------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 2016 at drivers/usb/core/urb.c:505 usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:504 Modules linked in: CPU: 0 PID: 2016 Comm: kworker/0:2 Not tainted 6.3.0-rc7-syzkaller-g14f8db1c0f9a #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 Workqueue: mld mld_ifc_work pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:504 lr : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:504 sp : ffff8000243b6fb0 x29: ffff8000243b6ff0 x28: 0000000000000003 x27: ffff8000138dd38c x26: ffff0000ca98f700 x25: ffff0000c22b6000 x24: 0000000000000400 x23: ffff8000138e3c00 x22: dfff800000000000 x21: 0000000000000003 x20: 0000000000000820 x19: ffff0000d734da00 x18: ffff8000243b64c0 x17: 0000000000000000 x16: ffff80001236e294 x15: 0000000000000405 x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000001 x11: 0000000000000403 x10: 0000000000000000 x9 : 330d52f5f9e40f00 x8 : 330d52f5f9e40f00 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff8000243b6898 x4 : ffff800015e4ccc0 x3 : ffff800008584230 x2 : 0000000000000001 x1 : 0000000100000403 x0 : 0000000000000000 Call trace: usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:504 usbnet_start_xmit+0xc74/0x18c0 drivers/net/usb/usbnet.c:1453 __netdev_start_xmit include/linux/netdevice.h:4884 [inline] netdev_start_xmit include/linux/netdevice.h:4898 [inline] xmit_one net/core/dev.c:3581 [inline] dev_hard_start_xmit+0x240/0x8ac net/core/dev.c:3597 sch_direct_xmit+0x234/0x548 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:3808 [inline] __dev_queue_xmit+0x1640/0x37dc net/core/dev.c:4213 dev_queue_xmit include/linux/netdevice.h:3054 [inline] neigh_resolve_output+0x518/0x618 net/core/neighbour.c:1583 neigh_output include/net/neighbour.h:546 [inline] ip6_finish_output2+0xd78/0x1a5c net/ipv6/ip6_output.c:134 __ip6_finish_output net/ipv6/ip6_output.c:195 [inline] ip6_finish_output+0x538/0x8c8 net/ipv6/ip6_output.c:206 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip6_output+0x270/0x594 net/ipv6/ip6_output.c:227 dst_output include/net/dst.h:444 [inline] NF_HOOK+0x160/0x4f0 include/linux/netfilter.h:302 mld_sendpack+0x904/0x1358 net/ipv6/mcast.c:1820 mld_send_cr net/ipv6/mcast.c:2121 [inline] mld_ifc_work+0x848/0xc20 net/ipv6/mcast.c:2653 process_one_work+0x788/0x12d4 kernel/workqueue.c:2390 worker_thread+0x8e0/0xfe8 kernel/workqueue.c:2537 kthread+0x250/0x2d8 kernel/kthread.c:376 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 irq event stamp: 100361 hardirqs last enabled at (100360): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] hardirqs last enabled at (100360): [] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:194 hardirqs last disabled at (100361): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (100361): [] _raw_spin_lock_irqsave+0x2c/0x7c kernel/locking/spinlock.c:162 softirqs last enabled at (100312): [] softirq_handle_end kernel/softirq.c:414 [inline] softirqs last enabled at (100312): [] __do_softirq+0xac0/0xd54 kernel/softirq.c:600 softirqs last disabled at (100314): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19 ---[ end trace 0000000000000000 ]---