program: r0 = socket$inet6(0xa, 0x2, 0x0) close(0x3) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) r3 = syz_open_dev$I2C(&(0x7f00000000c0), 0xc, 0x88000) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, 0x0, &(0x7f0000000600)={0x18, &(0x7f0000000400)={0x20, 0x16}, 0x0, 0x0, 0x0, 0x0}) ioctl$I2C_SMBUS(r3, 0x720, &(0x7f0000000140)={0x1, 0x6, 0x1, &(0x7f0000000100)={0x12, "3ac071ffbc8cd0d684737d99bb8bd238954c9a216d398df0f558125211b40c65fd"}}) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x3000080, &(0x7f00000003c0)={[{@lazytime}, {@nombcache}, {@nojournal_checksum}, {@data_journal}]}, 0x6, 0x4d1, &(0x7f0000000640)="$eJzs3c9vE9kdAPDv2ASSkJYf7aFwAFSQaIuIIRFJVHHhVKkSbQWHHlGamIjGiaPYoSTKIUg9tPeqReqp6oE/oOpel9Me0d52Oe2eV0K72bDRSovklcd2CEkcvGyItZnPRxr5zZtovu/Z+j6P38xkAsisc83XgYh4GhHHGqtParVabeMPzjVe1leXJ+pLErXa7c+TSCJibXV5orWvpPl6NCJWIqI3Im79JuJPyfa4lcWl6fFSqTjfXC9UZ+YKlcWly/dmxqeKU8XZ4dGh0bGRkdGxa3vW178+uPH7f35142///ejxJ39O/n8hafY74vyZDwuv+rGXGl3viROb6g5FxPV3EawL8s3+9HW7IbyV+uf3k3oGpPl/LPLppwlkQf17/mXtSLvNKzXgwMqlx8BJbjAiGuVcbnCwcQz/0+jPlcqV6qW75YXZycax8vHoyd29Vypeaf5WOB49SX39alp+tT4UEQ83rQ9HpMfA/8j3peuDE+XS5P4OdcAWR7fk/4t8I/+BjPCTH7JL/kN2yX/IrrfL/x3O6gM/OL7/IbvkP2SX/Ifskv+QXY38P9ztZgBd4Psfskv+Qyb94ebN+lJbb97HP3l/cWG6fP/yZLEyPTizMDE4UZ6fG5wql6fSe3Zm3rS/Urk8NxyzCw8K1WKlWqgsLt2ZKS/MVu+k9/XfKfbsS6+ATpw4++RZEhErv+5Ll9g0ESBX4WCr1ZLo9j3IQHfkuz0AAV1j6g+yy2984E038/W22zC3920B9keu2w0AuubiKef/IKu+w/z/yrtsB7D/zP9DdjnGB8z/Q/aY/4fsGmjz/K8fbXp215WI+HFEfJzvOdJ61hdwEOQ+S5rH/xePXRjYuvVw8nV6iuBwRPzl37f/9WC8Wp2/Wq//YqO++qhZP9SN9gOdauVpK48BgOxaW12eaC2NmrYz/nvq+Y3GRQj1uOvNpbHlUHNusjc9R9m/lrx2rUKyR9curDyMiJ9FvFhdnmgtrQiN55033of+tfy2+Cebr0ljF2l7D6XPTd+f+Kc2xT+zKf7p7/2uQDY8qY8/V3Ya/3JpTsdG/r0+/gzs0bUTrfFvfdv4l9sY//Jtxr+zHca4XvjjWtv4DyNO7xi/Fa83jbU1fr1tFzuM/8Hfv3zablvtP4397BS/pV4qVGfmCpXFpcvp/5GbKs4Ojw6Njo2MjI5dK6Rz1IXWTPV2z37+8v3d+t/fJv5u/a/X/bLD/n/z6L1L53aJ/4vzO3/+J3eJ3xcRv+ow/m//9+mtdtvq8Sfb9D+3S/x63XCH8W8/fv67Dv8UANgHlcWl6fFSqTivoKCgsFHo9sgEvGuvkr7bLQEAAAAAAAAAAAA6tR+XE3e7jwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB8G3AQAA//8yE90j") r4 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) r5 = openat$cgroup_subtree(r4, &(0x7f00000001c0), 0x2, 0x0) write$cgroup_subtree(r5, &(0x7f0000000080)=ANY=[@ANYBLOB='\a\x00\x00\x00\x00\x00\x00\x00'], 0x8) io_setup(0xf, &(0x7f0000002a40)=0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x2c2701, 0x0) pipe(&(0x7f0000000240)) r8 = openat$cgroup_int(r7, &(0x7f00000000c0)='cpuset.cpus\x00', 0x2, 0x0) io_submit(r6, 0x1, &(0x7f0000002d00)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0xd6a, r8, &(0x7f0000000280)='-', 0x1, 0x9}]) setsockopt$inet6_udp_int(r0, 0x11, 0x68, &(0x7f0000000080)=0xa40, 0x4) recvmmsg(r1, &(0x7f00000026c0)=[{{0x0, 0x0, 0x0}, 0x4}], 0x1, 0x0, 0x0) r9 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_udp_int(r9, 0x11, 0x67, &(0x7f0000000180)=0x7f, 0x4) getpid() connect$inet6(r9, &(0x7f00000001c0)={0xa, 0x4e23, 0x3, @mcast1, 0x2}, 0x1c) connect$inet6(r9, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c) write(r9, &(0x7f0000000300)="89ba41c97928dec7cec15a160d3dba2553b519a795020072aed129d4b5247c983455b3d757e8b2333a64d9abf416fd83f942661c47bcdf71f7d07ba20d03474a4a4bce636ea8d2b882b2b49ef18e2a96e41f206d930eda2769c5ee6d5e3d541ce9a21c3ce5cb5fbdad9a45de0000000000000000000000000000f1d3b9821c18", 0x80) r10 = syz_open_procfs$namespace(0x0, &(0x7f0000001380)='ns/cgroup\x00') open_by_handle_at(r10, &(0x7f0000000040)=@nfs={0x90, 0x24, {0x3, 0x3b, 0x8001, 0x80, "279d665a18642608a15cdc457c0379f88abf52feedaebc95b4b5a2603f133b52fc9edef89abf6bfcf88934d2321f0fd0712992e51e457916c486fb6908592bf34b9cc63a773ee8359d8bdf6201beca58024ea6349addb63f62493e8f3f301abe42be8c0bd61034f621e582c38f73c92bbef3eb5e93080d82ab7e68098a4172c3"}}, 0x0) [ 75.112856][ T5280] Bluetooth: hci0: command tx timeout [ 75.426533][ T5315] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 75.576819][ T5315] usb 5-1: Using ep0 maxpacket: 16 [ 75.585455][ T5315] usb 5-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 75.589419][ T5315] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 75.592956][ T5315] usb 5-1: Product: syz [ 75.595134][ T5315] usb 5-1: Manufacturer: syz [ 75.597913][ T5315] usb 5-1: SerialNumber: syz [ 75.605602][ T5315] usb 5-1: config 0 descriptor?? [ 76.015356][ T5315] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 76.029475][ T5315] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 76.034610][ T5315] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 76.041140][ T5315] usb 5-1: media controller created [ 76.062450][ T5315] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 76.220544][ T5315] zl10353_read_register: readreg error (reg=127, ret==0) [ 76.227320][ T5315] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 76.235199][ T5315] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 76.519746][ T1331] ieee802154 phy0 wpan0: encryption failed: -22 [ 76.522980][ T1331] ieee802154 phy1 wpan1: encryption failed: -22 [ 76.587514][ T5318] ------------[ cut here ]------------ [ 76.590273][ T5318] usb 5-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0 [ 76.594177][ T5318] WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1057/0x18b0, CPU#0: syz.0.0/5318 [ 76.598881][ T5318] Modules linked in: [ 76.601322][ T5318] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 76.605083][ T5318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 76.609350][ T5318] RIP: 0010:usb_submit_urb+0x1100/0x18b0 [ 76.611748][ T5318] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89 [ 76.619686][ T5318] RSP: 0018:ffffc9000e767698 EFLAGS: 00010246 [ 76.622862][ T5318] RAX: 0000000000000000 RBX: ffff8880120cf700 RCX: 0000000080000280 [ 76.626432][ T5318] RDX: ffff88803ef147e0 RSI: ffffffff8ca32720 RDI: ffffffff90659690 [ 76.629860][ T5318] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000 [ 76.633265][ T5318] R10: ffffc9000e767780 R11: fffff52001cecefc R12: 1ffff11008896ad0 [ 76.636867][ T5318] R13: ffff8880444b5680 R14: ffff88803ef147e0 R15: 0000000080000280 [ 76.640425][ T5318] FS: 00007fde37b096c0(0000) GS:ffff88808c54a000(0000) knlGS:0000000000000000 [ 76.644308][ T5318] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 76.647309][ T5318] CR2: 00005561c4843308 CR3: 0000000042e2b000 CR4: 0000000000352ef0 [ 76.650600][ T5318] Call Trace: [ 76.652059][ T5318] [ 76.653362][ T5318] usb_start_wait_urb+0x13f/0x5b0 [ 76.655635][ T5318] ? rcu_is_watching+0x15/0xb0 [ 76.657927][ T5318] ? trace_kmalloc+0x2a/0xf0 [ 76.660414][ T5318] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 76.663687][ T5318] usb_control_msg+0x234/0x3e0 [ 76.666057][ T5318] dtv5100_i2c_msg+0x231/0x2f0 [ 76.668511][ T5318] dtv5100_i2c_xfer+0x1a5/0x610 [ 76.670823][ T5318] ? kasan_save_track+0x4f/0x80 [ 76.673204][ T5318] ? kasan_save_free_info+0x40/0x50 [ 76.675663][ T5318] ? __se_sys_ioctl+0x47/0x170 [ 76.678315][ T5318] __i2c_transfer+0x7be/0x1fe0 [ 76.680639][ T5318] __i2c_smbus_xfer+0x1584/0x27d0 [ 76.683081][ T5318] ? __pfx___i2c_smbus_xfer+0x10/0x10 [ 76.685525][ T5318] ? lockdep_hardirqs_on+0x7a/0x110 [ 76.688028][ T5318] ? rt_mutex_lock_nested+0x156/0x1c0 [ 76.690508][ T5318] i2c_smbus_xfer+0x1f4/0x310 [ 76.692673][ T5318] i2cdev_ioctl_smbus+0x407/0x700 [ 76.695006][ T5318] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10 [ 76.697659][ T5318] i2cdev_ioctl+0x615/0x880 [ 76.699799][ T5318] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 76.701957][ T5318] ? __fget_files+0x2a/0x420 [ 76.703850][ T5318] ? __fget_files+0x3a2/0x420 [ 76.705715][ T5318] ? bpf_lsm_file_ioctl+0x9/0x20 [ 76.707979][ T5318] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 76.710309][ T5318] __se_sys_ioctl+0xfc/0x170 [ 76.712493][ T5318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.715474][ T5318] do_syscall_64+0x174/0x580 [ 76.717667][ T5318] ? trace_irq_disable+0x3b/0x140 [ 76.719705][ T5318] ? clear_bhb_loop+0x40/0x90 [ 76.721655][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.724133][ T5318] RIP: 0033:0x7fde36b9de59 [ 76.725990][ T5318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 76.735155][ T5318] RSP: 002b:00007fde37b08fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 76.738546][ T5318] RAX: ffffffffffffffda RBX: 00007fde36e26090 RCX: 00007fde36b9de59 [ 76.741661][ T5318] RDX: 0000200000000140 RSI: 0000000000000720 RDI: 0000000000000005 [ 76.745087][ T5318] RBP: 00007fde36c33e6f R08: 0000000000000000 R09: 0000000000000000 [ 76.748572][ T5318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 76.751949][ T5318] R13: 00007fde36e26128 R14: 00007fde36e26090 R15: 00007ffe3f70a858 [ 76.755429][ T5318] [ 76.757003][ T5318] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 76.759961][ T5318] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 76.763619][ T5318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 76.768261][ T5318] Call Trace: [ 76.769794][ T5318] [ 76.771085][ T5318] vpanic+0x56c/0xa60 [ 76.772869][ T5318] ? __pfx__printk+0x10/0x10 [ 76.774895][ T5318] ? __pfx_vpanic+0x10/0x10 [ 76.776932][ T5318] ? is_bpf_text_address+0x292/0x2b0 [ 76.779151][ T5318] ? is_bpf_text_address+0x26/0x2b0 [ 76.781250][ T5318] panic+0xc5/0xd0 [ 76.782865][ T5318] ? __pfx_panic+0x10/0x10 [ 76.784820][ T5318] __warn+0x315/0x4c0 [ 76.786607][ T5318] ? usb_submit_urb+0x1057/0x18b0 [ 76.788762][ T5318] ? usb_submit_urb+0x1057/0x18b0 [ 76.790906][ T5318] __report_bug+0x276/0x570 [ 76.792888][ T5318] ? usb_submit_urb+0x1057/0x18b0 [ 76.795120][ T5318] ? __pfx___report_bug+0x10/0x10 [ 76.797344][ T5318] ? __kmalloc_noprof+0x1ad/0x720 [ 76.799561][ T5318] ? kasan_save_track+0x4f/0x80 [ 76.801699][ T5318] ? kasan_save_track+0x3e/0x80 [ 76.803820][ T5318] ? __kasan_kmalloc+0x93/0xb0 [ 76.805885][ T5318] report_bug_entry+0x19a/0x290 [ 76.807978][ T5318] ? usb_submit_urb+0x1100/0x18b0 [ 76.810115][ T5318] ? usb_submit_urb+0x1105/0x18b0 [ 76.812276][ T5318] handle_bug+0xce/0x200 [ 76.814196][ T5318] exc_invalid_op+0x1a/0x50 [ 76.816165][ T5318] asm_exc_invalid_op+0x1a/0x20 [ 76.818280][ T5318] RIP: 0010:usb_submit_urb+0x1100/0x18b0 [ 76.820631][ T5318] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89 [ 76.828473][ T5318] RSP: 0018:ffffc9000e767698 EFLAGS: 00010246 [ 76.830809][ T5318] RAX: 0000000000000000 RBX: ffff8880120cf700 RCX: 0000000080000280 [ 76.833771][ T5318] RDX: ffff88803ef147e0 RSI: ffffffff8ca32720 RDI: ffffffff90659690 [ 76.836796][ T5318] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000 [ 76.839970][ T5318] R10: ffffc9000e767780 R11: fffff52001cecefc R12: 1ffff11008896ad0 [ 76.843534][ T5318] R13: ffff8880444b5680 R14: ffff88803ef147e0 R15: 0000000080000280 [ 76.846972][ T5318] ? usb_submit_urb+0x1091/0x18b0 [ 76.849005][ T5318] usb_start_wait_urb+0x13f/0x5b0 [ 76.850940][ T5318] ? rcu_is_watching+0x15/0xb0 [ 76.852728][ T5318] ? trace_kmalloc+0x2a/0xf0 [ 76.854616][ T5318] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 76.856830][ T5318] usb_control_msg+0x234/0x3e0 [ 76.858792][ T5318] dtv5100_i2c_msg+0x231/0x2f0 [ 76.860885][ T5318] dtv5100_i2c_xfer+0x1a5/0x610 [ 76.863104][ T5318] ? kasan_save_track+0x4f/0x80 [ 76.864943][ T5318] ? kasan_save_free_info+0x40/0x50 [ 76.867082][ T5318] ? __se_sys_ioctl+0x47/0x170 [ 76.868903][ T5318] __i2c_transfer+0x7be/0x1fe0 [ 76.870797][ T5318] __i2c_smbus_xfer+0x1584/0x27d0 [ 76.872735][ T5318] ? __pfx___i2c_smbus_xfer+0x10/0x10 [ 76.874770][ T5318] ? lockdep_hardirqs_on+0x7a/0x110 [ 76.876698][ T5318] ? rt_mutex_lock_nested+0x156/0x1c0 [ 76.878687][ T5318] i2c_smbus_xfer+0x1f4/0x310 [ 76.880470][ T5318] i2cdev_ioctl_smbus+0x407/0x700 [ 76.882357][ T5318] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10 [ 76.884590][ T5318] i2cdev_ioctl+0x615/0x880 [ 76.886352][ T5318] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 76.888571][ T5318] ? __fget_files+0x2a/0x420 [ 76.890581][ T5318] ? __fget_files+0x3a2/0x420 [ 76.892781][ T5318] ? bpf_lsm_file_ioctl+0x9/0x20 [ 76.894908][ T5318] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 76.897088][ T5318] __se_sys_ioctl+0xfc/0x170 [ 76.898959][ T5318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.901331][ T5318] do_syscall_64+0x174/0x580 [ 76.903274][ T5318] ? trace_irq_disable+0x3b/0x140 [ 76.905430][ T5318] ? clear_bhb_loop+0x40/0x90 [ 76.907477][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.909966][ T5318] RIP: 0033:0x7fde36b9de59 [ 76.911943][ T5318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 76.919810][ T5318] RSP: 002b:00007fde37b08fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 76.923113][ T5318] RAX: ffffffffffffffda RBX: 00007fde36e26090 RCX: 00007fde36b9de59 [ 76.926458][ T5318] RDX: 0000200000000140 RSI: 0000000000000720 RDI: 0000000000000005 [ 76.929993][ T5318] RBP: 00007fde36c33e6f R08: 0000000000000000 R09: 0000000000000000 [ 76.933277][ T5318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 76.936584][ T5318] R13: 00007fde36e26128 R14: 00007fde36e26090 R15: 00007ffe3f70a858 [ 76.939819][ T5318] [ 76.941369][ T5318] Kernel Offset: disabled [ 76.943131][ T5318] Rebooting in 86400 seconds..