cm109 1-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB 0000000046aabffe submitted while active
WARNING: CPU: 0 PID: 4261 at drivers/usb/core/urb.c:379 usb_submit_urb+0x4f4/0x550 drivers/usb/core/urb.c:379
Modules linked in:
CPU: 0 UID: 0 PID: 4261 Comm: syz.1.296 Not tainted syzkaller #0 PREEMPT 
Hardware name: linux,dummy-virt (DT)
pstate: 604020c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : usb_submit_urb+0x4f4/0x550 drivers/usb/core/urb.c:379
lr : usb_submit_urb+0x4f4/0x550 drivers/usb/core/urb.c:379
sp : ffff800080003ca0
x29: ffff800080003ca0 x28: f4f000000dab0540 x27: f4f0000005556e50
x26: 0000000000000000 x25: f1f000000c188380 x24: fcf0000005166000
x23: f4f0000005556c00 x22: fdf000000c228c53 x21: fdf000000c228c54
x20: 00000000000000c0 x19: fdf000000dab0000 x18: 0000000000000010
x17: fff07ffffcfe1000 x16: ffff800080000000 x15: ffff800080003820
x14: 00000000ffffffea x13: ffff800080003968 x12: ffff8000829ef238
x11: 0000000000000001 x10: 0000000000000001 x9 : 000000000002ffe8
x8 : c0000000ffffdfff x7 : ffff80008293f1b0 x6 : 00000000000affa8
x5 : fff000007f8ca4c8 x4 : 0000000000000000 x3 : fff07ffffcfe1000
x2 : 0000000000000000 x1 : 0000000000000000 x0 : f5f000000ad14a00
Call trace:
 usb_submit_urb+0x4f4/0x550 drivers/usb/core/urb.c:379 (P)
 cm109_submit_ctl drivers/input/misc/cm109.c:380 [inline]
 cm109_urb_irq_callback+0xdc/0x2b8 drivers/input/misc/cm109.c:431
 __usb_hcd_giveback_urb+0x9c/0x15c drivers/usb/core/hcd.c:1661
 usb_hcd_giveback_urb+0x11c/0x12c drivers/usb/core/hcd.c:1745
 dummy_timer+0x784/0xfb8 drivers/usb/gadget/udc/dummy_hcd.c:1995
 __run_hrtimer kernel/time/hrtimer.c:1761 [inline]
 __hrtimer_run_queues+0x138/0x1bc kernel/time/hrtimer.c:1825
 hrtimer_run_softirq+0x6c/0xc4 kernel/time/hrtimer.c:1842
 handle_softirqs+0x108/0x240 kernel/softirq.c:579
 __do_softirq+0x14/0x20 kernel/softirq.c:613
 ____do_softirq+0x10/0x1c arch/arm64/kernel/irq.c:68
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:891
 do_softirq_own_stack+0x1c/0x2c arch/arm64/kernel/irq.c:73
 invoke_softirq kernel/softirq.c:460 [inline]
 __irq_exit_rcu+0xd8/0x110 kernel/softirq.c:680
 irq_exit_rcu+0x10/0x1c kernel/softirq.c:696
 __el1_irq arch/arm64/kernel/entry-common.c:654 [inline]
 el1_interrupt+0x38/0x64 arch/arm64/kernel/entry-common.c:668
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:673
 el1h_64_irq+0x6c/0x70 arch/arm64/kernel/entry.S:592
 alloc_pages_mpol+0x3c/0x1b8 mm/mempolicy.c:2377 (P)
 folio_alloc_mpol_noprof+0x14/0x6c mm/mempolicy.c:2435
 vma_alloc_folio_noprof+0x7c/0xcc mm/mempolicy.c:2470
 vma_alloc_zeroed_movable_folio+0x38/0x44 arch/arm64/mm/fault.c:967
 folio_prealloc mm/memory.c:1061 [inline]
 alloc_anon_folio mm/memory.c:4997 [inline]
 do_anonymous_page mm/memory.c:5054 [inline]
 do_pte_missing mm/memory.c:4232 [inline]
 handle_pte_fault mm/memory.c:6052 [inline]
 __handle_mm_fault+0x1344/0x1a6c mm/memory.c:6195
 handle_mm_fault+0x158/0x308 mm/memory.c:6364
 faultin_page mm/gup.c:1144 [inline]
 __get_user_pages+0x1e0/0xcc8 mm/gup.c:1446
 populate_vma_page_range+0x84/0xd8 mm/gup.c:1880
 __mm_populate+0xb8/0x178 mm/gup.c:1983
 mm_populate include/linux/mm.h:3367 [inline]
 __do_sys_mlockall mm/mlock.c:769 [inline]
 __se_sys_mlockall mm/mlock.c:745 [inline]
 __arm64_sys_mlockall+0x178/0x1a4 mm/mlock.c:745
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x48/0x110 arch/arm64/kernel/syscall.c:49
 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151
 el0_svc+0x34/0x10c arch/arm64/kernel/entry-common.c:879
 el0t_64_sync_handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:898
 el0t_64_sync+0x1a4/0x1a8 arch/arm64/kernel/entry.S:596
---[ end trace 0000000000000000 ]---
cm109 1-1:0.8: cm109_submit_ctl: usb_submit_urb (urb_ctl) failed -16
cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -2
dummy_hcd dummy_hcd.0: timer fired with no URBs pending?