program:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404c05c1060001010203010902200001010080fa0904000002ffffff000705810200020007050202000200"], 0x0)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000100)="0000ff00ff00")
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x14, &(0x7f0000000106)="0000ffffff0a00f6d7290000000000000003fd00")
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000200)="0000ff00ff00")
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
syz_usb_ep_write(r0, 0x81, 0xd, &(0x7f0000000206)="0000ffffff0300fdd72b00fe00")
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000300)="0000ff00ff00")
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
syz_usb_ep_write(r0, 0x81, 0xe, &(0x7f0000000306)="0000ffffff0400fcd72101000700")
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000001000), r1)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000002000)={0x0, 0x0, &(0x7f0000002100)={&(0x7f0000002200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x1c}}, 0x0)
sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000003000)={0x0, 0x0, &(0x7f0000003100)={&(0x7f0000003200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000004000)={0x0, 0x0, &(0x7f0000004100)={&(0x7f0000004200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x1}]}, 0x1c}}, 0x0)
sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000005100)={&(0x7f0000005200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x1}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000006000)={0x0, 0x0, &(0x7f0000006100)={&(0x7f0000006200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x2}]}, 0x1c}}, 0x0)
sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000007100)={&(0x7f0000007200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x2}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0)
[ 102.232775][ T5287] Bluetooth: hci0: command tx timeout
[ 102.573924][ T938] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 102.727351][ T938] usb 5-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice= 1.00
[ 102.731154][ T938] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 102.734863][ T938] usb 5-1: Product: syz
[ 102.736913][ T938] usb 5-1: Manufacturer: syz
[ 102.738901][ T938] usb 5-1: SerialNumber: syz
[ 103.257344][ T938] ------------[ cut here ]------------
[ 103.259785][ T938] URB ffff88803f29de00 submitted while active
[ 103.262264][ T938] WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x79/0x18b0, CPU#0: kworker/0:3/938
[ 103.266408][ T938] Modules linked in:
[ 103.268208][ T938] CPU: 0 UID: 0 PID: 938 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(full)
[ 103.272116][ T938] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 103.276078][ T938] Workqueue: usb_hub_wq hub_event
[ 103.277909][ T938] RIP: 0010:usb_submit_urb+0x7c/0x18b0
[ 103.280399][ T938] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 79 40 d3 fa 49 83 3e 00 74 40 e8 ce 0d 64 fa 48 8d 3d 07 a0 02 09 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 b3 0d 64 fa eb 05 e8 ac 0d
[ 103.287559][ T938] RSP: 0018:ffffc90004f8eb80 EFLAGS: 00010293
[ 103.289886][ T938] RAX: ffffffff876314f2 RBX: ffff88803f29de00 RCX: ffff888030542540
[ 103.293351][ T938] RDX: 0000000000000000 RSI: ffff88803f29de00 RDI: ffffffff9065b500
[ 103.296248][ T938] RBP: dffffc0000000000 R08: ffffffff9057c237 R09: 1ffffffff20af846
[ 103.299320][ T938] R10: dffffc0000000000 R11: fffffbfff20af847 R12: ffff88803fd47458
[ 103.302857][ T938] R13: 1ffff11007fa8e8b R14: ffff88803f29de08 R15: 0000000000000cc0
[ 103.306256][ T938] FS: 0000000000000000(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000
[ 103.310011][ T938] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 103.312853][ T938] CR2: 00007fb8d0da3f98 CR3: 0000000012cf3000 CR4: 0000000000352ef0
[ 103.316164][ T938] Call Trace:
[ 103.317398][ T938]
[ 103.318601][ T938] ? __kmalloc_cache_noprof+0x150/0x660
[ 103.320680][ T938] ? port100_send_cmd_async+0xbd/0xcc0
[ 103.322896][ T938] ? skb_put+0x112/0x210
[ 103.324642][ T938] port100_send_cmd_async+0x84f/0xcc0
[ 103.326883][ T938] port100_set_command_type+0x1c8/0x390
[ 103.329490][ T938] ? pcpu_alloc+0x10/0x310
[ 103.331199][ T938] ? __pfx_port100_set_command_type+0x10/0x10
[ 103.333939][ T938] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 103.336399][ T938] port100_probe+0x7b2/0xba0
[ 103.338398][ T938] ? __pfx_port100_probe+0x10/0x10
[ 103.340634][ T938] ? lockdep_hardirqs_on+0x7a/0x110
[ 103.343003][ T938] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 103.345541][ T938] ? __pm_runtime_set_status+0x994/0xc80
[ 103.347949][ T938] usb_probe_interface+0x653/0xc60
[ 103.350123][ T938] ? __pfx_usb_probe_interface+0x10/0x10
[ 103.352569][ T938] really_probe+0x254/0xae0
[ 103.354573][ T938] __driver_probe_device+0x1e8/0x360
[ 103.356848][ T938] driver_probe_device+0x4f/0x240
[ 103.359069][ T938] __device_attach_driver+0x270/0x410
[ 103.361429][ T938] bus_for_each_drv+0x258/0x2f0
[ 103.363599][ T938] ? __pfx___device_attach_driver+0x10/0x10
[ 103.366173][ T938] ? __pfx_bus_for_each_drv+0x10/0x10
[ 103.368493][ T938] ? lockdep_hardirqs_on+0x7a/0x110
[ 103.370799][ T938] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 103.373461][ T938] __device_attach+0x2c4/0x450
[ 103.375543][ T938] ? __pfx___device_attach+0x10/0x10
[ 103.377806][ T938] ? do_raw_spin_unlock+0x4d/0x210
[ 103.380028][ T938] ? _raw_spin_unlock+0x28/0x50
[ 103.382539][ T938] device_initial_probe+0xa1/0xd0
[ 103.384968][ T938] bus_probe_device+0x12a/0x220
[ 103.387057][ T938] device_add+0x7d7/0xb80
[ 103.388929][ T938] usb_set_configuration+0x1ad8/0x2180
[ 103.391251][ T938] usb_generic_driver_probe+0x8d/0x150
[ 103.393615][ T938] usb_probe_device+0x1c3/0x3b0
[ 103.395688][ T938] ? __pfx_usb_probe_device+0x10/0x10
[ 103.397985][ T938] really_probe+0x254/0xae0
[ 103.399912][ T938] __driver_probe_device+0x1e8/0x360
[ 103.402186][ T938] driver_probe_device+0x4f/0x240
[ 103.404312][ T938] __device_attach_driver+0x270/0x410
[ 103.406656][ T938] bus_for_each_drv+0x258/0x2f0
[ 103.408749][ T938] ? __pfx___device_attach_driver+0x10/0x10
[ 103.411256][ T938] ? __pfx_bus_for_each_drv+0x10/0x10
[ 103.413568][ T938] ? lockdep_hardirqs_on+0x7a/0x110
[ 103.415785][ T938] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 103.418293][ T938] __device_attach+0x2c4/0x450
[ 103.420396][ T938] ? __pfx___device_attach+0x10/0x10
[ 103.422646][ T938] ? do_raw_spin_unlock+0x4d/0x210
[ 103.424845][ T938] ? _raw_spin_unlock+0x28/0x50
[ 103.427028][ T938] device_initial_probe+0xa1/0xd0
[ 103.429202][ T938] bus_probe_device+0x12a/0x220
[ 103.431319][ T938] device_add+0x7d7/0xb80
[ 103.433352][ T938] usb_new_device+0x99d/0x1620
[ 103.435481][ T938] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 103.438065][ T938] ? __pfx_usb_new_device+0x10/0x10
[ 103.440318][ T938] ? _raw_spin_unlock_irq+0x23/0x50
[ 103.442701][ T938] hub_event+0x28e8/0x4d30
[ 103.444706][ T938] ? __pfx_hub_event+0x10/0x10
[ 103.446786][ T938] ? process_scheduled_works+0xa20/0x14e0
[ 103.449236][ T938] ? rcu_is_watching+0x15/0xb0
[ 103.451332][ T938] ? process_scheduled_works+0xa20/0x14e0
[ 103.453824][ T938] process_scheduled_works+0xa8e/0x14e0
[ 103.456206][ T938] ? __pfx_process_scheduled_works+0x10/0x10
[ 103.458784][ T938] ? assign_work+0x3cf/0x5d0
[ 103.460775][ T938] worker_thread+0xa47/0xfb0
[ 103.462812][ T938] ? __kthread_parkme+0x71/0x1f0
[ 103.464952][ T938] kthread+0x388/0x470
[ 103.466740][ T938] ? __pfx_worker_thread+0x10/0x10
[ 103.468913][ T938] ? __pfx_kthread+0x10/0x10
[ 103.470906][ T938] ret_from_fork+0x514/0xb70
[ 103.472945][ T938] ? __pfx_ret_from_fork+0x10/0x10
[ 103.475091][ T938] ? __switch_to+0xc89/0x1420
[ 103.477091][ T938] ? __pfx_kthread+0x10/0x10
[ 103.479059][ T938] ret_from_fork_asm+0x1a/0x30
[ 103.481078][ T938]
[ 103.482461][ T938] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 103.485461][ T938] CPU: 0 UID: 0 PID: 938 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(full)
[ 103.489161][ T938] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 103.493330][ T938] Workqueue: usb_hub_wq hub_event
[ 103.495425][ T938] Call Trace:
[ 103.496866][ T938]
[ 103.498124][ T938] vpanic+0x56c/0xa60
[ 103.499818][ T938] ? __pfx__printk+0x10/0x10
[ 103.501733][ T938] ? __pfx_vpanic+0x10/0x10
[ 103.503633][ T938] ? is_bpf_text_address+0x292/0x2b0
[ 103.505868][ T938] ? is_bpf_text_address+0x26/0x2b0
[ 103.508045][ T938] panic+0xc5/0xd0
[ 103.509667][ T938] ? __pfx_panic+0x10/0x10
[ 103.511589][ T938] ? ret_from_fork_asm+0x1a/0x30
[ 103.513718][ T938] __warn+0x315/0x4c0
[ 103.515414][ T938] ? usb_submit_urb+0x79/0x18b0
[ 103.517503][ T938] ? usb_submit_urb+0x79/0x18b0
[ 103.519516][ T938] __report_bug+0x276/0x570
[ 103.521511][ T938] ? kasan_save_track+0x4f/0x80
[ 103.523638][ T938] ? kasan_save_track+0x3e/0x80
[ 103.525714][ T938] ? usb_submit_urb+0x79/0x18b0
[ 103.527718][ T938] ? __pfx___report_bug+0x10/0x10
[ 103.529806][ T938] ? __pfx___mutex_trylock_common+0x10/0x10
[ 103.532318][ T938] ? rcu_is_watching+0x15/0xb0
[ 103.534317][ T938] ? trace_contention_end+0x3d/0x140
[ 103.536464][ T938] report_bug_entry+0x19a/0x290
[ 103.538444][ T938] ? usb_submit_urb+0x7c/0x18b0
[ 103.540490][ T938] ? usb_submit_urb+0x81/0x18b0
[ 103.542556][ T938] handle_bug+0xce/0x200
[ 103.544276][ T938] exc_invalid_op+0x1a/0x50
[ 103.546140][ T938] asm_exc_invalid_op+0x1a/0x20
[ 103.548096][ T938] RIP: 0010:usb_submit_urb+0x7c/0x18b0
[ 103.550320][ T938] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 79 40 d3 fa 49 83 3e 00 74 40 e8 ce 0d 64 fa 48 8d 3d 07 a0 02 09 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 b3 0d 64 fa eb 05 e8 ac 0d
[ 103.558153][ T938] RSP: 0018:ffffc90004f8eb80 EFLAGS: 00010293
[ 103.560602][ T938] RAX: ffffffff876314f2 RBX: ffff88803f29de00 RCX: ffff888030542540
[ 103.563794][ T938] RDX: 0000000000000000 RSI: ffff88803f29de00 RDI: ffffffff9065b500
[ 103.567065][ T938] RBP: dffffc0000000000 R08: ffffffff9057c237 R09: 1ffffffff20af846
[ 103.570367][ T938] R10: dffffc0000000000 R11: fffffbfff20af847 R12: ffff88803fd47458
[ 103.573627][ T938] R13: 1ffff11007fa8e8b R14: ffff88803f29de08 R15: 0000000000000cc0
[ 103.576925][ T938] ? usb_submit_urb+0x72/0x18b0
[ 103.578975][ T938] ? __kmalloc_cache_noprof+0x150/0x660
[ 103.581237][ T938] ? port100_send_cmd_async+0xbd/0xcc0
[ 103.583486][ T938] ? skb_put+0x112/0x210
[ 103.585334][ T938] port100_send_cmd_async+0x84f/0xcc0
[ 103.587631][ T938] port100_set_command_type+0x1c8/0x390
[ 103.589931][ T938] ? pcpu_alloc+0x10/0x310
[ 103.591808][ T938] ? __pfx_port100_set_command_type+0x10/0x10
[ 103.594413][ T938] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 103.596957][ T938] port100_probe+0x7b2/0xba0
[ 103.598889][ T938] ? __pfx_port100_probe+0x10/0x10
[ 103.600939][ T938] ? lockdep_hardirqs_on+0x7a/0x110
[ 103.603114][ T938] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 103.605568][ T938] ? __pm_runtime_set_status+0x994/0xc80
[ 103.607875][ T938] usb_probe_interface+0x653/0xc60
[ 103.609983][ T938] ? __pfx_usb_probe_interface+0x10/0x10
[ 103.612281][ T938] really_probe+0x254/0xae0
[ 103.614172][ T938] __driver_probe_device+0x1e8/0x360
[ 103.616296][ T938] driver_probe_device+0x4f/0x240
[ 103.618406][ T938] __device_attach_driver+0x270/0x410
[ 103.620553][ T938] bus_for_each_drv+0x258/0x2f0
[ 103.622594][ T938] ? __pfx___device_attach_driver+0x10/0x10
[ 103.624999][ T938] ? __pfx_bus_for_each_drv+0x10/0x10
[ 103.627229][ T938] ? lockdep_hardirqs_on+0x7a/0x110
[ 103.629349][ T938] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 103.631716][ T938] __device_attach+0x2c4/0x450
[ 103.633727][ T938] ? __pfx___device_attach+0x10/0x10
[ 103.635844][ T938] ? do_raw_spin_unlock+0x4d/0x210
[ 103.637913][ T938] ? _raw_spin_unlock+0x28/0x50
[ 103.639842][ T938] device_initial_probe+0xa1/0xd0
[ 103.641917][ T938] bus_probe_device+0x12a/0x220
[ 103.643898][ T938] device_add+0x7d7/0xb80
[ 103.645697][ T938] usb_set_configuration+0x1ad8/0x2180
[ 103.647995][ T938] usb_generic_driver_probe+0x8d/0x150
[ 103.650360][ T938] usb_probe_device+0x1c3/0x3b0
[ 103.652391][ T938] ? __pfx_usb_probe_device+0x10/0x10
[ 103.654516][ T938] really_probe+0x254/0xae0
[ 103.656375][ T938] __driver_probe_device+0x1e8/0x360
[ 103.658531][ T938] driver_probe_device+0x4f/0x240
[ 103.660661][ T938] __device_attach_driver+0x270/0x410
[ 103.662921][ T938] bus_for_each_drv+0x258/0x2f0
[ 103.665023][ T938] ? __pfx___device_attach_driver+0x10/0x10
[ 103.667532][ T938] ? __pfx_bus_for_each_drv+0x10/0x10
[ 103.669830][ T938] ? lockdep_hardirqs_on+0x7a/0x110
[ 103.672090][ T938] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 103.674572][ T938] __device_attach+0x2c4/0x450
[ 103.676549][ T938] ? __pfx___device_attach+0x10/0x10
[ 103.678792][ T938] ? do_raw_spin_unlock+0x4d/0x210
[ 103.680915][ T938] ? _raw_spin_unlock+0x28/0x50
[ 103.682953][ T938] device_initial_probe+0xa1/0xd0
[ 103.684998][ T938] bus_probe_device+0x12a/0x220
[ 103.687025][ T938] device_add+0x7d7/0xb80
[ 103.688773][ T938] usb_new_device+0x99d/0x1620
[ 103.690751][ T938] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 103.693171][ T938] ? __pfx_usb_new_device+0x10/0x10
[ 103.695346][ T938] ? _raw_spin_unlock_irq+0x23/0x50
[ 103.697518][ T938] hub_event+0x28e8/0x4d30
[ 103.699376][ T938] ? __pfx_hub_event+0x10/0x10
[ 103.701316][ T938] ? process_scheduled_works+0xa20/0x14e0
[ 103.703673][ T938] ? rcu_is_watching+0x15/0xb0
[ 103.705616][ T938] ? process_scheduled_works+0xa20/0x14e0
[ 103.707856][ T938] process_scheduled_works+0xa8e/0x14e0
[ 103.710093][ T938] ? __pfx_process_scheduled_works+0x10/0x10
[ 103.712470][ T938] ? assign_work+0x3cf/0x5d0
[ 103.714355][ T938] worker_thread+0xa47/0xfb0
[ 103.716282][ T938] ? __kthread_parkme+0x71/0x1f0
[ 103.718309][ T938] kthread+0x388/0x470
[ 103.720009][ T938] ? __pfx_worker_thread+0x10/0x10
[ 103.722065][ T938] ? __pfx_kthread+0x10/0x10
[ 103.723950][ T938] ret_from_fork+0x514/0xb70
[ 103.725886][ T938] ? __pfx_ret_from_fork+0x10/0x10
[ 103.727979][ T938] ? __switch_to+0xc89/0x1420
[ 103.729927][ T938] ? __pfx_kthread+0x10/0x10
[ 103.731831][ T938] ret_from_fork_asm+0x1a/0x30
[ 103.733832][ T938]
[ 103.735518][ T938] Kernel Offset: disabled
[ 103.737330][ T938] Rebooting in 86400 seconds..