program:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404c05c1060001010203010902200001010080fa0904000002ffffff000705810200020007050202000200"], 0x0)
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000100)="0000ff00ff00")
syz_usb_ep_write(r0, 0x81, 0x14, &(0x7f0000000106)="0000ffffff0a00f6d7290000000000000003fd00")
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000200)="0000ff00ff00")
syz_usb_ep_write(r0, 0x81, 0xd, &(0x7f0000000206)="0000ffffff0300fdd72b00fe00")
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000300)="0000ff00ff00")
syz_usb_ep_write(r0, 0x81, 0xe, &(0x7f0000000306)="0000ffffff0400fcd72101000700")
nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000001000), r1)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000002000)={0x0, 0x0, &(0x7f0000002100)={&(0x7f0000002200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x1c}}, 0x0)
sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000003000)={0x0, 0x0, &(0x7f0000003100)={&(0x7f0000003200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000004000)={0x0, 0x0, &(0x7f0000004100)={&(0x7f0000004200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x1}]}, 0x1c}}, 0x0)
sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000005100)={&(0x7f0000005200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x1}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000006000)={0x0, 0x0, &(0x7f0000006100)={&(0x7f0000006200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x2}]}, 0x1c}}, 0x0)
sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000007100)={&(0x7f0000007200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x2}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0)
[ 116.163380][ T10] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 116.223430][ T4651] Bluetooth: hci0: command tx timeout
[ 116.320457][ T10] usb 5-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice= 1.00
[ 116.324367][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 116.327775][ T10] usb 5-1: Product: syz
[ 116.329657][ T10] usb 5-1: Manufacturer: syz
[ 116.331601][ T10] usb 5-1: SerialNumber: syz
[ 116.751101][ T10] ------------[ cut here ]------------
[ 116.753075][ T10] URB ffff8880373e6800 submitted while active
[ 116.755123][ T10] WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x79/0x18b0, CPU#0: kworker/0:1/10
[ 116.758457][ T10] Modules linked in:
[ 116.759857][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full)
[ 116.762857][ T10] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 116.766158][ T10] Workqueue: usb_hub_wq hub_event
[ 116.767882][ T10] RIP: 0010:usb_submit_urb+0x7c/0x18b0
[ 116.769761][ T10] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 79 40 d3 fa 49 83 3e 00 74 40 e8 ce 0d 64 fa 48 8d 3d 07 a0 02 09 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 b3 0d 64 fa eb 05 e8 ac 0d
[ 116.776045][ T10] RSP: 0018:ffffc9000023eb80 EFLAGS: 00010293
[ 116.778084][ T10] RAX: ffffffff876314f2 RBX: ffff8880373e6800 RCX: ffff88801bf0a540
[ 116.780712][ T10] RDX: 0000000000000000 RSI: ffff8880373e6800 RDI: ffffffff9065b500
[ 116.783817][ T10] RBP: dffffc0000000000 R08: ffffffff9057c237 R09: 1ffffffff20af846
[ 116.786459][ T10] R10: dffffc0000000000 R11: fffffbfff20af847 R12: ffff88803fb9e458
[ 116.789947][ T10] R13: 1ffff11007f73c8b R14: ffff8880373e6808 R15: 0000000000000cc0
[ 116.793670][ T10] FS: 0000000000000000(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000
[ 116.796733][ T10] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 116.798926][ T10] CR2: 00007f1809c157f0 CR3: 0000000042d34000 CR4: 0000000000352ef0
[ 116.802282][ T10] Call Trace:
[ 116.803890][ T10]
[ 116.805242][ T10] ? __kmalloc_cache_noprof+0x150/0x660
[ 116.807551][ T10] ? port100_send_cmd_async+0xbd/0xcc0
[ 116.809849][ T10] ? skb_put+0x112/0x210
[ 116.811704][ T10] port100_send_cmd_async+0x84f/0xcc0
[ 116.814038][ T10] port100_set_command_type+0x1c8/0x390
[ 116.816372][ T10] ? pcpu_alloc+0x10/0x310
[ 116.818279][ T10] ? __pfx_port100_set_command_type+0x10/0x10
[ 116.820847][ T10] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 116.823263][ T10] port100_probe+0x7b2/0xba0
[ 116.825964][ T10] ? __pfx_port100_probe+0x10/0x10
[ 116.828104][ T10] ? lockdep_hardirqs_on+0x7a/0x110
[ 116.830302][ T10] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 116.832814][ T10] ? __pm_runtime_set_status+0x994/0xc80
[ 116.835185][ T10] usb_probe_interface+0x653/0xc60
[ 116.837425][ T10] ? __pfx_usb_probe_interface+0x10/0x10
[ 116.839907][ T10] really_probe+0x254/0xae0
[ 116.841927][ T10] __driver_probe_device+0x1e8/0x360
[ 116.844370][ T10] driver_probe_device+0x4f/0x240
[ 116.846589][ T10] __device_attach_driver+0x270/0x410
[ 116.848912][ T10] bus_for_each_drv+0x258/0x2f0
[ 116.851007][ T10] ? __pfx___device_attach_driver+0x10/0x10
[ 116.853526][ T10] ? __pfx_bus_for_each_drv+0x10/0x10
[ 116.855651][ T10] ? lockdep_hardirqs_on+0x7a/0x110
[ 116.857776][ T10] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 116.860130][ T10] __device_attach+0x2c4/0x450
[ 116.862037][ T10] ? __pfx___device_attach+0x10/0x10
[ 116.864864][ T10] ? do_raw_spin_unlock+0x4d/0x210
[ 116.866769][ T10] ? _raw_spin_unlock+0x28/0x50
[ 116.868568][ T10] device_initial_probe+0xa1/0xd0
[ 116.870465][ T10] bus_probe_device+0x12a/0x220
[ 116.872308][ T10] device_add+0x7d7/0xb80
[ 116.873944][ T10] usb_set_configuration+0x1ad8/0x2180
[ 116.876056][ T10] usb_generic_driver_probe+0x8d/0x150
[ 116.878162][ T10] usb_probe_device+0x1c3/0x3b0
[ 116.880058][ T10] ? __pfx_usb_probe_device+0x10/0x10
[ 116.882116][ T10] really_probe+0x254/0xae0
[ 116.883879][ T10] __driver_probe_device+0x1e8/0x360
[ 116.885867][ T10] driver_probe_device+0x4f/0x240
[ 116.887788][ T10] __device_attach_driver+0x270/0x410
[ 116.890180][ T10] bus_for_each_drv+0x258/0x2f0
[ 116.892051][ T10] ? __pfx___device_attach_driver+0x10/0x10
[ 116.894567][ T10] ? __pfx_bus_for_each_drv+0x10/0x10
[ 116.896671][ T10] ? lockdep_hardirqs_on+0x7a/0x110
[ 116.898666][ T10] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 116.901009][ T10] __device_attach+0x2c4/0x450
[ 116.902895][ T10] ? __pfx___device_attach+0x10/0x10
[ 116.905024][ T10] ? do_raw_spin_unlock+0x4d/0x210
[ 116.907036][ T10] ? _raw_spin_unlock+0x28/0x50
[ 116.909014][ T10] device_initial_probe+0xa1/0xd0
[ 116.911018][ T10] bus_probe_device+0x12a/0x220
[ 116.913050][ T10] device_add+0x7d7/0xb80
[ 116.914825][ T10] usb_new_device+0x99d/0x1620
[ 116.916758][ T10] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 116.919176][ T10] ? __pfx_usb_new_device+0x10/0x10
[ 116.921267][ T10] ? _raw_spin_unlock_irq+0x23/0x50
[ 116.923342][ T10] hub_event+0x28e8/0x4d30
[ 116.925150][ T10] ? do_raw_spin_unlock+0x4d/0x210
[ 116.927200][ T10] ? __pfx_hub_event+0x10/0x10
[ 116.929134][ T10] ? process_scheduled_works+0xa20/0x14e0
[ 116.931418][ T10] ? rcu_is_watching+0x15/0xb0
[ 116.933392][ T10] ? process_scheduled_works+0xa20/0x14e0
[ 116.935717][ T10] process_scheduled_works+0xa8e/0x14e0
[ 116.937977][ T10] ? __pfx_process_scheduled_works+0x10/0x10
[ 116.940356][ T10] ? assign_work+0x3cf/0x5d0
[ 116.942208][ T10] worker_thread+0xa47/0xfb0
[ 116.944251][ T10] ? __kthread_parkme+0x71/0x1f0
[ 116.946215][ T10] kthread+0x388/0x470
[ 116.947857][ T10] ? __pfx_worker_thread+0x10/0x10
[ 116.949871][ T10] ? __pfx_kthread+0x10/0x10
[ 116.951666][ T10] ret_from_fork+0x514/0xb70
[ 116.953507][ T10] ? __pfx_ret_from_fork+0x10/0x10
[ 116.955630][ T10] ? __switch_to+0xc89/0x1420
[ 116.957359][ T10] ? __pfx_kthread+0x10/0x10
[ 116.959049][ T10] ret_from_fork_asm+0x1a/0x30
[ 116.960817][ T10]
[ 116.962028][ T10] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 116.964720][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full)
[ 116.968524][ T10] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 116.972702][ T10] Workqueue: usb_hub_wq hub_event
[ 116.974812][ T10] Call Trace:
[ 116.976302][ T10]
[ 116.977619][ T10] vpanic+0x56c/0xa60
[ 116.979326][ T10] ? __pfx__printk+0x10/0x10
[ 116.981245][ T10] ? __pfx_vpanic+0x10/0x10
[ 116.983157][ T10] ? is_bpf_text_address+0x292/0x2b0
[ 116.985406][ T10] ? is_bpf_text_address+0x26/0x2b0
[ 116.987660][ T10] panic+0xc5/0xd0
[ 116.989325][ T10] ? __pfx_panic+0x10/0x10
[ 116.991257][ T10] ? ret_from_fork_asm+0x1a/0x30
[ 116.993420][ T10] __warn+0x315/0x4c0
[ 116.995144][ T10] ? usb_submit_urb+0x79/0x18b0
[ 116.997225][ T10] ? usb_submit_urb+0x79/0x18b0
[ 116.999278][ T10] __report_bug+0x276/0x570
[ 117.001285][ T10] ? kasan_save_track+0x4f/0x80
[ 117.003368][ T10] ? kasan_save_track+0x3e/0x80
[ 117.005448][ T10] ? usb_submit_urb+0x79/0x18b0
[ 117.007553][ T10] ? __pfx___report_bug+0x10/0x10
[ 117.009708][ T10] ? __pfx___mutex_trylock_common+0x10/0x10
[ 117.012193][ T10] ? rcu_is_watching+0x15/0xb0
[ 117.014245][ T10] ? trace_contention_end+0x3d/0x140
[ 117.016475][ T10] report_bug_entry+0x19a/0x290
[ 117.018557][ T10] ? usb_submit_urb+0x7c/0x18b0
[ 117.020663][ T10] ? usb_submit_urb+0x81/0x18b0
[ 117.022702][ T10] handle_bug+0xce/0x200
[ 117.024458][ T10] exc_invalid_op+0x1a/0x50
[ 117.026357][ T10] asm_exc_invalid_op+0x1a/0x20
[ 117.028261][ T10] RIP: 0010:usb_submit_urb+0x7c/0x18b0
[ 117.030447][ T10] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 79 40 d3 fa 49 83 3e 00 74 40 e8 ce 0d 64 fa 48 8d 3d 07 a0 02 09 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 b3 0d 64 fa eb 05 e8 ac 0d
[ 117.038218][ T10] RSP: 0018:ffffc9000023eb80 EFLAGS: 00010293
[ 117.040804][ T10] RAX: ffffffff876314f2 RBX: ffff8880373e6800 RCX: ffff88801bf0a540
[ 117.044097][ T10] RDX: 0000000000000000 RSI: ffff8880373e6800 RDI: ffffffff9065b500
[ 117.047370][ T10] RBP: dffffc0000000000 R08: ffffffff9057c237 R09: 1ffffffff20af846
[ 117.050614][ T10] R10: dffffc0000000000 R11: fffffbfff20af847 R12: ffff88803fb9e458
[ 117.053950][ T10] R13: 1ffff11007f73c8b R14: ffff8880373e6808 R15: 0000000000000cc0
[ 117.057217][ T10] ? usb_submit_urb+0x72/0x18b0
[ 117.059291][ T10] ? __kmalloc_cache_noprof+0x150/0x660
[ 117.061580][ T10] ? port100_send_cmd_async+0xbd/0xcc0
[ 117.063892][ T10] ? skb_put+0x112/0x210
[ 117.065709][ T10] port100_send_cmd_async+0x84f/0xcc0
[ 117.068021][ T10] port100_set_command_type+0x1c8/0x390
[ 117.070224][ T10] ? pcpu_alloc+0x10/0x310
[ 117.071926][ T10] ? __pfx_port100_set_command_type+0x10/0x10
[ 117.074191][ T10] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 117.076452][ T10] port100_probe+0x7b2/0xba0
[ 117.078223][ T10] ? __pfx_port100_probe+0x10/0x10
[ 117.080156][ T10] ? lockdep_hardirqs_on+0x7a/0x110
[ 117.082245][ T10] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 117.084525][ T10] ? __pm_runtime_set_status+0x994/0xc80
[ 117.086669][ T10] usb_probe_interface+0x653/0xc60
[ 117.088686][ T10] ? __pfx_usb_probe_interface+0x10/0x10
[ 117.091059][ T10] really_probe+0x254/0xae0
[ 117.093058][ T10] __driver_probe_device+0x1e8/0x360
[ 117.095280][ T10] driver_probe_device+0x4f/0x240
[ 117.097378][ T10] __device_attach_driver+0x270/0x410
[ 117.099568][ T10] bus_for_each_drv+0x258/0x2f0
[ 117.101541][ T10] ? __pfx___device_attach_driver+0x10/0x10
[ 117.103987][ T10] ? __pfx_bus_for_each_drv+0x10/0x10
[ 117.106194][ T10] ? lockdep_hardirqs_on+0x7a/0x110
[ 117.108331][ T10] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 117.110772][ T10] __device_attach+0x2c4/0x450
[ 117.112861][ T10] ? __pfx___device_attach+0x10/0x10
[ 117.114990][ T10] ? do_raw_spin_unlock+0x4d/0x210
[ 117.117291][ T10] ? _raw_spin_unlock+0x28/0x50
[ 117.119234][ T10] device_initial_probe+0xa1/0xd0
[ 117.121241][ T10] bus_probe_device+0x12a/0x220
[ 117.123229][ T10] device_add+0x7d7/0xb80
[ 117.125100][ T10] usb_set_configuration+0x1ad8/0x2180
[ 117.127367][ T10] usb_generic_driver_probe+0x8d/0x150
[ 117.129633][ T10] usb_probe_device+0x1c3/0x3b0
[ 117.131502][ T10] ? __pfx_usb_probe_device+0x10/0x10
[ 117.133771][ T10] really_probe+0x254/0xae0
[ 117.135633][ T10] __driver_probe_device+0x1e8/0x360
[ 117.137712][ T10] driver_probe_device+0x4f/0x240
[ 117.139675][ T10] __device_attach_driver+0x270/0x410
[ 117.141805][ T10] bus_for_each_drv+0x258/0x2f0
[ 117.143610][ T10] ? __pfx___device_attach_driver+0x10/0x10
[ 117.145795][ T10] ? __pfx_bus_for_each_drv+0x10/0x10
[ 117.147842][ T10] ? lockdep_hardirqs_on+0x7a/0x110
[ 117.149740][ T10] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 117.151846][ T10] __device_attach+0x2c4/0x450
[ 117.153709][ T10] ? __pfx___device_attach+0x10/0x10
[ 117.155644][ T10] ? do_raw_spin_unlock+0x4d/0x210
[ 117.157533][ T10] ? _raw_spin_unlock+0x28/0x50
[ 117.159248][ T10] device_initial_probe+0xa1/0xd0
[ 117.160963][ T10] bus_probe_device+0x12a/0x220
[ 117.162627][ T10] device_add+0x7d7/0xb80
[ 117.164135][ T10] usb_new_device+0x99d/0x1620
[ 117.165849][ T10] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 117.167919][ T10] ? __pfx_usb_new_device+0x10/0x10
[ 117.169739][ T10] ? _raw_spin_unlock_irq+0x23/0x50
[ 117.171547][ T10] hub_event+0x28e8/0x4d30
[ 117.173263][ T10] ? do_raw_spin_unlock+0x4d/0x210
[ 117.175148][ T10] ? __pfx_hub_event+0x10/0x10
[ 117.176920][ T10] ? process_scheduled_works+0xa20/0x14e0
[ 117.179022][ T10] ? rcu_is_watching+0x15/0xb0
[ 117.180911][ T10] ? process_scheduled_works+0xa20/0x14e0
[ 117.182887][ T10] process_scheduled_works+0xa8e/0x14e0
[ 117.184767][ T10] ? __pfx_process_scheduled_works+0x10/0x10
[ 117.187040][ T10] ? assign_work+0x3cf/0x5d0
[ 117.188892][ T10] worker_thread+0xa47/0xfb0
[ 117.190660][ T10] ? __kthread_parkme+0x71/0x1f0
[ 117.192543][ T10] kthread+0x388/0x470
[ 117.194132][ T10] ? __pfx_worker_thread+0x10/0x10
[ 117.196019][ T10] ? __pfx_kthread+0x10/0x10
[ 117.197583][ T10] ret_from_fork+0x514/0xb70
[ 117.199163][ T10] ? __pfx_ret_from_fork+0x10/0x10
[ 117.200823][ T10] ? __switch_to+0xc89/0x1420
[ 117.202306][ T10] ? __pfx_kthread+0x10/0x10
[ 117.203910][ T10] ret_from_fork_asm+0x1a/0x30
[ 117.205636][ T10]
[ 117.207146][ T10] Kernel Offset: disabled
[ 117.208756][ T10] Rebooting in 86400 seconds..