program:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404c05c1060001010203010902200001010080fa0904000002ffffff000705810200020007050202000200"], 0x0)
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000100)="0000ff00ff00")
syz_usb_ep_write(r0, 0x81, 0x14, &(0x7f0000000106)="0000ffffff0a00f6d7290000000000000003fd00")
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000200)="0000ff00ff00")
syz_usb_ep_write(r0, 0x81, 0xd, &(0x7f0000000206)="0000ffffff0300fdd72b00fe00")
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000300)="0000ff00ff00")
syz_usb_ep_write(r0, 0x81, 0xe, &(0x7f0000000306)="0000ffffff0400fcd72101000700")
nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000001000), r1)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000002000)={0x0, 0x0, &(0x7f0000002100)={&(0x7f0000002200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x1c}}, 0x0)
sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000003000)={0x0, 0x0, &(0x7f0000003100)={&(0x7f0000003200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000004000)={0x0, 0x0, &(0x7f0000004100)={&(0x7f0000004200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x1}]}, 0x1c}}, 0x0)
sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000005100)={&(0x7f0000005200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x1}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000006000)={0x0, 0x0, &(0x7f0000006100)={&(0x7f0000006200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x2}]}, 0x1c}}, 0x0)
sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000007100)={&(0x7f0000007200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x2}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0)
[ 86.218958][ T52] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 86.228364][ T4648] Bluetooth: hci0: command tx timeout
[ 86.372762][ T52] usb 5-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice= 1.00
[ 86.375892][ T52] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 86.380607][ T52] usb 5-1: Product: syz
[ 86.386067][ T52] usb 5-1: Manufacturer: syz
[ 86.387731][ T52] usb 5-1: SerialNumber: syz
[ 86.559036][ T9] cfg80211: failed to load regulatory.db
[ 86.833768][ T52] ------------[ cut here ]------------
[ 86.836090][ T52] URB ffff88801298bc00 submitted while active
[ 86.838301][ T52] WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x79/0x18b0, CPU#0: kworker/0:2/52
[ 86.842105][ T52] Modules linked in:
[ 86.843893][ T52] CPU: 0 UID: 0 PID: 52 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full)
[ 86.847650][ T52] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.851378][ T52] Workqueue: usb_hub_wq hub_event
[ 86.853235][ T52] RIP: 0010:usb_submit_urb+0x7c/0x18b0
[ 86.855347][ T52] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 79 40 d3 fa 49 83 3e 00 74 40 e8 ce 0d 64 fa 48 8d 3d 07 a0 02 09 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 b3 0d 64 fa eb 05 e8 ac 0d
[ 86.862392][ T52] RSP: 0018:ffffc90000aceb80 EFLAGS: 00010293
[ 86.864689][ T52] RAX: ffffffff876314f2 RBX: ffff88801298bc00 RCX: ffff8880008fa540
[ 86.867474][ T52] RDX: 0000000000000000 RSI: ffff88801298bc00 RDI: ffffffff9065b500
[ 86.870988][ T52] RBP: dffffc0000000000 R08: ffffffff9057c237 R09: 1ffffffff20af846
[ 86.874256][ T52] R10: dffffc0000000000 R11: fffffbfff20af847 R12: ffff888011cd9c58
[ 86.877478][ T52] R13: 1ffff1100239b38b R14: ffff88801298bc08 R15: 0000000000000cc0
[ 86.880652][ T52] FS: 0000000000000000(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000
[ 86.884181][ T52] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 86.886890][ T52] CR2: 00007f87b27ec0b0 CR3: 000000001fc47000 CR4: 0000000000352ef0
[ 86.890154][ T52] Call Trace:
[ 86.891359][ T52]
[ 86.892557][ T52] ? __kmalloc_cache_noprof+0x150/0x660
[ 86.894635][ T52] ? port100_send_cmd_async+0xbd/0xcc0
[ 86.896809][ T52] ? skb_put+0x112/0x210
[ 86.898818][ T52] port100_send_cmd_async+0x84f/0xcc0
[ 86.901503][ T52] port100_set_command_type+0x1c8/0x390
[ 86.904100][ T52] ? pcpu_alloc+0x10/0x310
[ 86.905863][ T52] ? __pfx_port100_set_command_type+0x10/0x10
[ 86.908318][ T52] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 86.910862][ T52] port100_probe+0x7b2/0xba0
[ 86.912831][ T52] ? __pfx_port100_probe+0x10/0x10
[ 86.914899][ T52] ? lockdep_hardirqs_on+0x7a/0x110
[ 86.917064][ T52] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 86.919464][ T52] ? __pm_runtime_set_status+0x994/0xc80
[ 86.921785][ T52] usb_probe_interface+0x653/0xc60
[ 86.923902][ T52] ? __pfx_usb_probe_interface+0x10/0x10
[ 86.925946][ T52] really_probe+0x254/0xae0
[ 86.927513][ T52] __driver_probe_device+0x1e8/0x360
[ 86.929365][ T52] driver_probe_device+0x4f/0x240
[ 86.931293][ T52] __device_attach_driver+0x270/0x410
[ 86.933297][ T52] bus_for_each_drv+0x258/0x2f0
[ 86.935091][ T52] ? __pfx___device_attach_driver+0x10/0x10
[ 86.937382][ T52] ? __pfx_bus_for_each_drv+0x10/0x10
[ 86.939579][ T52] ? lockdep_hardirqs_on+0x7a/0x110
[ 86.941735][ T52] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 86.944141][ T52] __device_attach+0x2c4/0x450
[ 86.946114][ T52] ? __pfx___device_attach+0x10/0x10
[ 86.948209][ T52] ? do_raw_spin_unlock+0x4d/0x210
[ 86.950722][ T52] ? _raw_spin_unlock+0x28/0x50
[ 86.952373][ T52] device_initial_probe+0xa1/0xd0
[ 86.954062][ T52] bus_probe_device+0x12a/0x220
[ 86.955761][ T52] device_add+0x7d7/0xb80
[ 86.957269][ T52] usb_set_configuration+0x1ad8/0x2180
[ 86.959335][ T52] usb_generic_driver_probe+0x8d/0x150
[ 86.961394][ T52] usb_probe_device+0x1c3/0x3b0
[ 86.963218][ T52] ? __pfx_usb_probe_device+0x10/0x10
[ 86.965370][ T52] really_probe+0x254/0xae0
[ 86.967171][ T52] __driver_probe_device+0x1e8/0x360
[ 86.969043][ T52] driver_probe_device+0x4f/0x240
[ 86.970954][ T52] __device_attach_driver+0x270/0x410
[ 86.973105][ T52] bus_for_each_drv+0x258/0x2f0
[ 86.974991][ T52] ? __pfx___device_attach_driver+0x10/0x10
[ 86.977325][ T52] ? __pfx_bus_for_each_drv+0x10/0x10
[ 86.979367][ T52] ? lockdep_hardirqs_on+0x7a/0x110
[ 86.981236][ T52] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 86.983450][ T52] __device_attach+0x2c4/0x450
[ 86.985337][ T52] ? __pfx___device_attach+0x10/0x10
[ 86.987546][ T52] ? do_raw_spin_unlock+0x4d/0x210
[ 86.989714][ T52] ? _raw_spin_unlock+0x28/0x50
[ 86.991595][ T52] device_initial_probe+0xa1/0xd0
[ 86.993298][ T52] bus_probe_device+0x12a/0x220
[ 86.994986][ T52] device_add+0x7d7/0xb80
[ 86.996534][ T52] usb_new_device+0x99d/0x1620
[ 86.998184][ T52] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 87.001308][ T52] ? __pfx_usb_new_device+0x10/0x10
[ 87.003940][ T52] ? _raw_spin_unlock_irq+0x23/0x50
[ 87.006146][ T52] hub_event+0x28e8/0x4d30
[ 87.008021][ T52] ? do_raw_spin_unlock+0x4d/0x210
[ 87.010315][ T52] ? __pfx_hub_event+0x10/0x10
[ 87.012176][ T52] ? process_scheduled_works+0xa20/0x14e0
[ 87.014432][ T52] ? rcu_is_watching+0x15/0xb0
[ 87.016375][ T52] ? process_scheduled_works+0xa20/0x14e0
[ 87.018654][ T52] process_scheduled_works+0xa8e/0x14e0
[ 87.020877][ T52] ? __pfx_process_scheduled_works+0x10/0x10
[ 87.023253][ T52] ? assign_work+0x3cf/0x5d0
[ 87.024861][ T52] worker_thread+0xa47/0xfb0
[ 87.026583][ T52] kthread+0x388/0x470
[ 87.029078][ T52] ? __pfx_worker_thread+0x10/0x10
[ 87.031269][ T52] ? __pfx_kthread+0x10/0x10
[ 87.033347][ T52] ret_from_fork+0x514/0xb70
[ 87.035328][ T52] ? __pfx_ret_from_fork+0x10/0x10
[ 87.037527][ T52] ? __switch_to+0xc89/0x1420
[ 87.039582][ T52] ? __pfx_kthread+0x10/0x10
[ 87.041551][ T52] ret_from_fork_asm+0x1a/0x30
[ 87.043469][ T52]
[ 87.044814][ T52] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 87.047682][ T52] CPU: 0 UID: 0 PID: 52 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full)
[ 87.051280][ T52] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 87.055363][ T52] Workqueue: usb_hub_wq hub_event
[ 87.057422][ T52] Call Trace:
[ 87.058822][ T52]
[ 87.060060][ T52] vpanic+0x56c/0xa60
[ 87.061768][ T52] ? __pfx__printk+0x10/0x10
[ 87.063652][ T52] ? __pfx_vpanic+0x10/0x10
[ 87.065501][ T52] ? is_bpf_text_address+0x292/0x2b0
[ 87.067467][ T52] ? is_bpf_text_address+0x26/0x2b0
[ 87.069641][ T52] panic+0xc5/0xd0
[ 87.071244][ T52] ? __pfx_panic+0x10/0x10
[ 87.073124][ T52] ? ret_from_fork_asm+0x1a/0x30
[ 87.075203][ T52] __warn+0x315/0x4c0
[ 87.076910][ T52] ? usb_submit_urb+0x79/0x18b0
[ 87.078922][ T52] ? usb_submit_urb+0x79/0x18b0
[ 87.080726][ T52] __report_bug+0x276/0x570
[ 87.082321][ T52] ? kasan_save_track+0x4f/0x80
[ 87.084255][ T52] ? kasan_save_track+0x3e/0x80
[ 87.086310][ T52] ? usb_submit_urb+0x79/0x18b0
[ 87.088356][ T52] ? __pfx___report_bug+0x10/0x10
[ 87.090464][ T52] ? __pfx___mutex_trylock_common+0x10/0x10
[ 87.092917][ T52] ? rcu_is_watching+0x15/0xb0
[ 87.095259][ T52] ? trace_contention_end+0x3d/0x140
[ 87.097506][ T52] report_bug_entry+0x19a/0x290
[ 87.099380][ T52] ? usb_submit_urb+0x7c/0x18b0
[ 87.101407][ T52] ? usb_submit_urb+0x81/0x18b0
[ 87.103371][ T52] handle_bug+0xce/0x200
[ 87.105095][ T52] exc_invalid_op+0x1a/0x50
[ 87.106808][ T52] asm_exc_invalid_op+0x1a/0x20
[ 87.108749][ T52] RIP: 0010:usb_submit_urb+0x7c/0x18b0
[ 87.110785][ T52] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 79 40 d3 fa 49 83 3e 00 74 40 e8 ce 0d 64 fa 48 8d 3d 07 a0 02 09 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 b3 0d 64 fa eb 05 e8 ac 0d
[ 87.118453][ T52] RSP: 0018:ffffc90000aceb80 EFLAGS: 00010293
[ 87.120952][ T52] RAX: ffffffff876314f2 RBX: ffff88801298bc00 RCX: ffff8880008fa540
[ 87.124164][ T52] RDX: 0000000000000000 RSI: ffff88801298bc00 RDI: ffffffff9065b500
[ 87.127397][ T52] RBP: dffffc0000000000 R08: ffffffff9057c237 R09: 1ffffffff20af846
[ 87.130507][ T52] R10: dffffc0000000000 R11: fffffbfff20af847 R12: ffff888011cd9c58
[ 87.133737][ T52] R13: 1ffff1100239b38b R14: ffff88801298bc08 R15: 0000000000000cc0
[ 87.136806][ T52] ? usb_submit_urb+0x72/0x18b0
[ 87.138857][ T52] ? __kmalloc_cache_noprof+0x150/0x660
[ 87.141267][ T52] ? port100_send_cmd_async+0xbd/0xcc0
[ 87.143512][ T52] ? skb_put+0x112/0x210
[ 87.145261][ T52] port100_send_cmd_async+0x84f/0xcc0
[ 87.147477][ T52] port100_set_command_type+0x1c8/0x390
[ 87.149802][ T52] ? pcpu_alloc+0x10/0x310
[ 87.151841][ T52] ? __pfx_port100_set_command_type+0x10/0x10
[ 87.154352][ T52] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 87.156748][ T52] port100_probe+0x7b2/0xba0
[ 87.158656][ T52] ? __pfx_port100_probe+0x10/0x10
[ 87.160769][ T52] ? lockdep_hardirqs_on+0x7a/0x110
[ 87.162947][ T52] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 87.166117][ T52] ? __pm_runtime_set_status+0x994/0xc80
[ 87.169179][ T52] usb_probe_interface+0x653/0xc60
[ 87.171896][ T52] ? __pfx_usb_probe_interface+0x10/0x10
[ 87.174139][ T52] really_probe+0x254/0xae0
[ 87.176014][ T52] __driver_probe_device+0x1e8/0x360
[ 87.177945][ T52] driver_probe_device+0x4f/0x240
[ 87.179580][ T52] __device_attach_driver+0x270/0x410
[ 87.181324][ T52] bus_for_each_drv+0x258/0x2f0
[ 87.183136][ T52] ? __pfx___device_attach_driver+0x10/0x10
[ 87.185425][ T52] ? __pfx_bus_for_each_drv+0x10/0x10
[ 87.187343][ T52] ? lockdep_hardirqs_on+0x7a/0x110
[ 87.189380][ T52] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 87.191733][ T52] __device_attach+0x2c4/0x450
[ 87.193997][ T52] ? __pfx___device_attach+0x10/0x10
[ 87.196178][ T52] ? do_raw_spin_unlock+0x4d/0x210
[ 87.198162][ T52] ? _raw_spin_unlock+0x28/0x50
[ 87.200157][ T52] device_initial_probe+0xa1/0xd0
[ 87.202395][ T52] bus_probe_device+0x12a/0x220
[ 87.204842][ T52] device_add+0x7d7/0xb80
[ 87.206823][ T52] usb_set_configuration+0x1ad8/0x2180
[ 87.209179][ T52] usb_generic_driver_probe+0x8d/0x150
[ 87.211513][ T52] usb_probe_device+0x1c3/0x3b0
[ 87.213577][ T52] ? __pfx_usb_probe_device+0x10/0x10
[ 87.215877][ T52] really_probe+0x254/0xae0
[ 87.217837][ T52] __driver_probe_device+0x1e8/0x360
[ 87.220043][ T52] driver_probe_device+0x4f/0x240
[ 87.222275][ T52] __device_attach_driver+0x270/0x410
[ 87.224595][ T52] bus_for_each_drv+0x258/0x2f0
[ 87.226679][ T52] ? __pfx___device_attach_driver+0x10/0x10
[ 87.229200][ T52] ? __pfx_bus_for_each_drv+0x10/0x10
[ 87.231502][ T52] ? lockdep_hardirqs_on+0x7a/0x110
[ 87.233744][ T52] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 87.236191][ T52] __device_attach+0x2c4/0x450
[ 87.238246][ T52] ? __pfx___device_attach+0x10/0x10
[ 87.240464][ T52] ? do_raw_spin_unlock+0x4d/0x210
[ 87.242638][ T52] ? _raw_spin_unlock+0x28/0x50
[ 87.244771][ T52] device_initial_probe+0xa1/0xd0
[ 87.246918][ T52] bus_probe_device+0x12a/0x220
[ 87.249025][ T52] device_add+0x7d7/0xb80
[ 87.250868][ T52] usb_new_device+0x99d/0x1620
[ 87.252932][ T52] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 87.255443][ T52] ? __pfx_usb_new_device+0x10/0x10
[ 87.257581][ T52] ? _raw_spin_unlock_irq+0x23/0x50
[ 87.259714][ T52] hub_event+0x28e8/0x4d30
[ 87.261443][ T52] ? do_raw_spin_unlock+0x4d/0x210
[ 87.263542][ T52] ? __pfx_hub_event+0x10/0x10
[ 87.265458][ T52] ? process_scheduled_works+0xa20/0x14e0
[ 87.267714][ T52] ? rcu_is_watching+0x15/0xb0
[ 87.269353][ T52] ? process_scheduled_works+0xa20/0x14e0
[ 87.271313][ T52] process_scheduled_works+0xa8e/0x14e0
[ 87.273637][ T52] ? __pfx_process_scheduled_works+0x10/0x10
[ 87.275947][ T52] ? assign_work+0x3cf/0x5d0
[ 87.277744][ T52] worker_thread+0xa47/0xfb0
[ 87.279546][ T52] kthread+0x388/0x470
[ 87.281122][ T52] ? __pfx_worker_thread+0x10/0x10
[ 87.283156][ T52] ? __pfx_kthread+0x10/0x10
[ 87.284912][ T52] ret_from_fork+0x514/0xb70
[ 87.286696][ T52] ? __pfx_ret_from_fork+0x10/0x10
[ 87.288733][ T52] ? __switch_to+0xc89/0x1420
[ 87.290449][ T52] ? __pfx_kthread+0x10/0x10
[ 87.291970][ T52] ret_from_fork_asm+0x1a/0x30
[ 87.293729][ T52]
[ 87.295409][ T52] Kernel Offset: disabled
[ 87.297022][ T52] Rebooting in 86400 seconds..