program:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404c05c1060001010203010902200001010080fa0904000002ffffff000705810200020007050202000200"], 0x0)
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000100)="0000ff00ff00")
syz_usb_ep_write(r0, 0x81, 0x14, &(0x7f0000000106)="0000ffffff0a00f6d7290000000000000003fd00")
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000200)="0000ff00ff00")
syz_usb_ep_write(r0, 0x81, 0xd, &(0x7f0000000206)="0000ffffff0300fdd72b00fe00")
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000300)="0000ff00ff00")
syz_usb_ep_write(r0, 0x81, 0xe, &(0x7f0000000306)="0000ffffff0400fcd72101000700")
nanosleep(&(0x7f0000000400)={0x1}, 0x0)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000001000), r1)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000002000)={0x0, 0x0, &(0x7f0000002100)={&(0x7f0000002200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x1c}}, 0x0)
sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000003000)={0x0, 0x0, &(0x7f0000003100)={&(0x7f0000003200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000004000)={0x0, 0x0, &(0x7f0000004100)={&(0x7f0000004200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x1}]}, 0x1c}}, 0x0)
sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000005100)={&(0x7f0000005200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x1}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000006000)={0x0, 0x0, &(0x7f0000006100)={&(0x7f0000006200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x2}]}, 0x1c}}, 0x0)
sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000007100)={&(0x7f0000007200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x2}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0)
[ 92.741692][ T1379] cfg80211: failed to load regulatory.db
[ 92.781901][ T5287] Bluetooth: hci0: command tx timeout
[ 93.030240][ T5311] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 93.186388][ T5311] usb 5-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice= 1.00
[ 93.190356][ T5311] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 93.193811][ T5311] usb 5-1: Product: syz
[ 93.195618][ T5311] usb 5-1: Manufacturer: syz
[ 93.197713][ T5311] usb 5-1: SerialNumber: syz
[ 93.617581][ T5311] ------------[ cut here ]------------
[ 93.620020][ T5311] URB ffff888042d82700 submitted while active
[ 93.622634][ T5311] WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x79/0x18b0, CPU#0: kworker/0:5/5311
[ 93.627050][ T5311] Modules linked in:
[ 93.628947][ T5311] CPU: 0 UID: 0 PID: 5311 Comm: kworker/0:5 Not tainted syzkaller #0 PREEMPT(full)
[ 93.633363][ T5311] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 93.637712][ T5311] Workqueue: usb_hub_wq hub_event
[ 93.639411][ T5311] RIP: 0010:usb_submit_urb+0x7c/0x18b0
[ 93.641504][ T5311] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 79 40 d3 fa 49 83 3e 00 74 40 e8 ce 0d 64 fa 48 8d 3d 07 a0 02 09 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 b3 0d 64 fa eb 05 e8 ac 0d
[ 93.648193][ T5311] RSP: 0018:ffffc9000e49eb80 EFLAGS: 00010293
[ 93.650580][ T5311] RAX: ffffffff876314f2 RBX: ffff888042d82700 RCX: ffff8880003ca540
[ 93.653608][ T5311] RDX: 0000000000000000 RSI: ffff888042d82700 RDI: ffffffff9065b500
[ 93.656467][ T5311] RBP: dffffc0000000000 R08: ffffffff9057c237 R09: 1ffffffff20af846
[ 93.659069][ T5311] R10: dffffc0000000000 R11: fffffbfff20af847 R12: ffff88803fc96058
[ 93.662083][ T5311] R13: 1ffff11007f92c0b R14: ffff888042d82708 R15: 0000000000000cc0
[ 93.664936][ T5311] FS: 0000000000000000(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000
[ 93.668036][ T5311] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 93.670387][ T5311] CR2: 00007f96730157f0 CR3: 000000001260b000 CR4: 0000000000352ef0
[ 93.673191][ T5311] Call Trace:
[ 93.674460][ T5311]
[ 93.675577][ T5311] ? __kmalloc_cache_noprof+0x150/0x660
[ 93.677619][ T5311] ? port100_send_cmd_async+0xbd/0xcc0
[ 93.679638][ T5311] ? skb_put+0x112/0x210
[ 93.681330][ T5311] port100_send_cmd_async+0x84f/0xcc0
[ 93.683251][ T5311] port100_set_command_type+0x1c8/0x390
[ 93.685282][ T5311] ? pcpu_alloc+0x10/0x310
[ 93.687015][ T5311] ? __pfx_port100_set_command_type+0x10/0x10
[ 93.689231][ T5311] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 93.691335][ T5311] port100_probe+0x7b2/0xba0
[ 93.693094][ T5311] ? __pfx_port100_probe+0x10/0x10
[ 93.694999][ T5311] ? lockdep_hardirqs_on+0x7a/0x110
[ 93.696867][ T5311] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 93.698942][ T5311] ? __pm_runtime_set_status+0x994/0xc80
[ 93.700988][ T5311] usb_probe_interface+0x653/0xc60
[ 93.702833][ T5311] ? __pfx_usb_probe_interface+0x10/0x10
[ 93.704831][ T5311] really_probe+0x254/0xae0
[ 93.706507][ T5311] __driver_probe_device+0x1e8/0x360
[ 93.708406][ T5311] driver_probe_device+0x4f/0x240
[ 93.710298][ T5311] __device_attach_driver+0x270/0x410
[ 93.712241][ T5311] bus_for_each_drv+0x258/0x2f0
[ 93.713993][ T5311] ? __pfx___device_attach_driver+0x10/0x10
[ 93.716099][ T5311] ? __pfx_bus_for_each_drv+0x10/0x10
[ 93.717960][ T5311] ? lockdep_hardirqs_on+0x7a/0x110
[ 93.719867][ T5311] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 93.721997][ T5311] __device_attach+0x2c4/0x450
[ 93.723780][ T5311] ? __pfx___device_attach+0x10/0x10
[ 93.725682][ T5311] ? do_raw_spin_unlock+0x4d/0x210
[ 93.727526][ T5311] ? _raw_spin_unlock+0x28/0x50
[ 93.729326][ T5311] device_initial_probe+0xa1/0xd0
[ 93.731162][ T5311] bus_probe_device+0x12a/0x220
[ 93.733039][ T5311] device_add+0x7d7/0xb80
[ 93.734972][ T5311] usb_set_configuration+0x1ad8/0x2180
[ 93.736932][ T5311] usb_generic_driver_probe+0x8d/0x150
[ 93.738804][ T5311] usb_probe_device+0x1c3/0x3b0
[ 93.741902][ T5311] ? __pfx_usb_probe_device+0x10/0x10
[ 93.743886][ T5311] really_probe+0x254/0xae0
[ 93.745536][ T5311] __driver_probe_device+0x1e8/0x360
[ 93.747498][ T5311] driver_probe_device+0x4f/0x240
[ 93.749388][ T5311] __device_attach_driver+0x270/0x410
[ 93.751460][ T5311] bus_for_each_drv+0x258/0x2f0
[ 93.753297][ T5311] ? __pfx___device_attach_driver+0x10/0x10
[ 93.755434][ T5311] ? __pfx_bus_for_each_drv+0x10/0x10
[ 93.757430][ T5311] ? lockdep_hardirqs_on+0x7a/0x110
[ 93.759310][ T5311] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 93.761434][ T5311] __device_attach+0x2c4/0x450
[ 93.763137][ T5311] ? __pfx___device_attach+0x10/0x10
[ 93.765187][ T5311] ? do_raw_spin_unlock+0x4d/0x210
[ 93.767457][ T5311] ? _raw_spin_unlock+0x28/0x50
[ 93.769636][ T5311] device_initial_probe+0xa1/0xd0
[ 93.771931][ T5311] bus_probe_device+0x12a/0x220
[ 93.774103][ T5311] device_add+0x7d7/0xb80
[ 93.776048][ T5311] usb_new_device+0x99d/0x1620
[ 93.778153][ T5311] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 93.780778][ T5311] ? __pfx_usb_new_device+0x10/0x10
[ 93.783113][ T5311] ? _raw_spin_unlock_irq+0x23/0x50
[ 93.785368][ T5311] hub_event+0x28e8/0x4d30
[ 93.787327][ T5311] ? do_raw_spin_unlock+0x4d/0x210
[ 93.789570][ T5311] ? __pfx_hub_event+0x10/0x10
[ 93.791629][ T5311] ? process_scheduled_works+0xa20/0x14e0
[ 93.794064][ T5311] ? rcu_is_watching+0x15/0xb0
[ 93.796005][ T5311] ? process_scheduled_works+0xa20/0x14e0
[ 93.797872][ T5311] process_scheduled_works+0xa8e/0x14e0
[ 93.799984][ T5311] ? __pfx_process_scheduled_works+0x10/0x10
[ 93.802831][ T5311] ? assign_work+0x3cf/0x5d0
[ 93.804846][ T5311] worker_thread+0xa47/0xfb0
[ 93.806866][ T5311] ? __kthread_parkme+0x71/0x1f0
[ 93.808982][ T5311] kthread+0x388/0x470
[ 93.810763][ T5311] ? __pfx_worker_thread+0x10/0x10
[ 93.812934][ T5311] ? __pfx_kthread+0x10/0x10
[ 93.814942][ T5311] ret_from_fork+0x514/0xb70
[ 93.817009][ T5311] ? __pfx_ret_from_fork+0x10/0x10
[ 93.819216][ T5311] ? __switch_to+0xc89/0x1420
[ 93.821850][ T5311] ? __pfx_kthread+0x10/0x10
[ 93.823832][ T5311] ret_from_fork_asm+0x1a/0x30
[ 93.825878][ T5311]
[ 93.827238][ T5311] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 93.830245][ T5311] CPU: 0 UID: 0 PID: 5311 Comm: kworker/0:5 Not tainted syzkaller #0 PREEMPT(full)
[ 93.834032][ T5311] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 93.838162][ T5311] Workqueue: usb_hub_wq hub_event
[ 93.840303][ T5311] Call Trace:
[ 93.841707][ T5311]
[ 93.842947][ T5311] vpanic+0x56c/0xa60
[ 93.844605][ T5311] ? __pfx__printk+0x10/0x10
[ 93.846407][ T5311] ? __pfx_vpanic+0x10/0x10
[ 93.848073][ T5311] ? is_bpf_text_address+0x292/0x2b0
[ 93.850170][ T5311] ? is_bpf_text_address+0x26/0x2b0
[ 93.852434][ T5311] panic+0xc5/0xd0
[ 93.854043][ T5311] ? __pfx_panic+0x10/0x10
[ 93.855966][ T5311] ? ret_from_fork_asm+0x1a/0x30
[ 93.858008][ T5311] __warn+0x315/0x4c0
[ 93.859664][ T5311] ? usb_submit_urb+0x79/0x18b0
[ 93.861784][ T5311] ? usb_submit_urb+0x79/0x18b0
[ 93.863881][ T5311] __report_bug+0x276/0x570
[ 93.865816][ T5311] ? kasan_save_track+0x4f/0x80
[ 93.867852][ T5311] ? kasan_save_track+0x3e/0x80
[ 93.869832][ T5311] ? usb_submit_urb+0x79/0x18b0
[ 93.871891][ T5311] ? __pfx___report_bug+0x10/0x10
[ 93.874017][ T5311] ? __pfx___mutex_trylock_common+0x10/0x10
[ 93.876522][ T5311] ? rcu_is_watching+0x15/0xb0
[ 93.878503][ T5311] ? trace_contention_end+0x3d/0x140
[ 93.880752][ T5311] report_bug_entry+0x19a/0x290
[ 93.882786][ T5311] ? usb_submit_urb+0x7c/0x18b0
[ 93.884825][ T5311] ? usb_submit_urb+0x81/0x18b0
[ 93.886897][ T5311] handle_bug+0xce/0x200
[ 93.888445][ T5311] exc_invalid_op+0x1a/0x50
[ 93.890129][ T5311] asm_exc_invalid_op+0x1a/0x20
[ 93.892011][ T5311] RIP: 0010:usb_submit_urb+0x7c/0x18b0
[ 93.894076][ T5311] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 79 40 d3 fa 49 83 3e 00 74 40 e8 ce 0d 64 fa 48 8d 3d 07 a0 02 09 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 b3 0d 64 fa eb 05 e8 ac 0d
[ 93.901363][ T5311] RSP: 0018:ffffc9000e49eb80 EFLAGS: 00010293
[ 93.903477][ T5311] RAX: ffffffff876314f2 RBX: ffff888042d82700 RCX: ffff8880003ca540
[ 93.906282][ T5311] RDX: 0000000000000000 RSI: ffff888042d82700 RDI: ffffffff9065b500
[ 93.909032][ T5311] RBP: dffffc0000000000 R08: ffffffff9057c237 R09: 1ffffffff20af846
[ 93.911740][ T5311] R10: dffffc0000000000 R11: fffffbfff20af847 R12: ffff88803fc96058
[ 93.914522][ T5311] R13: 1ffff11007f92c0b R14: ffff888042d82708 R15: 0000000000000cc0
[ 93.917242][ T5311] ? usb_submit_urb+0x72/0x18b0
[ 93.918958][ T5311] ? __kmalloc_cache_noprof+0x150/0x660
[ 93.921040][ T5311] ? port100_send_cmd_async+0xbd/0xcc0
[ 93.923174][ T5311] ? skb_put+0x112/0x210
[ 93.924865][ T5311] port100_send_cmd_async+0x84f/0xcc0
[ 93.926936][ T5311] port100_set_command_type+0x1c8/0x390
[ 93.929162][ T5311] ? pcpu_alloc+0x10/0x310
[ 93.930927][ T5311] ? __pfx_port100_set_command_type+0x10/0x10
[ 93.933353][ T5311] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 93.935605][ T5311] port100_probe+0x7b2/0xba0
[ 93.937367][ T5311] ? __pfx_port100_probe+0x10/0x10
[ 93.939259][ T5311] ? lockdep_hardirqs_on+0x7a/0x110
[ 93.941243][ T5311] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 93.943649][ T5311] ? __pm_runtime_set_status+0x994/0xc80
[ 93.946011][ T5311] usb_probe_interface+0x653/0xc60
[ 93.948448][ T5311] ? __pfx_usb_probe_interface+0x10/0x10
[ 93.951256][ T5311] really_probe+0x254/0xae0
[ 93.953562][ T5311] __driver_probe_device+0x1e8/0x360
[ 93.956010][ T5311] driver_probe_device+0x4f/0x240
[ 93.958131][ T5311] __device_attach_driver+0x270/0x410
[ 93.960397][ T5311] bus_for_each_drv+0x258/0x2f0
[ 93.962439][ T5311] ? __pfx___device_attach_driver+0x10/0x10
[ 93.964941][ T5311] ? __pfx_bus_for_each_drv+0x10/0x10
[ 93.966976][ T5311] ? lockdep_hardirqs_on+0x7a/0x110
[ 93.969160][ T5311] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 93.971551][ T5311] __device_attach+0x2c4/0x450
[ 93.973816][ T5311] ? __pfx___device_attach+0x10/0x10
[ 93.976242][ T5311] ? do_raw_spin_unlock+0x4d/0x210
[ 93.978370][ T5311] ? _raw_spin_unlock+0x28/0x50
[ 93.980382][ T5311] device_initial_probe+0xa1/0xd0
[ 93.982464][ T5311] bus_probe_device+0x12a/0x220
[ 93.984458][ T5311] device_add+0x7d7/0xb80
[ 93.986280][ T5311] usb_set_configuration+0x1ad8/0x2180
[ 93.988598][ T5311] usb_generic_driver_probe+0x8d/0x150
[ 93.990909][ T5311] usb_probe_device+0x1c3/0x3b0
[ 93.992968][ T5311] ? __pfx_usb_probe_device+0x10/0x10
[ 93.995201][ T5311] really_probe+0x254/0xae0
[ 93.997036][ T5311] __driver_probe_device+0x1e8/0x360
[ 93.999142][ T5311] driver_probe_device+0x4f/0x240
[ 94.001167][ T5311] __device_attach_driver+0x270/0x410
[ 94.003353][ T5311] bus_for_each_drv+0x258/0x2f0
[ 94.005336][ T5311] ? __pfx___device_attach_driver+0x10/0x10
[ 94.007761][ T5311] ? __pfx_bus_for_each_drv+0x10/0x10
[ 94.009964][ T5311] ? lockdep_hardirqs_on+0x7a/0x110
[ 94.012121][ T5311] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 94.014552][ T5311] __device_attach+0x2c4/0x450
[ 94.016626][ T5311] ? __pfx___device_attach+0x10/0x10
[ 94.018839][ T5311] ? do_raw_spin_unlock+0x4d/0x210
[ 94.021040][ T5311] ? _raw_spin_unlock+0x28/0x50
[ 94.023121][ T5311] device_initial_probe+0xa1/0xd0
[ 94.025284][ T5311] bus_probe_device+0x12a/0x220
[ 94.027356][ T5311] device_add+0x7d7/0xb80
[ 94.028896][ T5311] usb_new_device+0x99d/0x1620
[ 94.030469][ T5311] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 94.032617][ T5311] ? __pfx_usb_new_device+0x10/0x10
[ 94.034335][ T5311] ? _raw_spin_unlock_irq+0x23/0x50
[ 94.036076][ T5311] hub_event+0x28e8/0x4d30
[ 94.037521][ T5311] ? do_raw_spin_unlock+0x4d/0x210
[ 94.039189][ T5311] ? __pfx_hub_event+0x10/0x10
[ 94.040793][ T5311] ? process_scheduled_works+0xa20/0x14e0
[ 94.042704][ T5311] ? rcu_is_watching+0x15/0xb0
[ 94.044285][ T5311] ? process_scheduled_works+0xa20/0x14e0
[ 94.046177][ T5311] process_scheduled_works+0xa8e/0x14e0
[ 94.047967][ T5311] ? __pfx_process_scheduled_works+0x10/0x10
[ 94.049878][ T5311] ? assign_work+0x3cf/0x5d0
[ 94.051385][ T5311] worker_thread+0xa47/0xfb0
[ 94.052900][ T5311] ? __kthread_parkme+0x71/0x1f0
[ 94.054509][ T5311] kthread+0x388/0x470
[ 94.055893][ T5311] ? __pfx_worker_thread+0x10/0x10
[ 94.057870][ T5311] ? __pfx_kthread+0x10/0x10
[ 94.059521][ T5311] ret_from_fork+0x514/0xb70
[ 94.061086][ T5311] ? __pfx_ret_from_fork+0x10/0x10
[ 94.062816][ T5311] ? __switch_to+0xc89/0x1420
[ 94.064436][ T5311] ? __pfx_kthread+0x10/0x10
[ 94.066003][ T5311] ret_from_fork_asm+0x1a/0x30
[ 94.067594][ T5311]
[ 94.068988][ T5311] Kernel Offset: disabled
[ 94.070426][ T5311] Rebooting in 86400 seconds..