program: pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_CM_ID_GET(r3, &(0x7f0000013c00)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="e1b5e8ee37720de96a1ce6aa3ca69e7d28e0ff01001470"], 0x28}, 0x1, 0x0, 0x0, 0x4}, 0xd4) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000000)=0x10000) r4 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0) syz_usb_control_io$hid(r4, &(0x7f0000000340)={0x24, 0x0, &(0x7f0000000180)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) r5 = syz_open_dev$I2C(&(0x7f00000000c0), 0xc, 0x88000) ioctl$I2C_SMBUS(r5, 0x720, &(0x7f0000001800)={0x1, 0xd, 0x0, &(0x7f0000000240)={0x1, "4ec0191e5bb41b08c198884329f6dd0711762717c44bc7c9b1cc22a10010115d6d"}}) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe2, 0x0) [ 93.228166][ T4639] Bluetooth: hci0: command tx timeout [ 93.243830][ T806] cfg80211: failed to load regulatory.db [ 93.619438][ T5293] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 93.769891][ T5293] usb 5-1: Using ep0 maxpacket: 16 [ 93.774445][ T5293] usb 5-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 93.785804][ T5293] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 93.789932][ T5293] usb 5-1: Product: syz [ 93.791796][ T5293] usb 5-1: Manufacturer: syz [ 93.793695][ T5293] usb 5-1: SerialNumber: syz [ 94.027753][ T5293] usb 5-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 94.051777][ T5293] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 94.057204][ T5293] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 94.062535][ T5293] usb 5-1: media controller created [ 94.084851][ T5293] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 94.329965][ T5293] zl10353_read_register: readreg error (reg=127, ret==-110) [ 94.336086][ T5317] ------------[ cut here ]------------ [ 94.338933][ T5317] usb 5-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0 [ 94.342528][ T5317] WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1057/0x18b0, CPU#0: syz.0.0/5317 [ 94.346717][ T5317] Modules linked in: [ 94.350703][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.354492][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.358837][ T5317] RIP: 0010:usb_submit_urb+0x1100/0x18b0 [ 94.361424][ T5317] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89 [ 94.370142][ T5317] RSP: 0018:ffffc9000e8075f8 EFLAGS: 00010246 [ 94.373130][ T5317] RAX: 0000000000000000 RBX: ffff88803354fc00 RCX: 0000000080000280 [ 94.376497][ T5317] RDX: ffff88803e250f20 RSI: ffffffff8cc45a20 RDI: ffffffff90869e40 [ 94.379790][ T5317] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000 [ 94.383102][ T5317] R10: ffffc9000e8076e0 R11: fffff52001d00ee8 R12: 1ffff110085aba50 [ 94.386436][ T5317] R13: ffff888042d5d280 R14: ffff88803e250f20 R15: 0000000080000280 [ 94.389986][ T5317] FS: 00007fceccb1c6c0(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000 [ 94.393599][ T5317] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.396345][ T5317] CR2: 000020000001f000 CR3: 000000003f94c000 CR4: 0000000000352ef0 [ 94.400145][ T5317] Call Trace: [ 94.401779][ T5317] [ 94.403253][ T5317] usb_start_wait_urb+0x13f/0x5b0 [ 94.405512][ T5317] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 94.408006][ T5317] usb_control_msg+0x234/0x3e0 [ 94.410272][ T5317] gl861_ctrl_msg+0x207/0x420 [ 94.412189][ T5317] ? __pfx_gl861_ctrl_msg+0x10/0x10 [ 94.414267][ T5317] ? do_raw_spin_lock+0x12b/0x2f0 [ 94.416403][ T5317] gl861_i2c_master_xfer+0x439/0x6a0 [ 94.418443][ T5317] __i2c_transfer+0x7bf/0x1fe0 [ 94.420389][ T5317] __i2c_smbus_xfer+0x159a/0x27e0 [ 94.422421][ T5317] ? rt_mutex_slowlock+0x1f2/0x780 [ 94.424662][ T5317] ? __pfx___i2c_smbus_xfer+0x10/0x10 [ 94.426904][ T5317] ? rt_mutex_lock_nested+0x167/0x1c0 [ 94.429004][ T5317] i2c_smbus_xfer+0x1f5/0x310 [ 94.431141][ T5317] i2cdev_ioctl_smbus+0x1e7/0x700 [ 94.433317][ T5317] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10 [ 94.435641][ T5317] i2cdev_ioctl+0x615/0x880 [ 94.437527][ T5317] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 94.439733][ T5317] ? __fget_files+0x2a/0x420 [ 94.441875][ T5317] ? __fget_files+0x3a2/0x420 [ 94.443971][ T5317] ? bpf_lsm_file_ioctl+0x9/0x20 [ 94.446099][ T5317] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 94.448264][ T5317] __se_sys_ioctl+0xfc/0x170 [ 94.450355][ T5317] do_syscall_64+0x166/0x520 [ 94.452417][ T5317] ? trace_irq_disable+0x3b/0x140 [ 94.454844][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.457529][ T5317] ? clear_bhb_loop+0x70/0xc0 [ 94.459527][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.461985][ T5317] RIP: 0033:0x7fcecbb9e0d9 [ 94.463713][ T5317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.471940][ T5317] RSP: 002b:00007fceccb1bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 94.475590][ T5317] RAX: ffffffffffffffda RBX: 00007fcecbe25fa0 RCX: 00007fcecbb9e0d9 [ 94.478981][ T5317] RDX: 0000200000001800 RSI: 0000000000000720 RDI: 0000000000000007 [ 94.482788][ T5317] RBP: 00007fcecbc35024 R08: 0000000000000000 R09: 0000000000000000 [ 94.486190][ T5317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.489723][ T5317] R13: 00007fcecbe26038 R14: 00007fcecbe25fa0 R15: 00007fffdca2a278 [ 94.493213][ T5317] [ 94.494599][ T5317] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 94.497663][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.501370][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.505703][ T5317] Call Trace: [ 94.507162][ T5317] [ 94.508459][ T5317] vpanic+0x56d/0xa60 [ 94.510167][ T5317] ? __pfx__printk+0x10/0x10 [ 94.512166][ T5317] ? __pfx_vpanic+0x10/0x10 [ 94.514089][ T5317] ? is_bpf_text_address+0x292/0x2b0 [ 94.516277][ T5317] ? is_bpf_text_address+0x26/0x2b0 [ 94.518211][ T5317] panic+0xc5/0xd0 [ 94.519834][ T5317] ? __pfx_panic+0x10/0x10 [ 94.521788][ T5317] __warn+0x315/0x4c0 [ 94.523423][ T5317] ? usb_submit_urb+0x1057/0x18b0 [ 94.525503][ T5317] ? usb_submit_urb+0x1057/0x18b0 [ 94.527646][ T5317] __report_bug+0x276/0x570 [ 94.529513][ T5317] ? usb_submit_urb+0x1057/0x18b0 [ 94.531615][ T5317] ? __pfx___report_bug+0x10/0x10 [ 94.533779][ T5317] ? usb_submit_urb+0x1105/0x18b0 [ 94.535942][ T5317] ? usb_submit_urb+0x1100/0x18b0 [ 94.538084][ T5317] report_bug_entry+0x19b/0x290 [ 94.540157][ T5317] ? usb_submit_urb+0x1100/0x18b0 [ 94.542275][ T5317] ? usb_submit_urb+0x1105/0x18b0 [ 94.544510][ T5317] handle_bug+0xce/0x200 [ 94.546431][ T5317] exc_invalid_op+0x1a/0x50 [ 94.548378][ T5317] asm_exc_invalid_op+0x1a/0x20 [ 94.550459][ T5317] RIP: 0010:usb_submit_urb+0x1100/0x18b0 [ 94.552835][ T5317] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89 [ 94.560460][ T5317] RSP: 0018:ffffc9000e8075f8 EFLAGS: 00010246 [ 94.562901][ T5317] RAX: 0000000000000000 RBX: ffff88803354fc00 RCX: 0000000080000280 [ 94.566063][ T5317] RDX: ffff88803e250f20 RSI: ffffffff8cc45a20 RDI: ffffffff90869e40 [ 94.569527][ T5317] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000 [ 94.572722][ T5317] R10: ffffc9000e8076e0 R11: fffff52001d00ee8 R12: 1ffff110085aba50 [ 94.575836][ T5317] R13: ffff888042d5d280 R14: ffff88803e250f20 R15: 0000000080000280 [ 94.578822][ T5317] ? usb_submit_urb+0x1091/0x18b0 [ 94.580843][ T5317] usb_start_wait_urb+0x13f/0x5b0 [ 94.582842][ T5317] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 94.585046][ T5317] usb_control_msg+0x234/0x3e0 [ 94.587031][ T5317] gl861_ctrl_msg+0x207/0x420 [ 94.589166][ T5317] ? __pfx_gl861_ctrl_msg+0x10/0x10 [ 94.591611][ T5317] ? do_raw_spin_lock+0x12b/0x2f0 [ 94.594403][ T5317] gl861_i2c_master_xfer+0x439/0x6a0 [ 94.597327][ T5317] __i2c_transfer+0x7bf/0x1fe0 [ 94.599616][ T5317] __i2c_smbus_xfer+0x159a/0x27e0 [ 94.602184][ T5317] ? rt_mutex_slowlock+0x1f2/0x780 [ 94.604567][ T5317] ? __pfx___i2c_smbus_xfer+0x10/0x10 [ 94.607622][ T5317] ? rt_mutex_lock_nested+0x167/0x1c0 [ 94.609990][ T5317] i2c_smbus_xfer+0x1f5/0x310 [ 94.612021][ T5317] i2cdev_ioctl_smbus+0x1e7/0x700 [ 94.614359][ T5317] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10 [ 94.616638][ T5317] i2cdev_ioctl+0x615/0x880 [ 94.618461][ T5317] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 94.620712][ T5317] ? __fget_files+0x2a/0x420 [ 94.622593][ T5317] ? __fget_files+0x3a2/0x420 [ 94.624456][ T5317] ? bpf_lsm_file_ioctl+0x9/0x20 [ 94.626569][ T5317] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 94.628798][ T5317] __se_sys_ioctl+0xfc/0x170 [ 94.630802][ T5317] do_syscall_64+0x166/0x520 [ 94.632830][ T5317] ? trace_irq_disable+0x3b/0x140 [ 94.634976][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.637552][ T5317] ? clear_bhb_loop+0x70/0xc0 [ 94.639624][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.642152][ T5317] RIP: 0033:0x7fcecbb9e0d9 [ 94.644034][ T5317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.651830][ T5317] RSP: 002b:00007fceccb1bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 94.655317][ T5317] RAX: ffffffffffffffda RBX: 00007fcecbe25fa0 RCX: 00007fcecbb9e0d9 [ 94.658629][ T5317] RDX: 0000200000001800 RSI: 0000000000000720 RDI: 0000000000000007 [ 94.662183][ T5317] RBP: 00007fcecbc35024 R08: 0000000000000000 R09: 0000000000000000 [ 94.665536][ T5317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.668825][ T5317] R13: 00007fcecbe26038 R14: 00007fcecbe25fa0 R15: 00007fffdca2a278 [ 94.672073][ T5317] [ 94.673827][ T5317] Kernel Offset: disabled [ 94.675825][ T5317] Rebooting in 86400 seconds..