb) [ 86.564454][ T5284] Bluetooth: hci0: command tx timeout [ 86.710085][ T5321] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.0'. [ 87.112490][ T5308] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 87.264366][ T5308] usb 5-1: Dual-Role OTG device on HNP port [ 87.267141][ T5308] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.02 [ 87.271007][ T5308] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 87.308797][ T5308] gspca_main: spca501-2.14.0 probing 0000:0000 [ 87.319654][ T5308] gspca_spca501: reg write: error -32 [ 87.322010][ T5308] spca501 5-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 87.326511][ T5308] spca501 5-1:1.0: probe with driver spca501 failed with error -22 [ 87.356662][ C0] Oops: general protection fault, probably for non-canonical address 0xdffffc00000000e6: 0000 [#1] SMP KASAN NOPTI [ 87.361894][ C0] KASAN: null-ptr-deref in range [0x0000000000000730-0x0000000000000737] [ 87.365421][ C0] CPU: 0 UID: 0 PID: 5308 Comm: kworker/0:5 Not tainted syzkaller #0 PREEMPT(full) [ 87.370221][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 87.374986][ C0] Workqueue: usb_hub_wq hub_event [ 87.377338][ C0] RIP: 0010:f_midi2_stop_eps+0x5f/0x4d0 [ 87.379842][ C0] Code: e8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 ef e8 67 e7 63 fa 41 bc 30 07 00 00 4c 03 65 00 4c 89 e0 48 c1 e8 03 48 89 44 24 10 <42> 0f b6 04 28 84 c0 0f 85 23 04 00 00 41 8b 1c 24 31 ff 89 de e8 [ 87.388121][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002 [ 87.390606][ C0] RAX: 00000000000000e6 RBX: 0000000000000001 RCX: ffff88801fc98000 [ 87.393839][ C0] RDX: 0000000000000100 RSI: 0000000000000008 RDI: ffff888011d48148 [ 87.397040][ C0] RBP: ffff888011d480f0 R08: ffff888011d4814f R09: 1ffff110023a9029 [ 87.400268][ C0] R10: dffffc0000000000 R11: ffffed10023a902a R12: 0000000000000730 [ 87.403817][ C0] R13: dffffc0000000000 R14: ffff888011d48128 R15: 0000000000000001 [ 87.407322][ C0] FS: 0000000000000000(0000) GS:ffff88808c53f000(0000) knlGS:0000000000000000 [ 87.411283][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 87.414177][ C0] CR2: 00007f8dab9970f5 CR3: 0000000012a7e000 CR4: 0000000000352ef0 [ 87.417705][ C0] Call Trace: [ 87.419187][ C0] [ 87.420405][ C0] f_midi2_set_alt+0x11c/0xf00 [ 87.422503][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 87.424818][ C0] composite_setup+0x1ffd/0x3480 [ 87.426894][ C0] configfs_composite_setup+0xc7/0x100 [ 87.429243][ C0] dummy_timer+0x2f43/0x4cf0 [ 87.431210][ C0] ? __lock_acquire+0x683/0x2cf0 [ 87.433363][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 87.435678][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 87.437716][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 87.440238][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 87.442396][ C0] __hrtimer_run_queues+0x3bc/0xa10 [ 87.444649][ C0] hrtimer_run_softirq+0x17a/0x240 [ 87.446832][ C0] handle_softirqs+0x225/0x840 [ 87.448976][ C0] ? __irq_exit_rcu+0xca/0x220 [ 87.451108][ C0] __irq_exit_rcu+0xca/0x220 [ 87.453172][ C0] irq_exit_rcu+0x9/0x30 [ 87.455027][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 87.457529][ C0] [ 87.458775][ C0] [ 87.460136][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 87.462716][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 [ 87.465478][ C0] Code: f7 e8 8d fb cc f5 f7 c3 00 02 00 00 74 05 e8 f0 f0 f8 f5 9c 58 a9 00 02 00 00 75 27 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 24 11 be f5 65 8b 05 1d a1 97 07 85 c0 74 18 5b 41 5e e9 81 48 [ 87.473494][ C0] RSP: 0018:ffffc9000e4de668 EFLAGS: 00000206 [ 87.476044][ C0] RAX: 0000000000000006 RBX: 0000000000000282 RCX: 0000000080000001 [ 87.479422][ C0] RDX: 0000000000000006 RSI: ffffffff8e231f88 RDI: 0000000000000001 [ 87.482808][ C0] RBP: 0000000000000000 R08: ffffffff9057c237 R09: 1ffffffff20af846 [ 87.486155][ C0] R10: dffffc0000000000 R11: fffffbfff20af847 R12: ffffffff81b3f470 [ 87.489446][ C0] R13: ffffc9000e4de6e0 R14: ffffffff9a9ce9f8 R15: ffffc9000e4de6e0 [ 87.492753][ C0] ? __pfx_process_timeout+0x10/0x10 [ 87.494917][ C0] timer_init_key_on_stack+0x3c/0x110 [ 87.497154][ C0] schedule_timeout+0x140/0x2c0 [ 87.499181][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 87.501438][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 87.503671][ C0] wait_for_completion_timeout+0x2cf/0x610 [ 87.506250][ C0] ? wait_for_completion_timeout+0x265/0x610 [ 87.509082][ C0] ? __pfx_wait_for_completion_timeout+0x10/0x10 [ 87.511967][ C0] usb_start_wait_urb+0x1e9/0x5b0 [ 87.514139][ C0] ? trace_kmalloc+0x2a/0xf0 [ 87.516137][ C0] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 87.518461][ C0] usb_control_msg+0x234/0x3e0 [ 87.520415][ C0] usb_set_interface+0x521/0x1470 [ 87.522596][ C0] snd_usb_midi_v2_create+0x621/0x4ac0 [ 87.524997][ C0] ? __pfx_proc_audio_usbid_read+0x10/0x10 [ 87.527524][ C0] ? snd_card_rw_proc_new+0x10d/0x140 [ 87.529847][ C0] ? __pfx_snd_usb_midi_v2_create+0x10/0x10 [ 87.532478][ C0] ? usb_ifnum_to_if+0x262/0x2f0 [ 87.534679][ C0] snd_usb_create_stream+0x262/0x630 [ 87.537049][ C0] usb_audio_probe+0x1447/0x2280 [ 87.539230][ C0] ? __pfx_usb_audio_probe+0x10/0x10 [ 87.541632][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 87.544284][ C0] usb_probe_interface+0x653/0xc60 [ 87.546449][ C0] ? __pfx_usb_probe_interface+0x10/0x10 [ 87.548865][ C0] really_probe+0x254/0xae0 [ 87.550839][ C0] __driver_probe_device+0x1e8/0x360 [ 87.553137][ C0] driver_probe_device+0x4f/0x240 [ 87.555339][ C0] __device_attach_driver+0x270/0x410 [ 87.557666][ C0] bus_for_each_drv+0x258/0x2f0 [ 87.559732][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 87.562276][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 87.564706][ C0] ? lockdep_hardirqs_on+0x7a/0x110 [ 87.567002][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 87.569557][ C0] __device_attach+0x2c4/0x450 [ 87.571723][ C0] ? __pfx___device_attach+0x10/0x10 [ 87.573804][ C0] ? do_raw_spin_unlock+0x4d/0x210 [ 87.576038][ C0] ? _raw_spin_unlock+0x28/0x50 [ 87.578161][ C0] device_initial_probe+0xa1/0xd0 [ 87.580332][ C0] bus_probe_device+0x12a/0x220 [ 87.582459][ C0] device_add+0x7d7/0xb80 [ 87.584398][ C0] usb_set_configuration+0x1ad8/0x2180 [ 87.586738][ C0] usb_generic_driver_probe+0x8d/0x150 [ 87.589067][ C0] usb_probe_device+0x1c3/0x3b0 [ 87.591195][ C0] ? __pfx_usb_probe_device+0x10/0x10 [ 87.593505][ C0] really_probe+0x254/0xae0 [ 87.595458][ C0] __driver_probe_device+0x1e8/0x360 [ 87.597644][ C0] driver_probe_device+0x4f/0x240 [ 87.599837][ C0] __device_attach_driver+0x270/0x410 [ 87.602178][ C0] bus_for_each_drv+0x258/0x2f0 [ 87.604307][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 87.606789][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 87.609006][ C0] ? lockdep_hardirqs_on+0x7a/0x110 [ 87.611153][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 87.613585][ C0] __device_attach+0x2c4/0x450 [ 87.615664][ C0] ? __pfx___device_attach+0x10/0x10 [ 87.617886][ C0] ? do_raw_spin_unlock+0x4d/0x210 [ 87.620012][ C0] ? _raw_spin_unlock+0x28/0x50 [ 87.622079][ C0] device_initial_probe+0xa1/0xd0 [ 87.624186][ C0] bus_probe_device+0x12a/0x220 [ 87.626188][ C0] device_add+0x7d7/0xb80 [ 87.627969][ C0] usb_new_device+0x99d/0x1620 [ 87.629899][ C0] ? __pfx_usb_new_device+0x10/0x10 [ 87.631904][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 87.633942][ C0] hub_event+0x28e8/0x4d30 [ 87.635857][ C0] ? do_raw_spin_unlock+0x4d/0x210 [ 87.638040][ C0] ? __pfx_hub_event+0x10/0x10 [ 87.640185][ C0] ? process_scheduled_works+0xa20/0x14e0 [ 87.642798][ C0] ? rcu_is_watching+0x15/0xb0 [ 87.644967][ C0] ? process_scheduled_works+0xa20/0x14e0 [ 87.647382][ C0] process_scheduled_works+0xa8e/0x14e0 [ 87.649729][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 87.652258][ C0] ? assign_work+0x3cf/0x5d0 [ 87.654226][ C0] worker_thread+0xa47/0xfb0 [ 87.656189][ C0] ? __kthread_parkme+0x71/0x1f0 [ 87.658243][ C0] kthread+0x388/0x470 [ 87.659975][ C0] ? __pfx_worker_thread+0x10/0x10 [ 87.662174][ C0] ? __pfx_kthread+0x10/0x10 [ 87.664118][ C0] ret_from_fork+0x514/0xb70 [ 87.666031][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 87.668208][ C0] ? __switch_to+0xc89/0x1420 [ 87.670378][ C0] ? __pfx_kthread+0x10/0x10 [ 87.672404][ C0] ret_from_fork_asm+0x1a/0x30 [ 87.674413][ C0] [ 87.675744][ C0] Modules linked in: [ 87.677348][ C0] ---[ end trace 0000000000000000 ]--- [ 87.679665][ C0] RIP: 0010:f_midi2_stop_eps+0x5f/0x4d0 [ 87.681852][ C0] Code: e8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 ef e8 67 e7 63 fa 41 bc 30 07 00 00 4c 03 65 00 4c 89 e0 48 c1 e8 03 48 89 44 24 10 <42> 0f b6 04 28 84 c0 0f 85 23 04 00 00 41 8b 1c 24 31 ff 89 de e8 [ 87.689483][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002 [ 87.691993][ C0] RAX: 00000000000000e6 RBX: 0000000000000001 RCX: ffff88801fc98000 [ 87.695260][ C0] RDX: 0000000000000100 RSI: 0000000000000008 RDI: ffff888011d48148 [ 87.698454][ C0] RBP: ffff888011d480f0 R08: ffff888011d4814f R09: 1ffff110023a9029 [ 87.701380][ C0] R10: dffffc0000000000 R11: ffffed10023a902a R12: 0000000000000730 [ 87.704618][ C0] R13: dffffc0000000000 R14: ffff888011d48128 R15: 0000000000000001 [ 87.707689][ C0] FS: 0000000000000000(0000) GS:ffff88808c53f000(0000) knlGS:0000000000000000 [ 87.711390][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 87.714013][ C0] CR2: 00007f8dab9970f5 CR3: 0000000012a7e000 CR4: 0000000000352ef0 [ 87.717111][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 87.720293][ C0] Kernel Offset: disabled [ 87.722073][ C0] Rebooting in 86400 seconds..