program:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404c05c1060001010203010902200001010080fa0904000002ffffff000705810200020007050202000200"], 0x0)
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000100)="0000ff00ff00")
syz_usb_ep_write(r0, 0x81, 0x14, &(0x7f0000000106)="0000ffffff0a00f6d7290000000000000003fd00")
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000200)="0000ff00ff00")
syz_usb_ep_write(r0, 0x81, 0xd, &(0x7f0000000206)="0000ffffff0300fdd72b00fe00")
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000300)="0000ff00ff00")
syz_usb_ep_write(r0, 0x81, 0xe, &(0x7f0000000306)="0000ffffff0400fcd72101000700")
nanosleep(&(0x7f0000000400)={0x1}, 0x0)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000001000), r1)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000002000)={0x0, 0x0, &(0x7f0000002100)={&(0x7f0000002200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x1c}}, 0x0)
sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000003000)={0x0, 0x0, &(0x7f0000003100)={&(0x7f0000003200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000004000)={0x0, 0x0, &(0x7f0000004100)={&(0x7f0000004200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x1}]}, 0x1c}}, 0x0)
sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000005100)={&(0x7f0000005200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x1}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000006000)={0x0, 0x0, &(0x7f0000006100)={&(0x7f0000006200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x2}]}, 0x1c}}, 0x0)
sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000007100)={&(0x7f0000007200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x2}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0)
[ 86.398972][ T5308] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 86.436350][ T4650] Bluetooth: hci0: command tx timeout
[ 86.525916][ T1379] cfg80211: failed to load regulatory.db
[ 86.552493][ T5308] usb 5-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice= 1.00
[ 86.556602][ T5308] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 86.559913][ T5308] usb 5-1: Product: syz
[ 86.561790][ T5308] usb 5-1: Manufacturer: syz
[ 86.563800][ T5308] usb 5-1: SerialNumber: syz
[ 87.006425][ T5308] ------------[ cut here ]------------
[ 87.008812][ T5308] URB ffff888044284f00 submitted while active
[ 87.011143][ T5308] WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x79/0x18b0, CPU#0: kworker/0:5/5308
[ 87.015387][ T5308] Modules linked in:
[ 87.017101][ T5308] CPU: 0 UID: 0 PID: 5308 Comm: kworker/0:5 Not tainted syzkaller #0 PREEMPT(full)
[ 87.020821][ T5308] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 87.025038][ T5308] Workqueue: usb_hub_wq hub_event
[ 87.027214][ T5308] RIP: 0010:usb_submit_urb+0x7c/0x18b0
[ 87.029467][ T5308] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 79 40 d3 fa 49 83 3e 00 74 40 e8 ce 0d 64 fa 48 8d 3d 07 a0 02 09 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 b3 0d 64 fa eb 05 e8 ac 0d
[ 87.036688][ T5308] RSP: 0018:ffffc9000f2a6b80 EFLAGS: 00010293
[ 87.039135][ T5308] RAX: ffffffff876314f2 RBX: ffff888044284f00 RCX: ffff88801fb4a540
[ 87.042151][ T5308] RDX: 0000000000000000 RSI: ffff888044284f00 RDI: ffffffff9065b500
[ 87.045193][ T5308] RBP: dffffc0000000000 R08: ffffffff9057c237 R09: 1ffffffff20af846
[ 87.048422][ T5308] R10: dffffc0000000000 R11: fffffbfff20af847 R12: ffff888040b50458
[ 87.052004][ T5308] R13: 1ffff1100816a08b R14: ffff888044284f08 R15: 0000000000000cc0
[ 87.056385][ T5308] FS: 0000000000000000(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000
[ 87.060849][ T5308] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 87.064093][ T5308] CR2: 000055f770885168 CR3: 000000001201f000 CR4: 0000000000352ef0
[ 87.067501][ T5308] Call Trace:
[ 87.068989][ T5308]
[ 87.070331][ T5308] ? __kmalloc_cache_noprof+0x150/0x660
[ 87.072740][ T5308] ? port100_send_cmd_async+0xbd/0xcc0
[ 87.075156][ T5308] ? skb_put+0x112/0x210
[ 87.077640][ T5308] port100_send_cmd_async+0x84f/0xcc0
[ 87.080138][ T5308] port100_set_command_type+0x1c8/0x390
[ 87.082501][ T5308] ? pcpu_alloc+0x10/0x310
[ 87.084394][ T5308] ? __pfx_port100_set_command_type+0x10/0x10
[ 87.087091][ T5308] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 87.089570][ T5308] port100_probe+0x7b2/0xba0
[ 87.091527][ T5308] ? __pfx_port100_probe+0x10/0x10
[ 87.094190][ T5308] ? lockdep_hardirqs_on+0x7a/0x110
[ 87.096763][ T5308] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 87.099289][ T5308] ? __pm_runtime_set_status+0x994/0xc80
[ 87.101712][ T5308] usb_probe_interface+0x653/0xc60
[ 87.103722][ T5308] ? __pfx_usb_probe_interface+0x10/0x10
[ 87.105989][ T5308] really_probe+0x254/0xae0
[ 87.108003][ T5308] __driver_probe_device+0x1e8/0x360
[ 87.110265][ T5308] driver_probe_device+0x4f/0x240
[ 87.112246][ T5308] __device_attach_driver+0x270/0x410
[ 87.114371][ T5308] bus_for_each_drv+0x258/0x2f0
[ 87.116375][ T5308] ? __pfx___device_attach_driver+0x10/0x10
[ 87.118804][ T5308] ? __pfx_bus_for_each_drv+0x10/0x10
[ 87.121044][ T5308] ? lockdep_hardirqs_on+0x7a/0x110
[ 87.123496][ T5308] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 87.126004][ T5308] __device_attach+0x2c4/0x450
[ 87.128199][ T5308] ? __pfx___device_attach+0x10/0x10
[ 87.130249][ T5308] ? do_raw_spin_unlock+0x4d/0x210
[ 87.132406][ T5308] ? _raw_spin_unlock+0x28/0x50
[ 87.134581][ T5308] device_initial_probe+0xa1/0xd0
[ 87.136786][ T5308] bus_probe_device+0x12a/0x220
[ 87.138900][ T5308] device_add+0x7d7/0xb80
[ 87.140745][ T5308] usb_set_configuration+0x1ad8/0x2180
[ 87.143066][ T5308] usb_generic_driver_probe+0x8d/0x150
[ 87.145342][ T5308] usb_probe_device+0x1c3/0x3b0
[ 87.147408][ T5308] ? __pfx_usb_probe_device+0x10/0x10
[ 87.149723][ T5308] really_probe+0x254/0xae0
[ 87.151720][ T5308] __driver_probe_device+0x1e8/0x360
[ 87.153998][ T5308] driver_probe_device+0x4f/0x240
[ 87.157024][ T5308] __device_attach_driver+0x270/0x410
[ 87.159354][ T5308] bus_for_each_drv+0x258/0x2f0
[ 87.161447][ T5308] ? __pfx___device_attach_driver+0x10/0x10
[ 87.163980][ T5308] ? __pfx_bus_for_each_drv+0x10/0x10
[ 87.166367][ T5308] ? lockdep_hardirqs_on+0x7a/0x110
[ 87.168674][ T5308] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 87.171193][ T5308] __device_attach+0x2c4/0x450
[ 87.173341][ T5308] ? __pfx___device_attach+0x10/0x10
[ 87.175575][ T5308] ? do_raw_spin_unlock+0x4d/0x210
[ 87.177888][ T5308] ? _raw_spin_unlock+0x28/0x50
[ 87.180071][ T5308] device_initial_probe+0xa1/0xd0
[ 87.182289][ T5308] bus_probe_device+0x12a/0x220
[ 87.184395][ T5308] device_add+0x7d7/0xb80
[ 87.186370][ T5308] usb_new_device+0x99d/0x1620
[ 87.188500][ T5308] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 87.191050][ T5308] ? __pfx_usb_new_device+0x10/0x10
[ 87.193290][ T5308] ? _raw_spin_unlock_irq+0x23/0x50
[ 87.195504][ T5308] hub_event+0x28e8/0x4d30
[ 87.197894][ T5308] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 87.200432][ T5308] ? __pfx_hub_event+0x10/0x10
[ 87.202834][ T5308] ? process_scheduled_works+0xa20/0x14e0
[ 87.205376][ T5308] ? rcu_is_watching+0x15/0xb0
[ 87.207513][ T5308] ? process_scheduled_works+0xa20/0x14e0
[ 87.209943][ T5308] process_scheduled_works+0xa8e/0x14e0
[ 87.212290][ T5308] ? __pfx_process_scheduled_works+0x10/0x10
[ 87.214918][ T5308] ? assign_work+0x3cf/0x5d0
[ 87.216852][ T5308] worker_thread+0xa47/0xfb0
[ 87.219004][ T5308] ? __kthread_parkme+0x71/0x1f0
[ 87.221070][ T5308] kthread+0x388/0x470
[ 87.222777][ T5308] ? __pfx_worker_thread+0x10/0x10
[ 87.224902][ T5308] ? __pfx_kthread+0x10/0x10
[ 87.226884][ T5308] ret_from_fork+0x514/0xb70
[ 87.228863][ T5308] ? __pfx_ret_from_fork+0x10/0x10
[ 87.230980][ T5308] ? __switch_to+0xc89/0x1420
[ 87.232952][ T5308] ? __pfx_kthread+0x10/0x10
[ 87.234921][ T5308] ret_from_fork_asm+0x1a/0x30
[ 87.237603][ T5308]
[ 87.239005][ T5308] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 87.242010][ T5308] CPU: 0 UID: 0 PID: 5308 Comm: kworker/0:5 Not tainted syzkaller #0 PREEMPT(full)
[ 87.245820][ T5308] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 87.249965][ T5308] Workqueue: usb_hub_wq hub_event
[ 87.252140][ T5308] Call Trace:
[ 87.253593][ T5308]
[ 87.254842][ T5308] vpanic+0x56c/0xa60
[ 87.256529][ T5308] ? __pfx__printk+0x10/0x10
[ 87.258495][ T5308] ? __pfx_vpanic+0x10/0x10
[ 87.260237][ T5308] ? is_bpf_text_address+0x292/0x2b0
[ 87.262171][ T5308] ? is_bpf_text_address+0x26/0x2b0
[ 87.264037][ T5308] panic+0xc5/0xd0
[ 87.265490][ T5308] ? __pfx_panic+0x10/0x10
[ 87.267316][ T5308] ? ret_from_fork_asm+0x1a/0x30
[ 87.269235][ T5308] __warn+0x315/0x4c0
[ 87.270730][ T5308] ? usb_submit_urb+0x79/0x18b0
[ 87.272568][ T5308] ? usb_submit_urb+0x79/0x18b0
[ 87.274404][ T5308] __report_bug+0x276/0x570
[ 87.276308][ T5308] ? kasan_save_track+0x4f/0x80
[ 87.278424][ T5308] ? kasan_save_track+0x3e/0x80
[ 87.280482][ T5308] ? usb_submit_urb+0x79/0x18b0
[ 87.282492][ T5308] ? __pfx___report_bug+0x10/0x10
[ 87.284603][ T5308] ? __pfx___mutex_trylock_common+0x10/0x10
[ 87.287035][ T5308] ? rcu_is_watching+0x15/0xb0
[ 87.289028][ T5308] ? trace_contention_end+0x3d/0x140
[ 87.291055][ T5308] report_bug_entry+0x19a/0x290
[ 87.293053][ T5308] ? usb_submit_urb+0x7c/0x18b0
[ 87.294863][ T5308] ? usb_submit_urb+0x81/0x18b0
[ 87.296717][ T5308] handle_bug+0xce/0x200
[ 87.298408][ T5308] exc_invalid_op+0x1a/0x50
[ 87.300308][ T5308] asm_exc_invalid_op+0x1a/0x20
[ 87.302231][ T5308] RIP: 0010:usb_submit_urb+0x7c/0x18b0
[ 87.304481][ T5308] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 79 40 d3 fa 49 83 3e 00 74 40 e8 ce 0d 64 fa 48 8d 3d 07 a0 02 09 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 b3 0d 64 fa eb 05 e8 ac 0d
[ 87.312229][ T5308] RSP: 0018:ffffc9000f2a6b80 EFLAGS: 00010293
[ 87.314621][ T5308] RAX: ffffffff876314f2 RBX: ffff888044284f00 RCX: ffff88801fb4a540
[ 87.317767][ T5308] RDX: 0000000000000000 RSI: ffff888044284f00 RDI: ffffffff9065b500
[ 87.320844][ T5308] RBP: dffffc0000000000 R08: ffffffff9057c237 R09: 1ffffffff20af846
[ 87.323977][ T5308] R10: dffffc0000000000 R11: fffffbfff20af847 R12: ffff888040b50458
[ 87.326997][ T5308] R13: 1ffff1100816a08b R14: ffff888044284f08 R15: 0000000000000cc0
[ 87.330193][ T5308] ? usb_submit_urb+0x72/0x18b0
[ 87.332124][ T5308] ? __kmalloc_cache_noprof+0x150/0x660
[ 87.334193][ T5308] ? port100_send_cmd_async+0xbd/0xcc0
[ 87.336239][ T5308] ? skb_put+0x112/0x210
[ 87.337966][ T5308] port100_send_cmd_async+0x84f/0xcc0
[ 87.340124][ T5308] port100_set_command_type+0x1c8/0x390
[ 87.342332][ T5308] ? pcpu_alloc+0x10/0x310
[ 87.344073][ T5308] ? __pfx_port100_set_command_type+0x10/0x10
[ 87.346506][ T5308] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 87.348734][ T5308] port100_probe+0x7b2/0xba0
[ 87.350606][ T5308] ? __pfx_port100_probe+0x10/0x10
[ 87.352715][ T5308] ? lockdep_hardirqs_on+0x7a/0x110
[ 87.354865][ T5308] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 87.357133][ T5308] ? __pm_runtime_set_status+0x994/0xc80
[ 87.359448][ T5308] usb_probe_interface+0x653/0xc60
[ 87.361702][ T5308] ? __pfx_usb_probe_interface+0x10/0x10
[ 87.364169][ T5308] really_probe+0x254/0xae0
[ 87.365811][ T5308] __driver_probe_device+0x1e8/0x360
[ 87.368036][ T5308] driver_probe_device+0x4f/0x240
[ 87.370257][ T5308] __device_attach_driver+0x270/0x410
[ 87.372523][ T5308] bus_for_each_drv+0x258/0x2f0
[ 87.374478][ T5308] ? __pfx___device_attach_driver+0x10/0x10
[ 87.376874][ T5308] ? __pfx_bus_for_each_drv+0x10/0x10
[ 87.379106][ T5308] ? lockdep_hardirqs_on+0x7a/0x110
[ 87.381434][ T5308] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 87.384069][ T5308] __device_attach+0x2c4/0x450
[ 87.386154][ T5308] ? __pfx___device_attach+0x10/0x10
[ 87.388467][ T5308] ? do_raw_spin_unlock+0x4d/0x210
[ 87.390636][ T5308] ? _raw_spin_unlock+0x28/0x50
[ 87.392628][ T5308] device_initial_probe+0xa1/0xd0
[ 87.394576][ T5308] bus_probe_device+0x12a/0x220
[ 87.396280][ T5308] device_add+0x7d7/0xb80
[ 87.397939][ T5308] usb_set_configuration+0x1ad8/0x2180
[ 87.400080][ T5308] usb_generic_driver_probe+0x8d/0x150
[ 87.402375][ T5308] usb_probe_device+0x1c3/0x3b0
[ 87.404084][ T5308] ? __pfx_usb_probe_device+0x10/0x10
[ 87.405842][ T5308] really_probe+0x254/0xae0
[ 87.407675][ T5308] __driver_probe_device+0x1e8/0x360
[ 87.409856][ T5308] driver_probe_device+0x4f/0x240
[ 87.411922][ T5308] __device_attach_driver+0x270/0x410
[ 87.414172][ T5308] bus_for_each_drv+0x258/0x2f0
[ 87.416210][ T5308] ? __pfx___device_attach_driver+0x10/0x10
[ 87.418671][ T5308] ? __pfx_bus_for_each_drv+0x10/0x10
[ 87.420868][ T5308] ? lockdep_hardirqs_on+0x7a/0x110
[ 87.423035][ T5308] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 87.425461][ T5308] __device_attach+0x2c4/0x450
[ 87.427394][ T5308] ? __pfx___device_attach+0x10/0x10
[ 87.429570][ T5308] ? do_raw_spin_unlock+0x4d/0x210
[ 87.431698][ T5308] ? _raw_spin_unlock+0x28/0x50
[ 87.433820][ T5308] device_initial_probe+0xa1/0xd0
[ 87.435930][ T5308] bus_probe_device+0x12a/0x220
[ 87.437971][ T5308] device_add+0x7d7/0xb80
[ 87.439982][ T5308] usb_new_device+0x99d/0x1620
[ 87.442226][ T5308] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 87.445264][ T5308] ? __pfx_usb_new_device+0x10/0x10
[ 87.447893][ T5308] ? _raw_spin_unlock_irq+0x23/0x50
[ 87.450502][ T5308] hub_event+0x28e8/0x4d30
[ 87.452799][ T5308] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 87.455622][ T5308] ? __pfx_hub_event+0x10/0x10
[ 87.457617][ T5308] ? process_scheduled_works+0xa20/0x14e0
[ 87.460109][ T5308] ? rcu_is_watching+0x15/0xb0
[ 87.462516][ T5308] ? process_scheduled_works+0xa20/0x14e0
[ 87.464996][ T5308] process_scheduled_works+0xa8e/0x14e0
[ 87.467612][ T5308] ? __pfx_process_scheduled_works+0x10/0x10
[ 87.470426][ T5308] ? assign_work+0x3cf/0x5d0
[ 87.472264][ T5308] worker_thread+0xa47/0xfb0
[ 87.474171][ T5308] ? __kthread_parkme+0x71/0x1f0
[ 87.476234][ T5308] kthread+0x388/0x470
[ 87.478011][ T5308] ? __pfx_worker_thread+0x10/0x10
[ 87.480183][ T5308] ? __pfx_kthread+0x10/0x10
[ 87.482163][ T5308] ret_from_fork+0x514/0xb70
[ 87.484139][ T5308] ? __pfx_ret_from_fork+0x10/0x10
[ 87.486386][ T5308] ? __switch_to+0xc89/0x1420
[ 87.488418][ T5308] ? __pfx_kthread+0x10/0x10
[ 87.490473][ T5308] ret_from_fork_asm+0x1a/0x30
[ 87.492519][ T5308]
[ 87.494284][ T5308] Kernel Offset: disabled
[ 87.496113][ T5308] Rebooting in 86400 seconds..