program:
r0 = syz_usb_connect(0x0, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b41889160001010203010902220002010080fa090400000003000000090401"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000040)={0x84, &(0x7f0000000140)={0xc0, 0x7, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r1 = syz_open_dev$I2C(&(0x7f00000001c0), 0x2, 0x0)
ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000200)={&(0x7f0000000300)=[{0xff, 0x800, 0x36, &(0x7f0000000280)="0610b1b6f2c492fb4d5dbd84558d8ee4e5ed89d141f2fbb190e1b7a4a66f1afabbfe9599b399715f81ff33cfb93355f25ba32ac7771a"}, {0x80, 0x6201, 0x0, 0x0}], 0x2})
[ 134.233677][ T4651] Bluetooth: hci0: command tx timeout
[ 134.269766][ T807] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 134.421343][ T807] usb 5-1: New USB device found, idVendor=18b4, idProduct=1689, bcdDevice= 1.00
[ 134.423433][ T807] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 134.429024][ T807] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 134.429040][ T807] usb 5-1: Product: syz
[ 134.429048][ T807] usb 5-1: Manufacturer: syz
[ 134.429056][ T807] usb 5-1: SerialNumber: syz
[ 134.468065][ T807] usbhid 5-1:1.0: couldn't find an input interrupt endpoint
[ 134.664075][ T807] usb 5-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state
[ 134.680611][ T807] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer
[ 134.686310][ T807] dvbdev: DVB: registering new adapter (E3C EC168 reference design)
[ 134.686349][ T807] usb 5-1: media controller created
[ 134.744957][ T807] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[ 135.833655][ T807] i2c i2c-2: ec100: i2c rd failed=-110 reg=33
[ 135.851071][ T5342] ------------[ cut here ]------------
[ 135.851085][ T5342] usb 5-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0
[ 135.851097][ T5342] WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1057/0x18b0, CPU#0: syz.0.0/5342
[ 135.862282][ T5342] Modules linked in:
[ 135.864806][ T5342] CPU: 0 UID: 0 PID: 5342 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 135.869004][ T5342] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 135.873462][ T5342] RIP: 0010:usb_submit_urb+0x1100/0x18b0
[ 135.875824][ T5342] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89
[ 135.884151][ T5342] RSP: 0018:ffffc9000e5878d8 EFLAGS: 00010246
[ 135.886758][ T5342] RAX: 0000000000000000 RBX: ffff888037bbb200 RCX: 0000000080000280
[ 135.890341][ T5342] RDX: ffff8880316c7520 RSI: ffffffff8cc57b40 RDI: ffffffff91885110
[ 135.893969][ T5342] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000
[ 135.898076][ T5342] R10: ffffc9000e5879c0 R11: fffff52001cb0f44 R12: 1ffff11006873400
[ 135.902000][ T5342] R13: ffff88803439a000 R14: ffff8880316c7520 R15: 0000000080000280
[ 135.905607][ T5342] FS: 00007ff8478376c0(0000) GS:ffff88808b0b4000(0000) knlGS:0000000000000000
[ 135.910141][ T5342] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 135.913139][ T5342] CR2: 00007ffcbb28e830 CR3: 0000000041a06000 CR4: 0000000000352ef0
[ 135.916309][ T5342] Call Trace:
[ 135.917866][ T5342]
[ 135.919192][ T5342] usb_start_wait_urb+0x13f/0x5b0
[ 135.925721][ T5342] ? __pfx_usb_start_wait_urb+0x10/0x10
[ 135.928688][ T5342] usb_control_msg+0x234/0x3e0
[ 135.930979][ T5342] ec168_ctrl_msg+0x308/0x7c0
[ 135.933117][ T5342] ec168_i2c_xfer+0x10e/0x630
[ 135.935167][ T5342] __i2c_transfer+0x7bf/0x1fe0
[ 135.937304][ T5342] ? rt_mutex_lock_nested+0x167/0x1c0
[ 135.940120][ T5342] ? i2c_transfer+0xc7/0x2d0
[ 135.942108][ T5342] i2c_transfer+0x1cb/0x2d0
[ 135.944094][ T5342] i2cdev_ioctl_rdwr+0x460/0x740
[ 135.946338][ T5342] i2cdev_ioctl+0x6a5/0x880
[ 135.948263][ T5342] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 135.950783][ T5342] ? __fget_files+0x3a2/0x420
[ 135.953803][ T5342] ? __fget_files+0x2a/0x420
[ 135.956507][ T5342] ? bpf_lsm_file_ioctl+0x9/0x20
[ 135.958789][ T5342] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 135.961057][ T5342] __se_sys_ioctl+0xfc/0x170
[ 135.963012][ T5342] do_syscall_64+0x166/0x520
[ 135.965117][ T5342] ? trace_irq_disable+0x3b/0x140
[ 135.967521][ T5342] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 135.970461][ T5342] ? clear_bhb_loop+0x70/0xc0
[ 135.972582][ T5342] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 135.975273][ T5342] RIP: 0033:0x7ff84699e559
[ 135.977169][ T5342] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 135.985782][ T5342] RSP: 002b:00007ff847836fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 135.989403][ T5342] RAX: ffffffffffffffda RBX: 00007ff846c25fa0 RCX: 00007ff84699e559
[ 135.995957][ T5342] RDX: 0000200000000200 RSI: 0000000000000707 RDI: 0000000000000004
[ 136.000753][ T5342] RBP: 00007ff846a358b0 R08: 0000000000000000 R09: 0000000000000000
[ 136.004230][ T5342] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 136.007605][ T5342] R13: 00007ff846c26038 R14: 00007ff846c25fa0 R15: 00007ffd8c3f3508
[ 136.011070][ T5342]
[ 136.012495][ T5342] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 136.016502][ T5342] CPU: 0 UID: 0 PID: 5342 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 136.020289][ T5342] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 136.024739][ T5342] Call Trace:
[ 136.026230][ T5342]
[ 136.027546][ T5342] vpanic+0x56d/0xa60
[ 136.029502][ T5342] ? __pfx__printk+0x10/0x10
[ 136.031545][ T5342] ? __pfx_vpanic+0x10/0x10
[ 136.033495][ T5342] ? is_bpf_text_address+0x292/0x2b0
[ 136.035769][ T5342] ? is_bpf_text_address+0x26/0x2b0
[ 136.037973][ T5342] panic+0xc5/0xd0
[ 136.039747][ T5342] ? __pfx_panic+0x10/0x10
[ 136.041775][ T5342] __warn+0x315/0x4c0
[ 136.043459][ T5342] ? usb_submit_urb+0x1057/0x18b0
[ 136.045664][ T5342] ? usb_submit_urb+0x1057/0x18b0
[ 136.047681][ T5342] __report_bug+0x276/0x570
[ 136.049553][ T5342] ? usb_submit_urb+0x1057/0x18b0
[ 136.051510][ T5342] ? __pfx___report_bug+0x10/0x10
[ 136.053589][ T5342] ? stack_depot_save_flags+0x404/0x7f0
[ 136.056082][ T5342] report_bug_entry+0x19b/0x290
[ 136.058130][ T5342] ? usb_submit_urb+0x1100/0x18b0
[ 136.060427][ T5342] ? usb_submit_urb+0x1105/0x18b0
[ 136.062486][ T5342] handle_bug+0xce/0x200
[ 136.064304][ T5342] exc_invalid_op+0x1a/0x50
[ 136.066290][ T5342] asm_exc_invalid_op+0x1a/0x20
[ 136.068316][ T5342] RIP: 0010:usb_submit_urb+0x1100/0x18b0
[ 136.070716][ T5342] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89
[ 136.079000][ T5342] RSP: 0018:ffffc9000e5878d8 EFLAGS: 00010246
[ 136.081590][ T5342] RAX: 0000000000000000 RBX: ffff888037bbb200 RCX: 0000000080000280
[ 136.084851][ T5342] RDX: ffff8880316c7520 RSI: ffffffff8cc57b40 RDI: ffffffff91885110
[ 136.088043][ T5342] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000
[ 136.091490][ T5342] R10: ffffc9000e5879c0 R11: fffff52001cb0f44 R12: 1ffff11006873400
[ 136.094863][ T5342] R13: ffff88803439a000 R14: ffff8880316c7520 R15: 0000000080000280
[ 136.098331][ T5342] ? usb_submit_urb+0x1091/0x18b0
[ 136.100593][ T5342] usb_start_wait_urb+0x13f/0x5b0
[ 136.102714][ T5342] ? __pfx_usb_start_wait_urb+0x10/0x10
[ 136.105126][ T5342] usb_control_msg+0x234/0x3e0
[ 136.107324][ T5342] ec168_ctrl_msg+0x308/0x7c0
[ 136.109341][ T5342] ec168_i2c_xfer+0x10e/0x630
[ 136.111248][ T5342] __i2c_transfer+0x7bf/0x1fe0
[ 136.113323][ T5342] ? rt_mutex_lock_nested+0x167/0x1c0
[ 136.115819][ T5342] ? i2c_transfer+0xc7/0x2d0
[ 136.117747][ T5342] i2c_transfer+0x1cb/0x2d0
[ 136.119699][ T5342] i2cdev_ioctl_rdwr+0x460/0x740
[ 136.121731][ T5342] i2cdev_ioctl+0x6a5/0x880
[ 136.123617][ T5342] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 136.125748][ T5342] ? __fget_files+0x3a2/0x420
[ 136.127677][ T5342] ? __fget_files+0x2a/0x420
[ 136.129632][ T5342] ? bpf_lsm_file_ioctl+0x9/0x20
[ 136.131792][ T5342] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 136.134002][ T5342] __se_sys_ioctl+0xfc/0x170
[ 136.135944][ T5342] do_syscall_64+0x166/0x520
[ 136.137909][ T5342] ? trace_irq_disable+0x3b/0x140
[ 136.139965][ T5342] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 136.142504][ T5342] ? clear_bhb_loop+0x70/0xc0
[ 136.144702][ T5342] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 136.147194][ T5342] RIP: 0033:0x7ff84699e559
[ 136.149077][ T5342] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 136.156986][ T5342] RSP: 002b:00007ff847836fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 136.160567][ T5342] RAX: ffffffffffffffda RBX: 00007ff846c25fa0 RCX: 00007ff84699e559
[ 136.163964][ T5342] RDX: 0000200000000200 RSI: 0000000000000707 RDI: 0000000000000004
[ 136.167408][ T5342] RBP: 00007ff846a358b0 R08: 0000000000000000 R09: 0000000000000000
[ 136.170781][ T5342] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 136.173840][ T5342] R13: 00007ff846c26038 R14: 00007ff846c25fa0 R15: 00007ffd8c3f3508
[ 136.176990][ T5342]
[ 136.178666][ T5342] Kernel Offset: disabled
[ 136.180325][ T5342] Rebooting in 86400 seconds..