Extracting prog: 2m16.096879472s
Minimizing prog: 9m12.833040999s
Simplifying prog options: 0s
Extracting C: 25.825193483s
Simplifying C: 7m33.60716203s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_SMBUS
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603)
ioctl$I2C_SMBUS(r0, 0x720, &(0x7f0000000380)={0x1, 0x10, 0x0, 0x0})

program crashed: WARNING in gl861_ctrl_msg/usb_submit_urb
single: successfully extracted reproducer
found reproducer with 3 syscalls
minimizing guilty program
testing program (duration=48.924574633s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603)

program did not crash
testing program (duration=48.924574633s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$I2C_SMBUS
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
ioctl$I2C_SMBUS(0xffffffffffffffff, 0x720, &(0x7f0000000380)={0x1, 0x10, 0x0, 0x0})

program did not crash
testing program (duration=48.924574633s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$I2C-ioctl$I2C_SMBUS
detailed listing:
executing program 0:
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603)
ioctl$I2C_SMBUS(r0, 0x720, &(0x7f0000000380)={0x1, 0x10, 0x0, 0x0})

program did not crash
testing program (duration=48.924574633s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_SMBUS
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, 0x0, 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603)
ioctl$I2C_SMBUS(r0, 0x720, &(0x7f0000000380)={0x1, 0x10, 0x0, 0x0})

program did not crash
testing program (duration=48.924574633s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_SMBUS
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603)
ioctl$I2C_SMBUS(r0, 0x720, &(0x7f0000000380)={0x1, 0x10, 0x0, 0x0})

program did not crash
testing program (duration=48.924574633s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_SMBUS
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
r0 = syz_open_dev$I2C(0x0, 0x1, 0x2603)
ioctl$I2C_SMBUS(r0, 0x720, &(0x7f0000000380)={0x1, 0x10, 0x0, 0x0})

program did not crash
testing program (duration=48.924574633s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_SMBUS
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603)
ioctl$I2C_SMBUS(r0, 0x720, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=48.924574633s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_SMBUS
program crashed: WARNING in gl861_ctrl_msg/usb_submit_urb
simplifying C reproducer
testing compiled C program (duration=48.924574633s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_SMBUS
program crashed: WARNING in gl861_ctrl_msg/usb_submit_urb
testing compiled C program (duration=48.924574633s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_SMBUS
program did not crash
testing compiled C program (duration=48.924574633s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_SMBUS
program did not crash
testing compiled C program (duration=48.924574633s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_SMBUS
program crashed: WARNING in gl861_ctrl_msg/usb_submit_urb
testing compiled C program (duration=48.924574633s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_SMBUS
program crashed: WARNING in gl861_ctrl_msg/usb_submit_urb
testing compiled C program (duration=48.924574633s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_SMBUS
program crashed: WARNING in gl861_ctrl_msg/usb_submit_urb
testing compiled C program (duration=48.924574633s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_SMBUS
program crashed: WARNING in gl861_ctrl_msg/usb_submit_urb
testing compiled C program (duration=48.924574633s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_SMBUS
program crashed: WARNING in gl861_ctrl_msg/usb_submit_urb
testing program (duration=48.924574633s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_SMBUS
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603)
ioctl$I2C_SMBUS(r0, 0x720, &(0x7f0000000380)={0x1, 0x10, 0x0, 0x0})

program did not crash
validation run: crashed=false
testing program (duration=48.924574633s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_SMBUS
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603)
ioctl$I2C_SMBUS(r0, 0x720, &(0x7f0000000380)={0x1, 0x10, 0x0, 0x0})

program crashed: WARNING in gl861_ctrl_msg/usb_submit_urb
validation run: crashed=true
testing program (duration=48.924574633s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_SMBUS
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603)
ioctl$I2C_SMBUS(r0, 0x720, &(0x7f0000000380)={0x1, 0x10, 0x0, 0x0})

program crashed: WARNING in gl861_ctrl_msg/usb_submit_urb
validation run: crashed=true
testing program (duration=48.924574633s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_SMBUS
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603)
ioctl$I2C_SMBUS(r0, 0x720, &(0x7f0000000380)={0x1, 0x10, 0x0, 0x0})

program crashed: WARNING in gl861_ctrl_msg/usb_submit_urb
validation run: crashed=true
reproducing took 24m25.325883985s
repro crashed as (corrupted=false):
------------[ cut here ]------------
usb 1-1: BOGUS control dir, pipe 80002180 doe
usb 1-1: BOGUS control dir, pipe 80002180 doesn't match bRequestType c0
WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1198/0x1458 drivers/usb/core/urb.c:411, CPU#1: syz.4.310/5362
Modules linked in:
CPU: 1 UID: 0 PID: 5362 Comm: syz.4.310 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : usb_submit_urb+0x1198/0x1458 drivers/usb/core/urb.c:411
lr : usb_submit_urb+0x1198/0x1458 drivers/usb/core/urb.c:411
sp : ffff800096bf7430
x29: ffff800096bf7460 x28: dfff800000000000 x27: 0000000080002180
x26: 0000000000000000 x25: ffff0000f10b8058 x24: ffff0000dbabf3a0
x23: ffff0000cae03fe0 x22: ffff800087175780 x21: ffff0000f10b8000
x20: 0000000000000c00 x19: ffff0000cbccf400 x18: 1fffe00035bf0220
x17: 0000000000000003 x16: ffff800088a0b000 x15: ffff800088abda60
x14: ffff0001adf8110c x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000003 x9 : ee2611119b8d0d00
x8 : ee2611119b8d0d00 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000001 x4 : 0000000000000008 x3 : ffff8000803b4ab0
x2 : 0000000000000001 x1 : ffff0000cdc1ba00 x0 : 0000000000000001
Call trace:
 usb_submit_urb+0x1198/0x1458 drivers/usb/core/urb.c:411 (P)
 usb_start_wait_urb+0x104/0x478 drivers/usb/core/message.c:62
 usb_internal_control_msg drivers/usb/core/message.c:117 [inline]
 usb_control_msg+0x1e8/0x378 drivers/usb/core/message.c:167
 gl861_ctrl_msg+0x1d0/0x3dc drivers/media/usb/dvb-usb-v2/gl861.c:58
 gl861_i2c_master_xfer+0x394/0x5c4 drivers/media/usb/dvb-usb-v2/gl861.c:-1
 __i2c_transfer+0x610/0x1c6c drivers/i2c/i2c-core-base.c:-1
 i2c_smbus_xfer_emulated drivers/i2c/i2c-core-smbus.c:471 [inline]
 __i2c_smbus_xfer+0xedc/0x260c drivers/i2c/i2c-core-smbus.c:621
 i2c_smbus_xfer+0x1f4/0x310 drivers/i2c/i2c-core-smbus.c:547
 i2cdev_ioctl_smbus+0x1f4/0x60c drivers/i2c/i2c-dev.c:356
 i2cdev_ioctl+0x54c/0x7e0 drivers/i2c/i2c-dev.c:478
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl fs/ioctl.c:583 [inline]
 __arm64_sys_ioctl+0x14c/0x1c4 fs/ioctl.c:583
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736
 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594
irq event stamp: 912
hardirqs last  enabled at (911): [<ffff8000803b4a78>] raw_spin_rq_unlock_irq kernel/sched/sched.h:1644 [inline]
hardirqs last  enabled at (911): [<ffff8000803b4a78>] finish_lock_switch kernel/sched/core.c:5125 [inline]
hardirqs last  enabled at (911): [<ffff8000803b4a78>] finish_task_switch+0x234/0x7b8 kernel/sched/core.c:5243
hardirqs last disabled at (912): [<ffff80008682e34c>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:425
softirqs last  enabled at (874): [<ffff80008013b4c0>] local_bh_enable include/linux/bottom_half.h:33 [inline]
softirqs last  enabled at (874): [<ffff80008013b4c0>] put_cpu_fpsimd_context arch/arm64/kernel/fpsimd.c:251 [inline]
softirqs last  enabled at (874): [<ffff80008013b4c0>] fpsimd_restore_current_state+0x39c/0x9c8 arch/arm64/kernel/fpsimd.c:1793
softirqs last disabled at (872): [<ffff80008013b168>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (872): [<ffff80008013b168>] get_cpu_fpsimd_context arch/arm64/kernel/fpsimd.c:234 [inline]
softirqs last disabled at (872): [<ffff80008013b168>] fpsimd_restore_current_state+0x44/0x9c8 arch/arm64/kernel/fpsimd.c:1786
---[ end trace 0000000000000000 ]---

final repro crashed as (corrupted=false):
------------[ cut here ]------------
usb 1-1: BOGUS control dir, pipe 80002180 doe
usb 1-1: BOGUS control dir, pipe 80002180 doesn't match bRequestType c0
WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1198/0x1458 drivers/usb/core/urb.c:411, CPU#1: syz.4.310/5362
Modules linked in:
CPU: 1 UID: 0 PID: 5362 Comm: syz.4.310 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : usb_submit_urb+0x1198/0x1458 drivers/usb/core/urb.c:411
lr : usb_submit_urb+0x1198/0x1458 drivers/usb/core/urb.c:411
sp : ffff800096bf7430
x29: ffff800096bf7460 x28: dfff800000000000 x27: 0000000080002180
x26: 0000000000000000 x25: ffff0000f10b8058 x24: ffff0000dbabf3a0
x23: ffff0000cae03fe0 x22: ffff800087175780 x21: ffff0000f10b8000
x20: 0000000000000c00 x19: ffff0000cbccf400 x18: 1fffe00035bf0220
x17: 0000000000000003 x16: ffff800088a0b000 x15: ffff800088abda60
x14: ffff0001adf8110c x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000003 x9 : ee2611119b8d0d00
x8 : ee2611119b8d0d00 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000001 x4 : 0000000000000008 x3 : ffff8000803b4ab0
x2 : 0000000000000001 x1 : ffff0000cdc1ba00 x0 : 0000000000000001
Call trace:
 usb_submit_urb+0x1198/0x1458 drivers/usb/core/urb.c:411 (P)
 usb_start_wait_urb+0x104/0x478 drivers/usb/core/message.c:62
 usb_internal_control_msg drivers/usb/core/message.c:117 [inline]
 usb_control_msg+0x1e8/0x378 drivers/usb/core/message.c:167
 gl861_ctrl_msg+0x1d0/0x3dc drivers/media/usb/dvb-usb-v2/gl861.c:58
 gl861_i2c_master_xfer+0x394/0x5c4 drivers/media/usb/dvb-usb-v2/gl861.c:-1
 __i2c_transfer+0x610/0x1c6c drivers/i2c/i2c-core-base.c:-1
 i2c_smbus_xfer_emulated drivers/i2c/i2c-core-smbus.c:471 [inline]
 __i2c_smbus_xfer+0xedc/0x260c drivers/i2c/i2c-core-smbus.c:621
 i2c_smbus_xfer+0x1f4/0x310 drivers/i2c/i2c-core-smbus.c:547
 i2cdev_ioctl_smbus+0x1f4/0x60c drivers/i2c/i2c-dev.c:356
 i2cdev_ioctl+0x54c/0x7e0 drivers/i2c/i2c-dev.c:478
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl fs/ioctl.c:583 [inline]
 __arm64_sys_ioctl+0x14c/0x1c4 fs/ioctl.c:583
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736
 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594
irq event stamp: 912
hardirqs last  enabled at (911): [<ffff8000803b4a78>] raw_spin_rq_unlock_irq kernel/sched/sched.h:1644 [inline]
hardirqs last  enabled at (911): [<ffff8000803b4a78>] finish_lock_switch kernel/sched/core.c:5125 [inline]
hardirqs last  enabled at (911): [<ffff8000803b4a78>] finish_task_switch+0x234/0x7b8 kernel/sched/core.c:5243
hardirqs last disabled at (912): [<ffff80008682e34c>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:425
softirqs last  enabled at (874): [<ffff80008013b4c0>] local_bh_enable include/linux/bottom_half.h:33 [inline]
softirqs last  enabled at (874): [<ffff80008013b4c0>] put_cpu_fpsimd_context arch/arm64/kernel/fpsimd.c:251 [inline]
softirqs last  enabled at (874): [<ffff80008013b4c0>] fpsimd_restore_current_state+0x39c/0x9c8 arch/arm64/kernel/fpsimd.c:1793
softirqs last disabled at (872): [<ffff80008013b168>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (872): [<ffff80008013b168>] get_cpu_fpsimd_context arch/arm64/kernel/fpsimd.c:234 [inline]
softirqs last disabled at (872): [<ffff80008013b168>] fpsimd_restore_current_state+0x44/0x9c8 arch/arm64/kernel/fpsimd.c:1786
---[ end trace 0000000000000000 ]---