usb 5-1: Product: syz
usb 5-1: Manufacturer: syz
usb 5-1: SerialNumber: syz
------------[ cut here ]------------
usb 5-1: BOGUS urb xfer, pipe 1 != type 3
WARNING: CPU: 0 PID: 6099 at drivers/usb/core/urb.c:503 usb_submit_urb+0xe4a/0x1790 drivers/usb/core/urb.c:503
Modules linked in:
CPU: 0 UID: 0 PID: 6099 Comm: kworker/0:4 Not tainted 6.16.0-rc4-syzkaller-ga79a588fc176 #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_submit_urb+0xe4a/0x1790 drivers/usb/core/urb.c:503
Code: 84 67 02 00 00 e8 e6 49 86 fa 4c 89 ef e8 ce ae d5 fe 45 89 e0 89 e9 4c 89 f2 48 89 c6 48 c7 c7 20 2c 73 8c e8 27 0a 45 fa 90 <0f> 0b 90 90 e9 ea f8 ff ff e8 b8 49 86 fa 49 81 c4 c8 05 00 00 e9
RSP: 0018:ffffc90003d5edf0 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff88810640df00 RCX: ffffffff817ae278
RDX: ffff888025990000 RSI: ffffffff817ae285 RDI: 0000000000000001
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000003
R13: ffff888025f7e0b0 R14: ffff8880533cd400 R15: 0000000040010200
FS:  0000000000000000(0000) GS:ffff8880d6715000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007eff8d5b2000 CR3: 0000000053946000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 usb_start_wait_urb+0x104/0x4b0 drivers/usb/core/message.c:59
 usb_bulk_msg+0x22b/0x550 drivers/usb/core/message.c:388
 amradio_send_cmd+0x2df/0x930 drivers/media/radio/radio-mr800.c:150
 amradio_set_mute drivers/media/radio/radio-mr800.c:182 [inline]
 usb_amradio_init drivers/media/radio/radio-mr800.c:411 [inline]
 usb_amradio_probe+0x4a3/0x8a0 drivers/media/radio/radio-mr800.c:554
 usb_probe_interface+0x303/0x9c0 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:579 [inline]
 really_probe+0x23e/0xa90 drivers/base/dd.c:657
 __driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
 __device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
 bus_for_each_drv+0x156/0x1e0 drivers/base/bus.c:462
 __device_attach+0x1e4/0x4b0 drivers/base/dd.c:1029
 bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
 device_add+0x1148/0x1a70 drivers/base/core.c:3692
 usb_set_configuration+0x1187/0x1e20 drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0xb1/0x110 drivers/usb/core/generic.c:250
 usb_probe_device+0xef/0x3e0 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:579 [inline]
 really_probe+0x23e/0xa90 drivers/base/dd.c:657
 __driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
 __device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
 bus_for_each_drv+0x156/0x1e0 drivers/base/bus.c:462
 __device_attach+0x1e4/0x4b0 drivers/base/dd.c:1029
 bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
 device_add+0x1148/0x1a70 drivers/base/core.c:3692
 usb_new_device+0xd07/0x1a20 drivers/usb/core/hub.c:2694
 hub_port_connect drivers/usb/core/hub.c:5566 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5706 [inline]
 port_event drivers/usb/core/hub.c:5866 [inline]
 hub_event+0x2eb7/0x4fa0 drivers/usb/core/hub.c:5948
 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3321 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
 kthread+0x3c2/0x780 kernel/kthread.c:464
 ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>