program: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f00000002c0)={@local, @loopback, @dev={0xfe, 0x80, '\x00', 0x25}, 0x1, 0x6, 0x0, 0x80, 0x4, 0x2540229}) r1 = socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x1) syz_emit_ethernet(0x7e, &(0x7f0000000040)={@link_local, @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f53a04", 0x48, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x500, {0x0, 0x6, "508359", 0x0, 0x0, 0x0, @private1, @private2, [@hopopts={0x3a, 0x1, '\x00', [@calipso={0x7, 0x8, {0x0, 0x0, 0x0, 0x80}}]}]}}}}}}}, 0x0) socket$packet(0x11, 0x2, 0x300) (async) r2 = socket$packet(0x11, 0x2, 0x300) syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) (async) r3 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r3, 0x1, 0x0, 0x0) (async) syz_usb_ep_read(r3, 0x1, 0x0, 0x0) syz_usb_ep_write(r3, 0x81, 0x40, &(0x7f0000000100)="900100"/64) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) ioctl$SNDCTL_DSP_SPEED(r4, 0xc0045002, &(0x7f0000000000)=0x7fffffff) (async) ioctl$SNDCTL_DSP_SPEED(r4, 0xc0045002, &(0x7f0000000000)=0x7fffffff) ioctl$SNDCTL_DSP_CHANNELS(r4, 0xc0045006, &(0x7f0000000040)=0x5c) (async) ioctl$SNDCTL_DSP_CHANNELS(r4, 0xc0045006, &(0x7f0000000040)=0x5c) ioctl$SNDCTL_DSP_GETODELAY(r4, 0x80045017, 0x0) (async) ioctl$SNDCTL_DSP_GETODELAY(r4, 0x80045017, 0x0) syz_usb_ep_read(r3, 0x1, 0x0, 0x0) syz_usb_ep_write(r3, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r3, 0x1, 0x0, 0x0) syz_usb_ep_read(r3, 0x1, 0x0, 0x0) syz_usb_ep_write(r3, 0x81, 0x0, 0x0) syz_usb_ep_write(r3, 0x81, 0x40, &(0x7f0000000900)="880100"/64) syz_usb_ep_write(r3, 0x81, 0x40, &(0x7f0000000a00)="880100"/64) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000e00)='./sys\x00', &(0x7f0000000f00)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001000)='./sys/devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/adsl_state\x00', 0x2, 0x0) (async) r5 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./sys/devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/adsl_state\x00', 0x2, 0x0) write(r5, &(0x7f0000001200)='stop', 0x4) (async) write(r5, &(0x7f0000001200)='stop', 0x4) syz_usb_ep_read(r3, 0x1, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xffff}, {0x4, 0xfff3}, {0x0, 0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x48080}, 0x0) syz_usb_connect(0x3, 0x0, 0x0, 0x0) [ 92.588156][ T4636] Bluetooth: hci0: command tx timeout [ 92.619340][ T10] cfg80211: failed to load regulatory.db [ 92.828184][ T5310] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 92.856741][ T5310] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 93.032065][ T5296] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 93.184034][ T5296] usb 5-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 93.187897][ T5296] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 94.621583][ T4636] Bluetooth: hci0: command tx timeout [ 94.876342][ T5296] cxacru 5-1:1.0: invalid response length to cm 0x84: 0 [ 94.881433][ T5296] ATM dev 0: cxacru_atm_start: CHIP_ADSL_LINE_START returned -5 [ 95.077983][ T5296] ATM dev 0: ADSL state: running [ 95.080932][ T5296] ATM dev 0: ADSL line: down [ 95.540540][ T5318] netlink: 4 bytes leftover after parsing attributes in process `syz.0.0'. [ 95.547835][ T5318] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 95.571209][ T5318] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 96.701677][ T4636] Bluetooth: hci0: command tx timeout [ 97.582006][ T5311] cxacru 5-1:1.0: send of cm 0x85 failed (-104) [ 97.586542][ T10] ------------[ cut here ]------------ [ 97.589108][ T10] URB ffff888033a53600 submitted while active [ 97.591868][ T10] WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x79/0x18b0, CPU#0: kworker/0:1/10 [ 97.596391][ T10] Modules linked in: [ 97.598364][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full) [ 97.602260][ T10] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 97.606648][ T10] Workqueue: events cxacru_poll_status [ 97.609213][ T10] RIP: 0010:usb_submit_urb+0x7c/0x18b0 [ 97.611681][ T10] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 19 ee d4 fa 49 83 3e 00 74 40 e8 1e b9 65 fa 48 8d 3d 97 08 04 09 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 03 b9 65 fa eb 05 e8 fc b8 [ 97.620264][ T10] RSP: 0018:ffffc9000023f6f8 EFLAGS: 00010293 [ 97.623564][ T10] RAX: ffffffff876159c2 RBX: ffff888033a53600 RCX: ffff88801bf0a540 [ 97.626972][ T10] RDX: 0000000000000000 RSI: ffff888033a53600 RDI: ffffffff90656260 [ 97.630119][ T10] RBP: dffffc0000000000 R08: 0000000000000002 R09: 0000000000000000 [ 97.633380][ T10] R10: dffffc0000000000 R11: fffffbfff20aed67 R12: 0000000000000040 [ 97.636423][ T10] R13: 0000000000000000 R14: ffff888033a53608 R15: 0000000000000cc0 [ 97.639451][ T10] FS: 0000000000000000(0000) GS:ffff88808c549000(0000) knlGS:0000000000000000 [ 97.643012][ T10] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 97.645735][ T10] CR2: 00005555742b8a58 CR3: 000000001c30a000 CR4: 0000000000352ef0 [ 97.648860][ T10] Call Trace: [ 97.650277][ T10] [ 97.651726][ T10] ? __raw_spin_lock_init+0x45/0x100 [ 97.654119][ T10] ? __init_swait_queue_head+0xa8/0x150 [ 97.656879][ T10] cxacru_cm+0x21a/0xf10 [ 97.659024][ T10] ? __pfx_cxacru_cm+0x10/0x10 [ 97.661682][ T10] ? __kasan_kmalloc+0x93/0xb0 [ 97.664273][ T10] ? __kmalloc_cache_noprof+0x32d/0x660 [ 97.666617][ T10] ? __kmalloc_cache_noprof+0x150/0x660 [ 97.668852][ T10] ? cxacru_poll_status+0x14b/0x1110 [ 97.671028][ T10] ? cxacru_poll_status+0x14b/0x1110 [ 97.673190][ T10] cxacru_poll_status+0x178/0x1110 [ 97.675462][ T10] ? irqentry_exit+0x218/0x8f0 [ 97.677596][ T10] ? trace_irq_disable+0x3b/0x140 [ 97.679792][ T10] ? __pfx_cxacru_poll_status+0x10/0x10 [ 97.682310][ T10] ? rcu_is_watching+0x15/0xb0 [ 97.684419][ T10] ? process_scheduled_works+0xa20/0x14e0 [ 97.686774][ T10] process_scheduled_works+0xa8e/0x14e0 [ 97.689142][ T10] ? __pfx_process_scheduled_works+0x10/0x10 [ 97.691729][ T10] ? assign_work+0x3cf/0x5d0 [ 97.693732][ T10] worker_thread+0xa47/0xfb0 [ 97.695731][ T10] ? __kthread_parkme+0x71/0x1f0 [ 97.697857][ T10] kthread+0x388/0x470 [ 97.699431][ T10] ? __pfx_worker_thread+0x10/0x10 [ 97.701542][ T10] ? __pfx_kthread+0x10/0x10 [ 97.703610][ T10] ret_from_fork+0x514/0xb70 [ 97.705656][ T10] ? __pfx_ret_from_fork+0x10/0x10 [ 97.708037][ T10] ? __switch_to+0xc89/0x1420 [ 97.710162][ T10] ? __pfx_kthread+0x10/0x10 [ 97.712247][ T10] ret_from_fork_asm+0x1a/0x30 [ 97.714370][ T10] [ 97.715803][ T10] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 97.718755][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full) [ 97.722296][ T10] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 97.726260][ T10] Workqueue: events cxacru_poll_status [ 97.728502][ T10] Call Trace: [ 97.729863][ T10] [ 97.731082][ T10] vpanic+0x56c/0xa60 [ 97.732747][ T10] ? __pfx__printk+0x10/0x10 [ 97.734769][ T10] ? __pfx_vpanic+0x10/0x10 [ 97.736762][ T10] ? is_bpf_text_address+0x292/0x2b0 [ 97.739238][ T10] ? is_bpf_text_address+0x26/0x2b0 [ 97.741950][ T10] panic+0xc5/0xd0 [ 97.743595][ T10] ? __pfx_panic+0x10/0x10 [ 97.745476][ T10] ? ret_from_fork_asm+0x1a/0x30 [ 97.747645][ T10] __warn+0x315/0x4c0 [ 97.749382][ T10] ? usb_submit_urb+0x79/0x18b0 [ 97.751505][ T10] ? usb_submit_urb+0x79/0x18b0 [ 97.753544][ T10] __report_bug+0x276/0x570 [ 97.755374][ T10] ? usb_submit_urb+0x79/0x18b0 [ 97.757344][ T10] ? __pfx___report_bug+0x10/0x10 [ 97.759334][ T10] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 97.761684][ T10] report_bug_entry+0x19a/0x290 [ 97.763763][ T10] ? usb_submit_urb+0x7c/0x18b0 [ 97.765878][ T10] ? usb_submit_urb+0x81/0x18b0 [ 97.767953][ T10] handle_bug+0xce/0x200 [ 97.769565][ T10] exc_invalid_op+0x1a/0x50 [ 97.771341][ T10] asm_exc_invalid_op+0x1a/0x20 [ 97.773292][ T10] RIP: 0010:usb_submit_urb+0x7c/0x18b0 [ 97.775485][ T10] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 19 ee d4 fa 49 83 3e 00 74 40 e8 1e b9 65 fa 48 8d 3d 97 08 04 09 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 03 b9 65 fa eb 05 e8 fc b8 [ 97.783333][ T10] RSP: 0018:ffffc9000023f6f8 EFLAGS: 00010293 [ 97.785981][ T10] RAX: ffffffff876159c2 RBX: ffff888033a53600 RCX: ffff88801bf0a540 [ 97.789266][ T10] RDX: 0000000000000000 RSI: ffff888033a53600 RDI: ffffffff90656260 [ 97.792611][ T10] RBP: dffffc0000000000 R08: 0000000000000002 R09: 0000000000000000 [ 97.795959][ T10] R10: dffffc0000000000 R11: fffffbfff20aed67 R12: 0000000000000040 [ 97.799278][ T10] R13: 0000000000000000 R14: ffff888033a53608 R15: 0000000000000cc0 [ 97.802681][ T10] ? usb_submit_urb+0x72/0x18b0 [ 97.804745][ T10] ? usb_submit_urb+0x72/0x18b0 [ 97.806729][ T10] ? __raw_spin_lock_init+0x45/0x100 [ 97.808765][ T10] ? __init_swait_queue_head+0xa8/0x150 [ 97.810921][ T10] cxacru_cm+0x21a/0xf10 [ 97.812742][ T10] ? __pfx_cxacru_cm+0x10/0x10 [ 97.814672][ T10] ? __kasan_kmalloc+0x93/0xb0 [ 97.816440][ T10] ? __kmalloc_cache_noprof+0x32d/0x660 [ 97.818646][ T10] ? __kmalloc_cache_noprof+0x150/0x660 [ 97.820985][ T10] ? cxacru_poll_status+0x14b/0x1110 [ 97.823265][ T10] ? cxacru_poll_status+0x14b/0x1110 [ 97.825523][ T10] cxacru_poll_status+0x178/0x1110 [ 97.827754][ T10] ? irqentry_exit+0x218/0x8f0 [ 97.829838][ T10] ? trace_irq_disable+0x3b/0x140 [ 97.832007][ T10] ? __pfx_cxacru_poll_status+0x10/0x10 [ 97.834310][ T10] ? rcu_is_watching+0x15/0xb0 [ 97.836466][ T10] ? process_scheduled_works+0xa20/0x14e0 [ 97.838879][ T10] process_scheduled_works+0xa8e/0x14e0 [ 97.841271][ T10] ? __pfx_process_scheduled_works+0x10/0x10 [ 97.843834][ T10] ? assign_work+0x3cf/0x5d0 [ 97.845682][ T10] worker_thread+0xa47/0xfb0 [ 97.847738][ T10] ? __kthread_parkme+0x71/0x1f0 [ 97.849898][ T10] kthread+0x388/0x470 [ 97.851704][ T10] ? __pfx_worker_thread+0x10/0x10 [ 97.854107][ T10] ? __pfx_kthread+0x10/0x10 [ 97.856617][ T10] ret_from_fork+0x514/0xb70 [ 97.858841][ T10] ? __pfx_ret_from_fork+0x10/0x10 [ 97.861219][ T10] ? __switch_to+0xc89/0x1420 [ 97.863467][ T10] ? __pfx_kthread+0x10/0x10 [ 97.865731][ T10] ret_from_fork_asm+0x1a/0x30 [ 97.867871][ T10] [ 97.869646][ T10] Kernel Offset: disabled [ 97.871924][ T10] Rebooting in 86400 seconds..