program:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
r2 = io_uring_setup(0x18ef, &(0x7f0000000000)={0x0, 0x0, 0x40})
io_uring_register$IORING_REGISTER_FILES(r2, 0x2, &(0x7f00000001c0), 0x0) (async)
io_uring_register$IORING_REGISTER_FILES(r2, 0x2, &(0x7f00000001c0), 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000000c0), 0x106, 0x1}}, 0x20) (async)
write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000000c0), 0x106, 0x1}}, 0x20)
r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0)
r4 = dup(r3)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000021002101000000000000dc000a000000000000000000000008001a"], 0x24}}, 0x0)
r5 = socket$netlink(0x10, 0x3, 0x0)
sendmmsg(r5, &(0x7f00000002c0), 0x40000000000009f, 0x0)
r6 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0)
syz_usb_ep_read(r6, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r6, 0x1, 0x0, 0x0)
syz_usb_ep_write(r6, 0x81, 0x40, &(0x7f0000000100)="900100"/64)
syz_usb_ep_read(r6, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r6, 0x1, 0x0, 0x0)
syz_usb_ep_write(r6, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64)
syz_usb_ep_read(r6, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r6, 0x1, 0x0, 0x0)
syz_usb_ep_read(r6, 0x1, 0x0, 0x0)
syz_usb_ep_write(r6, 0x81, 0x0, 0x0)
syz_usb_ep_write(r6, 0x81, 0x40, &(0x7f0000000900)="880100"/64) (async)
syz_usb_ep_write(r6, 0x81, 0x40, &(0x7f0000000900)="880100"/64)
r7 = memfd_create(&(0x7f0000000040)=')$}\xc0\x00', 0x4)
timerfd_gettime(r7, 0x0)
syz_usb_ep_write(r6, 0x81, 0x40, &(0x7f0000000a00)="880100"/64)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000e00)='./sys\x00', &(0x7f0000000f00)='sysfs\x00', 0x0, 0x0) (async)
mount(0x0, &(0x7f0000000e00)='./sys\x00', &(0x7f0000000f00)='sysfs\x00', 0x0, 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./sys/devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/adsl_state\x00', 0x2, 0x0)
write(r8, &(0x7f0000001200)='stop', 0x4) (async)
write(r8, &(0x7f0000001200)='stop', 0x4)
syz_usb_ep_read(r6, 0x1, 0x0, 0x0)
syz_kvm_setup_syzos_vm$x86(r4, &(0x7f0000951000/0x400000)=nil) (async)
syz_kvm_setup_syzos_vm$x86(r4, &(0x7f0000951000/0x400000)=nil)
sendmsg$nl_route_sched(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newtaction={0x6c, 0x30, 0xcac229faa96ee7df, 0x0, 0x1, {}, [{0x58, 0x1, [@m_ife={0x54, 0x1f, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x3, 0x10000000}, 0x1}}, @TCA_IFE_METALST={0xc, 0x6, [@IFE_META_TCINDEX={0x6, 0x5, @val=0x8}]}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x6c}, 0x1, 0x500}, 0x0) (async)
sendmsg$nl_route_sched(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newtaction={0x6c, 0x30, 0xcac229faa96ee7df, 0x0, 0x1, {}, [{0x58, 0x1, [@m_ife={0x54, 0x1f, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x3, 0x10000000}, 0x1}}, @TCA_IFE_METALST={0xc, 0x6, [@IFE_META_TCINDEX={0x6, 0x5, @val=0x8}]}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x6c}, 0x1, 0x500}, 0x0)
socket$unix(0x1, 0x5, 0x0)
[ 118.224333][ T5332] Zero length message leads to an empty skb
[ 118.467727][ T1378] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 118.620281][ T1378] usb 5-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00
[ 118.624068][ T1378] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 119.259017][ T1378] cxacru 5-1:1.0: invalid response length to cm 0x84: 0
[ 119.262690][ T1378] ATM dev 0: cxacru_atm_start: CHIP_ADSL_LINE_START returned -5
[ 119.458800][ T1378] ATM dev 0: ADSL state: running
[ 119.463284][ T1378] ATM dev 0: ADSL line: down
[ 121.868529][ T5334] cxacru 5-1:1.0: send of cm 0x85 failed (-104)
[ 121.873736][ T5334] ATM dev 0: change adsl state: CHIP_ADSL_LINE_STOP returned -104
[ 123.947791][ T5316] cxacru 5-1:1.0: send of cm 0x88 failed (-104)
[ 123.953231][ T5332] ------------[ cut here ]------------
[ 123.955764][ T5332] URB ffff888033179300 submitted while active
[ 123.958258][ T5332] WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x79/0x18b0, CPU#0: syz.0.0/5332
[ 123.961873][ T5332] Modules linked in:
[ 123.963724][ T5332] CPU: 0 UID: 0 PID: 5332 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 123.967699][ T5332] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 123.972178][ T5332] RIP: 0010:usb_submit_urb+0x7c/0x18b0
[ 123.974693][ T5332] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 59 ca d2 fa 49 83 3e 00 74 40 e8 ae 97 63 fa 48 8d 3d 17 27 02 09 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 93 97 63 fa eb 05 e8 8c 97
[ 123.982818][ T5332] RSP: 0018:ffffc9000e22f8f8 EFLAGS: 00010293
[ 123.985610][ T5332] RAX: ffffffff87638d72 RBX: ffff888033179300 RCX: ffff888000a3a540
[ 123.989175][ T5332] RDX: 0000000000000000 RSI: ffff888033179300 RDI: ffffffff9065b490
[ 123.992575][ T5332] RBP: dffffc0000000000 R08: 0000000000000002 R09: 0000000000000000
[ 123.996082][ T5332] R10: dffffc0000000000 R11: fffffbfff20af847 R12: 0000000000000040
[ 123.999539][ T5332] R13: 0000000000000000 R14: ffff888033179308 R15: 0000000000000cc0
[ 124.002959][ T5332] FS: 00007faee3b106c0(0000) GS:ffff88808c53f000(0000) knlGS:0000000000000000
[ 124.006956][ T5332] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 124.010061][ T5332] CR2: 000055557893ba58 CR3: 0000000043862000 CR4: 0000000000352ef0
[ 124.013710][ T5332] Call Trace:
[ 124.015312][ T5332]
[ 124.016579][ T5332] ? __raw_spin_lock_init+0x45/0x100
[ 124.018717][ T5332] ? __init_swait_queue_head+0xa8/0x150
[ 124.020894][ T5332] cxacru_cm+0x21a/0xf10
[ 124.022717][ T5332] ? rcu_is_watching+0x15/0xb0
[ 124.024695][ T5332] ? __pfx_cxacru_cm+0x10/0x10
[ 124.026655][ T5332] ? adsl_state_store+0x133/0x770
[ 124.028713][ T5332] ? __pfx___mutex_lock+0x10/0x10
[ 124.030697][ T5332] ? bpf_lsm_capable+0x9/0x20
[ 124.032531][ T5332] ? security_capable+0x7e/0x2c0
[ 124.034827][ T5332] ? adsl_state_store+0x13e/0x770
[ 124.037090][ T5332] adsl_state_store+0x208/0x770
[ 124.039284][ T5332] ? sysfs_file_kobj+0x1a/0x230
[ 124.041340][ T5332] ? __pfx_adsl_state_store+0x10/0x10
[ 124.043568][ T5332] ? sysfs_file_kobj+0x1e4/0x230
[ 124.045515][ T5332] ? sysfs_kf_write+0x166/0x260
[ 124.047398][ T5332] ? __pfx_sysfs_kf_write+0x10/0x10
[ 124.049548][ T5332] kernfs_fop_write_iter+0x3a4/0x540
[ 124.051713][ T5332] vfs_write+0x612/0xba0
[ 124.053356][ T5332] ? __pfx_vfs_write+0x10/0x10
[ 124.055592][ T5332] ? __fget_files+0x2a/0x420
[ 124.057627][ T5332] ksys_write+0x150/0x270
[ 124.059582][ T5332] ? __pfx_ksys_write+0x10/0x10
[ 124.061649][ T5332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 124.064180][ T5332] do_syscall_64+0x174/0x580
[ 124.066080][ T5332] ? clear_bhb_loop+0x40/0x90
[ 124.068069][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 124.070508][ T5332] RIP: 0033:0x7faee2b9e019
[ 124.072336][ T5332] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 124.080377][ T5332] RSP: 002b:00007faee3b0ffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 124.084021][ T5332] RAX: ffffffffffffffda RBX: 00007faee2e25fa0 RCX: 00007faee2b9e019
[ 124.087477][ T5332] RDX: 0000000000000004 RSI: 0000200000001200 RDI: 000000000000000b
[ 124.091023][ T5332] RBP: 00007faee2c3500c R08: 0000000000000000 R09: 0000000000000000
[ 124.094476][ T5332] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 124.097992][ T5332] R13: 00007faee2e26038 R14: 00007faee2e25fa0 R15: 00007ffdf1d9f3c8
[ 124.101459][ T5332]
[ 124.102924][ T5332] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 124.105852][ T5332] CPU: 0 UID: 0 PID: 5332 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 124.109602][ T5332] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 124.113709][ T5332] Call Trace:
[ 124.115220][ T5332]
[ 124.116464][ T5332] vpanic+0x56c/0xa60
[ 124.118219][ T5332] ? __pfx__printk+0x10/0x10
[ 124.120240][ T5332] ? __pfx_vpanic+0x10/0x10
[ 124.122259][ T5332] ? is_bpf_text_address+0x292/0x2b0
[ 124.124659][ T5332] ? is_bpf_text_address+0x26/0x2b0
[ 124.126837][ T5332] panic+0xc5/0xd0
[ 124.128513][ T5332] ? __pfx_panic+0x10/0x10
[ 124.130468][ T5332] __warn+0x315/0x4c0
[ 124.132090][ T5332] ? usb_submit_urb+0x79/0x18b0
[ 124.134085][ T5332] ? usb_submit_urb+0x79/0x18b0
[ 124.136044][ T5332] __report_bug+0x276/0x570
[ 124.137863][ T5332] ? usb_submit_urb+0x79/0x18b0
[ 124.139812][ T5332] ? __pfx___report_bug+0x10/0x10
[ 124.141818][ T5332] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 124.144238][ T5332] report_bug_entry+0x19a/0x290
[ 124.146231][ T5332] ? usb_submit_urb+0x7c/0x18b0
[ 124.148405][ T5332] ? usb_submit_urb+0x81/0x18b0
[ 124.150521][ T5332] handle_bug+0xce/0x200
[ 124.152369][ T5332] exc_invalid_op+0x1a/0x50
[ 124.154430][ T5332] asm_exc_invalid_op+0x1a/0x20
[ 124.156573][ T5332] RIP: 0010:usb_submit_urb+0x7c/0x18b0
[ 124.158889][ T5332] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 59 ca d2 fa 49 83 3e 00 74 40 e8 ae 97 63 fa 48 8d 3d 17 27 02 09 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 93 97 63 fa eb 05 e8 8c 97
[ 124.167153][ T5332] RSP: 0018:ffffc9000e22f8f8 EFLAGS: 00010293
[ 124.169793][ T5332] RAX: ffffffff87638d72 RBX: ffff888033179300 RCX: ffff888000a3a540
[ 124.173104][ T5332] RDX: 0000000000000000 RSI: ffff888033179300 RDI: ffffffff9065b490
[ 124.176513][ T5332] RBP: dffffc0000000000 R08: 0000000000000002 R09: 0000000000000000
[ 124.179903][ T5332] R10: dffffc0000000000 R11: fffffbfff20af847 R12: 0000000000000040
[ 124.183311][ T5332] R13: 0000000000000000 R14: ffff888033179308 R15: 0000000000000cc0
[ 124.186782][ T5332] ? usb_submit_urb+0x72/0x18b0
[ 124.188915][ T5332] ? usb_submit_urb+0x72/0x18b0
[ 124.191113][ T5332] ? __raw_spin_lock_init+0x45/0x100
[ 124.192988][ T5332] ? __init_swait_queue_head+0xa8/0x150
[ 124.197235][ T5332] cxacru_cm+0x21a/0xf10
[ 124.199143][ T5332] ? rcu_is_watching+0x15/0xb0
[ 124.201128][ T5332] ? __pfx_cxacru_cm+0x10/0x10
[ 124.203237][ T5332] ? adsl_state_store+0x133/0x770
[ 124.205501][ T5332] ? __pfx___mutex_lock+0x10/0x10
[ 124.207642][ T5332] ? bpf_lsm_capable+0x9/0x20
[ 124.209290][ T5332] ? security_capable+0x7e/0x2c0
[ 124.211033][ T5332] ? adsl_state_store+0x13e/0x770
[ 124.213052][ T5332] adsl_state_store+0x208/0x770
[ 124.214657][ T5332] ? sysfs_file_kobj+0x1a/0x230
[ 124.216209][ T5332] ? __pfx_adsl_state_store+0x10/0x10
[ 124.217885][ T5332] ? sysfs_file_kobj+0x1e4/0x230
[ 124.219459][ T5332] ? sysfs_kf_write+0x166/0x260
[ 124.221214][ T5332] ? __pfx_sysfs_kf_write+0x10/0x10
[ 124.223132][ T5332] kernfs_fop_write_iter+0x3a4/0x540
[ 124.224956][ T5332] vfs_write+0x612/0xba0
[ 124.226343][ T5332] ? __pfx_vfs_write+0x10/0x10
[ 124.228009][ T5332] ? __fget_files+0x2a/0x420
[ 124.229711][ T5332] ksys_write+0x150/0x270
[ 124.231346][ T5332] ? __pfx_ksys_write+0x10/0x10
[ 124.233239][ T5332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 124.235698][ T5332] do_syscall_64+0x174/0x580
[ 124.237783][ T5332] ? clear_bhb_loop+0x40/0x90
[ 124.239886][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 124.242430][ T5332] RIP: 0033:0x7faee2b9e019
[ 124.244424][ T5332] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 124.251990][ T5332] RSP: 002b:00007faee3b0ffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 124.255390][ T5332] RAX: ffffffffffffffda RBX: 00007faee2e25fa0 RCX: 00007faee2b9e019
[ 124.258596][ T5332] RDX: 0000000000000004 RSI: 0000200000001200 RDI: 000000000000000b
[ 124.261768][ T5332] RBP: 00007faee2c3500c R08: 0000000000000000 R09: 0000000000000000
[ 124.265145][ T5332] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 124.268462][ T5332] R13: 00007faee2e26038 R14: 00007faee2e25fa0 R15: 00007ffdf1d9f3c8
[ 124.271745][ T5332]
[ 124.273305][ T5332] Kernel Offset: disabled
[ 124.275140][ T5332] Rebooting in 86400 seconds..