program: r0 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000014c0)={0x6, 0x25, &(0x7f0000000140)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, [@initr0={0x18, 0x0, 0x0, 0x0, 0xa8f, 0x0, 0x0, 0x0, 0x2}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}, @tail_call, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x5, 0x0, 0x0, 0x0, 0x7fff}, @cb_func={0x18, 0x1, 0x4, 0x0, 0xfffffffffffffff8}, @generic={0x8, 0x4, 0x3, 0x7, 0x200}, @generic={0x2c, 0x7, 0xa, 0x1, 0x384}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x5}, @tail_call, @map_fd={0x18, 0x6, 0x1, 0x0, 0x1}]}, &(0x7f0000000300)='GPL\x00', 0x10000, 0x20, &(0x7f0000000340)=""/32, 0x41000, 0x8, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f00000003c0)={0x4, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000001480)=[{0x2, 0x4, 0xd, 0x2}], 0x10, 0x3}, 0x94) r2 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=@newqdisc={0x4c, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r4, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x75a, 0x51, 0x54, 0xd, 0x8, 0x1c}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40000}, 0x44080) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd29, 0x0, {0x60, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffe0, 0xa}, {0x1, 0x10}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x13c7200, 0x6, 0x8c, 0x0, 0x7ffe, 0x34d, 0xfff, 0x0, 0x1ff}}}}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x5}]}, 0x60}, 0x1, 0x0, 0x0, 0x55}, 0x4000000) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001580)={0x0, 0x0}, 0x8) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000015c0)={r1, r4, 0x25, 0x0, @val=@target_btf_id=r5}, 0x14) r6 = syz_open_dev$I2C(&(0x7f00000000c0), 0xc, 0x88000) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000600)={0x18, &(0x7f0000001600)=ANY=[@ANYBLOB="201604000000f896ff13cb46a8dbe64d3c245247f1d1036bac77903ff40a13c7ff4460480eb433c5029fcbb1aa7d08ccaa7f7d7f49ce4181dcb5b3c12f0bf66bd30107cbfa8e91f8b61f26d17a907ef9e2b29dbf86c593c68ec3a54428b41873e2c98e6e4de2b049e91bb1521b4367b209d9b7e68314ba16422f2c9fd9a47edad0476755a27e1c665f5374b8752975fa8abcb5c9c90c092554a6a3ea40d53445"], 0x0, 0x0, 0x0, 0x0}) r7 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r7, 0x10f, 0x87, &(0x7f0000000100)=@req={0x3fc, 0x0, 0x0, 0x6}, 0x10) r8 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r8, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) recvmmsg$unix(r7, &(0x7f0000001f40)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000480)=""/4081, 0xff1}], 0x1}}], 0x1, 0x0, 0x0) recvmmsg(r7, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000280)=""/32, 0x30}], 0x1}, 0x7}], 0x1, 0x40000182, 0x0) close(r8) ioctl$I2C_SMBUS(r6, 0x720, &(0x7f0000000000)={0x1, 0x6, 0x1, &(0x7f0000000100)={0x3, "3ac071ffbcd684737d99bb8bd238954c9b216d3911b40c65fd00"}}) [ 100.862914][ T806] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 101.012680][ T806] usb 5-1: Using ep0 maxpacket: 16 [ 101.018429][ T806] usb 5-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 101.027325][ T806] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 101.027372][ T806] usb 5-1: Product: syz [ 101.027407][ T806] usb 5-1: Manufacturer: syz [ 101.027434][ T806] usb 5-1: SerialNumber: syz [ 101.039272][ T46] Bluetooth: hci0: command tx timeout [ 101.056742][ T806] usb 5-1: config 0 descriptor?? [ 101.466726][ T806] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 101.490226][ T806] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 101.496523][ T806] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 101.501267][ T806] usb 5-1: media controller created [ 101.520112][ T806] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 101.679345][ T806] zl10353_read_register: readreg error (reg=127, ret==0) [ 101.683757][ T806] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 101.687623][ T806] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 102.143324][ T5319] ------------[ cut here ]------------ [ 102.143377][ T5319] usb 5-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0 [ 102.143420][ T5319] WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1057/0x18b0, CPU#0: syz.0.0/5319 [ 102.160641][ T5319] Modules linked in: [ 102.163399][ T5319] CPU: 0 UID: 0 PID: 5319 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 102.167284][ T5319] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.171583][ T5319] RIP: 0010:usb_submit_urb+0x1100/0x18b0 [ 102.174320][ T5319] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89 [ 102.182493][ T5319] RSP: 0018:ffffc9000df77698 EFLAGS: 00010246 [ 102.185332][ T5319] RAX: 0000000000000000 RBX: ffff8880370fc100 RCX: 0000000080000280 [ 102.188771][ T5319] RDX: ffff88804463a2a0 RSI: ffffffff8cc52600 RDI: ffffffff9087ebc0 [ 102.192145][ T5319] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000 [ 102.195692][ T5319] R10: ffffc9000df77780 R11: fffff52001beeefc R12: 1ffff1100671bfa4 [ 102.199179][ T5319] R13: ffff8880338dfd20 R14: ffff88804463a2a0 R15: 0000000080000280 [ 102.203467][ T5319] FS: 00007fed86a7f6c0(0000) GS:ffff88808c2cf000(0000) knlGS:0000000000000000 [ 102.207247][ T5319] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 102.210213][ T5319] CR2: 00007fed86a5dfe8 CR3: 0000000043c04000 CR4: 0000000000352ef0 [ 102.213777][ T5319] Call Trace: [ 102.215234][ T5319] [ 102.216444][ T5319] usb_start_wait_urb+0x13f/0x5b0 [ 102.218467][ T5319] ? trace_kmalloc+0x2a/0xf0 [ 102.220350][ T5319] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 102.223127][ T5319] usb_control_msg+0x234/0x3e0 [ 102.225376][ T5319] dtv5100_i2c_msg+0x231/0x2f0 [ 102.227629][ T5319] dtv5100_i2c_xfer+0x1a5/0x610 [ 102.229699][ T5319] ? kasan_save_track+0x4f/0x80 [ 102.231858][ T5319] ? kasan_save_free_info+0x40/0x50 [ 102.234312][ T5319] ? __se_sys_ioctl+0x47/0x170 [ 102.236415][ T5319] __i2c_transfer+0x7bf/0x1fe0 [ 102.238524][ T5319] __i2c_smbus_xfer+0x159a/0x27e0 [ 102.240904][ T5319] ? __pfx___i2c_smbus_xfer+0x10/0x10 [ 102.243458][ T5319] ? rt_mutex_lock_nested+0x156/0x1c0 [ 102.245880][ T5319] i2c_smbus_xfer+0x1f5/0x310 [ 102.247930][ T5319] i2cdev_ioctl_smbus+0x407/0x700 [ 102.250203][ T5319] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10 [ 102.252762][ T5319] i2cdev_ioctl+0x615/0x880 [ 102.254876][ T5319] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 102.257412][ T5319] ? __fget_files+0x2a/0x420 [ 102.259479][ T5319] ? __fget_files+0x3a2/0x420 [ 102.261621][ T5319] ? bpf_lsm_file_ioctl+0x9/0x20 [ 102.264161][ T5319] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 102.266319][ T5319] __se_sys_ioctl+0xfc/0x170 [ 102.268430][ T5319] do_syscall_64+0x166/0x520 [ 102.270470][ T5319] ? trace_irq_disable+0x3b/0x140 [ 102.272757][ T5319] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.275677][ T5319] ? clear_bhb_loop+0x70/0xc0 [ 102.278249][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.281553][ T5319] RIP: 0033:0x7fed85b9e159 [ 102.283642][ T5319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 102.292007][ T5319] RSP: 002b:00007fed86a7efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 102.296045][ T5319] RAX: ffffffffffffffda RBX: 00007fed85e26090 RCX: 00007fed85b9e159 [ 102.299590][ T5319] RDX: 0000200000000000 RSI: 0000000000000720 RDI: 0000000000000007 [ 102.303189][ T5319] RBP: 00007fed85c35024 R08: 0000000000000000 R09: 0000000000000000 [ 102.306820][ T5319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.310872][ T5319] R13: 00007fed85e26128 R14: 00007fed85e26090 R15: 00007ffc4919bd18 [ 102.314522][ T5319] [ 102.315911][ T5319] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 102.319072][ T5319] CPU: 0 UID: 0 PID: 5319 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 102.322810][ T5319] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.327049][ T5319] Call Trace: [ 102.328503][ T5319] [ 102.329875][ T5319] vpanic+0x56d/0xa60 [ 102.331592][ T5319] ? __pfx__printk+0x10/0x10 [ 102.333615][ T5319] ? __pfx_vpanic+0x10/0x10 [ 102.335527][ T5319] ? is_bpf_text_address+0x292/0x2b0 [ 102.337844][ T5319] ? is_bpf_text_address+0x26/0x2b0 [ 102.339953][ T5319] panic+0xc5/0xd0 [ 102.341575][ T5319] ? __pfx_panic+0x10/0x10 [ 102.343503][ T5319] __warn+0x315/0x4c0 [ 102.345214][ T5319] ? usb_submit_urb+0x1057/0x18b0 [ 102.347310][ T5319] ? usb_submit_urb+0x1057/0x18b0 [ 102.349558][ T5319] __report_bug+0x276/0x570 [ 102.351521][ T5319] ? usb_submit_urb+0x1057/0x18b0 [ 102.353879][ T5319] ? __pfx___report_bug+0x10/0x10 [ 102.356241][ T5319] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 102.358886][ T5319] ? kasan_save_track+0x4f/0x80 [ 102.361069][ T5319] report_bug_entry+0x19b/0x290 [ 102.363439][ T5319] ? usb_submit_urb+0x1100/0x18b0 [ 102.365600][ T5319] ? usb_submit_urb+0x1105/0x18b0 [ 102.367804][ T5319] handle_bug+0xce/0x200 [ 102.369741][ T5319] exc_invalid_op+0x1a/0x50 [ 102.371768][ T5319] asm_exc_invalid_op+0x1a/0x20 [ 102.373959][ T5319] RIP: 0010:usb_submit_urb+0x1100/0x18b0 [ 102.376298][ T5319] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89 [ 102.384418][ T5319] RSP: 0018:ffffc9000df77698 EFLAGS: 00010246 [ 102.387467][ T5319] RAX: 0000000000000000 RBX: ffff8880370fc100 RCX: 0000000080000280 [ 102.390865][ T5319] RDX: ffff88804463a2a0 RSI: ffffffff8cc52600 RDI: ffffffff9087ebc0 [ 102.394282][ T5319] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000 [ 102.397634][ T5319] R10: ffffc9000df77780 R11: fffff52001beeefc R12: 1ffff1100671bfa4 [ 102.401164][ T5319] R13: ffff8880338dfd20 R14: ffff88804463a2a0 R15: 0000000080000280 [ 102.404762][ T5319] ? usb_submit_urb+0x1091/0x18b0 [ 102.406950][ T5319] usb_start_wait_urb+0x13f/0x5b0 [ 102.409265][ T5319] ? trace_kmalloc+0x2a/0xf0 [ 102.411245][ T5319] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 102.413618][ T5319] usb_control_msg+0x234/0x3e0 [ 102.415654][ T5319] dtv5100_i2c_msg+0x231/0x2f0 [ 102.417750][ T5319] dtv5100_i2c_xfer+0x1a5/0x610 [ 102.419794][ T5319] ? kasan_save_track+0x4f/0x80 [ 102.421949][ T5319] ? kasan_save_free_info+0x40/0x50 [ 102.424187][ T5319] ? __se_sys_ioctl+0x47/0x170 [ 102.426268][ T5319] __i2c_transfer+0x7bf/0x1fe0 [ 102.428411][ T5319] __i2c_smbus_xfer+0x159a/0x27e0 [ 102.430664][ T5319] ? __pfx___i2c_smbus_xfer+0x10/0x10 [ 102.432983][ T5319] ? rt_mutex_lock_nested+0x156/0x1c0 [ 102.435366][ T5319] i2c_smbus_xfer+0x1f5/0x310 [ 102.437509][ T5319] i2cdev_ioctl_smbus+0x407/0x700 [ 102.439698][ T5319] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10 [ 102.442214][ T5319] i2cdev_ioctl+0x615/0x880 [ 102.444509][ T5319] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 102.446756][ T5319] ? __fget_files+0x2a/0x420 [ 102.448757][ T5319] ? __fget_files+0x3a2/0x420 [ 102.450857][ T5319] ? bpf_lsm_file_ioctl+0x9/0x20 [ 102.453280][ T5319] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 102.455476][ T5319] __se_sys_ioctl+0xfc/0x170 [ 102.457498][ T5319] do_syscall_64+0x166/0x520 [ 102.459453][ T5319] ? trace_irq_disable+0x3b/0x140 [ 102.461556][ T5319] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.464087][ T5319] ? clear_bhb_loop+0x70/0xc0 [ 102.466060][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.468435][ T5319] RIP: 0033:0x7fed85b9e159 [ 102.470240][ T5319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 102.478186][ T5319] RSP: 002b:00007fed86a7efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 102.481555][ T5319] RAX: ffffffffffffffda RBX: 00007fed85e26090 RCX: 00007fed85b9e159 [ 102.484831][ T5319] RDX: 0000200000000000 RSI: 0000000000000720 RDI: 0000000000000007 [ 102.488387][ T5319] RBP: 00007fed85c35024 R08: 0000000000000000 R09: 0000000000000000 [ 102.491887][ T5319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.495303][ T5319] R13: 00007fed85e26128 R14: 00007fed85e26090 R15: 00007ffc4919bd18 [ 102.498673][ T5319] [ 102.500571][ T5319] Kernel Offset: disabled [ 102.502482][ T5319] Rebooting in 86400 seconds..