program:
r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x41, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x22, @string={0x22, 0x3, "cefb16cd284317a3d87d80e709acad22103f02e9d01cb9f948afc637a6a9063a"}}, 0x0, 0x0}, 0x0)
r1 = syz_open_dev$I2C(&(0x7f00000000c0), 0xc, 0x88000)
ioctl$I2C_SMBUS(r1, 0x720, &(0x7f0000000040)={0x1, 0x7, 0x0, &(0x7f00000017c0)={0x19, "4ec0191e5bb41008c198884329f6dd0711762717c44bc7b7b1cc22a10010115d6d"}})
[ 94.335965][ T5289] Bluetooth: hci0: command tx timeout
[ 94.649893][ T5328] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 94.800057][ T5328] usb 5-1: Using ep0 maxpacket: 16
[ 94.806693][ T5328] usb 5-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22
[ 94.810510][ T5328] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 94.813897][ T5328] usb 5-1: Product: syz
[ 94.815696][ T5328] usb 5-1: Manufacturer: syz
[ 94.817673][ T5328] usb 5-1: SerialNumber: syz
[ 95.034699][ T5328] usb 5-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state
[ 95.055418][ T5328] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer
[ 95.060410][ T5328] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0)
[ 95.064937][ T5328] usb 5-1: media controller created
[ 95.078322][ T5328] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[ 95.304172][ T5328] zl10353_read_register: readreg error (reg=127, ret==-110)
[ 95.307284][ T5333] ------------[ cut here ]------------
[ 95.309392][ T5333] usb 5-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0
[ 95.312150][ T5333] WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1057/0x18b0, CPU#0: syz.0.0/5333
[ 95.315414][ T5333] Modules linked in:
[ 95.316826][ T5333] CPU: 0 UID: 0 PID: 5333 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 95.320042][ T5333] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.323444][ T5333] RIP: 0010:usb_submit_urb+0x1100/0x18b0
[ 95.325408][ T5333] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89
[ 95.331992][ T5333] RSP: 0018:ffffc9000e46f5f8 EFLAGS: 00010246
[ 95.334154][ T5333] RAX: 0000000000000000 RBX: ffff8880335dce00 RCX: 0000000080000280
[ 95.336862][ T5333] RDX: ffff888012bcc2e0 RSI: ffffffff8ca33060 RDI: ffffffff9065b520
[ 95.339630][ T5333] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000
[ 95.342904][ T5333] R10: ffffc9000e46f6e0 R11: fffff52001c8dee8 R12: 1ffff11002579990
[ 95.346424][ T5333] R13: ffff888012bccc80 R14: ffff888012bcc2e0 R15: 0000000080000280
[ 95.350020][ T5333] FS: 00007fe4d7c4c6c0(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000
[ 95.353865][ T5333] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 95.356829][ T5333] CR2: 00002000000017c0 CR3: 000000001f437000 CR4: 0000000000352ef0
[ 95.361379][ T5333] Call Trace:
[ 95.362917][ T5333]
[ 95.364272][ T5333] usb_start_wait_urb+0x13f/0x5b0
[ 95.366616][ T5333] ? __pfx_usb_start_wait_urb+0x10/0x10
[ 95.369192][ T5333] usb_control_msg+0x234/0x3e0
[ 95.371444][ T5333] gl861_ctrl_msg+0x207/0x420
[ 95.373667][ T5333] ? __pfx_gl861_ctrl_msg+0x10/0x10
[ 95.375964][ T5333] ? do_raw_spin_lock+0x12b/0x2f0
[ 95.378207][ T5333] gl861_i2c_master_xfer+0x439/0x6a0
[ 95.380766][ T5333] __i2c_transfer+0x7be/0x1fe0
[ 95.382555][ T5333] __i2c_smbus_xfer+0x1584/0x27d0
[ 95.384810][ T5333] ? lockdep_hardirqs_on+0x7a/0x110
[ 95.387018][ T5333] ? rt_mutex_slowlock+0x1f2/0x780
[ 95.389218][ T5333] ? __pfx___i2c_smbus_xfer+0x10/0x10
[ 95.391379][ T5333] ? rt_mutex_lock_nested+0x167/0x1c0
[ 95.393704][ T5333] i2c_smbus_xfer+0x1f4/0x310
[ 95.395769][ T5333] i2cdev_ioctl_smbus+0x1e7/0x700
[ 95.398019][ T5333] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10
[ 95.400570][ T5333] i2cdev_ioctl+0x615/0x880
[ 95.402983][ T5333] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 95.405509][ T5333] ? __fget_files+0x2a/0x420
[ 95.407574][ T5333] ? __fget_files+0x3a2/0x420
[ 95.409496][ T5333] ? bpf_lsm_file_ioctl+0x9/0x20
[ 95.411828][ T5333] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 95.414133][ T5333] __se_sys_ioctl+0xfc/0x170
[ 95.416219][ T5333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.418947][ T5333] do_syscall_64+0x174/0x580
[ 95.421000][ T5333] ? clear_bhb_loop+0x40/0x90
[ 95.423049][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.425639][ T5333] RIP: 0033:0x7fe4d6d9e019
[ 95.427650][ T5333] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 95.436081][ T5333] RSP: 002b:00007fe4d7c4bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 95.439445][ T5333] RAX: ffffffffffffffda RBX: 00007fe4d7025fa0 RCX: 00007fe4d6d9e019
[ 95.442938][ T5333] RDX: 0000200000000040 RSI: 0000000000000720 RDI: 0000000000000004
[ 95.446199][ T5333] RBP: 00007fe4d6e3500c R08: 0000000000000000 R09: 0000000000000000
[ 95.449772][ T5333] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 95.453198][ T5333] R13: 00007fe4d7026038 R14: 00007fe4d7025fa0 R15: 00007fff78c72a28
[ 95.456587][ T5333]
[ 95.457966][ T5333] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 95.460561][ T5333] CPU: 0 UID: 0 PID: 5333 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 95.463946][ T5333] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.468080][ T5333] Call Trace:
[ 95.469495][ T5333]
[ 95.470820][ T5333] vpanic+0x56c/0xa60
[ 95.472586][ T5333] ? __pfx__printk+0x10/0x10
[ 95.474620][ T5333] ? __pfx_vpanic+0x10/0x10
[ 95.476645][ T5333] ? is_bpf_text_address+0x292/0x2b0
[ 95.478961][ T5333] ? is_bpf_text_address+0x26/0x2b0
[ 95.481227][ T5333] panic+0xc5/0xd0
[ 95.482901][ T5333] ? __pfx_panic+0x10/0x10
[ 95.484889][ T5333] __warn+0x315/0x4c0
[ 95.486678][ T5333] ? usb_submit_urb+0x1057/0x18b0
[ 95.488860][ T5333] ? usb_submit_urb+0x1057/0x18b0
[ 95.491078][ T5333] __report_bug+0x276/0x570
[ 95.493098][ T5333] ? usb_submit_urb+0x1057/0x18b0
[ 95.495345][ T5333] ? __pfx___report_bug+0x10/0x10
[ 95.497572][ T5333] ? usb_submit_urb+0x1105/0x18b0
[ 95.499787][ T5333] ? usb_submit_urb+0x1100/0x18b0
[ 95.502004][ T5333] report_bug_entry+0x19a/0x290
[ 95.504210][ T5333] ? usb_submit_urb+0x1100/0x18b0
[ 95.506433][ T5333] ? usb_submit_urb+0x1105/0x18b0
[ 95.508649][ T5333] handle_bug+0xce/0x200
[ 95.510546][ T5333] exc_invalid_op+0x1a/0x50
[ 95.512582][ T5333] asm_exc_invalid_op+0x1a/0x20
[ 95.514708][ T5333] RIP: 0010:usb_submit_urb+0x1100/0x18b0
[ 95.517195][ T5333] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89
[ 95.524817][ T5333] RSP: 0018:ffffc9000e46f5f8 EFLAGS: 00010246
[ 95.527291][ T5333] RAX: 0000000000000000 RBX: ffff8880335dce00 RCX: 0000000080000280
[ 95.530661][ T5333] RDX: ffff888012bcc2e0 RSI: ffffffff8ca33060 RDI: ffffffff9065b520
[ 95.533990][ T5333] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000
[ 95.537216][ T5333] R10: ffffc9000e46f6e0 R11: fffff52001c8dee8 R12: 1ffff11002579990
[ 95.540353][ T5333] R13: ffff888012bccc80 R14: ffff888012bcc2e0 R15: 0000000080000280
[ 95.543358][ T5333] ? usb_submit_urb+0x1091/0x18b0
[ 95.545317][ T5333] usb_start_wait_urb+0x13f/0x5b0
[ 95.547398][ T5333] ? __pfx_usb_start_wait_urb+0x10/0x10
[ 95.549707][ T5333] usb_control_msg+0x234/0x3e0
[ 95.551714][ T5333] gl861_ctrl_msg+0x207/0x420
[ 95.553682][ T5333] ? __pfx_gl861_ctrl_msg+0x10/0x10
[ 95.555914][ T5333] ? do_raw_spin_lock+0x12b/0x2f0
[ 95.558177][ T5333] gl861_i2c_master_xfer+0x439/0x6a0
[ 95.560473][ T5333] __i2c_transfer+0x7be/0x1fe0
[ 95.562612][ T5333] __i2c_smbus_xfer+0x1584/0x27d0
[ 95.564893][ T5333] ? lockdep_hardirqs_on+0x7a/0x110
[ 95.567177][ T5333] ? rt_mutex_slowlock+0x1f2/0x780
[ 95.569413][ T5333] ? __pfx___i2c_smbus_xfer+0x10/0x10
[ 95.571777][ T5333] ? rt_mutex_lock_nested+0x167/0x1c0
[ 95.574093][ T5333] i2c_smbus_xfer+0x1f4/0x310
[ 95.576713][ T5333] i2cdev_ioctl_smbus+0x1e7/0x700
[ 95.579454][ T5333] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10
[ 95.582409][ T5333] i2cdev_ioctl+0x615/0x880
[ 95.584364][ T5333] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 95.586621][ T5333] ? __fget_files+0x2a/0x420
[ 95.588603][ T5333] ? __fget_files+0x3a2/0x420
[ 95.590587][ T5333] ? bpf_lsm_file_ioctl+0x9/0x20
[ 95.592574][ T5333] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 95.594645][ T5333] __se_sys_ioctl+0xfc/0x170
[ 95.596550][ T5333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.598959][ T5333] do_syscall_64+0x174/0x580
[ 95.600718][ T5333] ? clear_bhb_loop+0x40/0x90
[ 95.602460][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.604751][ T5333] RIP: 0033:0x7fe4d6d9e019
[ 95.606612][ T5333] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 95.614445][ T5333] RSP: 002b:00007fe4d7c4bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 95.617977][ T5333] RAX: ffffffffffffffda RBX: 00007fe4d7025fa0 RCX: 00007fe4d6d9e019
[ 95.621392][ T5333] RDX: 0000200000000040 RSI: 0000000000000720 RDI: 0000000000000004
[ 95.624854][ T5333] RBP: 00007fe4d6e3500c R08: 0000000000000000 R09: 0000000000000000
[ 95.628274][ T5333] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 95.631603][ T5333] R13: 00007fe4d7026038 R14: 00007fe4d7025fa0 R15: 00007fff78c72a28
[ 95.635107][ T5333]
[ 95.636876][ T5333] Kernel Offset: disabled
[ 95.638787][ T5333] Rebooting in 86400 seconds..