program:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404c05c1060001010203010902200001010080fa0904000002ffffff000705810200020007050202000200"], 0x0)
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000100)="0000ff00ff00")
syz_usb_ep_write(r0, 0x81, 0x14, &(0x7f0000000106)="0000ffffff0a00f6d7290000000000000003fd00")
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000200)="0000ff00ff00")
syz_usb_ep_write(r0, 0x81, 0xd, &(0x7f0000000206)="0000ffffff0300fdd72b00fe00")
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000300)="0000ff00ff00")
syz_usb_ep_write(r0, 0x81, 0xe, &(0x7f0000000306)="0000ffffff0400fcd72101000700")
nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000001000), r1)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000002000)={0x0, 0x0, &(0x7f0000002100)={&(0x7f0000002200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x1c}}, 0x0)
sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000003000)={0x0, 0x0, &(0x7f0000003100)={&(0x7f0000003200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000004000)={0x0, 0x0, &(0x7f0000004100)={&(0x7f0000004200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x1}]}, 0x1c}}, 0x0)
sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000005100)={&(0x7f0000005200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x1}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000006000)={0x0, 0x0, &(0x7f0000006100)={&(0x7f0000006200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x2}]}, 0x1c}}, 0x0)
sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000007100)={&(0x7f0000007200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x2}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0)
syz_usb_disconnect(r0) (async)
[ 86.969397][ T4648] Bluetooth: hci0: command tx timeout
[ 87.303636][ T9] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 87.459173][ T9] usb 5-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice= 1.00
[ 87.463199][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 87.466542][ T9] usb 5-1: Product: syz
[ 87.468351][ T9] usb 5-1: Manufacturer: syz
[ 87.470385][ T9] usb 5-1: SerialNumber: syz
[ 87.887084][ T9] ------------[ cut here ]------------
[ 87.889609][ T9] URB ffff888044873300 submitted while active
[ 87.892203][ T9] WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x79/0x18b0, CPU#0: kworker/0:0/9
[ 87.896483][ T9] Modules linked in:
[ 87.898148][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full)
[ 87.901150][ T9] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 87.904448][ T9] Workqueue: usb_hub_wq hub_event
[ 87.906150][ T9] RIP: 0010:usb_submit_urb+0x7c/0x18b0
[ 87.907995][ T9] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 79 40 d3 fa 49 83 3e 00 74 40 e8 ce 0d 64 fa 48 8d 3d 07 a0 02 09 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 b3 0d 64 fa eb 05 e8 ac 0d
[ 87.915012][ T9] RSP: 0018:ffffc9000022eb80 EFLAGS: 00010293
[ 87.917601][ T9] RAX: ffffffff876314f2 RBX: ffff888044873300 RCX: ffff88801bf0ca80
[ 87.921355][ T9] RDX: 0000000000000000 RSI: ffff888044873300 RDI: ffffffff9065b500
[ 87.924931][ T9] RBP: dffffc0000000000 R08: ffffffff9057c237 R09: 1ffffffff20af846
[ 87.928271][ T9] R10: dffffc0000000000 R11: fffffbfff20af847 R12: ffff888012c80458
[ 87.931615][ T9] R13: 1ffff1100259008b R14: ffff888044873308 R15: 0000000000000cc0
[ 87.934990][ T9] FS: 0000000000000000(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000
[ 87.938715][ T9] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 87.941523][ T9] CR2: 000055dbc6396168 CR3: 000000000e946000 CR4: 0000000000352ef0
[ 87.944853][ T9] Call Trace:
[ 87.946349][ T9]
[ 87.947649][ T9] ? __kmalloc_cache_noprof+0x150/0x660
[ 87.950001][ T9] ? port100_send_cmd_async+0xbd/0xcc0
[ 87.952353][ T9] ? skb_put+0x112/0x210
[ 87.954286][ T9] port100_send_cmd_async+0x84f/0xcc0
[ 87.956586][ T9] port100_set_command_type+0x1c8/0x390
[ 87.958937][ T9] ? pcpu_alloc+0x10/0x310
[ 87.960755][ T9] ? __pfx_port100_set_command_type+0x10/0x10
[ 87.964391][ T9] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 87.966876][ T9] port100_probe+0x7b2/0xba0
[ 87.968857][ T9] ? __pfx_port100_probe+0x10/0x10
[ 87.971085][ T9] ? lockdep_hardirqs_on+0x7a/0x110
[ 87.973135][ T9] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 87.975435][ T9] ? __pm_runtime_set_status+0x994/0xc80
[ 87.977625][ T9] usb_probe_interface+0x653/0xc60
[ 87.979414][ T9] ? __pfx_usb_probe_interface+0x10/0x10
[ 87.981453][ T9] really_probe+0x254/0xae0
[ 87.983083][ T9] __driver_probe_device+0x1e8/0x360
[ 87.984826][ T9] driver_probe_device+0x4f/0x240
[ 87.986514][ T9] __device_attach_driver+0x270/0x410
[ 87.988614][ T9] bus_for_each_drv+0x258/0x2f0
[ 87.990558][ T9] ? __pfx___device_attach_driver+0x10/0x10
[ 87.992657][ T9] ? __pfx_bus_for_each_drv+0x10/0x10
[ 87.994914][ T9] ? lockdep_hardirqs_on+0x7a/0x110
[ 87.997093][ T9] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 87.999375][ T9] __device_attach+0x2c4/0x450
[ 88.001002][ T9] ? __pfx___device_attach+0x10/0x10
[ 88.002814][ T9] ? do_raw_spin_unlock+0x4d/0x210
[ 88.004590][ T9] ? _raw_spin_unlock+0x28/0x50
[ 88.006288][ T9] device_initial_probe+0xa1/0xd0
[ 88.007981][ T9] bus_probe_device+0x12a/0x220
[ 88.009632][ T9] device_add+0x7d7/0xb80
[ 88.011151][ T9] usb_set_configuration+0x1ad8/0x2180
[ 88.013012][ T9] usb_generic_driver_probe+0x8d/0x150
[ 88.015008][ T9] usb_probe_device+0x1c3/0x3b0
[ 88.016821][ T9] ? __pfx_usb_probe_device+0x10/0x10
[ 88.018746][ T9] really_probe+0x254/0xae0
[ 88.020307][ T9] __driver_probe_device+0x1e8/0x360
[ 88.022045][ T9] driver_probe_device+0x4f/0x240
[ 88.025063][ T9] __device_attach_driver+0x270/0x410
[ 88.027153][ T9] bus_for_each_drv+0x258/0x2f0
[ 88.028961][ T9] ? __pfx___device_attach_driver+0x10/0x10
[ 88.031180][ T9] ? __pfx_bus_for_each_drv+0x10/0x10
[ 88.033180][ T9] ? lockdep_hardirqs_on+0x7a/0x110
[ 88.035030][ T9] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 88.036998][ T9] __device_attach+0x2c4/0x450
[ 88.038825][ T9] ? __pfx___device_attach+0x10/0x10
[ 88.040649][ T9] ? do_raw_spin_unlock+0x4d/0x210
[ 88.042453][ T9] ? _raw_spin_unlock+0x28/0x50
[ 88.044674][ T9] device_initial_probe+0xa1/0xd0
[ 88.046449][ T9] bus_probe_device+0x12a/0x220
[ 88.048304][ T9] device_add+0x7d7/0xb80
[ 88.050100][ T9] usb_new_device+0x99d/0x1620
[ 88.051989][ T9] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 88.054038][ T9] ? __pfx_usb_new_device+0x10/0x10
[ 88.055809][ T9] ? _raw_spin_unlock_irq+0x23/0x50
[ 88.057745][ T9] hub_event+0x28e8/0x4d30
[ 88.059431][ T9] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 88.061647][ T9] ? __pfx_hub_event+0x10/0x10
[ 88.063498][ T9] ? process_scheduled_works+0xa20/0x14e0
[ 88.065607][ T9] ? rcu_is_watching+0x15/0xb0
[ 88.067378][ T9] ? process_scheduled_works+0xa20/0x14e0
[ 88.069602][ T9] process_scheduled_works+0xa8e/0x14e0
[ 88.071860][ T9] ? __pfx_process_scheduled_works+0x10/0x10
[ 88.074278][ T9] ? assign_work+0x3cf/0x5d0
[ 88.075977][ T9] worker_thread+0xa47/0xfb0
[ 88.077751][ T9] kthread+0x388/0x470
[ 88.079327][ T9] ? __pfx_worker_thread+0x10/0x10
[ 88.081206][ T9] ? __pfx_kthread+0x10/0x10
[ 88.082945][ T9] ret_from_fork+0x514/0xb70
[ 88.084623][ T9] ? __pfx_ret_from_fork+0x10/0x10
[ 88.086344][ T9] ? __switch_to+0xc89/0x1420
[ 88.088003][ T9] ? __pfx_kthread+0x10/0x10
[ 88.089762][ T9] ret_from_fork_asm+0x1a/0x30
[ 88.091553][ T9]
[ 88.092723][ T9] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 88.095333][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full)
[ 88.098346][ T9] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 88.101887][ T9] Workqueue: usb_hub_wq hub_event
[ 88.103672][ T9] Call Trace:
[ 88.104920][ T9]
[ 88.106015][ T9] vpanic+0x56c/0xa60
[ 88.107448][ T9] ? __pfx__printk+0x10/0x10
[ 88.109084][ T9] ? __pfx_vpanic+0x10/0x10
[ 88.110877][ T9] ? is_bpf_text_address+0x292/0x2b0
[ 88.112869][ T9] ? is_bpf_text_address+0x26/0x2b0
[ 88.114725][ T9] panic+0xc5/0xd0
[ 88.116093][ T9] ? __pfx_panic+0x10/0x10
[ 88.117749][ T9] ? ret_from_fork_asm+0x1a/0x30
[ 88.119623][ T9] __warn+0x315/0x4c0
[ 88.121182][ T9] ? usb_submit_urb+0x79/0x18b0
[ 88.123053][ T9] ? usb_submit_urb+0x79/0x18b0
[ 88.124967][ T9] __report_bug+0x276/0x570
[ 88.126592][ T9] ? kasan_save_track+0x4f/0x80
[ 88.128200][ T9] ? kasan_save_track+0x3e/0x80
[ 88.129871][ T9] ? usb_submit_urb+0x79/0x18b0
[ 88.131438][ T9] ? __pfx___report_bug+0x10/0x10
[ 88.133035][ T9] ? __pfx___mutex_trylock_common+0x10/0x10
[ 88.134975][ T9] ? rcu_is_watching+0x15/0xb0
[ 88.136500][ T9] ? trace_contention_end+0x3d/0x140
[ 88.138499][ T9] report_bug_entry+0x19a/0x290
[ 88.140496][ T9] ? usb_submit_urb+0x7c/0x18b0
[ 88.142553][ T9] ? usb_submit_urb+0x81/0x18b0
[ 88.144566][ T9] handle_bug+0xce/0x200
[ 88.146364][ T9] exc_invalid_op+0x1a/0x50
[ 88.148261][ T9] asm_exc_invalid_op+0x1a/0x20
[ 88.150205][ T9] RIP: 0010:usb_submit_urb+0x7c/0x18b0
[ 88.152139][ T9] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 79 40 d3 fa 49 83 3e 00 74 40 e8 ce 0d 64 fa 48 8d 3d 07 a0 02 09 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 b3 0d 64 fa eb 05 e8 ac 0d
[ 88.159916][ T9] RSP: 0018:ffffc9000022eb80 EFLAGS: 00010293
[ 88.162366][ T9] RAX: ffffffff876314f2 RBX: ffff888044873300 RCX: ffff88801bf0ca80
[ 88.165583][ T9] RDX: 0000000000000000 RSI: ffff888044873300 RDI: ffffffff9065b500
[ 88.168754][ T9] RBP: dffffc0000000000 R08: ffffffff9057c237 R09: 1ffffffff20af846
[ 88.172039][ T9] R10: dffffc0000000000 R11: fffffbfff20af847 R12: ffff888012c80458
[ 88.175321][ T9] R13: 1ffff1100259008b R14: ffff888044873308 R15: 0000000000000cc0
[ 88.178479][ T9] ? usb_submit_urb+0x72/0x18b0
[ 88.180233][ T9] ? __kmalloc_cache_noprof+0x150/0x660
[ 88.182049][ T9] ? port100_send_cmd_async+0xbd/0xcc0
[ 88.183805][ T9] ? skb_put+0x112/0x210
[ 88.185228][ T9] port100_send_cmd_async+0x84f/0xcc0
[ 88.187047][ T9] port100_set_command_type+0x1c8/0x390
[ 88.188883][ T9] ? pcpu_alloc+0x10/0x310
[ 88.190439][ T9] ? __pfx_port100_set_command_type+0x10/0x10
[ 88.192471][ T9] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 88.194443][ T9] port100_probe+0x7b2/0xba0
[ 88.196057][ T9] ? __pfx_port100_probe+0x10/0x10
[ 88.197736][ T9] ? lockdep_hardirqs_on+0x7a/0x110
[ 88.199441][ T9] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 88.201388][ T9] ? __pm_runtime_set_status+0x994/0xc80
[ 88.203235][ T9] usb_probe_interface+0x653/0xc60
[ 88.204940][ T9] ? __pfx_usb_probe_interface+0x10/0x10
[ 88.206807][ T9] really_probe+0x254/0xae0
[ 88.208249][ T9] __driver_probe_device+0x1e8/0x360
[ 88.210133][ T9] driver_probe_device+0x4f/0x240
[ 88.212175][ T9] __device_attach_driver+0x270/0x410
[ 88.214420][ T9] bus_for_each_drv+0x258/0x2f0
[ 88.216447][ T9] ? __pfx___device_attach_driver+0x10/0x10
[ 88.218841][ T9] ? __pfx_bus_for_each_drv+0x10/0x10
[ 88.221043][ T9] ? lockdep_hardirqs_on+0x7a/0x110
[ 88.223184][ T9] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 88.225552][ T9] __device_attach+0x2c4/0x450
[ 88.227528][ T9] ? __pfx___device_attach+0x10/0x10
[ 88.229693][ T9] ? do_raw_spin_unlock+0x4d/0x210
[ 88.231792][ T9] ? _raw_spin_unlock+0x28/0x50
[ 88.233856][ T9] device_initial_probe+0xa1/0xd0
[ 88.235930][ T9] bus_probe_device+0x12a/0x220
[ 88.237955][ T9] device_add+0x7d7/0xb80
[ 88.239811][ T9] usb_set_configuration+0x1ad8/0x2180
[ 88.242072][ T9] usb_generic_driver_probe+0x8d/0x150
[ 88.244393][ T9] usb_probe_device+0x1c3/0x3b0
[ 88.246393][ T9] ? __pfx_usb_probe_device+0x10/0x10
[ 88.248627][ T9] really_probe+0x254/0xae0
[ 88.250616][ T9] __driver_probe_device+0x1e8/0x360
[ 88.252850][ T9] driver_probe_device+0x4f/0x240
[ 88.254962][ T9] __device_attach_driver+0x270/0x410
[ 88.257227][ T9] bus_for_each_drv+0x258/0x2f0
[ 88.259306][ T9] ? __pfx___device_attach_driver+0x10/0x10
[ 88.261740][ T9] ? __pfx_bus_for_each_drv+0x10/0x10
[ 88.263957][ T9] ? lockdep_hardirqs_on+0x7a/0x110
[ 88.266180][ T9] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 88.268587][ T9] __device_attach+0x2c4/0x450
[ 88.270569][ T9] ? __pfx___device_attach+0x10/0x10
[ 88.272708][ T9] ? do_raw_spin_unlock+0x4d/0x210
[ 88.274790][ T9] ? _raw_spin_unlock+0x28/0x50
[ 88.276798][ T9] device_initial_probe+0xa1/0xd0
[ 88.278876][ T9] bus_probe_device+0x12a/0x220
[ 88.280879][ T9] device_add+0x7d7/0xb80
[ 88.282684][ T9] usb_new_device+0x99d/0x1620
[ 88.284803][ T9] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 88.287230][ T9] ? __pfx_usb_new_device+0x10/0x10
[ 88.289364][ T9] ? _raw_spin_unlock_irq+0x23/0x50
[ 88.291559][ T9] hub_event+0x28e8/0x4d30
[ 88.293369][ T9] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 88.295844][ T9] ? __pfx_hub_event+0x10/0x10
[ 88.297858][ T9] ? process_scheduled_works+0xa20/0x14e0
[ 88.300143][ T9] ? rcu_is_watching+0x15/0xb0
[ 88.302108][ T9] ? process_scheduled_works+0xa20/0x14e0
[ 88.304468][ T9] process_scheduled_works+0xa8e/0x14e0
[ 88.306779][ T9] ? __pfx_process_scheduled_works+0x10/0x10
[ 88.309226][ T9] ? assign_work+0x3cf/0x5d0
[ 88.311134][ T9] worker_thread+0xa47/0xfb0
[ 88.313098][ T9] kthread+0x388/0x470
[ 88.314863][ T9] ? __pfx_worker_thread+0x10/0x10
[ 88.317020][ T9] ? __pfx_kthread+0x10/0x10
[ 88.318974][ T9] ret_from_fork+0x514/0xb70
[ 88.320907][ T9] ? __pfx_ret_from_fork+0x10/0x10
[ 88.323018][ T9] ? __switch_to+0xc89/0x1420
[ 88.324994][ T9] ? __pfx_kthread+0x10/0x10
[ 88.326969][ T9] ret_from_fork_asm+0x1a/0x30
[ 88.328988][ T9]
[ 88.330753][ T9] Kernel Offset: disabled
[ 88.332566][ T9] Rebooting in 86400 seconds..