program: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x14) r3 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) getsockopt$netlink(r4, 0x10e, 0x3, &(0x7f0000000080)=""/79, &(0x7f0000001100)=0x4f) syz_usb_control_io$hid(r3, &(0x7f0000000340)={0x24, 0x0, &(0x7f0000000180)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) r5 = syz_open_dev$I2C(&(0x7f00000000c0), 0xc, 0x88000) ioctl$I2C_SMBUS(r5, 0x720, &(0x7f0000000240)={0x1, 0x7, 0x0, &(0x7f00000017c0)={0x91, "4ec098884329f6dd0711762717c44bc7b7b1cc22a10010115d6d00"}}) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x40d, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r2, 0x1, 0xc000}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x6}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x404c084}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)=@newlink={0x2c, 0x10, 0x801, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, 0x0, 0x840}, [@IFLA_ADDRESS={0xa}]}, 0x2c}}, 0x0) [ 103.101769][ T5285] Bluetooth: hci0: command tx timeout [ 103.365305][ T5083] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 103.517008][ T5083] usb 5-1: Using ep0 maxpacket: 16 [ 103.519478][ T5083] usb 5-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 103.523379][ T5083] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 103.523399][ T5083] usb 5-1: Product: syz [ 103.523407][ T5083] usb 5-1: Manufacturer: syz [ 103.523414][ T5083] usb 5-1: SerialNumber: syz [ 103.777680][ T5083] usb 5-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 103.807056][ T5083] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 103.807377][ T5083] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 103.807418][ T5083] usb 5-1: media controller created [ 103.839260][ T5083] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 104.080072][ T5325] ------------[ cut here ]------------ [ 104.080082][ T5325] usb 5-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0 [ 104.080090][ T5325] WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1057/0x18b0, CPU#0: syz.0.0/5325 [ 104.092426][ T5325] Modules linked in: [ 104.094170][ T5325] CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 104.098635][ T5325] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 104.103109][ T5325] RIP: 0010:usb_submit_urb+0x1100/0x18b0 [ 104.105743][ T5325] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89 [ 104.114695][ T5325] RSP: 0018:ffffc9000ea6f5f8 EFLAGS: 00010246 [ 104.117904][ T5325] RAX: 0000000000000000 RBX: ffff8880373c3200 RCX: 0000000080000280 [ 104.121856][ T5325] RDX: ffff8880009b0000 RSI: ffffffff8cc54ca0 RDI: ffffffff90882c90 [ 104.126210][ T5325] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000 [ 104.130338][ T5325] R10: ffffc9000ea6f6e0 R11: fffff52001d4dee8 R12: 1ffff11009fe0b20 [ 104.134203][ T5325] R13: ffff88804ff05900 R14: ffff8880009b0000 R15: 0000000080000280 [ 104.138246][ T5325] FS: 00007f60f96616c0(0000) GS:ffff88808c2c0000(0000) knlGS:0000000000000000 [ 104.142154][ T5325] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 104.145562][ T5325] CR2: 0000561a5abdda80 CR3: 0000000012591000 CR4: 0000000000352ef0 [ 104.149536][ T5325] Call Trace: [ 104.151319][ T5325] [ 104.152974][ T5325] usb_start_wait_urb+0x13f/0x5b0 [ 104.155978][ T5325] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 104.158485][ T5325] usb_control_msg+0x234/0x3e0 [ 104.160797][ T5325] gl861_ctrl_msg+0x207/0x420 [ 104.162976][ T5325] ? __pfx_gl861_ctrl_msg+0x10/0x10 [ 104.165364][ T5325] ? do_raw_spin_lock+0x12b/0x2f0 [ 104.167731][ T5325] gl861_i2c_master_xfer+0x439/0x6a0 [ 104.170060][ T5325] __i2c_transfer+0x7bf/0x1fe0 [ 104.172100][ T5325] __i2c_smbus_xfer+0x159a/0x27e0 [ 104.174184][ T5325] ? rt_mutex_slowlock+0x1f2/0x780 [ 104.176424][ T5325] ? __pfx___i2c_smbus_xfer+0x10/0x10 [ 104.178669][ T5325] ? rt_mutex_lock_nested+0x167/0x1c0 [ 104.181058][ T5325] i2c_smbus_xfer+0x1f5/0x310 [ 104.183312][ T5325] i2cdev_ioctl_smbus+0x1e7/0x700 [ 104.185754][ T5325] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10 [ 104.188094][ T5325] i2cdev_ioctl+0x615/0x880 [ 104.190060][ T5325] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 104.192221][ T5325] ? __fget_files+0x2a/0x420 [ 104.194222][ T5325] ? __fget_files+0x3a2/0x420 [ 104.196407][ T5325] ? bpf_lsm_file_ioctl+0x9/0x20 [ 104.198532][ T5325] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 104.200728][ T5325] __se_sys_ioctl+0xfc/0x170 [ 104.202939][ T5325] do_syscall_64+0x166/0x520 [ 104.205213][ T5325] ? trace_irq_disable+0x3b/0x140 [ 104.207565][ T5325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.210420][ T5325] ? clear_bhb_loop+0x70/0xc0 [ 104.212766][ T5325] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.215832][ T5325] RIP: 0033:0x7f60f879e159 [ 104.217438][ T5325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 104.225167][ T5325] RSP: 002b:00007f60f9660fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 104.228830][ T5325] RAX: ffffffffffffffda RBX: 00007f60f8a25fa0 RCX: 00007f60f879e159 [ 104.232391][ T5325] RDX: 0000200000000240 RSI: 0000000000000720 RDI: 0000000000000007 [ 104.236135][ T5325] RBP: 00007f60f883506b R08: 0000000000000000 R09: 0000000000000000 [ 104.239661][ T5325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 104.243109][ T5325] R13: 00007f60f8a26038 R14: 00007f60f8a25fa0 R15: 00007fff28581d18 [ 104.246660][ T5325] [ 104.248133][ T5325] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 104.251091][ T5325] CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 104.254828][ T5325] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 104.258511][ T5325] Call Trace: [ 104.259788][ T5325] [ 104.260947][ T5325] vpanic+0x56d/0xa60 [ 104.262682][ T5325] ? __pfx__printk+0x10/0x10 [ 104.264856][ T5325] ? __pfx_vpanic+0x10/0x10 [ 104.267008][ T5325] ? is_bpf_text_address+0x292/0x2b0 [ 104.269517][ T5325] ? is_bpf_text_address+0x26/0x2b0 [ 104.272041][ T5325] panic+0xc5/0xd0 [ 104.273757][ T5325] ? __pfx_panic+0x10/0x10 [ 104.275761][ T5325] __warn+0x315/0x4c0 [ 104.277574][ T5325] ? usb_submit_urb+0x1057/0x18b0 [ 104.279860][ T5325] ? usb_submit_urb+0x1057/0x18b0 [ 104.282189][ T5325] __report_bug+0x276/0x570 [ 104.284274][ T5325] ? usb_submit_urb+0x1057/0x18b0 [ 104.286470][ T5325] ? __pfx___report_bug+0x10/0x10 [ 104.288642][ T5325] ? stack_depot_save_flags+0x404/0x7f0 [ 104.291137][ T5325] report_bug_entry+0x19b/0x290 [ 104.293425][ T5325] ? usb_submit_urb+0x1100/0x18b0 [ 104.295605][ T5325] ? usb_submit_urb+0x1105/0x18b0 [ 104.297851][ T5325] handle_bug+0xce/0x200 [ 104.299837][ T5325] exc_invalid_op+0x1a/0x50 [ 104.301798][ T5325] asm_exc_invalid_op+0x1a/0x20 [ 104.303848][ T5325] RIP: 0010:usb_submit_urb+0x1100/0x18b0 [ 104.306134][ T5325] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89 [ 104.314299][ T5325] RSP: 0018:ffffc9000ea6f5f8 EFLAGS: 00010246 [ 104.317074][ T5325] RAX: 0000000000000000 RBX: ffff8880373c3200 RCX: 0000000080000280 [ 104.320540][ T5325] RDX: ffff8880009b0000 RSI: ffffffff8cc54ca0 RDI: ffffffff90882c90 [ 104.323792][ T5325] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000 [ 104.327125][ T5325] R10: ffffc9000ea6f6e0 R11: fffff52001d4dee8 R12: 1ffff11009fe0b20 [ 104.330631][ T5325] R13: ffff88804ff05900 R14: ffff8880009b0000 R15: 0000000080000280 [ 104.334276][ T5325] ? usb_submit_urb+0x1091/0x18b0 [ 104.336490][ T5325] usb_start_wait_urb+0x13f/0x5b0 [ 104.338664][ T5325] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 104.341175][ T5325] usb_control_msg+0x234/0x3e0 [ 104.343507][ T5325] gl861_ctrl_msg+0x207/0x420 [ 104.345660][ T5325] ? __pfx_gl861_ctrl_msg+0x10/0x10 [ 104.348145][ T5325] ? do_raw_spin_lock+0x12b/0x2f0 [ 104.350544][ T5325] gl861_i2c_master_xfer+0x439/0x6a0 [ 104.353016][ T5325] __i2c_transfer+0x7bf/0x1fe0 [ 104.355069][ T5325] __i2c_smbus_xfer+0x159a/0x27e0 [ 104.357316][ T5325] ? rt_mutex_slowlock+0x1f2/0x780 [ 104.359751][ T5325] ? __pfx___i2c_smbus_xfer+0x10/0x10 [ 104.362160][ T5325] ? rt_mutex_lock_nested+0x167/0x1c0 [ 104.364474][ T5325] i2c_smbus_xfer+0x1f5/0x310 [ 104.366393][ T5325] i2cdev_ioctl_smbus+0x1e7/0x700 [ 104.368440][ T5325] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10 [ 104.370738][ T5325] i2cdev_ioctl+0x615/0x880 [ 104.372784][ T5325] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 104.374774][ T5325] ? __fget_files+0x2a/0x420 [ 104.376802][ T5325] ? __fget_files+0x3a2/0x420 [ 104.378717][ T5325] ? bpf_lsm_file_ioctl+0x9/0x20 [ 104.380824][ T5325] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 104.383135][ T5325] __se_sys_ioctl+0xfc/0x170 [ 104.385256][ T5325] do_syscall_64+0x166/0x520 [ 104.387378][ T5325] ? trace_irq_disable+0x3b/0x140 [ 104.389825][ T5325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.392871][ T5325] ? clear_bhb_loop+0x70/0xc0 [ 104.395220][ T5325] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.398174][ T5325] RIP: 0033:0x7f60f879e159 [ 104.400440][ T5325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 104.409470][ T5325] RSP: 002b:00007f60f9660fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 104.413273][ T5325] RAX: ffffffffffffffda RBX: 00007f60f8a25fa0 RCX: 00007f60f879e159 [ 104.416911][ T5325] RDX: 0000200000000240 RSI: 0000000000000720 RDI: 0000000000000007 [ 104.420691][ T5325] RBP: 00007f60f883506b R08: 0000000000000000 R09: 0000000000000000 [ 104.424451][ T5325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 104.428116][ T5325] R13: 00007f60f8a26038 R14: 00007f60f8a25fa0 R15: 00007fff28581d18 [ 104.431708][ T5325] [ 104.433428][ T5325] Kernel Offset: disabled [ 104.435172][ T5325] Rebooting in 86400 seconds..