program:
r0 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x10000001d, 0x8041)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./lower1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./lower2\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./upper\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./work\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mnt\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./lower1/file1\x00', 0x42, 0x1ff)
mount(0x0, &(0x7f00000002c0)='./mnt\x00', &(0x7f0000000340)='overlay\x00', 0x0, &(0x7f0000000380)='lowerdir=lower1:lower2,upperdir=upper,workdir=work,index=on,nfs_export=on,uuid=off\x00')
name_to_handle_at(0xffffffffffffff9c, &(0x7f00000004c0)='./mnt/file1\x00', &(0x7f0000000300)=@raw={0x80, 0x0, {'\x00'}}, &(0x7f0000000400), 0x0)
r2 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000b00)=ANY=[@ANYBLOB="1201000000000008d804dd0000000000000109022400010000a008090400fe01030001000921fffffd0122050009058103"], 0x0)
syz_usb_control_io$hid(r2, 0x0, 0x0)
syz_usb_control_io(r2, &(0x7f0000000040)={0x2c, &(0x7f00000012c0)=ANY=[@ANYBLOB="400305"], 0x0, 0x0, 0x0, 0x0}, 0x0)
r3 = syz_open_dev$I2C(&(0x7f0000000100), 0x2, 0x41)
ioctl$I2C_SMBUS(r3, 0x720, &(0x7f00000000c0)={0x0, 0x0, 0x1, 0x0})
ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, &(0x7f00000001c0)={0x0, 0x2, "4cf90fba85c830e42a3ca4b10f01bbcb15f3806c4853e7c44a6974759d9f643905a56baa4195fb396d9bfa306999f1586e5d1ca49add100a36b751a7d9fe0b182ebf2c8a0e66f72c1c08260030752f07cd4089473e52885a3c85bacf3ccfac5bb9435fe036dcfccd7254bbd8bce90e2284d29e1f17d6652270fd0abcb8729f16ff602b438bd122a9e09984e2799d0dbfef7533d1a930ea4f4b57605ace45f5815450693650ae122d34aa0c5ca5e793516d156e5a5b34d6c17c40d753426a3d8e15e726d0f2622e873e0cbe63751bb62c68594d4cb0a21b92ad2e80f24a9b290a87ee6779022a0b7f5223e4e8c9f53f501ec8c439724078fdc076a51d50760566"})
[ 86.406440][ T4648] Bluetooth: hci0: command tx timeout
[ 86.691520][ T1376] cfg80211: failed to load regulatory.db
[ 86.724249][ T5312] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 86.874327][ T5312] usb 5-1: Using ep0 maxpacket: 16
[ 86.878662][ T5312] usb 5-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3
[ 86.888024][ T5312] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 86.891361][ T5312] usb 5-1: Product: syz
[ 86.893536][ T5312] usb 5-1: Manufacturer: syz
[ 86.895825][ T5312] usb 5-1: SerialNumber: syz
[ 86.913814][ T5312] usb 5-1: config 0 descriptor??
[ 87.325822][ T5312] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state.
[ 87.351514][ T5312] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[ 87.356557][ T5312] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T)
[ 87.360729][ T5312] usb 5-1: media controller created
[ 87.381792][ T5312] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[ 87.526460][ T5312] zl10353_read_register: readreg error (reg=127, ret==0)
[ 87.529712][ T5312] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T'
[ 87.533390][ T5312] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected.
[ 87.613413][ T5325] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 87.620840][ T5325] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 87.644365][ T5325] ------------[ cut here ]------------
[ 87.644431][ T5325] usb 5-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0
[ 87.644476][ T5325] WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1057/0x18b0, CPU#0: syz.0.0/5325
[ 87.655453][ T5325] Modules linked in:
[ 87.657184][ T5325] CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 87.661085][ T5325] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 87.665502][ T5325] RIP: 0010:usb_submit_urb+0x1100/0x18b0
[ 87.668042][ T5325] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89
[ 87.676556][ T5325] RSP: 0018:ffffc9000e2af698 EFLAGS: 00010246
[ 87.679262][ T5325] RAX: 0000000000000000 RBX: ffff888030ae5a00 RCX: 0000000080000280
[ 87.682859][ T5325] RDX: ffff8880443168e0 RSI: ffffffff8cc53920 RDI: ffffffff9087f830
[ 87.686326][ T5325] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000
[ 87.689615][ T5325] R10: ffffc9000e2af780 R11: fffff52001c55efc R12: 1ffff110088730c0
[ 87.692765][ T5325] R13: ffff888044398600 R14: ffff8880443168e0 R15: 0000000080000280
[ 87.696307][ T5325] FS: 00007f2527bf66c0(0000) GS:ffff88808c2ca000(0000) knlGS:0000000000000000
[ 87.699844][ T5325] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 87.702486][ T5325] CR2: 00007fd65c571ad8 CR3: 000000003ec93000 CR4: 0000000000352ef0
[ 87.705916][ T5325] Call Trace:
[ 87.707799][ T5325]
[ 87.709181][ T5325] usb_start_wait_urb+0x13f/0x5b0
[ 87.711464][ T5325] ? trace_kmalloc+0x2a/0xf0
[ 87.713604][ T5325] ? __pfx_usb_start_wait_urb+0x10/0x10
[ 87.716161][ T5325] usb_control_msg+0x234/0x3e0
[ 87.718368][ T5325] dtv5100_i2c_msg+0x231/0x2f0
[ 87.720542][ T5325] dtv5100_i2c_xfer+0x1a5/0x610
[ 87.722756][ T5325] ? kasan_save_track+0x4f/0x80
[ 87.724907][ T5325] ? kasan_save_free_info+0x40/0x50
[ 87.727086][ T5325] ? __se_sys_ioctl+0x47/0x170
[ 87.729220][ T5325] __i2c_transfer+0x7bf/0x1fe0
[ 87.731357][ T5325] __i2c_smbus_xfer+0x159a/0x27e0
[ 87.733590][ T5325] ? __pfx___i2c_smbus_xfer+0x10/0x10
[ 87.736088][ T5325] ? rt_mutex_lock_nested+0x156/0x1c0
[ 87.738454][ T5325] i2c_smbus_xfer+0x1f5/0x310
[ 87.740513][ T5325] i2cdev_ioctl_smbus+0x1e7/0x700
[ 87.742676][ T5325] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10
[ 87.745122][ T5325] i2cdev_ioctl+0x615/0x880
[ 87.747131][ T5325] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 87.749343][ T5325] ? __fget_files+0x2a/0x420
[ 87.751713][ T5325] ? __fget_files+0x3a2/0x420
[ 87.753748][ T5325] ? bpf_lsm_file_ioctl+0x9/0x20
[ 87.756091][ T5325] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 87.758291][ T5325] __se_sys_ioctl+0xfc/0x170
[ 87.760384][ T5325] do_syscall_64+0x166/0x520
[ 87.762467][ T5325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.765256][ T5325] ? clear_bhb_loop+0x70/0xc0
[ 87.767288][ T5325] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.769910][ T5325] RIP: 0033:0x7f2526d9e159
[ 87.771878][ T5325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 87.782378][ T5325] RSP: 002b:00007f2527bf5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 87.786086][ T5325] RAX: ffffffffffffffda RBX: 00007f2527025fa0 RCX: 00007f2526d9e159
[ 87.789504][ T5325] RDX: 00002000000000c0 RSI: 0000000000000720 RDI: 0000000000000007
[ 87.792983][ T5325] RBP: 00007f2526e35024 R08: 0000000000000000 R09: 0000000000000000
[ 87.796422][ T5325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 87.800333][ T5325] R13: 00007f2527026038 R14: 00007f2527025fa0 R15: 00007ffe82696ed8
[ 87.804056][ T5325]
[ 87.805387][ T5325] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 87.808344][ T5325] CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 87.811965][ T5325] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 87.816195][ T5325] Call Trace:
[ 87.817732][ T5325]
[ 87.819081][ T5325] vpanic+0x56d/0xa60
[ 87.820894][ T5325] ? __pfx__printk+0x10/0x10
[ 87.822860][ T5325] ? __pfx_vpanic+0x10/0x10
[ 87.824719][ T5325] ? is_bpf_text_address+0x292/0x2b0
[ 87.826915][ T5325] ? is_bpf_text_address+0x26/0x2b0
[ 87.829192][ T5325] panic+0xc5/0xd0
[ 87.830829][ T5325] ? __pfx_panic+0x10/0x10
[ 87.832920][ T5325] __warn+0x315/0x4c0
[ 87.834733][ T5325] ? usb_submit_urb+0x1057/0x18b0
[ 87.836894][ T5325] ? usb_submit_urb+0x1057/0x18b0
[ 87.839079][ T5325] __report_bug+0x276/0x570
[ 87.840989][ T5325] ? usb_submit_urb+0x1057/0x18b0
[ 87.843028][ T5325] ? __pfx___report_bug+0x10/0x10
[ 87.845122][ T5325] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 87.847588][ T5325] ? kasan_save_track+0x4f/0x80
[ 87.849588][ T5325] report_bug_entry+0x19b/0x290
[ 87.851603][ T5325] ? usb_submit_urb+0x1100/0x18b0
[ 87.853649][ T5325] ? usb_submit_urb+0x1105/0x18b0
[ 87.855608][ T5325] handle_bug+0xce/0x200
[ 87.857413][ T5325] exc_invalid_op+0x1a/0x50
[ 87.859235][ T5325] asm_exc_invalid_op+0x1a/0x20
[ 87.861234][ T5325] RIP: 0010:usb_submit_urb+0x1100/0x18b0
[ 87.863781][ T5325] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89
[ 87.872105][ T5325] RSP: 0018:ffffc9000e2af698 EFLAGS: 00010246
[ 87.874775][ T5325] RAX: 0000000000000000 RBX: ffff888030ae5a00 RCX: 0000000080000280
[ 87.878081][ T5325] RDX: ffff8880443168e0 RSI: ffffffff8cc53920 RDI: ffffffff9087f830
[ 87.881705][ T5325] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000
[ 87.885011][ T5325] R10: ffffc9000e2af780 R11: fffff52001c55efc R12: 1ffff110088730c0
[ 87.888290][ T5325] R13: ffff888044398600 R14: ffff8880443168e0 R15: 0000000080000280
[ 87.891784][ T5325] ? usb_submit_urb+0x1091/0x18b0
[ 87.894002][ T5325] usb_start_wait_urb+0x13f/0x5b0
[ 87.896210][ T5325] ? trace_kmalloc+0x2a/0xf0
[ 87.898194][ T5325] ? __pfx_usb_start_wait_urb+0x10/0x10
[ 87.900604][ T5325] usb_control_msg+0x234/0x3e0
[ 87.902632][ T5325] dtv5100_i2c_msg+0x231/0x2f0
[ 87.904643][ T5325] dtv5100_i2c_xfer+0x1a5/0x610
[ 87.906757][ T5325] ? kasan_save_track+0x4f/0x80
[ 87.908904][ T5325] ? kasan_save_free_info+0x40/0x50
[ 87.910976][ T5325] ? __se_sys_ioctl+0x47/0x170
[ 87.912935][ T5325] __i2c_transfer+0x7bf/0x1fe0
[ 87.914845][ T5325] __i2c_smbus_xfer+0x159a/0x27e0
[ 87.916816][ T5325] ? __pfx___i2c_smbus_xfer+0x10/0x10
[ 87.918924][ T5325] ? rt_mutex_lock_nested+0x156/0x1c0
[ 87.921041][ T5325] i2c_smbus_xfer+0x1f5/0x310
[ 87.922996][ T5325] i2cdev_ioctl_smbus+0x1e7/0x700
[ 87.925070][ T5325] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10
[ 87.927334][ T5325] i2cdev_ioctl+0x615/0x880
[ 87.929386][ T5325] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 87.931715][ T5325] ? __fget_files+0x2a/0x420
[ 87.933747][ T5325] ? __fget_files+0x3a2/0x420
[ 87.936304][ T5325] ? bpf_lsm_file_ioctl+0x9/0x20
[ 87.938761][ T5325] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 87.941004][ T5325] __se_sys_ioctl+0xfc/0x170
[ 87.943072][ T5325] do_syscall_64+0x166/0x520
[ 87.945164][ T5325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.947660][ T5325] ? clear_bhb_loop+0x70/0xc0
[ 87.949616][ T5325] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.952011][ T5325] RIP: 0033:0x7f2526d9e159
[ 87.953854][ T5325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 87.962126][ T5325] RSP: 002b:00007f2527bf5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 87.966249][ T5325] RAX: ffffffffffffffda RBX: 00007f2527025fa0 RCX: 00007f2526d9e159
[ 87.969481][ T5325] RDX: 00002000000000c0 RSI: 0000000000000720 RDI: 0000000000000007
[ 87.972956][ T5325] RBP: 00007f2526e35024 R08: 0000000000000000 R09: 0000000000000000
[ 87.976409][ T5325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 87.979773][ T5325] R13: 00007f2527026038 R14: 00007f2527025fa0 R15: 00007ffe82696ed8
[ 87.983219][ T5325]
[ 87.985039][ T5325] Kernel Offset: disabled
[ 87.986900][ T5325] Rebooting in 86400 seconds..