usb 1-1: Product: syz usb 1-1: Manufacturer: syz usb 1-1: SerialNumber: syz ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 1 PID: 3555 at drivers/usb/core/urb.c:503 usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 Modules linked in: CPU: 1 PID: 3555 Comm: kworker/1:3 Not tainted 5.15.160-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: usb_hub_wq hub_event pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 lr : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 sp : ffff80001eef69a0 x29: ffff80001eef69e0 x28: 0000000000000003 x27: ffff800012b85fcc x26: ffff0000c15ad800 x25: ffff0000cd8b3000 x24: 0000000000000400 x23: ffff800012b8c7e0 x22: dfff800000000000 x21: 0000000000000003 x20: 0000000000000a20 x19: ffff0000c2066e00 x18: 0000000000000001 x17: 0000000000000000 x16: ffff8000119a179c x15: 00000000ffffffff x14: ffff0000d40eb680 x13: 0000000000000001 x12: 0000000000000001 x11: 0000000000000000 x10: 0000000000000000 x9 : 158edb6d0e534900 x8 : 158edb6d0e534900 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff80001eef6118 x4 : ffff800014a3f7a0 x3 : ffff8000085501f8 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000029 Call trace: usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 ar5523_submit_rx_cmd+0x170/0x28c drivers/net/wireless/ath/ar5523/ar5523.c:212 ar5523_probe+0x93c/0x1b40 drivers/net/wireless/ath/ar5523/ar5523.c:1653 usb_probe_interface+0x500/0x984 drivers/usb/core/driver.c:396 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_set_configuration+0x15e0/0x1b60 drivers/usb/core/message.c:2165 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:238 usb_probe_device+0x120/0x25c drivers/usb/core/driver.c:293 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_new_device+0x900/0x145c drivers/usb/core/hub.c:2593 hub_port_connect drivers/usb/core/hub.c:5455 [inline] hub_port_connect_change drivers/usb/core/hub.c:5595 [inline] port_event drivers/usb/core/hub.c:5741 [inline] hub_event+0x236c/0x46b8 drivers/usb/core/hub.c:5823 process_one_work+0x790/0x11b8 kernel/workqueue.c:2310 worker_thread+0x910/0x1034 kernel/workqueue.c:2457 kthread+0x37c/0x45c kernel/kthread.c:334 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 irq event stamp: 55014 hardirqs last enabled at (55013): [] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:257 hardirqs last disabled at (55014): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:396 softirqs last enabled at (53308): [] softirq_handle_end kernel/softirq.c:401 [inline] softirqs last enabled at (53308): [] __do_softirq+0xb5c/0xdb0 kernel/softirq.c:587 softirqs last disabled at (53277): [] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline] softirqs last disabled at (53277): [] invoke_softirq kernel/softirq.c:439 [inline] softirqs last disabled at (53277): [] __irq_exit_rcu+0x264/0x4d4 kernel/softirq.c:637 ---[ end trace 68741385d53f816b ]--- usb 1-1: error -22 when submitting rx urb usb 1-1: Failed to submit rx cmd ar5523: probe of 1-1:64.245 failed with error -22 ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 1 PID: 3555 at drivers/usb/core/urb.c:503 usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 Modules linked in: CPU: 1 PID: 3555 Comm: kworker/1:3 Tainted: G W 5.15.160-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: usb_hub_wq hub_event pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 lr : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 sp : ffff80001eef69a0 x29: ffff80001eef69e0 x28: 0000000000000003 x27: ffff800012b85fcc x26: ffff0000c15ad800 x25: ffff0000cd8b3000 x24: 0000000000000400 x23: ffff800012b8c7e0 x22: dfff800000000000 x21: 0000000000000003 x20: 0000000000000a20 x19: ffff0000cd79a000 x18: 1fffe0003690118e x17: 1fffe0003690118e x16: ffff8000119a179c x15: ffff8000149fec00 x14: 1ffff0000292c06a x13: dfff800000000000 x12: 0000000000000001 x11: 0000000000000000 x10: 0000000000000000 x9 : 158edb6d0e534900 x8 : 158edb6d0e534900 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000080 x4 : 0000000000000000 x3 : ffff8000085501f8 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000029 Call trace: usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 ar5523_submit_rx_cmd+0x170/0x28c drivers/net/wireless/ath/ar5523/ar5523.c:212 ar5523_probe+0x93c/0x1b40 drivers/net/wireless/ath/ar5523/ar5523.c:1653 usb_probe_interface+0x500/0x984 drivers/usb/core/driver.c:396 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_set_configuration+0x15e0/0x1b60 drivers/usb/core/message.c:2165 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:238 usb_probe_device+0x120/0x25c drivers/usb/core/driver.c:293 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_new_device+0x900/0x145c drivers/usb/core/hub.c:2593 hub_port_connect drivers/usb/core/hub.c:5455 [inline] hub_port_connect_change drivers/usb/core/hub.c:5595 [inline] port_event drivers/usb/core/hub.c:5741 [inline] hub_event+0x236c/0x46b8 drivers/usb/core/hub.c:5823 process_one_work+0x790/0x11b8 kernel/workqueue.c:2310 worker_thread+0x910/0x1034 kernel/workqueue.c:2457 kthread+0x37c/0x45c kernel/kthread.c:334 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 irq event stamp: 56544 hardirqs last enabled at (56543): [] raw_spin_rq_unlock_irq kernel/sched/sched.h:1338 [inline] hardirqs last enabled at (56543): [] finish_lock_switch+0xbc/0x1e8 kernel/sched/core.c:4784 hardirqs last disabled at (56544): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:396 softirqs last enabled at (55102): [] softirq_handle_end kernel/softirq.c:401 [inline] softirqs last enabled at (55102): [] __do_softirq+0xb5c/0xdb0 kernel/softirq.c:587 softirqs last disabled at (55017): [] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline] softirqs last disabled at (55017): [] invoke_softirq kernel/softirq.c:439 [inline] softirqs last disabled at (55017): [] __irq_exit_rcu+0x264/0x4d4 kernel/softirq.c:637 ---[ end trace 68741385d53f816c ]--- usb 1-1: error -22 when submitting rx urb usb 1-1: Failed to submit rx cmd ar5523: probe of 1-1:64.155 failed with error -22 ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 1 PID: 3555 at drivers/usb/core/urb.c:503 usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 Modules linked in: CPU: 1 PID: 3555 Comm: kworker/1:3 Tainted: G W 5.15.160-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: usb_hub_wq hub_event pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 lr : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 sp : ffff80001eef69a0 x29: ffff80001eef69e0 x28: 0000000000000003 x27: ffff800012b85fcc x26: ffff0000c15ad800 x25: ffff0000cd8b3000 x24: 0000000000000400 x23: ffff800012b8c7e0 x22: dfff800000000000 x21: 0000000000000003 x20: 0000000000000a20 x19: ffff0000cdbdba00 x18: 0000000000000001 x17: 0000000000000000 x16: ffff8000119a179c x15: 00000000ffffffff x14: ffff0000d40eb680 x13: 0000000000000001 x12: 0000000000000001 x11: 0000000000000000 x10: 0000000000000000 x9 : 158edb6d0e534900 x8 : 158edb6d0e534900 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff80001eef6118 x4 : ffff800014a3f7a0 x3 : ffff8000085501f8 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000029 Call trace: usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 ar5523_submit_rx_cmd+0x170/0x28c drivers/net/wireless/ath/ar5523/ar5523.c:212 ar5523_probe+0x93c/0x1b40 drivers/net/wireless/ath/ar5523/ar5523.c:1653 usb_probe_interface+0x500/0x984 drivers/usb/core/driver.c:396 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_set_configuration+0x15e0/0x1b60 drivers/usb/core/message.c:2165 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:238 usb_probe_device+0x120/0x25c drivers/usb/core/driver.c:293 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_new_device+0x900/0x145c drivers/usb/core/hub.c:2593 hub_port_connect drivers/usb/core/hub.c:5455 [inline] hub_port_connect_change drivers/usb/core/hub.c:5595 [inline] port_event drivers/usb/core/hub.c:5741 [inline] hub_event+0x236c/0x46b8 drivers/usb/core/hub.c:5823 process_one_work+0x790/0x11b8 kernel/workqueue.c:2310 worker_thread+0x910/0x1034 kernel/workqueue.c:2457 kthread+0x37c/0x45c kernel/kthread.c:334 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 irq event stamp: 58116 hardirqs last enabled at (58115): [] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:257 hardirqs last disabled at (58116): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:396 softirqs last enabled at (56654): [] softirq_handle_end kernel/softirq.c:401 [inline] softirqs last enabled at (56654): [] __do_softirq+0xb5c/0xdb0 kernel/softirq.c:587 softirqs last disabled at (56647): [] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline] softirqs last disabled at (56647): [] invoke_softirq kernel/softirq.c:439 [inline] softirqs last disabled at (56647): [] __irq_exit_rcu+0x264/0x4d4 kernel/softirq.c:637 ---[ end trace 68741385d53f816d ]--- usb 1-1: error -22 when submitting rx urb usb 1-1: Failed to submit rx cmd ar5523: probe of 1-1:64.243 failed with error -22 usb 1-1: USB disconnect, device number 2 usb 1-1: new high-speed USB device number 3 using dummy_hcd usb 1-1: Using ep0 maxpacket: 32 usb 1-1: config 64 has an invalid interface number: 245 but max is 2 usb 1-1: config 64 has an invalid interface number: 155 but max is 2 usb 1-1: config 64 contains an unexpected descriptor of type 0x2, skipping usb 1-1: config 64 contains an unexpected descriptor of type 0x1, skipping usb 1-1: config 64 has an invalid interface number: 243 but max is 2 usb 1-1: config 64 has no interface number 0 usb 1-1: config 64 has no interface number 1 usb 1-1: config 64 has no interface number 2 usb 1-1: config 64 interface 245 altsetting 7 endpoint 0x8 has invalid maxpacket 1024, setting to 64 usb 1-1: config 64 interface 245 altsetting 7 endpoint 0x3 has invalid maxpacket 1023, setting to 64 usb 1-1: config 64 interface 245 altsetting 7 has an invalid endpoint descriptor of length 2, skipping usb 1-1: config 64 interface 245 altsetting 7 has 5 endpoint descriptors, different from the interface descriptor's value: 4 usb 1-1: config 64 interface 155 altsetting 1 endpoint 0x9 has invalid maxpacket 512, setting to 64 usb 1-1: config 64 interface 155 altsetting 1 has an invalid endpoint with address 0x0, skipping usb 1-1: config 64 interface 155 altsetting 1 has an invalid endpoint with address 0x0, skipping usb 1-1: config 64 interface 155 altsetting 1 endpoint 0xA has invalid maxpacket 72, setting to 64 usb 1-1: config 64 interface 155 altsetting 1 endpoint 0x81 has an invalid bInterval 139, changing to 11 usb 1-1: config 64 interface 155 altsetting 1 endpoint 0x81 has invalid maxpacket 18251, setting to 1024 usb 1-1: config 64 interface 155 altsetting 1 has a duplicate endpoint with address 0xA, skipping usb 1-1: config 64 interface 155 altsetting 1 has an invalid endpoint with address 0x0, skipping usb 1-1: config 64 interface 155 altsetting 1 has 9 endpoint descriptors, different from the interface descriptor's value: 8 usb 1-1: config 64 interface 243 altsetting 31 endpoint 0xF has invalid maxpacket 512, setting to 64 usb 1-1: config 64 interface 245 has no altsetting 0 usb 1-1: config 64 interface 155 has no altsetting 0 usb 1-1: config 64 interface 243 has no altsetting 0 usb 1-1: New USB device found, idVendor=083a, idProduct=4506, bcdDevice=6d.7d usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: syz usb 1-1: Manufacturer: syz usb 1-1: SerialNumber: syz ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 1 PID: 3555 at drivers/usb/core/urb.c:503 usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 Modules linked in: CPU: 1 PID: 3555 Comm: kworker/1:3 Tainted: G W 5.15.160-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: usb_hub_wq hub_event pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 lr : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 sp : ffff80001eef69a0 x29: ffff80001eef69e0 x28: 0000000000000003 x27: ffff800012b85fcc x26: ffff0000c5cdf900 x25: ffff0000cdc19000 x24: 0000000000000400 x23: ffff800012b8c7e0 x22: dfff800000000000 x21: 0000000000000003 x20: 0000000000000a20 x19: ffff0000c0b37800 x18: 0000000000000001 x17: 0000000000000000 x16: ffff8000119a179c x15: 00000000ffffffff x14: ffff0000d40eb680 x13: 0000000000000001 x12: 0000000000000001 x11: 0000000000000000 x10: 0000000000000000 x9 : 158edb6d0e534900 x8 : 158edb6d0e534900 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff80001eef6118 x4 : ffff800014a3f7a0 x3 : ffff8000085501f8 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000029 Call trace: usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 ar5523_submit_rx_cmd+0x170/0x28c drivers/net/wireless/ath/ar5523/ar5523.c:212 ar5523_probe+0x93c/0x1b40 drivers/net/wireless/ath/ar5523/ar5523.c:1653 usb_probe_interface+0x500/0x984 drivers/usb/core/driver.c:396 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_set_configuration+0x15e0/0x1b60 drivers/usb/core/message.c:2165 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:238 usb_probe_device+0x120/0x25c drivers/usb/core/driver.c:293 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_new_device+0x900/0x145c drivers/usb/core/hub.c:2593 hub_port_connect drivers/usb/core/hub.c:5455 [inline] hub_port_connect_change drivers/usb/core/hub.c:5595 [inline] port_event drivers/usb/core/hub.c:5741 [inline] hub_event+0x236c/0x46b8 drivers/usb/core/hub.c:5823 process_one_work+0x790/0x11b8 kernel/workqueue.c:2310 process_scheduled_works kernel/workqueue.c:2373 [inline] worker_thread+0xb88/0x1034 kernel/workqueue.c:2459 kthread+0x37c/0x45c kernel/kthread.c:334 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 irq event stamp: 65294 hardirqs last enabled at (65293): [] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:257 hardirqs last disabled at (65294): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:396 softirqs last enabled at (63304): [] softirq_handle_end kernel/softirq.c:401 [inline] softirqs last enabled at (63304): [] __do_softirq+0xb5c/0xdb0 kernel/softirq.c:587 softirqs last disabled at (63295): [] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline] softirqs last disabled at (63295): [] invoke_softirq kernel/softirq.c:439 [inline] softirqs last disabled at (63295): [] __irq_exit_rcu+0x264/0x4d4 kernel/softirq.c:637 ---[ end trace 68741385d53f816e ]--- usb 1-1: error -22 when submitting rx urb usb 1-1: Failed to submit rx cmd ar5523: probe of 1-1:64.245 failed with error -22 ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 1 PID: 3555 at drivers/usb/core/urb.c:503 usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 Modules linked in: CPU: 1 PID: 3555 Comm: kworker/1:3 Tainted: G W 5.15.160-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: usb_hub_wq hub_event pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 lr : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 sp : ffff80001eef69a0 x29: ffff80001eef69e0 x28: 0000000000000003 x27: ffff800012b85fcc x26: ffff0000c5cdf900 x25: ffff0000cdc19000 x24: 0000000000000400 x23: ffff800012b8c7e0 x22: dfff800000000000 x21: 0000000000000003 x20: 0000000000000a20 x19: ffff0000c2032200 x18: 1fffe0003690118e x17: 1fffe0003690118e x16: ffff8000119a179c x15: ffff8000149fec00 x14: 1ffff0000292c06a x13: dfff800000000000 x12: 0000000000000001 x11: 0000000000000000 x10: 0000000000000000 x9 : 158edb6d0e534900 x8 : 158edb6d0e534900 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000080 x4 : 0000000000000000 x3 : ffff8000085501f8 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000029 Call trace: usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 ar5523_submit_rx_cmd+0x170/0x28c drivers/net/wireless/ath/ar5523/ar5523.c:212 ar5523_probe+0x93c/0x1b40 drivers/net/wireless/ath/ar5523/ar5523.c:1653 usb_probe_interface+0x500/0x984 drivers/usb/core/driver.c:396 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_set_configuration+0x15e0/0x1b60 drivers/usb/core/message.c:2165 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:238 usb_probe_device+0x120/0x25c drivers/usb/core/driver.c:293 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_new_device+0x900/0x145c drivers/usb/core/hub.c:2593 hub_port_connect drivers/usb/core/hub.c:5455 [inline] hub_port_connect_change drivers/usb/core/hub.c:5595 [inline] port_event drivers/usb/core/hub.c:5741 [inline] hub_event+0x236c/0x46b8 drivers/usb/core/hub.c:5823 process_one_work+0x790/0x11b8 kernel/workqueue.c:2310 process_scheduled_works kernel/workqueue.c:2373 [inline] worker_thread+0xb88/0x1034 kernel/workqueue.c:2459 kthread+0x37c/0x45c kernel/kthread.c:334 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 irq event stamp: 68130 hardirqs last enabled at (68129): [] raw_spin_rq_unlock_irq kernel/sched/sched.h:1338 [inline] hardirqs last enabled at (68129): [] finish_lock_switch+0xbc/0x1e8 kernel/sched/core.c:4784 hardirqs last disabled at (68130): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:396 softirqs last enabled at (65462): [] softirq_handle_end kernel/softirq.c:401 [inline] softirqs last enabled at (65462): [] __do_softirq+0xb5c/0xdb0 kernel/softirq.c:587 softirqs last disabled at (65297): [] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline] softirqs last disabled at (65297): [] invoke_softirq kernel/softirq.c:439 [inline] softirqs last disabled at (65297): [] __irq_exit_rcu+0x264/0x4d4 kernel/softirq.c:637 ---[ end trace 68741385d53f816f ]--- usb 1-1: error -22 when submitting rx urb usb 1-1: Failed to submit rx cmd ar5523: probe of 1-1:64.155 failed with error -22 ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 1 PID: 3555 at drivers/usb/core/urb.c:503 usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 Modules linked in: CPU: 1 PID: 3555 Comm: kworker/1:3 Tainted: G W 5.15.160-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: usb_hub_wq hub_event pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 lr : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 sp : ffff80001eef69a0 x29: ffff80001eef69e0 x28: 0000000000000003 x27: ffff800012b85fcc x26: ffff0000c5cdf900 x25: ffff0000cdc19000 x24: 0000000000000400 x23: ffff800012b8c7e0 x22: dfff800000000000 x21: 0000000000000003 x20: 0000000000000a20 x19: ffff0000cdbd1400 x18: 0000000000000001 x17: 0000000000000000 x16: ffff8000119a179c x15: 00000000ffffffff x14: ffff0000d40eb680 x13: 0000000000000001 x12: 0000000000000001 x11: 0000000000000000 x10: 0000000000000000 x9 : 158edb6d0e534900 x8 : 158edb6d0e534900 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff80001eef6118 x4 : ffff800014a3f7a0 x3 : ffff8000085501f8 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000029 Call trace: usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 ar5523_submit_rx_cmd+0x170/0x28c drivers/net/wireless/ath/ar5523/ar5523.c:212 ar5523_probe+0x93c/0x1b40 drivers/net/wireless/ath/ar5523/ar5523.c:1653 usb_probe_interface+0x500/0x984 drivers/usb/core/driver.c:396 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_set_configuration+0x15e0/0x1b60 drivers/usb/core/message.c:2165 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:238 usb_probe_device+0x120/0x25c drivers/usb/core/driver.c:293 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_new_device+0x900/0x145c drivers/usb/core/hub.c:2593 hub_port_connect drivers/usb/core/hub.c:5455 [inline] hub_port_connect_change drivers/usb/core/hub.c:5595 [inline] port_event drivers/usb/core/hub.c:5741 [inline] hub_event+0x236c/0x46b8 drivers/usb/core/hub.c:5823 process_one_work+0x790/0x11b8 kernel/workqueue.c:2310 process_scheduled_works kernel/workqueue.c:2373 [inline] worker_thread+0xb88/0x1034 kernel/workqueue.c:2459 kthread+0x37c/0x45c kernel/kthread.c:334 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 irq event stamp: 69698 hardirqs last enabled at (69697): [] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:257 hardirqs last disabled at (69698): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:396 softirqs last enabled at (69114): [] softirq_handle_end kernel/softirq.c:401 [inline] softirqs last enabled at (69114): [] __do_softirq+0xb5c/0xdb0 kernel/softirq.c:587 softirqs last disabled at (69103): [] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline] softirqs last disabled at (69103): [] invoke_softirq kernel/softirq.c:439 [inline] softirqs last disabled at (69103): [] __irq_exit_rcu+0x264/0x4d4 kernel/softirq.c:637 ---[ end trace 68741385d53f8170 ]--- usb 1-1: error -22 when submitting rx urb usb 1-1: Failed to submit rx cmd ar5523: probe of 1-1:64.243 failed with error -22 usb 1-1: USB disconnect, device number 3 usb 1-1: new high-speed USB device number 4 using dummy_hcd usb 1-1: Using ep0 maxpacket: 32 usb 1-1: config 64 has an invalid interface number: 245 but max is 2 usb 1-1: config 64 has an invalid interface number: 155 but max is 2 usb 1-1: config 64 contains an unexpected descriptor of type 0x2, skipping usb 1-1: config 64 contains an unexpected descriptor of type 0x1, skipping usb 1-1: config 64 has an invalid interface number: 243 but max is 2 usb 1-1: config 64 has no interface number 0 usb 1-1: config 64 has no interface number 1 usb 1-1: config 64 has no interface number 2 usb 1-1: config 64 interface 245 altsetting 7 endpoint 0x8 has invalid maxpacket 1024, setting to 64 usb 1-1: config 64 interface 245 altsetting 7 endpoint 0x3 has invalid maxpacket 1023, setting to 64 usb 1-1: config 64 interface 245 altsetting 7 has an invalid endpoint descriptor of length 2, skipping usb 1-1: config 64 interface 245 altsetting 7 has 5 endpoint descriptors, different from the interface descriptor's value: 4 usb 1-1: config 64 interface 155 altsetting 1 endpoint 0x9 has invalid maxpacket 512, setting to 64 usb 1-1: config 64 interface 155 altsetting 1 has an invalid endpoint with address 0x0, skipping usb 1-1: config 64 interface 155 altsetting 1 has an invalid endpoint with address 0x0, skipping usb 1-1: config 64 interface 155 altsetting 1 endpoint 0xA has invalid maxpacket 72, setting to 64 usb 1-1: config 64 interface 155 altsetting 1 endpoint 0x81 has an invalid bInterval 139, changing to 11 usb 1-1: config 64 interface 155 altsetting 1 endpoint 0x81 has invalid maxpacket 18251, setting to 1024 usb 1-1: config 64 interface 155 altsetting 1 has a duplicate endpoint with address 0xA, skipping usb 1-1: config 64 interface 155 altsetting 1 has an invalid endpoint with address 0x0, skipping usb 1-1: config 64 interface 155 altsetting 1 has 9 endpoint descriptors, different from the interface descriptor's value: 8 usb 1-1: config 64 interface 243 altsetting 31 endpoint 0xF has invalid maxpacket 512, setting to 64 usb 1-1: config 64 interface 245 has no altsetting 0 usb 1-1: config 64 interface 155 has no altsetting 0 usb 1-1: config 64 interface 243 has no altsetting 0 usb 1-1: New USB device found, idVendor=083a, idProduct=4506, bcdDevice=6d.7d usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: syz usb 1-1: Manufacturer: syz usb 1-1: SerialNumber: syz ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 1 PID: 3555 at drivers/usb/core/urb.c:503 usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 Modules linked in: CPU: 1 PID: 3555 Comm: kworker/1:3 Tainted: G W 5.15.160-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: usb_hub_wq hub_event pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 lr : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 sp : ffff80001eef69a0 x29: ffff80001eef69e0 x28: 0000000000000003 x27: ffff800012b85fcc x26: ffff0000cd996600 x25: ffff0000c65f8000 x24: 0000000000000400 x23: ffff800012b8c7e0 x22: dfff800000000000 x21: 0000000000000003 x20: 0000000000000a20 x19: ffff0000c92c8800 x18: 0000000000000001 x17: 0000000000000000 x16: ffff8000119a179c x15: 00000000ffffffff x14: ffff0000d40eb680 x13: 0000000000000001 x12: 0000000000000001 x11: 0000000000000000 x10: 0000000000000000 x9 : 158edb6d0e534900 x8 : 158edb6d0e534900 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff80001eef6118 x4 : ffff800014a3f7a0 x3 : ffff8000085501f8 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000029 Call trace: usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 ar5523_submit_rx_cmd+0x170/0x28c drivers/net/wireless/ath/ar5523/ar5523.c:212 ar5523_probe+0x93c/0x1b40 drivers/net/wireless/ath/ar5523/ar5523.c:1653 usb_probe_interface+0x500/0x984 drivers/usb/core/driver.c:396 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_set_configuration+0x15e0/0x1b60 drivers/usb/core/message.c:2165 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:238 usb_probe_device+0x120/0x25c drivers/usb/core/driver.c:293 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_new_device+0x900/0x145c drivers/usb/core/hub.c:2593 hub_port_connect drivers/usb/core/hub.c:5455 [inline] hub_port_connect_change drivers/usb/core/hub.c:5595 [inline] port_event drivers/usb/core/hub.c:5741 [inline] hub_event+0x236c/0x46b8 drivers/usb/core/hub.c:5823 process_one_work+0x790/0x11b8 kernel/workqueue.c:2310 process_scheduled_works kernel/workqueue.c:2373 [inline] worker_thread+0xb88/0x1034 kernel/workqueue.c:2459 kthread+0x37c/0x45c kernel/kthread.c:334 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 irq event stamp: 75900 hardirqs last enabled at (75899): [] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:257 hardirqs last disabled at (75900): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:396 softirqs last enabled at (74832): [] softirq_handle_end kernel/softirq.c:401 [inline] softirqs last enabled at (74832): [] __do_softirq+0xb5c/0xdb0 kernel/softirq.c:587 softirqs last disabled at (74815): [] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline] softirqs last disabled at (74815): [] invoke_softirq kernel/softirq.c:439 [inline] softirqs last disabled at (74815): [] __irq_exit_rcu+0x264/0x4d4 kernel/softirq.c:637 ---[ end trace 68741385d53f8171 ]--- usb 1-1: error -22 when submitting rx urb usb 1-1: Failed to submit rx cmd ar5523: probe of 1-1:64.245 failed with error -22 ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 1 PID: 3555 at drivers/usb/core/urb.c:503 usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 Modules linked in: CPU: 1 PID: 3555 Comm: kworker/1:3 Tainted: G W 5.15.160-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: usb_hub_wq hub_event pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 lr : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 sp : ffff80001eef69a0 x29: ffff80001eef69e0 x28: 0000000000000003 x27: ffff800012b85fcc x26: ffff0000cd996600 x25: ffff0000c65f8000 x24: 0000000000000400 x23: ffff800012b8c7e0 x22: dfff800000000000 x21: 0000000000000003 x20: 0000000000000a20 x19: ffff0000c960ca00 x18: 1fffe0003690118e x17: 1fffe0003690118e x16: ffff8000119a179c x15: ffff8000149fec00 x14: 1ffff0000292c06a x13: dfff800000000000 x12: 0000000000000001 x11: 0000000000000000 x10: 0000000000000000 x9 : 158edb6d0e534900 x8 : 158edb6d0e534900 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000080 x4 : 0000000000000000 x3 : ffff8000085501f8 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000029 Call trace: usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 ar5523_submit_rx_cmd+0x170/0x28c drivers/net/wireless/ath/ar5523/ar5523.c:212 ar5523_probe+0x93c/0x1b40 drivers/net/wireless/ath/ar5523/ar5523.c:1653 usb_probe_interface+0x500/0x984 drivers/usb/core/driver.c:396 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_set_configuration+0x15e0/0x1b60 drivers/usb/core/message.c:2165 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:238 usb_probe_device+0x120/0x25c drivers/usb/core/driver.c:293 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_new_device+0x900/0x145c drivers/usb/core/hub.c:2593 hub_port_connect drivers/usb/core/hub.c:5455 [inline] hub_port_connect_change drivers/usb/core/hub.c:5595 [inline] port_event drivers/usb/core/hub.c:5741 [inline] hub_event+0x236c/0x46b8 drivers/usb/core/hub.c:5823 process_one_work+0x790/0x11b8 kernel/workqueue.c:2310 process_scheduled_works kernel/workqueue.c:2373 [inline] worker_thread+0xb88/0x1034 kernel/workqueue.c:2459 kthread+0x37c/0x45c kernel/kthread.c:334 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 irq event stamp: 77476 hardirqs last enabled at (77475): [] raw_spin_rq_unlock_irq kernel/sched/sched.h:1338 [inline] hardirqs last enabled at (77475): [] finish_lock_switch+0xbc/0x1e8 kernel/sched/core.c:4784 hardirqs last disabled at (77476): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:396 softirqs last enabled at (77458): [] softirq_handle_end kernel/softirq.c:401 [inline] softirqs last enabled at (77458): [] __do_softirq+0xb5c/0xdb0 kernel/softirq.c:587 softirqs last disabled at (77389): [] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline] softirqs last disabled at (77389): [] invoke_softirq kernel/softirq.c:439 [inline] softirqs last disabled at (77389): [] __irq_exit_rcu+0x264/0x4d4 kernel/softirq.c:637 ---[ end trace 68741385d53f8172 ]--- usb 1-1: error -22 when submitting rx urb usb 1-1: Failed to submit rx cmd ar5523: probe of 1-1:64.155 failed with error -22 ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 1 PID: 3555 at drivers/usb/core/urb.c:503 usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 Modules linked in: CPU: 1 PID: 3555 Comm: kworker/1:3 Tainted: G W 5.15.160-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: usb_hub_wq hub_event pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 lr : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 sp : ffff80001eef69a0 x29: ffff80001eef69e0 x28: 0000000000000003 x27: ffff800012b85fcc x26: ffff0000cd996600 x25: ffff0000c65f8000 x24: 0000000000000400 x23: ffff800012b8c7e0 x22: dfff800000000000 x21: 0000000000000003 x20: 0000000000000a20 x19: ffff0000c8dcaa00 x18: 0000000000000001 x17: 0000000000000000 x16: ffff8000119a179c x15: 00000000ffffffff x14: ffff0000d40eb680 x13: 0000000000000001 x12: 0000000000000001 x11: 0000000000000000 x10: 0000000000000000 x9 : 158edb6d0e534900 x8 : 158edb6d0e534900 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff80001eef6118 x4 : ffff800014a3f7a0 x3 : ffff8000085501f8 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000029 Call trace: usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 ar5523_submit_rx_cmd+0x170/0x28c drivers/net/wireless/ath/ar5523/ar5523.c:212 ar5523_probe+0x93c/0x1b40 drivers/net/wireless/ath/ar5523/ar5523.c:1653 usb_probe_interface+0x500/0x984 drivers/usb/core/driver.c:396 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_set_configuration+0x15e0/0x1b60 drivers/usb/core/message.c:2165 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:238 usb_probe_device+0x120/0x25c drivers/usb/core/driver.c:293 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_new_device+0x900/0x145c drivers/usb/core/hub.c:2593 hub_port_connect drivers/usb/core/hub.c:5455 [inline] hub_port_connect_change drivers/usb/core/hub.c:5595 [inline] port_event drivers/usb/core/hub.c:5741 [inline] hub_event+0x236c/0x46b8 drivers/usb/core/hub.c:5823 process_one_work+0x790/0x11b8 kernel/workqueue.c:2310 process_scheduled_works kernel/workqueue.c:2373 [inline] worker_thread+0xb88/0x1034 kernel/workqueue.c:2459 kthread+0x37c/0x45c kernel/kthread.c:334 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 irq event stamp: 79230 hardirqs last enabled at (79229): [] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:257 hardirqs last disabled at (79230): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:396 softirqs last enabled at (78898): [] softirq_handle_end kernel/softirq.c:401 [inline] softirqs last enabled at (78898): [] __do_softirq+0xb5c/0xdb0 kernel/softirq.c:587 softirqs last disabled at (78887): [] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline] softirqs last disabled at (78887): [] invoke_softirq kernel/softirq.c:439 [inline] softirqs last disabled at (78887): [] __irq_exit_rcu+0x264/0x4d4 kernel/softirq.c:637 ---[ end trace 68741385d53f8173 ]--- usb 1-1: error -22 when submitting rx urb usb 1-1: Failed to submit rx cmd ar5523: probe of 1-1:64.243 failed with error -22 usb 1-1: USB disconnect, device number 4 usb 1-1: new high-speed USB device number 5 using dummy_hcd usb 1-1: Using ep0 maxpacket: 32 usb 1-1: config 64 has an invalid interface number: 245 but max is 2 usb 1-1: config 64 has an invalid interface number: 155 but max is 2 usb 1-1: config 64 contains an unexpected descriptor of type 0x2, skipping usb 1-1: config 64 contains an unexpected descriptor of type 0x1, skipping usb 1-1: config 64 has an invalid interface number: 243 but max is 2 usb 1-1: config 64 has no interface number 0 usb 1-1: config 64 has no interface number 1 usb 1-1: config 64 has no interface number 2 usb 1-1: config 64 interface 245 altsetting 7 endpoint 0x8 has invalid maxpacket 1024, setting to 64 usb 1-1: config 64 interface 245 altsetting 7 endpoint 0x3 has invalid maxpacket 1023, setting to 64 usb 1-1: config 64 interface 245 altsetting 7 has an invalid endpoint descriptor of length 2, skipping usb 1-1: config 64 interface 245 altsetting 7 has 5 endpoint descriptors, different from the interface descriptor's value: 4 usb 1-1: config 64 interface 155 altsetting 1 endpoint 0x9 has invalid maxpacket 512, setting to 64 usb 1-1: config 64 interface 155 altsetting 1 has an invalid endpoint with address 0x0, skipping usb 1-1: config 64 interface 155 altsetting 1 has an invalid endpoint with address 0x0, skipping usb 1-1: config 64 interface 155 altsetting 1 endpoint 0xA has invalid maxpacket 72, setting to 64 usb 1-1: config 64 interface 155 altsetting 1 endpoint 0x81 has an invalid bInterval 139, changing to 11 usb 1-1: config 64 interface 155 altsetting 1 endpoint 0x81 has invalid maxpacket 18251, setting to 1024 usb 1-1: config 64 interface 155 altsetting 1 has a duplicate endpoint with address 0xA, skipping usb 1-1: config 64 interface 155 altsetting 1 has an invalid endpoint with address 0x0, skipping usb 1-1: config 64 interface 155 altsetting 1 has 9 endpoint descriptors, different from the interface descriptor's value: 8 usb 1-1: config 64 interface 243 altsetting 31 endpoint 0xF has invalid maxpacket 512, setting to 64 usb 1-1: config 64 interface 245 has no altsetting 0 usb 1-1: config 64 interface 155 has no altsetting 0 usb 1-1: config 64 interface 243 has no altsetting 0 usb 1-1: New USB device found, idVendor=083a, idProduct=4506, bcdDevice=6d.7d usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: syz usb 1-1: Manufacturer: syz usb 1-1: SerialNumber: syz ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 1 PID: 3555 at drivers/usb/core/urb.c:503 usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 Modules linked in: CPU: 1 PID: 3555 Comm: kworker/1:3 Tainted: G W 5.15.160-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: usb_hub_wq hub_event pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 lr : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 sp : ffff80001eef69a0 x29: ffff80001eef69e0 x28: 0000000000000003 x27: ffff800012b85fcc x26: ffff0000c78a1100 x25: ffff0000c26b4000 x24: 0000000000000400 x23: ffff800012b8c7e0 x22: dfff800000000000 x21: 0000000000000003 x20: 0000000000000a20 x19: ffff0000cec5f800 x18: 0000000000000001 x17: 0000000000000000 x16: ffff8000119a179c x15: 00000000ffffffff x14: ffff0000d40eb680 x13: 0000000000000001 x12: 0000000000000001 x11: 0000000000000000 x10: 0000000000000000 x9 : 158edb6d0e534900 x8 : 158edb6d0e534900 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff80001eef6118 x4 : ffff800014a3f7a0 x3 : ffff8000085501f8 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000029 Call trace: usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 ar5523_submit_rx_cmd+0x170/0x28c drivers/net/wireless/ath/ar5523/ar5523.c:212 ar5523_probe+0x93c/0x1b40 drivers/net/wireless/ath/ar5523/ar5523.c:1653 usb_probe_interface+0x500/0x984 drivers/usb/core/driver.c:396 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_set_configuration+0x15e0/0x1b60 drivers/usb/core/message.c:2165 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:238 usb_probe_device+0x120/0x25c drivers/usb/core/driver.c:293 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_new_device+0x900/0x145c drivers/usb/core/hub.c:2593 hub_port_connect drivers/usb/core/hub.c:5455 [inline] hub_port_connect_change drivers/usb/core/hub.c:5595 [inline] port_event drivers/usb/core/hub.c:5741 [inline] hub_event+0x236c/0x46b8 drivers/usb/core/hub.c:5823 process_one_work+0x790/0x11b8 kernel/workqueue.c:2310 process_scheduled_works kernel/workqueue.c:2373 [inline] worker_thread+0xb88/0x1034 kernel/workqueue.c:2459 kthread+0x37c/0x45c kernel/kthread.c:334 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 irq event stamp: 85880 hardirqs last enabled at (85879): [] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:257 hardirqs last disabled at (85880): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:396 softirqs last enabled at (84218): [] softirq_handle_end kernel/softirq.c:401 [inline] softirqs last enabled at (84218): [] __do_softirq+0xb5c/0xdb0 kernel/softirq.c:587 softirqs last disabled at (84209): [] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline] softirqs last disabled at (84209): [] invoke_softirq kernel/softirq.c:439 [inline] softirqs last disabled at (84209): [] __irq_exit_rcu+0x264/0x4d4 kernel/softirq.c:637 ---[ end trace 68741385d53f8174 ]--- usb 1-1: error -22 when submitting rx urb usb 1-1: Failed to submit rx cmd ar5523: probe of 1-1:64.245 failed with error -22 ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 1 PID: 3555 at drivers/usb/core/urb.c:503 usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 Modules linked in: CPU: 1 PID: 3555 Comm: kworker/1:3 Tainted: G W 5.15.160-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: usb_hub_wq hub_event pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 lr : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 sp : ffff80001eef69a0 x29: ffff80001eef69e0 x28: 0000000000000003 x27: ffff800012b85fcc x26: ffff0000c78a1100 x25: ffff0000c26b4000 x24: 0000000000000400 x23: ffff800012b8c7e0 x22: dfff800000000000 x21: 0000000000000003 x20: 0000000000000a20 x19: ffff0000cec59800 x18: 0000000000000001 x17: 0000000000000000 x16: ffff8000119a179c x15: 00000000ffffffff x14: ffff0000d40eb680 x13: 0000000000000001 x12: 0000000000000001 x11: 0000000000000000 x10: 0000000000000000 x9 : 158edb6d0e534900 x8 : 158edb6d0e534900 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff80001eef6118 x4 : ffff800014a3f7a0 x3 : ffff8000085501f8 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000029 Call trace: usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 ar5523_submit_rx_cmd+0x170/0x28c drivers/net/wireless/ath/ar5523/ar5523.c:212 ar5523_probe+0x93c/0x1b40 drivers/net/wireless/ath/ar5523/ar5523.c:1653 usb_probe_interface+0x500/0x984 drivers/usb/core/driver.c:396 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_set_configuration+0x15e0/0x1b60 drivers/usb/core/message.c:2165 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:238 usb_probe_device+0x120/0x25c drivers/usb/core/driver.c:293 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_new_device+0x900/0x145c drivers/usb/core/hub.c:2593 hub_port_connect drivers/usb/core/hub.c:5455 [inline] hub_port_connect_change drivers/usb/core/hub.c:5595 [inline] port_event drivers/usb/core/hub.c:5741 [inline] hub_event+0x236c/0x46b8 drivers/usb/core/hub.c:5823 process_one_work+0x790/0x11b8 kernel/workqueue.c:2310 process_scheduled_works kernel/workqueue.c:2373 [inline] worker_thread+0xb88/0x1034 kernel/workqueue.c:2459 kthread+0x37c/0x45c kernel/kthread.c:334 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 irq event stamp: 87284 hardirqs last enabled at (87283): [] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:257 hardirqs last disabled at (87284): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:396 softirqs last enabled at (87190): [] softirq_handle_end kernel/softirq.c:401 [inline] softirqs last enabled at (87190): [] __do_softirq+0xb5c/0xdb0 kernel/softirq.c:587 softirqs last disabled at (87179): [] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline] softirqs last disabled at (87179): [] invoke_softirq kernel/softirq.c:439 [inline] softirqs last disabled at (87179): [] __irq_exit_rcu+0x264/0x4d4 kernel/softirq.c:637 ---[ end trace 68741385d53f8175 ]--- usb 1-1: error -22 when submitting rx urb usb 1-1: Failed to submit rx cmd ar5523: probe of 1-1:64.155 failed with error -22 ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 1 PID: 3555 at drivers/usb/core/urb.c:503 usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 Modules linked in: CPU: 1 PID: 3555 Comm: kworker/1:3 Tainted: G W 5.15.160-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: usb_hub_wq hub_event pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 lr : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 sp : ffff80001eef69a0 x29: ffff80001eef69e0 x28: 0000000000000003 x27: ffff800012b85fcc x26: ffff0000c78a1100 x25: ffff0000c26b4000 x24: 0000000000000400 x23: ffff800012b8c7e0 x22: dfff800000000000 x21: 0000000000000003 x20: 0000000000000a20 x19: ffff0000c9658e00 x18: 0000000000000001 x17: 0000000000000000 x16: ffff8000119a179c x15: 00000000ffffffff x14: ffff0000d40eb680 x13: 0000000000000001 x12: 0000000000000001 x11: 0000000000000000 x10: 0000000000000000 x9 : 158edb6d0e534900 x8 : 158edb6d0e534900 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff80001eef6118 x4 : ffff800014a3f7a0 x3 : ffff8000085501f8 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000029 Call trace: usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 ar5523_submit_rx_cmd+0x170/0x28c drivers/net/wireless/ath/ar5523/ar5523.c:212 ar5523_probe+0x93c/0x1b40 drivers/net/wireless/ath/ar5523/ar5523.c:1653 usb_probe_interface+0x500/0x984 drivers/usb/core/driver.c:396 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_set_configuration+0x15e0/0x1b60 drivers/usb/core/message.c:2165 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:238 usb_probe_device+0x120/0x25c drivers/usb/core/driver.c:293 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_new_device+0x900/0x145c drivers/usb/core/hub.c:2593 hub_port_connect drivers/usb/core/hub.c:5455 [inline] hub_port_connect_change drivers/usb/core/hub.c:5595 [inline] port_event drivers/usb/core/hub.c:5741 [inline] hub_event+0x236c/0x46b8 drivers/usb/core/hub.c:5823 process_one_work+0x790/0x11b8 kernel/workqueue.c:2310 process_scheduled_works kernel/workqueue.c:2373 [inline] worker_thread+0xb88/0x1034 kernel/workqueue.c:2459 kthread+0x37c/0x45c kernel/kthread.c:334 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 irq event stamp: 88776 hardirqs last enabled at (88775): [] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:257 hardirqs last disabled at (88776): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:396 softirqs last enabled at (87370): [] softirq_handle_end kernel/softirq.c:401 [inline] softirqs last enabled at (87370): [] __do_softirq+0xb5c/0xdb0 kernel/softirq.c:587 softirqs last disabled at (87287): [] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline] softirqs last disabled at (87287): [] invoke_softirq kernel/softirq.c:439 [inline] softirqs last disabled at (87287): [] __irq_exit_rcu+0x264/0x4d4 kernel/softirq.c:637 ---[ end trace 68741385d53f8176 ]--- usb 1-1: error -22 when submitting rx urb usb 1-1: Failed to submit rx cmd ar5523: probe of 1-1:64.243 failed with error -22 usb 1-1: USB disconnect, device number 5 usb 1-1: new high-speed USB device number 6 using dummy_hcd usb 1-1: Using ep0 maxpacket: 32 usb 1-1: config 64 has an invalid interface number: 245 but max is 2 usb 1-1: config 64 has an invalid interface number: 155 but max is 2 usb 1-1: config 64 contains an unexpected descriptor of type 0x2, skipping usb 1-1: config 64 contains an unexpected descriptor of type 0x1, skipping usb 1-1: config 64 has an invalid interface number: 243 but max is 2 usb 1-1: config 64 has no interface number 0 usb 1-1: config 64 has no interface number 1 usb 1-1: config 64 has no interface number 2 usb 1-1: config 64 interface 245 altsetting 7 endpoint 0x8 has invalid maxpacket 1024, setting to 64 usb 1-1: config 64 interface 245 altsetting 7 endpoint 0x3 has invalid maxpacket 1023, setting to 64 usb 1-1: config 64 interface 245 altsetting 7 has an invalid endpoint descriptor of length 2, skipping usb 1-1: config 64 interface 245 altsetting 7 has 5 endpoint descriptors, different from the interface descriptor's value: 4 usb 1-1: config 64 interface 155 altsetting 1 endpoint 0x9 has invalid maxpacket 512, setting to 64 usb 1-1: config 64 interface 155 altsetting 1 has an invalid endpoint with address 0x0, skipping usb 1-1: config 64 interface 155 altsetting 1 has an invalid endpoint with address 0x0, skipping usb 1-1: config 64 interface 155 altsetting 1 endpoint 0xA has invalid maxpacket 72, setting to 64 usb 1-1: config 64 interface 155 altsetting 1 endpoint 0x81 has an invalid bInterval 139, changing to 11 usb 1-1: config 64 interface 155 altsetting 1 endpoint 0x81 has invalid maxpacket 18251, setting to 1024 usb 1-1: config 64 interface 155 altsetting 1 has a duplicate endpoint with address 0xA, skipping usb 1-1: config 64 interface 155 altsetting 1 has an invalid endpoint with address 0x0, skipping usb 1-1: config 64 interface 155 altsetting 1 has 9 endpoint descriptors, different from the interface descriptor's value: 8 usb 1-1: config 64 interface 243 altsetting 31 endpoint 0xF has invalid maxpacket 512, setting to 64 usb 1-1: config 64 interface 245 has no altsetting 0 usb 1-1: config 64 interface 155 has no altsetting 0 usb 1-1: config 64 interface 243 has no altsetting 0 usb 1-1: New USB device found, idVendor=083a, idProduct=4506, bcdDevice=6d.7d usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: syz usb 1-1: Manufacturer: syz usb 1-1: SerialNumber: syz ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 1 PID: 3555 at drivers/usb/core/urb.c:503 usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 Modules linked in: CPU: 1 PID: 3555 Comm: kworker/1:3 Tainted: G W 5.15.160-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: usb_hub_wq hub_event pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 lr : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 sp : ffff80001eef69a0 x29: ffff80001eef69e0 x28: 0000000000000003 x27: ffff800012b85fcc x26: ffff0000c9c6a800 x25: ffff0000db59e000 x24: 0000000000000400 x23: ffff800012b8c7e0 x22: dfff800000000000 x21: 0000000000000003 x20: 0000000000000a20 x19: ffff0000cec84600 x18: 0000000000000001 x17: 0000000000000000 x16: ffff8000119a179c x15: 00000000ffffffff x14: ffff0000d40eb680 x13: 0000000000000001 x12: 0000000000000001 x11: 0000000000000000 x10: 0000000000000000 x9 : 158edb6d0e534900 x8 : 158edb6d0e534900 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff80001eef6118 x4 : ffff800014a3f7a0 x3 : ffff8000085501f8 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000029 Call trace: usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 ar5523_submit_rx_cmd+0x170/0x28c drivers/net/wireless/ath/ar5523/ar5523.c:212 ar5523_probe+0x93c/0x1b40 drivers/net/wireless/ath/ar5523/ar5523.c:1653 usb_probe_interface+0x500/0x984 drivers/usb/core/driver.c:396 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_set_configuration+0x15e0/0x1b60 drivers/usb/core/message.c:2165 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:238 usb_probe_device+0x120/0x25c drivers/usb/core/driver.c:293 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_new_device+0x900/0x145c drivers/usb/core/hub.c:2593 hub_port_connect drivers/usb/core/hub.c:5455 [inline] hub_port_connect_change drivers/usb/core/hub.c:5595 [inline] port_event drivers/usb/core/hub.c:5741 [inline] hub_event+0x236c/0x46b8 drivers/usb/core/hub.c:5823 process_one_work+0x790/0x11b8 kernel/workqueue.c:2310 process_scheduled_works kernel/workqueue.c:2373 [inline] worker_thread+0xb88/0x1034 kernel/workqueue.c:2459 kthread+0x37c/0x45c kernel/kthread.c:334 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 irq event stamp: 96452 hardirqs last enabled at (96451): [] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:257 hardirqs last disabled at (96452): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:396 softirqs last enabled at (94804): [] softirq_handle_end kernel/softirq.c:401 [inline] softirqs last enabled at (94804): [] __do_softirq+0xb5c/0xdb0 kernel/softirq.c:587 softirqs last disabled at (94791): [] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline] softirqs last disabled at (94791): [] invoke_softirq kernel/softirq.c:439 [inline] softirqs last disabled at (94791): [] __irq_exit_rcu+0x264/0x4d4 kernel/softirq.c:637 ---[ end trace 68741385d53f8177 ]--- usb 1-1: error -22 when submitting rx urb usb 1-1: Failed to submit rx cmd ar5523: probe of 1-1:64.245 failed with error -22 ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 1 PID: 3555 at drivers/usb/core/urb.c:503 usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 Modules linked in: CPU: 1 PID: 3555 Comm: kworker/1:3 Tainted: G W 5.15.160-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: usb_hub_wq hub_event pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 lr : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 sp : ffff80001eef69a0 x29: ffff80001eef69e0 x28: 0000000000000003 x27: ffff800012b85fcc x26: ffff0000c9c6a800 x25: ffff0000db59e000 x24: 0000000000000400 x23: ffff800012b8c7e0 x22: dfff800000000000 x21: 0000000000000003 x20: 0000000000000a20 x19: ffff0000cec81400 x18: 0000000000000001 x17: 0000000000000000 x16: ffff80000833680c x15: 00000000ffffffff x14: ffff0000d40eb680 x13: 0000000000000001 x12: 0000000000000001 x11: 0000000000000000 x10: 0000000000000000 x9 : 158edb6d0e534900 x8 : 158edb6d0e534900 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff80001eef6118 x4 : ffff800014a3f7a0 x3 : ffff800008336958 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000029 Call trace: usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 ar5523_submit_rx_cmd+0x170/0x28c drivers/net/wireless/ath/ar5523/ar5523.c:212 ar5523_probe+0x93c/0x1b40 drivers/net/wireless/ath/ar5523/ar5523.c:1653 usb_probe_interface+0x500/0x984 drivers/usb/core/driver.c:396 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_set_configuration+0x15e0/0x1b60 drivers/usb/core/message.c:2165 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:238 usb_probe_device+0x120/0x25c drivers/usb/core/driver.c:293 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_new_device+0x900/0x145c drivers/usb/core/hub.c:2593 hub_port_connect drivers/usb/core/hub.c:5455 [inline] hub_port_connect_change drivers/usb/core/hub.c:5595 [inline] port_event drivers/usb/core/hub.c:5741 [inline] hub_event+0x236c/0x46b8 drivers/usb/core/hub.c:5823 process_one_work+0x790/0x11b8 kernel/workqueue.c:2310 process_scheduled_works kernel/workqueue.c:2373 [inline] worker_thread+0xb88/0x1034 kernel/workqueue.c:2459 kthread+0x37c/0x45c kernel/kthread.c:334 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 irq event stamp: 97948 hardirqs last enabled at (97947): [] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:257 hardirqs last disabled at (97948): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:396 softirqs last enabled at (97944): [] softirq_handle_end kernel/softirq.c:401 [inline] softirqs last enabled at (97944): [] __do_softirq+0xb5c/0xdb0 kernel/softirq.c:587 softirqs last disabled at (97921): [] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline] softirqs last disabled at (97921): [] invoke_softirq kernel/softirq.c:439 [inline] softirqs last disabled at (97921): [] __irq_exit_rcu+0x264/0x4d4 kernel/softirq.c:637 ---[ end trace 68741385d53f8178 ]--- usb 1-1: error -22 when submitting rx urb usb 1-1: Failed to submit rx cmd ar5523: probe of 1-1:64.155 failed with error -22 ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 1 PID: 3555 at drivers/usb/core/urb.c:503 usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 Modules linked in: CPU: 1 PID: 3555 Comm: kworker/1:3 Tainted: G W 5.15.160-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: usb_hub_wq hub_event pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 lr : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 sp : ffff80001eef69a0 x29: ffff80001eef69e0 x28: 0000000000000003 x27: ffff800012b85fcc x26: ffff0000c9c6a800 x25: ffff0000db59e000 x24: 0000000000000400 x23: ffff800012b8c7e0 x22: dfff800000000000 x21: 0000000000000003 x20: 0000000000000a20 x19: ffff0000cec7c400 x18: 0000000000000001 x17: 0000000000000000 x16: ffff8000119a179c x15: 00000000ffffffff x14: ffff0000d40eb680 x13: 0000000000000001 x12: 0000000000000001 x11: 0000000000000000 x10: 0000000000000000 x9 : 158edb6d0e534900 x8 : 158edb6d0e534900 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff80001eef6118 x4 : ffff800014a3f7a0 x3 : ffff8000085501f8 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000029 Call trace: usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 ar5523_submit_rx_cmd+0x170/0x28c drivers/net/wireless/ath/ar5523/ar5523.c:212 ar5523_probe+0x93c/0x1b40 drivers/net/wireless/ath/ar5523/ar5523.c:1653 usb_probe_interface+0x500/0x984 drivers/usb/core/driver.c:396 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_set_configuration+0x15e0/0x1b60 drivers/usb/core/message.c:2165 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:238 usb_probe_device+0x120/0x25c drivers/usb/core/driver.c:293 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_new_device+0x900/0x145c drivers/usb/core/hub.c:2593 hub_port_connect drivers/usb/core/hub.c:5455 [inline] hub_port_connect_change drivers/usb/core/hub.c:5595 [inline] port_event drivers/usb/core/hub.c:5741 [inline] hub_event+0x236c/0x46b8 drivers/usb/core/hub.c:5823 process_one_work+0x790/0x11b8 kernel/workqueue.c:2310 process_scheduled_works kernel/workqueue.c:2373 [inline] worker_thread+0xb88/0x1034 kernel/workqueue.c:2459 kthread+0x37c/0x45c kernel/kthread.c:334 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 irq event stamp: 99432 hardirqs last enabled at (99431): [] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:257 hardirqs last disabled at (99432): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:396 softirqs last enabled at (98054): [] softirq_handle_end kernel/softirq.c:401 [inline] softirqs last enabled at (98054): [] __do_softirq+0xb5c/0xdb0 kernel/softirq.c:587 softirqs last disabled at (98045): [] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline] softirqs last disabled at (98045): [] invoke_softirq kernel/softirq.c:439 [inline] softirqs last disabled at (98045): [] __irq_exit_rcu+0x264/0x4d4 kernel/softirq.c:637 ---[ end trace 68741385d53f8179 ]--- usb 1-1: error -22 when submitting rx urb usb 1-1: Failed to submit rx cmd ar5523: probe of 1-1:64.243 failed with error -22 usb 1-1: USB disconnect, device number 6 usb 1-1: new high-speed USB device number 7 using dummy_hcd usb 1-1: Using ep0 maxpacket: 32 usb 1-1: config 64 has an invalid interface number: 245 but max is 2 usb 1-1: config 64 has an invalid interface number: 155 but max is 2 usb 1-1: config 64 contains an unexpected descriptor of type 0x2, skipping usb 1-1: config 64 contains an unexpected descriptor of type 0x1, skipping usb 1-1: config 64 has an invalid interface number: 243 but max is 2 usb 1-1: config 64 has no interface number 0 usb 1-1: config 64 has no interface number 1 usb 1-1: config 64 has no interface number 2 usb 1-1: config 64 interface 245 altsetting 7 endpoint 0x8 has invalid maxpacket 1024, setting to 64 usb 1-1: config 64 interface 245 altsetting 7 endpoint 0x3 has invalid maxpacket 1023, setting to 64 usb 1-1: config 64 interface 245 altsetting 7 has an invalid endpoint descriptor of length 2, skipping usb 1-1: config 64 interface 245 altsetting 7 has 5 endpoint descriptors, different from the interface descriptor's value: 4 usb 1-1: config 64 interface 155 altsetting 1 endpoint 0x9 has invalid maxpacket 512, setting to 64 usb 1-1: config 64 interface 155 altsetting 1 has an invalid endpoint with address 0x0, skipping usb 1-1: config 64 interface 155 altsetting 1 has an invalid endpoint with address 0x0, skipping usb 1-1: config 64 interface 155 altsetting 1 endpoint 0xA has invalid maxpacket 72, setting to 64 usb 1-1: config 64 interface 155 altsetting 1 endpoint 0x81 has an invalid bInterval 139, changing to 11 usb 1-1: config 64 interface 155 altsetting 1 endpoint 0x81 has invalid maxpacket 18251, setting to 1024 usb 1-1: config 64 interface 155 altsetting 1 has a duplicate endpoint with address 0xA, skipping usb 1-1: config 64 interface 155 altsetting 1 has an invalid endpoint with address 0x0, skipping usb 1-1: config 64 interface 155 altsetting 1 has 9 endpoint descriptors, different from the interface descriptor's value: 8 usb 1-1: config 64 interface 243 altsetting 31 endpoint 0xF has invalid maxpacket 512, setting to 64 usb 1-1: config 64 interface 245 has no altsetting 0 usb 1-1: config 64 interface 155 has no altsetting 0 usb 1-1: config 64 interface 243 has no altsetting 0 usb 1-1: New USB device found, idVendor=083a, idProduct=4506, bcdDevice=6d.7d usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: syz usb 1-1: Manufacturer: syz usb 1-1: SerialNumber: syz ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 1 PID: 3555 at drivers/usb/core/urb.c:503 usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 Modules linked in: CPU: 1 PID: 3555 Comm: kworker/1:3 Tainted: G W 5.15.160-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: usb_hub_wq hub_event pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 lr : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 sp : ffff80001eef69a0 x29: ffff80001eef69e0 x28: 0000000000000003 x27: ffff800012b85fcc x26: ffff0000cd672b00 x25: ffff0000d3e1f000 x24: 0000000000000400 x23: ffff800012b8c7e0 x22: dfff800000000000 x21: 0000000000000003 x20: 0000000000000a20 x19: ffff0000cec71400 x18: 0000000000000001 x17: 0000000000000000 x16: ffff8000119a179c x15: 00000000ffffffff x14: ffff0000d40eb680 x13: 0000000000000001 x12: 0000000000000001 x11: 0000000000000000 x10: 0000000000000000 x9 : 158edb6d0e534900 x8 : 158edb6d0e534900 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff80001eef6118 x4 : ffff800014a3f7a0 x3 : ffff8000085501f8 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000029 Call trace: usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 ar5523_submit_rx_cmd+0x170/0x28c drivers/net/wireless/ath/ar5523/ar5523.c:212 ar5523_probe+0x93c/0x1b40 drivers/net/wireless/ath/ar5523/ar5523.c:1653 usb_probe_interface+0x500/0x984 drivers/usb/core/driver.c:396 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_set_configuration+0x15e0/0x1b60 drivers/usb/core/message.c:2165 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:238 usb_probe_device+0x120/0x25c drivers/usb/core/driver.c:293 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_new_device+0x900/0x145c drivers/usb/core/hub.c:2593 hub_port_connect drivers/usb/core/hub.c:5455 [inline] hub_port_connect_change drivers/usb/core/hub.c:5595 [inline] port_event drivers/usb/core/hub.c:5741 [inline] hub_event+0x236c/0x46b8 drivers/usb/core/hub.c:5823 process_one_work+0x790/0x11b8 kernel/workqueue.c:2310 process_scheduled_works kernel/workqueue.c:2373 [inline] worker_thread+0xb88/0x1034 kernel/workqueue.c:2459 kthread+0x37c/0x45c kernel/kthread.c:334 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 irq event stamp: 106294 hardirqs last enabled at (106293): [] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:257 hardirqs last disabled at (106294): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:396 softirqs last enabled at (105722): [] softirq_handle_end kernel/softirq.c:401 [inline] softirqs last enabled at (105722): [] __do_softirq+0xb5c/0xdb0 kernel/softirq.c:587 softirqs last disabled at (105711): [] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline] softirqs last disabled at (105711): [] invoke_softirq kernel/softirq.c:439 [inline] softirqs last disabled at (105711): [] __irq_exit_rcu+0x264/0x4d4 kernel/softirq.c:637 ---[ end trace 68741385d53f817a ]--- usb 1-1: error -22 when submitting rx urb usb 1-1: Failed to submit rx cmd ar5523: probe of 1-1:64.245 failed with error -22 ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 1 PID: 3555 at drivers/usb/core/urb.c:503 usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 Modules linked in: CPU: 1 PID: 3555 Comm: kworker/1:3 Tainted: G W 5.15.160-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: usb_hub_wq hub_event pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 lr : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 sp : ffff80001eef69a0 x29: ffff80001eef69e0 x28: 0000000000000003 x27: ffff800012b85fcc x26: ffff0000cd672b00 x25: ffff0000d3e1f000 x24: 0000000000000400 x23: ffff800012b8c7e0 x22: dfff800000000000 x21: 0000000000000003 x20: 0000000000000a20 x19: ffff0000cec6bc00 x18: 0000000000000001 x17: 0000000000000000 x16: ffff8000119a179c x15: 00000000ffffffff x14: ffff0000d40eb680 x13: 0000000000000001 x12: 0000000000000001 x11: 0000000000000000 x10: 0000000000000000 x9 : 158edb6d0e534900 x8 : 158edb6d0e534900 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff80001eef6118 x4 : ffff800014a3f7a0 x3 : ffff8000085501f8 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000029 Call trace: usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 ar5523_submit_rx_cmd+0x170/0x28c drivers/net/wireless/ath/ar5523/ar5523.c:212 ar5523_probe+0x93c/0x1b40 drivers/net/wireless/ath/ar5523/ar5523.c:1653 usb_probe_interface+0x500/0x984 drivers/usb/core/driver.c:396 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_set_configuration+0x15e0/0x1b60 drivers/usb/core/message.c:2165 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:238 usb_probe_device+0x120/0x25c drivers/usb/core/driver.c:293 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_new_device+0x900/0x145c drivers/usb/core/hub.c:2593 hub_port_connect drivers/usb/core/hub.c:5455 [inline] hub_port_connect_change drivers/usb/core/hub.c:5595 [inline] port_event drivers/usb/core/hub.c:5741 [inline] hub_event+0x236c/0x46b8 drivers/usb/core/hub.c:5823 process_one_work+0x790/0x11b8 kernel/workqueue.c:2310 process_scheduled_works kernel/workqueue.c:2373 [inline] worker_thread+0xb88/0x1034 kernel/workqueue.c:2459 kthread+0x37c/0x45c kernel/kthread.c:334 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 irq event stamp: 107690 hardirqs last enabled at (107689): [] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:257 hardirqs last disabled at (107690): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:396 softirqs last enabled at (106374): [] softirq_handle_end kernel/softirq.c:401 [inline] softirqs last enabled at (106374): [] __do_softirq+0xb5c/0xdb0 kernel/softirq.c:587 softirqs last disabled at (106297): [] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline] softirqs last disabled at (106297): [] invoke_softirq kernel/softirq.c:439 [inline] softirqs last disabled at (106297): [] __irq_exit_rcu+0x264/0x4d4 kernel/softirq.c:637 ---[ end trace 68741385d53f817b ]--- usb 1-1: error -22 when submitting rx urb usb 1-1: Failed to submit rx cmd ar5523: probe of 1-1:64.155 failed with error -22 ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 1 PID: 3555 at drivers/usb/core/urb.c:503 usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 Modules linked in: CPU: 1 PID: 3555 Comm: kworker/1:3 Tainted: G W 5.15.160-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: usb_hub_wq hub_event pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 lr : usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 sp : ffff80001eef69a0 x29: ffff80001eef69e0 x28: 0000000000000003 x27: ffff800012b85fcc x26: ffff0000cd672b00 x25: ffff0000d3e1f000 x24: 0000000000000400 x23: ffff800012b8c7e0 x22: dfff800000000000 x21: 0000000000000003 x20: 0000000000000a20 x19: ffff0000cec64800 x18: 0000000000000001 x17: 0000000000000000 x16: ffff8000119a179c x15: 00000000ffffffff x14: ffff0000d40eb680 x13: 0000000000000001 x12: 0000000000000001 x11: 0000000000000000 x10: 0000000000000000 x9 : 158edb6d0e534900 x8 : 158edb6d0e534900 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff80001eef6118 x4 : ffff800014a3f7a0 x3 : ffff8000085501f8 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000029 Call trace: usb_submit_urb+0xa44/0x1588 drivers/usb/core/urb.c:502 ar5523_submit_rx_cmd+0x170/0x28c drivers/net/wireless/ath/ar5523/ar5523.c:212 ar5523_probe+0x93c/0x1b40 drivers/net/wireless/ath/ar5523/ar5523.c:1653 usb_probe_interface+0x500/0x984 drivers/usb/core/driver.c:396 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_set_configuration+0x15e0/0x1b60 drivers/usb/core/message.c:2165 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:238 usb_probe_device+0x120/0x25c drivers/usb/core/driver.c:293 really_probe+0x26c/0xaec drivers/base/dd.c:595 __driver_probe_device+0x194/0x3b4 drivers/base/dd.c:755 driver_probe_device+0x78/0x34c drivers/base/dd.c:785 __device_attach_driver+0x28c/0x4d8 drivers/base/dd.c:907 bus_for_each_drv+0x158/0x1e0 drivers/base/bus.c:427 __device_attach+0x2f0/0x480 drivers/base/dd.c:979 device_initial_probe+0x24/0x34 drivers/base/dd.c:1028 bus_probe_device+0xbc/0x1c8 drivers/base/bus.c:487 device_add+0xae0/0xef4 drivers/base/core.c:3409 usb_new_device+0x900/0x145c drivers/usb/core/hub.c:2593 hub_port_connect drivers/usb/core/hub.c:5455 [inline] hub_port_connect_change drivers/usb/core/hub.c:5595 [inline] port_event drivers/usb/core/hub.c:5741 [inline] hub_event+0x236c/0x46b8 drivers/usb/core/hub.c:5823 process_one_work+0x790/0x11b8 kernel/workqueue.c:2310 process_scheduled_works kernel/workqueue.c:2373 [inline] worker_thread+0xb88/0x1034 kernel/workqueue.c:2459 kthread+0x37c/0x45c kernel/kthread.c:334 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 irq event stamp: 109188 hardirqs last enabled at (109187): [] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:257 hardirqs last disabled at (109188): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:396 softirqs last enabled at (107780): [] softirq_handle_end kernel/softirq.c:401 [inline] softirqs last enabled at (107780): [] __do_softirq+0xb5c/0xdb0 kernel/softirq.c:587 softirqs last disabled at (107693): [] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline] softirqs last disabled at (107693): [] invoke_softirq kernel/softirq.c:439 [inline] softirqs last disabled at (107693): [] __irq_exit_rcu+0x264/0x4d4 kernel/softirq.c:637 ---[ end trace 68741385d53f817c ]--- usb 1-1: error -22 when submitting rx urb usb 1-1: Failed to submit rx cmd ar5523: probe of 1-1:64.243 failed with error -22 usb 1-1: USB disconnect, device number 7 usb 1-1: new high-speed USB device number 8 using dummy_hcd usb 1-1: Using ep0 maxpacket: 32 usb 1-1: config 64 has an invalid interface number: 245 but max is 2 usb 1-1: config 64 has an invalid interface number: 155 but max is 2 usb 1-1: config 64 contains an unexpected descriptor of type 0x2, skipping usb 1-1: config 64 contains an unexpected descriptor of type 0x1, skipping usb 1-1: config 64 has an invalid interface number: 243 but max is 2 usb 1-1: config 64 has no interface number 0 usb 1-1: config 64 has no interface number 1 usb 1-1: config 64 has no interface number 2 usb 1-1: config 64 interface 245 altsetting 7 endpoint 0x8 has invalid maxpacket 1024, setting to 64 usb 1-1: config 64 interface 245 altsetting 7 endpoint 0x3 has invalid maxpacket 1023, setting to 64