program:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404c05c1060001010203010902200001010080fa0904000002ffffff000705810200020007050202000200"], 0x0)
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000100)="0000ff00ff00")
syz_usb_ep_write(r0, 0x81, 0x14, &(0x7f0000000106)="0000ffffff0a00f6d7290000000000000003fd00")
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000200)="0000ff00ff00")
syz_usb_ep_write(r0, 0x81, 0xd, &(0x7f0000000206)="0000ffffff0300fdd72b00fe00")
syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000300)="0000ff00ff00")
syz_usb_ep_write(r0, 0x81, 0xe, &(0x7f0000000306)="0000ffffff0400fcd72101000700")
nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000001000), r1)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000002000)={0x0, 0x0, &(0x7f0000002100)={&(0x7f0000002200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x1c}}, 0x0)
sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000003000)={0x0, 0x0, &(0x7f0000003100)={&(0x7f0000003200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000004000)={0x0, 0x0, &(0x7f0000004100)={&(0x7f0000004200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x1}]}, 0x1c}}, 0x0)
sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000005100)={&(0x7f0000005200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x1}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0)
sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000006000)={0x0, 0x0, &(0x7f0000006100)={&(0x7f0000006200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x2}]}, 0x1c}}, 0x0)
sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000007100)={&(0x7f0000007200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x2}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0) (async)
syz_usb_disconnect(r0)
[ 85.797112][ T5307] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 85.927079][ T4651] Bluetooth: hci0: command tx timeout
[ 85.952244][ T5307] usb 5-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice= 1.00
[ 85.955818][ T5307] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 85.959266][ T5307] usb 5-1: Product: syz
[ 85.961021][ T5307] usb 5-1: Manufacturer: syz
[ 85.963049][ T5307] usb 5-1: SerialNumber: syz
[ 86.383959][ T5307] ------------[ cut here ]------------
[ 86.386252][ T5307] URB ffff88803767fb00 submitted while active
[ 86.388769][ T5307] WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x79/0x18b0, CPU#0: kworker/0:4/5307
[ 86.392998][ T5307] Modules linked in:
[ 86.394817][ T5307] CPU: 0 UID: 0 PID: 5307 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full)
[ 86.398293][ T5307] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.402079][ T5307] Workqueue: usb_hub_wq hub_event
[ 86.404292][ T5307] RIP: 0010:usb_submit_urb+0x7c/0x18b0
[ 86.406523][ T5307] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 79 40 d3 fa 49 83 3e 00 74 40 e8 ce 0d 64 fa 48 8d 3d 07 a0 02 09 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 b3 0d 64 fa eb 05 e8 ac 0d
[ 86.415369][ T5307] RSP: 0018:ffffc9000dfb6b80 EFLAGS: 00010293
[ 86.418054][ T5307] RAX: ffffffff876314f2 RBX: ffff88803767fb00 RCX: ffff8880006da540
[ 86.422993][ T5307] RDX: 0000000000000000 RSI: ffff88803767fb00 RDI: ffffffff9065b500
[ 86.427406][ T5307] RBP: dffffc0000000000 R08: ffffffff9057c237 R09: 1ffffffff20af846
[ 86.431061][ T5307] R10: dffffc0000000000 R11: fffffbfff20af847 R12: ffff88801323c458
[ 86.434065][ T5307] R13: 1ffff1100264788b R14: ffff88803767fb08 R15: 0000000000000cc0
[ 86.437293][ T5307] FS: 0000000000000000(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000
[ 86.440415][ T5307] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 86.442661][ T5307] CR2: 00007fa273c157f0 CR3: 0000000043a54000 CR4: 0000000000352ef0
[ 86.445523][ T5307] Call Trace:
[ 86.446792][ T5307]
[ 86.447949][ T5307] ? __kmalloc_cache_noprof+0x150/0x660
[ 86.449950][ T5307] ? port100_send_cmd_async+0xbd/0xcc0
[ 86.452094][ T5307] ? skb_put+0x112/0x210
[ 86.453869][ T5307] port100_send_cmd_async+0x84f/0xcc0
[ 86.456129][ T5307] port100_set_command_type+0x1c8/0x390
[ 86.458316][ T5307] ? trace_irq_disable+0x3b/0x140
[ 86.460023][ T5307] ? __pfx_port100_set_command_type+0x10/0x10
[ 86.462456][ T5307] ? _raw_spin_unlock_irqrestore+0x47/0x80
[ 86.464793][ T5307] port100_probe+0x7b2/0xba0
[ 86.466555][ T5307] ? __pfx_port100_probe+0x10/0x10
[ 86.468582][ T5307] ? lockdep_hardirqs_on+0x7a/0x110
[ 86.470976][ T5307] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 86.473769][ T5307] ? __pm_runtime_set_status+0x994/0xc80
[ 86.476111][ T5307] usb_probe_interface+0x653/0xc60
[ 86.478321][ T5307] ? __pfx_usb_probe_interface+0x10/0x10
[ 86.480600][ T5307] really_probe+0x254/0xae0
[ 86.482387][ T5307] __driver_probe_device+0x1e8/0x360
[ 86.484654][ T5307] driver_probe_device+0x4f/0x240
[ 86.486633][ T5307] __device_attach_driver+0x270/0x410
[ 86.489094][ T5307] bus_for_each_drv+0x258/0x2f0
[ 86.491018][ T5307] ? __pfx___device_attach_driver+0x10/0x10
[ 86.493327][ T5307] ? __pfx_bus_for_each_drv+0x10/0x10
[ 86.495380][ T5307] ? lockdep_hardirqs_on+0x7a/0x110
[ 86.497470][ T5307] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 86.499721][ T5307] __device_attach+0x2c4/0x450
[ 86.501726][ T5307] ? __pfx___device_attach+0x10/0x10
[ 86.503903][ T5307] ? do_raw_spin_unlock+0x4d/0x210
[ 86.506009][ T5307] ? _raw_spin_unlock+0x28/0x50
[ 86.508027][ T5307] device_initial_probe+0xa1/0xd0
[ 86.510074][ T5307] bus_probe_device+0x12a/0x220
[ 86.512050][ T5307] device_add+0x7d7/0xb80
[ 86.513775][ T5307] usb_set_configuration+0x1ad8/0x2180
[ 86.515832][ T5307] usb_generic_driver_probe+0x8d/0x150
[ 86.517812][ T5307] usb_probe_device+0x1c3/0x3b0
[ 86.519710][ T5307] ? __pfx_usb_probe_device+0x10/0x10
[ 86.521860][ T5307] really_probe+0x254/0xae0
[ 86.523798][ T5307] __driver_probe_device+0x1e8/0x360
[ 86.526009][ T5307] driver_probe_device+0x4f/0x240
[ 86.528184][ T5307] __device_attach_driver+0x270/0x410
[ 86.530467][ T5307] bus_for_each_drv+0x258/0x2f0
[ 86.532526][ T5307] ? __pfx___device_attach_driver+0x10/0x10
[ 86.535011][ T5307] ? __pfx_bus_for_each_drv+0x10/0x10
[ 86.537294][ T5307] ? lockdep_hardirqs_on+0x7a/0x110
[ 86.539486][ T5307] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 86.541951][ T5307] __device_attach+0x2c4/0x450
[ 86.543977][ T5307] ? __pfx___device_attach+0x10/0x10
[ 86.546215][ T5307] ? do_raw_spin_unlock+0x4d/0x210
[ 86.548490][ T5307] ? _raw_spin_unlock+0x28/0x50
[ 86.550556][ T5307] device_initial_probe+0xa1/0xd0
[ 86.552652][ T5307] bus_probe_device+0x12a/0x220
[ 86.554774][ T5307] device_add+0x7d7/0xb80
[ 86.556645][ T5307] usb_new_device+0x99d/0x1620
[ 86.558758][ T5307] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 86.561297][ T5307] ? __pfx_usb_new_device+0x10/0x10
[ 86.563517][ T5307] ? _raw_spin_unlock_irq+0x23/0x50
[ 86.565730][ T5307] hub_event+0x28e8/0x4d30
[ 86.568714][ T5307] ? do_raw_spin_unlock+0x4d/0x210
[ 86.571004][ T5307] ? __pfx_hub_event+0x10/0x10
[ 86.573483][ T5307] ? process_scheduled_works+0xa20/0x14e0
[ 86.575843][ T5307] ? rcu_is_watching+0x15/0xb0
[ 86.578342][ T5307] ? process_scheduled_works+0xa20/0x14e0
[ 86.580853][ T5307] process_scheduled_works+0xa8e/0x14e0
[ 86.583324][ T5307] ? __pfx_process_scheduled_works+0x10/0x10
[ 86.585951][ T5307] ? assign_work+0x3cf/0x5d0
[ 86.588069][ T5307] worker_thread+0xa47/0xfb0
[ 86.590140][ T5307] kthread+0x388/0x470
[ 86.591944][ T5307] ? __pfx_worker_thread+0x10/0x10
[ 86.594186][ T5307] ? __pfx_kthread+0x10/0x10
[ 86.596213][ T5307] ret_from_fork+0x514/0xb70
[ 86.598240][ T5307] ? __pfx_ret_from_fork+0x10/0x10
[ 86.600468][ T5307] ? __switch_to+0xc89/0x1420
[ 86.602510][ T5307] ? __pfx_kthread+0x10/0x10
[ 86.604582][ T5307] ret_from_fork_asm+0x1a/0x30
[ 86.606643][ T5307]
[ 86.608089][ T5307] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 86.611121][ T5307] CPU: 0 UID: 0 PID: 5307 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full)
[ 86.614852][ T5307] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.618955][ T5307] Workqueue: usb_hub_wq hub_event
[ 86.621011][ T5307] Call Trace:
[ 86.622397][ T5307]
[ 86.623620][ T5307] vpanic+0x56c/0xa60
[ 86.625264][ T5307] ? __pfx__printk+0x10/0x10
[ 86.627116][ T5307] ? __pfx_vpanic+0x10/0x10
[ 86.628939][ T5307] ? is_bpf_text_address+0x292/0x2b0
[ 86.631061][ T5307] ? is_bpf_text_address+0x26/0x2b0
[ 86.633225][ T5307] panic+0xc5/0xd0
[ 86.634771][ T5307] ? __pfx_panic+0x10/0x10
[ 86.636640][ T5307] ? ret_from_fork_asm+0x1a/0x30
[ 86.638699][ T5307] __warn+0x315/0x4c0
[ 86.640423][ T5307] ? usb_submit_urb+0x79/0x18b0
[ 86.642445][ T5307] ? usb_submit_urb+0x79/0x18b0
[ 86.644516][ T5307] __report_bug+0x276/0x570
[ 86.646404][ T5307] ? kasan_save_track+0x4f/0x80
[ 86.648415][ T5307] ? kasan_save_track+0x3e/0x80
[ 86.650491][ T5307] ? usb_submit_urb+0x79/0x18b0
[ 86.652540][ T5307] ? __pfx___report_bug+0x10/0x10
[ 86.654656][ T5307] ? usb_submit_urb+0x81/0x18b0
[ 86.656700][ T5307] report_bug_entry+0x19a/0x290
[ 86.658725][ T5307] ? usb_submit_urb+0x7c/0x18b0
[ 86.660767][ T5307] ? usb_submit_urb+0x81/0x18b0
[ 86.662562][ T5307] handle_bug+0xce/0x200
[ 86.664263][ T5307] exc_invalid_op+0x1a/0x50
[ 86.666040][ T5307] asm_exc_invalid_op+0x1a/0x20
[ 86.667893][ T5307] RIP: 0010:usb_submit_urb+0x7c/0x18b0
[ 86.669899][ T5307] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 79 40 d3 fa 49 83 3e 00 74 40 e8 ce 0d 64 fa 48 8d 3d 07 a0 02 09 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 b3 0d 64 fa eb 05 e8 ac 0d
[ 86.676763][ T5307] RSP: 0018:ffffc9000dfb6b80 EFLAGS: 00010293
[ 86.679030][ T5307] RAX: ffffffff876314f2 RBX: ffff88803767fb00 RCX: ffff8880006da540
[ 86.681882][ T5307] RDX: 0000000000000000 RSI: ffff88803767fb00 RDI: ffffffff9065b500
[ 86.684584][ T5307] RBP: dffffc0000000000 R08: ffffffff9057c237 R09: 1ffffffff20af846
[ 86.687502][ T5307] R10: dffffc0000000000 R11: fffffbfff20af847 R12: ffff88801323c458
[ 86.690416][ T5307] R13: 1ffff1100264788b R14: ffff88803767fb08 R15: 0000000000000cc0
[ 86.693193][ T5307] ? usb_submit_urb+0x72/0x18b0
[ 86.695013][ T5307] ? __kmalloc_cache_noprof+0x150/0x660
[ 86.697068][ T5307] ? port100_send_cmd_async+0xbd/0xcc0
[ 86.699071][ T5307] ? skb_put+0x112/0x210
[ 86.700676][ T5307] port100_send_cmd_async+0x84f/0xcc0
[ 86.702619][ T5307] port100_set_command_type+0x1c8/0x390
[ 86.704705][ T5307] ? trace_irq_disable+0x3b/0x140
[ 86.706404][ T5307] ? __pfx_port100_set_command_type+0x10/0x10
[ 86.708614][ T5307] ? _raw_spin_unlock_irqrestore+0x47/0x80
[ 86.710814][ T5307] port100_probe+0x7b2/0xba0
[ 86.712573][ T5307] ? __pfx_port100_probe+0x10/0x10
[ 86.714474][ T5307] ? lockdep_hardirqs_on+0x7a/0x110
[ 86.716423][ T5307] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 86.718470][ T5307] ? __pm_runtime_set_status+0x994/0xc80
[ 86.720339][ T5307] usb_probe_interface+0x653/0xc60
[ 86.722093][ T5307] ? __pfx_usb_probe_interface+0x10/0x10
[ 86.724079][ T5307] really_probe+0x254/0xae0
[ 86.725581][ T5307] __driver_probe_device+0x1e8/0x360
[ 86.727476][ T5307] driver_probe_device+0x4f/0x240
[ 86.729143][ T5307] __device_attach_driver+0x270/0x410
[ 86.730945][ T5307] bus_for_each_drv+0x258/0x2f0
[ 86.732658][ T5307] ? __pfx___device_attach_driver+0x10/0x10
[ 86.734963][ T5307] ? __pfx_bus_for_each_drv+0x10/0x10
[ 86.736964][ T5307] ? lockdep_hardirqs_on+0x7a/0x110
[ 86.738921][ T5307] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 86.741108][ T5307] __device_attach+0x2c4/0x450
[ 86.742867][ T5307] ? __pfx___device_attach+0x10/0x10
[ 86.744671][ T5307] ? do_raw_spin_unlock+0x4d/0x210
[ 86.746354][ T5307] ? _raw_spin_unlock+0x28/0x50
[ 86.747959][ T5307] device_initial_probe+0xa1/0xd0
[ 86.749753][ T5307] bus_probe_device+0x12a/0x220
[ 86.751400][ T5307] device_add+0x7d7/0xb80
[ 86.752863][ T5307] usb_set_configuration+0x1ad8/0x2180
[ 86.754737][ T5307] usb_generic_driver_probe+0x8d/0x150
[ 86.756561][ T5307] usb_probe_device+0x1c3/0x3b0
[ 86.758209][ T5307] ? __pfx_usb_probe_device+0x10/0x10
[ 86.759986][ T5307] really_probe+0x254/0xae0
[ 86.761582][ T5307] __driver_probe_device+0x1e8/0x360
[ 86.763373][ T5307] driver_probe_device+0x4f/0x240
[ 86.765090][ T5307] __device_attach_driver+0x270/0x410
[ 86.766853][ T5307] bus_for_each_drv+0x258/0x2f0
[ 86.768490][ T5307] ? __pfx___device_attach_driver+0x10/0x10
[ 86.770497][ T5307] ? __pfx_bus_for_each_drv+0x10/0x10
[ 86.772304][ T5307] ? lockdep_hardirqs_on+0x7a/0x110
[ 86.773989][ T5307] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 86.775859][ T5307] __device_attach+0x2c4/0x450
[ 86.777553][ T5307] ? __pfx___device_attach+0x10/0x10
[ 86.779302][ T5307] ? do_raw_spin_unlock+0x4d/0x210
[ 86.781097][ T5307] ? _raw_spin_unlock+0x28/0x50
[ 86.782706][ T5307] device_initial_probe+0xa1/0xd0
[ 86.784472][ T5307] bus_probe_device+0x12a/0x220
[ 86.786089][ T5307] device_add+0x7d7/0xb80
[ 86.787510][ T5307] usb_new_device+0x99d/0x1620
[ 86.789137][ T5307] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 86.791153][ T5307] ? __pfx_usb_new_device+0x10/0x10
[ 86.792829][ T5307] ? _raw_spin_unlock_irq+0x23/0x50
[ 86.794539][ T5307] hub_event+0x28e8/0x4d30
[ 86.796065][ T5307] ? do_raw_spin_unlock+0x4d/0x210
[ 86.797787][ T5307] ? __pfx_hub_event+0x10/0x10
[ 86.799379][ T5307] ? process_scheduled_works+0xa20/0x14e0
[ 86.801320][ T5307] ? rcu_is_watching+0x15/0xb0
[ 86.802880][ T5307] ? process_scheduled_works+0xa20/0x14e0
[ 86.804833][ T5307] process_scheduled_works+0xa8e/0x14e0
[ 86.806644][ T5307] ? __pfx_process_scheduled_works+0x10/0x10
[ 86.808600][ T5307] ? assign_work+0x3cf/0x5d0
[ 86.810147][ T5307] worker_thread+0xa47/0xfb0
[ 86.811697][ T5307] kthread+0x388/0x470
[ 86.813073][ T5307] ? __pfx_worker_thread+0x10/0x10
[ 86.814914][ T5307] ? __pfx_kthread+0x10/0x10
[ 86.816789][ T5307] ret_from_fork+0x514/0xb70
[ 86.818648][ T5307] ? __pfx_ret_from_fork+0x10/0x10
[ 86.820675][ T5307] ? __switch_to+0xc89/0x1420
[ 86.822527][ T5307] ? __pfx_kthread+0x10/0x10
[ 86.824169][ T5307] ret_from_fork_asm+0x1a/0x30
[ 86.825877][ T5307]
[ 86.827480][ T5307] Kernel Offset: disabled
[ 86.829198][ T5307] Rebooting in 86400 seconds..