program:
r0 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
r1 = socket$inet6(0x10, 0x2, 0x0)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000040)=[{0x30, 0x0, 0x0, 0xffeffffe}, {0x16, 0x0, 0x2}]}, 0x10)
sendto$inet6(r1, &(0x7f00000002c0)="100000001200050f0c1000000049b23e", 0x10, 0x0, 0x0, 0x0)
r2 = syz_open_dev$I2C(&(0x7f00000000c0), 0xc, 0x88000)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000600)={0x2c, &(0x7f0000000400)=ANY=[], 0x0, 0x0, 0x0, 0x0})
ioctl$I2C_SMBUS(r2, 0x720, &(0x7f0000000040)={0x1, 0x6, 0x1, &(0x7f0000000000)={0x1c, "3ac071ffbc8cd0d684737999cc8bd238954cb2216d398df0f558125211b40c65fd"}})
[ 94.090697][ T4655] Bluetooth: hci0: command tx timeout
[ 94.428728][ T804] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 94.578028][ T804] usb 5-1: Using ep0 maxpacket: 16
[ 94.586594][ T804] usb 5-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3
[ 94.590374][ T804] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 94.593590][ T804] usb 5-1: Product: syz
[ 94.595400][ T804] usb 5-1: Manufacturer: syz
[ 94.597276][ T804] usb 5-1: SerialNumber: syz
[ 94.615063][ T804] usb 5-1: config 0 descriptor??
[ 95.027682][ T804] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state.
[ 95.037658][ T804] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[ 95.042380][ T804] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T)
[ 95.045760][ T804] usb 5-1: media controller created
[ 95.080963][ T804] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[ 95.232490][ T804] zl10353_read_register: readreg error (reg=127, ret==0)
[ 95.235623][ T804] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T'
[ 95.238859][ T804] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected.
[ 95.598931][ T5330] ------------[ cut here ]------------
[ 95.601814][ T5330] usb 5-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0
[ 95.605364][ T5330] WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1057/0x18b0, CPU#0: syz.0.0/5330
[ 95.609650][ T5330] Modules linked in:
[ 95.611997][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 95.615724][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.619921][ T5330] RIP: 0010:usb_submit_urb+0x1100/0x18b0
[ 95.622208][ T5330] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89
[ 95.630103][ T5330] RSP: 0018:ffffc9000efdf698 EFLAGS: 00010246
[ 95.632851][ T5330] RAX: 0000000000000000 RBX: ffff8880375d7800 RCX: 0000000080000280
[ 95.636020][ T5330] RDX: ffff888032ddd6e0 RSI: ffffffff8ca32920 RDI: ffffffff90659c80
[ 95.639341][ T5330] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000
[ 95.642615][ T5330] R10: ffffc9000efdf780 R11: fffff52001dfbefc R12: 1ffff11002583638
[ 95.645758][ T5330] R13: ffff888012c1b1c0 R14: ffff888032ddd6e0 R15: 0000000080000280
[ 95.649137][ T5330] FS: 00007fdf61df56c0(0000) GS:ffff88808c549000(0000) knlGS:0000000000000000
[ 95.652713][ T5330] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 95.655364][ T5330] CR2: 00005608a3eb1c20 CR3: 0000000012f38000 CR4: 0000000000352ef0
[ 95.658806][ T5330] Call Trace:
[ 95.660223][ T5330]
[ 95.661484][ T5330] usb_start_wait_urb+0x13f/0x5b0
[ 95.663704][ T5330] ? rcu_is_watching+0x15/0xb0
[ 95.665711][ T5330] ? trace_kmalloc+0x2a/0xf0
[ 95.667683][ T5330] ? __pfx_usb_start_wait_urb+0x10/0x10
[ 95.670069][ T5330] usb_control_msg+0x234/0x3e0
[ 95.672083][ T5330] dtv5100_i2c_msg+0x231/0x2f0
[ 95.674159][ T5330] dtv5100_i2c_xfer+0x1a5/0x610
[ 95.676117][ T5330] ? kasan_save_track+0x4f/0x80
[ 95.678172][ T5330] ? kasan_save_free_info+0x40/0x50
[ 95.680332][ T5330] ? __se_sys_ioctl+0x47/0x170
[ 95.682705][ T5330] __i2c_transfer+0x7be/0x1fe0
[ 95.684949][ T5330] __i2c_smbus_xfer+0x1584/0x27d0
[ 95.687105][ T5330] ? __pfx___i2c_smbus_xfer+0x10/0x10
[ 95.689630][ T5330] ? lockdep_hardirqs_on+0x7a/0x110
[ 95.692195][ T5330] ? rt_mutex_lock_nested+0x156/0x1c0
[ 95.694614][ T5330] i2c_smbus_xfer+0x1f4/0x310
[ 95.696743][ T5330] i2cdev_ioctl_smbus+0x407/0x700
[ 95.699405][ T5330] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10
[ 95.701858][ T5330] i2cdev_ioctl+0x615/0x880
[ 95.703824][ T5330] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 95.705987][ T5330] ? __fget_files+0x2a/0x420
[ 95.708394][ T5330] ? __fget_files+0x3a2/0x420
[ 95.710735][ T5330] ? bpf_lsm_file_ioctl+0x9/0x20
[ 95.712939][ T5330] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 95.715065][ T5330] __se_sys_ioctl+0xfc/0x170
[ 95.717027][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.723004][ T5330] do_syscall_64+0x174/0x580
[ 95.724954][ T5330] ? trace_irq_disable+0x3b/0x140
[ 95.727118][ T5330] ? clear_bhb_loop+0x40/0x90
[ 95.729006][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.731438][ T5330] RIP: 0033:0x7fdf6599de99
[ 95.733271][ T5330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 95.741156][ T5330] RSP: 002b:00007fdf61df4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 95.744494][ T5330] RAX: ffffffffffffffda RBX: 00007fdf65c26090 RCX: 00007fdf6599de99
[ 95.747940][ T5330] RDX: 0000200000000040 RSI: 0000000000000720 RDI: 0000000000000005
[ 95.751430][ T5330] RBP: 00007fdf65a33eaf R08: 0000000000000000 R09: 0000000000000000
[ 95.754566][ T5330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 95.757617][ T5330] R13: 00007fdf65c26128 R14: 00007fdf65c26090 R15: 00007ffda42c5138
[ 95.760999][ T5330]
[ 95.762396][ T5330] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 95.765621][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 95.769425][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.773801][ T5330] Call Trace:
[ 95.775285][ T5330]
[ 95.776573][ T5330] vpanic+0x56c/0xa60
[ 95.778345][ T5330] ? __pfx__printk+0x10/0x10
[ 95.780329][ T5330] ? __pfx_vpanic+0x10/0x10
[ 95.782388][ T5330] ? is_bpf_text_address+0x292/0x2b0
[ 95.784705][ T5330] ? is_bpf_text_address+0x26/0x2b0
[ 95.786956][ T5330] panic+0xc5/0xd0
[ 95.788640][ T5330] ? __pfx_panic+0x10/0x10
[ 95.790638][ T5330] __warn+0x315/0x4c0
[ 95.792329][ T5330] ? usb_submit_urb+0x1057/0x18b0
[ 95.794491][ T5330] ? usb_submit_urb+0x1057/0x18b0
[ 95.796678][ T5330] __report_bug+0x276/0x570
[ 95.798536][ T5330] ? usb_submit_urb+0x1057/0x18b0
[ 95.800734][ T5330] ? __pfx___report_bug+0x10/0x10
[ 95.802975][ T5330] ? __kmalloc_noprof+0x1ad/0x720
[ 95.805102][ T5330] ? kasan_save_track+0x4f/0x80
[ 95.807197][ T5330] ? kasan_save_track+0x3e/0x80
[ 95.809381][ T5330] ? __kasan_kmalloc+0x93/0xb0
[ 95.811429][ T5330] report_bug_entry+0x19a/0x290
[ 95.813226][ T5330] ? usb_submit_urb+0x1100/0x18b0
[ 95.815213][ T5330] ? usb_submit_urb+0x1105/0x18b0
[ 95.817207][ T5330] handle_bug+0xce/0x200
[ 95.818943][ T5330] exc_invalid_op+0x1a/0x50
[ 95.820740][ T5330] asm_exc_invalid_op+0x1a/0x20
[ 95.822674][ T5330] RIP: 0010:usb_submit_urb+0x1100/0x18b0
[ 95.824995][ T5330] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89
[ 95.832412][ T5330] RSP: 0018:ffffc9000efdf698 EFLAGS: 00010246
[ 95.834738][ T5330] RAX: 0000000000000000 RBX: ffff8880375d7800 RCX: 0000000080000280
[ 95.837841][ T5330] RDX: ffff888032ddd6e0 RSI: ffffffff8ca32920 RDI: ffffffff90659c80
[ 95.841022][ T5330] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000
[ 95.844264][ T5330] R10: ffffc9000efdf780 R11: fffff52001dfbefc R12: 1ffff11002583638
[ 95.847337][ T5330] R13: ffff888012c1b1c0 R14: ffff888032ddd6e0 R15: 0000000080000280
[ 95.850473][ T5330] ? usb_submit_urb+0x1091/0x18b0
[ 95.852463][ T5330] usb_start_wait_urb+0x13f/0x5b0
[ 95.854366][ T5330] ? rcu_is_watching+0x15/0xb0
[ 95.856421][ T5330] ? trace_kmalloc+0x2a/0xf0
[ 95.858437][ T5330] ? __pfx_usb_start_wait_urb+0x10/0x10
[ 95.860741][ T5330] usb_control_msg+0x234/0x3e0
[ 95.862824][ T5330] dtv5100_i2c_msg+0x231/0x2f0
[ 95.864826][ T5330] dtv5100_i2c_xfer+0x1a5/0x610
[ 95.867298][ T5330] ? kasan_save_track+0x4f/0x80
[ 95.869870][ T5330] ? kasan_save_free_info+0x40/0x50
[ 95.872553][ T5330] ? __se_sys_ioctl+0x47/0x170
[ 95.874395][ T5330] __i2c_transfer+0x7be/0x1fe0
[ 95.876802][ T5330] __i2c_smbus_xfer+0x1584/0x27d0
[ 95.880181][ T5330] ? __pfx___i2c_smbus_xfer+0x10/0x10
[ 95.883251][ T5330] ? lockdep_hardirqs_on+0x7a/0x110
[ 95.885654][ T5330] ? rt_mutex_lock_nested+0x156/0x1c0
[ 95.887884][ T5330] i2c_smbus_xfer+0x1f4/0x310
[ 95.889815][ T5330] i2cdev_ioctl_smbus+0x407/0x700
[ 95.891883][ T5330] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10
[ 95.894198][ T5330] i2cdev_ioctl+0x615/0x880
[ 95.896124][ T5330] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 95.898253][ T5330] ? __fget_files+0x2a/0x420
[ 95.900393][ T5330] ? __fget_files+0x3a2/0x420
[ 95.902387][ T5330] ? bpf_lsm_file_ioctl+0x9/0x20
[ 95.904435][ T5330] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 95.906492][ T5330] __se_sys_ioctl+0xfc/0x170
[ 95.908434][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.910921][ T5330] do_syscall_64+0x174/0x580
[ 95.912759][ T5330] ? trace_irq_disable+0x3b/0x140
[ 95.914817][ T5330] ? clear_bhb_loop+0x40/0x90
[ 95.916760][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.919082][ T5330] RIP: 0033:0x7fdf6599de99
[ 95.920895][ T5330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 95.928553][ T5330] RSP: 002b:00007fdf61df4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 95.931892][ T5330] RAX: ffffffffffffffda RBX: 00007fdf65c26090 RCX: 00007fdf6599de99
[ 95.935090][ T5330] RDX: 0000200000000040 RSI: 0000000000000720 RDI: 0000000000000005
[ 95.938320][ T5330] RBP: 00007fdf65a33eaf R08: 0000000000000000 R09: 0000000000000000
[ 95.941523][ T5330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 95.944661][ T5330] R13: 00007fdf65c26128 R14: 00007fdf65c26090 R15: 00007ffda42c5138
[ 95.947783][ T5330]
[ 95.949406][ T5330] Kernel Offset: disabled
[ 95.951219][ T5330] Rebooting in 86400 seconds..