program: r0 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000140)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f00000000c0), 0xc, 0x88a81) syz_usb_control_io$hid(r0, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x70bd2b, 0xfffffffc, {0x0, 0x0, 0x0, 0x0, 0x0, 0x14}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r3}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000881}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @empty, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x2, 0x21, 0x28, 0x64, 0x0, 0x4, 0x6, 0x0, @remote, @remote}, {{0x4e22, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10, 0x40, 0x0, 0xe7}}}}}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$I2C_SMBUS(r1, 0x720, &(0x7f0000000680)={0x0, 0x6, 0x1, &(0x7f00000006c0)={0x1c, "3ac071ffbc8cd0d684737999cc8bd238954cb2216d398df0f558125211b40c65fd"}}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x14}, [@ldst={0x2, 0x0, 0x3, 0x1c10a1, 0x0, 0xc}], {0x95, 0x0, 0x9}}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x85}, 0x52) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01060000000000000000020000000900010073797a300000000040000000160a01060000000000000000020000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400008000040000000030a01060000000000000000020000000900010073797a30000000000900030073797a3000000000140004800800014000000002080002400000000058000000060a01060000000000000000020000000900010073797a30aea45a39000000fdfc702c0073797a30000000002c0004802800018011000100666c6f775f6f66666c6f616400000000100002800900010073797a3000000000140000001100010000000000000000000200000a"], 0x120}}, 0x0) syz_usb_control_io$uac1(r0, &(0x7f0000000200)={0x14, &(0x7f0000000180)={0x0, 0x21, 0x1e, {0x1e, 0x22, "9ff00bdf5b1c4fe1fd1952e7e728bf727598d4d9ae8266a4158b1221"}}, &(0x7f00000001c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x410}}}, &(0x7f0000000600)={0x44, &(0x7f0000000240)={0x40, 0x14, 0x56, "1271d7cab3b7a83d6f1b019cee1ee90f6a5db39690b86541a212dbcb69c670bb26a218f6f107d16bf11ce23e6cde05c2b70ec030349deaf510f6a3b7a1fa1305256bafa475d23cf5e96c2328b6a2f02084f495c03537"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0xb4}, &(0x7f0000000480)={0x0, 0x8, 0x1, 0x81}, &(0x7f00000004c0)={0x20, 0x81, 0x2, "19f4"}, &(0x7f0000000500)={0x20, 0x82, 0x3, "7db5a0"}, &(0x7f0000000540)={0x20, 0x83, 0x1, 'U'}, &(0x7f0000000580)={0x20, 0x84, 0x1, "d4"}, &(0x7f00000005c0)={0x20, 0x85, 0x3, "b7f393"}}) [ 103.003436][ T5289] Bluetooth: hci0: command tx timeout [ 103.300541][ T9] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 103.450138][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 103.451816][ T9] usb 5-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 103.456079][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 103.456094][ T9] usb 5-1: Product: syz [ 103.456099][ T9] usb 5-1: Manufacturer: syz [ 103.456104][ T9] usb 5-1: SerialNumber: syz [ 103.483964][ T9] usb 5-1: config 0 descriptor?? [ 103.893998][ T9] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 103.907150][ T9] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 103.907872][ T9] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 103.907907][ T9] usb 5-1: media controller created [ 103.943937][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 104.102875][ T9] zl10353_read_register: readreg error (reg=127, ret==0) [ 104.102918][ T9] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 104.102926][ T9] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 104.521425][ T5329] ------------[ cut here ]------------ [ 104.521440][ T5329] usb 5-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0 [ 104.521471][ T5329] WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1057/0x18b0, CPU#0: syz.0.0/5329 [ 104.536913][ T5329] Modules linked in: [ 104.539436][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 104.543424][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 104.547587][ T5329] RIP: 0010:usb_submit_urb+0x1100/0x18b0 [ 104.550074][ T5329] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89 [ 104.558306][ T5329] RSP: 0018:ffffc9000f34f698 EFLAGS: 00010246 [ 104.561090][ T5329] RAX: 0000000000000000 RBX: ffff88803777db00 RCX: 0000000080000280 [ 104.565019][ T5329] RDX: ffff88803e3cee80 RSI: ffffffff8cc55400 RDI: ffffffff90884010 [ 104.569420][ T5329] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000 [ 104.573766][ T5329] R10: ffffc9000f34f780 R11: fffff52001e69efc R12: 1ffff11001d262dc [ 104.577753][ T5329] R13: ffff88800e9316e0 R14: ffff88803e3cee80 R15: 0000000080000280 [ 104.581478][ T5329] FS: 00007f50db7176c0(0000) GS:ffff88808c2bb000(0000) knlGS:0000000000000000 [ 104.585572][ T5329] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 104.588573][ T5329] CR2: 00007f50daa27da0 CR3: 000000000bed6000 CR4: 0000000000352ef0 [ 104.592096][ T5329] Call Trace: [ 104.593532][ T5329] [ 104.594810][ T5329] usb_start_wait_urb+0x13f/0x5b0 [ 104.597128][ T5329] ? trace_kmalloc+0x2a/0xf0 [ 104.599242][ T5329] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 104.602184][ T5329] usb_control_msg+0x234/0x3e0 [ 104.604268][ T5329] dtv5100_i2c_msg+0x231/0x2f0 [ 104.606347][ T5329] dtv5100_i2c_xfer+0x1a5/0x610 [ 104.608433][ T5329] ? kasan_save_track+0x4f/0x80 [ 104.610881][ T5329] ? kasan_save_free_info+0x40/0x50 [ 104.613172][ T5329] ? __se_sys_ioctl+0x47/0x170 [ 104.615244][ T5329] __i2c_transfer+0x7bf/0x1fe0 [ 104.617239][ T5329] __i2c_smbus_xfer+0x159a/0x27e0 [ 104.619458][ T5329] ? __pfx___i2c_smbus_xfer+0x10/0x10 [ 104.621792][ T5329] ? rt_mutex_lock_nested+0x156/0x1c0 [ 104.624170][ T5329] i2c_smbus_xfer+0x1f5/0x310 [ 104.626235][ T5329] i2cdev_ioctl_smbus+0x1e7/0x700 [ 104.628760][ T5329] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10 [ 104.631449][ T5329] i2cdev_ioctl+0x615/0x880 [ 104.633404][ T5329] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 104.635546][ T5329] ? __fget_files+0x2a/0x420 [ 104.637579][ T5329] ? __fget_files+0x3a2/0x420 [ 104.639606][ T5329] ? bpf_lsm_file_ioctl+0x9/0x20 [ 104.641799][ T5329] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 104.643978][ T5329] __se_sys_ioctl+0xfc/0x170 [ 104.645974][ T5329] do_syscall_64+0x166/0x520 [ 104.647911][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.650624][ T5329] ? clear_bhb_loop+0x70/0xc0 [ 104.652693][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.655185][ T5329] RIP: 0033:0x7f50da79e159 [ 104.657100][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 104.665189][ T5329] RSP: 002b:00007f50db716fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 104.669022][ T5329] RAX: ffffffffffffffda RBX: 00007f50daa25fa0 RCX: 00007f50da79e159 [ 104.673044][ T5329] RDX: 0000200000000680 RSI: 0000000000000720 RDI: 0000000000000004 [ 104.676984][ T5329] RBP: 00007f50da83506b R08: 0000000000000000 R09: 0000000000000000 [ 104.680987][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 104.684353][ T5329] R13: 00007f50daa26038 R14: 00007f50daa25fa0 R15: 00007ffc90f48548 [ 104.687829][ T5329] [ 104.689239][ T5329] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 104.692226][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 104.696007][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 104.700024][ T5329] Call Trace: [ 104.701461][ T5329] [ 104.702804][ T5329] vpanic+0x56d/0xa60 [ 104.704604][ T5329] ? __pfx__printk+0x10/0x10 [ 104.706516][ T5329] ? __pfx_vpanic+0x10/0x10 [ 104.708490][ T5329] ? is_bpf_text_address+0x292/0x2b0 [ 104.710742][ T5329] ? is_bpf_text_address+0x26/0x2b0 [ 104.712949][ T5329] panic+0xc5/0xd0 [ 104.714664][ T5329] ? __pfx_panic+0x10/0x10 [ 104.716640][ T5329] __warn+0x315/0x4c0 [ 104.718370][ T5329] ? usb_submit_urb+0x1057/0x18b0 [ 104.720427][ T5329] ? usb_submit_urb+0x1057/0x18b0 [ 104.722463][ T5329] __report_bug+0x276/0x570 [ 104.724306][ T5329] ? usb_submit_urb+0x1057/0x18b0 [ 104.726378][ T5329] ? __pfx___report_bug+0x10/0x10 [ 104.728456][ T5329] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 104.730906][ T5329] ? kasan_save_track+0x4f/0x80 [ 104.733004][ T5329] report_bug_entry+0x19b/0x290 [ 104.735016][ T5329] ? usb_submit_urb+0x1100/0x18b0 [ 104.737135][ T5329] ? usb_submit_urb+0x1105/0x18b0 [ 104.739205][ T5329] handle_bug+0xce/0x200 [ 104.740967][ T5329] exc_invalid_op+0x1a/0x50 [ 104.742916][ T5329] asm_exc_invalid_op+0x1a/0x20 [ 104.745020][ T5329] RIP: 0010:usb_submit_urb+0x1100/0x18b0 [ 104.747540][ T5329] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89 [ 104.755419][ T5329] RSP: 0018:ffffc9000f34f698 EFLAGS: 00010246 [ 104.757994][ T5329] RAX: 0000000000000000 RBX: ffff88803777db00 RCX: 0000000080000280 [ 104.761392][ T5329] RDX: ffff88803e3cee80 RSI: ffffffff8cc55400 RDI: ffffffff90884010 [ 104.764709][ T5329] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000 [ 104.767875][ T5329] R10: ffffc9000f34f780 R11: fffff52001e69efc R12: 1ffff11001d262dc [ 104.771029][ T5329] R13: ffff88800e9316e0 R14: ffff88803e3cee80 R15: 0000000080000280 [ 104.774250][ T5329] ? usb_submit_urb+0x1091/0x18b0 [ 104.776462][ T5329] usb_start_wait_urb+0x13f/0x5b0 [ 104.778617][ T5329] ? trace_kmalloc+0x2a/0xf0 [ 104.780599][ T5329] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 104.782914][ T5329] usb_control_msg+0x234/0x3e0 [ 104.784840][ T5329] dtv5100_i2c_msg+0x231/0x2f0 [ 104.786918][ T5329] dtv5100_i2c_xfer+0x1a5/0x610 [ 104.788937][ T5329] ? kasan_save_track+0x4f/0x80 [ 104.790994][ T5329] ? kasan_save_free_info+0x40/0x50 [ 104.793273][ T5329] ? __se_sys_ioctl+0x47/0x170 [ 104.795117][ T5329] __i2c_transfer+0x7bf/0x1fe0 [ 104.797142][ T5329] __i2c_smbus_xfer+0x159a/0x27e0 [ 104.799225][ T5329] ? __pfx___i2c_smbus_xfer+0x10/0x10 [ 104.801563][ T5329] ? rt_mutex_lock_nested+0x156/0x1c0 [ 104.803816][ T5329] i2c_smbus_xfer+0x1f5/0x310 [ 104.805839][ T5329] i2cdev_ioctl_smbus+0x1e7/0x700 [ 104.808036][ T5329] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10 [ 104.810236][ T5329] i2cdev_ioctl+0x615/0x880 [ 104.812166][ T5329] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 104.814180][ T5329] ? __fget_files+0x2a/0x420 [ 104.816008][ T5329] ? __fget_files+0x3a2/0x420 [ 104.817944][ T5329] ? bpf_lsm_file_ioctl+0x9/0x20 [ 104.820039][ T5329] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 104.822136][ T5329] __se_sys_ioctl+0xfc/0x170 [ 104.824122][ T5329] do_syscall_64+0x166/0x520 [ 104.826069][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.828709][ T5329] ? clear_bhb_loop+0x70/0xc0 [ 104.830783][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.833324][ T5329] RIP: 0033:0x7f50da79e159 [ 104.835477][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 104.844084][ T5329] RSP: 002b:00007f50db716fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 104.847540][ T5329] RAX: ffffffffffffffda RBX: 00007f50daa25fa0 RCX: 00007f50da79e159 [ 104.850999][ T5329] RDX: 0000200000000680 RSI: 0000000000000720 RDI: 0000000000000004 [ 104.855225][ T5329] RBP: 00007f50da83506b R08: 0000000000000000 R09: 0000000000000000 [ 104.858236][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 104.861560][ T5329] R13: 00007f50daa26038 R14: 00007f50daa25fa0 R15: 00007ffc90f48548 [ 104.864944][ T5329] [ 104.866751][ T5329] Kernel Offset: disabled [ 104.868686][ T5329] Rebooting in 86400 seconds..