program:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407f1801020000010203010902200001010080fa0904000002ffffff000705810200020007050202000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
syz_usb_ep_write(r0, 0x81, 0xd8, &(0x7f0000000100)="d8000000d800000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100"/212)
nanosleep(&(0x7f0000000300)={0x5}, 0x0)
[ 78.091337][ T1331] ieee802154 phy0 wpan0: encryption failed: -22
[ 78.094658][ T1331] ieee802154 phy1 wpan1: encryption failed: -22
[ 78.266115][ T804] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 78.276101][ T5281] Bluetooth: hci0: command tx timeout
[ 78.422983][ T804] usb 5-1: New USB device found, idVendor=187f, idProduct=0201, bcdDevice= 0.00
[ 78.426924][ T804] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 78.430264][ T804] usb 5-1: Product: syz
[ 78.432037][ T804] usb 5-1: Manufacturer: syz
[ 78.433933][ T804] usb 5-1: SerialNumber: syz
[ 78.461396][ T804] smsusb:smsusb_probe: board id=3, interface number 0
[ 78.474254][ T804] smsusb:siano_media_device_register: media controller created
[ 79.557406][ T804] smsmdtv:smscore_sendrequest_and_wait: sendrequest returned error -110
[ 79.561032][ T804] smsmdtv:smscore_set_device_mode: mode detect failed -110
[ 79.564130][ T804] smsmdtv:smscore_start_device: set device mode failed , rc -110
[ 79.567576][ T804] smsusb:smsusb_init_device: smscore_start_device(...) failed
[ 79.571471][ C0] smsusb:smsusb_onresponse: error, urb status -2, 0 bytes
[ 79.574818][ C0] smsusb:smsusb_onresponse: error, urb status -2, 0 bytes
[ 79.578896][ C0] smsusb:smsusb_onresponse: error, urb status -2, 0 bytes
[ 79.582162][ C0] smsusb:smsusb_onresponse: error, urb status -2, 0 bytes
[ 79.585266][ C0] smsusb:smsusb_onresponse: error, urb status -2, 0 bytes
[ 79.588661][ C0] smsusb:smsusb_onresponse: error, urb status -2, 0 bytes
[ 79.591921][ C0] smsusb:smsusb_onresponse: error, urb status -2, 0 bytes
[ 79.595168][ C0] smsusb:smsusb_onresponse: error, urb status -2, 0 bytes
[ 79.598276][ C0] smsusb:smsusb_onresponse: error, urb status -2, 0 bytes
[ 79.601386][ C0] smsusb:smsusb_onresponse: error, urb status -2, 0 bytes
[ 79.607981][ T804] ------------[ cut here ]------------
[ 79.610252][ T804] !PageLargeKmalloc(page)
[ 79.610261][ T804] WARNING: mm/slub.c:6602 at free_large_kmalloc+0x97/0x110, CPU#0: kworker/0:2/804
[ 79.615799][ T804] Modules linked in:
[ 79.618766][ T804] CPU: 0 UID: 0 PID: 804 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full)
[ 79.623170][ T804] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 79.627441][ T804] Workqueue: usb_hub_wq hub_event
[ 79.629652][ T804] RIP: 0010:free_large_kmalloc+0x97/0x110
[ 79.631974][ T804] Code: 8b 43 30 83 f8 ff 74 13 25 00 00 00 ff 3d 00 00 00 f8 75 7a c7 43 30 ff ff ff ff 48 89 df 89 ee 5b 41 5e 5d e9 ea be fc ff 90 <0f> 0b 90 48 89 df 48 c7 c6 9f df 24 8e 5b 41 5e 5d e9 83 42 fd fe
[ 79.641750][ T804] RSP: 0018:ffffc900042f6bc8 EFLAGS: 00010206
[ 79.644399][ T804] RAX: 00000000ff000000 RBX: ffffea00014b3880 RCX: 0000000000000001
[ 79.647791][ T804] RDX: 0000000000000000 RSI: ffff888052ce2000 RDI: ffffea00014b3880
[ 79.651050][ T804] RBP: 0000000000000000 R08: ffff888040053503 R09: 1ffff1100800a6a0
[ 79.654212][ T804] R10: dffffc0000000000 R11: ffffed100800a6a1 R12: 1ffff11007627c82
[ 79.657530][ T804] R13: ffff888034d98900 R14: ffff888040053560 R15: dffffc0000000000
[ 79.660716][ T804] FS: 0000000000000000(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000
[ 79.664403][ T804] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 79.667354][ T804] CR2: 000056492593b168 CR3: 000000000e946000 CR4: 0000000000352ef0
[ 79.670642][ T804] Call Trace:
[ 79.672075][ T804]
[ 79.673342][ T804] usb_free_urb+0xd0/0x120
[ 79.675173][ T804] smsusb_term_device+0x1d0/0x3d0
[ 79.677374][ T804] smsusb_probe+0x1aba/0x2280
[ 79.679351][ T804] ? rcu_is_watching+0x15/0xb0
[ 79.681362][ T804] ? __pfx_smsusb_probe+0x10/0x10
[ 79.683414][ T804] ? do_raw_spin_lock+0x12b/0x2f0
[ 79.685515][ T804] ? __pfx_smsusb_sendrequest+0x10/0x10
[ 79.687838][ T804] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 79.690232][ T804] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 79.692602][ T804] ? __pm_runtime_set_status+0x994/0xc80
[ 79.694875][ T804] usb_probe_interface+0x653/0xc60
[ 79.697072][ T804] ? __pfx_usb_probe_interface+0x10/0x10
[ 79.699322][ T804] really_probe+0x254/0xae0
[ 79.701277][ T804] __driver_probe_device+0x1e8/0x360
[ 79.703462][ T804] driver_probe_device+0x4f/0x240
[ 79.705503][ T804] __device_attach_driver+0x270/0x410
[ 79.707824][ T804] bus_for_each_drv+0x258/0x2f0
[ 79.709824][ T804] ? __pfx___device_attach_driver+0x10/0x10
[ 79.712277][ T804] ? __pfx_bus_for_each_drv+0x10/0x10
[ 79.714426][ T804] ? lockdep_hardirqs_on+0x7a/0x110
[ 79.716661][ T804] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 79.719230][ T804] __device_attach+0x2c4/0x450
[ 79.721585][ T804] ? __pfx___device_attach+0x10/0x10
[ 79.723665][ T804] ? do_raw_spin_unlock+0x4d/0x210
[ 79.726732][ T804] ? _raw_spin_unlock+0x28/0x50
[ 79.728967][ T804] device_initial_probe+0xa1/0xd0
[ 79.731058][ T804] bus_probe_device+0x12a/0x220
[ 79.733032][ T804] device_add+0x7d7/0xb80
[ 79.734804][ T804] usb_set_configuration+0x1ad8/0x2180
[ 79.737144][ T804] usb_generic_driver_probe+0x8d/0x150
[ 79.739759][ T804] usb_probe_device+0x1c3/0x3b0
[ 79.741785][ T804] ? __pfx_usb_probe_device+0x10/0x10
[ 79.743915][ T804] really_probe+0x254/0xae0
[ 79.745868][ T804] __driver_probe_device+0x1e8/0x360
[ 79.747993][ T804] driver_probe_device+0x4f/0x240
[ 79.750443][ T804] __device_attach_driver+0x270/0x410
[ 79.752870][ T804] bus_for_each_drv+0x258/0x2f0
[ 79.754856][ T804] ? __pfx___device_attach_driver+0x10/0x10
[ 79.757316][ T804] ? __pfx_bus_for_each_drv+0x10/0x10
[ 79.759442][ T804] ? lockdep_hardirqs_on+0x7a/0x110
[ 79.761497][ T804] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 79.763882][ T804] __device_attach+0x2c4/0x450
[ 79.765900][ T804] ? __pfx___device_attach+0x10/0x10
[ 79.768263][ T804] ? do_raw_spin_unlock+0x4d/0x210
[ 79.770752][ T804] ? _raw_spin_unlock+0x28/0x50
[ 79.772756][ T804] device_initial_probe+0xa1/0xd0
[ 79.774756][ T804] bus_probe_device+0x12a/0x220
[ 79.776771][ T804] device_add+0x7d7/0xb80
[ 79.778540][ T804] usb_new_device+0x99d/0x1620
[ 79.780534][ T804] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 79.782993][ T804] ? __pfx_usb_new_device+0x10/0x10
[ 79.785105][ T804] ? _raw_spin_unlock_irq+0x23/0x50
[ 79.787301][ T804] hub_event+0x28e8/0x4d30
[ 79.789140][ T804] ? do_raw_spin_unlock+0x4d/0x210
[ 79.791226][ T804] ? __pfx_hub_event+0x10/0x10
[ 79.793174][ T804] ? process_scheduled_works+0xa20/0x14e0
[ 79.795517][ T804] ? rcu_is_watching+0x15/0xb0
[ 79.797723][ T804] ? process_scheduled_works+0xa20/0x14e0
[ 79.799951][ T804] process_scheduled_works+0xa8e/0x14e0
[ 79.802132][ T804] ? __pfx_process_scheduled_works+0x10/0x10
[ 79.804404][ T804] ? assign_work+0x3cf/0x5d0
[ 79.806384][ T804] worker_thread+0xa47/0xfb0
[ 79.808310][ T804] kthread+0x388/0x470
[ 79.810013][ T804] ? __pfx_worker_thread+0x10/0x10
[ 79.812123][ T804] ? __pfx_kthread+0x10/0x10
[ 79.813996][ T804] ret_from_fork+0x514/0xb70
[ 79.815916][ T804] ? __pfx_ret_from_fork+0x10/0x10
[ 79.817969][ T804] ? __switch_to+0xc89/0x1420
[ 79.819865][ T804] ? __pfx_kthread+0x10/0x10
[ 79.821798][ T804] ret_from_fork_asm+0x1a/0x30
[ 79.824183][ T804]
[ 79.825519][ T804] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 79.828401][ T804] CPU: 0 UID: 0 PID: 804 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full)
[ 79.832040][ T804] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 79.835907][ T804] Workqueue: usb_hub_wq hub_event
[ 79.837908][ T804] Call Trace:
[ 79.839240][ T804]
[ 79.840419][ T804] vpanic+0x56c/0xa60
[ 79.841891][ T804] ? __pfx__printk+0x10/0x10
[ 79.843699][ T804] ? __pfx_vpanic+0x10/0x10
[ 79.845563][ T804] ? is_bpf_text_address+0x292/0x2b0
[ 79.847653][ T804] ? is_bpf_text_address+0x26/0x2b0
[ 79.849772][ T804] panic+0xc5/0xd0
[ 79.851273][ T804] ? __pfx_panic+0x10/0x10
[ 79.853077][ T804] ? ret_from_fork_asm+0x1a/0x30
[ 79.855045][ T804] __warn+0x315/0x4c0
[ 79.856656][ T804] ? free_large_kmalloc+0x97/0x110
[ 79.858750][ T804] ? free_large_kmalloc+0x97/0x110
[ 79.860766][ T804] __report_bug+0x276/0x570
[ 79.862685][ T804] ? free_large_kmalloc+0x97/0x110
[ 79.864747][ T804] ? __pfx___report_bug+0x10/0x10
[ 79.866774][ T804] ? lockdep_hardirqs_on+0x7a/0x110
[ 79.868907][ T804] ? irqentry_exit+0x218/0x8f0
[ 79.870975][ T804] ? trace_irq_disable+0x3b/0x140
[ 79.873103][ T804] ? free_large_kmalloc+0x99/0x110
[ 79.875225][ T804] ? free_large_kmalloc+0x97/0x110
[ 79.877307][ T804] report_bug+0x16a/0x220
[ 79.878939][ T804] ? free_large_kmalloc+0x97/0x110
[ 79.880974][ T804] ? free_large_kmalloc+0x99/0x110
[ 79.883048][ T804] handle_bug+0x9c/0x200
[ 79.884746][ T804] exc_invalid_op+0x1a/0x50
[ 79.886572][ T804] asm_exc_invalid_op+0x1a/0x20
[ 79.888558][ T804] RIP: 0010:free_large_kmalloc+0x97/0x110
[ 79.890871][ T804] Code: 8b 43 30 83 f8 ff 74 13 25 00 00 00 ff 3d 00 00 00 f8 75 7a c7 43 30 ff ff ff ff 48 89 df 89 ee 5b 41 5e 5d e9 ea be fc ff 90 <0f> 0b 90 48 89 df 48 c7 c6 9f df 24 8e 5b 41 5e 5d e9 83 42 fd fe
[ 79.898250][ T804] RSP: 0018:ffffc900042f6bc8 EFLAGS: 00010206
[ 79.900564][ T804] RAX: 00000000ff000000 RBX: ffffea00014b3880 RCX: 0000000000000001
[ 79.903748][ T804] RDX: 0000000000000000 RSI: ffff888052ce2000 RDI: ffffea00014b3880
[ 79.906752][ T804] RBP: 0000000000000000 R08: ffff888040053503 R09: 1ffff1100800a6a0
[ 79.909956][ T804] R10: dffffc0000000000 R11: ffffed100800a6a1 R12: 1ffff11007627c82
[ 79.913128][ T804] R13: ffff888034d98900 R14: ffff888040053560 R15: dffffc0000000000
[ 79.916390][ T804] usb_free_urb+0xd0/0x120
[ 79.918236][ T804] smsusb_term_device+0x1d0/0x3d0
[ 79.920335][ T804] smsusb_probe+0x1aba/0x2280
[ 79.922295][ T804] ? rcu_is_watching+0x15/0xb0
[ 79.924237][ T804] ? __pfx_smsusb_probe+0x10/0x10
[ 79.926290][ T804] ? do_raw_spin_lock+0x12b/0x2f0
[ 79.928365][ T804] ? __pfx_smsusb_sendrequest+0x10/0x10
[ 79.930727][ T804] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 79.933139][ T804] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 79.935530][ T804] ? __pm_runtime_set_status+0x994/0xc80
[ 79.937925][ T804] usb_probe_interface+0x653/0xc60
[ 79.940053][ T804] ? __pfx_usb_probe_interface+0x10/0x10
[ 79.942424][ T804] really_probe+0x254/0xae0
[ 79.944338][ T804] __driver_probe_device+0x1e8/0x360
[ 79.946550][ T804] driver_probe_device+0x4f/0x240
[ 79.948772][ T804] __device_attach_driver+0x270/0x410
[ 79.951011][ T804] bus_for_each_drv+0x258/0x2f0
[ 79.953081][ T804] ? __pfx___device_attach_driver+0x10/0x10
[ 79.955465][ T804] ? __pfx_bus_for_each_drv+0x10/0x10
[ 79.957721][ T804] ? lockdep_hardirqs_on+0x7a/0x110
[ 79.959861][ T804] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 79.962269][ T804] __device_attach+0x2c4/0x450
[ 79.964286][ T804] ? __pfx___device_attach+0x10/0x10
[ 79.966574][ T804] ? do_raw_spin_unlock+0x4d/0x210
[ 79.968744][ T804] ? _raw_spin_unlock+0x28/0x50
[ 79.970807][ T804] device_initial_probe+0xa1/0xd0
[ 79.972900][ T804] bus_probe_device+0x12a/0x220
[ 79.974974][ T804] device_add+0x7d7/0xb80
[ 79.976791][ T804] usb_set_configuration+0x1ad8/0x2180
[ 79.979095][ T804] usb_generic_driver_probe+0x8d/0x150
[ 79.981389][ T804] usb_probe_device+0x1c3/0x3b0
[ 79.983459][ T804] ? __pfx_usb_probe_device+0x10/0x10
[ 79.985754][ T804] really_probe+0x254/0xae0
[ 79.987716][ T804] __driver_probe_device+0x1e8/0x360
[ 79.989950][ T804] driver_probe_device+0x4f/0x240
[ 79.992080][ T804] __device_attach_driver+0x270/0x410
[ 79.994322][ T804] bus_for_each_drv+0x258/0x2f0
[ 79.996331][ T804] ? __pfx___device_attach_driver+0x10/0x10
[ 79.998809][ T804] ? __pfx_bus_for_each_drv+0x10/0x10
[ 80.001058][ T804] ? lockdep_hardirqs_on+0x7a/0x110
[ 80.003242][ T804] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 80.005663][ T804] __device_attach+0x2c4/0x450
[ 80.007676][ T804] ? __pfx___device_attach+0x10/0x10
[ 80.009906][ T804] ? do_raw_spin_unlock+0x4d/0x210
[ 80.012030][ T804] ? _raw_spin_unlock+0x28/0x50
[ 80.014074][ T804] device_initial_probe+0xa1/0xd0
[ 80.016155][ T804] bus_probe_device+0x12a/0x220
[ 80.018225][ T804] device_add+0x7d7/0xb80
[ 80.020007][ T804] usb_new_device+0x99d/0x1620
[ 80.023093][ T804] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 80.025692][ T804] ? __pfx_usb_new_device+0x10/0x10
[ 80.027891][ T804] ? _raw_spin_unlock_irq+0x23/0x50
[ 80.030177][ T804] hub_event+0x28e8/0x4d30
[ 80.032077][ T804] ? do_raw_spin_unlock+0x4d/0x210
[ 80.034261][ T804] ? __pfx_hub_event+0x10/0x10
[ 80.036283][ T804] ? process_scheduled_works+0xa20/0x14e0
[ 80.038671][ T804] ? rcu_is_watching+0x15/0xb0
[ 80.040708][ T804] ? process_scheduled_works+0xa20/0x14e0
[ 80.043132][ T804] process_scheduled_works+0xa8e/0x14e0
[ 80.045498][ T804] ? __pfx_process_scheduled_works+0x10/0x10
[ 80.048017][ T804] ? assign_work+0x3cf/0x5d0
[ 80.049955][ T804] worker_thread+0xa47/0xfb0
[ 80.051923][ T804] kthread+0x388/0x470
[ 80.053654][ T804] ? __pfx_worker_thread+0x10/0x10
[ 80.055772][ T804] ? __pfx_kthread+0x10/0x10
[ 80.057730][ T804] ret_from_fork+0x514/0xb70
[ 80.059697][ T804] ? __pfx_ret_from_fork+0x10/0x10
[ 80.061854][ T804] ? __switch_to+0xc89/0x1420
[ 80.063806][ T804] ? __pfx_kthread+0x10/0x10
[ 80.065757][ T804] ret_from_fork_asm+0x1a/0x30
[ 80.067860][ T804]
[ 80.069652][ T804] Kernel Offset: disabled
[ 80.071495][ T804] Rebooting in 86400 seconds..