program: socket$pptp(0x18, 0x1, 0x2) r0 = socket$pptp(0x18, 0x1, 0x2) fadvise64(r0, 0xfffffffffffffffa, 0x8, 0xffc1be0bd1539102) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000640)=ANY=[@ANYBLOB="0001000016000100000000000000000000000000000000000000000000000000ffffffff0000000000000000000000004e200000000000000000a00000000000", @ANYRES8=r0, @ANYRES32, @ANYBLOB="ac1414aa0000000000000000000000000000000033000000ac1414bb00000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000002000000000000000000000000000000001000000000000000000000000000000000000001000000000000000a"], 0x100}}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="4401000010000100feffffbf000100000000000000000000000000000000000020010000000000000000000000000001000103944e230005000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c000000ac1414bb000000000000000000000000000000000000000009000000000000000600000000000000ffff0000000000001c250800000000000200000000000000f8ffffffffffffff0000000000000000060000000000050000000000000000001f00000000000000fd0100000000000002000000fcffffff000000002abd7000043500000a0001fd2000000000000000480003006465666c617465"], 0x144}, 0x1, 0x0, 0x0, 0x8801}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/direction\x00', 0x1, 0x0) write(r3, &(0x7f0000000600)='2', 0x1) symlinkat(&(0x7f0000000880)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000008c0)='./my_configfs/usb_gadget/g1/configs/c.1/midi2.usb0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./my_configfs/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000000940)='dummy_udc.0', 0xb) syz_usb_connect$hid(0x3, 0x0, 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="2000000011000101000000000000000000000600", @ANYRES32=r7, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x20}}, 0x20008802) r8 = inotify_init1(0x800) r9 = inotify_add_watch(r8, &(0x7f0000000100)='./cgroup\x00', 0x11000041) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x19) r10 = syz_open_procfs(0x0, &(0x7f0000000380)='clear_refs\x00') writev(r10, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) inotify_rm_watch(r8, r9) read(r8, &(0x7f0000000140)=""/115, 0x29) [ 94.087403][ T45] Bluetooth: hci0: command tx timeout [ 94.178055][ T5317] netlink: 8 bytes leftover after parsing attributes in process `syz.0.0'. [ 94.202794][ T5317] netlink: 12 bytes leftover after parsing attributes in process `syz.0.0'. [ 94.778578][ T5067] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 94.951438][ T5067] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.02 [ 94.958034][ T5067] usb 5-1: Dual-Role OTG device on HNP port [ 94.961278][ T5067] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 94.991776][ T5067] gspca_main: spca501-2.14.0 probing 0000:0000 [ 95.001073][ T5067] gspca_spca501: reg write: error -32 [ 95.005352][ T5067] spca501 5-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 95.015355][ T5067] spca501 5-1:1.0: probe with driver spca501 failed with error -22 [ 95.026063][ C0] Oops: general protection fault, probably for non-canonical address 0xdffffc00000000e6: 0000 [#1] SMP KASAN NOPTI [ 95.030575][ C0] KASAN: null-ptr-deref in range [0x0000000000000730-0x0000000000000737] [ 95.033962][ C0] CPU: 0 UID: 0 PID: 5067 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full) [ 95.037931][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.042402][ C0] Workqueue: usb_hub_wq hub_event [ 95.044668][ C0] RIP: 0010:f_midi2_stop_eps+0x5f/0x4d0 [ 95.046954][ C0] Code: e8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 ef e8 77 4b 61 fa 41 bc 30 07 00 00 4c 03 65 00 4c 89 e0 48 c1 e8 03 48 89 44 24 10 <42> 0f b6 04 28 84 c0 0f 85 23 04 00 00 41 8b 1c 24 31 ff 89 de e8 [ 95.055061][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002 [ 95.058125][ C0] RAX: 00000000000000e6 RBX: 0000000000000001 RCX: ffff8880002c8000 [ 95.061668][ C0] RDX: 0000000000000100 RSI: 0000000000000100 RDI: ffff88805299c148 [ 95.065266][ C0] RBP: ffff88805299c0f0 R08: ffff88805299c14f R09: 1ffff1100a533829 [ 95.068691][ C0] R10: dffffc0000000000 R11: ffffed100a53382a R12: 0000000000000730 [ 95.072120][ C0] R13: dffffc0000000000 R14: ffff88805299c128 R15: 0000000000000001 [ 95.075375][ C0] FS: 0000000000000000(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000 [ 95.079002][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.081788][ C0] CR2: 00007fe2240b20f5 CR3: 000000000bfca000 CR4: 0000000000352ef0 [ 95.085091][ C0] Call Trace: [ 95.086511][ C0] [ 95.087735][ C0] f_midi2_set_alt+0x11c/0xf00 [ 95.089766][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 95.092038][ C0] composite_setup+0x1ffd/0x3480 [ 95.094167][ C0] configfs_composite_setup+0xc7/0x100 [ 95.096367][ C0] dummy_timer+0x2f43/0x4cf0 [ 95.098338][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 95.100432][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 95.102457][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 95.104908][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 95.106919][ C0] __hrtimer_run_queues+0x3bc/0xa10 [ 95.109050][ C0] hrtimer_run_softirq+0x1e3/0x2e0 [ 95.111377][ C0] handle_softirqs+0x226/0x860 [ 95.113454][ C0] ? __irq_exit_rcu+0xcb/0x220 [ 95.115446][ C0] __irq_exit_rcu+0xcb/0x220 [ 95.117427][ C0] irq_exit_rcu+0x9/0x30 [ 95.119265][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 95.121726][ C0] [ 95.123007][ C0] [ 95.124295][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 95.126850][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 [ 95.129488][ C0] Code: f7 e8 ad b6 c2 f5 f7 c3 00 02 00 00 74 05 e8 b0 e7 ee f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 b4 d6 b3 f5 65 48 8b 05 2c ce b0 07 48 85 c0 74 18 5b 41 5e c3 [ 95.137412][ C0] RSP: 0018:ffffc900030ae5e8 EFLAGS: 00000206 [ 95.139822][ C0] RAX: 0000000000000006 RBX: 0000000000000287 RCX: 8000000000000001 [ 95.143192][ C0] RDX: 0000000000000006 RSI: ffffffff8e460b06 RDI: 0000000000000001 [ 95.146528][ C0] RBP: dffffc0000000000 R08: ffffffff9078fa37 R09: 1ffffffff20f1f46 [ 95.149812][ C0] R10: dffffc0000000000 R11: fffffbfff20f1f47 R12: ffff88801fc26000 [ 95.153054][ C0] R13: 0000000000000000 R14: ffff88801fc26000 R15: 0000000000000287 [ 95.156328][ C0] __mod_timer+0xb53/0xed0 [ 95.158164][ C0] schedule_timeout+0x14d/0x2c0 [ 95.160163][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 95.162297][ C0] ? __pfx_process_timeout+0x10/0x10 [ 95.164406][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 95.166547][ C0] wait_for_completion_timeout+0x2cf/0x610 [ 95.168979][ C0] ? wait_for_completion_timeout+0x265/0x610 [ 95.171551][ C0] ? __pfx_wait_for_completion_timeout+0x10/0x10 [ 95.174143][ C0] usb_start_wait_urb+0x1e9/0x5b0 [ 95.176144][ C0] ? trace_kmalloc+0x2a/0xf0 [ 95.178019][ C0] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 95.180273][ C0] usb_control_msg+0x234/0x3e0 [ 95.182279][ C0] usb_set_interface+0x521/0x1470 [ 95.184382][ C0] snd_usb_midi_v2_create+0x621/0x4ac0 [ 95.186591][ C0] ? __pfx_proc_audio_usbid_read+0x10/0x10 [ 95.188979][ C0] ? snd_card_rw_proc_new+0x10d/0x140 [ 95.191177][ C0] ? __pfx_snd_usb_midi_v2_create+0x10/0x10 [ 95.193615][ C0] ? usb_ifnum_to_if+0x262/0x2f0 [ 95.195701][ C0] snd_usb_create_stream+0x262/0x630 [ 95.197860][ C0] usb_audio_probe+0x144c/0x2240 [ 95.199884][ C0] ? __pfx_usb_audio_probe+0x10/0x10 [ 95.202058][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 95.204392][ C0] usb_probe_interface+0x653/0xc60 [ 95.206426][ C0] ? __pfx_usb_probe_interface+0x10/0x10 [ 95.208666][ C0] really_probe+0x254/0xae0 [ 95.210546][ C0] __driver_probe_device+0x1e8/0x360 [ 95.212820][ C0] driver_probe_device+0x4f/0x240 [ 95.214963][ C0] __device_attach_driver+0x270/0x410 [ 95.217285][ C0] bus_for_each_drv+0x258/0x2f0 [ 95.219359][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 95.221674][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 95.223849][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 95.226310][ C0] __device_attach+0x2c4/0x450 [ 95.228414][ C0] ? __pfx___device_attach+0x10/0x10 [ 95.230730][ C0] ? do_raw_spin_unlock+0x4d/0x200 [ 95.232938][ C0] ? _raw_spin_unlock+0x28/0x50 [ 95.234956][ C0] device_initial_probe+0xa1/0xd0 [ 95.237284][ C0] bus_probe_device+0x12a/0x220 [ 95.239855][ C0] device_add+0x7d7/0xb80 [ 95.242004][ C0] usb_set_configuration+0x1ad8/0x2180 [ 95.244100][ C0] usb_generic_driver_probe+0x8d/0x150 [ 95.246204][ C0] usb_probe_device+0x1c3/0x3b0 [ 95.248135][ C0] ? __pfx_usb_probe_device+0x10/0x10 [ 95.250367][ C0] really_probe+0x254/0xae0 [ 95.252200][ C0] __driver_probe_device+0x1e8/0x360 [ 95.254190][ C0] driver_probe_device+0x4f/0x240 [ 95.256237][ C0] __device_attach_driver+0x270/0x410 [ 95.258547][ C0] bus_for_each_drv+0x258/0x2f0 [ 95.260681][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 95.263241][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 95.265516][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 95.267949][ C0] __device_attach+0x2c4/0x450 [ 95.269985][ C0] ? __pfx___device_attach+0x10/0x10 [ 95.272219][ C0] ? do_raw_spin_unlock+0x4d/0x200 [ 95.274358][ C0] ? _raw_spin_unlock+0x28/0x50 [ 95.276312][ C0] device_initial_probe+0xa1/0xd0 [ 95.278380][ C0] bus_probe_device+0x12a/0x220 [ 95.280320][ C0] device_add+0x7d7/0xb80 [ 95.282036][ C0] usb_new_device+0x9aa/0x1690 [ 95.284324][ C0] ? __pfx_usb_new_device+0x10/0x10 [ 95.286694][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 95.288997][ C0] hub_event+0x28e8/0x4d30 [ 95.290978][ C0] ? do_raw_spin_unlock+0x4d/0x200 [ 95.293213][ C0] ? __pfx_hub_event+0x10/0x10 [ 95.295279][ C0] ? process_scheduled_works+0x97a/0x1630 [ 95.297548][ C0] ? rcu_is_watching+0x16/0xb0 [ 95.299638][ C0] ? process_scheduled_works+0x97a/0x1630 [ 95.302042][ C0] process_scheduled_works+0xc3d/0x1630 [ 95.304184][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 95.306590][ C0] ? assign_work+0x3cf/0x5d0 [ 95.308572][ C0] worker_thread+0xa47/0xfb0 [ 95.310493][ C0] ? __kthread_parkme+0x71/0x1f0 [ 95.312526][ C0] kthread+0x38b/0x480 [ 95.314226][ C0] ? __pfx_worker_thread+0x10/0x10 [ 95.316287][ C0] ? __pfx_kthread+0x10/0x10 [ 95.318124][ C0] ret_from_fork+0x514/0xb70 [ 95.320145][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 95.322319][ C0] ? __switch_to+0xc89/0x1420 [ 95.324211][ C0] ? __pfx_kthread+0x10/0x10 [ 95.326123][ C0] ret_from_fork_asm+0x1a/0x30 [ 95.328109][ C0] [ 95.329393][ C0] Modules linked in: [ 95.330979][ C0] ---[ end trace 0000000000000000 ]--- [ 95.333415][ C0] RIP: 0010:f_midi2_stop_eps+0x5f/0x4d0 [ 95.336370][ C0] Code: e8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 ef e8 77 4b 61 fa 41 bc 30 07 00 00 4c 03 65 00 4c 89 e0 48 c1 e8 03 48 89 44 24 10 <42> 0f b6 04 28 84 c0 0f 85 23 04 00 00 41 8b 1c 24 31 ff 89 de e8 [ 95.344905][ C0] RSP: 0018:ffffc90000007930 EFLAGS: 00010002 [ 95.348015][ C0] RAX: 00000000000000e6 RBX: 0000000000000001 RCX: ffff8880002c8000 [ 95.351633][ C0] RDX: 0000000000000100 RSI: 0000000000000100 RDI: ffff88805299c148 [ 95.354995][ C0] RBP: ffff88805299c0f0 R08: ffff88805299c14f R09: 1ffff1100a533829 [ 95.358395][ C0] R10: dffffc0000000000 R11: ffffed100a53382a R12: 0000000000000730 [ 95.361736][ C0] R13: dffffc0000000000 R14: ffff88805299c128 R15: 0000000000000001 [ 95.365054][ C0] FS: 0000000000000000(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000 [ 95.368717][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.371660][ C0] CR2: 00007fe2240b20f5 CR3: 000000000bfca000 CR4: 0000000000352ef0 [ 95.374972][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 95.378564][ C0] Kernel Offset: disabled [ 95.380482][ C0] Rebooting in 86400 seconds..