program:
r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000200)={0x24, 0x0, &(0x7f0000000300)={0x0, 0x3, 0x4, @string={0x3158e6ebfa2aff90, 0x3, "f6a196769cc479a2cfd88784edf3eaec43cce3e854e7a71ec5e0a7a22fd830864e070092a5e96358ea6b8de459804475ccb4126f42b149a521ce324155b3fa43ace5a8171b2cd94993bd06547a9acd679f9296a409a882f9a50d16fe7b60385983d241e16fbd04ff52f440eea392408366d1882fd9ada8ea3b9844dc7d500000000000000000000000000000000062975a351b000041c50d7884934616a1b82d68561bb6241311050b996cc0a0788e73a15be53c1561ddc992f22ae3a40714a2a9144ec0fc97e6712362006a8db4e4d2dd215d5b644748e0cbebf66f53021059c351faedf8"}}, 0x0, 0x0}, 0x0)
r1 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000b00)=ANY=[@ANYBLOB="1201000000000008d804dd0000000000000109022400010000a008090400fe01030001000921fffffd0122050009058103"], 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, &(0x7f0000000040)={0x18, &(0x7f00000012c0)={0x40, 0x3, 0x5, {0x5, 0x4, '\x00\x00\x00'}}, 0x0, 0x0, 0x0, 0x0}, 0x0)
r2 = syz_open_dev$I2C(&(0x7f0000000100), 0x2, 0x41)
ioctl$I2C_SMBUS(r2, 0x720, &(0x7f00000000c0)={0x1, 0x0, 0x0, 0x0})
r3 = syz_open_dev$I2C(&(0x7f00000000c0), 0xc, 0x88000)
ioctl$I2C_SMBUS(r3, 0x720, &(0x7f0000000240)={0x1, 0x7, 0x3, &(0x7f00000017c0)={0x98, "45c098884329f6dd0711762917c44bc7b7b1cc22a10010115d6d00"}})
r4 = socket$igmp(0x2, 0x3, 0x2)
setsockopt$MRT_INIT(r4, 0x0, 0xc8, &(0x7f0000003d40), 0x4)
setsockopt$MRT_ADD_VIF(r4, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10)
r5 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r5, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10)
connect$inet(r5, &(0x7f0000000080)={0x2, 0x0, @multicast2}, 0x10)
mount(&(0x7f0000000040)=@filename='./file0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='fuse\x00', 0x200040, &(0x7f0000000140)='\x00')
[ 93.684330][ T4649] Bluetooth: hci0: command tx timeout
[ 94.047617][ T10] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 94.217890][ T10] usb 5-1: Using ep0 maxpacket: 16
[ 94.225013][ T10] usb 5-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22
[ 94.228727][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 94.231660][ T10] usb 5-1: Product: syz
[ 94.233087][ T10] usb 5-1: Manufacturer: syz
[ 94.234695][ T10] usb 5-1: SerialNumber: syz
[ 94.452529][ T10] usb 5-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state
[ 94.468985][ T10] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer
[ 94.479224][ T10] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0)
[ 94.483573][ T10] usb 5-1: media controller created
[ 94.503977][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[ 94.652015][ T5325] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 94.663445][ T5325] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 94.729246][ T10] zl10353_read_register: readreg error (reg=127, ret==-110)
[ 94.729978][ T5325] ------------[ cut here ]------------
[ 94.736018][ T5325] usb 5-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0
[ 94.740107][ T5325] WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1057/0x18b0, CPU#0: syz.0.0/5325
[ 94.744592][ T5325] Modules linked in:
[ 94.746471][ T5325] CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.750465][ T5325] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.754726][ T5325] RIP: 0010:usb_submit_urb+0x1100/0x18b0
[ 94.757159][ T5325] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89
[ 94.765135][ T5325] RSP: 0018:ffffc9000f7575f8 EFLAGS: 00010246
[ 94.794248][ T5325] RAX: 0000000000000000 RBX: ffff88801336d900 RCX: 0000000080000280
[ 94.797897][ T5325] RDX: ffff888043c42f20 RSI: ffffffff8ca33060 RDI: ffffffff9065b520
[ 94.801264][ T5325] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000
[ 94.804665][ T5325] R10: ffffc9000f7576e0 R11: fffff52001eeaee8 R12: 1ffff110087ce1f0
[ 94.808075][ T5325] R13: ffff888043e70f80 R14: ffff888043c42f20 R15: 0000000080000280
[ 94.811534][ T5325] FS: 00007fab51a366c0(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000
[ 94.815368][ T5325] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 94.819061][ T5325] CR2: 000055c40df96c78 CR3: 00000000133b6000 CR4: 0000000000352ef0
[ 94.822477][ T5325] Call Trace:
[ 94.823968][ T5325]
[ 94.825316][ T5325] usb_start_wait_urb+0x13f/0x5b0
[ 94.827742][ T5325] ? __pfx_usb_start_wait_urb+0x10/0x10
[ 94.830301][ T5325] usb_control_msg+0x234/0x3e0
[ 94.832480][ T5325] gl861_ctrl_msg+0x207/0x420
[ 94.834570][ T5325] ? __pfx_gl861_ctrl_msg+0x10/0x10
[ 94.836775][ T5325] ? do_raw_spin_lock+0x12b/0x2f0
[ 94.838977][ T5325] gl861_i2c_master_xfer+0x439/0x6a0
[ 94.841232][ T5325] __i2c_transfer+0x7be/0x1fe0
[ 94.843325][ T5325] __i2c_smbus_xfer+0x1584/0x27d0
[ 94.845457][ T5325] ? lockdep_hardirqs_on+0x7a/0x110
[ 94.847814][ T5325] ? rt_mutex_slowlock+0x1f2/0x780
[ 94.850077][ T5325] ? __pfx___i2c_smbus_xfer+0x10/0x10
[ 94.852385][ T5325] ? rt_mutex_lock_nested+0x167/0x1c0
[ 94.854454][ T5325] i2c_smbus_xfer+0x1f4/0x310
[ 94.856402][ T5325] i2cdev_ioctl_smbus+0x1e7/0x700
[ 94.858766][ T5325] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10
[ 94.861155][ T5325] i2cdev_ioctl+0x615/0x880
[ 94.863086][ T5325] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 94.865268][ T5325] ? __fget_files+0x2a/0x420
[ 94.867525][ T5325] ? __fget_files+0x3a2/0x420
[ 94.869899][ T5325] ? bpf_lsm_file_ioctl+0x9/0x20
[ 94.872088][ T5325] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 94.874218][ T5325] __se_sys_ioctl+0xfc/0x170
[ 94.876280][ T5325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.878885][ T5325] do_syscall_64+0x174/0x580
[ 94.880857][ T5325] ? trace_irq_disable+0x3b/0x140
[ 94.883016][ T5325] ? clear_bhb_loop+0x40/0x90
[ 94.885072][ T5325] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.887963][ T5325] RIP: 0033:0x7fab50b9e019
[ 94.889817][ T5325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.898386][ T5325] RSP: 002b:00007fab51a35fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 94.902059][ T5325] RAX: ffffffffffffffda RBX: 00007fab50e25fa0 RCX: 00007fab50b9e019
[ 94.905503][ T5325] RDX: 00002000000000c0 RSI: 0000000000000720 RDI: 0000000000000005
[ 94.909046][ T5325] RBP: 00007fab50c3500c R08: 0000000000000000 R09: 0000000000000000
[ 94.912753][ T5325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.916283][ T5325] R13: 00007fab50e26038 R14: 00007fab50e25fa0 R15: 00007ffc35e9f168
[ 94.919591][ T5325]
[ 94.920901][ T5325] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 94.923966][ T5325] CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.927744][ T5325] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.931879][ T5325] Call Trace:
[ 94.933442][ T5325]
[ 94.934711][ T5325] vpanic+0x56c/0xa60
[ 94.936490][ T5325] ? __pfx__printk+0x10/0x10
[ 94.938500][ T5325] ? __pfx_vpanic+0x10/0x10
[ 94.940471][ T5325] ? is_bpf_text_address+0x292/0x2b0
[ 94.942695][ T5325] ? is_bpf_text_address+0x26/0x2b0
[ 94.945093][ T5325] panic+0xc5/0xd0
[ 94.946746][ T5325] ? __pfx_panic+0x10/0x10
[ 94.948712][ T5325] __warn+0x315/0x4c0
[ 94.950344][ T5325] ? usb_submit_urb+0x1057/0x18b0
[ 94.952448][ T5325] ? usb_submit_urb+0x1057/0x18b0
[ 94.954462][ T5325] __report_bug+0x276/0x570
[ 94.956322][ T5325] ? usb_submit_urb+0x1057/0x18b0
[ 94.958510][ T5325] ? __pfx___report_bug+0x10/0x10
[ 94.960708][ T5325] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 94.963287][ T5325] ? __kmalloc_noprof+0x1ad/0x720
[ 94.965461][ T5325] ? kasan_save_track+0x4f/0x80
[ 94.967589][ T5325] report_bug_entry+0x19a/0x290
[ 94.969603][ T5325] ? usb_submit_urb+0x1100/0x18b0
[ 94.971766][ T5325] ? usb_submit_urb+0x1105/0x18b0
[ 94.973929][ T5325] handle_bug+0xce/0x200
[ 94.975843][ T5325] exc_invalid_op+0x1a/0x50
[ 94.977751][ T5325] asm_exc_invalid_op+0x1a/0x20
[ 94.979771][ T5325] RIP: 0010:usb_submit_urb+0x1100/0x18b0
[ 94.982170][ T5325] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89
[ 94.990133][ T5325] RSP: 0018:ffffc9000f7575f8 EFLAGS: 00010246
[ 94.992790][ T5325] RAX: 0000000000000000 RBX: ffff88801336d900 RCX: 0000000080000280
[ 94.996079][ T5325] RDX: ffff888043c42f20 RSI: ffffffff8ca33060 RDI: ffffffff9065b520
[ 94.999451][ T5325] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000
[ 95.002878][ T5325] R10: ffffc9000f7576e0 R11: fffff52001eeaee8 R12: 1ffff110087ce1f0
[ 95.006170][ T5325] R13: ffff888043e70f80 R14: ffff888043c42f20 R15: 0000000080000280
[ 95.009655][ T5325] ? usb_submit_urb+0x1091/0x18b0
[ 95.011894][ T5325] usb_start_wait_urb+0x13f/0x5b0
[ 95.014103][ T5325] ? __pfx_usb_start_wait_urb+0x10/0x10
[ 95.016507][ T5325] usb_control_msg+0x234/0x3e0
[ 95.018569][ T5325] gl861_ctrl_msg+0x207/0x420
[ 95.020623][ T5325] ? __pfx_gl861_ctrl_msg+0x10/0x10
[ 95.022760][ T5325] ? do_raw_spin_lock+0x12b/0x2f0
[ 95.024965][ T5325] gl861_i2c_master_xfer+0x439/0x6a0
[ 95.027190][ T5325] __i2c_transfer+0x7be/0x1fe0
[ 95.029276][ T5325] __i2c_smbus_xfer+0x1584/0x27d0
[ 95.031356][ T5325] ? lockdep_hardirqs_on+0x7a/0x110
[ 95.033545][ T5325] ? rt_mutex_slowlock+0x1f2/0x780
[ 95.035666][ T5325] ? __pfx___i2c_smbus_xfer+0x10/0x10
[ 95.037918][ T5325] ? rt_mutex_lock_nested+0x167/0x1c0
[ 95.040219][ T5325] i2c_smbus_xfer+0x1f4/0x310
[ 95.042339][ T5325] i2cdev_ioctl_smbus+0x1e7/0x700
[ 95.044435][ T5325] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10
[ 95.046604][ T5325] i2cdev_ioctl+0x615/0x880
[ 95.048415][ T5325] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 95.050447][ T5325] ? __fget_files+0x2a/0x420
[ 95.052316][ T5325] ? __fget_files+0x3a2/0x420
[ 95.054313][ T5325] ? bpf_lsm_file_ioctl+0x9/0x20
[ 95.056331][ T5325] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 95.058460][ T5325] __se_sys_ioctl+0xfc/0x170
[ 95.060469][ T5325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.063104][ T5325] do_syscall_64+0x174/0x580
[ 95.065180][ T5325] ? trace_irq_disable+0x3b/0x140
[ 95.067266][ T5325] ? clear_bhb_loop+0x40/0x90
[ 95.069281][ T5325] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.071833][ T5325] RIP: 0033:0x7fab50b9e019
[ 95.073670][ T5325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 95.081786][ T5325] RSP: 002b:00007fab51a35fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 95.085364][ T5325] RAX: ffffffffffffffda RBX: 00007fab50e25fa0 RCX: 00007fab50b9e019
[ 95.088682][ T5325] RDX: 00002000000000c0 RSI: 0000000000000720 RDI: 0000000000000005
[ 95.092339][ T5325] RBP: 00007fab50c3500c R08: 0000000000000000 R09: 0000000000000000
[ 95.096313][ T5325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 95.099512][ T5325] R13: 00007fab50e26038 R14: 00007fab50e25fa0 R15: 00007ffc35e9f168
[ 95.102533][ T5325]
[ 95.104025][ T5325] Kernel Offset: disabled
[ 95.105757][ T5325] Rebooting in 86400 seconds..