program: syz_usb_connect(0x3, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x201, 0xd1, 0xa0, 0x5e, 0x20, 0xccd, 0x102, 0x890e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x8, 0x54, 0x40, 0x1, "", [{{0x9, 0x4, 0xbc, 0x80, 0x0, 0xc, 0xf1, 0xc7, 0x7f}}]}}]}}, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r0 = syz_open_dev$I2C(&(0x7f0000000000), 0xa840, 0x582) ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000100)={&(0x7f00000000c0)=[{0x1900, 0x800, 0x0, 0x0}], 0x1}) [ 86.201884][ T5282] Bluetooth: hci0: command tx timeout [ 86.538233][ T5067] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 86.687451][ T5067] usb 5-1: Using ep0 maxpacket: 32 [ 86.690211][ T5067] usb 5-1: unable to get BOS descriptor or descriptor too short [ 86.690272][ T5067] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0102, bcdDevice=89.0e [ 86.692220][ T5067] usb 5-1: config 8 has an invalid interface number: 188 but max is 0 [ 86.692236][ T5067] usb 5-1: config 8 has no interface number 0 [ 86.692254][ T5067] usb 5-1: config 8 interface 188 has no altsetting 0 [ 86.695689][ T5067] usb 5-1: string descriptor 0 read error: -22 [ 86.695815][ T5067] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 86.756289][ T5067] dvb-usb: found a 'Terratec Cinergy S2 USB HD Rev.3' in warm state. [ 86.756343][ T5067] dw2102: su3000_power_ctrl: 1, initialized 0 [ 86.756614][ T5067] dvb-usb: bulk message failed: -22 (2/0) [ 86.788232][ T5067] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 86.789115][ T5067] dvbdev: DVB: registering new adapter (Terratec Cinergy S2 USB HD Rev.3) [ 86.789142][ T5067] usb 5-1: media controller created [ 86.789438][ T5067] dvb-usb: bulk message failed: -22 (6/0) [ 86.789451][ T5067] dw2102: i2c transfer failed. [ 86.789474][ T5067] dvb-usb: bulk message failed: -22 (6/0) [ 86.789479][ T5067] dw2102: i2c transfer failed. [ 86.789486][ T5067] dvb-usb: bulk message failed: -22 (6/0) [ 86.789492][ T5067] dw2102: i2c transfer failed. [ 86.789499][ T5067] dvb-usb: bulk message failed: -22 (6/0) [ 86.789506][ T5067] dw2102: i2c transfer failed. [ 86.789513][ T5067] dvb-usb: bulk message failed: -22 (6/0) [ 86.789519][ T5067] dw2102: i2c transfer failed. [ 86.789525][ T5067] dvb-usb: bulk message failed: -22 (6/0) [ 86.789531][ T5067] dw2102: i2c transfer failed. [ 86.789536][ T5067] dvb-usb: MAC address: 02:02:02:02:02:02 [ 86.856420][ T5067] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 86.921964][ T5067] dvb-usb: bulk message failed: -22 (3/0) [ 86.922027][ T5067] dw2102: command 0x0e transfer failed. [ 86.922042][ T5067] dvb-usb: bulk message failed: -22 (3/0) [ 86.922048][ T5067] dw2102: command 0x0e transfer failed. [ 87.227660][ T5067] dvb-usb: bulk message failed: -22 (3/0) [ 87.227673][ T5067] dw2102: command 0x0e transfer failed. [ 87.227676][ T5067] dvb-usb: bulk message failed: -22 (3/0) [ 87.227681][ T5067] dw2102: command 0x0e transfer failed. [ 87.227683][ T5067] dvb-usb: bulk message failed: -22 (1/0) [ 87.227687][ T5067] dw2102: command 0x51 transfer failed. [ 87.228841][ T5320] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI [ 87.247656][ T5320] KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] [ 87.251266][ T5320] CPU: 0 UID: 0 PID: 5320 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 87.255129][ T5320] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 87.259396][ T5320] RIP: 0010:su3000_i2c_transfer+0x1aa/0xfc0 [ 87.261991][ T5320] Code: 4c 89 f8 48 c1 e8 03 49 bc 00 00 00 00 00 fc ff df 42 80 3c 20 00 74 08 4c 89 ff e8 a0 75 07 fa 49 8b 1f 48 89 d8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 e7 08 00 00 0f b6 1b 48 8b 44 24 30 42 [ 87.270034][ T5320] RSP: 0018:ffffc9000e517bb8 EFLAGS: 00010202 [ 87.272591][ T5320] RAX: 0000000000000002 RBX: 0000000000000010 RCX: 0000000000000003 [ 87.275927][ T5320] RDX: ffffffff88332ad2 RSI: ffffffff90df9050 RDI: 0000000000001900 [ 87.279316][ T5320] RBP: 0000000000000000 R08: ffff888037a10000 R09: 0000000000000002 [ 87.282697][ T5320] R10: 0000000000001a00 R11: 0000000000000002 R12: dffffc0000000000 [ 87.285935][ T5320] R13: 1ffff11008b3d154 R14: 0000000000000001 R15: ffff8880459e8aa8 [ 87.289637][ T5320] FS: 00007f4f7e0ef6c0(0000) GS:ffff88808b0b4000(0000) knlGS:0000000000000000 [ 87.294052][ T5320] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 87.297053][ T5320] CR2: 00007f4f7d41b7f8 CR3: 000000004191d000 CR4: 0000000000352ef0 [ 87.300567][ T5320] Call Trace: [ 87.302234][ T5320] [ 87.304743][ T5320] __i2c_transfer+0x7bf/0x1fe0 [ 87.306913][ T5320] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 87.309638][ T5320] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 87.312145][ T5320] ? rt_mutex_lock_nested+0x156/0x1c0 [ 87.314503][ T5320] ? i2c_transfer+0xc7/0x2d0 [ 87.316608][ T5320] i2c_transfer+0x1cb/0x2d0 [ 87.318692][ T5320] i2cdev_ioctl_rdwr+0x460/0x740 [ 87.320926][ T5320] i2cdev_ioctl+0x6a5/0x880 [ 87.322919][ T5320] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 87.325040][ T5320] ? __fget_files+0x3a2/0x420 [ 87.326977][ T5320] ? __fget_files+0x2a/0x420 [ 87.328810][ T5320] ? bpf_lsm_file_ioctl+0x9/0x20 [ 87.330911][ T5320] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 87.333039][ T5320] __se_sys_ioctl+0xfc/0x170 [ 87.335063][ T5320] do_syscall_64+0x166/0x520 [ 87.337068][ T5320] ? trace_irq_disable+0x3b/0x140 [ 87.339227][ T5320] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.341979][ T5320] ? clear_bhb_loop+0x70/0xc0 [ 87.344094][ T5320] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.346727][ T5320] RIP: 0033:0x7f4f7d19e2d9 [ 87.348688][ T5320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 87.356413][ T5320] RSP: 002b:00007f4f7e0eefe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 87.359985][ T5320] RAX: ffffffffffffffda RBX: 00007f4f7d425fa0 RCX: 00007f4f7d19e2d9 [ 87.363342][ T5320] RDX: 0000200000000100 RSI: 0000000000000707 RDI: 0000000000000004 [ 87.366594][ T5320] RBP: 00007f4f7d235888 R08: 0000000000000000 R09: 0000000000000000 [ 87.369896][ T5320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 87.373164][ T5320] R13: 00007f4f7d426038 R14: 00007f4f7d425fa0 R15: 00007ffd69a24438 [ 87.376571][ T5320] [ 87.377900][ T5320] Modules linked in: [ 87.380700][ T5320] ---[ end trace 0000000000000000 ]--- [ 87.411343][ T5067] DVB: Unable to find symbol ds3000_attach() [ 87.411353][ T5067] dvb-usb: no frontend was attached by 'Terratec Cinergy S2 USB HD Rev.3' [ 87.411558][ T5320] RIP: 0010:su3000_i2c_transfer+0x1aa/0xfc0 [ 87.411752][ T5320] Code: 4c 89 f8 48 c1 e8 03 49 bc 00 00 00 00 00 fc ff df 42 80 3c 20 00 74 08 4c 89 ff e8 a0 75 07 fa 49 8b 1f 48 89 d8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 e7 08 00 00 0f b6 1b 48 8b 44 24 30 42 [ 87.411762][ T5320] RSP: 0018:ffffc9000e517bb8 EFLAGS: 00010202 [ 87.411773][ T5320] RAX: 0000000000000002 RBX: 0000000000000010 RCX: 0000000000000003 [ 87.411778][ T5320] RDX: ffffffff88332ad2 RSI: ffffffff90df9050 RDI: 0000000000001900 [ 87.411783][ T5320] RBP: 0000000000000000 R08: ffff888037a10000 R09: 0000000000000002 [ 87.411788][ T5320] R10: 0000000000001a00 R11: 0000000000000002 R12: dffffc0000000000 [ 87.411793][ T5320] R13: 1ffff11008b3d154 R14: 0000000000000001 R15: ffff8880459e8aa8 [ 87.411798][ T5320] FS: 00007f4f7e0ef6c0(0000) GS:ffff88808b0b4000(0000) knlGS:0000000000000000 [ 87.411804][ T5320] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 87.411809][ T5320] CR2: 00007f46a6226e9c CR3: 000000004191d000 CR4: 0000000000352ef0 [ 87.411848][ T5320] Kernel panic - not syncing: Fatal exception [ 87.461478][ T5320] Kernel Offset: disabled [ 87.463340][ T5320] Rebooting in 86400 seconds..