general protection fault, probably for non-canonical address 0xdffffc00000000c9: 0000 [#1] SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000648-0x000000000000064f]
CPU: 1 PID: 78 Comm: kworker/1:3 Not tainted 5.8.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_pipe_endpoint include/linux/usb.h:1961 [inline]
RIP: 0010:usb_urb_ep_type_check+0xa2/0x190 drivers/usb/core/urb.c:206
Code: fd 48 81 c3 c8 05 00 00 e8 3b b4 c9 fd 89 e8 c1 e8 0f 83 e0 0f 48 8d 1c c3 48 b8 00 00 00 00 00 fc ff df 48 89 da 48 c1 ea 03 <80> 3c 02 00 0f 85 cf 00 00 00 48 8b 1b 48 85 db 0f 84 b1 00 00 00
RSP: 0018:ffff8881d40bef60 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000648 RCX: ffffffff8375efbb
RDX: 00000000000000c9 RSI: ffffffff8375efd5 RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff8881ca994d98 R14: ffff8881ca994008 R15: ffff8881ca994000
FS:  0000000000000000(0000) GS:ffff8881db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff1e97c6740 CR3: 00000001cae8c000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 submit_rx_urb+0x26/0x410 drivers/staging/wlan-ng/hfa384x_usb.c:328
 hfa384x_drvr_start+0x1cf/0x480 drivers/staging/wlan-ng/hfa384x_usb.c:2375
 prism2sta_ifstate+0x24e/0x510 drivers/staging/wlan-ng/prism2sta.c:471
 prism2sta_probe_usb.cold+0x13f/0x4c4 drivers/staging/wlan-ng/prism2usb.c:112
 usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:374
 really_probe+0x291/0xc90 drivers/base/dd.c:520
 driver_probe_device+0x26b/0x3d0 drivers/base/dd.c:696
 __device_attach_driver+0x1d1/0x290 drivers/base/dd.c:802
 bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:431
 __device_attach+0x28d/0x430 drivers/base/dd.c:868
 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:491
 device_add+0xb09/0x1c10 drivers/base/core.c:2700
 usb_set_configuration+0xf05/0x18a0 drivers/usb/core/message.c:2032
 usb_generic_driver_probe+0xba/0xf2 drivers/usb/core/generic.c:241
 usb_probe_device+0xd9/0x250 drivers/usb/core/driver.c:272
 really_probe+0x291/0xc90 drivers/base/dd.c:520
 driver_probe_device+0x26b/0x3d0 drivers/base/dd.c:696
 __device_attach_driver+0x1d1/0x290 drivers/base/dd.c:802
 bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:431
 __device_attach+0x28d/0x430 drivers/base/dd.c:868
 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:491
 device_add+0xb09/0x1c10 drivers/base/core.c:2700
 usb_new_device.cold+0x71d/0xfd4 drivers/usb/core/hub.c:2554
 hub_port_connect drivers/usb/core/hub.c:5208 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5348 [inline]
 port_event drivers/usb/core/hub.c:5494 [inline]
 hub_event+0x2361/0x4390 drivers/usb/core/hub.c:5576
 process_one_work+0x94c/0x15f0 kernel/workqueue.c:2269
 worker_thread+0x64c/0x1120 kernel/workqueue.c:2415
 kthread+0x392/0x470 kernel/kthread.c:291
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293
Modules linked in:
---[ end trace c896808aae96baaf ]---
RIP: 0010:usb_pipe_endpoint include/linux/usb.h:1961 [inline]
RIP: 0010:usb_urb_ep_type_check+0xa2/0x190 drivers/usb/core/urb.c:206
Code: fd 48 81 c3 c8 05 00 00 e8 3b b4 c9 fd 89 e8 c1 e8 0f 83 e0 0f 48 8d 1c c3 48 b8 00 00 00 00 00 fc ff df 48 89 da 48 c1 ea 03 <80> 3c 02 00 0f 85 cf 00 00 00 48 8b 1b 48 85 db 0f 84 b1 00 00 00
RSP: 0018:ffff8881d40bef60 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000648 RCX: ffffffff8375efbb
RDX: 00000000000000c9 RSI: ffffffff8375efd5 RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff8881ca994d98 R14: ffff8881ca994008 R15: ffff8881ca994000
FS:  0000000000000000(0000) GS:ffff8881db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff1e97c6740 CR3: 00000001cae8c000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400