program:
r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x9, &(0x7f0000000800)=@framed={{0x18, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r0}, {}, {}, {0x7, 0x0, 0xb, 0x7, 0x0, 0x0, 0xff7f0000}}, @call={0x85, 0x0, 0x0, 0x8}]}, &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0)
syz_usb_control_io$uac1(r1, 0x0, 0x0)
syz_usb_control_io$printer(r1, 0x0, 0x0)
r2 = syz_open_dev$I2C(&(0x7f0000000040), 0x2, 0x20002)
ioctl$I2C_RDWR(r2, 0x707, &(0x7f0000000080)={&(0x7f0000000500)=[{0x8, 0x2a10, 0x0, 0x0}, {0xeb45, 0x5a00, 0x0, 0x0}], 0x2})
ioctl$I2C_SMBUS(r2, 0x720, &(0x7f0000000100)={0x1, 0x7, 0x1, &(0x7f00000000c0)={0x17, "f12c3ff439b1862299008d02bf00dc269211540ba89fd451613af4956714bca883"}})
mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file1\x00', 0x20)
mount$9p_virtio(&(0x7f00000001c0), &(0x7f00000002c0)='./file0\x00', &(0x7f00000004c0), 0x8017, &(0x7f0000000200)={'trans=virtio,', {[{@version_u}]}})
r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x175a978679bbbe1d, 0x80a0a1240160183d)
umount2(&(0x7f00000001c0)='./file0\x00', 0x1)
fstat(r3, 0x0)
ioctl$VIDIOC_QUERYCAP(0xffffffffffffffff, 0x80685600, &(0x7f0000000000))
[ 94.584093][ T4649] Bluetooth: hci0: command tx timeout
[ 94.918229][ T5300] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 95.068425][ T5300] usb 5-1: Using ep0 maxpacket: 16
[ 95.073035][ T5300] usb 5-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3
[ 95.084575][ T5300] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 95.088589][ T5300] usb 5-1: Product: syz
[ 95.090850][ T5300] usb 5-1: Manufacturer: syz
[ 95.093228][ T5300] usb 5-1: SerialNumber: syz
[ 95.108635][ T5300] usb 5-1: config 0 descriptor??
[ 95.520339][ T5300] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state.
[ 95.542084][ T5300] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[ 95.547123][ T5300] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T)
[ 95.552039][ T5300] usb 5-1: media controller created
[ 95.574388][ T5300] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[ 96.132676][ T5300] zl10353_read_register: readreg error (reg=127, ret==0)
[ 96.138326][ T5320] dtv5100: wlen = 0, aborting.
[ 96.142663][ T5300] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T'
[ 96.146558][ T5300] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected.
[ 96.168542][ T5321] ------------[ cut here ]------------
[ 96.168585][ T5321] usb 5-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0
[ 96.168625][ T5321] WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1057/0x18b0, CPU#0: syz.0.0/5321
[ 96.179452][ T5321] Modules linked in:
[ 96.181448][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 96.185227][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 96.189598][ T5321] RIP: 0010:usb_submit_urb+0x1100/0x18b0
[ 96.192080][ T5321] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89
[ 96.200230][ T5321] RSP: 0018:ffffc9000f1ef698 EFLAGS: 00010246
[ 96.203095][ T5321] RAX: 0000000000000000 RBX: ffff888034349a00 RCX: 0000000080000280
[ 96.206498][ T5321] RDX: ffff88803d8a3380 RSI: ffffffff8cc52500 RDI: ffffffff9087e9d0
[ 96.210255][ T5321] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000
[ 96.213734][ T5321] R10: ffffc9000f1ef780 R11: fffff52001e3defc R12: 1ffff11008566fa4
[ 96.217228][ T5321] R13: ffff888042b37d20 R14: ffff88803d8a3380 R15: 0000000080000280
[ 96.221135][ T5321] FS: 00007fe6182296c0(0000) GS:ffff88808c2d1000(0000) knlGS:0000000000000000
[ 96.225192][ T5321] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 96.228314][ T5321] CR2: 00007fe618207fe8 CR3: 0000000012dbc000 CR4: 0000000000352ef0
[ 96.231955][ T5321] Call Trace:
[ 96.233524][ T5321]
[ 96.234842][ T5321] usb_start_wait_urb+0x13f/0x5b0
[ 96.237090][ T5321] ? trace_kmalloc+0x2a/0xf0
[ 96.239291][ T5321] ? __pfx_usb_start_wait_urb+0x10/0x10
[ 96.241733][ T5321] usb_control_msg+0x234/0x3e0
[ 96.243867][ T5321] dtv5100_i2c_msg+0x231/0x2f0
[ 96.246130][ T5321] dtv5100_i2c_xfer+0x1a5/0x610
[ 96.248523][ T5321] __i2c_transfer+0x7bf/0x1fe0
[ 96.250778][ T5321] __i2c_smbus_xfer+0x159a/0x27e0
[ 96.253064][ T5321] ? rt_mutex_slowlock+0x1f2/0x780
[ 96.255388][ T5321] ? __pfx___i2c_smbus_xfer+0x10/0x10
[ 96.257887][ T5321] ? rt_mutex_lock_nested+0x167/0x1c0
[ 96.260471][ T5321] i2c_smbus_xfer+0x1f5/0x310
[ 96.262640][ T5321] i2cdev_ioctl_smbus+0x407/0x700
[ 96.264919][ T5321] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10
[ 96.267381][ T5321] i2cdev_ioctl+0x615/0x880
[ 96.269584][ T5321] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 96.271927][ T5321] ? __fget_files+0x2a/0x420
[ 96.274053][ T5321] ? __fget_files+0x3a2/0x420
[ 96.276175][ T5321] ? bpf_lsm_file_ioctl+0x9/0x20
[ 96.278511][ T5321] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 96.280847][ T5321] __se_sys_ioctl+0xfc/0x170
[ 96.282988][ T5321] do_syscall_64+0x166/0x520
[ 96.285110][ T5321] ? trace_irq_disable+0x3b/0x140
[ 96.287326][ T5321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 96.290137][ T5321] ? clear_bhb_loop+0x70/0xc0
[ 96.292299][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 96.295038][ T5321] RIP: 0033:0x7fe61739e159
[ 96.297008][ T5321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 96.305660][ T5321] RSP: 002b:00007fe618228fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 96.309533][ T5321] RAX: ffffffffffffffda RBX: 00007fe617626090 RCX: 00007fe61739e159
[ 96.314313][ T5321] RDX: 0000200000000100 RSI: 0000000000000720 RDI: 0000000000000006
[ 96.317890][ T5321] RBP: 00007fe617435024 R08: 0000000000000000 R09: 0000000000000000
[ 96.321749][ T5321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 96.325415][ T5321] R13: 00007fe617626128 R14: 00007fe617626090 R15: 00007ffc4e9307b8
[ 96.329026][ T5321]
[ 96.330478][ T5321] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 96.333656][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 96.337734][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 96.342273][ T5321] Call Trace:
[ 96.343738][ T5321]
[ 96.345088][ T5321] vpanic+0x56d/0xa60
[ 96.346922][ T5321] ? __pfx__printk+0x10/0x10
[ 96.349051][ T5321] ? __pfx_vpanic+0x10/0x10
[ 96.351157][ T5321] ? is_bpf_text_address+0x292/0x2b0
[ 96.353470][ T5321] ? is_bpf_text_address+0x26/0x2b0
[ 96.355833][ T5321] panic+0xc5/0xd0
[ 96.357603][ T5321] ? __pfx_panic+0x10/0x10
[ 96.359587][ T5321] __warn+0x315/0x4c0
[ 96.361408][ T5321] ? usb_submit_urb+0x1057/0x18b0
[ 96.363694][ T5321] ? usb_submit_urb+0x1057/0x18b0
[ 96.366001][ T5321] __report_bug+0x276/0x570
[ 96.368040][ T5321] ? usb_submit_urb+0x1057/0x18b0
[ 96.370248][ T5321] ? __pfx___report_bug+0x10/0x10
[ 96.372671][ T5321] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 96.375254][ T5321] ? kasan_save_track+0x4f/0x80
[ 96.377418][ T5321] report_bug_entry+0x19b/0x290
[ 96.379611][ T5321] ? usb_submit_urb+0x1100/0x18b0
[ 96.381932][ T5321] ? usb_submit_urb+0x1105/0x18b0
[ 96.384256][ T5321] handle_bug+0xce/0x200
[ 96.386188][ T5321] exc_invalid_op+0x1a/0x50
[ 96.388218][ T5321] asm_exc_invalid_op+0x1a/0x20
[ 96.390408][ T5321] RIP: 0010:usb_submit_urb+0x1100/0x18b0
[ 96.393072][ T5321] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89
[ 96.401461][ T5321] RSP: 0018:ffffc9000f1ef698 EFLAGS: 00010246
[ 96.404279][ T5321] RAX: 0000000000000000 RBX: ffff888034349a00 RCX: 0000000080000280
[ 96.407701][ T5321] RDX: ffff88803d8a3380 RSI: ffffffff8cc52500 RDI: ffffffff9087e9d0
[ 96.411293][ T5321] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000
[ 96.414847][ T5321] R10: ffffc9000f1ef780 R11: fffff52001e3defc R12: 1ffff11008566fa4
[ 96.418466][ T5321] R13: ffff888042b37d20 R14: ffff88803d8a3380 R15: 0000000080000280
[ 96.421952][ T5321] ? usb_submit_urb+0x1091/0x18b0
[ 96.424252][ T5321] usb_start_wait_urb+0x13f/0x5b0
[ 96.426647][ T5321] ? trace_kmalloc+0x2a/0xf0
[ 96.428753][ T5321] ? __pfx_usb_start_wait_urb+0x10/0x10
[ 96.431272][ T5321] usb_control_msg+0x234/0x3e0
[ 96.433456][ T5321] dtv5100_i2c_msg+0x231/0x2f0
[ 96.435715][ T5321] dtv5100_i2c_xfer+0x1a5/0x610
[ 96.437926][ T5321] __i2c_transfer+0x7bf/0x1fe0
[ 96.440140][ T5321] __i2c_smbus_xfer+0x159a/0x27e0
[ 96.442519][ T5321] ? rt_mutex_slowlock+0x1f2/0x780
[ 96.444833][ T5321] ? __pfx___i2c_smbus_xfer+0x10/0x10
[ 96.447249][ T5321] ? rt_mutex_lock_nested+0x167/0x1c0
[ 96.449667][ T5321] i2c_smbus_xfer+0x1f5/0x310
[ 96.451786][ T5321] i2cdev_ioctl_smbus+0x407/0x700
[ 96.454064][ T5321] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10
[ 96.456457][ T5321] i2cdev_ioctl+0x615/0x880
[ 96.458495][ T5321] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 96.460723][ T5321] ? __fget_files+0x2a/0x420
[ 96.462842][ T5321] ? __fget_files+0x3a2/0x420
[ 96.464945][ T5321] ? bpf_lsm_file_ioctl+0x9/0x20
[ 96.467188][ T5321] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 96.469412][ T5321] __se_sys_ioctl+0xfc/0x170
[ 96.471496][ T5321] do_syscall_64+0x166/0x520
[ 96.473630][ T5321] ? trace_irq_disable+0x3b/0x140
[ 96.475935][ T5321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 96.478650][ T5321] ? clear_bhb_loop+0x70/0xc0
[ 96.480674][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 96.483234][ T5321] RIP: 0033:0x7fe61739e159
[ 96.485474][ T5321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 96.494189][ T5321] RSP: 002b:00007fe618228fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 96.497750][ T5321] RAX: ffffffffffffffda RBX: 00007fe617626090 RCX: 00007fe61739e159
[ 96.501190][ T5321] RDX: 0000200000000100 RSI: 0000000000000720 RDI: 0000000000000006
[ 96.504659][ T5321] RBP: 00007fe617435024 R08: 0000000000000000 R09: 0000000000000000
[ 96.508037][ T5321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 96.511491][ T5321] R13: 00007fe617626128 R14: 00007fe617626090 R15: 00007ffc4e9307b8
[ 96.515026][ T5321]
[ 96.516793][ T5321] Kernel Offset: disabled
[ 96.518711][ T5321] Rebooting in 86400 seconds..