program: r0 = socket$igmp(0x2, 0x3, 0x2) r1 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000440)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) r2 = syz_open_dev$I2C(&(0x7f0000000480), 0xc, 0x88000) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f00000004c0)={0x2c, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_connect$uac3(0x1, 0x80, &(0x7f00000005c0)=ANY=[@ANYBLOB="12010102000000086307500140000102030109026e000301008002080b0101ed22307f0904000000010130000a24010a0a00000000000904010000010230000904010101010230000905010908000313060a252507000000090800090402000001023000090402010101023000002402010810a4ce4b002402020000010006fd0905820900020302400a2525020000000d0600"], &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x1}) r3 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000007c0)={0xffffffffffffffff, 0x58, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) sendmsg$nl_route_sched(r3, &(0x7f0000000880)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)=@getqdisc={0x28, 0x26, 0x200, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, r4, {0x6}, {0x2, 0x7}, {0xa, 0xb}}, [{0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x10000) r5 = syz_open_dev$usbfs(&(0x7f00000006c0), 0x10000001d, 0x8041) ioctl$USBDEVFS_IOCTL(r5, 0xc0105512, &(0x7f0000000700)=@usbdevfs_connect) ioctl$I2C_SMBUS(r2, 0x720, &(0x7f0000000540)={0x1, 0x2, 0x1, &(0x7f0000000580)={0x12, "3ac071ffbc8cd0d684737d99bb8bd238954c9a216d398df0f558125211b40c65fd"}}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) capset(&(0x7f0000000380)={0x20080522}, &(0x7f00000003c0)) openat$comedi(0xffffffffffffff9c, &(0x7f0000000400)='/dev/comedi0\x00', 0x400, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x12, 0x8, &(0x7f0000000300)=ANY=[@ANYBLOB="b702000000000000b7030000f1030000bfa400000000000007040000f8ffffffb7050000040000008500000039000000b70000000100000095"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock_addr=0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x6, 0x3, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000e4ff9500"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', r6}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000200)={r7, r6, 0x25, 0x2, @void}, 0x10) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000008c0)='devices.list\x00', 0x26e1, 0x0) close(r8) r9 = getpid() sendmsg$unix(r8, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000980)="e60d", 0x2}], 0x1, &(0x7f00000009c0)=[@cred={{0x1c, 0x1, 0x2, {r9, 0xee01, 0xee00}}}], 0x20, 0x10}, 0x10044001) sched_setaffinity(r9, 0x8, &(0x7f0000000a00)=0x2) socket(0xa, 0x3, 0x7) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xc5, 0x1, 0x0, 0x0, 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000a40), 0x3}, 0x4000, 0x0, 0xb, 0x0, 0x4, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x800000000, 0xffffffffffffffff, 0x9) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) remap_file_pages(&(0x7f000075d000/0x3000)=nil, 0x3000, 0x0, 0x5, 0x0) [ 104.043914][ T48] Bluetooth: hci0: command tx timeout [ 104.376278][ T43] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 104.527766][ T43] usb 5-1: Using ep0 maxpacket: 16 [ 104.528964][ T43] usb 5-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 104.545145][ T43] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 104.545165][ T43] usb 5-1: Product: syz [ 104.545174][ T43] usb 5-1: Manufacturer: syz [ 104.545181][ T43] usb 5-1: SerialNumber: syz [ 104.567930][ T43] usb 5-1: config 0 descriptor?? [ 104.976385][ T43] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 104.999173][ T43] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 105.000839][ T43] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 105.000899][ T43] usb 5-1: media controller created [ 105.033811][ T43] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 105.176928][ T43] zl10353_read_register: readreg error (reg=127, ret==0) [ 105.176970][ T43] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 105.176979][ T43] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 105.536451][ T5331] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 105.536888][ T5331] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 105.566406][ T5331] ------------[ cut here ]------------ [ 105.566421][ T5331] usb 5-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0 [ 105.566448][ T5331] WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1057/0x18b0, CPU#0: syz.0.0/5331 [ 105.579514][ T5331] Modules linked in: [ 105.582287][ T5331] CPU: 0 UID: 0 PID: 5331 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 105.587356][ T5331] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 105.592002][ T5331] RIP: 0010:usb_submit_urb+0x1100/0x18b0 [ 105.594900][ T5331] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89 [ 105.604242][ T5331] RSP: 0018:ffffc9000db37698 EFLAGS: 00010246 [ 105.607252][ T5331] RAX: 0000000000000000 RBX: ffff8880389a3400 RCX: 0000000080000280 [ 105.610935][ T5331] RDX: ffff88804fdd5f60 RSI: ffffffff8cc57dc0 RDI: ffffffff91885320 [ 105.614934][ T5331] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000 [ 105.618966][ T5331] R10: ffffc9000db37780 R11: fffff52001b66efc R12: 1ffff1100896ca34 [ 105.622588][ T5331] R13: ffff888044b651a0 R14: ffff88804fdd5f60 R15: 0000000080000280 [ 105.626394][ T5331] FS: 00007fc077fd76c0(0000) GS:ffff88808b0b4000(0000) knlGS:0000000000000000 [ 105.630618][ T5331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 105.633869][ T5331] CR2: 00007ffdb86b6000 CR3: 0000000050ae8000 CR4: 0000000000352ef0 [ 105.638921][ T5331] Call Trace: [ 105.641002][ T5331] [ 105.642741][ T5331] usb_start_wait_urb+0x13f/0x5b0 [ 105.645081][ T5331] ? trace_kmalloc+0x2a/0xf0 [ 105.647424][ T5331] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 105.650121][ T5331] usb_control_msg+0x234/0x3e0 [ 105.652264][ T5331] dtv5100_i2c_msg+0x231/0x2f0 [ 105.654628][ T5331] dtv5100_i2c_xfer+0x1a5/0x610 [ 105.657534][ T5331] ? kasan_save_track+0x4f/0x80 [ 105.659826][ T5331] ? kasan_save_free_info+0x40/0x50 [ 105.662304][ T5331] ? __se_sys_ioctl+0x47/0x170 [ 105.664471][ T5331] __i2c_transfer+0x7bf/0x1fe0 [ 105.666666][ T5331] __i2c_smbus_xfer+0x159a/0x27e0 [ 105.668997][ T5331] ? __pfx___i2c_smbus_xfer+0x10/0x10 [ 105.671448][ T5331] ? rt_mutex_lock_nested+0x156/0x1c0 [ 105.673936][ T5331] i2c_smbus_xfer+0x1f5/0x310 [ 105.676145][ T5331] i2cdev_ioctl_smbus+0x407/0x700 [ 105.678518][ T5331] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10 [ 105.681042][ T5331] i2cdev_ioctl+0x615/0x880 [ 105.683085][ T5331] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 105.685406][ T5331] ? __fget_files+0x2a/0x420 [ 105.687731][ T5331] ? __fget_files+0x3a2/0x420 [ 105.689857][ T5331] ? bpf_lsm_file_ioctl+0x9/0x20 [ 105.692956][ T5331] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 105.695320][ T5331] __se_sys_ioctl+0xfc/0x170 [ 105.697547][ T5331] do_syscall_64+0x166/0x520 [ 105.699570][ T5331] ? trace_irq_disable+0x3b/0x140 [ 105.701820][ T5331] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.704493][ T5331] ? clear_bhb_loop+0x70/0xc0 [ 105.706779][ T5331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.709512][ T5331] RIP: 0033:0x7fc07719e559 [ 105.711446][ T5331] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 105.720748][ T5331] RSP: 002b:00007fc077fd6fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 105.724487][ T5331] RAX: ffffffffffffffda RBX: 00007fc077426090 RCX: 00007fc07719e559 [ 105.728212][ T5331] RDX: 0000200000000540 RSI: 0000000000000720 RDI: 0000000000000005 [ 105.731601][ T5331] RBP: 00007fc077235ab8 R08: 0000000000000000 R09: 0000000000000000 [ 105.735295][ T5331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 105.738948][ T5331] R13: 00007fc077426128 R14: 00007fc077426090 R15: 00007ffd41275d68 [ 105.742768][ T5331] [ 105.744058][ T5331] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 105.747338][ T5331] CPU: 0 UID: 0 PID: 5331 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 105.751039][ T5331] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 105.755331][ T5331] Call Trace: [ 105.756723][ T5331] [ 105.757993][ T5331] vpanic+0x56d/0xa60 [ 105.759695][ T5331] ? __pfx__printk+0x10/0x10 [ 105.761640][ T5331] ? __pfx_vpanic+0x10/0x10 [ 105.763631][ T5331] ? is_bpf_text_address+0x292/0x2b0 [ 105.766038][ T5331] ? is_bpf_text_address+0x26/0x2b0 [ 105.768379][ T5331] panic+0xc5/0xd0 [ 105.770145][ T5331] ? __pfx_panic+0x10/0x10 [ 105.772529][ T5331] __warn+0x315/0x4c0 [ 105.774235][ T5331] ? usb_submit_urb+0x1057/0x18b0 [ 105.776375][ T5331] ? usb_submit_urb+0x1057/0x18b0 [ 105.778548][ T5331] __report_bug+0x276/0x570 [ 105.780655][ T5331] ? usb_submit_urb+0x1057/0x18b0 [ 105.782714][ T5331] ? __pfx___report_bug+0x10/0x10 [ 105.784821][ T5331] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 105.787232][ T5331] ? kasan_save_track+0x4f/0x80 [ 105.789219][ T5331] report_bug_entry+0x19b/0x290 [ 105.791426][ T5331] ? usb_submit_urb+0x1100/0x18b0 [ 105.793650][ T5331] ? usb_submit_urb+0x1105/0x18b0 [ 105.796041][ T5331] handle_bug+0xce/0x200 [ 105.798049][ T5331] exc_invalid_op+0x1a/0x50 [ 105.800089][ T5331] asm_exc_invalid_op+0x1a/0x20 [ 105.802178][ T5331] RIP: 0010:usb_submit_urb+0x1100/0x18b0 [ 105.804616][ T5331] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89 [ 105.812417][ T5331] RSP: 0018:ffffc9000db37698 EFLAGS: 00010246 [ 105.814872][ T5331] RAX: 0000000000000000 RBX: ffff8880389a3400 RCX: 0000000080000280 [ 105.817970][ T5331] RDX: ffff88804fdd5f60 RSI: ffffffff8cc57dc0 RDI: ffffffff91885320 [ 105.820801][ T5331] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000 [ 105.823692][ T5331] R10: ffffc9000db37780 R11: fffff52001b66efc R12: 1ffff1100896ca34 [ 105.826946][ T5331] R13: ffff888044b651a0 R14: ffff88804fdd5f60 R15: 0000000080000280 [ 105.830397][ T5331] ? usb_submit_urb+0x1091/0x18b0 [ 105.832700][ T5331] usb_start_wait_urb+0x13f/0x5b0 [ 105.834953][ T5331] ? trace_kmalloc+0x2a/0xf0 [ 105.837016][ T5331] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 105.839490][ T5331] usb_control_msg+0x234/0x3e0 [ 105.841400][ T5331] dtv5100_i2c_msg+0x231/0x2f0 [ 105.843344][ T5331] dtv5100_i2c_xfer+0x1a5/0x610 [ 105.845303][ T5331] ? kasan_save_track+0x4f/0x80 [ 105.847300][ T5331] ? kasan_save_free_info+0x40/0x50 [ 105.849334][ T5331] ? __se_sys_ioctl+0x47/0x170 [ 105.851362][ T5331] __i2c_transfer+0x7bf/0x1fe0 [ 105.853539][ T5331] __i2c_smbus_xfer+0x159a/0x27e0 [ 105.855780][ T5331] ? __pfx___i2c_smbus_xfer+0x10/0x10 [ 105.858370][ T5331] ? rt_mutex_lock_nested+0x156/0x1c0 [ 105.860765][ T5331] i2c_smbus_xfer+0x1f5/0x310 [ 105.863101][ T5331] i2cdev_ioctl_smbus+0x407/0x700 [ 105.865475][ T5331] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10 [ 105.868019][ T5331] i2cdev_ioctl+0x615/0x880 [ 105.870143][ T5331] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 105.872357][ T5331] ? __fget_files+0x2a/0x420 [ 105.874588][ T5331] ? __fget_files+0x3a2/0x420 [ 105.876803][ T5331] ? bpf_lsm_file_ioctl+0x9/0x20 [ 105.879173][ T5331] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 105.881522][ T5331] __se_sys_ioctl+0xfc/0x170 [ 105.883708][ T5331] do_syscall_64+0x166/0x520 [ 105.886049][ T5331] ? trace_irq_disable+0x3b/0x140 [ 105.888555][ T5331] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.891355][ T5331] ? clear_bhb_loop+0x70/0xc0 [ 105.893541][ T5331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.896188][ T5331] RIP: 0033:0x7fc07719e559 [ 105.898209][ T5331] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 105.907283][ T5331] RSP: 002b:00007fc077fd6fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 105.911073][ T5331] RAX: ffffffffffffffda RBX: 00007fc077426090 RCX: 00007fc07719e559 [ 105.914678][ T5331] RDX: 0000200000000540 RSI: 0000000000000720 RDI: 0000000000000005 [ 105.918082][ T5331] RBP: 00007fc077235ab8 R08: 0000000000000000 R09: 0000000000000000 [ 105.921522][ T5331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 105.924888][ T5331] R13: 00007fc077426128 R14: 00007fc077426090 R15: 00007ffd41275d68 [ 105.928631][ T5331] [ 105.930396][ T5331] Kernel Offset: disabled [ 105.932289][ T5331] Rebooting in 86400 seconds..