------------[ cut here ]------------
usb 3-1: BOGUS control dir, pipe 80001a80 doesn't match bRequestType c0
WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1057/0x18b0 drivers/usb/core/urb.c:411, CPU#1: syz.4.403/7305
Modules linked in:
CPU: 1 UID: 0 PID: 7305 Comm: syz.4.403 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
RIP: 0010:usb_submit_urb+0x1100/0x18b0 drivers/usb/core/urb.c:411
Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89
RSP: 0018:ffffc90005cc76f8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8880323dad00 RCX: 0000000080001a80
RDX: ffff8880692990e0 RSI: ffffffff8c819780 RDI: ffffffff903f39b0
RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000
R10: ffffc90005cc77e0 R11: fffff52000b98f08 R12: 1ffff1100565cf5c
R13: ffff88802b2e7ae0 R14: ffff8880692990e0 R15: 0000000080001a80
FS:  0000000000000000(0000) GS:ffff88812535d000(0063) knlGS:00000000f53f5b40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000080001180 CR3: 0000000077654000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 usb_start_wait_urb+0x13f/0x5b0 drivers/usb/core/message.c:62
 usb_internal_control_msg drivers/usb/core/message.c:117 [inline]
 usb_control_msg+0x234/0x3e0 drivers/usb/core/message.c:167
 gl861_ctrl_msg+0x207/0x420 drivers/media/usb/dvb-usb-v2/gl861.c:58
 gl861_i2c_master_xfer+0x439/0x6a0 drivers/media/usb/dvb-usb-v2/gl861.c:-1
 __i2c_transfer+0x7be/0x1fe0 drivers/i2c/i2c-core-base.c:-1
 i2c_transfer+0x1cc/0x2d0 drivers/i2c/i2c-core-base.c:2343
 i2cdev_ioctl_rdwr+0x460/0x740 drivers/i2c/i2c-dev.c:306
 compat_i2cdev_ioctl+0x59f/0x5c0 drivers/i2c/i2c-dev.c:575
 __do_compat_sys_ioctl fs/ioctl.c:695 [inline]
 __se_compat_sys_ioctl fs/ioctl.c:638 [inline]
 __ia32_compat_sys_ioctl+0x5ea/0x950 fs/ioctl.c:638
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
 __do_fast_syscall_32+0x23e/0x6f0 arch/x86/entry/syscall_32.c:307
 do_fast_syscall_32+0x33/0x70 arch/x86/entry/syscall_32.c:332
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf7f590ec
Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8
RSP: 002b:00000000f53f550c EFLAGS: 00000206 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000707
RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	b8 00 00 00 00       	mov    $0x0,%eax
   5:	00 fc                	add    %bh,%ah
   7:	ff                   	lcall  (bad)
   8:	df 41 0f             	filds  0xf(%rcx)
   b:	b6 04                	mov    $0x4,%dh
   d:	04 84                	add    $0x84,%al
   f:	c0 0f 85             	rorb   $0x85,(%rdi)
  12:	b2 05                	mov    $0x5,%dl
  14:	00 00                	add    %al,(%rax)
  16:	45 0f b6 45 00       	movzbl 0x0(%r13),%r8d
  1b:	48 8b 3c 24          	mov    (%rsp),%rdi
  1f:	48 8b 74 24 18       	mov    0x18(%rsp),%rsi
  24:	4c 89 f2             	mov    %r14,%rdx
  27:	44 89 f9             	mov    %r15d,%ecx
* 2a:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2f:	48 bd 00 00 00 00 00 	movabs $0xdffffc0000000000,%rbp
  36:	fc ff df
  39:	e9 ba f2 ff ff       	jmp    0xfffff2f8
  3e:	44                   	rex.R
  3f:	89                   	.byte 0x89