program:
madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0)
syz_usb_control_io$uac1(r1, 0x0, 0x0)
syz_usb_control_io$printer(r1, 0x0, 0x0)
r2 = syz_open_dev$I2C(&(0x7f0000000340), 0xc, 0x88000)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000600)={0x18, &(0x7f0000000300)=ANY=[@ANYBLOB="201600000000987d15240a31161652d3d5"], 0x0, 0x0, 0x0, 0x0})
ioctl$I2C_SMBUS(r2, 0x720, &(0x7f0000000140)={0x1, 0x6, 0x1, &(0x7f0000000100)={0x5, "cd3012b4c131d0d6847374e7ffff000200"}})
sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000020303000000000000000000000100000800010001"], 0x1c}}, 0x0)
mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./pipefs\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./pipefs\x00', &(0x7f0000000100)='rpc_pipefs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./pipefs/gssd/clntXX/gssd\x00', 0x2, 0x0)
ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r3, 0x541b, 0x0)
r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000000010000000000000"], 0x50)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="032000000400000004a42a000ac69a0eb93c094de4b5e9f67cf60e6182aa4812b66610c5435d90d77da79c96"], 0x50)
bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0xe, 0x11, &(0x7f0000000440)=ANY=[@ANYRESHEX=r0, @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf09000000000000b609010000000281650000007ffffffa18130000", @ANYRESDEC=r5, @ANYBLOB="00000000000000005f93000000000000b5030000030000008500000076000000b7000000000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c00000002030300000000000001000000000010"], 0x1c}}, 0x0)
r6 = syz_usb_connect$uac2(0x0, 0x7b, &(0x7f0000000280)=ANY=[@ANYBLOB="120100020000000882058b00400001020301090269000301"], 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f0000004200)='./mnt/trace_marker\x00', 0x1, 0x0)
write(r7, &(0x7f0000000000)="2d2519", 0x3)
sendmsg$AUDIT_SET_FEATURE(r7, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x20, 0x3fa, 0x8, 0x70bd2c, 0x25dfdbfb, {0x1, 0x1}, ["", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x2000}, 0x4)
syz_usb_control_io$uac2(r6, 0x0, 0x0)
r8 = syz_open_dev$usbfs(&(0x7f0000000180), 0x10000001d, 0x8041)
close(0x3)
ioctl$USBDEVFS_SETCONFIGURATION(r8, 0x80045505, &(0x7f0000000140)=0x1)
sendmsg$NFQNL_MSG_VERDICT(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)=ANY=[@ANYBLOB="1400000001030104000000000000000001000000c71ae47cc336dddb141acd1869a6b3fdc414f576ea78b3724f238531a301e9a077cb807cf1ecd64b9f67054e542080ae"], 0x14}, 0x1, 0x0, 0x0, 0x804}, 0x4004840)
madvise(&(0x7f0000e3a000/0x2000)=nil, 0x2000, 0x16)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0)
[ 94.810528][ T5280] Bluetooth: hci0: command tx timeout
[ 95.131665][ T5297] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 95.281707][ T5297] usb 5-1: Using ep0 maxpacket: 16
[ 95.285585][ T5297] usb 5-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3
[ 95.297372][ T5297] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 95.297476][ T5297] usb 5-1: Product: syz
[ 95.297545][ T5297] usb 5-1: Manufacturer: syz
[ 95.297575][ T5297] usb 5-1: SerialNumber: syz
[ 95.334618][ T5297] usb 5-1: config 0 descriptor??
[ 95.786362][ T5297] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state.
[ 95.829078][ T5297] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[ 95.836825][ T5297] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T)
[ 95.840544][ T5297] usb 5-1: media controller created
[ 95.857591][ T5297] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[ 95.992641][ T5297] zl10353_read_register: readreg error (reg=127, ret==0)
[ 95.997384][ T5297] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T'
[ 96.002036][ T5297] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected.
[ 96.362822][ T5320] ------------[ cut here ]------------
[ 96.362866][ T5320] usb 5-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0
[ 96.363281][ T5320] WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1057/0x18b0, CPU#0: syz.0.0/5320
[ 96.374715][ T5320] Modules linked in:
[ 96.377077][ T5320] CPU: 0 UID: 0 PID: 5320 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 96.380666][ T5320] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 96.384848][ T5320] RIP: 0010:usb_submit_urb+0x1100/0x18b0
[ 96.387158][ T5320] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89
[ 96.395390][ T5320] RSP: 0018:ffffc9000f517698 EFLAGS: 00010246
[ 96.398162][ T5320] RAX: 0000000000000000 RBX: ffff88801d247d00 RCX: 0000000080000280
[ 96.401669][ T5320] RDX: ffff888044289380 RSI: ffffffff8cc526c0 RDI: ffffffff9087ef60
[ 96.405030][ T5320] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000
[ 96.408372][ T5320] R10: ffffc9000f517780 R11: fffff52001ea2efc R12: 1ffff11008851348
[ 96.411884][ T5320] R13: ffff888044289a40 R14: ffff888044289380 R15: 0000000080000280
[ 96.415301][ T5320] FS: 00007fc2bebd46c0(0000) GS:ffff88808c2cd000(0000) knlGS:0000000000000000
[ 96.419530][ T5320] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 96.422755][ T5320] CR2: 000055f3d0801760 CR3: 000000000bf5e000 CR4: 0000000000352ef0
[ 96.426103][ T5320] Call Trace:
[ 96.427660][ T5320]
[ 96.428982][ T5320] usb_start_wait_urb+0x13f/0x5b0
[ 96.431326][ T5320] ? trace_kmalloc+0x2a/0xf0
[ 96.433493][ T5320] ? __pfx_usb_start_wait_urb+0x10/0x10
[ 96.435981][ T5320] usb_control_msg+0x234/0x3e0
[ 96.438079][ T5320] dtv5100_i2c_msg+0x231/0x2f0
[ 96.440007][ T5320] dtv5100_i2c_xfer+0x1a5/0x610
[ 96.441825][ T5320] ? kasan_save_track+0x4f/0x80
[ 96.443580][ T5320] ? kasan_save_free_info+0x40/0x50
[ 96.445459][ T5320] ? __se_sys_ioctl+0x47/0x170
[ 96.447398][ T5320] __i2c_transfer+0x7bf/0x1fe0
[ 96.449524][ T5320] __i2c_smbus_xfer+0x159a/0x27e0
[ 96.451959][ T5320] ? __pfx___i2c_smbus_xfer+0x10/0x10
[ 96.454365][ T5320] ? rt_mutex_lock_nested+0x156/0x1c0
[ 96.456758][ T5320] i2c_smbus_xfer+0x1f5/0x310
[ 96.458970][ T5320] i2cdev_ioctl_smbus+0x407/0x700
[ 96.461265][ T5320] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10
[ 96.463835][ T5320] i2cdev_ioctl+0x615/0x880
[ 96.465899][ T5320] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 96.468071][ T5320] ? __fget_files+0x2a/0x420
[ 96.470160][ T5320] ? __fget_files+0x3a2/0x420
[ 96.472479][ T5320] ? bpf_lsm_file_ioctl+0x9/0x20
[ 96.474610][ T5320] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 96.476845][ T5320] __se_sys_ioctl+0xfc/0x170
[ 96.478901][ T5320] do_syscall_64+0x166/0x520
[ 96.480971][ T5320] ? trace_irq_disable+0x3b/0x140
[ 96.484771][ T5320] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 96.487415][ T5320] ? clear_bhb_loop+0x70/0xc0
[ 96.489507][ T5320] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 96.492687][ T5320] RIP: 0033:0x7fc2c279e159
[ 96.494980][ T5320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 96.503485][ T5320] RSP: 002b:00007fc2bebd3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 96.507002][ T5320] RAX: ffffffffffffffda RBX: 00007fc2c2a26090 RCX: 00007fc2c279e159
[ 96.510195][ T5320] RDX: 0000200000000140 RSI: 0000000000000720 RDI: 0000000000000005
[ 96.513666][ T5320] RBP: 00007fc2c2835024 R08: 0000000000000000 R09: 0000000000000000
[ 96.517149][ T5320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 96.520966][ T5320] R13: 00007fc2c2a26128 R14: 00007fc2c2a26090 R15: 00007fff246aef58
[ 96.524812][ T5320]
[ 96.526123][ T5320] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 96.529009][ T5320] CPU: 0 UID: 0 PID: 5320 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 96.532535][ T5320] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 96.536758][ T5320] Call Trace:
[ 96.538196][ T5320]
[ 96.539451][ T5320] vpanic+0x56d/0xa60
[ 96.541126][ T5320] ? __pfx__printk+0x10/0x10
[ 96.542992][ T5320] ? __pfx_vpanic+0x10/0x10
[ 96.544850][ T5320] ? is_bpf_text_address+0x292/0x2b0
[ 96.546951][ T5320] ? is_bpf_text_address+0x26/0x2b0
[ 96.549073][ T5320] panic+0xc5/0xd0
[ 96.550676][ T5320] ? __pfx_panic+0x10/0x10
[ 96.552443][ T5320] __warn+0x315/0x4c0
[ 96.554084][ T5320] ? usb_submit_urb+0x1057/0x18b0
[ 96.555905][ T5320] ? usb_submit_urb+0x1057/0x18b0
[ 96.557905][ T5320] __report_bug+0x276/0x570
[ 96.559865][ T5320] ? usb_submit_urb+0x1057/0x18b0
[ 96.562027][ T5320] ? __pfx___report_bug+0x10/0x10
[ 96.564249][ T5320] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 96.566863][ T5320] ? kasan_save_track+0x4f/0x80
[ 96.568971][ T5320] report_bug_entry+0x19b/0x290
[ 96.571109][ T5320] ? usb_submit_urb+0x1100/0x18b0
[ 96.573325][ T5320] ? usb_submit_urb+0x1105/0x18b0
[ 96.575592][ T5320] handle_bug+0xce/0x200
[ 96.577410][ T5320] exc_invalid_op+0x1a/0x50
[ 96.579054][ T5320] asm_exc_invalid_op+0x1a/0x20
[ 96.580859][ T5320] RIP: 0010:usb_submit_urb+0x1100/0x18b0
[ 96.582869][ T5320] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89
[ 96.589487][ T5320] RSP: 0018:ffffc9000f517698 EFLAGS: 00010246
[ 96.591592][ T5320] RAX: 0000000000000000 RBX: ffff88801d247d00 RCX: 0000000080000280
[ 96.594629][ T5320] RDX: ffff888044289380 RSI: ffffffff8cc526c0 RDI: ffffffff9087ef60
[ 96.597359][ T5320] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000
[ 96.600148][ T5320] R10: ffffc9000f517780 R11: fffff52001ea2efc R12: 1ffff11008851348
[ 96.603476][ T5320] R13: ffff888044289a40 R14: ffff888044289380 R15: 0000000080000280
[ 96.606848][ T5320] ? usb_submit_urb+0x1091/0x18b0
[ 96.609055][ T5320] usb_start_wait_urb+0x13f/0x5b0
[ 96.611295][ T5320] ? trace_kmalloc+0x2a/0xf0
[ 96.613305][ T5320] ? __pfx_usb_start_wait_urb+0x10/0x10
[ 96.615485][ T5320] usb_control_msg+0x234/0x3e0
[ 96.617447][ T5320] dtv5100_i2c_msg+0x231/0x2f0
[ 96.619541][ T5320] dtv5100_i2c_xfer+0x1a5/0x610
[ 96.621557][ T5320] ? kasan_save_track+0x4f/0x80
[ 96.623648][ T5320] ? kasan_save_free_info+0x40/0x50
[ 96.625780][ T5320] ? __se_sys_ioctl+0x47/0x170
[ 96.627790][ T5320] __i2c_transfer+0x7bf/0x1fe0
[ 96.629931][ T5320] __i2c_smbus_xfer+0x159a/0x27e0
[ 96.632149][ T5320] ? __pfx___i2c_smbus_xfer+0x10/0x10
[ 96.634574][ T5320] ? rt_mutex_lock_nested+0x156/0x1c0
[ 96.636907][ T5320] i2c_smbus_xfer+0x1f5/0x310
[ 96.639016][ T5320] i2cdev_ioctl_smbus+0x407/0x700
[ 96.641255][ T5320] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10
[ 96.643699][ T5320] i2cdev_ioctl+0x615/0x880
[ 96.645706][ T5320] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 96.647827][ T5320] ? __fget_files+0x2a/0x420
[ 96.649629][ T5320] ? __fget_files+0x3a2/0x420
[ 96.651429][ T5320] ? bpf_lsm_file_ioctl+0x9/0x20
[ 96.653322][ T5320] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 96.658933][ T5320] __se_sys_ioctl+0xfc/0x170
[ 96.660881][ T5320] do_syscall_64+0x166/0x520
[ 96.662745][ T5320] ? trace_irq_disable+0x3b/0x140
[ 96.664717][ T5320] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 96.667154][ T5320] ? clear_bhb_loop+0x70/0xc0
[ 96.668895][ T5320] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 96.671204][ T5320] RIP: 0033:0x7fc2c279e159
[ 96.672740][ T5320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 96.680945][ T5320] RSP: 002b:00007fc2bebd3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 96.684628][ T5320] RAX: ffffffffffffffda RBX: 00007fc2c2a26090 RCX: 00007fc2c279e159
[ 96.687757][ T5320] RDX: 0000200000000140 RSI: 0000000000000720 RDI: 0000000000000005
[ 96.690785][ T5320] RBP: 00007fc2c2835024 R08: 0000000000000000 R09: 0000000000000000
[ 96.694239][ T5320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 96.697509][ T5320] R13: 00007fc2c2a26128 R14: 00007fc2c2a26090 R15: 00007fff246aef58
[ 96.700797][ T5320]
[ 96.702546][ T5320] Kernel Offset: disabled
[ 96.704446][ T5320] Rebooting in 86400 seconds..