program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0x1d6b\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/bcdUSB\x00', 0x1, 0x0)
write(r2, 0x0, 0x0)
write(r0, &(0x7f0000000b40)="a75f3e8763810fb65db27b093ce625d61034fd6f81992cbace7584a0463a17a53bd51219be4c462a52591512f0901461910a999bff9cac267b67b04c786921a9b7730ccc20ca181bdcfd994246f794823814ba667bdd9f2fd0f25ee266", 0x5d)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000380)='0123456789\n', 0xb)
write(0xffffffffffffffff, &(0x7f0000000400)='syzkaller\n', 0xa)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/strings/0x409/product\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='HID Gadget\n', 0xb)
mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/hid.usb0/no_out_endpoint\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f0000000840)='8\n', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000880)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x1, 0x0)
symlinkat(&(0x7f0000000900)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000980)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r4, &(0x7f0000000a40)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f0000000b00)={0x0, 0x1dcd6500}, 0x0)
syz_open_dev$hidraw(&(0x7f0000000c00), 0x0, 0x2)

[   76.605620][ T1331] ieee802154 phy0 wpan0: encryption failed: -22
[   76.605675][ T1331] ieee802154 phy1 wpan1: encryption failed: -22
[   76.846699][ T5280] Bluetooth: hci0: command tx timeout
[   76.956550][    T9] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[   77.128096][    T9] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0000, bcdDevice= 7.03
[   77.129790][    T9] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[   77.129809][    T9] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0
[   77.131135][    T9] usb 5-1: Dual-Role OTG device on HNP port
[   77.131395][    T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   77.131406][    T9] usb 5-1: Product: HID Gadget
[   77.137219][    C0] ------------[ cut here ]------------
[   77.137228][    C0] usb_ep_enable: ep129 (ep1in-bulk) has maxpacket 0
[   77.137250][    C0] WARNING: drivers/usb/gadget/udc/core.c:125 at usb_ep_enable+0x148/0x480, CPU#0: kworker/0:0/9
[   77.167250][    C0] Modules linked in:
[   77.168824][    C0] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full) 
[   77.172486][    C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   77.176252][    C0] Workqueue: usb_hub_wq hub_event
[   77.178280][    C0] RIP: 0010:usb_ep_enable+0x1bc/0x480
[   77.180473][    C0] Code: ca 84 74 fa 49 83 3f 00 48 c7 c0 20 69 d3 8c 49 c7 c0 40 69 d3 8c 4c 0f 44 c0 4c 89 f7 48 c7 c6 71 19 6b 8e 44 89 ea 4c 89 e1 <67> 48 0f b9 3a bd ea ff ff ff 0f 1f 44 00 00 e8 f0 dc 02 fa 65 8b
[   77.188749][    C0] RSP: 0018:ffffc90000007910 EFLAGS: 00010082
[   77.191357][    C0] RAX: ffffffff8cd36920 RBX: ffff88803483c0e0 RCX: ffffffff8cd38740
[   77.196976][    C0] RDX: 0000000000000081 RSI: ffffffff8e6b1971 RDI: ffffffff908866d0
[   77.200538][    C0] RBP: dffffc0000000000 R08: ffffffff8cd36940 R09: 0000000000000002
[   77.203970][    C0] R10: 0000000000000003 R11: 0000000000000100 R12: ffffffff8cd38740
[   77.207330][    C0] R13: 0000000000000081 R14: ffffffff908866d0 R15: ffff88803483c0f8
[   77.210664][    C0] FS:  0000000000000000(0000) GS:ffff88808c2c0000(0000) knlGS:0000000000000000
[   77.214418][    C0] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   77.217207][    C0] CR2: 00007f937e187780 CR3: 0000000043e5f000 CR4: 0000000000352ef0
[   77.220625][    C0] Call Trace:
[   77.222332][    C0]  <IRQ>
[   77.223595][    C0]  hidg_set_alt+0x12a/0xa60
[   77.225610][    C0]  ? usb_gadget_set_state+0x12c/0x2d0
[   77.227970][    C0]  set_config+0x749/0x1160
[   77.229904][    C0]  composite_setup+0x1de7/0x3480
[   77.232060][    C0]  configfs_composite_setup+0xc7/0x100
[   77.234364][    C0]  dummy_timer+0x2f43/0x4cf0
[   77.236377][    C0]  ? call_timer_fn+0xd5/0x5f0
[   77.238461][    C0]  ? __pfx_do_raw_spin_lock+0x10/0x10
[   77.240788][    C0]  ? __pfx_dummy_timer+0x10/0x10
[   77.242883][    C0]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[   77.245419][    C0]  ? __pfx_dummy_timer+0x10/0x10
[   77.247541][    C0]  __hrtimer_run_queues+0x3bc/0xa10
[   77.249657][    C0]  hrtimer_run_softirq+0x1e3/0x2e0
[   77.252234][    C0]  handle_softirqs+0x226/0x860
[   77.254182][    C0]  ? __irq_exit_rcu+0xcb/0x220
[   77.256195][    C0]  __irq_exit_rcu+0xcb/0x220
[   77.258029][    C0]  irq_exit_rcu+0x9/0x30
[   77.259689][    C0]  sysvec_apic_timer_interrupt+0xa6/0xc0
[   77.261883][    C0]  </IRQ>
[   77.263153][    C0]  <TASK>
[   77.264540][    C0]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
[   77.267265][    C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80
[   77.269947][    C0] Code: f7 e8 4d 31 b9 f5 f7 c3 00 02 00 00 74 05 e8 00 8d e5 f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 <e8> b4 3e aa f5 65 48 8b 05 ec 50 ab 07 48 85 c0 74 18 5b 41 5e c3
[   77.278046][    C0] RSP: 0018:ffffc9000022ef50 EFLAGS: 00000206
[   77.280673][    C0] RAX: 0000000000000002 RBX: 0000000000000246 RCX: 8000000000000001
[   77.284424][    C0] RDX: 0000000000000006 RSI: ffffffff8e4189c4 RDI: 0000000000000001
[   77.288019][    C0] RBP: 0000000000000007 R08: ffffffff907a767f R09: 1ffffffff20f4ecf
[   77.291416][    C0] R10: dffffc0000000000 R11: fffffbfff20f4ed0 R12: 0000000000000000
[   77.294848][    C0] R13: dffffc0000000000 R14: ffff88803483c000 R15: 1ffff11006dd2094
[   77.298382][    C0]  dummy_urb_enqueue+0x587/0x780
[   77.300632][    C0]  usb_hcd_submit_urb+0x328/0x1b60
[   77.302976][    C0]  usb_start_wait_urb+0x13f/0x5b0
[   77.305360][    C0]  ? rcu_is_watching+0x16/0xb0
[   77.307461][    C0]  ? __pfx_usb_start_wait_urb+0x10/0x10
[   77.309886][    C0]  usb_control_msg+0x234/0x3e0
[   77.311899][    C0]  ? kfree+0x1c5/0x650
[   77.313754][    C0]  usb_set_configuration+0x12b1/0x2180
[   77.316571][    C0]  usb_generic_driver_probe+0x8d/0x150
[   77.318911][    C0]  usb_probe_device+0x1c3/0x3b0
[   77.321032][    C0]  ? __pfx_usb_probe_device+0x10/0x10
[   77.323377][    C0]  really_probe+0x254/0xae0
[   77.325452][    C0]  __driver_probe_device+0x1e8/0x360
[   77.327708][    C0]  driver_probe_device+0x4f/0x240
[   77.329828][    C0]  __device_attach_driver+0x270/0x410
[   77.332140][    C0]  bus_for_each_drv+0x258/0x2f0
[   77.334302][    C0]  ? __pfx___device_attach_driver+0x10/0x10
[   77.336831][    C0]  ? __pfx_bus_for_each_drv+0x10/0x10
[   77.339172][    C0]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[   77.341649][    C0]  __device_attach+0x2c4/0x450
[   77.343788][    C0]  ? __pfx___device_attach+0x10/0x10
[   77.346071][    C0]  ? do_raw_spin_unlock+0x4d/0x200
[   77.348752][    C0]  ? _raw_spin_unlock+0x28/0x50
[   77.350632][    C0]  device_initial_probe+0xa1/0xd0
[   77.352718][    C0]  bus_probe_device+0x12a/0x220
[   77.354737][    C0]  device_add+0x7d7/0xb80
[   77.356683][    C0]  usb_new_device+0x9aa/0x1690
[   77.358607][    C0]  ? __pfx_usb_new_device+0x10/0x10
[   77.360894][    C0]  ? _raw_spin_unlock_irq+0x23/0x50
[   77.363179][    C0]  hub_event+0x28e8/0x4d30
[   77.365166][    C0]  ? __pfx_hub_event+0x10/0x10
[   77.367224][    C0]  ? rcu_is_watching+0x16/0xb0
[   77.369236][    C0]  ? process_scheduled_works+0x97a/0x1630
[   77.371653][    C0]  process_scheduled_works+0xc3d/0x1630
[   77.374143][    C0]  ? __pfx_process_scheduled_works+0x10/0x10
[   77.376617][    C0]  ? assign_work+0x3cf/0x5d0
[   77.378585][    C0]  worker_thread+0xa47/0xfb0
[   77.380570][    C0]  kthread+0x38b/0x480
[   77.382811][    C0]  ? __pfx_worker_thread+0x10/0x10
[   77.385031][    C0]  ? __pfx_kthread+0x10/0x10
[   77.386993][    C0]  ret_from_fork+0x514/0xb70
[   77.388987][    C0]  ? __pfx_ret_from_fork+0x10/0x10
[   77.391275][    C0]  ? __switch_to+0xc89/0x1420
[   77.393321][    C0]  ? __pfx_kthread+0x10/0x10
[   77.395274][    C0]  ret_from_fork_asm+0x1a/0x30
[   77.397313][    C0]  </TASK>
[   77.398666][    C0] Kernel panic - not syncing: kernel: panic_on_warn set ...
[   77.401723][    C0] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full) 
[   77.405569][    C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   77.409749][    C0] Workqueue: usb_hub_wq hub_event
[   77.411928][    C0] Call Trace:
[   77.413402][    C0]  <IRQ>
[   77.414655][    C0]  vpanic+0x56d/0xa60
[   77.416328][    C0]  ? __pfx__printk+0x10/0x10
[   77.418743][    C0]  ? __pfx_vpanic+0x10/0x10
[   77.420794][    C0]  ? is_bpf_text_address+0x292/0x2b0
[   77.423082][    C0]  ? is_bpf_text_address+0x26/0x2b0
[   77.425409][    C0]  panic+0xc5/0xd0
[   77.427106][    C0]  ? __pfx_panic+0x10/0x10
[   77.429060][    C0]  ? ret_from_fork_asm+0x1a/0x30
[   77.431240][    C0]  __warn+0x315/0x4c0
[   77.433065][    C0]  ? usb_ep_enable+0x148/0x480
[   77.435189][    C0]  ? usb_ep_enable+0x148/0x480
[   77.437216][    C0]  __report_bug+0x276/0x570
[   77.439124][    C0]  ? __driver_probe_device+0x1e8/0x360
[   77.441508][    C0]  ? driver_probe_device+0x4f/0x240
[   77.443802][    C0]  ? __device_attach_driver+0x270/0x410
[   77.446170][    C0]  ? usb_ep_enable+0x148/0x480
[   77.448252][    C0]  ? __pfx___report_bug+0x10/0x10
[   77.450466][    C0]  report_bug_entry+0x19b/0x290
[   77.452583][    C0]  ? usb_ep_enable+0x1bc/0x480
[   77.456044][    C0]  ? usb_ep_enable+0x1c1/0x480
[   77.458208][    C0]  handle_bug+0xce/0x200
[   77.460109][    C0]  exc_invalid_op+0x1a/0x50
[   77.462049][    C0]  asm_exc_invalid_op+0x1a/0x20
[   77.464230][    C0] RIP: 0010:usb_ep_enable+0x1bc/0x480
[   77.466543][    C0] Code: ca 84 74 fa 49 83 3f 00 48 c7 c0 20 69 d3 8c 49 c7 c0 40 69 d3 8c 4c 0f 44 c0 4c 89 f7 48 c7 c6 71 19 6b 8e 44 89 ea 4c 89 e1 <67> 48 0f b9 3a bd ea ff ff ff 0f 1f 44 00 00 e8 f0 dc 02 fa 65 8b
[   77.474646][    C0] RSP: 0018:ffffc90000007910 EFLAGS: 00010082
[   77.477600][    C0] RAX: ffffffff8cd36920 RBX: ffff88803483c0e0 RCX: ffffffff8cd38740
[   77.481410][    C0] RDX: 0000000000000081 RSI: ffffffff8e6b1971 RDI: ffffffff908866d0
[   77.484810][    C0] RBP: dffffc0000000000 R08: ffffffff8cd36940 R09: 0000000000000002
[   77.488105][    C0] R10: 0000000000000003 R11: 0000000000000100 R12: ffffffff8cd38740
[   77.492271][    C0] R13: 0000000000000081 R14: ffffffff908866d0 R15: ffff88803483c0f8
[   77.495761][    C0]  hidg_set_alt+0x12a/0xa60
[   77.497793][    C0]  ? usb_gadget_set_state+0x12c/0x2d0
[   77.500108][    C0]  set_config+0x749/0x1160
[   77.502029][    C0]  composite_setup+0x1de7/0x3480
[   77.504160][    C0]  configfs_composite_setup+0xc7/0x100
[   77.506474][    C0]  dummy_timer+0x2f43/0x4cf0
[   77.508507][    C0]  ? call_timer_fn+0xd5/0x5f0
[   77.510496][    C0]  ? __pfx_do_raw_spin_lock+0x10/0x10
[   77.512899][    C0]  ? __pfx_dummy_timer+0x10/0x10
[   77.515186][    C0]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[   77.517739][    C0]  ? __pfx_dummy_timer+0x10/0x10
[   77.519980][    C0]  __hrtimer_run_queues+0x3bc/0xa10
[   77.522294][    C0]  hrtimer_run_softirq+0x1e3/0x2e0
[   77.524598][    C0]  handle_softirqs+0x226/0x860
[   77.526673][    C0]  ? __irq_exit_rcu+0xcb/0x220
[   77.529148][    C0]  __irq_exit_rcu+0xcb/0x220
[   77.531257][    C0]  irq_exit_rcu+0x9/0x30
[   77.533115][    C0]  sysvec_apic_timer_interrupt+0xa6/0xc0
[   77.535497][    C0]  </IRQ>
[   77.536773][    C0]  <TASK>
[   77.538087][    C0]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
[   77.540601][    C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80
[   77.543305][    C0] Code: f7 e8 4d 31 b9 f5 f7 c3 00 02 00 00 74 05 e8 00 8d e5 f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 <e8> b4 3e aa f5 65 48 8b 05 ec 50 ab 07 48 85 c0 74 18 5b 41 5e c3
[   77.551507][    C0] RSP: 0018:ffffc9000022ef50 EFLAGS: 00000206
[   77.554017][    C0] RAX: 0000000000000002 RBX: 0000000000000246 RCX: 8000000000000001
[   77.557200][    C0] RDX: 0000000000000006 RSI: ffffffff8e4189c4 RDI: 0000000000000001
[   77.560335][    C0] RBP: 0000000000000007 R08: ffffffff907a767f R09: 1ffffffff20f4ecf
[   77.563563][    C0] R10: dffffc0000000000 R11: fffffbfff20f4ed0 R12: 0000000000000000
[   77.566801][    C0] R13: dffffc0000000000 R14: ffff88803483c000 R15: 1ffff11006dd2094
[   77.570633][    C0]  dummy_urb_enqueue+0x587/0x780
[   77.572746][    C0]  usb_hcd_submit_urb+0x328/0x1b60
[   77.574976][    C0]  usb_start_wait_urb+0x13f/0x5b0
[   77.577152][    C0]  ? rcu_is_watching+0x16/0xb0
[   77.579143][    C0]  ? __pfx_usb_start_wait_urb+0x10/0x10
[   77.581519][    C0]  usb_control_msg+0x234/0x3e0
[   77.583654][    C0]  ? kfree+0x1c5/0x650
[   77.585507][    C0]  usb_set_configuration+0x12b1/0x2180
[   77.587920][    C0]  usb_generic_driver_probe+0x8d/0x150
[   77.590206][    C0]  usb_probe_device+0x1c3/0x3b0
[   77.592218][    C0]  ? __pfx_usb_probe_device+0x10/0x10
[   77.594935][    C0]  really_probe+0x254/0xae0
[   77.597040][    C0]  __driver_probe_device+0x1e8/0x360
[   77.599337][    C0]  driver_probe_device+0x4f/0x240
[   77.601595][    C0]  __device_attach_driver+0x270/0x410
[   77.604000][    C0]  bus_for_each_drv+0x258/0x2f0
[   77.606187][    C0]  ? __pfx___device_attach_driver+0x10/0x10
[   77.609335][    C0]  ? __pfx_bus_for_each_drv+0x10/0x10
[   77.613890][    C0]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[   77.616451][    C0]  __device_attach+0x2c4/0x450
[   77.618542][    C0]  ? __pfx___device_attach+0x10/0x10
[   77.620832][    C0]  ? do_raw_spin_unlock+0x4d/0x200
[   77.623155][    C0]  ? _raw_spin_unlock+0x28/0x50
[   77.625225][    C0]  device_initial_probe+0xa1/0xd0
[   77.627454][    C0]  bus_probe_device+0x12a/0x220
[   77.629563][    C0]  device_add+0x7d7/0xb80
[   77.631399][    C0]  usb_new_device+0x9aa/0x1690
[   77.633371][    C0]  ? __pfx_usb_new_device+0x10/0x10
[   77.635591][    C0]  ? _raw_spin_unlock_irq+0x23/0x50
[   77.637831][    C0]  hub_event+0x28e8/0x4d30
[   77.639756][    C0]  ? __pfx_hub_event+0x10/0x10
[   77.641808][    C0]  ? rcu_is_watching+0x16/0xb0
[   77.643868][    C0]  ? process_scheduled_works+0x97a/0x1630
[   77.646322][    C0]  process_scheduled_works+0xc3d/0x1630
[   77.649184][    C0]  ? __pfx_process_scheduled_works+0x10/0x10
[   77.651720][    C0]  ? assign_work+0x3cf/0x5d0
[   77.653760][    C0]  worker_thread+0xa47/0xfb0
[   77.655797][    C0]  kthread+0x38b/0x480
[   77.657475][    C0]  ? __pfx_worker_thread+0x10/0x10
[   77.659478][    C0]  ? __pfx_kthread+0x10/0x10
[   77.661444][    C0]  ret_from_fork+0x514/0xb70
[   77.663583][    C0]  ? __pfx_ret_from_fork+0x10/0x10
[   77.665805][    C0]  ? __switch_to+0xc89/0x1420
[   77.667789][    C0]  ? __pfx_kthread+0x10/0x10
[   77.669776][    C0]  ret_from_fork_asm+0x1a/0x30
[   77.671850][    C0]  </TASK>
[   77.673594][    C0] Kernel Offset: disabled
[   77.675429][    C0] Rebooting in 86400 seconds..