program: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000140)='status\x00') preadv(r1, &(0x7f0000000a80)=[{&(0x7f00000021c0)=""/4096, 0x1000}], 0x1, 0x4, 0xfff) sendto$unix(r1, &(0x7f0000000180)="ea5e5ee99786f74187d223906be9c8888e7ce4dbcef955dd683af67a53d048d0b2ccea57dde55496423295e00357a76d5cad0b257c316127b2ad3baabcc03cc825468f6fefa869e40f70af4f934c13b0039156d93856", 0x56, 0x4004001, &(0x7f0000000240)=@abs={0x0, 0x0, 0x4e24}, 0x6e) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'vxcan1\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x44, 0x24, 0xf0b, 0x70bd26, 0x2, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x5, 0x0, 0x8}}]}}]}, 0x44}}, 0x30000000) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$inet_udp(0x2, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) r7 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/direction\x00', 0x1, 0x0) write(r7, &(0x7f0000000600)='2', 0x1) symlinkat(&(0x7f0000000880)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000008c0)='./my_configfs/usb_gadget/g1/configs/c.1/midi2.usb0\x00') r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./my_configfs/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r8, &(0x7f0000000940)='dummy_udc.0', 0xb) close(r6) socket$nl_route(0x10, 0x3, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="364000002600913e"], 0xfe33) write$binfmt_misc(r5, &(0x7f0000000000), 0xfffffecc) splice(r4, 0x0, r6, 0x0, 0x4ffe6, 0x0) [ 94.823650][ T5322] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.0'. [ 94.834972][ T45] Bluetooth: hci0: command tx timeout [ 95.114715][ T1359] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 95.265485][ T1359] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.02 [ 95.271129][ T1359] usb 5-1: Dual-Role OTG device on HNP port [ 95.274291][ T1359] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.305316][ T1359] gspca_main: spca501-2.14.0 probing 0000:0000 [ 95.312905][ T1359] gspca_spca501: reg write: error -32 [ 95.316367][ T1359] spca501 5-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 95.319539][ T1359] spca501 5-1:1.0: probe with driver spca501 failed with error -22 [ 95.329691][ C0] Oops: general protection fault, probably for non-canonical address 0xdffffc00000000e6: 0000 [#1] SMP KASAN NOPTI [ 95.334712][ C0] KASAN: null-ptr-deref in range [0x0000000000000730-0x0000000000000737] [ 95.338168][ C0] CPU: 0 UID: 0 PID: 1359 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(full) [ 95.342376][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.346325][ C0] Workqueue: usb_hub_wq hub_event [ 95.348379][ C0] RIP: 0010:f_midi2_stop_eps+0x5f/0x4d0 [ 95.350508][ C0] Code: e8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 ef e8 77 4b 61 fa 41 bc 30 07 00 00 4c 03 65 00 4c 89 e0 48 c1 e8 03 48 89 44 24 10 <42> 0f b6 04 28 84 c0 0f 85 23 04 00 00 41 8b 1c 24 31 ff 89 de e8 [ 95.358109][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002 [ 95.360715][ C0] RAX: 00000000000000e6 RBX: 0000000000000001 RCX: ffff88803412a580 [ 95.363938][ C0] RDX: 0000000000000100 RSI: 0000000000000100 RDI: ffff888052cf8148 [ 95.367024][ C0] RBP: ffff888052cf80f0 R08: ffff888052cf814f R09: 1ffff1100a59f029 [ 95.370143][ C0] R10: dffffc0000000000 R11: ffffed100a59f02a R12: 0000000000000730 [ 95.373181][ C0] R13: dffffc0000000000 R14: ffff888052cf8128 R15: 0000000000000001 [ 95.376240][ C0] FS: 0000000000000000(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000 [ 95.379971][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.382878][ C0] CR2: 00007f32a36760f5 CR3: 0000000052b9f000 CR4: 0000000000352ef0 [ 95.386333][ C0] Call Trace: [ 95.387930][ C0] [ 95.389163][ C0] f_midi2_set_alt+0x11c/0xf00 [ 95.391215][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 95.393361][ C0] composite_setup+0x1ffd/0x3480 [ 95.395306][ C0] configfs_composite_setup+0xc7/0x100 [ 95.397543][ C0] dummy_timer+0x2f43/0x4cf0 [ 95.399465][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 95.401606][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 95.403372][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 95.405501][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 95.407342][ C0] __hrtimer_run_queues+0x3bc/0xa10 [ 95.409159][ C0] hrtimer_run_softirq+0x1e3/0x2e0 [ 95.411197][ C0] handle_softirqs+0x226/0x860 [ 95.413142][ C0] ? __irq_exit_rcu+0xcb/0x220 [ 95.415237][ C0] __irq_exit_rcu+0xcb/0x220 [ 95.417282][ C0] irq_exit_rcu+0x9/0x30 [ 95.419061][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 95.421524][ C0] [ 95.422827][ C0] [ 95.424060][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 95.426954][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 [ 95.429735][ C0] Code: f7 e8 ad b6 c2 f5 f7 c3 00 02 00 00 74 05 e8 b0 e7 ee f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 b4 d6 b3 f5 65 48 8b 05 2c ce b0 07 48 85 c0 74 18 5b 41 5e c3 [ 95.437767][ C0] RSP: 0018:ffffc900021667d0 EFLAGS: 00000206 [ 95.440479][ C0] RAX: 0000000000000006 RBX: 0000000000000246 RCX: 8000000000000001 [ 95.443841][ C0] RDX: 0000000000000006 RSI: ffffffff8e460b06 RDI: 0000000000000001 [ 95.447143][ C0] RBP: 0000000000000007 R08: ffffffff9078fa37 R09: 1ffffffff20f1f46 [ 95.450591][ C0] R10: dffffc0000000000 R11: fffffbfff20f1f47 R12: 0000000000000000 [ 95.453834][ C0] R13: dffffc0000000000 R14: ffff8880344d4000 R15: 1ffff110068d5894 [ 95.457346][ C0] dummy_urb_enqueue+0x587/0x780 [ 95.459527][ C0] usb_hcd_submit_urb+0x328/0x1b60 [ 95.461775][ C0] usb_start_wait_urb+0x13f/0x5b0 [ 95.463949][ C0] ? trace_kmalloc+0x2a/0xf0 [ 95.465943][ C0] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 95.468358][ C0] usb_control_msg+0x234/0x3e0 [ 95.470447][ C0] usb_set_interface+0x521/0x1470 [ 95.472690][ C0] snd_usb_midi_v2_create+0x621/0x4ac0 [ 95.475112][ C0] ? __pfx_proc_audio_usbid_read+0x10/0x10 [ 95.477655][ C0] ? snd_card_rw_proc_new+0x10d/0x140 [ 95.479984][ C0] ? __pfx_snd_usb_midi_v2_create+0x10/0x10 [ 95.482533][ C0] ? usb_ifnum_to_if+0x262/0x2f0 [ 95.484560][ C0] snd_usb_create_stream+0x262/0x630 [ 95.486829][ C0] usb_audio_probe+0x144c/0x2240 [ 95.488930][ C0] ? __pfx_usb_audio_probe+0x10/0x10 [ 95.491173][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 95.493802][ C0] usb_probe_interface+0x653/0xc60 [ 95.496058][ C0] ? __pfx_usb_probe_interface+0x10/0x10 [ 95.498547][ C0] really_probe+0x254/0xae0 [ 95.500609][ C0] __driver_probe_device+0x1e8/0x360 [ 95.502821][ C0] driver_probe_device+0x4f/0x240 [ 95.505031][ C0] __device_attach_driver+0x270/0x410 [ 95.507419][ C0] bus_for_each_drv+0x258/0x2f0 [ 95.509471][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 95.511936][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 95.514185][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 95.517372][ C0] __device_attach+0x2c4/0x450 [ 95.519963][ C0] ? __pfx___device_attach+0x10/0x10 [ 95.522435][ C0] ? do_raw_spin_unlock+0x4d/0x200 [ 95.524586][ C0] ? _raw_spin_unlock+0x28/0x50 [ 95.526679][ C0] device_initial_probe+0xa1/0xd0 [ 95.529068][ C0] bus_probe_device+0x12a/0x220 [ 95.531180][ C0] device_add+0x7d7/0xb80 [ 95.532996][ C0] usb_set_configuration+0x1ad8/0x2180 [ 95.535365][ C0] usb_generic_driver_probe+0x8d/0x150 [ 95.537791][ C0] usb_probe_device+0x1c3/0x3b0 [ 95.539558][ C0] ? __pfx_usb_probe_device+0x10/0x10 [ 95.541437][ C0] really_probe+0x254/0xae0 [ 95.543124][ C0] __driver_probe_device+0x1e8/0x360 [ 95.545093][ C0] driver_probe_device+0x4f/0x240 [ 95.547169][ C0] __device_attach_driver+0x270/0x410 [ 95.549518][ C0] bus_for_each_drv+0x258/0x2f0 [ 95.551567][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 95.554081][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 95.556452][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 95.558874][ C0] __device_attach+0x2c4/0x450 [ 95.560991][ C0] ? __pfx___device_attach+0x10/0x10 [ 95.563275][ C0] ? do_raw_spin_unlock+0x4d/0x200 [ 95.565507][ C0] ? _raw_spin_unlock+0x28/0x50 [ 95.567629][ C0] device_initial_probe+0xa1/0xd0 [ 95.569841][ C0] bus_probe_device+0x12a/0x220 [ 95.571952][ C0] device_add+0x7d7/0xb80 [ 95.573832][ C0] usb_new_device+0x9aa/0x1690 [ 95.575736][ C0] ? __pfx_usb_new_device+0x10/0x10 [ 95.577653][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 95.579795][ C0] hub_event+0x28e8/0x4d30 [ 95.581652][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 95.584171][ C0] ? __pfx_hub_event+0x10/0x10 [ 95.586256][ C0] ? process_scheduled_works+0x97a/0x1630 [ 95.588753][ C0] ? rcu_is_watching+0x16/0xb0 [ 95.590843][ C0] ? process_scheduled_works+0x97a/0x1630 [ 95.593325][ C0] process_scheduled_works+0xc3d/0x1630 [ 95.595708][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 95.598288][ C0] ? assign_work+0x3cf/0x5d0 [ 95.600253][ C0] worker_thread+0xa47/0xfb0 [ 95.602174][ C0] kthread+0x38b/0x480 [ 95.603890][ C0] ? __pfx_worker_thread+0x10/0x10 [ 95.606226][ C0] ? __pfx_kthread+0x10/0x10 [ 95.608295][ C0] ret_from_fork+0x514/0xb70 [ 95.610111][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 95.612185][ C0] ? __switch_to+0xc89/0x1420 [ 95.614095][ C0] ? __pfx_kthread+0x10/0x10 [ 95.615959][ C0] ret_from_fork_asm+0x1a/0x30 [ 95.617913][ C0] [ 95.619171][ C0] Modules linked in: [ 95.621456][ C0] ---[ end trace 0000000000000000 ]--- [ 95.623767][ C0] RIP: 0010:f_midi2_stop_eps+0x5f/0x4d0 [ 95.626135][ C0] Code: e8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 ef e8 77 4b 61 fa 41 bc 30 07 00 00 4c 03 65 00 4c 89 e0 48 c1 e8 03 48 89 44 24 10 <42> 0f b6 04 28 84 c0 0f 85 23 04 00 00 41 8b 1c 24 31 ff 89 de e8 [ 95.633965][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002 [ 95.636607][ C0] RAX: 00000000000000e6 RBX: 0000000000000001 RCX: ffff88803412a580 [ 95.639919][ C0] RDX: 0000000000000100 RSI: 0000000000000100 RDI: ffff888052cf8148 [ 95.643072][ C0] RBP: ffff888052cf80f0 R08: ffff888052cf814f R09: 1ffff1100a59f029 [ 95.646282][ C0] R10: dffffc0000000000 R11: ffffed100a59f02a R12: 0000000000000730 [ 95.649313][ C0] R13: dffffc0000000000 R14: ffff888052cf8128 R15: 0000000000000001 [ 95.652514][ C0] FS: 0000000000000000(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000 [ 95.656610][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.660102][ C0] CR2: 00007f32a36760f5 CR3: 0000000052b9f000 CR4: 0000000000352ef0 [ 95.663962][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 95.667553][ C0] Kernel Offset: disabled [ 95.669443][ C0] Rebooting in 86400 seconds..