program:
r0 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xb, &(0x7f0000000000)=@framed={{}, [@printk={@p, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x9b}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
r1 = syz_open_dev$I2C(&(0x7f00000000c0), 0xc, 0x88000)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000600)={0x18, &(0x7f0000000280)=ANY=[@ANYBLOB="2016ef3a8c5e662ed488a3f2b252c0dca9000000"], 0x0, 0x0, 0x0, 0x0})
ioctl$I2C_SMBUS(r1, 0x720, &(0x7f0000000200)={0x1, 0x6, 0x1, &(0x7f0000000240)={0x1c, "3ac071ffbc8cd0d684737d99bb8bd238954c9a216d398df0f558125211b40c65fd"}})
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000b00)=ANY=[@ANYBLOB="2c0000003f00070100000000fddbdf25027c00001800378013000100717472283414d6bba919736d"], 0x2c}, 0x1, 0x0, 0x0, 0xc880}, 0x0)
sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYRES16=r3, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe80090000000000000000000000001d000004d86c000000ac1e0001000000000000000000000000000000010000003d5597d9ffff0000000000000000000200000000000000f8ffffffffffffff0000000000000000ffffffffffffffffffffffffffffffff000800000000000000000000000000800300000008000000000000002cbd700004350000020001002000000000000000480003006c7a73000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000800000000000000005002100020000000600250005000000000000000000000000000000008275"], 0x148}, 0x1, 0x0, 0x0, 0x8801}, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f00000001c0), 0x10800)
[ 124.453825][ T4640] Bluetooth: hci0: command tx timeout
[ 124.804820][ T9] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 124.954925][ T9] usb 5-1: Using ep0 maxpacket: 16
[ 124.958034][ T9] usb 5-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3
[ 124.967483][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 124.970799][ T9] usb 5-1: Product: syz
[ 124.973222][ T9] usb 5-1: Manufacturer: syz
[ 124.976036][ T9] usb 5-1: SerialNumber: syz
[ 124.990152][ T9] usb 5-1: config 0 descriptor??
[ 125.402745][ T9] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state.
[ 125.426334][ T9] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[ 125.431508][ T9] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T)
[ 125.436739][ T9] usb 5-1: media controller created
[ 125.453458][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[ 125.603222][ T9] zl10353_read_register: readreg error (reg=127, ret==0)
[ 125.606567][ T9] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T'
[ 125.610346][ T9] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected.
[ 125.975190][ T5322] ------------[ cut here ]------------
[ 125.978518][ T5322] usb 5-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0
[ 125.982061][ T5322] WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1057/0x18b0, CPU#0: syz.0.0/5322
[ 125.986028][ T5322] Modules linked in:
[ 125.988515][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 125.993236][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 125.998559][ T5322] RIP: 0010:usb_submit_urb+0x1100/0x18b0
[ 126.001138][ T5322] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89
[ 126.009665][ T5322] RSP: 0018:ffffc9000e75f698 EFLAGS: 00010246
[ 126.012219][ T5322] RAX: 0000000000000000 RBX: ffff888036264000 RCX: 0000000080000280
[ 126.016249][ T5322] RDX: ffff888012813040 RSI: ffffffff8ca33380 RDI: ffffffff90665390
[ 126.019650][ T5322] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000
[ 126.023119][ T5322] R10: ffffc9000e75f780 R11: fffff52001cebefc R12: 1ffff110025026f0
[ 126.027920][ T5322] R13: ffff888012813780 R14: ffff888012813040 R15: 0000000080000280
[ 126.031386][ T5322] FS: 00007f343fb0c6c0(0000) GS:ffff88808c526000(0000) knlGS:0000000000000000
[ 126.036256][ T5322] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 126.039028][ T5322] CR2: 000055b01fa4dff8 CR3: 000000001213f000 CR4: 0000000000352ef0
[ 126.042315][ T5322] Call Trace:
[ 126.043822][ T5322]
[ 126.045288][ T5322] usb_start_wait_urb+0x13f/0x5b0
[ 126.047387][ T5322] ? rcu_is_watching+0x16/0xb0
[ 126.049348][ T5322] ? trace_kmalloc+0x2a/0xf0
[ 126.051271][ T5322] ? __pfx_usb_start_wait_urb+0x10/0x10
[ 126.053557][ T5322] usb_control_msg+0x234/0x3e0
[ 126.055798][ T5322] dtv5100_i2c_msg+0x231/0x2f0
[ 126.057996][ T5322] dtv5100_i2c_xfer+0x1a5/0x610
[ 126.059885][ T5322] ? kasan_save_track+0x4f/0x80
[ 126.061706][ T5322] ? kasan_save_free_info+0x40/0x50
[ 126.063810][ T5322] ? __se_sys_ioctl+0x47/0x170
[ 126.065898][ T5322] __i2c_transfer+0x7bf/0x1fe0
[ 126.068059][ T5322] __i2c_smbus_xfer+0x159a/0x27e0
[ 126.070230][ T5322] ? __pfx___i2c_smbus_xfer+0x10/0x10
[ 126.072520][ T5322] ? rt_mutex_lock_nested+0x156/0x1c0
[ 126.074879][ T5322] i2c_smbus_xfer+0x1f5/0x310
[ 126.076929][ T5322] i2cdev_ioctl_smbus+0x407/0x700
[ 126.079192][ T5322] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10
[ 126.081635][ T5322] i2cdev_ioctl+0x615/0x880
[ 126.083541][ T5322] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 126.085643][ T5322] ? __fget_files+0x2a/0x420
[ 126.087562][ T5322] ? __fget_files+0x3a2/0x420
[ 126.089589][ T5322] ? bpf_lsm_file_ioctl+0x9/0x20
[ 126.091784][ T5322] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 126.093988][ T5322] __se_sys_ioctl+0xfc/0x170
[ 126.096236][ T5322] do_syscall_64+0x166/0x520
[ 126.098334][ T5322] ? trace_irq_disable+0x3b/0x140
[ 126.100617][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 126.103250][ T5322] ? clear_bhb_loop+0x70/0xc0
[ 126.105476][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 126.108184][ T5322] RIP: 0033:0x7f343eb9e0d9
[ 126.110131][ T5322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 126.118734][ T5322] RSP: 002b:00007f343fb0bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 126.122788][ T5322] RAX: ffffffffffffffda RBX: 00007f343ee26090 RCX: 00007f343eb9e0d9
[ 126.126361][ T5322] RDX: 0000200000000200 RSI: 0000000000000720 RDI: 0000000000000005
[ 126.129741][ T5322] RBP: 00007f343ec35024 R08: 0000000000000000 R09: 0000000000000000
[ 126.133150][ T5322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 126.136574][ T5322] R13: 00007f343ee26128 R14: 00007f343ee26090 R15: 00007ffd306070f8
[ 126.139879][ T5322]
[ 126.141268][ T5322] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 126.144311][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 126.147947][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 126.151939][ T5322] Call Trace:
[ 126.153275][ T5322]
[ 126.154472][ T5322] vpanic+0x56d/0xa60
[ 126.156160][ T5322] ? __pfx__printk+0x10/0x10
[ 126.158092][ T5322] ? __pfx_vpanic+0x10/0x10
[ 126.159987][ T5322] ? is_bpf_text_address+0x292/0x2b0
[ 126.162151][ T5322] ? is_bpf_text_address+0x26/0x2b0
[ 126.164302][ T5322] panic+0xc5/0xd0
[ 126.165921][ T5322] ? __pfx_panic+0x10/0x10
[ 126.168150][ T5322] __warn+0x315/0x4c0
[ 126.170445][ T5322] ? usb_submit_urb+0x1057/0x18b0
[ 126.172927][ T5322] ? usb_submit_urb+0x1057/0x18b0
[ 126.174998][ T5322] __report_bug+0x276/0x570
[ 126.176808][ T5322] ? usb_submit_urb+0x1057/0x18b0
[ 126.178870][ T5322] ? __pfx___report_bug+0x10/0x10
[ 126.180863][ T5322] ? __kmalloc_noprof+0x1af/0x720
[ 126.182928][ T5322] ? kasan_save_track+0x4f/0x80
[ 126.184984][ T5322] ? kasan_save_track+0x3e/0x80
[ 126.187076][ T5322] ? __kasan_kmalloc+0x93/0xb0
[ 126.189181][ T5322] report_bug_entry+0x19b/0x290
[ 126.191219][ T5322] ? usb_submit_urb+0x1100/0x18b0
[ 126.193363][ T5322] ? usb_submit_urb+0x1105/0x18b0
[ 126.195505][ T5322] handle_bug+0xce/0x200
[ 126.197362][ T5322] exc_invalid_op+0x1a/0x50
[ 126.199200][ T5322] asm_exc_invalid_op+0x1a/0x20
[ 126.201023][ T5322] RIP: 0010:usb_submit_urb+0x1100/0x18b0
[ 126.203173][ T5322] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89
[ 126.211138][ T5322] RSP: 0018:ffffc9000e75f698 EFLAGS: 00010246
[ 126.213898][ T5322] RAX: 0000000000000000 RBX: ffff888036264000 RCX: 0000000080000280
[ 126.217549][ T5322] RDX: ffff888012813040 RSI: ffffffff8ca33380 RDI: ffffffff90665390
[ 126.221821][ T5322] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000
[ 126.225275][ T5322] R10: ffffc9000e75f780 R11: fffff52001cebefc R12: 1ffff110025026f0
[ 126.229546][ T5322] R13: ffff888012813780 R14: ffff888012813040 R15: 0000000080000280
[ 126.232956][ T5322] ? usb_submit_urb+0x1091/0x18b0
[ 126.235291][ T5322] usb_start_wait_urb+0x13f/0x5b0
[ 126.237502][ T5322] ? rcu_is_watching+0x16/0xb0
[ 126.239487][ T5322] ? trace_kmalloc+0x2a/0xf0
[ 126.241355][ T5322] ? __pfx_usb_start_wait_urb+0x10/0x10
[ 126.243542][ T5322] usb_control_msg+0x234/0x3e0
[ 126.245468][ T5322] dtv5100_i2c_msg+0x231/0x2f0
[ 126.247439][ T5322] dtv5100_i2c_xfer+0x1a5/0x610
[ 126.249155][ T5322] ? kasan_save_track+0x4f/0x80
[ 126.250914][ T5322] ? kasan_save_free_info+0x40/0x50
[ 126.253018][ T5322] ? __se_sys_ioctl+0x47/0x170
[ 126.255131][ T5322] __i2c_transfer+0x7bf/0x1fe0
[ 126.257234][ T5322] __i2c_smbus_xfer+0x159a/0x27e0
[ 126.259466][ T5322] ? __pfx___i2c_smbus_xfer+0x10/0x10
[ 126.261882][ T5322] ? rt_mutex_lock_nested+0x156/0x1c0
[ 126.264093][ T5322] i2c_smbus_xfer+0x1f5/0x310
[ 126.265903][ T5322] i2cdev_ioctl_smbus+0x407/0x700
[ 126.267978][ T5322] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10
[ 126.270404][ T5322] i2cdev_ioctl+0x615/0x880
[ 126.272331][ T5322] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 126.274407][ T5322] ? __fget_files+0x2a/0x420
[ 126.276403][ T5322] ? __fget_files+0x3a2/0x420
[ 126.278463][ T5322] ? bpf_lsm_file_ioctl+0x9/0x20
[ 126.280499][ T5322] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 126.282582][ T5322] __se_sys_ioctl+0xfc/0x170
[ 126.284579][ T5322] do_syscall_64+0x166/0x520
[ 126.286516][ T5322] ? trace_irq_disable+0x3b/0x140
[ 126.288633][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 126.291013][ T5322] ? clear_bhb_loop+0x70/0xc0
[ 126.292939][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 126.295199][ T5322] RIP: 0033:0x7f343eb9e0d9
[ 126.297044][ T5322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 126.304932][ T5322] RSP: 002b:00007f343fb0bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 126.309201][ T5322] RAX: ffffffffffffffda RBX: 00007f343ee26090 RCX: 00007f343eb9e0d9
[ 126.313103][ T5322] RDX: 0000200000000200 RSI: 0000000000000720 RDI: 0000000000000005
[ 126.316445][ T5322] RBP: 00007f343ec35024 R08: 0000000000000000 R09: 0000000000000000
[ 126.319924][ T5322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 126.323382][ T5322] R13: 00007f343ee26128 R14: 00007f343ee26090 R15: 00007ffd306070f8
[ 126.326600][ T5322]
[ 126.328225][ T5322] Kernel Offset: disabled
[ 126.330046][ T5322] Rebooting in 86400 seconds..