syzbot

cm109 1-1:0.0: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff8880171d1b00 submitted while active
WARNING: CPU: 0 PID: 3269 at drivers/usb/core/urb.c:378 usb_submit_urb+0x14e8/0x1880 drivers/usb/core/urb.c:378
Modules linked in:
CPU: 0 PID: 3269 Comm: kworker/0:3 Not tainted 6.0.0-syzkaller-09589-g55be6084c8e0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_submit_urb+0x14e8/0x1880 drivers/usb/core/urb.c:378
Code: 89 de e8 8b 06 e9 fb 84 db 0f 85 a3 f3 ff ff e8 fe 09 e9 fb 4c 89 fe 48 c7 c7 00 6a 91 8a c6 05 25 0d 39 08 01 e8 d7 8b ac 03 <0f> 0b e9 81 f3 ff ff 48 89 7c 24 40 e8 d7 09 e9 fb 48 8b 7c 24 40
RSP: 0018:ffffc900000079d8 EFLAGS: 00010086
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88807bd201c0 RSI: ffffffff81605668 RDI: fffff52000000f2d
RBP: ffff88801fd9fb80 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000101 R11: 6666666620425255 R12: 0000000000000046
R13: ffff88802008d058 R14: 00000000fffffff0 R15: ffff8880171d1b00
FS:  0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc4c20f9b68 CR3: 000000000bc8e000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 cm109_urb_irq_callback+0x2e6/0xaa0 drivers/input/misc/cm109.c:422
 __usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1671
 usb_hcd_giveback_urb+0x380/0x430 drivers/usb/core/hcd.c:1754
 dummy_timer+0x11ff/0x32c0 drivers/usb/gadget/udc/dummy_hcd.c:1988
 call_timer_fn+0x1a0/0x6b0 kernel/time/timer.c:1474
 expire_timers kernel/time/timer.c:1519 [inline]
 __run_timers.part.0+0x674/0xa80 kernel/time/timer.c:1790
 __run_timers kernel/time/timer.c:1768 [inline]
 run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1803
 __do_softirq+0x1d0/0x9c8 kernel/softirq.c:571
 invoke_softirq kernel/softirq.c:445 [inline]
 __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1107
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:kasan_check_range+0x16/0x180 mm/kasan/generic.c:188
Code: ff ff 89 43 08 5b 5d c3 66 66 2e 0f 1f 84 00 00 00 00 00 90 48 85 f6 0f 84 3c 01 00 00 49 89 f9 41 54 44 0f b6 c2 49 01 f1 55 <53> 0f 82 18 01 00 00 48 b8 ff ff ff ff ff 7f ff ff 48 39 c7 0f 86
RSP: 0018:ffffc900030cf750 EFLAGS: 00000286
RAX: 0000000000000000 RBX: ffff8880174191d0 RCX: ffffffff81fc4941
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff8880174191d0
RBP: ffff8880174191d0 R08: 0000000000000001 R09: ffff8880174191d4
R10: 0000000000000002 R11: 000000000008c07d R12: dffffc0000000000
R13: ffff8880174191d0 R14: 0000000000000000 R15: ffff888017419210
 instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
 atomic_dec_and_test include/linux/atomic/atomic-instrumented.h:575 [inline]
 kernfs_put+0x21/0x50 fs/kernfs/dir.c:531
 __kernfs_remove+0x456/0x600 fs/kernfs/dir.c:1440
 kernfs_remove_by_name_ns+0xb0/0x120 fs/kernfs/dir.c:1626
 kernfs_remove_by_name include/linux/kernfs.h:618 [inline]
 remove_files+0x96/0x1c0 fs/sysfs/group.c:28
 sysfs_remove_group+0x87/0x170 fs/sysfs/group.c:288
 sysfs_remove_groups fs/sysfs/group.c:312 [inline]
 sysfs_remove_groups+0x5c/0xa0 fs/sysfs/group.c:304
 device_remove_groups drivers/base/core.c:2579 [inline]
 device_remove_attrs+0x192/0x290 drivers/base/core.c:2793
 device_del+0x4eb/0xc80 drivers/base/core.c:3703
 usb_disable_device+0x356/0x7a0 drivers/usb/core/message.c:1419
 usb_disconnect.cold+0x259/0x6ed drivers/usb/core/hub.c:2235
 hub_port_connect drivers/usb/core/hub.c:5197 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5497 [inline]
 port_event drivers/usb/core/hub.c:5653 [inline]
 hub_event+0x1f86/0x45e0 drivers/usb/core/hub.c:5735
 process_one_work+0x991/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e4/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
 </TASK>
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	ff 89 43 08 5b 5d    	decl   0x5d5b0843(%rcx)
   6:	c3                   	retq
   7:	66 66 2e 0f 1f 84 00 	data16 nopw %cs:0x0(%rax,%rax,1)
   e:	00 00 00 00
  12:	90                   	nop
  13:	48 85 f6             	test   %rsi,%rsi
  16:	0f 84 3c 01 00 00    	je     0x158
  1c:	49 89 f9             	mov    %rdi,%r9
  1f:	41 54                	push   %r12
  21:	44 0f b6 c2          	movzbl %dl,%r8d
  25:	49 01 f1             	add    %rsi,%r9
  28:	55                   	push   %rbp
* 29:	53                   	push   %rbx <-- trapping instruction
  2a:	0f 82 18 01 00 00    	jb     0x148
  30:	48 b8 ff ff ff ff ff 	movabs $0xffff7fffffffffff,%rax
  37:	7f ff ff
  3a:	48 39 c7             	cmp    %rax,%rdi
  3d:	0f                   	.byte 0xf
  3e:	86                   	.byte 0x86