------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 9 at drivers/usb/core/urb.c:504 usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 Modules linked in: CPU: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.4.0-rc5-syzkaller-00016-ga4d7d7011219 #0 Hardware name: linux,dummy-virt (DT) Workqueue: mld mld_ifc_work pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 lr : usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 sp : ffff80000a80b870 x29: ffff80000a80b870 x28: 0000000000000000 x27: fdff00000593f000 x26: 0000000000000001 x25: f8ff0000057458a8 x24: ffff800009ad45b8 x23: 0000000000000003 x22: 0000000000000003 x21: 0000000000000820 x20: f8ff000005745800 x19: f6ff000005b27900 x18: 00000000fffffffe x17: ffff800075617000 x16: ffff800008000000 x15: 0000000000000020 x14: ffff80000a3ecc78 x13: 000000000000088e x12: 00000000000002da x11: 202c726566782062 x10: ffff80000a49cc78 x9 : 00000000ffffe000 x8 : ffff80000a3ecc78 x7 : ffff80000a49cc78 x6 : 0000000000000000 x5 : ffff00007f9b7c88 x4 : 0000000000000000 x3 : ffff800075617000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : f5ff000003098000 Call trace: usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 usbnet_start_xmit+0x340/0x5dc drivers/net/usb/usbnet.c:1453 __netdev_start_xmit include/linux/netdevice.h:4915 [inline] netdev_start_xmit include/linux/netdevice.h:4929 [inline] xmit_one net/core/dev.c:3578 [inline] dev_hard_start_xmit+0x94/0x148 net/core/dev.c:3594 sch_direct_xmit+0x90/0x1e4 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:3805 [inline] __dev_queue_xmit+0x468/0xd40 net/core/dev.c:4210 dev_queue_xmit include/linux/netdevice.h:3085 [inline] neigh_resolve_output net/core/neighbour.c:1552 [inline] neigh_resolve_output+0xfc/0x1c8 net/core/neighbour.c:1532 neigh_output include/net/neighbour.h:544 [inline] ip6_finish_output2+0x1b0/0x7b8 net/ipv6/ip6_output.c:134 __ip6_finish_output net/ipv6/ip6_output.c:195 [inline] ip6_finish_output+0x220/0x360 net/ipv6/ip6_output.c:206 NF_HOOK_COND include/linux/netfilter.h:292 [inline] ip6_output+0x74/0x1d4 net/ipv6/ip6_output.c:227 dst_output include/net/dst.h:458 [inline] NF_HOOK.constprop.0+0x50/0xe0 include/linux/netfilter.h:303 mld_sendpack+0x280/0x4b8 net/ipv6/mcast.c:1820 mld_send_cr net/ipv6/mcast.c:2121 [inline] mld_ifc_work+0x1d0/0x4bc net/ipv6/mcast.c:2653 process_one_work+0x1c0/0x30c kernel/workqueue.c:2405 worker_thread+0x70/0x418 kernel/workqueue.c:2552 kthread+0x118/0x11c kernel/kthread.c:379 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 9 at drivers/usb/core/urb.c:504 usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 Modules linked in: CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.4.0-rc5-syzkaller-00016-ga4d7d7011219 #0 Hardware name: linux,dummy-virt (DT) Workqueue: ipv6_addrconf addrconf_dad_work pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 lr : usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 sp : ffff80000a80b800 x29: ffff80000a80b800 x28: 0000000000000000 x27: fdff00000593f000 x26: 0000000000000001 x25: f8ff0000057458a8 x24: ffff800009ad45b8 x23: 0000000000000003 x22: 0000000000000003 x21: 0000000000000820 x20: f8ff000005745800 x19: f0ff000005b27900 x18: 00000000fffffffe x17: ffff800075617000 x16: ffff800008000000 x15: 0000000000000020 x14: ffff80000a3ecc78 x13: 0000000000000903 x12: 0000000000000301 x11: 202c726566782062 x10: ffff80000a49cc78 x9 : 00000000ffffe000 x8 : ffff80000a3ecc78 x7 : ffff80000a49cc78 x6 : 0000000000000000 x5 : ffff00007f9b7c88 x4 : 0000000000000000 x3 : ffff800075617000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : f5ff000003098000 Call trace: usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 usbnet_start_xmit+0x340/0x5dc drivers/net/usb/usbnet.c:1453 __netdev_start_xmit include/linux/netdevice.h:4915 [inline] netdev_start_xmit include/linux/netdevice.h:4929 [inline] xmit_one net/core/dev.c:3578 [inline] dev_hard_start_xmit+0x94/0x148 net/core/dev.c:3594 sch_direct_xmit+0x90/0x1e4 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:3805 [inline] __dev_queue_xmit+0x468/0xd40 net/core/dev.c:4210 dev_queue_xmit include/linux/netdevice.h:3085 [inline] neigh_resolve_output net/core/neighbour.c:1552 [inline] neigh_resolve_output+0xfc/0x1c8 net/core/neighbour.c:1532 neigh_output include/net/neighbour.h:544 [inline] ip6_finish_output2+0x1b0/0x7b8 net/ipv6/ip6_output.c:134 __ip6_finish_output net/ipv6/ip6_output.c:195 [inline] ip6_finish_output+0x220/0x360 net/ipv6/ip6_output.c:206 NF_HOOK_COND include/linux/netfilter.h:292 [inline] ip6_output+0x74/0x1d4 net/ipv6/ip6_output.c:227 dst_output include/net/dst.h:458 [inline] NF_HOOK.constprop.0+0x50/0xe0 include/linux/netfilter.h:303 ndisc_send_skb+0x2f0/0x488 net/ipv6/ndisc.c:508 ndisc_send_ns+0x64/0xb0 net/ipv6/ndisc.c:666 addrconf_dad_work+0x3d4/0x594 net/ipv6/addrconf.c:4176 process_one_work+0x1c0/0x30c kernel/workqueue.c:2405 worker_thread+0x70/0x418 kernel/workqueue.c:2552 kthread+0x118/0x11c kernel/kthread.c:379 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 9 at drivers/usb/core/urb.c:504 usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 Modules linked in: CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.4.0-rc5-syzkaller-00016-ga4d7d7011219 #0 Hardware name: linux,dummy-virt (DT) Workqueue: mld mld_ifc_work pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 lr : usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 sp : ffff80000a80b8b0 x29: ffff80000a80b8b0 x28: 0000000000000000 x27: fdff00000593f000 x26: 0000000000000001 x25: f8ff0000057458a8 x24: ffff800009ad45b8 x23: 0000000000000003 x22: 0000000000000003 x21: 0000000000000820 x20: f8ff000005745800 x19: f4ff000005b27900 x18: 00000000fffffffe x17: ffff800075617000 x16: ffff800008000000 x15: 0000000000000020 x14: ffff80000a3ecc78 x13: 000000000000097b x12: 0000000000000329 x11: 202c726566782062 x10: ffff80000a49cc78 x9 : 00000000ffffe000 x8 : ffff80000a3ecc78 x7 : ffff80000a49cc78 x6 : 0000000000000000 x5 : ffff00007f9b7c88 x4 : 0000000000000000 x3 : ffff800075617000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : f5ff000003098000 Call trace: usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 usbnet_start_xmit+0x340/0x5dc drivers/net/usb/usbnet.c:1453 __netdev_start_xmit include/linux/netdevice.h:4915 [inline] netdev_start_xmit include/linux/netdevice.h:4929 [inline] xmit_one net/core/dev.c:3578 [inline] dev_hard_start_xmit+0x94/0x148 net/core/dev.c:3594 sch_direct_xmit+0x90/0x1e4 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:3805 [inline] __dev_queue_xmit+0x468/0xd40 net/core/dev.c:4210 dev_queue_xmit include/linux/netdevice.h:3085 [inline] neigh_hh_output include/net/neighbour.h:528 [inline] neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x268/0x7b8 net/ipv6/ip6_output.c:134 __ip6_finish_output net/ipv6/ip6_output.c:195 [inline] ip6_finish_output+0x220/0x360 net/ipv6/ip6_output.c:206 NF_HOOK_COND include/linux/netfilter.h:292 [inline] ip6_output+0x74/0x1d4 net/ipv6/ip6_output.c:227 dst_output include/net/dst.h:458 [inline] NF_HOOK.constprop.0+0x50/0xe0 include/linux/netfilter.h:303 mld_sendpack+0x280/0x4b8 net/ipv6/mcast.c:1820 mld_send_cr net/ipv6/mcast.c:2121 [inline] mld_ifc_work+0x1d0/0x4bc net/ipv6/mcast.c:2653 process_one_work+0x1c0/0x30c kernel/workqueue.c:2405 worker_thread+0x70/0x418 kernel/workqueue.c:2552 kthread+0x118/0x11c kernel/kthread.c:379 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 9 at drivers/usb/core/urb.c:504 usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 Modules linked in: CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.4.0-rc5-syzkaller-00016-ga4d7d7011219 #0 Hardware name: linux,dummy-virt (DT) Workqueue: ipv6_addrconf addrconf_dad_work pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 lr : usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 sp : ffff80000a80b800 x29: ffff80000a80b800 x28: 0000000000000000 x27: fdff00000593f000 x26: 0000000000000001 x25: f8ff0000057458a8 x24: ffff800009ad45b8 x23: 0000000000000003 x22: 0000000000000003 x21: 0000000000000820 x20: f8ff000005745800 x19: fbff000005b27900 x18: 00000000fffffffe x17: ffff800075617000 x16: ffff800008000000 x15: 0000000000000020 x14: ffff80000a3ecc78 x13: 00000000000009ed x12: 000000000000034f x11: 202c726566782062 x10: ffff80000a49cc78 x9 : 00000000ffffe000 x8 : ffff80000a3ecc78 x7 : ffff80000a49cc78 x6 : 0000000000000000 x5 : ffff00007f9b7c88 x4 : 0000000000000000 x3 : ffff800075617000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : f5ff000003098000 Call trace: usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 usbnet_start_xmit+0x340/0x5dc drivers/net/usb/usbnet.c:1453 __netdev_start_xmit include/linux/netdevice.h:4915 [inline] netdev_start_xmit include/linux/netdevice.h:4929 [inline] xmit_one net/core/dev.c:3578 [inline] dev_hard_start_xmit+0x94/0x148 net/core/dev.c:3594 sch_direct_xmit+0x90/0x1e4 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:3805 [inline] __dev_queue_xmit+0x468/0xd40 net/core/dev.c:4210 dev_queue_xmit include/linux/netdevice.h:3085 [inline] neigh_hh_output include/net/neighbour.h:528 [inline] neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x268/0x7b8 net/ipv6/ip6_output.c:134 __ip6_finish_output net/ipv6/ip6_output.c:195 [inline] ip6_finish_output+0x220/0x360 net/ipv6/ip6_output.c:206 NF_HOOK_COND include/linux/netfilter.h:292 [inline] ip6_output+0x74/0x1d4 net/ipv6/ip6_output.c:227 dst_output include/net/dst.h:458 [inline] NF_HOOK.constprop.0+0x50/0xe0 include/linux/netfilter.h:303 mld_sendpack+0x280/0x4b8 net/ipv6/mcast.c:1820 mld_send_initial_cr.part.0.isra.0+0x5c/0x70 net/ipv6/mcast.c:2239 mld_send_initial_cr net/ipv6/mcast.c:1232 [inline] ipv6_mc_dad_complete+0x78/0x17c net/ipv6/mcast.c:2247 addrconf_dad_completed+0x31c/0x3a8 net/ipv6/addrconf.c:4234 addrconf_dad_work+0x254/0x594 net/ipv6/addrconf.c:4162 process_one_work+0x1c0/0x30c kernel/workqueue.c:2405 worker_thread+0x70/0x418 kernel/workqueue.c:2552 kthread+0x118/0x11c kernel/kthread.c:379 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 9 at drivers/usb/core/urb.c:504 usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 Modules linked in: CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.4.0-rc5-syzkaller-00016-ga4d7d7011219 #0 Hardware name: linux,dummy-virt (DT) Workqueue: mld mld_ifc_work pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 lr : usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 sp : ffff80000a80b870 x29: ffff80000a80b870 x28: 0000000000000000 x27: fbff00000593b000 x26: 0000000000000001 x25: f8ff0000057458a8 x24: ffff800009ad45b8 x23: 0000000000000003 x22: 0000000000000003 x21: 0000000000000820 x20: f8ff000005745800 x19: f0ff000005b27a00 x18: 00000000fffffffe x17: ffff800075617000 x16: ffff800008000000 x15: 0000000000000020 x14: ffff80000a3ecc78 x13: 0000000000000a68 x12: 0000000000000378 x11: 202c726566782062 x10: ffff80000a49cc78 x9 : 00000000ffffe000 x8 : ffff80000a3ecc78 x7 : ffff80000a49cc78 x6 : 0000000000000000 x5 : ffff00007f9b7c88 x4 : 0000000000000000 x3 : ffff800075617000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : f5ff000003098000 Call trace: usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 usbnet_start_xmit+0x340/0x5dc drivers/net/usb/usbnet.c:1453 __netdev_start_xmit include/linux/netdevice.h:4915 [inline] netdev_start_xmit include/linux/netdevice.h:4929 [inline] xmit_one net/core/dev.c:3578 [inline] dev_hard_start_xmit+0x94/0x148 net/core/dev.c:3594 sch_direct_xmit+0x90/0x1e4 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:3805 [inline] __dev_queue_xmit+0x468/0xd40 net/core/dev.c:4210 dev_queue_xmit include/linux/netdevice.h:3085 [inline] neigh_resolve_output net/core/neighbour.c:1552 [inline] neigh_resolve_output+0xfc/0x1c8 net/core/neighbour.c:1532 neigh_output include/net/neighbour.h:544 [inline] ip6_finish_output2+0x1b0/0x7b8 net/ipv6/ip6_output.c:134 __ip6_finish_output net/ipv6/ip6_output.c:195 [inline] ip6_finish_output+0x220/0x360 net/ipv6/ip6_output.c:206 NF_HOOK_COND include/linux/netfilter.h:292 [inline] ip6_output+0x74/0x1d4 net/ipv6/ip6_output.c:227 dst_output include/net/dst.h:458 [inline] NF_HOOK.constprop.0+0x50/0xe0 include/linux/netfilter.h:303 mld_sendpack+0x280/0x4b8 net/ipv6/mcast.c:1820 mld_send_cr net/ipv6/mcast.c:2121 [inline] mld_ifc_work+0x1d0/0x4bc net/ipv6/mcast.c:2653 process_one_work+0x1c0/0x30c kernel/workqueue.c:2405 worker_thread+0x70/0x418 kernel/workqueue.c:2552 kthread+0x118/0x11c kernel/kthread.c:379 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 9 at drivers/usb/core/urb.c:504 usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 Modules linked in: CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.4.0-rc5-syzkaller-00016-ga4d7d7011219 #0 Hardware name: linux,dummy-virt (DT) Workqueue: mld mld_dad_work pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 lr : usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 sp : ffff80000a80b8d0 x29: ffff80000a80b8d0 x28: 0000000000000000 x27: fdff00000593f000 x26: 0000000000000001 x25: f8ff0000057458a8 x24: ffff800009ad45b8 x23: 0000000000000003 x22: 0000000000000003 x21: 0000000000000820 x20: f8ff000005745800 x19: fcff000005b27a00 x18: 00000000fffffffe x17: ffff800075617000 x16: ffff800008000000 x15: 0000000000000020 x14: ffff80000a3ecc78 x13: 0000000000000add x12: 000000000000039f x11: 202c726566782062 x10: ffff80000a49cc78 x9 : 00000000ffffe000 x8 : ffff80000a3ecc78 x7 : ffff80000a49cc78 x6 : 0000000000000000 x5 : ffff00007f9b7c88 x4 : 0000000000000000 x3 : ffff800075617000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : f5ff000003098000 Call trace: usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 usbnet_start_xmit+0x340/0x5dc drivers/net/usb/usbnet.c:1453 __netdev_start_xmit include/linux/netdevice.h:4915 [inline] netdev_start_xmit include/linux/netdevice.h:4929 [inline] xmit_one net/core/dev.c:3578 [inline] dev_hard_start_xmit+0x94/0x148 net/core/dev.c:3594 sch_direct_xmit+0x90/0x1e4 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:3805 [inline] __dev_queue_xmit+0x468/0xd40 net/core/dev.c:4210 dev_queue_xmit include/linux/netdevice.h:3085 [inline] neigh_hh_output include/net/neighbour.h:528 [inline] neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x268/0x7b8 net/ipv6/ip6_output.c:134 __ip6_finish_output net/ipv6/ip6_output.c:195 [inline] ip6_finish_output+0x220/0x360 net/ipv6/ip6_output.c:206 NF_HOOK_COND include/linux/netfilter.h:292 [inline] ip6_output+0x74/0x1d4 net/ipv6/ip6_output.c:227 dst_output include/net/dst.h:458 [inline] NF_HOOK.constprop.0+0x50/0xe0 include/linux/netfilter.h:303 mld_sendpack+0x280/0x4b8 net/ipv6/mcast.c:1820 mld_send_initial_cr.part.0.isra.0+0x5c/0x70 net/ipv6/mcast.c:2239 mld_send_initial_cr net/ipv6/mcast.c:1232 [inline] mld_dad_work+0x60/0x20c net/ipv6/mcast.c:2262 process_one_work+0x1c0/0x30c kernel/workqueue.c:2405 worker_thread+0x70/0x418 kernel/workqueue.c:2552 kthread+0x118/0x11c kernel/kthread.c:379 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 9 at drivers/usb/core/urb.c:504 usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 Modules linked in: CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.4.0-rc5-syzkaller-00016-ga4d7d7011219 #0 Hardware name: linux,dummy-virt (DT) Workqueue: ipv6_addrconf addrconf_dad_work pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 lr : usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 sp : ffff80000a80b800 x29: ffff80000a80b800 x28: 0000000000000000 x27: fbff00000593b000 x26: 0000000000000001 x25: f8ff0000057458a8 x24: ffff800009ad45b8 x23: 0000000000000003 x22: 0000000000000003 x21: 0000000000000820 x20: f8ff000005745800 x19: f6ff000005b27c00 x18: 00000000fffffffe x17: ffff800075617000 x16: ffff800008000000 x15: 0000000000000020 x14: ffff80000a3ecc78 x13: 0000000000000bdf x12: 00000000000003f5 x11: 202c726566782062 x10: ffff80000a49cc78 x9 : 00000000ffffe000 x8 : ffff80000a3ecc78 x7 : ffff80000a49cc78 x6 : 0000000000000000 x5 : 0000000000017ff4 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : f5ff000003098000 Call trace: usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 usbnet_start_xmit+0x340/0x5dc drivers/net/usb/usbnet.c:1453 __netdev_start_xmit include/linux/netdevice.h:4915 [inline] netdev_start_xmit include/linux/netdevice.h:4929 [inline] xmit_one net/core/dev.c:3578 [inline] dev_hard_start_xmit+0x94/0x148 net/core/dev.c:3594 sch_direct_xmit+0x90/0x1e4 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:3805 [inline] __dev_queue_xmit+0x468/0xd40 net/core/dev.c:4210 dev_queue_xmit include/linux/netdevice.h:3085 [inline] neigh_resolve_output net/core/neighbour.c:1552 [inline] neigh_resolve_output+0xfc/0x1c8 net/core/neighbour.c:1532 neigh_output include/net/neighbour.h:544 [inline] ip6_finish_output2+0x1b0/0x7b8 net/ipv6/ip6_output.c:134 __ip6_finish_output net/ipv6/ip6_output.c:195 [inline] ip6_finish_output+0x220/0x360 net/ipv6/ip6_output.c:206 NF_HOOK_COND include/linux/netfilter.h:292 [inline] ip6_output+0x74/0x1d4 net/ipv6/ip6_output.c:227 dst_output include/net/dst.h:458 [inline] NF_HOOK.constprop.0+0x50/0xe0 include/linux/netfilter.h:303 ndisc_send_skb+0x2f0/0x488 net/ipv6/ndisc.c:508 ndisc_send_ns+0x64/0xb0 net/ipv6/ndisc.c:666 addrconf_dad_work+0x3d4/0x594 net/ipv6/addrconf.c:4176 process_one_work+0x1c0/0x30c kernel/workqueue.c:2405 worker_thread+0x70/0x418 kernel/workqueue.c:2552 kthread+0x118/0x11c kernel/kthread.c:379 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 9 at drivers/usb/core/urb.c:504 usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 Modules linked in: CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.4.0-rc5-syzkaller-00016-ga4d7d7011219 #0 Hardware name: linux,dummy-virt (DT) Workqueue: mld mld_ifc_work pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 lr : usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 sp : ffff80000a80b8b0 x29: ffff80000a80b8b0 x28: 0000000000000000 x27: fbff00000593b000 x26: 0000000000000001 x25: f8ff0000057458a8 x24: ffff800009ad45b8 x23: 0000000000000003 x22: 0000000000000003 x21: 0000000000000820 x20: f8ff000005745800 x19: fdff000005b27c00 x18: 00000000fffffffe x17: ffff800075617000 x16: ffff800008000000 x15: 0000000000000020 x14: ffff80000a3ecc78 x13: 0000000000000cd5 x12: 0000000000000447 x11: 202c726566782062 x10: ffff80000a49cc78 x9 : 00000000ffffe000 x8 : ffff80000a3ecc78 x7 : ffff80000a49cc78 x6 : 0000000000000000 x5 : 0000000000017ff4 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : f5ff000003098000 Call trace: usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 usbnet_start_xmit+0x340/0x5dc drivers/net/usb/usbnet.c:1453 __netdev_start_xmit include/linux/netdevice.h:4915 [inline] netdev_start_xmit include/linux/netdevice.h:4929 [inline] xmit_one net/core/dev.c:3578 [inline] dev_hard_start_xmit+0x94/0x148 net/core/dev.c:3594 sch_direct_xmit+0x90/0x1e4 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:3805 [inline] __dev_queue_xmit+0x468/0xd40 net/core/dev.c:4210 dev_queue_xmit include/linux/netdevice.h:3085 [inline] neigh_hh_output include/net/neighbour.h:528 [inline] neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x268/0x7b8 net/ipv6/ip6_output.c:134 __ip6_finish_output net/ipv6/ip6_output.c:195 [inline] ip6_finish_output+0x220/0x360 net/ipv6/ip6_output.c:206 NF_HOOK_COND include/linux/netfilter.h:292 [inline] ip6_output+0x74/0x1d4 net/ipv6/ip6_output.c:227 dst_output include/net/dst.h:458 [inline] NF_HOOK.constprop.0+0x50/0xe0 include/linux/netfilter.h:303 mld_sendpack+0x280/0x4b8 net/ipv6/mcast.c:1820 mld_send_cr net/ipv6/mcast.c:2121 [inline] mld_ifc_work+0x1d0/0x4bc net/ipv6/mcast.c:2653 process_one_work+0x1c0/0x30c kernel/workqueue.c:2405 worker_thread+0x70/0x418 kernel/workqueue.c:2552 kthread+0x118/0x11c kernel/kthread.c:379 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 9 at drivers/usb/core/urb.c:504 usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 Modules linked in: CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.4.0-rc5-syzkaller-00016-ga4d7d7011219 #0 Hardware name: linux,dummy-virt (DT) Workqueue: ipv6_addrconf addrconf_dad_work pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 lr : usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 sp : ffff80000a80b800 x29: ffff80000a80b800 x28: 0000000000000000 x27: fbff00000593b000 x26: 0000000000000001 x25: f8ff0000057458a8 x24: ffff800009ad45b8 x23: 0000000000000003 x22: 0000000000000003 x21: 0000000000000820 x20: f8ff000005745800 x19: f0ff000005b27c00 x18: 00000000fffffffe x17: ffff800075617000 x16: ffff800008000000 x15: 0000000000000020 x14: ffff80000a3ecc78 x13: 0000000000000dc5 x12: 0000000000000497 x11: 202c726566782062 x10: ffff80000a49cc78 x9 : 00000000ffffe000 x8 : ffff80000a3ecc78 x7 : ffff80000a49cc78 x6 : 0000000000000000 x5 : ffff00007f9b7c88 x4 : 0000000000000000 x3 : ffff800075617000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : f5ff000003098000 Call trace: usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 usbnet_start_xmit+0x340/0x5dc drivers/net/usb/usbnet.c:1453 __netdev_start_xmit include/linux/netdevice.h:4915 [inline] netdev_start_xmit include/linux/netdevice.h:4929 [inline] xmit_one net/core/dev.c:3578 [inline] dev_hard_start_xmit+0x94/0x148 net/core/dev.c:3594 sch_direct_xmit+0x90/0x1e4 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:3805 [inline] __dev_queue_xmit+0x468/0xd40 net/core/dev.c:4210 dev_queue_xmit include/linux/netdevice.h:3085 [inline] neigh_hh_output include/net/neighbour.h:528 [inline] neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x268/0x7b8 net/ipv6/ip6_output.c:134 __ip6_finish_output net/ipv6/ip6_output.c:195 [inline] ip6_finish_output+0x220/0x360 net/ipv6/ip6_output.c:206 NF_HOOK_COND include/linux/netfilter.h:292 [inline] ip6_output+0x74/0x1d4 net/ipv6/ip6_output.c:227 dst_output include/net/dst.h:458 [inline] NF_HOOK.constprop.0+0x50/0xe0 include/linux/netfilter.h:303 mld_sendpack+0x280/0x4b8 net/ipv6/mcast.c:1820 mld_send_initial_cr.part.0.isra.0+0x5c/0x70 net/ipv6/mcast.c:2239 mld_send_initial_cr net/ipv6/mcast.c:1232 [inline] ipv6_mc_dad_complete+0x78/0x17c net/ipv6/mcast.c:2247 addrconf_dad_completed+0x31c/0x3a8 net/ipv6/addrconf.c:4234 addrconf_dad_work+0x254/0x594 net/ipv6/addrconf.c:4162 process_one_work+0x1c0/0x30c kernel/workqueue.c:2405 worker_thread+0x70/0x418 kernel/workqueue.c:2552 kthread+0x118/0x11c kernel/kthread.c:379 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 9 at drivers/usb/core/urb.c:504 usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 Modules linked in: CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.4.0-rc5-syzkaller-00016-ga4d7d7011219 #0 Hardware name: linux,dummy-virt (DT) Workqueue: mld mld_dad_work pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 lr : usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 sp : ffff80000a80b8d0 x29: ffff80000a80b8d0 x28: 0000000000000000 x27: fbff00000593b000 x26: 0000000000000001 x25: f8ff0000057458a8 x24: ffff800009ad45b8 x23: 0000000000000003 x22: 0000000000000003 x21: 0000000000000820 x20: f8ff000005745800 x19: f8ff000005b27c00 x18: 00000000fffffffe x17: ffff800075617000 x16: ffff800008000000 x15: 0000000000000020 x14: ffff80000a3ecc78 x13: 0000000000000ecd x12: 00000000000004ef x11: 202c726566782062 x10: ffff80000a49cc78 x9 : 00000000ffffe000 x8 : ffff80000a3ecc78 x7 : ffff80000a49cc78 x6 : 0000000000000000 x5 : ffff00007f9b7c88 x4 : 0000000000000000 x3 : ffff800075617000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : f5ff000003098000 Call trace: usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 usbnet_start_xmit+0x340/0x5dc drivers/net/usb/usbnet.c:1453 __netdev_start_xmit include/linux/netdevice.h:4915 [inline] netdev_start_xmit include/linux/netdevice.h:4929 [inline] xmit_one net/core/dev.c:3578 [inline] dev_hard_start_xmit+0x94/0x148 net/core/dev.c:3594 sch_direct_xmit+0x90/0x1e4 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:3805 [inline] __dev_queue_xmit+0x468/0xd40 net/core/dev.c:4210 dev_queue_xmit include/linux/netdevice.h:3085 [inline] neigh_hh_output include/net/neighbour.h:528 [inline] neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x268/0x7b8 net/ipv6/ip6_output.c:134 __ip6_finish_output net/ipv6/ip6_output.c:195 [inline] ip6_finish_output+0x220/0x360 net/ipv6/ip6_output.c:206 NF_HOOK_COND include/linux/netfilter.h:292 [inline] ip6_output+0x74/0x1d4 net/ipv6/ip6_output.c:227 dst_output include/net/dst.h:458 [inline] NF_HOOK.constprop.0+0x50/0xe0 include/linux/netfilter.h:303 mld_sendpack+0x280/0x4b8 net/ipv6/mcast.c:1820 mld_send_initial_cr.part.0.isra.0+0x5c/0x70 net/ipv6/mcast.c:2239 mld_send_initial_cr net/ipv6/mcast.c:1232 [inline] mld_dad_work+0x60/0x20c net/ipv6/mcast.c:2262 process_one_work+0x1c0/0x30c kernel/workqueue.c:2405 worker_thread+0x70/0x418 kernel/workqueue.c:2552 kthread+0x118/0x11c kernel/kthread.c:379 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 9 at drivers/usb/core/urb.c:504 usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 Modules linked in: CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.4.0-rc5-syzkaller-00016-ga4d7d7011219 #0 Hardware name: linux,dummy-virt (DT) Workqueue: mld mld_ifc_work pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 lr : usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 sp : ffff80000a80b870 x29: ffff80000a80b870 x28: 0000000000000000 x27: f1ff000005596000 x26: 0000000000000001 x25: f2ff000006d380a8 x24: ffff800009ad45b8 x23: 0000000000000003 x22: 0000000000000003 x21: 0000000000000820 x20: f2ff000006d38000 x19: faff000005b27f00 x18: 00000000fffffffe x17: ffff800075617000 x16: ffff800008000000 x15: 0000000000000020 x14: ffff80000a3ecc78 x13: 00000000000012b4 x12: 000000000000063c x11: 202c726566782062 x10: ffff80000a49cc78 x9 : 00000000ffffe000 x8 : ffff80000a3ecc78 x7 : ffff80000a49cc78 x6 : 0000000000000000 x5 : ffff00007f9b7c88 x4 : 0000000000000000 x3 : ffff800075617000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : f5ff000003098000 Call trace: usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 usbnet_start_xmit+0x340/0x5dc drivers/net/usb/usbnet.c:1453 __netdev_start_xmit include/linux/netdevice.h:4915 [inline] netdev_start_xmit include/linux/netdevice.h:4929 [inline] xmit_one net/core/dev.c:3578 [inline] dev_hard_start_xmit+0x94/0x148 net/core/dev.c:3594 sch_direct_xmit+0x90/0x1e4 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:3805 [inline] __dev_queue_xmit+0x468/0xd40 net/core/dev.c:4210 dev_queue_xmit include/linux/netdevice.h:3085 [inline] neigh_resolve_output net/core/neighbour.c:1552 [inline] neigh_resolve_output+0xfc/0x1c8 net/core/neighbour.c:1532 neigh_output include/net/neighbour.h:544 [inline] ip6_finish_output2+0x1b0/0x7b8 net/ipv6/ip6_output.c:134 __ip6_finish_output net/ipv6/ip6_output.c:195 [inline] ip6_finish_output+0x220/0x360 net/ipv6/ip6_output.c:206 NF_HOOK_COND include/linux/netfilter.h:292 [inline] ip6_output+0x74/0x1d4 net/ipv6/ip6_output.c:227 dst_output include/net/dst.h:458 [inline] NF_HOOK.constprop.0+0x50/0xe0 include/linux/netfilter.h:303 mld_sendpack+0x280/0x4b8 net/ipv6/mcast.c:1820 mld_send_cr net/ipv6/mcast.c:2121 [inline] mld_ifc_work+0x1d0/0x4bc net/ipv6/mcast.c:2653 process_one_work+0x1c0/0x30c kernel/workqueue.c:2405 worker_thread+0x70/0x418 kernel/workqueue.c:2552 kthread+0x118/0x11c kernel/kthread.c:379 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 9 at drivers/usb/core/urb.c:504 usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 Modules linked in: CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.4.0-rc5-syzkaller-00016-ga4d7d7011219 #0 Hardware name: linux,dummy-virt (DT) Workqueue: ipv6_addrconf addrconf_dad_work pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 lr : usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 sp : ffff80000a80b800 x29: ffff80000a80b800 x28: 0000000000000000 x27: f1ff000005596000 x26: 0000000000000001 x25: f2ff000006d380a8 x24: ffff800009ad45b8 x23: 0000000000000003 x22: 0000000000000003 x21: 0000000000000820 x20: f2ff000006d38000 x19: fbff000005b27f00 x18: 00000000fffffffe x17: ffff800075617000 x16: ffff800008000000 x15: 0000000000000020 x14: ffff80000a3ecc78 x13: 0000000000001329 x12: 0000000000000663 x11: 202c726566782062 x10: ffff80000a49cc78 x9 : 00000000ffffe000 x8 : ffff80000a3ecc78 x7 : ffff80000a49cc78 x6 : 0000000000000000 x5 : ffff00007f9b7c88 x4 : 0000000000000000 x3 : ffff800075617000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : f5ff000003098000 Call trace: usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 usbnet_start_xmit+0x340/0x5dc drivers/net/usb/usbnet.c:1453 __netdev_start_xmit include/linux/netdevice.h:4915 [inline] netdev_start_xmit include/linux/netdevice.h:4929 [inline] xmit_one net/core/dev.c:3578 [inline] dev_hard_start_xmit+0x94/0x148 net/core/dev.c:3594 sch_direct_xmit+0x90/0x1e4 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:3805 [inline] __dev_queue_xmit+0x468/0xd40 net/core/dev.c:4210 dev_queue_xmit include/linux/netdevice.h:3085 [inline] neigh_resolve_output net/core/neighbour.c:1552 [inline] neigh_resolve_output+0xfc/0x1c8 net/core/neighbour.c:1532 neigh_output include/net/neighbour.h:544 [inline] ip6_finish_output2+0x1b0/0x7b8 net/ipv6/ip6_output.c:134 __ip6_finish_output net/ipv6/ip6_output.c:195 [inline] ip6_finish_output+0x220/0x360 net/ipv6/ip6_output.c:206 NF_HOOK_COND include/linux/netfilter.h:292 [inline] ip6_output+0x74/0x1d4 net/ipv6/ip6_output.c:227 dst_output include/net/dst.h:458 [inline] NF_HOOK.constprop.0+0x50/0xe0 include/linux/netfilter.h:303 ndisc_send_skb+0x2f0/0x488 net/ipv6/ndisc.c:508 ndisc_send_ns+0x64/0xb0 net/ipv6/ndisc.c:666 addrconf_dad_work+0x3d4/0x594 net/ipv6/addrconf.c:4176 process_one_work+0x1c0/0x30c kernel/workqueue.c:2405 worker_thread+0x70/0x418 kernel/workqueue.c:2552 kthread+0x118/0x11c kernel/kthread.c:379 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 9 at drivers/usb/core/urb.c:504 usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 Modules linked in: CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.4.0-rc5-syzkaller-00016-ga4d7d7011219 #0 Hardware name: linux,dummy-virt (DT) Workqueue: mld mld_ifc_work pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 lr : usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 sp : ffff80000a80b8b0 x29: ffff80000a80b8b0 x28: 0000000000000000 x27: f1ff000005596000 x26: 0000000000000001 x25: f2ff000006d380a8 x24: ffff800009ad45b8 x23: 0000000000000003 x22: 0000000000000003 x21: 0000000000000820 x20: f2ff000006d38000 x19: f4ff000005b27f00 x18: 00000000fffffffe x17: ffff800075617000 x16: ffff800008000000 x15: 0000000000000020 x14: ffff80000a3ecc78 x13: 0000000000001416 x12: 00000000000006b2 x11: 202c726566782062 x10: ffff80000a49cc78 x9 : 00000000ffffe000 x8 : ffff80000a3ecc78 x7 : ffff80000a49cc78 x6 : 0000000000000000 x5 : ffff00007f9b7c88 x4 : 0000000000000000 x3 : ffff800075617000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : f5ff000003098000 Call trace: usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 usbnet_start_xmit+0x340/0x5dc drivers/net/usb/usbnet.c:1453 __netdev_start_xmit include/linux/netdevice.h:4915 [inline] netdev_start_xmit include/linux/netdevice.h:4929 [inline] xmit_one net/core/dev.c:3578 [inline] dev_hard_start_xmit+0x94/0x148 net/core/dev.c:3594 sch_direct_xmit+0x90/0x1e4 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:3805 [inline] __dev_queue_xmit+0x468/0xd40 net/core/dev.c:4210 dev_queue_xmit include/linux/netdevice.h:3085 [inline] neigh_hh_output include/net/neighbour.h:528 [inline] neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x268/0x7b8 net/ipv6/ip6_output.c:134 __ip6_finish_output net/ipv6/ip6_output.c:195 [inline] ip6_finish_output+0x220/0x360 net/ipv6/ip6_output.c:206 NF_HOOK_COND include/linux/netfilter.h:292 [inline] ip6_output+0x74/0x1d4 net/ipv6/ip6_output.c:227 dst_output include/net/dst.h:458 [inline] NF_HOOK.constprop.0+0x50/0xe0 include/linux/netfilter.h:303 mld_sendpack+0x280/0x4b8 net/ipv6/mcast.c:1820 mld_send_cr net/ipv6/mcast.c:2121 [inline] mld_ifc_work+0x1d0/0x4bc net/ipv6/mcast.c:2653 process_one_work+0x1c0/0x30c kernel/workqueue.c:2405 worker_thread+0x70/0x418 kernel/workqueue.c:2552 kthread+0x118/0x11c kernel/kthread.c:379 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 9 at drivers/usb/core/urb.c:504 usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 Modules linked in: CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.4.0-rc5-syzkaller-00016-ga4d7d7011219 #0 Hardware name: linux,dummy-virt (DT) Workqueue: ipv6_addrconf addrconf_dad_work pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 lr : usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 sp : ffff80000a80b800 x29: ffff80000a80b800 x28: 0000000000000000 x27: f1ff000005596000 x26: 0000000000000001 x25: f2ff000006d380a8 x24: ffff800009ad45b8 x23: 0000000000000003 x22: 0000000000000003 x21: 0000000000000820 x20: f2ff000006d38000 x19: f2ff000005b27f00 x18: 00000000fffffffe x17: ffff800075617000 x16: ffff800008000000 x15: 0000000000000020 x14: ffff80000a3ecc78 x13: 0000000000001500 x12: 0000000000000700 x11: 202c726566782062 x10: ffff80000a49cc78 x9 : 00000000ffffe000 x8 : ffff80000a3ecc78 x7 : ffff80000a49cc78 x6 : 0000000000000000 x5 : 0000000000017ff4 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : f5ff000003098000 Call trace: usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 usbnet_start_xmit+0x340/0x5dc drivers/net/usb/usbnet.c:1453 __netdev_start_xmit include/linux/netdevice.h:4915 [inline] netdev_start_xmit include/linux/netdevice.h:4929 [inline] xmit_one net/core/dev.c:3578 [inline] dev_hard_start_xmit+0x94/0x148 net/core/dev.c:3594 sch_direct_xmit+0x90/0x1e4 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:3805 [inline] __dev_queue_xmit+0x468/0xd40 net/core/dev.c:4210 dev_queue_xmit include/linux/netdevice.h:3085 [inline] neigh_hh_output include/net/neighbour.h:528 [inline] neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x268/0x7b8 net/ipv6/ip6_output.c:134 __ip6_finish_output net/ipv6/ip6_output.c:195 [inline] ip6_finish_output+0x220/0x360 net/ipv6/ip6_output.c:206 NF_HOOK_COND include/linux/netfilter.h:292 [inline] ip6_output+0x74/0x1d4 net/ipv6/ip6_output.c:227 dst_output include/net/dst.h:458 [inline] NF_HOOK.constprop.0+0x50/0xe0 include/linux/netfilter.h:303 mld_sendpack+0x280/0x4b8 net/ipv6/mcast.c:1820 mld_send_initial_cr.part.0.isra.0+0x5c/0x70 net/ipv6/mcast.c:2239 mld_send_initial_cr net/ipv6/mcast.c:1232 [inline] ipv6_mc_dad_complete+0x78/0x17c net/ipv6/mcast.c:2247 addrconf_dad_completed+0x31c/0x3a8 net/ipv6/addrconf.c:4234 addrconf_dad_work+0x254/0x594 net/ipv6/addrconf.c:4162 process_one_work+0x1c0/0x30c kernel/workqueue.c:2405 worker_thread+0x70/0x418 kernel/workqueue.c:2552 kthread+0x118/0x11c kernel/kthread.c:379 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 9 at drivers/usb/core/urb.c:504 usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 Modules linked in: CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.4.0-rc5-syzkaller-00016-ga4d7d7011219 #0 Hardware name: linux,dummy-virt (DT) Workqueue: mld mld_dad_work pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 lr : usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 sp : ffff80000a80b8d0 x29: ffff80000a80b8d0 x28: 0000000000000000 x27: f1ff000005596000 x26: 0000000000000001 x25: f2ff000006d380a8 x24: ffff800009ad45b8 x23: 0000000000000003 x22: 0000000000000003 x21: 0000000000000820 x20: f2ff000006d38000 x19: f1ff000005b27f00 x18: 00000000fffffffe x17: ffff800075617000 x16: ffff800008000000 x15: 0000000000000020 x14: ffff80000a3ecc78 x13: 0000000000001668 x12: 0000000000000778 x11: 202c726566782062 x10: ffff80000a49cc78 x9 : 00000000ffffe000 x8 : ffff80000a3ecc78 x7 : ffff80000a49cc78 x6 : 0000000000000000 x5 : 0000000000017ff4 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : f5ff000003098000 Call trace: usb_submit_urb+0x3ec/0x5c8 drivers/usb/core/urb.c:504 usbnet_start_xmit+0x340/0x5dc drivers/net/usb/usbnet.c:1453 __netdev_start_xmit include/linux/netdevice.h:4915 [inline] netdev_start_xmit include/linux/netdevice.h:4929 [inline] xmit_one net/core/dev.c:3578 [inline] dev_hard_start_xmit+0x94/0x148 net/core/dev.c:3594 sch_direct_xmit+0x90/0x1e4 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:3805 [inline] __dev_queue_xmit+0x468/0xd40 net/core/dev.c:4210 dev_queue_xmit include/linux/netdevice.h:3085 [inline] neigh_hh_output include/net/neighbour.h:528 [inline] neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x268/0x7b8 net/ipv6/ip6_output.c:134 __ip6_finish_output net/ipv6/ip6_output.c:195 [inline] ip6_finish_output+0x220/0x360 net/ipv6/ip6_output.c:206 NF_HOOK_COND include/linux/netfilter.h:292 [inline] ip6_output+0x74/0x1d4 net/ipv6/ip6_output.c:227 dst_output include/net/dst.h:458 [inline] NF_HOOK.constprop.0+0x50/0xe0 include/linux/netfilter.h:303 mld_sendpack+0x280/0x4b8 net/ipv6/mcast.c:1820 mld_send_initial_cr.part.0.isra.0+0x5c/0x70 net/ipv6/mcast.c:2239 mld_send_initial_cr net/ipv6/mcast.c:1232 [inline] mld_dad_work+0x60/0x20c net/ipv6/mcast.c:2262 process_one_work+0x1c0/0x30c kernel/workqueue.c:2405 worker_thread+0x70/0x418 kernel/workqueue.c:2552 kthread+0x118/0x11c kernel/kthread.c:379 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 ---[ end trace 0000000000000000 ]---