program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
fsopen(0x0, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
r1 = syz_open_procfs(0x0, 0x0)
lseek(r1, 0x8000000000000000, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c000000000000000000000104000000200000000500000001000004040000000100000001000000000000001800000002000004080000001300000002000000000000000100000001000000200000000076616c006270665f7370696e5f6c6f636b006c6f636b0066"], 0x0, 0x80}, 0x28)
syz_usb_control_io$lan78xx(0xffffffffffffffff, &(0x7f0000000240)={0x14, &(0x7f00000000c0)={0x40, 0x1, 0x1f, {0x1f, 0xb, "47e3655a95e4b0980d5e488647fad328b8ab0c2df3056dd5792786bf9d"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xfcff}}}, &(0x7f0000000540)={0x34, &(0x7f0000000280)={0x0, 0x15, 0x62, "4fc7728966a699c0f22d18591a5e883287bc628a166680679ecff66f57e1a38b2e17670936b01a01fa30e40b94fb9b9e675a95c8f5aa81ec587fcc1d76d9a94b281a1011dc0ea267377b38c6ba14dc51143761acbf35923650181191666b2ad829d2"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0xf}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000380)={0xc0, 0xa1, 0x4, 0x6}, &(0x7f00000003c0)={0x40, 0xa0, 0x4, 0x2}, &(0x7f0000000400)={0xc0, 0xa2, 0x2f, "c53d456566e1f9d21facc1103de4f1b9328f8f61dea794123ca89d71fe9e2ec0c9d568ec08479a8dd5d081635da6e0"}})
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/hid.usb0/no_out_endpoint\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1', 0x1)
symlinkat(&(0x7f0000000440)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r3, &(0x7f0000000500)='dummy_udc.0', 0xb)
[ 93.615253][ T5281] Bluetooth: hci0: command tx timeout
[ 93.654199][ T10] cfg80211: failed to load regulatory.db
[ 94.168134][ T1992] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 94.319504][ T1992] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.03
[ 94.321512][ T1992] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[ 94.321543][ T1992] usb 5-1: Dual-Role OTG device on HNP port
[ 94.321816][ T1992] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 94.361529][ C0] ------------[ cut here ]------------
[ 94.361547][ C0] usb_ep_enable: ep129 (ep1in-bulk) has maxpacket 0
[ 94.361561][ C0] WARNING: drivers/usb/gadget/udc/core.c:125 at usb_ep_enable+0x148/0x480, CPU#0: kworker/0:4/1992
[ 94.372911][ C0] Modules linked in:
[ 94.374774][ C0] CPU: 0 UID: 0 PID: 1992 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full)
[ 94.378793][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.383341][ C0] Workqueue: usb_hub_wq hub_event
[ 94.386062][ C0] RIP: 0010:usb_ep_enable+0x1bc/0x480
[ 94.388893][ C0] Code: 2a 8b 74 fa 49 83 3f 00 48 c7 c0 20 69 d3 8c 49 c7 c0 40 69 d3 8c 4c 0f 44 c0 4c 89 f7 48 c7 c6 a7 12 6b 8e 44 89 ea 4c 89 e1 <67> 48 0f b9 3a bd ea ff ff ff 0f 1f 44 00 00 e8 70 e3 02 fa 65 8b
[ 94.397354][ C0] RSP: 0018:ffffc90000007910 EFLAGS: 00010082
[ 94.400075][ C0] RAX: ffffffff8cd36920 RBX: ffff8880341080e0 RCX: ffffffff8cd38740
[ 94.403855][ C0] RDX: 0000000000000081 RSI: ffffffff8e6b12a7 RDI: ffffffff908865d0
[ 94.407245][ C0] RBP: dffffc0000000000 R08: ffffffff8cd36940 R09: 0000000000000002
[ 94.410671][ C0] R10: 0000000000000003 R11: 8000000000000100 R12: ffffffff8cd38740
[ 94.414220][ C0] R13: 0000000000000081 R14: ffffffff908865d0 R15: ffff8880341080f8
[ 94.417531][ C0] FS: 0000000000000000(0000) GS:ffff88808c2c0000(0000) knlGS:0000000000000000
[ 94.421301][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 94.424400][ C0] CR2: 000055956b0be3d0 CR3: 0000000012b78000 CR4: 0000000000352ef0
[ 94.428567][ C0] Call Trace:
[ 94.430307][ C0]
[ 94.431763][ C0] hidg_set_alt+0x12a/0xa60
[ 94.433704][ C0] ? usb_gadget_set_state+0x12c/0x2d0
[ 94.435878][ C0] set_config+0x749/0x1160
[ 94.437637][ C0] composite_setup+0x1de7/0x3480
[ 94.439691][ C0] configfs_composite_setup+0xc7/0x100
[ 94.441853][ C0] dummy_timer+0x2f43/0x4cf0
[ 94.443908][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 94.446203][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 94.448338][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 94.451115][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 94.453478][ C0] __hrtimer_run_queues+0x3bc/0xa10
[ 94.456075][ C0] hrtimer_run_softirq+0x1e3/0x2e0
[ 94.458454][ C0] handle_softirqs+0x226/0x860
[ 94.460576][ C0] ? __irq_exit_rcu+0xcb/0x220
[ 94.462526][ C0] __irq_exit_rcu+0xcb/0x220
[ 94.464573][ C0] irq_exit_rcu+0x9/0x30
[ 94.466543][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0
[ 94.469148][ C0]
[ 94.470476][ C0]
[ 94.471770][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 94.474337][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80
[ 94.476917][ C0] Code: f7 e8 4d 41 b9 f5 f7 c3 00 02 00 00 74 05 e8 00 9d e5 f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 b4 4e aa f5 65 48 8b 05 ec 60 ab 07 48 85 c0 74 18 5b 41 5e c3
[ 94.484657][ C0] RSP: 0018:ffffc90000b66f50 EFLAGS: 00000206
[ 94.487532][ C0] RAX: 0000000000000006 RBX: 0000000000000246 RCX: 8000000000000001
[ 94.490993][ C0] RDX: 0000000000000006 RSI: ffffffff8e418918 RDI: 0000000000000001
[ 94.494451][ C0] RBP: 0000000000000007 R08: ffffffff907a757f R09: 1ffffffff20f4eaf
[ 94.497592][ C0] R10: dffffc0000000000 R11: fffffbfff20f4eb0 R12: 0000000000000000
[ 94.501164][ C0] R13: dffffc0000000000 R14: ffff888034108000 R15: 1ffff11003f44694
[ 94.504573][ C0] dummy_urb_enqueue+0x587/0x780
[ 94.506861][ C0] usb_hcd_submit_urb+0x328/0x1b60
[ 94.509341][ C0] usb_start_wait_urb+0x13f/0x5b0
[ 94.511456][ C0] ? rcu_is_watching+0x16/0xb0
[ 94.513880][ C0] ? __pfx_usb_start_wait_urb+0x10/0x10
[ 94.516757][ C0] usb_control_msg+0x234/0x3e0
[ 94.518931][ C0] ? kfree+0x1c5/0x650
[ 94.523440][ C0] usb_set_configuration+0x12b1/0x2180
[ 94.526144][ C0] usb_generic_driver_probe+0x8d/0x150
[ 94.528491][ C0] usb_probe_device+0x1c3/0x3b0
[ 94.530588][ C0] ? __pfx_usb_probe_device+0x10/0x10
[ 94.532921][ C0] really_probe+0x254/0xae0
[ 94.535349][ C0] __driver_probe_device+0x1e8/0x360
[ 94.538226][ C0] driver_probe_device+0x4f/0x240
[ 94.541010][ C0] __device_attach_driver+0x270/0x410
[ 94.543506][ C0] bus_for_each_drv+0x258/0x2f0
[ 94.545651][ C0] ? __pfx___device_attach_driver+0x10/0x10
[ 94.548466][ C0] ? __pfx_bus_for_each_drv+0x10/0x10
[ 94.551021][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 94.553735][ C0] __device_attach+0x2c4/0x450
[ 94.555904][ C0] ? __pfx___device_attach+0x10/0x10
[ 94.558527][ C0] ? do_raw_spin_unlock+0x4d/0x200
[ 94.561216][ C0] ? _raw_spin_unlock+0x28/0x50
[ 94.563427][ C0] device_initial_probe+0xa1/0xd0
[ 94.565670][ C0] bus_probe_device+0x12a/0x220
[ 94.567873][ C0] device_add+0x7d7/0xb80
[ 94.569811][ C0] usb_new_device+0x9aa/0x1690
[ 94.571905][ C0] ? __pfx_usb_new_device+0x10/0x10
[ 94.574349][ C0] ? _raw_spin_unlock_irq+0x23/0x50
[ 94.576865][ C0] hub_event+0x28e8/0x4d30
[ 94.578850][ C0] ? do_raw_spin_unlock+0x4d/0x200
[ 94.581098][ C0] ? __pfx_hub_event+0x10/0x10
[ 94.583226][ C0] ? rcu_is_watching+0x16/0xb0
[ 94.585447][ C0] ? process_scheduled_works+0x97a/0x1630
[ 94.588286][ C0] process_scheduled_works+0xc3d/0x1630
[ 94.591027][ C0] ? __pfx_process_scheduled_works+0x10/0x10
[ 94.593792][ C0] ? assign_work+0x3cf/0x5d0
[ 94.595893][ C0] worker_thread+0xa47/0xfb0
[ 94.598011][ C0] ? __kthread_parkme+0x71/0x1f0
[ 94.600252][ C0] kthread+0x38b/0x480
[ 94.602032][ C0] ? __pfx_worker_thread+0x10/0x10
[ 94.604366][ C0] ? __pfx_kthread+0x10/0x10
[ 94.606706][ C0] ret_from_fork+0x514/0xb70
[ 94.609037][ C0] ? __pfx_ret_from_fork+0x10/0x10
[ 94.611433][ C0] ? __switch_to+0xc89/0x1420
[ 94.613526][ C0] ? __pfx_kthread+0x10/0x10
[ 94.615387][ C0] ret_from_fork_asm+0x1a/0x30
[ 94.617426][ C0]
[ 94.618828][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 94.621838][ C0] CPU: 0 UID: 0 PID: 1992 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full)
[ 94.626010][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.630879][ C0] Workqueue: usb_hub_wq hub_event
[ 94.633129][ C0] Call Trace:
[ 94.634495][ C0]
[ 94.635814][ C0] vpanic+0x56d/0xa60
[ 94.637597][ C0] ? __pfx__printk+0x10/0x10
[ 94.639572][ C0] ? __pfx_vpanic+0x10/0x10
[ 94.641567][ C0] ? is_bpf_text_address+0x292/0x2b0
[ 94.643974][ C0] ? is_bpf_text_address+0x26/0x2b0
[ 94.646359][ C0] panic+0xc5/0xd0
[ 94.648012][ C0] ? __pfx_panic+0x10/0x10
[ 94.649930][ C0] ? ret_from_fork_asm+0x1a/0x30
[ 94.651966][ C0] __warn+0x315/0x4c0
[ 94.653726][ C0] ? usb_ep_enable+0x148/0x480
[ 94.655695][ C0] ? usb_ep_enable+0x148/0x480
[ 94.657820][ C0] __report_bug+0x276/0x570
[ 94.659874][ C0] ? __driver_probe_device+0x1e8/0x360
[ 94.662371][ C0] ? driver_probe_device+0x4f/0x240
[ 94.664945][ C0] ? __device_attach_driver+0x270/0x410
[ 94.667506][ C0] ? usb_ep_enable+0x148/0x480
[ 94.669569][ C0] ? __pfx___report_bug+0x10/0x10
[ 94.671799][ C0] report_bug_entry+0x19b/0x290
[ 94.673963][ C0] ? usb_ep_enable+0x1bc/0x480
[ 94.676047][ C0] ? usb_ep_enable+0x1c1/0x480
[ 94.678129][ C0] handle_bug+0xce/0x200
[ 94.679914][ C0] exc_invalid_op+0x1a/0x50
[ 94.681943][ C0] asm_exc_invalid_op+0x1a/0x20
[ 94.684212][ C0] RIP: 0010:usb_ep_enable+0x1bc/0x480
[ 94.686707][ C0] Code: 2a 8b 74 fa 49 83 3f 00 48 c7 c0 20 69 d3 8c 49 c7 c0 40 69 d3 8c 4c 0f 44 c0 4c 89 f7 48 c7 c6 a7 12 6b 8e 44 89 ea 4c 89 e1 <67> 48 0f b9 3a bd ea ff ff ff 0f 1f 44 00 00 e8 70 e3 02 fa 65 8b
[ 94.695175][ C0] RSP: 0018:ffffc90000007910 EFLAGS: 00010082
[ 94.697821][ C0] RAX: ffffffff8cd36920 RBX: ffff8880341080e0 RCX: ffffffff8cd38740
[ 94.701114][ C0] RDX: 0000000000000081 RSI: ffffffff8e6b12a7 RDI: ffffffff908865d0
[ 94.704610][ C0] RBP: dffffc0000000000 R08: ffffffff8cd36940 R09: 0000000000000002
[ 94.708312][ C0] R10: 0000000000000003 R11: 8000000000000100 R12: ffffffff8cd38740
[ 94.711878][ C0] R13: 0000000000000081 R14: ffffffff908865d0 R15: ffff8880341080f8
[ 94.715986][ C0] hidg_set_alt+0x12a/0xa60
[ 94.718541][ C0] ? usb_gadget_set_state+0x12c/0x2d0
[ 94.720623][ C0] set_config+0x749/0x1160
[ 94.722367][ C0] composite_setup+0x1de7/0x3480
[ 94.724459][ C0] configfs_composite_setup+0xc7/0x100
[ 94.726740][ C0] dummy_timer+0x2f43/0x4cf0
[ 94.728781][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 94.731474][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 94.734349][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 94.737300][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 94.739605][ C0] __hrtimer_run_queues+0x3bc/0xa10
[ 94.741899][ C0] hrtimer_run_softirq+0x1e3/0x2e0
[ 94.744210][ C0] handle_softirqs+0x226/0x860
[ 94.746197][ C0] ? __irq_exit_rcu+0xcb/0x220
[ 94.748158][ C0] __irq_exit_rcu+0xcb/0x220
[ 94.749994][ C0] irq_exit_rcu+0x9/0x30
[ 94.751849][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0
[ 94.754446][ C0]
[ 94.755942][ C0]
[ 94.757281][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 94.759910][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80
[ 94.762731][ C0] Code: f7 e8 4d 41 b9 f5 f7 c3 00 02 00 00 74 05 e8 00 9d e5 f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 b4 4e aa f5 65 48 8b 05 ec 60 ab 07 48 85 c0 74 18 5b 41 5e c3
[ 94.771752][ C0] RSP: 0018:ffffc90000b66f50 EFLAGS: 00000206
[ 94.775089][ C0] RAX: 0000000000000006 RBX: 0000000000000246 RCX: 8000000000000001
[ 94.778696][ C0] RDX: 0000000000000006 RSI: ffffffff8e418918 RDI: 0000000000000001
[ 94.782169][ C0] RBP: 0000000000000007 R08: ffffffff907a757f R09: 1ffffffff20f4eaf
[ 94.785685][ C0] R10: dffffc0000000000 R11: fffffbfff20f4eb0 R12: 0000000000000000
[ 94.789053][ C0] R13: dffffc0000000000 R14: ffff888034108000 R15: 1ffff11003f44694
[ 94.792645][ C0] dummy_urb_enqueue+0x587/0x780
[ 94.794999][ C0] usb_hcd_submit_urb+0x328/0x1b60
[ 94.797338][ C0] usb_start_wait_urb+0x13f/0x5b0
[ 94.799672][ C0] ? rcu_is_watching+0x16/0xb0
[ 94.801833][ C0] ? __pfx_usb_start_wait_urb+0x10/0x10
[ 94.804347][ C0] usb_control_msg+0x234/0x3e0
[ 94.806555][ C0] ? kfree+0x1c5/0x650
[ 94.808595][ C0] usb_set_configuration+0x12b1/0x2180
[ 94.811374][ C0] usb_generic_driver_probe+0x8d/0x150
[ 94.814208][ C0] usb_probe_device+0x1c3/0x3b0
[ 94.816189][ C0] ? __pfx_usb_probe_device+0x10/0x10
[ 94.818313][ C0] really_probe+0x254/0xae0
[ 94.820330][ C0] __driver_probe_device+0x1e8/0x360
[ 94.822464][ C0] driver_probe_device+0x4f/0x240
[ 94.824532][ C0] __device_attach_driver+0x270/0x410
[ 94.827120][ C0] bus_for_each_drv+0x258/0x2f0
[ 94.829404][ C0] ? __pfx___device_attach_driver+0x10/0x10
[ 94.831913][ C0] ? __pfx_bus_for_each_drv+0x10/0x10
[ 94.834351][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 94.837040][ C0] __device_attach+0x2c4/0x450
[ 94.839223][ C0] ? __pfx___device_attach+0x10/0x10
[ 94.841757][ C0] ? do_raw_spin_unlock+0x4d/0x200
[ 94.844173][ C0] ? _raw_spin_unlock+0x28/0x50
[ 94.846411][ C0] device_initial_probe+0xa1/0xd0
[ 94.848650][ C0] bus_probe_device+0x12a/0x220
[ 94.850697][ C0] device_add+0x7d7/0xb80
[ 94.852547][ C0] usb_new_device+0x9aa/0x1690
[ 94.854600][ C0] ? __pfx_usb_new_device+0x10/0x10
[ 94.856792][ C0] ? _raw_spin_unlock_irq+0x23/0x50
[ 94.858904][ C0] hub_event+0x28e8/0x4d30
[ 94.860792][ C0] ? do_raw_spin_unlock+0x4d/0x200
[ 94.863226][ C0] ? __pfx_hub_event+0x10/0x10
[ 94.865711][ C0] ? rcu_is_watching+0x16/0xb0
[ 94.867804][ C0] ? process_scheduled_works+0x97a/0x1630
[ 94.869963][ C0] process_scheduled_works+0xc3d/0x1630
[ 94.874510][ C0] ? __pfx_process_scheduled_works+0x10/0x10
[ 94.877410][ C0] ? assign_work+0x3cf/0x5d0
[ 94.879430][ C0] worker_thread+0xa47/0xfb0
[ 94.881367][ C0] ? __kthread_parkme+0x71/0x1f0
[ 94.883578][ C0] kthread+0x38b/0x480
[ 94.885532][ C0] ? __pfx_worker_thread+0x10/0x10
[ 94.887853][ C0] ? __pfx_kthread+0x10/0x10
[ 94.890056][ C0] ret_from_fork+0x514/0xb70
[ 94.892217][ C0] ? __pfx_ret_from_fork+0x10/0x10
[ 94.894535][ C0] ? __switch_to+0xc89/0x1420
[ 94.896964][ C0] ? __pfx_kthread+0x10/0x10
[ 94.899429][ C0] ret_from_fork_asm+0x1a/0x30
[ 94.902288][ C0]
[ 94.905027][ C0] Kernel Offset: disabled
[ 94.907717][ C0] Rebooting in 86400 seconds..