program:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000880)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302", @ANYRESHEX], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000180)={0x1c, &(0x7f00000001c0)=ANY=[@ANYBLOB="200a0200000093"], 0x0, 0x0})
r1 = syz_usb_connect(0x3, 0x2d, &(0x7f00000002c0)=ANY=[], 0x0)
syz_usb_disconnect(r1)
r2 = syz_usb_connect$uac1(0x0, 0xac, &(0x7f0000000300)=ANY=[], 0x0)
syz_usb_control_io(r2, &(0x7f0000000340)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$uac3(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$uac3(0xffffffffffffffff, &(0x7f0000000540)={0x14, 0x0, 0x0}, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0x5, &(0x7f00000003c0)=ANY=[])
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x3, &(0x7f0000000300)='\x00\x00\x00')
syz_usb_ep_write(r0, 0x81, 0xa, &(0x7f0000000240)="0a000100010000000001")
syz_usb_ep_write(r0, 0x81, 0xb, &(0x7f0000000280)="0b00020002000000010001")
r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1a34, 0xf705, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x1, "", [{{0x9, 0x4, 0x0, 0x8, 0x1, 0x3, 0x0, 0x7, 0x0, {0x9, 0x21, 0x0, 0x80, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x9}}}}}]}}]}}, 0x0)
r4 = syz_open_dev$evdev(&(0x7f0000000200), 0x2, 0x862b01)
r5 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f00000005c0)=ANY=[@ANYBLOB="12010000090000102505a1a4400000000101090244000101000000090400001202060000052406000005240000000d240f01000000000000"], 0x0)
syz_usb_control_io(r5, 0x0, 0x0)
syz_usb_control_io(r5, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r5, &(0x7f0000000640)={0x14, 0x0, &(0x7f0000000680)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0)
ioctl$EVIOCSREP(r4, 0x80086601, 0x0)
syz_usb_control_io$hid(r3, 0x0, 0x0)
syz_usb_disconnect(0xffffffffffffffff)
[ 102.471873][ T4642] Bluetooth: hci0: command tx timeout
[ 102.863610][ T5064] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 103.015196][ T5064] usb 5-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00
[ 103.016980][ T5064] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 30768, setting to 1024
[ 103.016999][ T5064] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 1024
[ 103.019159][ T5064] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 103.019173][ T5064] usb 5-1: Product: syz
[ 103.019180][ T5064] usb 5-1: Manufacturer: syz
[ 103.019188][ T5064] usb 5-1: SerialNumber: syz
qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0xac000)
[ 103.091388][ T5332] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[ 103.144744][ T1025] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1
[ 103.144758][ T1025] ata1: failed to read log page 10h (errno=-5)
[ 103.144767][ T1025] ata1.00: exception Emask 0x1 SAct 0xc000 SErr 0x0 action 0x0
[ 103.144774][ T1025] ata1.00: irq_stat 0x41000000
[ 103.144781][ T1025] ata1.00: failed command: READ FPDMA QUEUED
[ 103.144785][ T1025] ata1.00: cmd 60/60:70:0e:56:01/05:00:00:00:00/40 tag 14 ncq dma 704512 in
[ 103.144785][ T1025] res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 103.144804][ T1025] ata1.00: status: { DRDY }
[ 103.144808][ T1025] ata1.00: error: { ABRT }
[ 103.144814][ T1025] ata1.00: failed command: READ FPDMA QUEUED
[ 103.144818][ T1025] ata1.00: cmd 60/48:78:6e:5b:01/0a:00:00:00:00/40 tag 15 ncq dma 1347584 in
[ 103.144818][ T1025] res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 103.144836][ T1025] ata1.00: status: { DRDY }
[ 103.144900][ T1025] ata1.00: error: { ABRT }
[ 103.145990][ T1025] ata1.00: configured for UDMA/100
[ 103.146421][ T1025] sd 0:0:0:0: [sda] tag#14 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s
[ 103.146464][ T1025] sd 0:0:0:0: [sda] tag#14 Sense Key : Aborted Command [current]
[ 103.146565][ T1025] sd 0:0:0:0: [sda] tag#14 Add. Sense: No additional sense information
[ 103.146589][ T1025] sd 0:0:0:0: [sda] tag#14 CDB: Read(10) 28 00 00 01 56 0e 00 05 60 00
[ 103.146604][ T1025] I/O error, dev sda, sector 87566 op 0x0:(READ) flags 0x80700 phys_seg 11 prio class 2
[ 103.146926][ T1025] sd 0:0:0:0: [sda] tag#15 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s
[ 103.146952][ T1025] sd 0:0:0:0: [sda] tag#15 Sense Key : Aborted Command [current]
[ 103.146974][ T1025] sd 0:0:0:0: [sda] tag#15 Add. Sense: No additional sense information
[ 103.146996][ T1025] sd 0:0:0:0: [sda] tag#15 CDB: Read(10) 28 00 00 01 5b 6e 00 0a 48 00
[ 103.147009][ T1025] I/O error, dev sda, sector 88942 op 0x0:(READ) flags 0x80700 phys_seg 21 prio class 2
[ 103.148170][ T1025] ata1: EH complete
[ 103.507394][ T5332] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 103.510044][ T5332] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 103.713051][ T5332] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 103.722704][ T5332] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 104.341971][ C0] greybus greybus1: 0/0:0: error sending response 0x01: -71
[ 104.483972][ T4642] Bluetooth: hci0: command tx timeout
[ 104.555544][ T37] greybus greybus1: 0/0:0: synchronous operation id 0x0002 of type 0x10 failed: -71
[ 104.555725][ T37] ------------[ cut here ]------------
[ 104.555732][ T37] ODEBUG: free active (active state 0) object: ffff88804546e878 object type: timer_list hint: gb_operation_timeout+0x0/0x110
[ 104.556069][ T37] WARNING: lib/debugobjects.c:632 at debug_print_object+0xec/0x230, CPU#0: kworker/u4:2/37
[ 104.572314][ T37] Modules linked in:
[ 104.574281][ T37] CPU: 0 UID: 0 PID: 37 Comm: kworker/u4:2 Not tainted syzkaller #0 PREEMPT(full)
[ 104.578276][ T37] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 104.582463][ T37] Workqueue: greybus1:svc gb_svc_process_deferred_request
[ 104.585730][ T37] RIP: 0010:debug_print_object+0x18a/0x230
[ 104.588299][ T37] Code: f8 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ff e8 cd 97 4c fd 4d 8b 0f 4c 89 ef 48 8b 74 24 08 48 89 ea 44 89 e1 4d 89 f0 ff 34 24 <67> 48 0f b9 3a 48 83 c4 08 ff 05 73 bf 8c 0c 48 83 c4 10 5b 41 5c
[ 104.596419][ T37] RSP: 0018:ffffc900003f77e0 EFLAGS: 00010246
[ 104.599066][ T37] RAX: 1ffffffff181f08c RBX: dffffc0000000000 RCX: 0000000000000000
[ 104.602427][ T37] RDX: ffffffff8c6df740 RSI: ffffffff8c6df1c0 RDI: ffffffff9185c030
[ 104.605801][ T37] RBP: ffffffff8c6df740 R08: ffff88804546e878 R09: ffffffff8c0f97c0
[ 104.609126][ T37] R10: dffffc0000000000 R11: ffffffff81b3f760 R12: 0000000000000000
[ 104.612577][ T37] R13: ffffffff9185c030 R14: ffff88804546e878 R15: ffffffff8c0f8460
[ 104.615648][ T37] FS: 0000000000000000(0000) GS:ffff88808b0b4000(0000) knlGS:0000000000000000
[ 104.619211][ T37] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 104.622176][ T37] CR2: 000055a0d34933f0 CR3: 0000000051df0000 CR4: 0000000000352ef0
[ 104.625137][ T37] Call Trace:
[ 104.626676][ T37]
[ 104.628016][ T37] ? __pfx_gb_operation_timeout+0x10/0x10
[ 104.630434][ T37] ? __pfx_gb_operation_timeout+0x10/0x10
[ 104.632445][ T37] debug_check_no_obj_freed+0x2e3/0x450
[ 104.634409][ T37] ? gb_operation_sync_timeout+0x1c7/0x270
[ 104.636555][ T37] kmem_cache_free+0xfd/0x650
[ 104.638399][ T37] gb_operation_sync_timeout+0x1c7/0x270
[ 104.640834][ T37] gb_svc_process_deferred_request+0x5f3/0x1150
[ 104.644332][ T37] ? __pfx_gb_svc_process_deferred_request+0x10/0x10
[ 104.646957][ T37] ? rcu_is_watching+0x16/0xb0
[ 104.648651][ T37] ? process_scheduled_works+0x97a/0x1630
[ 104.650759][ T37] process_scheduled_works+0xc3d/0x1630
[ 104.653063][ T37] ? __pfx_process_scheduled_works+0x10/0x10
[ 104.655702][ T37] ? assign_work+0x3cf/0x5d0
[ 104.657745][ T37] worker_thread+0xa47/0xfb0
[ 104.659839][ T37] kthread+0x38b/0x480
[ 104.661690][ T37] ? __pfx_worker_thread+0x10/0x10
[ 104.664056][ T37] ? __pfx_kthread+0x10/0x10
[ 104.666127][ T37] ret_from_fork+0x514/0xb70
[ 104.668175][ T37] ? __pfx_ret_from_fork+0x10/0x10
[ 104.670415][ T37] ? __switch_to+0xc89/0x1420
[ 104.672499][ T37] ? __pfx_kthread+0x10/0x10
[ 104.674473][ T37] ret_from_fork_asm+0x1a/0x30
[ 104.676534][ T37]
[ 104.677911][ T37] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 104.680975][ T37] CPU: 0 UID: 0 PID: 37 Comm: kworker/u4:2 Not tainted syzkaller #0 PREEMPT(full)
[ 104.684665][ T37] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 104.688865][ T37] Workqueue: greybus1:svc gb_svc_process_deferred_request
[ 104.691890][ T37] Call Trace:
[ 104.693329][ T37]
[ 104.694590][ T37] vpanic+0x56d/0xa60
[ 104.696306][ T37] ? __pfx__printk+0x10/0x10
[ 104.698279][ T37] ? __pfx_vpanic+0x10/0x10
[ 104.700263][ T37] ? is_bpf_text_address+0x292/0x2b0
[ 104.702547][ T37] ? is_bpf_text_address+0x26/0x2b0
[ 104.704736][ T37] panic+0xc5/0xd0
[ 104.706416][ T37] ? __pfx_panic+0x10/0x10
[ 104.708403][ T37] ? ret_from_fork_asm+0x1a/0x30
[ 104.710616][ T37] __warn+0x315/0x4c0
[ 104.712439][ T37] ? debug_print_object+0xec/0x230
[ 104.714507][ T37] ? debug_print_object+0xec/0x230
[ 104.716675][ T37] __report_bug+0x276/0x570
[ 104.718693][ T37] ? debug_print_object+0xec/0x230
[ 104.720943][ T37] ? __pfx___report_bug+0x10/0x10
[ 104.723161][ T37] ? debug_print_object+0x18f/0x230
[ 104.725480][ T37] report_bug_entry+0x19b/0x290
[ 104.727556][ T37] ? debug_print_object+0x18a/0x230
[ 104.729810][ T37] ? debug_print_object+0x18f/0x230
[ 104.732038][ T37] handle_bug+0xce/0x200
[ 104.733575][ T37] exc_invalid_op+0x1a/0x50
[ 104.735441][ T37] asm_exc_invalid_op+0x1a/0x20
[ 104.737862][ T37] RIP: 0010:debug_print_object+0x18a/0x230
[ 104.740817][ T37] Code: f8 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ff e8 cd 97 4c fd 4d 8b 0f 4c 89 ef 48 8b 74 24 08 48 89 ea 44 89 e1 4d 89 f0 ff 34 24 <67> 48 0f b9 3a 48 83 c4 08 ff 05 73 bf 8c 0c 48 83 c4 10 5b 41 5c
[ 104.748729][ T37] RSP: 0018:ffffc900003f77e0 EFLAGS: 00010246
[ 104.751059][ T37] RAX: 1ffffffff181f08c RBX: dffffc0000000000 RCX: 0000000000000000
[ 104.753874][ T37] RDX: ffffffff8c6df740 RSI: ffffffff8c6df1c0 RDI: ffffffff9185c030
[ 104.757100][ T37] RBP: ffffffff8c6df740 R08: ffff88804546e878 R09: ffffffff8c0f97c0
[ 104.759994][ T37] R10: dffffc0000000000 R11: ffffffff81b3f760 R12: 0000000000000000
[ 104.762845][ T37] R13: ffffffff9185c030 R14: ffff88804546e878 R15: ffffffff8c0f8460
[ 104.766145][ T37] ? __pfx_timer_debug_hint+0x10/0x10
[ 104.768204][ T37] ? __pfx_gb_operation_timeout+0x10/0x10
[ 104.770474][ T37] ? __pfx_gb_operation_timeout+0x10/0x10
[ 104.772857][ T37] debug_check_no_obj_freed+0x2e3/0x450
[ 104.775181][ T37] ? gb_operation_sync_timeout+0x1c7/0x270
[ 104.777468][ T37] kmem_cache_free+0xfd/0x650
[ 104.779278][ T37] gb_operation_sync_timeout+0x1c7/0x270
[ 104.781313][ T37] gb_svc_process_deferred_request+0x5f3/0x1150
[ 104.783719][ T37] ? __pfx_gb_svc_process_deferred_request+0x10/0x10
[ 104.786487][ T37] ? rcu_is_watching+0x16/0xb0
[ 104.788542][ T37] ? process_scheduled_works+0x97a/0x1630
[ 104.790876][ T37] process_scheduled_works+0xc3d/0x1630
[ 104.793087][ T37] ? __pfx_process_scheduled_works+0x10/0x10
[ 104.795374][ T37] ? assign_work+0x3cf/0x5d0
[ 104.797262][ T37] worker_thread+0xa47/0xfb0
[ 104.799182][ T37] kthread+0x38b/0x480
[ 104.800842][ T37] ? __pfx_worker_thread+0x10/0x10
[ 104.802803][ T37] ? __pfx_kthread+0x10/0x10
[ 104.804593][ T37] ret_from_fork+0x514/0xb70
[ 104.806452][ T37] ? __pfx_ret_from_fork+0x10/0x10
[ 104.808647][ T37] ? __switch_to+0xc89/0x1420
[ 104.810730][ T37] ? __pfx_kthread+0x10/0x10
[ 104.812733][ T37] ret_from_fork_asm+0x1a/0x30
[ 104.814873][ T37]
[ 104.816732][ T37] Kernel Offset: disabled
[ 104.818679][ T37] Rebooting in 86400 seconds..