------------[ cut here ]------------
usb 1-1: BOGUS urb xfer, pipe 1 != type 3
WARNING: CPU: 0 PID: 3344 at drivers/usb/core/urb.c:503 usb_submit_urb+0xce2/0x1920 drivers/usb/core/urb.c:502
Modules linked in:
CPU: 0 PID: 3344 Comm: kworker/0:4 Not tainted 6.0.0-syzkaller-09589-g55be6084c8e0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_submit_urb+0xce2/0x1920 drivers/usb/core/urb.c:502
Code: 48 c1 e8 03 8a 04 18 84 c0 0f 85 d4 08 00 00 45 8b 06 48 c7 c7 e0 e3 54 8b 48 8b 74 24 20 4c 89 fa 89 e9 31 c0 e8 fe d7 39 fb <0f> 0b 4c 8b 74 24 30 44 89 e5 48 89 ef 48 c7 c6 b0 e6 77 8d e8 65
RSP: 0018:ffffc900039ee7c0 EFLAGS: 00010246
RAX: 2e8d751be2f5ff00 RBX: dffffc0000000000 RCX: ffff888024278000
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 0000000000000001 R08: ffffffff816c0f4d R09: ffffed10173467f1
R10: ffffed10173467f1 R11: 1ffff110173467f0 R12: 0000000000000002
R13: ffff888012f8a100 R14: ffffffff8b54e1c8 R15: ffff888023a229d8
FS:  0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fcb717f4130 CR3: 0000000027044000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 carl9170_usb_submit_cmd_urb+0x8d/0x100 drivers/net/wireless/ath/carl9170/usb.c:229
 carl9170_usb_disconnect+0x8b/0x160 drivers/net/wireless/ath/carl9170/usb.c:1116
 usb_unbind_interface+0x1f2/0x860 drivers/usb/core/driver.c:458
 device_remove drivers/base/dd.c:550 [inline]
 __device_release_driver drivers/base/dd.c:1249 [inline]
 device_release_driver_internal+0x5bc/0x8a0 drivers/base/dd.c:1275
 usb_driver_release_interface drivers/usb/core/driver.c:627 [inline]
 usb_forced_unbind_intf+0x14d/0x220 drivers/usb/core/driver.c:1118
 usb_reset_device+0x4ca/0xb40 drivers/usb/core/hub.c:6113
 carl9170_usb_probe+0x4c/0xc00 drivers/net/wireless/ath/carl9170/usb.c:1044
 usb_probe_interface+0x66e/0xb60 drivers/usb/core/driver.c:396
 call_driver_probe+0x96/0x250
 really_probe+0x24c/0x9f0 drivers/base/dd.c:639
 __driver_probe_device+0x1f4/0x3f0 drivers/base/dd.c:778
 driver_probe_device+0x50/0x240 drivers/base/dd.c:808
 __device_attach_driver+0x272/0x3c0 drivers/base/dd.c:936
 bus_for_each_drv+0x18a/0x210 drivers/base/bus.c:427
 __device_attach+0x372/0x5a0 drivers/base/dd.c:1008
 bus_probe_device+0xb8/0x1f0 drivers/base/bus.c:487
 device_add+0xb20/0xf90 drivers/base/core.c:3517
 usb_set_configuration+0x1a5f/0x20e0 drivers/usb/core/message.c:2170
 usb_generic_driver_probe+0x83/0x140 drivers/usb/core/generic.c:238
 usb_probe_device+0x131/0x260 drivers/usb/core/driver.c:293
 call_driver_probe+0x96/0x250
 really_probe+0x24c/0x9f0 drivers/base/dd.c:639
 __driver_probe_device+0x1f4/0x3f0 drivers/base/dd.c:778
 driver_probe_device+0x50/0x240 drivers/base/dd.c:808
 __device_attach_driver+0x272/0x3c0 drivers/base/dd.c:936
 bus_for_each_drv+0x18a/0x210 drivers/base/bus.c:427
 __device_attach+0x372/0x5a0 drivers/base/dd.c:1008
 bus_probe_device+0xb8/0x1f0 drivers/base/bus.c:487
 device_add+0xb20/0xf90 drivers/base/core.c:3517
 usb_new_device+0xbc2/0x18b0 drivers/usb/core/hub.c:2573
 hub_port_connect+0x105b/0x2930 drivers/usb/core/hub.c:5353
 hub_port_connect_change+0x619/0xbe0 drivers/usb/core/hub.c:5497
 port_event+0xec6/0x13b0 drivers/usb/core/hub.c:5653
 hub_event+0x5c1/0xd80 drivers/usb/core/hub.c:5735
 process_one_work+0x81c/0xd10 kernel/workqueue.c:2289
 worker_thread+0xb14/0x1330 kernel/workqueue.c:2436
 kthread+0x266/0x300 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
 </TASK>