program:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404c05c1060001010203010902200001010080fa0904000002ffffff000705810200020007050202000200"], 0x0)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000100)="0000ff00ff00")
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x14, &(0x7f0000000106)="0000ffffff0a00f6d7290000000000000003fd00")
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000200)="0000ff00ff00")
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
syz_usb_ep_write(r0, 0x81, 0xd, &(0x7f0000000206)="0000ffffff0300fdd72b00fe00")
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000300)="0000ff00ff00")
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
syz_usb_ep_write(r0, 0x81, 0xe, &(0x7f0000000306)="0000ffffff0400fcd72101000700")
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000001000), r1)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000002000)={0x0, 0x0, &(0x7f0000002100)={&(0x7f0000002200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x1c}}, 0x0)
sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000003000)={0x0, 0x0, &(0x7f0000003100)={&(0x7f0000003200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000004000)={0x0, 0x0, &(0x7f0000004100)={&(0x7f0000004200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x1}]}, 0x1c}}, 0x0)
sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000005100)={&(0x7f0000005200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x1}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000006000)={0x0, 0x0, &(0x7f0000006100)={&(0x7f0000006200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x2}]}, 0x1c}}, 0x0)
sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000007100)={&(0x7f0000007200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x2}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0)
[ 111.587463][ T4651] Bluetooth: hci0: command tx timeout
[ 111.886430][ T5319] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 112.047206][ T5319] usb 5-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice= 1.00
[ 112.058787][ T5319] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 112.071219][ T5319] usb 5-1: Product: syz
[ 112.077610][ T5319] usb 5-1: Manufacturer: syz
[ 112.083326][ T5319] usb 5-1: SerialNumber: syz
[ 112.620399][ T5319] ------------[ cut here ]------------
[ 112.622871][ T5319] URB ffff88803761a400 submitted while active
[ 112.625409][ T5319] WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x79/0x18b0, CPU#0: kworker/0:4/5319
[ 112.629691][ T5319] Modules linked in:
[ 112.631585][ T5319] CPU: 0 UID: 0 PID: 5319 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full)
[ 112.635631][ T5319] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 112.639963][ T5319] Workqueue: usb_hub_wq hub_event
[ 112.642156][ T5319] RIP: 0010:usb_submit_urb+0x7c/0x18b0
[ 112.644527][ T5319] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 79 40 d3 fa 49 83 3e 00 74 40 e8 ce 0d 64 fa 48 8d 3d 07 a0 02 09 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 b3 0d 64 fa eb 05 e8 ac 0d
[ 112.652489][ T5319] RSP: 0018:ffffc9000df5eb80 EFLAGS: 00010293
[ 112.655009][ T5319] RAX: ffffffff876314f2 RBX: ffff88803761a400 RCX: ffff888000ba8000
[ 112.659316][ T5319] RDX: 0000000000000000 RSI: ffff88803761a400 RDI: ffffffff9065b500
[ 112.662640][ T5319] RBP: dffffc0000000000 R08: ffffffff9057c237 R09: 1ffffffff20af846
[ 112.665966][ T5319] R10: dffffc0000000000 R11: fffffbfff20af847 R12: ffff88804074fc58
[ 112.669401][ T5319] R13: 1ffff110080e9f8b R14: ffff88803761a408 R15: 0000000000000cc0
[ 112.672708][ T5319] FS: 0000000000000000(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000
[ 112.676477][ T5319] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 112.679287][ T5319] CR2: 00007ff3cabf36b8 CR3: 000000001280c000 CR4: 0000000000352ef0
[ 112.682695][ T5319] Call Trace:
[ 112.684699][ T5319]
[ 112.686402][ T5319] ? __kmalloc_cache_noprof+0x150/0x660
[ 112.688856][ T5319] ? port100_send_cmd_async+0xbd/0xcc0
[ 112.691186][ T5319] ? skb_put+0x112/0x210
[ 112.693112][ T5319] port100_send_cmd_async+0x84f/0xcc0
[ 112.695426][ T5319] port100_set_command_type+0x1c8/0x390
[ 112.697894][ T5319] ? pcpu_alloc+0x10/0x310
[ 112.699904][ T5319] ? __pfx_port100_set_command_type+0x10/0x10
[ 112.702518][ T5319] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 112.705054][ T5319] port100_probe+0x7b2/0xba0
[ 112.707076][ T5319] ? __pfx_port100_probe+0x10/0x10
[ 112.709324][ T5319] ? lockdep_hardirqs_on+0x7a/0x110
[ 112.711527][ T5319] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 112.714045][ T5319] ? __pm_runtime_set_status+0x994/0xc80
[ 112.716507][ T5319] usb_probe_interface+0x653/0xc60
[ 112.718715][ T5319] ? __pfx_usb_probe_interface+0x10/0x10
[ 112.721118][ T5319] really_probe+0x254/0xae0
[ 112.723093][ T5319] __driver_probe_device+0x1e8/0x360
[ 112.725311][ T5319] driver_probe_device+0x4f/0x240
[ 112.727543][ T5319] __device_attach_driver+0x270/0x410
[ 112.729900][ T5319] bus_for_each_drv+0x258/0x2f0
[ 112.732056][ T5319] ? __pfx___device_attach_driver+0x10/0x10
[ 112.734523][ T5319] ? __pfx_bus_for_each_drv+0x10/0x10
[ 112.737667][ T5319] ? lockdep_hardirqs_on+0x7a/0x110
[ 112.739964][ T5319] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 112.742498][ T5319] __device_attach+0x2c4/0x450
[ 112.744614][ T5319] ? __pfx___device_attach+0x10/0x10
[ 112.747012][ T5319] ? do_raw_spin_unlock+0x4d/0x210
[ 112.749305][ T5319] ? _raw_spin_unlock+0x28/0x50
[ 112.751427][ T5319] device_initial_probe+0xa1/0xd0
[ 112.753599][ T5319] bus_probe_device+0x12a/0x220
[ 112.755724][ T5319] device_add+0x7d7/0xb80
[ 112.757601][ T5319] usb_set_configuration+0x1ad8/0x2180
[ 112.760019][ T5319] usb_generic_driver_probe+0x8d/0x150
[ 112.762363][ T5319] usb_probe_device+0x1c3/0x3b0
[ 112.764577][ T5319] ? __pfx_usb_probe_device+0x10/0x10
[ 112.766910][ T5319] really_probe+0x254/0xae0
[ 112.768959][ T5319] __driver_probe_device+0x1e8/0x360
[ 112.771222][ T5319] driver_probe_device+0x4f/0x240
[ 112.773461][ T5319] __device_attach_driver+0x270/0x410
[ 112.775837][ T5319] bus_for_each_drv+0x258/0x2f0
[ 112.777999][ T5319] ? __pfx___device_attach_driver+0x10/0x10
[ 112.780599][ T5319] ? __pfx_bus_for_each_drv+0x10/0x10
[ 112.782900][ T5319] ? lockdep_hardirqs_on+0x7a/0x110
[ 112.785110][ T5319] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 112.788068][ T5319] __device_attach+0x2c4/0x450
[ 112.790058][ T5319] ? __pfx___device_attach+0x10/0x10
[ 112.792305][ T5319] ? do_raw_spin_unlock+0x4d/0x210
[ 112.794408][ T5319] ? _raw_spin_unlock+0x28/0x50
[ 112.800294][ T5319] device_initial_probe+0xa1/0xd0
[ 112.802686][ T5319] bus_probe_device+0x12a/0x220
[ 112.804798][ T5319] device_add+0x7d7/0xb80
[ 112.806713][ T5319] usb_new_device+0x99d/0x1620
[ 112.808796][ T5319] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 112.811397][ T5319] ? __pfx_usb_new_device+0x10/0x10
[ 112.813651][ T5319] ? _raw_spin_unlock_irq+0x23/0x50
[ 112.815951][ T5319] hub_event+0x28e8/0x4d30
[ 112.817981][ T5319] ? __pfx_hub_event+0x10/0x10
[ 112.820182][ T5319] ? process_scheduled_works+0xa20/0x14e0
[ 112.822623][ T5319] ? rcu_is_watching+0x15/0xb0
[ 112.824722][ T5319] ? process_scheduled_works+0xa20/0x14e0
[ 112.827212][ T5319] process_scheduled_works+0xa8e/0x14e0
[ 112.829682][ T5319] ? __pfx_process_scheduled_works+0x10/0x10
[ 112.832240][ T5319] ? assign_work+0x3cf/0x5d0
[ 112.834255][ T5319] worker_thread+0xa47/0xfb0
[ 112.836307][ T5319] ? __kthread_parkme+0x71/0x1f0
[ 112.838499][ T5319] kthread+0x388/0x470
[ 112.840330][ T5319] ? __pfx_worker_thread+0x10/0x10
[ 112.842516][ T5319] ? __pfx_kthread+0x10/0x10
[ 112.844555][ T5319] ret_from_fork+0x514/0xb70
[ 112.846622][ T5319] ? __pfx_ret_from_fork+0x10/0x10
[ 112.848861][ T5319] ? __switch_to+0xc89/0x1420
[ 112.850885][ T5319] ? __pfx_kthread+0x10/0x10
[ 112.852955][ T5319] ret_from_fork_asm+0x1a/0x30
[ 112.855035][ T5319]
[ 112.856457][ T5319] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 112.859531][ T5319] CPU: 0 UID: 0 PID: 5319 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full)
[ 112.863332][ T5319] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 112.867374][ T5319] Workqueue: usb_hub_wq hub_event
[ 112.869476][ T5319] Call Trace:
[ 112.870893][ T5319]
[ 112.872168][ T5319] vpanic+0x56c/0xa60
[ 112.873848][ T5319] ? __pfx__printk+0x10/0x10
[ 112.875807][ T5319] ? __pfx_vpanic+0x10/0x10
[ 112.877712][ T5319] ? is_bpf_text_address+0x292/0x2b0
[ 112.879935][ T5319] ? is_bpf_text_address+0x26/0x2b0
[ 112.882121][ T5319] panic+0xc5/0xd0
[ 112.883722][ T5319] ? __pfx_panic+0x10/0x10
[ 112.885651][ T5319] ? ret_from_fork_asm+0x1a/0x30
[ 112.887762][ T5319] __warn+0x315/0x4c0
[ 112.889431][ T5319] ? usb_submit_urb+0x79/0x18b0
[ 112.891454][ T5319] ? usb_submit_urb+0x79/0x18b0
[ 112.893476][ T5319] __report_bug+0x276/0x570
[ 112.895478][ T5319] ? kasan_save_track+0x4f/0x80
[ 112.897525][ T5319] ? kasan_save_track+0x3e/0x80
[ 112.899607][ T5319] ? usb_submit_urb+0x79/0x18b0
[ 112.901647][ T5319] ? __pfx___report_bug+0x10/0x10
[ 112.903766][ T5319] ? __pfx___mutex_trylock_common+0x10/0x10
[ 112.906223][ T5319] ? rcu_is_watching+0x15/0xb0
[ 112.908248][ T5319] ? trace_contention_end+0x3d/0x140
[ 112.910430][ T5319] report_bug_entry+0x19a/0x290
[ 112.912457][ T5319] ? usb_submit_urb+0x7c/0x18b0
[ 112.914445][ T5319] ? usb_submit_urb+0x81/0x18b0
[ 112.916488][ T5319] handle_bug+0xce/0x200
[ 112.918220][ T5319] exc_invalid_op+0x1a/0x50
[ 112.920105][ T5319] asm_exc_invalid_op+0x1a/0x20
[ 112.922122][ T5319] RIP: 0010:usb_submit_urb+0x7c/0x18b0
[ 112.924363][ T5319] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 79 40 d3 fa 49 83 3e 00 74 40 e8 ce 0d 64 fa 48 8d 3d 07 a0 02 09 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 b3 0d 64 fa eb 05 e8 ac 0d
[ 112.932106][ T5319] RSP: 0018:ffffc9000df5eb80 EFLAGS: 00010293
[ 112.934573][ T5319] RAX: ffffffff876314f2 RBX: ffff88803761a400 RCX: ffff888000ba8000
[ 112.937797][ T5319] RDX: 0000000000000000 RSI: ffff88803761a400 RDI: ffffffff9065b500
[ 112.940983][ T5319] RBP: dffffc0000000000 R08: ffffffff9057c237 R09: 1ffffffff20af846
[ 112.944199][ T5319] R10: dffffc0000000000 R11: fffffbfff20af847 R12: ffff88804074fc58
[ 112.947416][ T5319] R13: 1ffff110080e9f8b R14: ffff88803761a408 R15: 0000000000000cc0
[ 112.950633][ T5319] ? usb_submit_urb+0x72/0x18b0
[ 112.952656][ T5319] ? __kmalloc_cache_noprof+0x150/0x660
[ 112.955005][ T5319] ? port100_send_cmd_async+0xbd/0xcc0
[ 112.957216][ T5319] ? skb_put+0x112/0x210
[ 112.958999][ T5319] port100_send_cmd_async+0x84f/0xcc0
[ 112.961229][ T5319] port100_set_command_type+0x1c8/0x390
[ 112.963506][ T5319] ? pcpu_alloc+0x10/0x310
[ 112.965356][ T5319] ? __pfx_port100_set_command_type+0x10/0x10
[ 112.967929][ T5319] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 112.970311][ T5319] port100_probe+0x7b2/0xba0
[ 112.972296][ T5319] ? __pfx_port100_probe+0x10/0x10
[ 112.974426][ T5319] ? lockdep_hardirqs_on+0x7a/0x110
[ 112.976602][ T5319] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 112.979015][ T5319] ? __pm_runtime_set_status+0x994/0xc80
[ 112.981366][ T5319] usb_probe_interface+0x653/0xc60
[ 112.983483][ T5319] ? __pfx_usb_probe_interface+0x10/0x10
[ 112.985763][ T5319] really_probe+0x254/0xae0
[ 112.987728][ T5319] __driver_probe_device+0x1e8/0x360
[ 112.989885][ T5319] driver_probe_device+0x4f/0x240
[ 112.991999][ T5319] __device_attach_driver+0x270/0x410
[ 112.994227][ T5319] bus_for_each_drv+0x258/0x2f0
[ 112.996259][ T5319] ? __pfx___device_attach_driver+0x10/0x10
[ 112.998761][ T5319] ? __pfx_bus_for_each_drv+0x10/0x10
[ 113.000998][ T5319] ? lockdep_hardirqs_on+0x7a/0x110
[ 113.003175][ T5319] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 113.005668][ T5319] __device_attach+0x2c4/0x450
[ 113.007651][ T5319] ? __pfx___device_attach+0x10/0x10
[ 113.009789][ T5319] ? do_raw_spin_unlock+0x4d/0x210
[ 113.011926][ T5319] ? _raw_spin_unlock+0x28/0x50
[ 113.013962][ T5319] device_initial_probe+0xa1/0xd0
[ 113.016067][ T5319] bus_probe_device+0x12a/0x220
[ 113.018111][ T5319] device_add+0x7d7/0xb80
[ 113.019928][ T5319] usb_set_configuration+0x1ad8/0x2180
[ 113.022208][ T5319] usb_generic_driver_probe+0x8d/0x150
[ 113.024520][ T5319] usb_probe_device+0x1c3/0x3b0
[ 113.026550][ T5319] ? __pfx_usb_probe_device+0x10/0x10
[ 113.028809][ T5319] really_probe+0x254/0xae0
[ 113.030727][ T5319] __driver_probe_device+0x1e8/0x360
[ 113.032921][ T5319] driver_probe_device+0x4f/0x240
[ 113.035023][ T5319] __device_attach_driver+0x270/0x410
[ 113.037251][ T5319] bus_for_each_drv+0x258/0x2f0
[ 113.039377][ T5319] ? __pfx___device_attach_driver+0x10/0x10
[ 113.041871][ T5319] ? __pfx_bus_for_each_drv+0x10/0x10
[ 113.044107][ T5319] ? lockdep_hardirqs_on+0x7a/0x110
[ 113.046274][ T5319] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 113.048730][ T5319] __device_attach+0x2c4/0x450
[ 113.050728][ T5319] ? __pfx___device_attach+0x10/0x10
[ 113.052896][ T5319] ? do_raw_spin_unlock+0x4d/0x210
[ 113.055031][ T5319] ? _raw_spin_unlock+0x28/0x50
[ 113.057045][ T5319] device_initial_probe+0xa1/0xd0
[ 113.059110][ T5319] bus_probe_device+0x12a/0x220
[ 113.061127][ T5319] device_add+0x7d7/0xb80
[ 113.062958][ T5319] usb_new_device+0x99d/0x1620
[ 113.064972][ T5319] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 113.067411][ T5319] ? __pfx_usb_new_device+0x10/0x10
[ 113.069627][ T5319] ? _raw_spin_unlock_irq+0x23/0x50
[ 113.071767][ T5319] hub_event+0x28e8/0x4d30
[ 113.073657][ T5319] ? __pfx_hub_event+0x10/0x10
[ 113.075648][ T5319] ? process_scheduled_works+0xa20/0x14e0
[ 113.077989][ T5319] ? rcu_is_watching+0x15/0xb0
[ 113.079928][ T5319] ? process_scheduled_works+0xa20/0x14e0
[ 113.082270][ T5319] process_scheduled_works+0xa8e/0x14e0
[ 113.084582][ T5319] ? __pfx_process_scheduled_works+0x10/0x10
[ 113.087053][ T5319] ? assign_work+0x3cf/0x5d0
[ 113.088988][ T5319] worker_thread+0xa47/0xfb0
[ 113.090934][ T5319] ? __kthread_parkme+0x71/0x1f0
[ 113.092990][ T5319] kthread+0x388/0x470
[ 113.094702][ T5319] ? __pfx_worker_thread+0x10/0x10
[ 113.096833][ T5319] ? __pfx_kthread+0x10/0x10
[ 113.098782][ T5319] ret_from_fork+0x514/0xb70
[ 113.100688][ T5319] ? __pfx_ret_from_fork+0x10/0x10
[ 113.102773][ T5319] ? __switch_to+0xc89/0x1420
[ 113.104738][ T5319] ? __pfx_kthread+0x10/0x10
[ 113.106647][ T5319] ret_from_fork_asm+0x1a/0x30
[ 113.108701][ T5319]
[ 113.110373][ T5319] Kernel Offset: disabled
[ 113.112186][ T5319] Rebooting in 86400 seconds..