program:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404c05c1060001010203010902200001010080fa0904000002ffffff000705810200020007050202000200"], 0x0)
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000100)="0000ff00ff00")
syz_usb_ep_write(r0, 0x81, 0x14, &(0x7f0000000106)="0000ffffff0a00f6d7290000000000000003fd00")
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000200)="0000ff00ff00")
syz_usb_ep_write(r0, 0x81, 0xd, &(0x7f0000000206)="0000ffffff0300fdd72b00fe00")
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000300)="0000ff00ff00")
syz_usb_ep_write(r0, 0x81, 0xe, &(0x7f0000000306)="0000ffffff0400fcd72101000700")
nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000001000), r1)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000002000)={0x0, 0x0, &(0x7f0000002100)={&(0x7f0000002200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x1c}}, 0x0)
sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000003000)={0x0, 0x0, &(0x7f0000003100)={&(0x7f0000003200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000004000)={0x0, 0x0, &(0x7f0000004100)={&(0x7f0000004200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x1}]}, 0x1c}}, 0x0)
sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000005100)={&(0x7f0000005200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x1}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000006000)={0x0, 0x0, &(0x7f0000006100)={&(0x7f0000006200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x2}]}, 0x1c}}, 0x0)
sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000007100)={&(0x7f0000007200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x2}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0)
syz_usb_disconnect(r0) (async)
[ 99.871144][ T5286] Bluetooth: hci0: command tx timeout
[ 100.190890][ T52] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 100.346592][ T52] usb 5-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice= 1.00
[ 100.350187][ T52] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 100.353716][ T52] usb 5-1: Product: syz
[ 100.355354][ T52] usb 5-1: Manufacturer: syz
[ 100.357134][ T52] usb 5-1: SerialNumber: syz
[ 100.772368][ T52] ------------[ cut here ]------------
[ 100.774926][ T52] URB ffff888043e0fa00 submitted while active
[ 100.777527][ T52] WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x79/0x18b0, CPU#0: kworker/0:2/52
[ 100.781704][ T52] Modules linked in:
[ 100.783459][ T52] CPU: 0 UID: 0 PID: 52 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full)
[ 100.787161][ T52] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 100.791420][ T52] Workqueue: usb_hub_wq hub_event
[ 100.793588][ T52] RIP: 0010:usb_submit_urb+0x7c/0x18b0
[ 100.795878][ T52] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 79 40 d3 fa 49 83 3e 00 74 40 e8 ce 0d 64 fa 48 8d 3d 07 a0 02 09 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 b3 0d 64 fa eb 05 e8 ac 0d
[ 100.804133][ T52] RSP: 0018:ffffc90000aceb80 EFLAGS: 00010293
[ 100.806810][ T52] RAX: ffffffff876314f2 RBX: ffff888043e0fa00 RCX: ffff88800090a540
[ 100.810205][ T52] RDX: 0000000000000000 RSI: ffff888043e0fa00 RDI: ffffffff9065b500
[ 100.813519][ T52] RBP: dffffc0000000000 R08: ffffffff9057c237 R09: 1ffffffff20af846
[ 100.816941][ T52] R10: dffffc0000000000 R11: fffffbfff20af847 R12: ffff88803f6b7458
[ 100.820409][ T52] R13: 1ffff11007ed6e8b R14: ffff888043e0fa08 R15: 0000000000000cc0
[ 100.823913][ T52] FS: 0000000000000000(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000
[ 100.827470][ T52] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 100.830239][ T52] CR2: 00007faccae157f0 CR3: 0000000043edf000 CR4: 0000000000352ef0
[ 100.833586][ T52] Call Trace:
[ 100.834941][ T52]
[ 100.836116][ T52] ? __kmalloc_cache_noprof+0x150/0x660
[ 100.838303][ T52] ? port100_send_cmd_async+0xbd/0xcc0
[ 100.840219][ T52] ? skb_put+0x112/0x210
[ 100.841966][ T52] port100_send_cmd_async+0x84f/0xcc0
[ 100.844056][ T52] port100_set_command_type+0x1c8/0x390
[ 100.845955][ T52] ? pcpu_alloc+0x10/0x310
[ 100.847461][ T52] ? __pfx_port100_set_command_type+0x10/0x10
[ 100.849453][ T52] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 100.851466][ T52] port100_probe+0x7b2/0xba0
[ 100.853112][ T52] ? __pfx_port100_probe+0x10/0x10
[ 100.854840][ T52] ? lockdep_hardirqs_on+0x7a/0x110
[ 100.856575][ T52] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 100.858565][ T52] ? __pm_runtime_set_status+0x994/0xc80
[ 100.860435][ T52] usb_probe_interface+0x653/0xc60
[ 100.862267][ T52] ? __pfx_usb_probe_interface+0x10/0x10
[ 100.864273][ T52] really_probe+0x254/0xae0
[ 100.865907][ T52] __driver_probe_device+0x1e8/0x360
[ 100.868575][ T52] driver_probe_device+0x4f/0x240
[ 100.871242][ T52] __device_attach_driver+0x270/0x410
[ 100.873983][ T52] bus_for_each_drv+0x258/0x2f0
[ 100.876503][ T52] ? __pfx___device_attach_driver+0x10/0x10
[ 100.878874][ T52] ? __pfx_bus_for_each_drv+0x10/0x10
[ 100.881011][ T52] ? lockdep_hardirqs_on+0x7a/0x110
[ 100.883132][ T52] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 100.885588][ T52] __device_attach+0x2c4/0x450
[ 100.887599][ T52] ? __pfx___device_attach+0x10/0x10
[ 100.889762][ T52] ? do_raw_spin_unlock+0x4d/0x210
[ 100.892117][ T52] ? _raw_spin_unlock+0x28/0x50
[ 100.894297][ T52] device_initial_probe+0xa1/0xd0
[ 100.896540][ T52] bus_probe_device+0x12a/0x220
[ 100.898659][ T52] device_add+0x7d7/0xb80
[ 100.900521][ T52] usb_set_configuration+0x1ad8/0x2180
[ 100.902914][ T52] usb_generic_driver_probe+0x8d/0x150
[ 100.905189][ T52] usb_probe_device+0x1c3/0x3b0
[ 100.907215][ T52] ? __pfx_usb_probe_device+0x10/0x10
[ 100.909322][ T52] really_probe+0x254/0xae0
[ 100.911143][ T52] __driver_probe_device+0x1e8/0x360
[ 100.913193][ T52] driver_probe_device+0x4f/0x240
[ 100.915148][ T52] __device_attach_driver+0x270/0x410
[ 100.917297][ T52] bus_for_each_drv+0x258/0x2f0
[ 100.919344][ T52] ? __pfx___device_attach_driver+0x10/0x10
[ 100.921903][ T52] ? __pfx_bus_for_each_drv+0x10/0x10
[ 100.924253][ T52] ? lockdep_hardirqs_on+0x7a/0x110
[ 100.926702][ T52] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 100.929263][ T52] __device_attach+0x2c4/0x450
[ 100.933213][ T52] ? __pfx___device_attach+0x10/0x10
[ 100.935455][ T52] ? do_raw_spin_unlock+0x4d/0x210
[ 100.937699][ T52] ? _raw_spin_unlock+0x28/0x50
[ 100.939740][ T52] device_initial_probe+0xa1/0xd0
[ 100.942321][ T52] bus_probe_device+0x12a/0x220
[ 100.944499][ T52] device_add+0x7d7/0xb80
[ 100.946421][ T52] usb_new_device+0x99d/0x1620
[ 100.948500][ T52] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 100.951144][ T52] ? __pfx_usb_new_device+0x10/0x10
[ 100.953387][ T52] ? _raw_spin_unlock_irq+0x23/0x50
[ 100.955595][ T52] hub_event+0x28e8/0x4d30
[ 100.957581][ T52] ? do_raw_spin_unlock+0x4d/0x210
[ 100.959807][ T52] ? __pfx_hub_event+0x10/0x10
[ 100.961941][ T52] ? process_scheduled_works+0xa20/0x14e0
[ 100.964407][ T52] ? rcu_is_watching+0x15/0xb0
[ 100.966517][ T52] ? process_scheduled_works+0xa20/0x14e0
[ 100.968984][ T52] process_scheduled_works+0xa8e/0x14e0
[ 100.971444][ T52] ? __pfx_process_scheduled_works+0x10/0x10
[ 100.974074][ T52] ? assign_work+0x3cf/0x5d0
[ 100.976091][ T52] worker_thread+0xa47/0xfb0
[ 100.978198][ T52] kthread+0x388/0x470
[ 100.979996][ T52] ? __pfx_worker_thread+0x10/0x10
[ 100.982195][ T52] ? __pfx_kthread+0x10/0x10
[ 100.984215][ T52] ret_from_fork+0x514/0xb70
[ 100.986316][ T52] ? __pfx_ret_from_fork+0x10/0x10
[ 100.988537][ T52] ? __switch_to+0xc89/0x1420
[ 100.990703][ T52] ? __pfx_kthread+0x10/0x10
[ 100.992833][ T52] ret_from_fork_asm+0x1a/0x30
[ 100.994890][ T52]
[ 100.996280][ T52] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 100.999260][ T52] CPU: 0 UID: 0 PID: 52 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full)
[ 101.003125][ T52] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 101.007393][ T52] Workqueue: usb_hub_wq hub_event
[ 101.009580][ T52] Call Trace:
[ 101.011010][ T52]
[ 101.012289][ T52] vpanic+0x56c/0xa60
[ 101.014035][ T52] ? __pfx__printk+0x10/0x10
[ 101.016022][ T52] ? __pfx_vpanic+0x10/0x10
[ 101.017954][ T52] ? is_bpf_text_address+0x292/0x2b0
[ 101.020164][ T52] ? is_bpf_text_address+0x26/0x2b0
[ 101.022406][ T52] panic+0xc5/0xd0
[ 101.024006][ T52] ? __pfx_panic+0x10/0x10
[ 101.025876][ T52] ? ret_from_fork_asm+0x1a/0x30
[ 101.027962][ T52] __warn+0x315/0x4c0
[ 101.029528][ T52] ? usb_submit_urb+0x79/0x18b0
[ 101.031628][ T52] ? usb_submit_urb+0x79/0x18b0
[ 101.033708][ T52] __report_bug+0x276/0x570
[ 101.035611][ T52] ? kasan_save_track+0x4f/0x80
[ 101.037698][ T52] ? kasan_save_track+0x3e/0x80
[ 101.039724][ T52] ? usb_submit_urb+0x79/0x18b0
[ 101.041632][ T52] ? __pfx___report_bug+0x10/0x10
[ 101.043424][ T52] ? __pfx___mutex_trylock_common+0x10/0x10
[ 101.045844][ T52] ? rcu_is_watching+0x15/0xb0
[ 101.047937][ T52] ? trace_contention_end+0x3d/0x140
[ 101.050282][ T52] report_bug_entry+0x19a/0x290
[ 101.052305][ T52] ? usb_submit_urb+0x7c/0x18b0
[ 101.054343][ T52] ? usb_submit_urb+0x81/0x18b0
[ 101.056467][ T52] handle_bug+0xce/0x200
[ 101.058318][ T52] exc_invalid_op+0x1a/0x50
[ 101.060272][ T52] asm_exc_invalid_op+0x1a/0x20
[ 101.062394][ T52] RIP: 0010:usb_submit_urb+0x7c/0x18b0
[ 101.064624][ T52] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 79 40 d3 fa 49 83 3e 00 74 40 e8 ce 0d 64 fa 48 8d 3d 07 a0 02 09 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 b3 0d 64 fa eb 05 e8 ac 0d
[ 101.072021][ T52] RSP: 0018:ffffc90000aceb80 EFLAGS: 00010293
[ 101.074606][ T52] RAX: ffffffff876314f2 RBX: ffff888043e0fa00 RCX: ffff88800090a540
[ 101.078028][ T52] RDX: 0000000000000000 RSI: ffff888043e0fa00 RDI: ffffffff9065b500
[ 101.081336][ T52] RBP: dffffc0000000000 R08: ffffffff9057c237 R09: 1ffffffff20af846
[ 101.084724][ T52] R10: dffffc0000000000 R11: fffffbfff20af847 R12: ffff88803f6b7458
[ 101.088026][ T52] R13: 1ffff11007ed6e8b R14: ffff888043e0fa08 R15: 0000000000000cc0
[ 101.091321][ T52] ? usb_submit_urb+0x72/0x18b0
[ 101.093424][ T52] ? __kmalloc_cache_noprof+0x150/0x660
[ 101.095795][ T52] ? port100_send_cmd_async+0xbd/0xcc0
[ 101.098102][ T52] ? skb_put+0x112/0x210
[ 101.099924][ T52] port100_send_cmd_async+0x84f/0xcc0
[ 101.102219][ T52] port100_set_command_type+0x1c8/0x390
[ 101.104569][ T52] ? pcpu_alloc+0x10/0x310
[ 101.106492][ T52] ? __pfx_port100_set_command_type+0x10/0x10
[ 101.109066][ T52] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 101.111590][ T52] port100_probe+0x7b2/0xba0
[ 101.113586][ T52] ? __pfx_port100_probe+0x10/0x10
[ 101.115685][ T52] ? lockdep_hardirqs_on+0x7a/0x110
[ 101.117943][ T52] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 101.120259][ T52] ? __pm_runtime_set_status+0x994/0xc80
[ 101.122511][ T52] usb_probe_interface+0x653/0xc60
[ 101.124561][ T52] ? __pfx_usb_probe_interface+0x10/0x10
[ 101.126868][ T52] really_probe+0x254/0xae0
[ 101.128799][ T52] __driver_probe_device+0x1e8/0x360
[ 101.131104][ T52] driver_probe_device+0x4f/0x240
[ 101.133254][ T52] __device_attach_driver+0x270/0x410
[ 101.135515][ T52] bus_for_each_drv+0x258/0x2f0
[ 101.137605][ T52] ? __pfx___device_attach_driver+0x10/0x10
[ 101.140082][ T52] ? __pfx_bus_for_each_drv+0x10/0x10
[ 101.142321][ T52] ? lockdep_hardirqs_on+0x7a/0x110
[ 101.144422][ T52] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 101.146905][ T52] __device_attach+0x2c4/0x450
[ 101.148963][ T52] ? __pfx___device_attach+0x10/0x10
[ 101.151274][ T52] ? do_raw_spin_unlock+0x4d/0x210
[ 101.153434][ T52] ? _raw_spin_unlock+0x28/0x50
[ 101.155449][ T52] device_initial_probe+0xa1/0xd0
[ 101.157601][ T52] bus_probe_device+0x12a/0x220
[ 101.159628][ T52] device_add+0x7d7/0xb80
[ 101.161468][ T52] usb_set_configuration+0x1ad8/0x2180
[ 101.163755][ T52] usb_generic_driver_probe+0x8d/0x150
[ 101.166033][ T52] usb_probe_device+0x1c3/0x3b0
[ 101.168119][ T52] ? __pfx_usb_probe_device+0x10/0x10
[ 101.170298][ T52] really_probe+0x254/0xae0
[ 101.172212][ T52] __driver_probe_device+0x1e8/0x360
[ 101.174401][ T52] driver_probe_device+0x4f/0x240
[ 101.176528][ T52] __device_attach_driver+0x270/0x410
[ 101.178769][ T52] bus_for_each_drv+0x258/0x2f0
[ 101.180880][ T52] ? __pfx___device_attach_driver+0x10/0x10
[ 101.183307][ T52] ? __pfx_bus_for_each_drv+0x10/0x10
[ 101.185496][ T52] ? lockdep_hardirqs_on+0x7a/0x110
[ 101.187711][ T52] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 101.190177][ T52] __device_attach+0x2c4/0x450
[ 101.192156][ T52] ? __pfx___device_attach+0x10/0x10
[ 101.194331][ T52] ? do_raw_spin_unlock+0x4d/0x210
[ 101.196456][ T52] ? _raw_spin_unlock+0x28/0x50
[ 101.198501][ T52] device_initial_probe+0xa1/0xd0
[ 101.200598][ T52] bus_probe_device+0x12a/0x220
[ 101.202620][ T52] device_add+0x7d7/0xb80
[ 101.204443][ T52] usb_new_device+0x99d/0x1620
[ 101.206445][ T52] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 101.208959][ T52] ? __pfx_usb_new_device+0x10/0x10
[ 101.211125][ T52] ? _raw_spin_unlock_irq+0x23/0x50
[ 101.213279][ T52] hub_event+0x28e8/0x4d30
[ 101.215109][ T52] ? do_raw_spin_unlock+0x4d/0x210
[ 101.217295][ T52] ? __pfx_hub_event+0x10/0x10
[ 101.219246][ T52] ? process_scheduled_works+0xa20/0x14e0
[ 101.221575][ T52] ? rcu_is_watching+0x15/0xb0
[ 101.223532][ T52] ? process_scheduled_works+0xa20/0x14e0
[ 101.225891][ T52] process_scheduled_works+0xa8e/0x14e0
[ 101.228229][ T52] ? __pfx_process_scheduled_works+0x10/0x10
[ 101.230695][ T52] ? assign_work+0x3cf/0x5d0
[ 101.232633][ T52] worker_thread+0xa47/0xfb0
[ 101.234583][ T52] kthread+0x388/0x470
[ 101.236304][ T52] ? __pfx_worker_thread+0x10/0x10
[ 101.238392][ T52] ? __pfx_kthread+0x10/0x10
[ 101.240287][ T52] ret_from_fork+0x514/0xb70
[ 101.242270][ T52] ? __pfx_ret_from_fork+0x10/0x10
[ 101.244381][ T52] ? __switch_to+0xc89/0x1420
[ 101.246397][ T52] ? __pfx_kthread+0x10/0x10
[ 101.248344][ T52] ret_from_fork_asm+0x1a/0x30
[ 101.250363][ T52]
[ 101.252088][ T52] Kernel Offset: disabled
[ 101.253892][ T52] Rebooting in 86400 seconds..