program: r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, &(0x7f0000000180)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) r1 = syz_open_dev$I2C(&(0x7f00000000c0), 0xc, 0x88000) rename(&(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='./file0\x00') ioctl$I2C_SMBUS(r1, 0x720, &(0x7f0000000040)={0x1, 0x7, 0x0, &(0x7f00000017c0)={0x91, "4ec0191e5bb41b08c198884329f6dd0711762717c44bc7b7b1cc22a10010115d6d"}}) r2 = gettid() r3 = syz_open_procfs(r2, &(0x7f0000000040)='smaps_rollup\x00') exit(0xffff) accept(r3, 0x0, &(0x7f0000000000)) ioctl$UBLK_U_CMD_END_USER_RECOVERY(r3, 0xc0207511, &(0x7f0000000180)={0x0, 0xffff, 0x0, 0x0, r2}) perf_event_open(&(0x7f0000000100)={0x3, 0x80, 0x6, 0xff, 0x1, 0x6, 0x0, 0x8, 0xa1148, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x2, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0xffffffff, 0x2, @perf_config_ext={0x7f, 0x100000001}, 0x118804, 0x1, 0x18000, 0x1, 0xfffffffffffffff8, 0x7, 0x4, 0x0, 0x2, 0x0, 0x1}, r4, 0xe, r3, 0x1) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') [ 94.782218][ T4640] Bluetooth: hci0: command tx timeout [ 95.050252][ T5299] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 95.199844][ T5299] usb 5-1: Using ep0 maxpacket: 16 [ 95.207713][ T5299] usb 5-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 95.213610][ T5299] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.217174][ T5299] usb 5-1: Product: syz [ 95.218903][ T5299] usb 5-1: Manufacturer: syz [ 95.221211][ T5299] usb 5-1: SerialNumber: syz [ 95.454322][ T5299] usb 5-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 95.476772][ T5299] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 95.482461][ T5299] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 95.486616][ T5299] usb 5-1: media controller created [ 95.508909][ T5299] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 95.742265][ T5312] ------------[ cut here ]------------ [ 95.744941][ T5312] usb 5-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0 [ 95.748488][ T5312] WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1057/0x18b0, CPU#0: syz.0.0/5312 [ 95.752863][ T5312] Modules linked in: [ 95.755244][ T5312] CPU: 0 UID: 0 PID: 5312 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.759031][ T5312] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.763287][ T5312] RIP: 0010:usb_submit_urb+0x1100/0x18b0 [ 95.765764][ T5312] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89 [ 95.774519][ T5312] RSP: 0018:ffffc9000f1c75f8 EFLAGS: 00010246 [ 95.777124][ T5312] RAX: 0000000000000000 RBX: ffff8880341a7500 RCX: 0000000080000280 [ 95.780623][ T5312] RDX: ffff8880435927e0 RSI: ffffffff8ca2e420 RDI: ffffffff90656160 [ 95.783957][ T5312] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000 [ 95.787454][ T5312] R10: ffffc9000f1c76e0 R11: fffff52001e38ee8 R12: 1ffff11006582620 [ 95.790990][ T5312] R13: ffff888032c13100 R14: ffff8880435927e0 R15: 0000000080000280 [ 95.794331][ T5312] FS: 00007fc7fb3366c0(0000) GS:ffff88808c54a000(0000) knlGS:0000000000000000 [ 95.798019][ T5312] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.800773][ T5312] CR2: 0000559975be93f0 CR3: 000000001ace1000 CR4: 0000000000352ef0 [ 95.803830][ T5312] Call Trace: [ 95.805197][ T5312] [ 95.806438][ T5312] usb_start_wait_urb+0x13f/0x5b0 [ 95.808642][ T5312] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 95.811146][ T5312] usb_control_msg+0x234/0x3e0 [ 95.813628][ T5312] gl861_ctrl_msg+0x207/0x420 [ 95.816032][ T5312] ? __pfx_gl861_ctrl_msg+0x10/0x10 [ 95.818349][ T5312] ? do_raw_spin_lock+0x12b/0x2f0 [ 95.821016][ T5312] gl861_i2c_master_xfer+0x439/0x6a0 [ 95.823300][ T5312] __i2c_transfer+0x7be/0x1fe0 [ 95.825401][ T5312] __i2c_smbus_xfer+0x1584/0x27d0 [ 95.827556][ T5312] ? lockdep_hardirqs_on+0x7a/0x110 [ 95.829931][ T5312] ? rt_mutex_slowlock+0x1f2/0x780 [ 95.832115][ T5312] ? __pfx___i2c_smbus_xfer+0x10/0x10 [ 95.840036][ T5312] ? rt_mutex_lock_nested+0x167/0x1c0 [ 95.842401][ T5312] i2c_smbus_xfer+0x1f4/0x310 [ 95.844428][ T5312] i2cdev_ioctl_smbus+0x1e7/0x700 [ 95.846632][ T5312] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10 [ 95.849050][ T5312] i2cdev_ioctl+0x615/0x880 [ 95.851756][ T5312] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 95.854026][ T5312] ? __fget_files+0x2a/0x420 [ 95.856039][ T5312] ? __fget_files+0x3a2/0x420 [ 95.858145][ T5312] ? bpf_lsm_file_ioctl+0x9/0x20 [ 95.860407][ T5312] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 95.862596][ T5312] __se_sys_ioctl+0xfc/0x170 [ 95.864714][ T5312] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.867438][ T5312] do_syscall_64+0x174/0x580 [ 95.869405][ T5312] ? trace_irq_disable+0x3b/0x140 [ 95.871474][ T5312] ? clear_bhb_loop+0x70/0xc0 [ 95.873342][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.875652][ T5312] RIP: 0033:0x7fc7fa39e0d9 [ 95.877545][ T5312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.885888][ T5312] RSP: 002b:00007fc7fb335fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 95.889337][ T5312] RAX: ffffffffffffffda RBX: 00007fc7fa625fa0 RCX: 00007fc7fa39e0d9 [ 95.892699][ T5312] RDX: 0000200000000040 RSI: 0000000000000720 RDI: 0000000000000004 [ 95.896076][ T5312] RBP: 00007fc7fa435024 R08: 0000000000000000 R09: 0000000000000000 [ 95.899465][ T5312] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.903043][ T5312] R13: 00007fc7fa626038 R14: 00007fc7fa625fa0 R15: 00007ffddea44868 [ 95.906584][ T5312] [ 95.907947][ T5312] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 95.911098][ T5312] CPU: 0 UID: 0 PID: 5312 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.914785][ T5312] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.919164][ T5312] Call Trace: [ 95.920629][ T5312] [ 95.921917][ T5312] vpanic+0x56c/0xa60 [ 95.923624][ T5312] ? __pfx__printk+0x10/0x10 [ 95.925779][ T5312] ? __pfx_vpanic+0x10/0x10 [ 95.927792][ T5312] ? is_bpf_text_address+0x292/0x2b0 [ 95.930121][ T5312] ? is_bpf_text_address+0x26/0x2b0 [ 95.932400][ T5312] panic+0xc5/0xd0 [ 95.934054][ T5312] ? __pfx_panic+0x10/0x10 [ 95.936051][ T5312] __warn+0x315/0x4c0 [ 95.937787][ T5312] ? usb_submit_urb+0x1057/0x18b0 [ 95.940004][ T5312] ? usb_submit_urb+0x1057/0x18b0 [ 95.942162][ T5312] __report_bug+0x276/0x570 [ 95.944131][ T5312] ? usb_submit_urb+0x1057/0x18b0 [ 95.946381][ T5312] ? __pfx___report_bug+0x10/0x10 [ 95.948622][ T5312] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 95.951168][ T5312] ? __kmalloc_noprof+0x1ad/0x720 [ 95.953399][ T5312] ? kasan_save_track+0x4f/0x80 [ 95.955570][ T5312] report_bug_entry+0x19a/0x290 [ 95.957703][ T5312] ? usb_submit_urb+0x1100/0x18b0 [ 95.959894][ T5312] ? usb_submit_urb+0x1105/0x18b0 [ 95.962130][ T5312] handle_bug+0xce/0x200 [ 95.963965][ T5312] exc_invalid_op+0x1a/0x50 [ 95.966000][ T5312] asm_exc_invalid_op+0x1a/0x20 [ 95.968155][ T5312] RIP: 0010:usb_submit_urb+0x1100/0x18b0 [ 95.970678][ T5312] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89 [ 95.979077][ T5312] RSP: 0018:ffffc9000f1c75f8 EFLAGS: 00010246 [ 95.981680][ T5312] RAX: 0000000000000000 RBX: ffff8880341a7500 RCX: 0000000080000280 [ 95.984948][ T5312] RDX: ffff8880435927e0 RSI: ffffffff8ca2e420 RDI: ffffffff90656160 [ 95.988352][ T5312] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000 [ 95.991663][ T5312] R10: ffffc9000f1c76e0 R11: fffff52001e38ee8 R12: 1ffff11006582620 [ 95.995080][ T5312] R13: ffff888032c13100 R14: ffff8880435927e0 R15: 0000000080000280 [ 95.998318][ T5312] ? usb_submit_urb+0x1091/0x18b0 [ 96.000530][ T5312] usb_start_wait_urb+0x13f/0x5b0 [ 96.002639][ T5312] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 96.004999][ T5312] usb_control_msg+0x234/0x3e0 [ 96.007248][ T5312] gl861_ctrl_msg+0x207/0x420 [ 96.009328][ T5312] ? __pfx_gl861_ctrl_msg+0x10/0x10 [ 96.011451][ T5312] ? do_raw_spin_lock+0x12b/0x2f0 [ 96.013547][ T5312] gl861_i2c_master_xfer+0x439/0x6a0 [ 96.015765][ T5312] __i2c_transfer+0x7be/0x1fe0 [ 96.017836][ T5312] __i2c_smbus_xfer+0x1584/0x27d0 [ 96.019930][ T5312] ? lockdep_hardirqs_on+0x7a/0x110 [ 96.022077][ T5312] ? rt_mutex_slowlock+0x1f2/0x780 [ 96.024202][ T5312] ? __pfx___i2c_smbus_xfer+0x10/0x10 [ 96.026500][ T5312] ? rt_mutex_lock_nested+0x167/0x1c0 [ 96.028805][ T5312] i2c_smbus_xfer+0x1f4/0x310 [ 96.030698][ T5312] i2cdev_ioctl_smbus+0x1e7/0x700 [ 96.032615][ T5312] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10 [ 96.034685][ T5312] i2cdev_ioctl+0x615/0x880 [ 96.036626][ T5312] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 96.038727][ T5312] ? __fget_files+0x2a/0x420 [ 96.040687][ T5312] ? __fget_files+0x3a2/0x420 [ 96.042669][ T5312] ? bpf_lsm_file_ioctl+0x9/0x20 [ 96.044838][ T5312] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 96.046976][ T5312] __se_sys_ioctl+0xfc/0x170 [ 96.048975][ T5312] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.051432][ T5312] do_syscall_64+0x174/0x580 [ 96.053205][ T5312] ? trace_irq_disable+0x3b/0x140 [ 96.055329][ T5312] ? clear_bhb_loop+0x70/0xc0 [ 96.057369][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.059839][ T5312] RIP: 0033:0x7fc7fa39e0d9 [ 96.061751][ T5312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 96.069730][ T5312] RSP: 002b:00007fc7fb335fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 96.073053][ T5312] RAX: ffffffffffffffda RBX: 00007fc7fa625fa0 RCX: 00007fc7fa39e0d9 [ 96.076245][ T5312] RDX: 0000200000000040 RSI: 0000000000000720 RDI: 0000000000000004 [ 96.079345][ T5312] RBP: 00007fc7fa435024 R08: 0000000000000000 R09: 0000000000000000 [ 96.082490][ T5312] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 96.085903][ T5312] R13: 00007fc7fa626038 R14: 00007fc7fa625fa0 R15: 00007ffddea44868 [ 96.089279][ T5312] [ 96.090983][ T5312] Kernel Offset: disabled [ 96.092776][ T5312] Rebooting in 86400 seconds..