program: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) r3 = syz_open_dev$I2C(&(0x7f00000000c0), 0xc, 0x88a81) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) ioctl$I2C_SMBUS(r3, 0x720, &(0x7f0000000040)={0x0, 0x6, 0x1, &(0x7f0000000000)={0xc, "3ac071ffbc8cd0d684737999cc8bd238954cb2216d398df0f558125211b40c65fd"}}) socket$netlink(0x10, 0x3, 0x8) r4 = socket(0x10, 0x2, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@newqdisc={0x24, 0x24, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x4}, {0xffe0}, {0x0, 0xe}}}, 0x24}}, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[], 0x5c}, 0x1, 0x0, 0x0, 0x20000800}, 0x10) sendmsg$IPSET_CMD_LIST(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, 0x7, 0x6, 0x101, 0x0, 0x0, {0xd, 0x0, 0x7}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x80) sendmsg$nl_route_sched(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0x0, 0x4}, {0xffff}}, [@TCA_EGRESS_BLOCK={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=@deltaction={0x4c, 0x31, 0x8, 0x70bd28, 0x25dfdbfe, {}, [@TCA_ACT_TAB={0x38, 0x1, [{0xc, 0x6, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7fffffff}}, {0xc, 0xb, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}, {0x10, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0xc, 0x5, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1}}]}]}, 0x4c}}, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r7 = socket$kcm(0x2, 0xa, 0x2) syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) r9 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x105042, 0x1ff) fsconfig$FSCONFIG_SET_FD(r9, 0x5, 0x0, 0x0, 0xffffffffffffffff) setsockopt$inet6_group_source_req(r8, 0x29, 0x2b, &(0x7f0000000080)={0x4, {{0xa, 0x4e22, 0x12000000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x6}}, {{0xa, 0x4e22, 0x80000000, @private1, 0x8}}}, 0x108) ioctl$NILFS_IOCTL_CHANGE_CPMODE(r8, 0x40106e80, &(0x7f0000000040)={0xffffffffffffffb7}) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000180)={'wg1\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x21}}) socket$nl_netfilter(0x10, 0x3, 0xc) r10 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/mm/ksm/run\x00', 0x2, 0x0) sendfile(r10, r10, 0x0, 0x1) [ 102.165053][ T5296] Bluetooth: hci0: command tx timeout [ 102.479165][ T1368] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 102.628264][ T1368] usb 5-1: Using ep0 maxpacket: 16 [ 102.636879][ T1368] usb 5-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 102.640895][ T1368] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 102.644432][ T1368] usb 5-1: Product: syz [ 102.646618][ T1368] usb 5-1: Manufacturer: syz [ 102.650480][ T1368] usb 5-1: SerialNumber: syz [ 102.672590][ T1368] usb 5-1: config 0 descriptor?? [ 103.080427][ T1368] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 103.108981][ T1368] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 103.114221][ T1368] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 103.117676][ T1368] usb 5-1: media controller created [ 103.134379][ T1368] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 103.281402][ T1368] zl10353_read_register: readreg error (reg=127, ret==0) [ 103.285512][ T1368] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 103.289157][ T1368] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 103.649074][ T5334] ------------[ cut here ]------------ [ 103.651968][ T5334] usb 5-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0 [ 103.655693][ T5334] WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1057/0x18b0, CPU#0: syz.0.0/5334 [ 103.660564][ T5334] Modules linked in: [ 103.663133][ T5334] CPU: 0 UID: 0 PID: 5334 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.667304][ T5334] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.671495][ T5334] RIP: 0010:usb_submit_urb+0x1100/0x18b0 [ 103.673655][ T5334] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89 [ 103.682574][ T5334] RSP: 0018:ffffc9000e2e7698 EFLAGS: 00010246 [ 103.685141][ T5334] RAX: 0000000000000000 RBX: ffff888033fbdd00 RCX: 0000000080000280 [ 103.694623][ T5334] RDX: ffff88803492db40 RSI: ffffffff8ca33060 RDI: ffffffff9065b520 [ 103.698266][ T5334] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000 [ 103.702108][ T5334] R10: ffffc9000e2e7780 R11: fffff52001c5cefc R12: 1ffff11008692870 [ 103.706257][ T5334] R13: ffff888043494380 R14: ffff88803492db40 R15: 0000000080000280 [ 103.709917][ T5334] FS: 00007f9f0de296c0(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 103.714099][ T5334] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 103.717236][ T5334] CR2: 000055ff80739e60 CR3: 000000001287b000 CR4: 0000000000352ef0 [ 103.720813][ T5334] Call Trace: [ 103.722313][ T5334] [ 103.723714][ T5334] usb_start_wait_urb+0x13f/0x5b0 [ 103.726315][ T5334] ? rcu_is_watching+0x15/0xb0 [ 103.728700][ T5334] ? trace_kmalloc+0x2a/0xf0 [ 103.730711][ T5334] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 103.732946][ T5334] usb_control_msg+0x234/0x3e0 [ 103.735045][ T5334] dtv5100_i2c_msg+0x231/0x2f0 [ 103.737561][ T5334] dtv5100_i2c_xfer+0x1a5/0x610 [ 103.740068][ T5334] ? kasan_save_track+0x4f/0x80 [ 103.742250][ T5334] ? kasan_save_free_info+0x40/0x50 [ 103.744396][ T5334] ? __se_sys_ioctl+0x47/0x170 [ 103.746581][ T5334] __i2c_transfer+0x7be/0x1fe0 [ 103.749055][ T5334] __i2c_smbus_xfer+0x1584/0x27d0 [ 103.751428][ T5334] ? __pfx___i2c_smbus_xfer+0x10/0x10 [ 103.753702][ T5334] ? lockdep_hardirqs_on+0x7a/0x110 [ 103.755978][ T5334] ? rt_mutex_lock_nested+0x156/0x1c0 [ 103.758449][ T5334] i2c_smbus_xfer+0x1f4/0x310 [ 103.760746][ T5334] i2cdev_ioctl_smbus+0x1e7/0x700 [ 103.763109][ T5334] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10 [ 103.765571][ T5334] i2cdev_ioctl+0x615/0x880 [ 103.767596][ T5334] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 103.769966][ T5334] ? __fget_files+0x2a/0x420 [ 103.772088][ T5334] ? __fget_files+0x3a2/0x420 [ 103.774081][ T5334] ? bpf_lsm_file_ioctl+0x9/0x20 [ 103.776234][ T5334] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 103.778455][ T5334] __se_sys_ioctl+0xfc/0x170 [ 103.780341][ T5334] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.783007][ T5334] do_syscall_64+0x174/0x580 [ 103.785217][ T5334] ? trace_irq_disable+0x3b/0x140 [ 103.787745][ T5334] ? clear_bhb_loop+0x40/0x90 [ 103.790638][ T5334] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.793399][ T5334] RIP: 0033:0x7f9f0cf9e0d9 [ 103.795643][ T5334] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.804971][ T5334] RSP: 002b:00007f9f0de28fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 103.809445][ T5334] RAX: ffffffffffffffda RBX: 00007f9f0d226090 RCX: 00007f9f0cf9e0d9 [ 103.813113][ T5334] RDX: 0000200000000040 RSI: 0000000000000720 RDI: 0000000000000006 [ 103.816381][ T5334] RBP: 00007f9f0d035024 R08: 0000000000000000 R09: 0000000000000000 [ 103.820250][ T5334] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.823900][ T5334] R13: 00007f9f0d226128 R14: 00007f9f0d226090 R15: 00007ffcb1a2af68 [ 103.827116][ T5334] [ 103.828559][ T5334] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 103.831891][ T5334] CPU: 0 UID: 0 PID: 5334 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.836121][ T5334] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.840471][ T5334] Call Trace: [ 103.841920][ T5334] [ 103.843275][ T5334] vpanic+0x56c/0xa60 [ 103.845127][ T5334] ? __pfx__printk+0x10/0x10 [ 103.847238][ T5334] ? __pfx_vpanic+0x10/0x10 [ 103.849330][ T5334] ? is_bpf_text_address+0x292/0x2b0 [ 103.851779][ T5334] ? is_bpf_text_address+0x26/0x2b0 [ 103.853934][ T5334] panic+0xc5/0xd0 [ 103.855559][ T5334] ? __pfx_panic+0x10/0x10 [ 103.857598][ T5334] __warn+0x315/0x4c0 [ 103.859419][ T5334] ? usb_submit_urb+0x1057/0x18b0 [ 103.861629][ T5334] ? usb_submit_urb+0x1057/0x18b0 [ 103.863873][ T5334] __report_bug+0x276/0x570 [ 103.866016][ T5334] ? usb_submit_urb+0x1057/0x18b0 [ 103.868381][ T5334] ? __pfx___report_bug+0x10/0x10 [ 103.870522][ T5334] ? __kmalloc_noprof+0x1ad/0x720 [ 103.872625][ T5334] ? kasan_save_track+0x4f/0x80 [ 103.874839][ T5334] ? kasan_save_track+0x3e/0x80 [ 103.877255][ T5334] ? __kasan_kmalloc+0x93/0xb0 [ 103.879502][ T5334] report_bug_entry+0x19a/0x290 [ 103.881735][ T5334] ? usb_submit_urb+0x1100/0x18b0 [ 103.883963][ T5334] ? usb_submit_urb+0x1105/0x18b0 [ 103.886191][ T5334] handle_bug+0xce/0x200 [ 103.888128][ T5334] exc_invalid_op+0x1a/0x50 [ 103.890271][ T5334] asm_exc_invalid_op+0x1a/0x20 [ 103.892532][ T5334] RIP: 0010:usb_submit_urb+0x1100/0x18b0 [ 103.895011][ T5334] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89 [ 103.903669][ T5334] RSP: 0018:ffffc9000e2e7698 EFLAGS: 00010246 [ 103.906509][ T5334] RAX: 0000000000000000 RBX: ffff888033fbdd00 RCX: 0000000080000280 [ 103.909954][ T5334] RDX: ffff88803492db40 RSI: ffffffff8ca33060 RDI: ffffffff9065b520 [ 103.913490][ T5334] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000 [ 103.917463][ T5334] R10: ffffc9000e2e7780 R11: fffff52001c5cefc R12: 1ffff11008692870 [ 103.920972][ T5334] R13: ffff888043494380 R14: ffff88803492db40 R15: 0000000080000280 [ 103.924460][ T5334] ? usb_submit_urb+0x1091/0x18b0 [ 103.926759][ T5334] usb_start_wait_urb+0x13f/0x5b0 [ 103.928964][ T5334] ? rcu_is_watching+0x15/0xb0 [ 103.931301][ T5334] ? trace_kmalloc+0x2a/0xf0 [ 103.933458][ T5334] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 103.935922][ T5334] usb_control_msg+0x234/0x3e0 [ 103.938151][ T5334] dtv5100_i2c_msg+0x231/0x2f0 [ 103.940342][ T5334] dtv5100_i2c_xfer+0x1a5/0x610 [ 103.942735][ T5334] ? kasan_save_track+0x4f/0x80 [ 103.944921][ T5334] ? kasan_save_free_info+0x40/0x50 [ 103.947170][ T5334] ? __se_sys_ioctl+0x47/0x170 [ 103.949233][ T5334] __i2c_transfer+0x7be/0x1fe0 [ 103.951373][ T5334] __i2c_smbus_xfer+0x1584/0x27d0 [ 103.953782][ T5334] ? __pfx___i2c_smbus_xfer+0x10/0x10 [ 103.956356][ T5334] ? lockdep_hardirqs_on+0x7a/0x110 [ 103.958564][ T5334] ? rt_mutex_lock_nested+0x156/0x1c0 [ 103.960742][ T5334] i2c_smbus_xfer+0x1f4/0x310 [ 103.962540][ T5334] i2cdev_ioctl_smbus+0x1e7/0x700 [ 103.964590][ T5334] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10 [ 103.967130][ T5334] i2cdev_ioctl+0x615/0x880 [ 103.969179][ T5334] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 103.971252][ T5334] ? __fget_files+0x2a/0x420 [ 103.973167][ T5334] ? __fget_files+0x3a2/0x420 [ 103.975086][ T5334] ? bpf_lsm_file_ioctl+0x9/0x20 [ 103.977214][ T5334] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 103.979371][ T5334] __se_sys_ioctl+0xfc/0x170 [ 103.981262][ T5334] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.983880][ T5334] do_syscall_64+0x174/0x580 [ 103.985777][ T5334] ? trace_irq_disable+0x3b/0x140 [ 103.988179][ T5334] ? clear_bhb_loop+0x40/0x90 [ 103.990427][ T5334] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.993133][ T5334] RIP: 0033:0x7f9f0cf9e0d9 [ 103.995095][ T5334] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 104.003516][ T5334] RSP: 002b:00007f9f0de28fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 104.007020][ T5334] RAX: ffffffffffffffda RBX: 00007f9f0d226090 RCX: 00007f9f0cf9e0d9 [ 104.010486][ T5334] RDX: 0000200000000040 RSI: 0000000000000720 RDI: 0000000000000006 [ 104.013939][ T5334] RBP: 00007f9f0d035024 R08: 0000000000000000 R09: 0000000000000000 [ 104.017193][ T5334] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 104.020669][ T5334] R13: 00007f9f0d226128 R14: 00007f9f0d226090 R15: 00007ffcb1a2af68 [ 104.024291][ T5334] [ 104.026070][ T5334] Kernel Offset: disabled [ 104.027942][ T5334] Rebooting in 86400 seconds..