program:
r0 = syz_usb_connect(0x0, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b41889160001010203010902220002010080fa090400000003000000090401"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000040)={0x84, &(0x7f0000000140)={0xc0, 0x7, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r1 = syz_open_dev$I2C(&(0x7f00000001c0), 0x2, 0x0)
ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000200)={&(0x7f0000000300)=[{0xff, 0x800, 0x36, &(0x7f0000000280)="0610b1b6f2c492fb4d5dbd84558d8ee4e5ed89d141f2fbb190e1b7a4a66f1afabbfe9599b399715f81ff33cfb93355f25ba32ac7771a"}, {0x80, 0x6201, 0x0, 0x0}], 0x2})
[ 86.546224][ T4650] Bluetooth: hci0: command tx timeout
[ 86.956598][ T2015] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 87.108885][ T2015] usb 5-1: New USB device found, idVendor=18b4, idProduct=1689, bcdDevice= 1.00
[ 87.110829][ T2015] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 87.113144][ T2015] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 87.113158][ T2015] usb 5-1: Product: syz
[ 87.113166][ T2015] usb 5-1: Manufacturer: syz
[ 87.113174][ T2015] usb 5-1: SerialNumber: syz
[ 87.159093][ T2015] usbhid 5-1:1.0: couldn't find an input interrupt endpoint
[ 87.258275][ T808] cfg80211: failed to load regulatory.db
[ 87.357081][ T2015] usb 5-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state
[ 87.373761][ T2015] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer
[ 87.374260][ T2015] dvbdev: DVB: registering new adapter (E3C EC168 reference design)
[ 87.374317][ T2015] usb 5-1: media controller created
[ 87.412722][ T2015] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[ 88.534262][ T2015] i2c i2c-2: ec100: i2c rd failed=-110 reg=33
[ 88.580202][ T5334] ------------[ cut here ]------------
[ 88.580215][ T5334] usb 5-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0
[ 88.580227][ T5334] WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1057/0x18b0, CPU#0: syz.0.0/5334
[ 88.591187][ T5334] Modules linked in:
[ 88.594635][ T5334] CPU: 0 UID: 0 PID: 5334 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 88.598636][ T5334] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 88.603271][ T5334] RIP: 0010:usb_submit_urb+0x1100/0x18b0
[ 88.607986][ T5334] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89
[ 88.616644][ T5334] RSP: 0018:ffffc9000e3ef8d8 EFLAGS: 00010246
[ 88.619348][ T5334] RAX: 0000000000000000 RBX: ffff88803683b700 RCX: 0000000080000280
[ 88.622665][ T5334] RDX: ffff88803549c7e0 RSI: ffffffff8cc57b40 RDI: ffffffff91885110
[ 88.626527][ T5334] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000
[ 88.629991][ T5334] R10: ffffc9000e3ef9c0 R11: fffff52001c7df44 R12: 1ffff110062de6b8
[ 88.633404][ T5334] R13: ffff8880316f35c0 R14: ffff88803549c7e0 R15: 0000000080000280
[ 88.636925][ T5334] FS: 00007f35730306c0(0000) GS:ffff88808b0b4000(0000) knlGS:0000000000000000
[ 88.640710][ T5334] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 88.643596][ T5334] CR2: 00007f1323dd8ad8 CR3: 0000000041ae7000 CR4: 0000000000352ef0
[ 88.647222][ T5334] Call Trace:
[ 88.648607][ T5334]
[ 88.650052][ T5334] usb_start_wait_urb+0x13f/0x5b0
[ 88.652141][ T5334] ? __pfx_usb_start_wait_urb+0x10/0x10
[ 88.654623][ T5334] usb_control_msg+0x234/0x3e0
[ 88.656940][ T5334] ec168_ctrl_msg+0x308/0x7c0
[ 88.661815][ T5334] ec168_i2c_xfer+0x10e/0x630
[ 88.664496][ T5334] __i2c_transfer+0x7bf/0x1fe0
[ 88.667392][ T5334] ? rt_mutex_lock_nested+0x167/0x1c0
[ 88.670279][ T5334] ? i2c_transfer+0xc7/0x2d0
[ 88.672475][ T5334] i2c_transfer+0x1cb/0x2d0
[ 88.674534][ T5334] i2cdev_ioctl_rdwr+0x460/0x740
[ 88.676977][ T5334] i2cdev_ioctl+0x6a5/0x880
[ 88.679052][ T5334] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 88.681230][ T5334] ? __fget_files+0x3a2/0x420
[ 88.683401][ T5334] ? __fget_files+0x2a/0x420
[ 88.685724][ T5334] ? bpf_lsm_file_ioctl+0x9/0x20
[ 88.688469][ T5334] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 88.690587][ T5334] __se_sys_ioctl+0xfc/0x170
[ 88.692782][ T5334] do_syscall_64+0x166/0x520
[ 88.694873][ T5334] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.697503][ T5334] ? clear_bhb_loop+0x70/0xc0
[ 88.699559][ T5334] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.702194][ T5334] RIP: 0033:0x7f357219e559
[ 88.704256][ T5334] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 88.712849][ T5334] RSP: 002b:00007f357302ffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 88.716523][ T5334] RAX: ffffffffffffffda RBX: 00007f3572425fa0 RCX: 00007f357219e559
[ 88.719771][ T5334] RDX: 0000200000000200 RSI: 0000000000000707 RDI: 0000000000000004
[ 88.724006][ T5334] RBP: 00007f35722358b0 R08: 0000000000000000 R09: 0000000000000000
[ 88.727397][ T5334] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 88.730650][ T5334] R13: 00007f3572426038 R14: 00007f3572425fa0 R15: 00007fffa16a1d18
[ 88.733941][ T5334]
[ 88.735270][ T5334] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 88.738260][ T5334] CPU: 0 UID: 0 PID: 5334 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 88.742040][ T5334] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 88.746269][ T5334] Call Trace:
[ 88.747608][ T5334]
[ 88.748795][ T5334] vpanic+0x56d/0xa60
[ 88.750405][ T5334] ? __pfx__printk+0x10/0x10
[ 88.752344][ T5334] ? __pfx_vpanic+0x10/0x10
[ 88.754343][ T5334] ? is_bpf_text_address+0x292/0x2b0
[ 88.756613][ T5334] ? is_bpf_text_address+0x26/0x2b0
[ 88.758870][ T5334] panic+0xc5/0xd0
[ 88.760485][ T5334] ? __pfx_panic+0x10/0x10
[ 88.762331][ T5334] __warn+0x315/0x4c0
[ 88.763973][ T5334] ? usb_submit_urb+0x1057/0x18b0
[ 88.765971][ T5334] ? usb_submit_urb+0x1057/0x18b0
[ 88.767996][ T5334] __report_bug+0x276/0x570
[ 88.769822][ T5334] ? usb_submit_urb+0x1057/0x18b0
[ 88.771858][ T5334] ? __pfx___report_bug+0x10/0x10
[ 88.774058][ T5334] ? stack_depot_save_flags+0x404/0x7f0
[ 88.776444][ T5334] report_bug_entry+0x19b/0x290
[ 88.778385][ T5334] ? usb_submit_urb+0x1100/0x18b0
[ 88.780640][ T5334] ? usb_submit_urb+0x1105/0x18b0
[ 88.782723][ T5334] handle_bug+0xce/0x200
[ 88.784607][ T5334] exc_invalid_op+0x1a/0x50
[ 88.786606][ T5334] asm_exc_invalid_op+0x1a/0x20
[ 88.788722][ T5334] RIP: 0010:usb_submit_urb+0x1100/0x18b0
[ 88.791137][ T5334] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89
[ 88.800219][ T5334] RSP: 0018:ffffc9000e3ef8d8 EFLAGS: 00010246
[ 88.802962][ T5334] RAX: 0000000000000000 RBX: ffff88803683b700 RCX: 0000000080000280
[ 88.806711][ T5334] RDX: ffff88803549c7e0 RSI: ffffffff8cc57b40 RDI: ffffffff91885110
[ 88.810216][ T5334] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000
[ 88.813735][ T5334] R10: ffffc9000e3ef9c0 R11: fffff52001c7df44 R12: 1ffff110062de6b8
[ 88.817167][ T5334] R13: ffff8880316f35c0 R14: ffff88803549c7e0 R15: 0000000080000280
[ 88.820433][ T5334] ? usb_submit_urb+0x1091/0x18b0
[ 88.822568][ T5334] usb_start_wait_urb+0x13f/0x5b0
[ 88.824598][ T5334] ? __pfx_usb_start_wait_urb+0x10/0x10
[ 88.826886][ T5334] usb_control_msg+0x234/0x3e0
[ 88.828967][ T5334] ec168_ctrl_msg+0x308/0x7c0
[ 88.831042][ T5334] ec168_i2c_xfer+0x10e/0x630
[ 88.833155][ T5334] __i2c_transfer+0x7bf/0x1fe0
[ 88.835311][ T5334] ? rt_mutex_lock_nested+0x167/0x1c0
[ 88.837675][ T5334] ? i2c_transfer+0xc7/0x2d0
[ 88.839754][ T5334] i2c_transfer+0x1cb/0x2d0
[ 88.841730][ T5334] i2cdev_ioctl_rdwr+0x460/0x740
[ 88.843922][ T5334] i2cdev_ioctl+0x6a5/0x880
[ 88.845888][ T5334] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 88.848138][ T5334] ? __fget_files+0x3a2/0x420
[ 88.850261][ T5334] ? __fget_files+0x2a/0x420
[ 88.852138][ T5334] ? bpf_lsm_file_ioctl+0x9/0x20
[ 88.854353][ T5334] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 88.856538][ T5334] __se_sys_ioctl+0xfc/0x170
[ 88.858622][ T5334] do_syscall_64+0x166/0x520
[ 88.860653][ T5334] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.863090][ T5334] ? clear_bhb_loop+0x70/0xc0
[ 88.865085][ T5334] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.867483][ T5334] RIP: 0033:0x7f357219e559
[ 88.869230][ T5334] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 88.876941][ T5334] RSP: 002b:00007f357302ffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 88.880141][ T5334] RAX: ffffffffffffffda RBX: 00007f3572425fa0 RCX: 00007f357219e559
[ 88.882869][ T5334] RDX: 0000200000000200 RSI: 0000000000000707 RDI: 0000000000000004
[ 88.885983][ T5334] RBP: 00007f35722358b0 R08: 0000000000000000 R09: 0000000000000000
[ 88.889455][ T5334] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 88.892945][ T5334] R13: 00007f3572426038 R14: 00007f3572425fa0 R15: 00007fffa16a1d18
[ 88.896421][ T5334]
[ 88.898104][ T5334] Kernel Offset: disabled
[ 88.899953][ T5334] Rebooting in 86400 seconds..