program:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404c05c1060001010203010902200001010080fa0904000002ffffff000705810200020007050202000200"], 0x0)
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000100)="0000ff00ff00")
syz_usb_ep_write(r0, 0x81, 0x14, &(0x7f0000000106)="0000ffffff0a00f6d7290000000000000003fd00")
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000200)="0000ff00ff00")
syz_usb_ep_write(r0, 0x81, 0xd, &(0x7f0000000206)="0000ffffff0300fdd72b00fe00")
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000300)="0000ff00ff00")
syz_usb_ep_write(r0, 0x81, 0xe, &(0x7f0000000306)="0000ffffff0400fcd72101000700")
nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000001000), r1)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000002000)={0x0, 0x0, &(0x7f0000002100)={&(0x7f0000002200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x1c}}, 0x0)
sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000003000)={0x0, 0x0, &(0x7f0000003100)={&(0x7f0000003200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000004000)={0x0, 0x0, &(0x7f0000004100)={&(0x7f0000004200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x1}]}, 0x1c}}, 0x0)
sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000005100)={&(0x7f0000005200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x1}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000006000)={0x0, 0x0, &(0x7f0000006100)={&(0x7f0000006200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x2}]}, 0x1c}}, 0x0)
sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000007100)={&(0x7f0000007200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x2}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0) (async)
syz_usb_disconnect(r0)
[ 86.418487][ T9] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 86.482216][ T1379] cfg80211: failed to load regulatory.db
[ 86.574329][ T9] usb 5-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice= 1.00
[ 86.578120][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 86.581385][ T9] usb 5-1: Product: syz
[ 86.583197][ T9] usb 5-1: Manufacturer: syz
[ 86.585024][ T9] usb 5-1: SerialNumber: syz
[ 86.639453][ T5287] Bluetooth: hci0: command tx timeout
[ 87.003496][ T9] ------------[ cut here ]------------
[ 87.005789][ T9] URB ffff888037a66900 submitted while active
[ 87.008322][ T9] WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x79/0x18b0, CPU#0: kworker/0:0/9
[ 87.012532][ T9] Modules linked in:
[ 87.015371][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full)
[ 87.019578][ T9] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 87.023779][ T9] Workqueue: usb_hub_wq hub_event
[ 87.025912][ T9] RIP: 0010:usb_submit_urb+0x7c/0x18b0
[ 87.028272][ T9] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 79 40 d3 fa 49 83 3e 00 74 40 e8 ce 0d 64 fa 48 8d 3d 07 a0 02 09 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 b3 0d 64 fa eb 05 e8 ac 0d
[ 87.036007][ T9] RSP: 0018:ffffc9000022eb80 EFLAGS: 00010293
[ 87.038904][ T9] RAX: ffffffff876314f2 RBX: ffff888037a66900 RCX: ffff88801bf0ca80
[ 87.042199][ T9] RDX: 0000000000000000 RSI: ffff888037a66900 RDI: ffffffff9065b500
[ 87.045452][ T9] RBP: dffffc0000000000 R08: ffffffff9057c237 R09: 1ffffffff20af846
[ 87.048882][ T9] R10: dffffc0000000000 R11: fffffbfff20af847 R12: ffff88801fd53458
[ 87.051998][ T9] R13: 1ffff11003faa68b R14: ffff888037a66908 R15: 0000000000000cc0
[ 87.055047][ T9] FS: 0000000000000000(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000
[ 87.058487][ T9] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 87.060908][ T9] CR2: 00007f96cba157f0 CR3: 0000000012aa4000 CR4: 0000000000352ef0
[ 87.064024][ T9] Call Trace:
[ 87.065389][ T9]
[ 87.066643][ T9] ? __kmalloc_cache_noprof+0x150/0x660
[ 87.068977][ T9] ? port100_send_cmd_async+0xbd/0xcc0
[ 87.071327][ T9] ? skb_put+0x112/0x210
[ 87.073216][ T9] port100_send_cmd_async+0x84f/0xcc0
[ 87.075457][ T9] port100_set_command_type+0x1c8/0x390
[ 87.078008][ T9] ? pcpu_alloc+0x10/0x310
[ 87.079871][ T9] ? __pfx_port100_set_command_type+0x10/0x10
[ 87.081945][ T9] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 87.083962][ T9] port100_probe+0x7b2/0xba0
[ 87.085505][ T9] ? __pfx_port100_probe+0x10/0x10
[ 87.087320][ T9] ? lockdep_hardirqs_on+0x7a/0x110
[ 87.089329][ T9] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 87.091549][ T9] ? __pm_runtime_set_status+0x994/0xc80
[ 87.093850][ T9] usb_probe_interface+0x653/0xc60
[ 87.095876][ T9] ? __pfx_usb_probe_interface+0x10/0x10
[ 87.098166][ T9] really_probe+0x254/0xae0
[ 87.100048][ T9] __driver_probe_device+0x1e8/0x360
[ 87.102150][ T9] driver_probe_device+0x4f/0x240
[ 87.104106][ T9] __device_attach_driver+0x270/0x410
[ 87.106034][ T9] bus_for_each_drv+0x258/0x2f0
[ 87.107935][ T9] ? __pfx___device_attach_driver+0x10/0x10
[ 87.110215][ T9] ? __pfx_bus_for_each_drv+0x10/0x10
[ 87.112257][ T9] ? lockdep_hardirqs_on+0x7a/0x110
[ 87.114255][ T9] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 87.116437][ T9] __device_attach+0x2c4/0x450
[ 87.118322][ T9] ? __pfx___device_attach+0x10/0x10
[ 87.121882][ T9] ? do_raw_spin_unlock+0x4d/0x210
[ 87.123905][ T9] ? _raw_spin_unlock+0x28/0x50
[ 87.125844][ T9] device_initial_probe+0xa1/0xd0
[ 87.127896][ T9] bus_probe_device+0x12a/0x220
[ 87.130065][ T9] device_add+0x7d7/0xb80
[ 87.131903][ T9] usb_set_configuration+0x1ad8/0x2180
[ 87.134205][ T9] usb_generic_driver_probe+0x8d/0x150
[ 87.136504][ T9] usb_probe_device+0x1c3/0x3b0
[ 87.138658][ T9] ? __pfx_usb_probe_device+0x10/0x10
[ 87.140841][ T9] really_probe+0x254/0xae0
[ 87.142780][ T9] __driver_probe_device+0x1e8/0x360
[ 87.144980][ T9] driver_probe_device+0x4f/0x240
[ 87.147100][ T9] __device_attach_driver+0x270/0x410
[ 87.149444][ T9] bus_for_each_drv+0x258/0x2f0
[ 87.151482][ T9] ? __pfx___device_attach_driver+0x10/0x10
[ 87.153907][ T9] ? __pfx_bus_for_each_drv+0x10/0x10
[ 87.156121][ T9] ? lockdep_hardirqs_on+0x7a/0x110
[ 87.158268][ T9] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 87.160734][ T9] __device_attach+0x2c4/0x450
[ 87.162793][ T9] ? __pfx___device_attach+0x10/0x10
[ 87.164958][ T9] ? do_raw_spin_unlock+0x4d/0x210
[ 87.167120][ T9] ? _raw_spin_unlock+0x28/0x50
[ 87.169294][ T9] device_initial_probe+0xa1/0xd0
[ 87.171387][ T9] bus_probe_device+0x12a/0x220
[ 87.173432][ T9] device_add+0x7d7/0xb80
[ 87.175266][ T9] usb_new_device+0x99d/0x1620
[ 87.177234][ T9] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 87.180130][ T9] ? __pfx_usb_new_device+0x10/0x10
[ 87.182195][ T9] ? _raw_spin_unlock_irq+0x23/0x50
[ 87.184232][ T9] hub_event+0x28e8/0x4d30
[ 87.186429][ T9] ? do_raw_spin_unlock+0x4d/0x210
[ 87.188747][ T9] ? __pfx_hub_event+0x10/0x10
[ 87.191041][ T9] ? process_scheduled_works+0xa20/0x14e0
[ 87.193537][ T9] ? rcu_is_watching+0x15/0xb0
[ 87.195432][ T9] ? process_scheduled_works+0xa20/0x14e0
[ 87.197791][ T9] process_scheduled_works+0xa8e/0x14e0
[ 87.200734][ T9] ? __pfx_process_scheduled_works+0x10/0x10
[ 87.203219][ T9] ? assign_work+0x3cf/0x5d0
[ 87.205128][ T9] worker_thread+0xa47/0xfb0
[ 87.207008][ T9] kthread+0x388/0x470
[ 87.208798][ T9] ? __pfx_worker_thread+0x10/0x10
[ 87.211076][ T9] ? __pfx_kthread+0x10/0x10
[ 87.213180][ T9] ret_from_fork+0x514/0xb70
[ 87.215263][ T9] ? __pfx_ret_from_fork+0x10/0x10
[ 87.217597][ T9] ? __switch_to+0xc89/0x1420
[ 87.219762][ T9] ? __pfx_kthread+0x10/0x10
[ 87.221802][ T9] ret_from_fork_asm+0x1a/0x30
[ 87.223803][ T9]
[ 87.225069][ T9] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 87.228252][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full)
[ 87.231947][ T9] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 87.236126][ T9] Workqueue: usb_hub_wq hub_event
[ 87.238260][ T9] Call Trace:
[ 87.239663][ T9]
[ 87.240905][ T9] vpanic+0x56c/0xa60
[ 87.242604][ T9] ? __pfx__printk+0x10/0x10
[ 87.244560][ T9] ? __pfx_vpanic+0x10/0x10
[ 87.246505][ T9] ? is_bpf_text_address+0x292/0x2b0
[ 87.248832][ T9] ? is_bpf_text_address+0x26/0x2b0
[ 87.251049][ T9] panic+0xc5/0xd0
[ 87.252666][ T9] ? __pfx_panic+0x10/0x10
[ 87.254603][ T9] ? ret_from_fork_asm+0x1a/0x30
[ 87.256656][ T9] __warn+0x315/0x4c0
[ 87.258345][ T9] ? usb_submit_urb+0x79/0x18b0
[ 87.260105][ T9] ? usb_submit_urb+0x79/0x18b0
[ 87.261743][ T9] __report_bug+0x276/0x570
[ 87.263595][ T9] ? kasan_save_track+0x4f/0x80
[ 87.265257][ T9] ? kasan_save_track+0x3e/0x80
[ 87.266917][ T9] ? usb_submit_urb+0x79/0x18b0
[ 87.268914][ T9] ? __pfx___report_bug+0x10/0x10
[ 87.271103][ T9] ? __pfx___mutex_trylock_common+0x10/0x10
[ 87.273667][ T9] ? rcu_is_watching+0x15/0xb0
[ 87.275795][ T9] ? trace_contention_end+0x3d/0x140
[ 87.278072][ T9] report_bug_entry+0x19a/0x290
[ 87.280152][ T9] ? usb_submit_urb+0x7c/0x18b0
[ 87.282219][ T9] ? usb_submit_urb+0x81/0x18b0
[ 87.284275][ T9] handle_bug+0xce/0x200
[ 87.286108][ T9] exc_invalid_op+0x1a/0x50
[ 87.288133][ T9] asm_exc_invalid_op+0x1a/0x20
[ 87.290260][ T9] RIP: 0010:usb_submit_urb+0x7c/0x18b0
[ 87.292613][ T9] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 79 40 d3 fa 49 83 3e 00 74 40 e8 ce 0d 64 fa 48 8d 3d 07 a0 02 09 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 b3 0d 64 fa eb 05 e8 ac 0d
[ 87.301188][ T9] RSP: 0018:ffffc9000022eb80 EFLAGS: 00010293
[ 87.303892][ T9] RAX: ffffffff876314f2 RBX: ffff888037a66900 RCX: ffff88801bf0ca80
[ 87.307152][ T9] RDX: 0000000000000000 RSI: ffff888037a66900 RDI: ffffffff9065b500
[ 87.310460][ T9] RBP: dffffc0000000000 R08: ffffffff9057c237 R09: 1ffffffff20af846
[ 87.313722][ T9] R10: dffffc0000000000 R11: fffffbfff20af847 R12: ffff88801fd53458
[ 87.316936][ T9] R13: 1ffff11003faa68b R14: ffff888037a66908 R15: 0000000000000cc0
[ 87.320169][ T9] ? usb_submit_urb+0x72/0x18b0
[ 87.322506][ T9] ? __kmalloc_cache_noprof+0x150/0x660
[ 87.324838][ T9] ? port100_send_cmd_async+0xbd/0xcc0
[ 87.327124][ T9] ? skb_put+0x112/0x210
[ 87.328966][ T9] port100_send_cmd_async+0x84f/0xcc0
[ 87.331211][ T9] port100_set_command_type+0x1c8/0x390
[ 87.333525][ T9] ? pcpu_alloc+0x10/0x310
[ 87.335391][ T9] ? __pfx_port100_set_command_type+0x10/0x10
[ 87.337890][ T9] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 87.340431][ T9] port100_probe+0x7b2/0xba0
[ 87.342732][ T9] ? __pfx_port100_probe+0x10/0x10
[ 87.345262][ T9] ? lockdep_hardirqs_on+0x7a/0x110
[ 87.347934][ T9] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 87.350924][ T9] ? __pm_runtime_set_status+0x994/0xc80
[ 87.353875][ T9] usb_probe_interface+0x653/0xc60
[ 87.356377][ T9] ? __pfx_usb_probe_interface+0x10/0x10
[ 87.358729][ T9] really_probe+0x254/0xae0
[ 87.360659][ T9] __driver_probe_device+0x1e8/0x360
[ 87.362942][ T9] driver_probe_device+0x4f/0x240
[ 87.365553][ T9] __device_attach_driver+0x270/0x410
[ 87.368346][ T9] bus_for_each_drv+0x258/0x2f0
[ 87.370542][ T9] ? __pfx___device_attach_driver+0x10/0x10
[ 87.373277][ T9] ? __pfx_bus_for_each_drv+0x10/0x10
[ 87.375711][ T9] ? lockdep_hardirqs_on+0x7a/0x110
[ 87.378049][ T9] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 87.380700][ T9] __device_attach+0x2c4/0x450
[ 87.382933][ T9] ? __pfx___device_attach+0x10/0x10
[ 87.385361][ T9] ? do_raw_spin_unlock+0x4d/0x210
[ 87.387713][ T9] ? _raw_spin_unlock+0x28/0x50
[ 87.389954][ T9] device_initial_probe+0xa1/0xd0
[ 87.392127][ T9] bus_probe_device+0x12a/0x220
[ 87.394139][ T9] device_add+0x7d7/0xb80
[ 87.395958][ T9] usb_set_configuration+0x1ad8/0x2180
[ 87.398318][ T9] usb_generic_driver_probe+0x8d/0x150
[ 87.400601][ T9] usb_probe_device+0x1c3/0x3b0
[ 87.402669][ T9] ? __pfx_usb_probe_device+0x10/0x10
[ 87.404894][ T9] really_probe+0x254/0xae0
[ 87.406774][ T9] __driver_probe_device+0x1e8/0x360
[ 87.408962][ T9] driver_probe_device+0x4f/0x240
[ 87.411100][ T9] __device_attach_driver+0x270/0x410
[ 87.413315][ T9] bus_for_each_drv+0x258/0x2f0
[ 87.415680][ T9] ? __pfx___device_attach_driver+0x10/0x10
[ 87.418716][ T9] ? __pfx_bus_for_each_drv+0x10/0x10
[ 87.421269][ T9] ? lockdep_hardirqs_on+0x7a/0x110
[ 87.423400][ T9] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 87.425828][ T9] __device_attach+0x2c4/0x450
[ 87.427878][ T9] ? __pfx___device_attach+0x10/0x10
[ 87.430079][ T9] ? do_raw_spin_unlock+0x4d/0x210
[ 87.432220][ T9] ? _raw_spin_unlock+0x28/0x50
[ 87.434262][ T9] device_initial_probe+0xa1/0xd0
[ 87.436349][ T9] bus_probe_device+0x12a/0x220
[ 87.438462][ T9] device_add+0x7d7/0xb80
[ 87.440437][ T9] usb_new_device+0x99d/0x1620
[ 87.442629][ T9] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 87.445104][ T9] ? __pfx_usb_new_device+0x10/0x10
[ 87.447288][ T9] ? _raw_spin_unlock_irq+0x23/0x50
[ 87.449459][ T9] hub_event+0x28e8/0x4d30
[ 87.451386][ T9] ? do_raw_spin_unlock+0x4d/0x210
[ 87.453574][ T9] ? __pfx_hub_event+0x10/0x10
[ 87.455640][ T9] ? process_scheduled_works+0xa20/0x14e0
[ 87.458072][ T9] ? rcu_is_watching+0x15/0xb0
[ 87.460045][ T9] ? process_scheduled_works+0xa20/0x14e0
[ 87.461987][ T9] process_scheduled_works+0xa8e/0x14e0
[ 87.464404][ T9] ? __pfx_process_scheduled_works+0x10/0x10
[ 87.467013][ T9] ? assign_work+0x3cf/0x5d0
[ 87.469094][ T9] worker_thread+0xa47/0xfb0
[ 87.471116][ T9] kthread+0x388/0x470
[ 87.472843][ T9] ? __pfx_worker_thread+0x10/0x10
[ 87.475003][ T9] ? __pfx_kthread+0x10/0x10
[ 87.476945][ T9] ret_from_fork+0x514/0xb70
[ 87.478916][ T9] ? __pfx_ret_from_fork+0x10/0x10
[ 87.481108][ T9] ? __switch_to+0xc89/0x1420
[ 87.483125][ T9] ? __pfx_kthread+0x10/0x10
[ 87.485080][ T9] ret_from_fork_asm+0x1a/0x30
[ 87.487155][ T9]
[ 87.488937][ T9] Kernel Offset: disabled
[ 87.490701][ T9] Rebooting in 86400 seconds..