program: mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x4}, 0xe) listen(r0, 0x3) accept4$bt_l2cap(r0, 0x0, 0x0, 0x800) landlock_restrict_self(0xffffffffffffffff, 0xc) r1 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) r2 = syz_open_dev$I2C(&(0x7f00000000c0), 0xc, 0x88000) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000600)={0x18, &(0x7f0000000400)={0x20, 0x16}, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="3400000011000100000000000000000007000000", @ANYRES32=r5, @ANYBLOB="00000000a400050014001a80100005800c00048008000100"], 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) ioctl$I2C_SMBUS(r2, 0x720, &(0x7f0000000140)={0x1, 0xfa, 0x1, &(0x7f0000000100)={0xe, "3ac071ffbc38954c9a216d398df0f558125211b40c65fd00"}}) r6 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r6, &(0x7f0000000000)='7', 0x1) openat(0xffffffffffffff9c, &(0x7f0000000300)='.\x00', 0x100, 0x62) [ 93.902907][ T4638] Bluetooth: hci0: command tx timeout [ 94.296463][ T5291] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 94.446587][ T5291] usb 5-1: Using ep0 maxpacket: 16 [ 94.450404][ T5291] usb 5-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 94.459760][ T5291] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 94.463006][ T5291] usb 5-1: Product: syz [ 94.464741][ T5291] usb 5-1: Manufacturer: syz [ 94.467841][ T5291] usb 5-1: SerialNumber: syz [ 94.481546][ T5291] usb 5-1: config 0 descriptor?? [ 94.893316][ T5291] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 94.930999][ T5291] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 94.940748][ T5291] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 94.944297][ T5291] usb 5-1: media controller created [ 94.964961][ T5291] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 95.094817][ T5291] zl10353_read_register: readreg error (reg=127, ret==0) [ 95.097979][ T5291] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 95.101524][ T5291] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 95.468017][ T5320] ------------[ cut here ]------------ [ 95.471067][ T5320] usb 5-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0 [ 95.474838][ T5320] WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1057/0x18b0, CPU#0: syz.0.0/5320 [ 95.479282][ T5320] Modules linked in: [ 95.481838][ T5320] CPU: 0 UID: 0 PID: 5320 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.485502][ T5320] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.489752][ T5320] RIP: 0010:usb_submit_urb+0x1100/0x18b0 [ 95.492270][ T5320] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89 [ 95.500414][ T5320] RSP: 0018:ffffc9000e137698 EFLAGS: 00010246 [ 95.503343][ T5320] RAX: 0000000000000000 RBX: ffff888043d73000 RCX: 0000000080000280 [ 95.506953][ T5320] RDX: ffff888042d9d900 RSI: ffffffff8cc45a20 RDI: ffffffff90869e40 [ 95.510059][ T5320] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000 [ 95.513102][ T5320] R10: ffffc9000e137780 R11: fffff52001c26efc R12: 1ffff1100b655c00 [ 95.516126][ T5320] R13: ffff88805b2ae000 R14: ffff888042d9d900 R15: 0000000080000280 [ 95.519049][ T5320] FS: 00007f51fd7876c0(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000 [ 95.522445][ T5320] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.525148][ T5320] CR2: 00007f51fd786fe8 CR3: 000000004379c000 CR4: 0000000000352ef0 [ 95.529363][ T5320] Call Trace: [ 95.530833][ T5320] [ 95.532121][ T5320] usb_start_wait_urb+0x13f/0x5b0 [ 95.534320][ T5320] ? rcu_is_watching+0x16/0xb0 [ 95.536272][ T5320] ? trace_kmalloc+0x2a/0xf0 [ 95.538456][ T5320] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 95.540794][ T5320] usb_control_msg+0x234/0x3e0 [ 95.542794][ T5320] dtv5100_i2c_msg+0x231/0x2f0 [ 95.544811][ T5320] dtv5100_i2c_xfer+0x1a5/0x610 [ 95.547035][ T5320] ? kasan_save_track+0x4f/0x80 [ 95.549072][ T5320] ? kasan_save_free_info+0x40/0x50 [ 95.551084][ T5320] ? __se_sys_ioctl+0x47/0x170 [ 95.553192][ T5320] __i2c_transfer+0x7bf/0x1fe0 [ 95.555197][ T5320] __i2c_smbus_xfer+0x159a/0x27e0 [ 95.557535][ T5320] ? __pfx___i2c_smbus_xfer+0x10/0x10 [ 95.559902][ T5320] ? rt_mutex_lock_nested+0x156/0x1c0 [ 95.562167][ T5320] i2c_smbus_xfer+0x1f5/0x310 [ 95.564166][ T5320] i2cdev_ioctl_smbus+0x407/0x700 [ 95.566471][ T5320] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10 [ 95.568834][ T5320] i2cdev_ioctl+0x615/0x880 [ 95.570739][ T5320] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 95.572747][ T5320] ? __fget_files+0x2a/0x420 [ 95.574695][ T5320] ? __fget_files+0x3a2/0x420 [ 95.576780][ T5320] ? bpf_lsm_file_ioctl+0x9/0x20 [ 95.578866][ T5320] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 95.581029][ T5320] __se_sys_ioctl+0xfc/0x170 [ 95.582938][ T5320] do_syscall_64+0x166/0x520 [ 95.584874][ T5320] ? trace_irq_disable+0x3b/0x140 [ 95.586978][ T5320] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.589529][ T5320] ? clear_bhb_loop+0x70/0xc0 [ 95.591499][ T5320] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.594034][ T5320] RIP: 0033:0x7f51fc99e0d9 [ 95.595921][ T5320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.604348][ T5320] RSP: 002b:00007f51fd786fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 95.608449][ T5320] RAX: ffffffffffffffda RBX: 00007f51fcc26180 RCX: 00007f51fc99e0d9 [ 95.611646][ T5320] RDX: 0000200000000140 RSI: 0000000000000720 RDI: 0000000000000006 [ 95.615044][ T5320] RBP: 00007f51fca35024 R08: 0000000000000000 R09: 0000000000000000 [ 95.618444][ T5320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.621835][ T5320] R13: 00007f51fcc26218 R14: 00007f51fcc26180 R15: 00007ffc24293898 [ 95.625078][ T5320] [ 95.626425][ T5320] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 95.629316][ T5320] CPU: 0 UID: 0 PID: 5320 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.633222][ T5320] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.637434][ T5320] Call Trace: [ 95.638858][ T5320] [ 95.640086][ T5320] vpanic+0x56d/0xa60 [ 95.641773][ T5320] ? __pfx__printk+0x10/0x10 [ 95.643760][ T5320] ? __pfx_vpanic+0x10/0x10 [ 95.645722][ T5320] ? is_bpf_text_address+0x292/0x2b0 [ 95.647884][ T5320] ? is_bpf_text_address+0x26/0x2b0 [ 95.650031][ T5320] panic+0xc5/0xd0 [ 95.651648][ T5320] ? __pfx_panic+0x10/0x10 [ 95.653646][ T5320] __warn+0x315/0x4c0 [ 95.655394][ T5320] ? usb_submit_urb+0x1057/0x18b0 [ 95.657573][ T5320] ? usb_submit_urb+0x1057/0x18b0 [ 95.659759][ T5320] __report_bug+0x276/0x570 [ 95.661662][ T5320] ? usb_submit_urb+0x1057/0x18b0 [ 95.663739][ T5320] ? __pfx___report_bug+0x10/0x10 [ 95.665820][ T5320] ? __kmalloc_noprof+0x1af/0x720 [ 95.667886][ T5320] ? kasan_save_track+0x4f/0x80 [ 95.669846][ T5320] ? kasan_save_track+0x3e/0x80 [ 95.671872][ T5320] ? __kasan_kmalloc+0x93/0xb0 [ 95.673928][ T5320] report_bug_entry+0x19b/0x290 [ 95.676072][ T5320] ? usb_submit_urb+0x1100/0x18b0 [ 95.678274][ T5320] ? usb_submit_urb+0x1105/0x18b0 [ 95.680375][ T5320] handle_bug+0xce/0x200 [ 95.682103][ T5320] exc_invalid_op+0x1a/0x50 [ 95.683967][ T5320] asm_exc_invalid_op+0x1a/0x20 [ 95.685986][ T5320] RIP: 0010:usb_submit_urb+0x1100/0x18b0 [ 95.688423][ T5320] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89 [ 95.696862][ T5320] RSP: 0018:ffffc9000e137698 EFLAGS: 00010246 [ 95.699501][ T5320] RAX: 0000000000000000 RBX: ffff888043d73000 RCX: 0000000080000280 [ 95.702826][ T5320] RDX: ffff888042d9d900 RSI: ffffffff8cc45a20 RDI: ffffffff90869e40 [ 95.706114][ T5320] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000 [ 95.709445][ T5320] R10: ffffc9000e137780 R11: fffff52001c26efc R12: 1ffff1100b655c00 [ 95.712994][ T5320] R13: ffff88805b2ae000 R14: ffff888042d9d900 R15: 0000000080000280 [ 95.716623][ T5320] ? usb_submit_urb+0x1091/0x18b0 [ 95.718656][ T5320] usb_start_wait_urb+0x13f/0x5b0 [ 95.720723][ T5320] ? rcu_is_watching+0x16/0xb0 [ 95.722754][ T5320] ? trace_kmalloc+0x2a/0xf0 [ 95.724674][ T5320] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 95.727029][ T5320] usb_control_msg+0x234/0x3e0 [ 95.729014][ T5320] dtv5100_i2c_msg+0x231/0x2f0 [ 95.731048][ T5320] dtv5100_i2c_xfer+0x1a5/0x610 [ 95.733067][ T5320] ? kasan_save_track+0x4f/0x80 [ 95.735118][ T5320] ? kasan_save_free_info+0x40/0x50 [ 95.737286][ T5320] ? __se_sys_ioctl+0x47/0x170 [ 95.739285][ T5320] __i2c_transfer+0x7bf/0x1fe0 [ 95.741235][ T5320] __i2c_smbus_xfer+0x159a/0x27e0 [ 95.743382][ T5320] ? __pfx___i2c_smbus_xfer+0x10/0x10 [ 95.745529][ T5320] ? rt_mutex_lock_nested+0x156/0x1c0 [ 95.747749][ T5320] i2c_smbus_xfer+0x1f5/0x310 [ 95.749750][ T5320] i2cdev_ioctl_smbus+0x407/0x700 [ 95.751812][ T5320] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10 [ 95.754093][ T5320] i2cdev_ioctl+0x615/0x880 [ 95.756091][ T5320] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 95.758251][ T5320] ? __fget_files+0x2a/0x420 [ 95.760178][ T5320] ? __fget_files+0x3a2/0x420 [ 95.762005][ T5320] ? bpf_lsm_file_ioctl+0x9/0x20 [ 95.763949][ T5320] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 95.766075][ T5320] __se_sys_ioctl+0xfc/0x170 [ 95.768239][ T5320] do_syscall_64+0x166/0x520 [ 95.770137][ T5320] ? trace_irq_disable+0x3b/0x140 [ 95.772403][ T5320] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.774890][ T5320] ? clear_bhb_loop+0x70/0xc0 [ 95.776786][ T5320] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.779235][ T5320] RIP: 0033:0x7f51fc99e0d9 [ 95.781037][ T5320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.788783][ T5320] RSP: 002b:00007f51fd786fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 95.791938][ T5320] RAX: ffffffffffffffda RBX: 00007f51fcc26180 RCX: 00007f51fc99e0d9 [ 95.794933][ T5320] RDX: 0000200000000140 RSI: 0000000000000720 RDI: 0000000000000006 [ 95.798096][ T5320] RBP: 00007f51fca35024 R08: 0000000000000000 R09: 0000000000000000 [ 95.801273][ T5320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.804663][ T5320] R13: 00007f51fcc26218 R14: 00007f51fcc26180 R15: 00007ffc24293898 [ 95.807995][ T5320] [ 95.809680][ T5320] Kernel Offset: disabled [ 95.811487][ T5320] Rebooting in 86400 seconds..