program:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407f1800010000000000010902200001010080320904000002ff0000000705810240000007050202400000"], 0x0)
nanosleep(&(0x7f0000000100)={0x0, 0x5f5e100}, 0x0)
syz_usb_ep_write(r0, 0x81, 0x8, &(0x7f0000000200)="4302000008000000")
nanosleep(&(0x7f0000000100)={0x0, 0x5f5e100}, 0x0)
[ 75.298189][ T5278] Bluetooth: hci0: command tx timeout
[ 75.634814][ T9] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 75.787813][ T9] usb 5-1: New USB device found, idVendor=187f, idProduct=0100, bcdDevice= 0.00
[ 75.790154][ T9] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64
[ 75.790168][ T9] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64
[ 75.790183][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 75.822521][ T5313] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[ 75.822652][ T5313] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[ 75.844156][ T9] smsusb:smsusb_probe: board id=1, interface number 0
[ 75.859541][ T9] smsusb:siano_media_device_register: media controller created
[ 75.861448][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes
[ 75.861522][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes
[ 75.861577][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes
[ 75.861617][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes
[ 75.861668][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes
[ 75.861710][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes
[ 75.861753][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes
[ 75.861849][ T9] smsusb:smsusb1_detectmode: product string not found
[ 75.862695][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes
[ 75.862760][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes
[ 75.862810][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes
[ 75.863994][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes
[ 75.910604][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes
[ 75.910650][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes
[ 75.910681][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes
[ 75.910711][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes
[ 75.910748][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes
[ 75.910779][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes
[ 75.910826][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes
[ 75.910856][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes
[ 75.910886][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes
[ 75.912340][ T9] smsmdtv:smscore_set_device_mode: return error code -71.
[ 75.912352][ T9] smsmdtv:smscore_start_device: set device mode failed , rc -71
[ 75.912361][ T9] smsusb:smsusb_init_device: smscore_start_device(...) failed
[ 75.951393][ T9] ------------[ cut here ]------------
[ 75.951403][ T9] !PageLargeKmalloc(page)
[ 75.951420][ T9] WARNING: mm/slub.c:6734 at free_large_kmalloc+0x97/0x110, CPU#0: kworker/0:0/9
[ 75.959701][ T9] Modules linked in:
[ 75.961324][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full)
[ 75.965001][ T9] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 75.969141][ T9] Workqueue: usb_hub_wq hub_event
[ 75.971419][ T9] RIP: 0010:free_large_kmalloc+0x97/0x110
[ 75.975429][ T9] Code: 8b 43 30 83 f8 ff 74 13 25 00 00 00 ff 3d 00 00 00 f8 75 7a c7 43 30 ff ff ff ff 48 89 df 89 ee 5b 41 5e 5d e9 5a af fc ff 90 <0f> 0b 90 48 89 df 48 c7 c6 55 71 43 8e 5b 41 5e 5d e9 93 c3 f9 fe
[ 75.983097][ T9] RSP: 0018:ffffc9000022eb08 EFLAGS: 00010206
[ 75.985719][ T9] RAX: 00000000ff000000 RBX: ffffea0001495c40 RCX: 0000000000000001
[ 75.988814][ T9] RDX: 0000000000000000 RSI: ffff888052571000 RDI: ffffea0001495c40
[ 75.992065][ T9] RBP: 0000000000000000 R08: ffff8880124e2c03 R09: 1ffff1100249c580
[ 75.995255][ T9] R10: dffffc0000000000 R11: ffffed100249c581 R12: 1ffff11007f95282
[ 75.998489][ T9] R13: ffff888043554d80 R14: ffff8880124e2c60 R15: dffffc0000000000
[ 76.001699][ T9] FS: 0000000000000000(0000) GS:ffff88808c2bb000(0000) knlGS:0000000000000000
[ 76.005946][ T9] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 76.009232][ T9] CR2: 00007f839266e0f5 CR3: 00000000125d5000 CR4: 0000000000352ef0
[ 76.012794][ T9] Call Trace:
[ 76.014665][ T9]
[ 76.016324][ T9] usb_free_urb+0xd0/0x120
[ 76.018617][ T9] smsusb_term_device+0x1d0/0x3d0
[ 76.021267][ T9] smsusb_probe+0x1aba/0x2280
[ 76.023854][ T9] ? __pfx_smsusb_probe+0x10/0x10
[ 76.026391][ T9] ? do_raw_spin_lock+0x12b/0x2f0
[ 76.028992][ T9] ? __pfx_smsusb1_setmode+0x10/0x10
[ 76.031309][ T9] ? __pfx_smsusb1_detectmode+0x10/0x10
[ 76.033941][ T9] ? __pfx_smsusb_sendrequest+0x10/0x10
[ 76.036466][ T9] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 76.038987][ T9] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 76.041406][ T9] ? __pm_runtime_set_status+0x994/0xc80
[ 76.046692][ T9] usb_probe_interface+0x788/0xe50
[ 76.048749][ T9] ? __pfx_usb_probe_interface+0x10/0x10
[ 76.051156][ T9] ? sysfs_do_create_link_sd+0xe0/0x110
[ 76.053526][ T9] ? driver_sysfs_add+0x1fe/0x210
[ 76.055783][ T9] ? __pfx_usb_probe_interface+0x10/0x10
[ 76.058142][ T9] really_probe+0x254/0xae0
[ 76.060194][ T9] __driver_probe_device+0x1e8/0x360
[ 76.062484][ T9] driver_probe_device+0x4f/0x240
[ 76.064713][ T9] __device_attach_driver+0x270/0x410
[ 76.066883][ T9] bus_for_each_drv+0x258/0x2f0
[ 76.068944][ T9] ? __pfx___device_attach_driver+0x10/0x10
[ 76.071345][ T9] ? __pfx_bus_for_each_drv+0x10/0x10
[ 76.073713][ T9] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 76.076162][ T9] __device_attach+0x2c4/0x450
[ 76.078184][ T9] ? __pfx___device_attach+0x10/0x10
[ 76.080316][ T9] ? do_raw_spin_unlock+0x4d/0x200
[ 76.082430][ T9] ? _raw_spin_unlock+0x28/0x50
[ 76.084576][ T9] device_initial_probe+0xa1/0xd0
[ 76.086642][ T9] bus_probe_device+0x12a/0x220
[ 76.088684][ T9] device_add+0x7d7/0xb80
[ 76.090540][ T9] usb_set_configuration+0x1bb5/0x2260
[ 76.092853][ T9] usb_generic_driver_probe+0x8d/0x150
[ 76.095223][ T9] usb_probe_device+0x1c3/0x3b0
[ 76.097188][ T9] ? __pfx_usb_probe_device+0x10/0x10
[ 76.099312][ T9] really_probe+0x254/0xae0
[ 76.101164][ T9] __driver_probe_device+0x1e8/0x360
[ 76.103430][ T9] driver_probe_device+0x4f/0x240
[ 76.105891][ T9] __device_attach_driver+0x270/0x410
[ 76.108113][ T9] bus_for_each_drv+0x258/0x2f0
[ 76.110107][ T9] ? __pfx___device_attach_driver+0x10/0x10
[ 76.112454][ T9] ? __pfx_bus_for_each_drv+0x10/0x10
[ 76.115111][ T9] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 76.117584][ T9] __device_attach+0x2c4/0x450
[ 76.119582][ T9] ? __pfx___device_attach+0x10/0x10
[ 76.121887][ T9] ? do_raw_spin_unlock+0x4d/0x200
[ 76.124461][ T9] ? _raw_spin_unlock+0x28/0x50
[ 76.126456][ T9] device_initial_probe+0xa1/0xd0
[ 76.128416][ T9] bus_probe_device+0x12a/0x220
[ 76.130515][ T9] device_add+0x7d7/0xb80
[ 76.132385][ T9] usb_new_device+0x9aa/0x1690
[ 76.134571][ T9] ? __pfx_usb_new_device+0x10/0x10
[ 76.136841][ T9] ? _raw_spin_unlock_irq+0x23/0x50
[ 76.139126][ T9] hub_event+0x28e8/0x4d30
[ 76.141097][ T9] ? do_raw_spin_unlock+0x4d/0x200
[ 76.143375][ T9] ? __pfx_hub_event+0x10/0x10
[ 76.145429][ T9] ? rcu_is_watching+0x16/0xb0
[ 76.147371][ T9] ? process_scheduled_works+0x97a/0x1630
[ 76.149737][ T9] process_scheduled_works+0xc3d/0x1630
[ 76.152014][ T9] ? __pfx_process_scheduled_works+0x10/0x10
[ 76.154544][ T9] ? assign_work+0x3cf/0x5d0
[ 76.156487][ T9] worker_thread+0xa47/0xfb0
[ 76.158379][ T9] kthread+0x38b/0x480
[ 76.160240][ T9] ? __pfx_worker_thread+0x10/0x10
[ 76.162632][ T9] ? __pfx_kthread+0x10/0x10
[ 76.164909][ T9] ret_from_fork+0x514/0xb70
[ 76.166826][ T9] ? __pfx_ret_from_fork+0x10/0x10
[ 76.168915][ T9] ? __switch_to+0xc89/0x1420
[ 76.171136][ T9] ? __pfx_kthread+0x10/0x10
[ 76.173143][ T9] ret_from_fork_asm+0x1a/0x30
[ 76.175339][ T9]
[ 76.176692][ T9] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 76.179795][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full)
[ 76.183645][ T9] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 76.187884][ T9] Workqueue: usb_hub_wq hub_event
[ 76.189864][ T9] Call Trace:
[ 76.191302][ T9]
[ 76.192558][ T9] vpanic+0x56d/0xa60
[ 76.194319][ T9] ? __pfx__printk+0x10/0x10
[ 76.196314][ T9] ? __pfx_vpanic+0x10/0x10
[ 76.198265][ T9] ? is_bpf_text_address+0x292/0x2b0
[ 76.200550][ T9] ? is_bpf_text_address+0x26/0x2b0
[ 76.202756][ T9] panic+0xc5/0xd0
[ 76.204252][ T9] ? __pfx_panic+0x10/0x10
[ 76.206171][ T9] ? ret_from_fork_asm+0x1a/0x30
[ 76.208118][ T9] __warn+0x315/0x4c0
[ 76.209697][ T9] ? free_large_kmalloc+0x97/0x110
[ 76.211874][ T9] ? free_large_kmalloc+0x97/0x110
[ 76.214052][ T9] __report_bug+0x276/0x570
[ 76.218408][ T9] ? bus_for_each_drv+0x258/0x2f0
[ 76.220611][ T9] ? __device_attach+0x2c4/0x450
[ 76.222756][ T9] ? device_initial_probe+0xa1/0xd0
[ 76.225039][ T9] ? free_large_kmalloc+0x97/0x110
[ 76.227193][ T9] ? __pfx___report_bug+0x10/0x10
[ 76.229347][ T9] ? bus_probe_device+0x12a/0x220
[ 76.231468][ T9] ? device_add+0x7d7/0xb80
[ 76.233236][ T9] ? usb_new_device+0x9aa/0x1690
[ 76.235429][ T9] ? hub_event+0x28e8/0x4d30
[ 76.237420][ T9] ? process_scheduled_works+0xc3d/0x1630
[ 76.239943][ T9] ? worker_thread+0xa47/0xfb0
[ 76.241983][ T9] ? kthread+0x38b/0x480
[ 76.243873][ T9] ? smscore_unregister_device+0x651/0x780
[ 76.247544][ T9] ? free_large_kmalloc+0x97/0x110
[ 76.249743][ T9] report_bug+0x16b/0x220
[ 76.251562][ T9] ? free_large_kmalloc+0x97/0x110
[ 76.253633][ T9] ? free_large_kmalloc+0x99/0x110
[ 76.255780][ T9] handle_bug+0x9c/0x200
[ 76.257545][ T9] exc_invalid_op+0x1a/0x50
[ 76.259402][ T9] asm_exc_invalid_op+0x1a/0x20
[ 76.261433][ T9] RIP: 0010:free_large_kmalloc+0x97/0x110
[ 76.263867][ T9] Code: 8b 43 30 83 f8 ff 74 13 25 00 00 00 ff 3d 00 00 00 f8 75 7a c7 43 30 ff ff ff ff 48 89 df 89 ee 5b 41 5e 5d e9 5a af fc ff 90 <0f> 0b 90 48 89 df 48 c7 c6 55 71 43 8e 5b 41 5e 5d e9 93 c3 f9 fe
[ 76.271435][ T9] RSP: 0018:ffffc9000022eb08 EFLAGS: 00010206
[ 76.273786][ T9] RAX: 00000000ff000000 RBX: ffffea0001495c40 RCX: 0000000000000001
[ 76.276810][ T9] RDX: 0000000000000000 RSI: ffff888052571000 RDI: ffffea0001495c40
[ 76.279743][ T9] RBP: 0000000000000000 R08: ffff8880124e2c03 R09: 1ffff1100249c580
[ 76.282732][ T9] R10: dffffc0000000000 R11: ffffed100249c581 R12: 1ffff11007f95282
[ 76.285761][ T9] R13: ffff888043554d80 R14: ffff8880124e2c60 R15: dffffc0000000000
[ 76.288861][ T9] usb_free_urb+0xd0/0x120
[ 76.290670][ T9] smsusb_term_device+0x1d0/0x3d0
[ 76.292649][ T9] smsusb_probe+0x1aba/0x2280
[ 76.294538][ T9] ? __pfx_smsusb_probe+0x10/0x10
[ 76.296515][ T9] ? do_raw_spin_lock+0x12b/0x2f0
[ 76.298510][ T9] ? __pfx_smsusb1_setmode+0x10/0x10
[ 76.300635][ T9] ? __pfx_smsusb1_detectmode+0x10/0x10
[ 76.303832][ T9] ? __pfx_smsusb_sendrequest+0x10/0x10
[ 76.306035][ T9] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 76.308403][ T9] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 76.310773][ T9] ? __pm_runtime_set_status+0x994/0xc80
[ 76.313089][ T9] usb_probe_interface+0x788/0xe50
[ 76.315304][ T9] ? __pfx_usb_probe_interface+0x10/0x10
[ 76.317611][ T9] ? sysfs_do_create_link_sd+0xe0/0x110
[ 76.319902][ T9] ? driver_sysfs_add+0x1fe/0x210
[ 76.322062][ T9] ? __pfx_usb_probe_interface+0x10/0x10
[ 76.324340][ T9] really_probe+0x254/0xae0
[ 76.326115][ T9] __driver_probe_device+0x1e8/0x360
[ 76.328095][ T9] driver_probe_device+0x4f/0x240
[ 76.330178][ T9] __device_attach_driver+0x270/0x410
[ 76.332356][ T9] bus_for_each_drv+0x258/0x2f0
[ 76.334345][ T9] ? __pfx___device_attach_driver+0x10/0x10
[ 76.336797][ T9] ? __pfx_bus_for_each_drv+0x10/0x10
[ 76.339000][ T9] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 76.341369][ T9] __device_attach+0x2c4/0x450
[ 76.343392][ T9] ? __pfx___device_attach+0x10/0x10
[ 76.345575][ T9] ? do_raw_spin_unlock+0x4d/0x200
[ 76.347691][ T9] ? _raw_spin_unlock+0x28/0x50
[ 76.349748][ T9] device_initial_probe+0xa1/0xd0
[ 76.352134][ T9] bus_probe_device+0x12a/0x220
[ 76.354709][ T9] device_add+0x7d7/0xb80
[ 76.356902][ T9] usb_set_configuration+0x1bb5/0x2260
[ 76.359644][ T9] usb_generic_driver_probe+0x8d/0x150
[ 76.362407][ T9] usb_probe_device+0x1c3/0x3b0
[ 76.364932][ T9] ? __pfx_usb_probe_device+0x10/0x10
[ 76.367423][ T9] really_probe+0x254/0xae0
[ 76.369325][ T9] __driver_probe_device+0x1e8/0x360
[ 76.371464][ T9] driver_probe_device+0x4f/0x240
[ 76.373542][ T9] __device_attach_driver+0x270/0x410
[ 76.375725][ T9] bus_for_each_drv+0x258/0x2f0
[ 76.377622][ T9] ? __pfx___device_attach_driver+0x10/0x10
[ 76.380180][ T9] ? __pfx_bus_for_each_drv+0x10/0x10
[ 76.382427][ T9] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 76.384843][ T9] __device_attach+0x2c4/0x450
[ 76.386777][ T9] ? __pfx___device_attach+0x10/0x10
[ 76.388940][ T9] ? do_raw_spin_unlock+0x4d/0x200
[ 76.391049][ T9] ? _raw_spin_unlock+0x28/0x50
[ 76.393156][ T9] device_initial_probe+0xa1/0xd0
[ 76.395237][ T9] bus_probe_device+0x12a/0x220
[ 76.397265][ T9] device_add+0x7d7/0xb80
[ 76.399053][ T9] usb_new_device+0x9aa/0x1690
[ 76.401086][ T9] ? __pfx_usb_new_device+0x10/0x10
[ 76.403266][ T9] ? _raw_spin_unlock_irq+0x23/0x50
[ 76.405460][ T9] hub_event+0x28e8/0x4d30
[ 76.407325][ T9] ? do_raw_spin_unlock+0x4d/0x200
[ 76.409579][ T9] ? __pfx_hub_event+0x10/0x10
[ 76.411634][ T9] ? rcu_is_watching+0x16/0xb0
[ 76.413692][ T9] ? process_scheduled_works+0x97a/0x1630
[ 76.416027][ T9] process_scheduled_works+0xc3d/0x1630
[ 76.418340][ T9] ? __pfx_process_scheduled_works+0x10/0x10
[ 76.421023][ T9] ? assign_work+0x3cf/0x5d0
[ 76.422951][ T9] worker_thread+0xa47/0xfb0
[ 76.425025][ T9] kthread+0x38b/0x480
[ 76.426858][ T9] ? __pfx_worker_thread+0x10/0x10
[ 76.428964][ T9] ? __pfx_kthread+0x10/0x10
[ 76.430847][ T9] ret_from_fork+0x514/0xb70
[ 76.432730][ T9] ? __pfx_ret_from_fork+0x10/0x10
[ 76.434848][ T9] ? __switch_to+0xc89/0x1420
[ 76.436786][ T9] ? __pfx_kthread+0x10/0x10
[ 76.438775][ T9] ret_from_fork_asm+0x1a/0x30
[ 76.440765][ T9]
[ 76.442451][ T9] Kernel Offset: disabled
[ 76.444270][ T9] Rebooting in 86400 seconds..