program: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) r2 = syz_open_dev$I2C(&(0x7f00000000c0), 0xc, 0x88a81) syz_usb_control_io$hid(r1, 0x0, 0x0) r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x77, 0x29, 0x4, 0x20, 0x424, 0x9901, 0xc257, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x10}}]}}, 0x0) syz_emit_vhci(&(0x7f0000000380)=ANY=[@ANYRES32=r3], 0x2) syz_usb_control_io$uac3(r3, &(0x7f0000000400)={0x14, &(0x7f0000000140)={0x20, 0x1f, 0x63, {0x63, 0x9, "6d5d8d3200abb7c9cc5b0514828abd24076b27030ad7be57818307f3f08fb76c97255976ec54944f9430eabb231fce7d21ef180deeab154d45720e226cf6aab66202a5a4fe666caf9f8551c0aa261fc9fcf9124c4bcf609551ca673cc67ca6c57c"}}, &(0x7f00000003c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc09}}}, &(0x7f0000000640)={0x44, &(0x7f0000000440)={0x20, 0x0, 0x39, "bb945fb271dfc49b4ad604a77fdd5aa1d78bea7b8bd0263a4a649b23e09ad2cce19246eabd00374e8299cffd80b82a803d9cef3b63d876238a"}, &(0x7f0000000480)={0x0, 0xa, 0x1, 0x81}, &(0x7f00000004c0)={0x0, 0x8, 0x1, 0xc}, &(0x7f0000000500)={0x20, 0x81, 0x3, "7ec8f3"}, &(0x7f0000000540)={0x20, 0x82, 0x2, 'oq'}, &(0x7f0000000580)={0x20, 0x83, 0x2, "02d5"}, &(0x7f00000005c0)={0x20, 0x84, 0x1, "0e"}, &(0x7f0000000600)={0x20, 0x85, 0x3, "93c414"}}) syz_usb_control_io$hid(r1, 0x0, 0x0) ioctl$I2C_SMBUS(r2, 0x720, &(0x7f0000000040)={0x0, 0x6, 0x2, &(0x7f0000000000)={0x1c, "3ac071ffbc8cd0d684737999cc8bd238954cb2216d398df0f558125211b40c65fd"}}) r4 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000b00)=ANY=[@ANYBLOB="1201000000000008d804dd0000000000000109022400010000a008090400fe01030001000921fffffd0122050009058103"], 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io(r4, &(0x7f0000000040)={0x2c, &(0x7f00000012c0)=ANY=[@ANYBLOB="400305"], 0x0, 0x0, 0x0, 0x0}, 0x0) r5 = syz_open_dev$I2C(&(0x7f0000000100), 0x2, 0x41) ioctl$I2C_SMBUS(r5, 0x720, &(0x7f00000000c0)={0x0, 0x0, 0x1, 0x0}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, 0x0, &(0x7f0000000040)=0x28) r6 = openat$nmem0(0xffffffffffffff9c, &(0x7f0000002100), 0x8000, 0x0) ioctl$F2FS_IOC_WRITE_CHECKPOINT(r6, 0xf507, 0x0) syz_mount_image$minix(&(0x7f0000000040), &(0x7f00000001c0)='./file0\x00', 0x40, &(0x7f0000000200), 0x1, 0x16f, &(0x7f0000000240)="$eJzs281KAlEYxvFn1Mzs+xtaBQW1yfGroF1eiuhk0liSbZQgupSurBvQRTfQRKNYMxSNgjOo/x/IvK/w8J6zOM7ZKABzKyHJkKGUJMdxnm+ODR1GvSgAoXAGzw8HwPyJ/3n0kwp3JQDC1SvF3fd/U9Lb+1OlO/ikAt4feqWY+7yS1P2RXwqafzHc50HCm09LWg5yf3nt509881dGnJ/25VcD5/v7Pz3y5tckrUvakLQpaUvStqQdSbu/zK/65hsB5wMAAAAAEIShjL/3fBHTdd22ssN+we1zwz7p9nlfXxj2i26fqdzb1UltAcCYYv+c/7jv/Cd85x/A9Gq1O7dl27YeRi2+wqOnKCgopqKI+pcJwKSZj42m2Wp3zuqNcs2qWXf54vlFsZC7zOZN9+Zveu//AGbH90s/6pUAAAAAAAAAAAAAAIBx7Unaj3oRAAAAAEIRxt+Jot4jAAAAAAAAAAAAAACz7jMAAP//rMhHFg==") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r7, &(0x7f0000005a40)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x98}}, {{&(0x7f0000005840)=@file={0x1, './file2\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x4004000}}], 0x2, 0x0) [ 165.252847][ T44] Bluetooth: hci0: command tx timeout [ 165.541429][ T5342] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 165.691339][ T5342] usb 5-1: Using ep0 maxpacket: 16 [ 165.702250][ T5342] usb 5-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 165.706464][ T5342] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 165.709898][ T5342] usb 5-1: Product: syz [ 165.712206][ T5342] usb 5-1: Manufacturer: syz [ 165.714260][ T5342] usb 5-1: SerialNumber: syz [ 165.722423][ T5342] usb 5-1: config 0 descriptor?? [ 166.135253][ T5342] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 166.149971][ T5342] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 166.156012][ T5342] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 166.160527][ T5342] usb 5-1: media controller created [ 166.183493][ T5342] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 166.344551][ T5345] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 166.349410][ T5342] zl10353_read_register: readreg error (reg=127, ret==0) [ 166.353056][ T5342] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 166.359821][ T5345] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 166.364831][ T5342] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 166.735825][ T5346] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 166.744071][ T5346] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 166.761740][ T5346] ------------[ cut here ]------------ [ 166.765465][ T5346] usb 5-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0 [ 166.769144][ T5346] WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1057/0x18b0, CPU#0: syz.0.0/5346 [ 166.773624][ T5346] Modules linked in: [ 166.776677][ T5346] CPU: 0 UID: 0 PID: 5346 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 166.780251][ T5346] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 166.784580][ T5346] RIP: 0010:usb_submit_urb+0x1100/0x18b0 [ 166.786998][ T5346] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89 [ 166.795770][ T5346] RSP: 0018:ffffc9000e417698 EFLAGS: 00010246 [ 166.798445][ T5346] RAX: 0000000000000000 RBX: ffff888037864700 RCX: 0000000080000280 [ 166.801948][ T5346] RDX: ffff888032dd9580 RSI: ffffffff8ca32bc0 RDI: ffffffff9065a770 [ 166.804905][ T5346] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000 [ 166.808326][ T5346] R10: ffffc9000e417780 R11: fffff52001c82efc R12: 1ffff11008730878 [ 166.811716][ T5346] R13: ffff8880439843c0 R14: ffff888032dd9580 R15: 0000000080000280 [ 166.814941][ T5346] FS: 00007f8733b9f6c0(0000) GS:ffff88808c543000(0000) knlGS:0000000000000000 [ 166.818685][ T5346] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 166.821780][ T5346] CR2: 00002000000012c1 CR3: 0000000012f63000 CR4: 0000000000352ef0 [ 166.825374][ T5346] Call Trace: [ 166.826885][ T5346] [ 166.828157][ T5346] usb_start_wait_urb+0x13f/0x5b0 [ 166.830246][ T5346] ? rcu_is_watching+0x15/0xb0 [ 166.832616][ T5346] ? trace_kmalloc+0x2a/0xf0 [ 166.834848][ T5346] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 166.837198][ T5346] usb_control_msg+0x234/0x3e0 [ 166.839180][ T5346] dtv5100_i2c_msg+0x231/0x2f0 [ 166.841343][ T5346] dtv5100_i2c_xfer+0x1a5/0x610 [ 166.843430][ T5346] ? kasan_save_track+0x4f/0x80 [ 166.845398][ T5346] ? kasan_save_free_info+0x40/0x50 [ 166.847401][ T5346] ? security_file_ioctl+0xc3/0x2a0 [ 166.849473][ T5346] ? __se_sys_ioctl+0x47/0x170 [ 166.851498][ T5346] __i2c_transfer+0x7be/0x1fe0 [ 166.853512][ T5346] __i2c_smbus_xfer+0x1584/0x27d0 [ 166.855502][ T5346] ? __pfx___i2c_smbus_xfer+0x10/0x10 [ 166.857708][ T5346] ? lockdep_hardirqs_on+0x7a/0x110 [ 166.859869][ T5346] ? rt_mutex_lock_nested+0x156/0x1c0 [ 166.862169][ T5346] i2c_smbus_xfer+0x1f4/0x310 [ 166.864103][ T5346] i2cdev_ioctl_smbus+0x1e7/0x700 [ 166.866280][ T5346] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10 [ 166.868673][ T5346] i2cdev_ioctl+0x615/0x880 [ 166.870627][ T5346] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 166.873082][ T5346] ? __fget_files+0x2a/0x420 [ 166.875137][ T5346] ? __fget_files+0x3a2/0x420 [ 166.877194][ T5346] ? bpf_lsm_file_ioctl+0x9/0x20 [ 166.879188][ T5346] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 166.881402][ T5346] __se_sys_ioctl+0xfc/0x170 [ 166.883291][ T5346] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 166.885808][ T5346] do_syscall_64+0x174/0x580 [ 166.888030][ T5346] ? trace_irq_disable+0x3b/0x140 [ 166.890249][ T5346] ? clear_bhb_loop+0x40/0x90 [ 166.892338][ T5346] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 166.894893][ T5346] RIP: 0033:0x7f8732d9de99 [ 166.896873][ T5346] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 166.905213][ T5346] RSP: 002b:00007f8733b9efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 166.908728][ T5346] RAX: ffffffffffffffda RBX: 00007f8733026090 RCX: 00007f8732d9de99 [ 166.912161][ T5346] RDX: 00002000000000c0 RSI: 0000000000000720 RDI: 0000000000000008 [ 166.915593][ T5346] RBP: 00007f8732e33eaf R08: 0000000000000000 R09: 0000000000000000 [ 166.919091][ T5346] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 166.922485][ T5346] R13: 00007f8733026128 R14: 00007f8733026090 R15: 00007ffd3b70fae8 [ 166.925957][ T5346] [ 166.927626][ T5346] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 166.930669][ T5346] CPU: 0 UID: 0 PID: 5346 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 166.934495][ T5346] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 166.938666][ T5346] Call Trace: [ 166.940089][ T5346] [ 166.941391][ T5346] vpanic+0x56c/0xa60 [ 166.943178][ T5346] ? __pfx__printk+0x10/0x10 [ 166.945424][ T5346] ? __pfx_vpanic+0x10/0x10 [ 166.947709][ T5346] ? is_bpf_text_address+0x292/0x2b0 [ 166.949959][ T5346] ? is_bpf_text_address+0x26/0x2b0 [ 166.952234][ T5346] panic+0xc5/0xd0 [ 166.953883][ T5346] ? __pfx_panic+0x10/0x10 [ 166.955843][ T5346] __warn+0x315/0x4c0 [ 166.957663][ T5346] ? usb_submit_urb+0x1057/0x18b0 [ 166.959840][ T5346] ? usb_submit_urb+0x1057/0x18b0 [ 166.962037][ T5346] __report_bug+0x276/0x570 [ 166.964072][ T5346] ? usb_submit_urb+0x1057/0x18b0 [ 166.966299][ T5346] ? __pfx___report_bug+0x10/0x10 [ 166.968416][ T5346] ? __kmalloc_noprof+0x1ad/0x720 [ 166.970519][ T5346] ? kasan_save_track+0x4f/0x80 [ 166.972650][ T5346] ? kasan_save_track+0x3e/0x80 [ 166.974735][ T5346] ? __kasan_kmalloc+0x93/0xb0 [ 166.976825][ T5346] report_bug_entry+0x19a/0x290 [ 166.978942][ T5346] ? usb_submit_urb+0x1100/0x18b0 [ 166.981209][ T5346] ? usb_submit_urb+0x1105/0x18b0 [ 166.983493][ T5346] handle_bug+0xce/0x200 [ 166.985468][ T5346] exc_invalid_op+0x1a/0x50 [ 166.987490][ T5346] asm_exc_invalid_op+0x1a/0x20 [ 166.989630][ T5346] RIP: 0010:usb_submit_urb+0x1100/0x18b0 [ 166.991998][ T5346] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89 [ 167.000021][ T5346] RSP: 0018:ffffc9000e417698 EFLAGS: 00010246 [ 167.002536][ T5346] RAX: 0000000000000000 RBX: ffff888037864700 RCX: 0000000080000280 [ 167.005323][ T5346] RDX: ffff888032dd9580 RSI: ffffffff8ca32bc0 RDI: ffffffff9065a770 [ 167.008232][ T5346] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000 [ 167.011628][ T5346] R10: ffffc9000e417780 R11: fffff52001c82efc R12: 1ffff11008730878 [ 167.015190][ T5346] R13: ffff8880439843c0 R14: ffff888032dd9580 R15: 0000000080000280 [ 167.018542][ T5346] ? usb_submit_urb+0x1091/0x18b0 [ 167.020734][ T5346] usb_start_wait_urb+0x13f/0x5b0 [ 167.022930][ T5346] ? rcu_is_watching+0x15/0xb0 [ 167.025057][ T5346] ? trace_kmalloc+0x2a/0xf0 [ 167.026999][ T5346] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 167.029586][ T5346] usb_control_msg+0x234/0x3e0 [ 167.031690][ T5346] dtv5100_i2c_msg+0x231/0x2f0 [ 167.033739][ T5346] dtv5100_i2c_xfer+0x1a5/0x610 [ 167.035846][ T5346] ? kasan_save_track+0x4f/0x80 [ 167.038061][ T5346] ? kasan_save_free_info+0x40/0x50 [ 167.040332][ T5346] ? security_file_ioctl+0xc3/0x2a0 [ 167.042438][ T5346] ? __se_sys_ioctl+0x47/0x170 [ 167.044224][ T5346] __i2c_transfer+0x7be/0x1fe0 [ 167.046216][ T5346] __i2c_smbus_xfer+0x1584/0x27d0 [ 167.048471][ T5346] ? __pfx___i2c_smbus_xfer+0x10/0x10 [ 167.050737][ T5346] ? lockdep_hardirqs_on+0x7a/0x110 [ 167.052985][ T5346] ? rt_mutex_lock_nested+0x156/0x1c0 [ 167.055270][ T5346] i2c_smbus_xfer+0x1f4/0x310 [ 167.057359][ T5346] i2cdev_ioctl_smbus+0x1e7/0x700 [ 167.059579][ T5346] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10 [ 167.062056][ T5346] i2cdev_ioctl+0x615/0x880 [ 167.064035][ T5346] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 167.065963][ T5346] ? __fget_files+0x2a/0x420 [ 167.068065][ T5346] ? __fget_files+0x3a2/0x420 [ 167.070105][ T5346] ? bpf_lsm_file_ioctl+0x9/0x20 [ 167.072164][ T5346] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 167.074291][ T5346] __se_sys_ioctl+0xfc/0x170 [ 167.076165][ T5346] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 167.078780][ T5346] do_syscall_64+0x174/0x580 [ 167.080784][ T5346] ? trace_irq_disable+0x3b/0x140 [ 167.082817][ T5346] ? clear_bhb_loop+0x40/0x90 [ 167.084746][ T5346] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 167.087127][ T5346] RIP: 0033:0x7f8732d9de99 [ 167.088832][ T5346] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 167.095869][ T5346] RSP: 002b:00007f8733b9efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 167.099280][ T5346] RAX: ffffffffffffffda RBX: 00007f8733026090 RCX: 00007f8732d9de99 [ 167.102506][ T5346] RDX: 00002000000000c0 RSI: 0000000000000720 RDI: 0000000000000008 [ 167.106203][ T5346] RBP: 00007f8732e33eaf R08: 0000000000000000 R09: 0000000000000000 [ 167.109983][ T5346] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 167.113376][ T5346] R13: 00007f8733026128 R14: 00007f8733026090 R15: 00007ffd3b70fae8 [ 167.116927][ T5346] [ 167.118747][ T5346] Kernel Offset: disabled [ 167.120627][ T5346] Rebooting in 86400 seconds..