program:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404c05c1060001010203010902200001010080fa0904000002ffffff000705810200020007050202000200"], 0x0)
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000100)="0000ff00ff00")
syz_usb_ep_write(r0, 0x81, 0x14, &(0x7f0000000106)="0000ffffff0a00f6f5290000000000000003df00")
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000200)="0000ff00ff00")
syz_usb_ep_write(r0, 0x81, 0xd, &(0x7f0000000206)="0000ffffff0300fdfd2b00d800")
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000300)="0000ff00ff00")
syz_usb_ep_write(r0, 0x81, 0xe, &(0x7f0000000306)="0000ffffff0400fcfd210100e100")
nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0)
[ 85.715997][ T4653] Bluetooth: hci0: command tx timeout
[ 85.795791][ T9] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 85.960555][ T9] usb 5-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice= 1.00
[ 85.964217][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 85.967796][ T9] usb 5-1: Product: syz
[ 85.969756][ T9] usb 5-1: Manufacturer: syz
[ 85.971704][ T9] usb 5-1: SerialNumber: syz
[ 86.392641][ T9] ------------[ cut here ]------------
[ 86.395151][ T9] URB ffff88803693d200 submitted while active
[ 86.397632][ T9] WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x79/0x18b0, CPU#0: kworker/0:0/9
[ 86.401515][ T9] Modules linked in:
[ 86.403274][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full)
[ 86.406947][ T9] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.410963][ T9] Workqueue: usb_hub_wq hub_event
[ 86.413128][ T9] RIP: 0010:usb_submit_urb+0x7c/0x18b0
[ 86.415388][ T9] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 79 40 d3 fa 49 83 3e 00 74 40 e8 ce 0d 64 fa 48 8d 3d 07 a0 02 09 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 b3 0d 64 fa eb 05 e8 ac 0d
[ 86.422988][ T9] RSP: 0018:ffffc9000022eb80 EFLAGS: 00010293
[ 86.425534][ T9] RAX: ffffffff876314f2 RBX: ffff88803693d200 RCX: ffff88801bf0ca80
[ 86.428620][ T9] RDX: 0000000000000000 RSI: ffff88803693d200 RDI: ffffffff9065b500
[ 86.431681][ T9] RBP: dffffc0000000000 R08: ffffffff9057c237 R09: 1ffffffff20af846
[ 86.435059][ T9] R10: dffffc0000000000 R11: fffffbfff20af847 R12: ffff88801afe9858
[ 86.438349][ T9] R13: 1ffff110035fd30b R14: ffff88803693d208 R15: 0000000000000cc0
[ 86.441384][ T9] FS: 0000000000000000(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000
[ 86.444772][ T9] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 86.447410][ T9] CR2: 00007fa8e06157f0 CR3: 00000000133b2000 CR4: 0000000000352ef0
[ 86.450592][ T9] Call Trace:
[ 86.452089][ T9]
[ 86.453382][ T9] ? __kmalloc_cache_noprof+0x150/0x660
[ 86.455729][ T9] ? port100_send_cmd_async+0xbd/0xcc0
[ 86.458077][ T9] ? skb_put+0x112/0x210
[ 86.459980][ T9] port100_send_cmd_async+0x84f/0xcc0
[ 86.462805][ T9] port100_set_command_type+0x1c8/0x390
[ 86.465511][ T9] ? pcpu_alloc+0x10/0x310
[ 86.467559][ T9] ? __pfx_port100_set_command_type+0x10/0x10
[ 86.470549][ T9] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 86.473292][ T9] port100_probe+0x7b2/0xba0
[ 86.475352][ T9] ? __pfx_port100_probe+0x10/0x10
[ 86.477931][ T9] ? lockdep_hardirqs_on+0x7a/0x110
[ 86.480566][ T9] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 86.483174][ T9] ? __pm_runtime_set_status+0x994/0xc80
[ 86.485682][ T9] usb_probe_interface+0x653/0xc60
[ 86.487810][ T9] ? __pfx_usb_probe_interface+0x10/0x10
[ 86.490423][ T9] really_probe+0x254/0xae0
[ 86.493387][ T9] __driver_probe_device+0x1e8/0x360
[ 86.495525][ T9] driver_probe_device+0x4f/0x240
[ 86.497556][ T9] __device_attach_driver+0x270/0x410
[ 86.499730][ T9] bus_for_each_drv+0x258/0x2f0
[ 86.501768][ T9] ? __pfx___device_attach_driver+0x10/0x10
[ 86.504289][ T9] ? __pfx_bus_for_each_drv+0x10/0x10
[ 86.506466][ T9] ? lockdep_hardirqs_on+0x7a/0x110
[ 86.508747][ T9] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 86.511133][ T9] __device_attach+0x2c4/0x450
[ 86.513090][ T9] ? __pfx___device_attach+0x10/0x10
[ 86.515898][ T9] ? do_raw_spin_unlock+0x4d/0x210
[ 86.518002][ T9] ? _raw_spin_unlock+0x28/0x50
[ 86.520047][ T9] device_initial_probe+0xa1/0xd0
[ 86.522129][ T9] bus_probe_device+0x12a/0x220
[ 86.524201][ T9] device_add+0x7d7/0xb80
[ 86.526085][ T9] usb_set_configuration+0x1ad8/0x2180
[ 86.528493][ T9] usb_generic_driver_probe+0x8d/0x150
[ 86.530738][ T9] usb_probe_device+0x1c3/0x3b0
[ 86.532671][ T9] ? __pfx_usb_probe_device+0x10/0x10
[ 86.534767][ T9] really_probe+0x254/0xae0
[ 86.536584][ T9] __driver_probe_device+0x1e8/0x360
[ 86.538745][ T9] driver_probe_device+0x4f/0x240
[ 86.540752][ T9] __device_attach_driver+0x270/0x410
[ 86.542916][ T9] bus_for_each_drv+0x258/0x2f0
[ 86.544652][ T9] ? __pfx___device_attach_driver+0x10/0x10
[ 86.546815][ T9] ? __pfx_bus_for_each_drv+0x10/0x10
[ 86.548720][ T9] ? lockdep_hardirqs_on+0x7a/0x110
[ 86.550479][ T9] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 86.552418][ T9] __device_attach+0x2c4/0x450
[ 86.554066][ T9] ? __pfx___device_attach+0x10/0x10
[ 86.556050][ T9] ? do_raw_spin_unlock+0x4d/0x210
[ 86.558012][ T9] ? _raw_spin_unlock+0x28/0x50
[ 86.559837][ T9] device_initial_probe+0xa1/0xd0
[ 86.561743][ T9] bus_probe_device+0x12a/0x220
[ 86.563712][ T9] device_add+0x7d7/0xb80
[ 86.565613][ T9] usb_new_device+0x99d/0x1620
[ 86.567540][ T9] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 86.569846][ T9] ? __pfx_usb_new_device+0x10/0x10
[ 86.571754][ T9] ? _raw_spin_unlock_irq+0x23/0x50
[ 86.573927][ T9] hub_event+0x28e8/0x4d30
[ 86.575916][ T9] ? do_raw_spin_unlock+0x4d/0x210
[ 86.578010][ T9] ? __pfx_hub_event+0x10/0x10
[ 86.579972][ T9] ? process_scheduled_works+0xa20/0x14e0
[ 86.582193][ T9] ? rcu_is_watching+0x15/0xb0
[ 86.584121][ T9] ? process_scheduled_works+0xa20/0x14e0
[ 86.586460][ T9] process_scheduled_works+0xa8e/0x14e0
[ 86.588784][ T9] ? __pfx_process_scheduled_works+0x10/0x10
[ 86.591294][ T9] ? assign_work+0x3cf/0x5d0
[ 86.593494][ T9] worker_thread+0xa47/0xfb0
[ 86.595839][ T9] kthread+0x388/0x470
[ 86.597553][ T9] ? __pfx_worker_thread+0x10/0x10
[ 86.599841][ T9] ? __pfx_kthread+0x10/0x10
[ 86.601907][ T9] ret_from_fork+0x514/0xb70
[ 86.603752][ T9] ? __pfx_ret_from_fork+0x10/0x10
[ 86.605680][ T9] ? __switch_to+0xc89/0x1420
[ 86.607762][ T9] ? __pfx_kthread+0x10/0x10
[ 86.609915][ T9] ret_from_fork_asm+0x1a/0x30
[ 86.612021][ T9]
[ 86.613490][ T9] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 86.616589][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full)
[ 86.620115][ T9] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.624260][ T9] Workqueue: usb_hub_wq hub_event
[ 86.626301][ T9] Call Trace:
[ 86.627574][ T9]
[ 86.628590][ T9] vpanic+0x56c/0xa60
[ 86.629972][ T9] ? __pfx__printk+0x10/0x10
[ 86.631550][ T9] ? __pfx_vpanic+0x10/0x10
[ 86.633300][ T9] ? is_bpf_text_address+0x292/0x2b0
[ 86.635384][ T9] ? is_bpf_text_address+0x26/0x2b0
[ 86.637489][ T9] panic+0xc5/0xd0
[ 86.638935][ T9] ? __pfx_panic+0x10/0x10
[ 86.640727][ T9] ? ret_from_fork_asm+0x1a/0x30
[ 86.642714][ T9] __warn+0x315/0x4c0
[ 86.644321][ T9] ? usb_submit_urb+0x79/0x18b0
[ 86.646264][ T9] ? usb_submit_urb+0x79/0x18b0
[ 86.648211][ T9] __report_bug+0x276/0x570
[ 86.650135][ T9] ? kasan_save_track+0x4f/0x80
[ 86.652052][ T9] ? kasan_save_track+0x3e/0x80
[ 86.654076][ T9] ? usb_submit_urb+0x79/0x18b0
[ 86.656101][ T9] ? __pfx___report_bug+0x10/0x10
[ 86.658104][ T9] ? __pfx___mutex_trylock_common+0x10/0x10
[ 86.660245][ T9] ? rcu_is_watching+0x15/0xb0
[ 86.662127][ T9] ? trace_contention_end+0x3d/0x140
[ 86.664168][ T9] report_bug_entry+0x19a/0x290
[ 86.666100][ T9] ? usb_submit_urb+0x7c/0x18b0
[ 86.668162][ T9] ? usb_submit_urb+0x81/0x18b0
[ 86.670214][ T9] handle_bug+0xce/0x200
[ 86.671981][ T9] exc_invalid_op+0x1a/0x50
[ 86.673882][ T9] asm_exc_invalid_op+0x1a/0x20
[ 86.675979][ T9] RIP: 0010:usb_submit_urb+0x7c/0x18b0
[ 86.678314][ T9] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 79 40 d3 fa 49 83 3e 00 74 40 e8 ce 0d 64 fa 48 8d 3d 07 a0 02 09 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 b3 0d 64 fa eb 05 e8 ac 0d
[ 86.685820][ T9] RSP: 0018:ffffc9000022eb80 EFLAGS: 00010293
[ 86.688189][ T9] RAX: ffffffff876314f2 RBX: ffff88803693d200 RCX: ffff88801bf0ca80
[ 86.691306][ T9] RDX: 0000000000000000 RSI: ffff88803693d200 RDI: ffffffff9065b500
[ 86.694492][ T9] RBP: dffffc0000000000 R08: ffffffff9057c237 R09: 1ffffffff20af846
[ 86.697488][ T9] R10: dffffc0000000000 R11: fffffbfff20af847 R12: ffff88801afe9858
[ 86.700385][ T9] R13: 1ffff110035fd30b R14: ffff88803693d208 R15: 0000000000000cc0
[ 86.703618][ T9] ? usb_submit_urb+0x72/0x18b0
[ 86.705622][ T9] ? __kmalloc_cache_noprof+0x150/0x660
[ 86.707787][ T9] ? port100_send_cmd_async+0xbd/0xcc0
[ 86.709973][ T9] ? skb_put+0x112/0x210
[ 86.711609][ T9] port100_send_cmd_async+0x84f/0xcc0
[ 86.713522][ T9] port100_set_command_type+0x1c8/0x390
[ 86.715522][ T9] ? pcpu_alloc+0x10/0x310
[ 86.717094][ T9] ? __pfx_port100_set_command_type+0x10/0x10
[ 86.719129][ T9] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 86.721276][ T9] port100_probe+0x7b2/0xba0
[ 86.723071][ T9] ? __pfx_port100_probe+0x10/0x10
[ 86.724999][ T9] ? lockdep_hardirqs_on+0x7a/0x110
[ 86.726839][ T9] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 86.728989][ T9] ? __pm_runtime_set_status+0x994/0xc80
[ 86.730875][ T9] usb_probe_interface+0x653/0xc60
[ 86.732522][ T9] ? __pfx_usb_probe_interface+0x10/0x10
[ 86.734317][ T9] really_probe+0x254/0xae0
[ 86.735791][ T9] __driver_probe_device+0x1e8/0x360
[ 86.737540][ T9] driver_probe_device+0x4f/0x240
[ 86.739158][ T9] __device_attach_driver+0x270/0x410
[ 86.740951][ T9] bus_for_each_drv+0x258/0x2f0
[ 86.742891][ T9] ? __pfx___device_attach_driver+0x10/0x10
[ 86.745147][ T9] ? __pfx_bus_for_each_drv+0x10/0x10
[ 86.747012][ T9] ? lockdep_hardirqs_on+0x7a/0x110
[ 86.748946][ T9] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 86.750875][ T9] __device_attach+0x2c4/0x450
[ 86.752635][ T9] ? __pfx___device_attach+0x10/0x10
[ 86.754393][ T9] ? do_raw_spin_unlock+0x4d/0x210
[ 86.756082][ T9] ? _raw_spin_unlock+0x28/0x50
[ 86.757739][ T9] device_initial_probe+0xa1/0xd0
[ 86.759533][ T9] bus_probe_device+0x12a/0x220
[ 86.761223][ T9] device_add+0x7d7/0xb80
[ 86.762754][ T9] usb_set_configuration+0x1ad8/0x2180
[ 86.764647][ T9] usb_generic_driver_probe+0x8d/0x150
[ 86.766535][ T9] usb_probe_device+0x1c3/0x3b0
[ 86.768280][ T9] ? __pfx_usb_probe_device+0x10/0x10
[ 86.770229][ T9] really_probe+0x254/0xae0
[ 86.771854][ T9] __driver_probe_device+0x1e8/0x360
[ 86.773836][ T9] driver_probe_device+0x4f/0x240
[ 86.775827][ T9] __device_attach_driver+0x270/0x410
[ 86.777709][ T9] bus_for_each_drv+0x258/0x2f0
[ 86.779388][ T9] ? __pfx___device_attach_driver+0x10/0x10
[ 86.781510][ T9] ? __pfx_bus_for_each_drv+0x10/0x10
[ 86.783369][ T9] ? lockdep_hardirqs_on+0x7a/0x110
[ 86.785249][ T9] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 86.787638][ T9] __device_attach+0x2c4/0x450
[ 86.789560][ T9] ? __pfx___device_attach+0x10/0x10
[ 86.791680][ T9] ? do_raw_spin_unlock+0x4d/0x210
[ 86.793889][ T9] ? _raw_spin_unlock+0x28/0x50
[ 86.795989][ T9] device_initial_probe+0xa1/0xd0
[ 86.798557][ T9] bus_probe_device+0x12a/0x220
[ 86.801163][ T9] device_add+0x7d7/0xb80
[ 86.803498][ T9] usb_new_device+0x99d/0x1620
[ 86.806338][ T9] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 86.809456][ T9] ? __pfx_usb_new_device+0x10/0x10
[ 86.812162][ T9] ? _raw_spin_unlock_irq+0x23/0x50
[ 86.814270][ T9] hub_event+0x28e8/0x4d30
[ 86.815971][ T9] ? do_raw_spin_unlock+0x4d/0x210
[ 86.818165][ T9] ? __pfx_hub_event+0x10/0x10
[ 86.820579][ T9] ? process_scheduled_works+0xa20/0x14e0
[ 86.823331][ T9] ? rcu_is_watching+0x15/0xb0
[ 86.825767][ T9] ? process_scheduled_works+0xa20/0x14e0
[ 86.828565][ T9] process_scheduled_works+0xa8e/0x14e0
[ 86.830908][ T9] ? __pfx_process_scheduled_works+0x10/0x10
[ 86.833472][ T9] ? assign_work+0x3cf/0x5d0
[ 86.835505][ T9] worker_thread+0xa47/0xfb0
[ 86.837636][ T9] kthread+0x388/0x470
[ 86.839540][ T9] ? __pfx_worker_thread+0x10/0x10
[ 86.841871][ T9] ? __pfx_kthread+0x10/0x10
[ 86.844013][ T9] ret_from_fork+0x514/0xb70
[ 86.846106][ T9] ? __pfx_ret_from_fork+0x10/0x10
[ 86.848497][ T9] ? __switch_to+0xc89/0x1420
[ 86.850576][ T9] ? __pfx_kthread+0x10/0x10
[ 86.852544][ T9] ret_from_fork_asm+0x1a/0x30
[ 86.854617][ T9]
[ 86.856289][ T9] Kernel Offset: disabled
[ 86.858118][ T9] Rebooting in 86400 seconds..