program:
r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, &(0x7f0000000180)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0)
r1 = syz_open_dev$I2C(&(0x7f00000000c0), 0xc, 0x88000)
ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000300)={&(0x7f0000002400)=[{0x0, 0x4801, 0x0, 0x0}], 0x1})
[ 85.827829][ T5285] Bluetooth: hci0: command tx timeout
[ 86.248932][ T110] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 86.404247][ T110] usb 5-1: Using ep0 maxpacket: 16
[ 86.405235][ T110] usb 5-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22
[ 86.416022][ T110] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 86.416038][ T110] usb 5-1: Product: syz
[ 86.416046][ T110] usb 5-1: Manufacturer: syz
[ 86.416054][ T110] usb 5-1: SerialNumber: syz
[ 86.653713][ T110] usb 5-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state
[ 86.674468][ T110] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer
[ 86.674904][ T110] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0)
[ 86.675135][ T110] usb 5-1: media controller created
[ 86.713805][ T110] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[ 86.950144][ T110] zl10353_read_register: readreg error (reg=127, ret==-110)
[ 86.964082][ T5324] ------------[ cut here ]------------
[ 86.964095][ T5324] usb 5-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0
[ 86.964116][ T5324] WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1057/0x18b0, CPU#0: syz.0.0/5324
[ 86.979207][ T5324] Modules linked in:
[ 86.981972][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 86.986767][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.992322][ T5324] RIP: 0010:usb_submit_urb+0x1100/0x18b0
[ 86.995858][ T5324] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89
[ 87.005829][ T5324] RSP: 0018:ffffc9000e28f8d8 EFLAGS: 00010246
[ 87.008496][ T5324] RAX: 0000000000000000 RBX: ffff888042a0a700 RCX: 0000000080000280
[ 87.012091][ T5324] RDX: ffff8880525f6b00 RSI: ffffffff8cc55400 RDI: ffffffff90884010
[ 87.015571][ T5324] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000
[ 87.019515][ T5324] R10: ffffc9000e28f9c0 R11: fffff52001c51f44 R12: 1ffff11007fc39d8
[ 87.023001][ T5324] R13: ffff88803fe1cec0 R14: ffff8880525f6b00 R15: 0000000080000280
[ 87.026583][ T5324] FS: 00007f11a42996c0(0000) GS:ffff88808c2bb000(0000) knlGS:0000000000000000
[ 87.030594][ T5324] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 87.033659][ T5324] CR2: 0000200000002400 CR3: 000000003fdb9000 CR4: 0000000000352ef0
[ 87.037235][ T5324] Call Trace:
[ 87.038845][ T5324]
[ 87.040123][ T5324] usb_start_wait_urb+0x13f/0x5b0
[ 87.042165][ T5324] ? __pfx_usb_start_wait_urb+0x10/0x10
[ 87.044523][ T5324] usb_control_msg+0x234/0x3e0
[ 87.046648][ T5324] gl861_ctrl_msg+0x207/0x420
[ 87.048849][ T5324] ? __pfx_gl861_ctrl_msg+0x10/0x10
[ 87.051233][ T5324] ? rt_mutex_slowlock+0x1f2/0x780
[ 87.053396][ T5324] ? __pfx_rt_mutex_slowlock+0x10/0x10
[ 87.056699][ T5324] gl861_i2c_master_xfer+0x439/0x6a0
[ 87.059201][ T5324] __i2c_transfer+0x7bf/0x1fe0
[ 87.061373][ T5324] ? rt_mutex_lock_nested+0x167/0x1c0
[ 87.063787][ T5324] ? i2c_transfer+0xc7/0x2d0
[ 87.065962][ T5324] i2c_transfer+0x1cb/0x2d0
[ 87.067942][ T5324] i2cdev_ioctl_rdwr+0x460/0x740
[ 87.070317][ T5324] i2cdev_ioctl+0x6a5/0x880
[ 87.072340][ T5324] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 87.074661][ T5324] ? __fget_files+0x3a2/0x420
[ 87.076795][ T5324] ? __fget_files+0x2a/0x420
[ 87.079010][ T5324] ? bpf_lsm_file_ioctl+0x9/0x20
[ 87.081219][ T5324] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 87.083310][ T5324] __se_sys_ioctl+0xfc/0x170
[ 87.086802][ T5324] do_syscall_64+0x166/0x520
[ 87.089049][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.091855][ T5324] ? clear_bhb_loop+0x70/0xc0
[ 87.093951][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.097744][ T5324] RIP: 0033:0x7f11a339e159
[ 87.100148][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 87.108461][ T5324] RSP: 002b:00007f11a4298fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 87.112023][ T5324] RAX: ffffffffffffffda RBX: 00007f11a3625fa0 RCX: 00007f11a339e159
[ 87.115368][ T5324] RDX: 0000200000000300 RSI: 0000000000000707 RDI: 0000000000000004
[ 87.118748][ T5324] RBP: 00007f11a343506b R08: 0000000000000000 R09: 0000000000000000
[ 87.122025][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 87.125427][ T5324] R13: 00007f11a3626038 R14: 00007f11a3625fa0 R15: 00007ffdbf1a7f68
[ 87.128818][ T5324]
[ 87.130163][ T5324] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 87.133295][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 87.137010][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 87.141133][ T5324] Call Trace:
[ 87.142575][ T5324]
[ 87.143928][ T5324] vpanic+0x56d/0xa60
[ 87.145740][ T5324] ? __pfx__printk+0x10/0x10
[ 87.147775][ T5324] ? __pfx_vpanic+0x10/0x10
[ 87.149848][ T5324] ? is_bpf_text_address+0x292/0x2b0
[ 87.152206][ T5324] ? is_bpf_text_address+0x26/0x2b0
[ 87.154490][ T5324] panic+0xc5/0xd0
[ 87.156176][ T5324] ? __pfx_panic+0x10/0x10
[ 87.158225][ T5324] __warn+0x315/0x4c0
[ 87.159975][ T5324] ? usb_submit_urb+0x1057/0x18b0
[ 87.162257][ T5324] ? usb_submit_urb+0x1057/0x18b0
[ 87.164451][ T5324] __report_bug+0x276/0x570
[ 87.166463][ T5324] ? usb_submit_urb+0x1057/0x18b0
[ 87.168756][ T5324] ? __pfx___report_bug+0x10/0x10
[ 87.171086][ T5324] ? usb_submit_urb+0x1105/0x18b0
[ 87.173323][ T5324] ? usb_submit_urb+0x1100/0x18b0
[ 87.175458][ T5324] report_bug_entry+0x19b/0x290
[ 87.177715][ T5324] ? usb_submit_urb+0x1100/0x18b0
[ 87.179947][ T5324] ? usb_submit_urb+0x1105/0x18b0
[ 87.182188][ T5324] handle_bug+0xce/0x200
[ 87.184056][ T5324] exc_invalid_op+0x1a/0x50
[ 87.186029][ T5324] asm_exc_invalid_op+0x1a/0x20
[ 87.188072][ T5324] RIP: 0010:usb_submit_urb+0x1100/0x18b0
[ 87.190462][ T5324] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89
[ 87.198597][ T5324] RSP: 0018:ffffc9000e28f8d8 EFLAGS: 00010246
[ 87.202637][ T5324] RAX: 0000000000000000 RBX: ffff888042a0a700 RCX: 0000000080000280
[ 87.206200][ T5324] RDX: ffff8880525f6b00 RSI: ffffffff8cc55400 RDI: ffffffff90884010
[ 87.209743][ T5324] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000
[ 87.213206][ T5324] R10: ffffc9000e28f9c0 R11: fffff52001c51f44 R12: 1ffff11007fc39d8
[ 87.216680][ T5324] R13: ffff88803fe1cec0 R14: ffff8880525f6b00 R15: 0000000080000280
[ 87.220066][ T5324] ? usb_submit_urb+0x1091/0x18b0
[ 87.222296][ T5324] usb_start_wait_urb+0x13f/0x5b0
[ 87.224448][ T5324] ? __pfx_usb_start_wait_urb+0x10/0x10
[ 87.226838][ T5324] usb_control_msg+0x234/0x3e0
[ 87.228917][ T5324] gl861_ctrl_msg+0x207/0x420
[ 87.230948][ T5324] ? __pfx_gl861_ctrl_msg+0x10/0x10
[ 87.233312][ T5324] ? rt_mutex_slowlock+0x1f2/0x780
[ 87.235619][ T5324] ? __pfx_rt_mutex_slowlock+0x10/0x10
[ 87.238073][ T5324] gl861_i2c_master_xfer+0x439/0x6a0
[ 87.240427][ T5324] __i2c_transfer+0x7bf/0x1fe0
[ 87.242570][ T5324] ? rt_mutex_lock_nested+0x167/0x1c0
[ 87.244924][ T5324] ? i2c_transfer+0xc7/0x2d0
[ 87.246889][ T5324] i2c_transfer+0x1cb/0x2d0
[ 87.248788][ T5324] i2cdev_ioctl_rdwr+0x460/0x740
[ 87.250947][ T5324] i2cdev_ioctl+0x6a5/0x880
[ 87.253021][ T5324] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 87.255171][ T5324] ? __fget_files+0x3a2/0x420
[ 87.257233][ T5324] ? __fget_files+0x2a/0x420
[ 87.259218][ T5324] ? bpf_lsm_file_ioctl+0x9/0x20
[ 87.261321][ T5324] ? __pfx_i2cdev_ioctl+0x10/0x10
[ 87.263471][ T5324] __se_sys_ioctl+0xfc/0x170
[ 87.266666][ T5324] do_syscall_64+0x166/0x520
[ 87.268728][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.271428][ T5324] ? clear_bhb_loop+0x70/0xc0
[ 87.273593][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.276170][ T5324] RIP: 0033:0x7f11a339e159
[ 87.278284][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 87.286716][ T5324] RSP: 002b:00007f11a4298fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 87.290229][ T5324] RAX: ffffffffffffffda RBX: 00007f11a3625fa0 RCX: 00007f11a339e159
[ 87.293512][ T5324] RDX: 0000200000000300 RSI: 0000000000000707 RDI: 0000000000000004
[ 87.296922][ T5324] RBP: 00007f11a343506b R08: 0000000000000000 R09: 0000000000000000
[ 87.300375][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 87.303911][ T5324] R13: 00007f11a3626038 R14: 00007f11a3625fa0 R15: 00007ffdbf1a7f68
[ 87.307300][ T5324]
[ 87.309198][ T5324] Kernel Offset: disabled
[ 87.311171][ T5324] Rebooting in 86400 seconds..