------------[ cut here ]------------
NETDEV WATCHDOG: usb0 (cdc_ether): transmit queue 0 timed out 7040 ms
WARNING: CPU: 0 PID: 5526 at net/sched/sch_generic.c:525 dev_watchdog+0x8c7/0x8f0 net/sched/sch_generic.c:525
Modules linked in:
CPU: 0 PID: 5526 Comm: kworker/0:6 Not tainted 6.6.0-rc6-syzkaller-g5220d8b04a84 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023
Workqueue: usb_hub_wq hub_event
RIP: 0010:dev_watchdog+0x8c7/0x8f0 net/sched/sch_generic.c:525
Code: 8b 5c 24 10 c6 05 4f c0 c4 03 01 48 89 df e8 00 25 eb ff 45 89 e8 89 e9 48 89 de 48 89 c2 48 c7 c7 00 98 3c 87 e8 19 9a b4 fb <0f> 0b e9 2b fd ff ff e8 4d ef ea fb 0f 0b e9 c6 fc ff ff e8 21 64
RSP: 0018:ffffc90000007be0 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff888110370000 RCX: 0000000000000100
RDX: ffff8881178cd700 RSI: ffffffff81172206 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 00000000001e7f30 R12: ffff888117d7d800
R13: 0000000000001b80 R14: ffff888110370508 R15: 0000000100012e40
FS:  0000000000000000(0000) GS:ffff8881f6600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555560c6818 CR3: 0000000112029000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 call_timer_fn+0x19e/0x580 kernel/time/timer.c:1700
 expire_timers kernel/time/timer.c:1751 [inline]
 __run_timers+0x764/0xb10 kernel/time/timer.c:2022
 run_timer_softirq+0x58/0xd0 kernel/time/timer.c:2035
 __do_softirq+0x20b/0x94e kernel/softirq.c:553
 invoke_softirq kernel/softirq.c:427 [inline]
 __irq_exit_rcu kernel/softirq.c:632 [inline]
 irq_exit_rcu+0xa7/0x110 kernel/softirq.c:644
 sysvec_apic_timer_interrupt+0x8e/0xb0 arch/x86/kernel/apic/apic.c:1074
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:202
Code: 90 f3 0f 1e fa 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 ea ca e3 fa 48 89 df e8 e2 49 e4 fa e8 2d 7d 09 fb fb bf 01 00 00 00 <e8> 32 b7 d8 fa 65 8b 05 53 06 b9 79 85 c0 74 02 5b c3 0f 1f 44 00
RSP: 0018:ffffc9000255f6f0 EFLAGS: 00000202
RAX: 000000000010d491 RBX: ffffffff888e7320 RCX: 1ffffffff16e33dc
RDX: 0000000000000000 RSI: ffffffff8687c980 RDI: 0000000000000001
RBP: ffff888115682000 R08: 0000000000000001 R09: fffffbfff16ded42
R10: ffffffff8b6f6a17 R11: 0000000000000000 R12: ffff888115682018
R13: 00000000ffffff94 R14: dffffc0000000000 R15: ffff8881063e8000
 spin_unlock_irq include/linux/spinlock.h:401 [inline]
 usb_hcd_flush_endpoint+0x142/0x3e0 drivers/usb/core/hcd.c:1798
 usb_disable_endpoint drivers/usb/core/message.c:1300 [inline]
 usb_disable_interface+0x1ce/0x4c0 drivers/usb/core/message.c:1346
 usb_unbind_interface+0x3b7/0x8d0 drivers/usb/core/driver.c:456
 device_remove drivers/base/dd.c:569 [inline]
 device_remove+0x11f/0x170 drivers/base/dd.c:561
 __device_release_driver drivers/base/dd.c:1272 [inline]
 device_release_driver_internal+0x44a/0x610 drivers/base/dd.c:1295
 bus_remove_device+0x22c/0x420 drivers/base/bus.c:574
 device_del+0x39a/0xa50 drivers/base/core.c:3813
 usb_disable_device+0x36c/0x7f0 drivers/usb/core/message.c:1416
 usb_disconnect+0x2e1/0x910 drivers/usb/core/hub.c:2260
 hub_port_connect drivers/usb/core/hub.c:5303 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5603 [inline]
 port_event drivers/usb/core/hub.c:5763 [inline]
 hub_event+0x1be0/0x4f40 drivers/usb/core/hub.c:5845
 process_one_work+0x884/0x15c0 kernel/workqueue.c:2630
 process_scheduled_works kernel/workqueue.c:2703 [inline]
 worker_thread+0x8b9/0x1290 kernel/workqueue.c:2784
 kthread+0x33c/0x440 kernel/kthread.c:388
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
 </TASK>
----------------
Code disassembly (best guess):
   0:	90                   	nop
   1:	f3 0f 1e fa          	endbr64
   5:	53                   	push   %rbx
   6:	48 8b 74 24 08       	mov    0x8(%rsp),%rsi
   b:	48 89 fb             	mov    %rdi,%rbx
   e:	48 83 c7 18          	add    $0x18,%rdi
  12:	e8 ea ca e3 fa       	call   0xfae3cb01
  17:	48 89 df             	mov    %rbx,%rdi
  1a:	e8 e2 49 e4 fa       	call   0xfae44a01
  1f:	e8 2d 7d 09 fb       	call   0xfb097d51
  24:	fb                   	sti
  25:	bf 01 00 00 00       	mov    $0x1,%edi
* 2a:	e8 32 b7 d8 fa       	call   0xfad8b761 <-- trapping instruction
  2f:	65 8b 05 53 06 b9 79 	mov    %gs:0x79b90653(%rip),%eax        # 0x79b90689
  36:	85 c0                	test   %eax,%eax
  38:	74 02                	je     0x3c
  3a:	5b                   	pop    %rbx
  3b:	c3                   	ret
  3c:	0f                   	.byte 0xf
  3d:	1f                   	(bad)
  3e:	44                   	rex.R