cm109 4-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff88814c9ff000 submitted while active
WARNING: CPU: 1 PID: 3545 at drivers/usb/core/urb.c:379 usb_submit_urb+0xfc1/0x1830 drivers/usb/core/urb.c:379
Modules linked in:
CPU: 1 UID: 0 PID: 3545 Comm: kworker/u8:7 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Workqueue: bat_events batadv_nc_worker
RIP: 0010:usb_submit_urb+0xfc1/0x1830 drivers/usb/core/urb.c:379
Code: 44 89 f2 e8 e1 bf 00 fa e9 13 fc ff ff e8 f7 d6 93 fa c6 05 4e ad 61 08 01 90 48 c7 c7 c0 fc 34 8c 48 89 de e8 80 75 57 fa 90 <0f> 0b 90 90 e9 b7 f0 ff ff e8 d1 d6 93 fa eb 11 e8 ca d6 93 fa bd
RSP: 0018:ffffc90000a08868 EFLAGS: 00010046
RAX: 837104229df88200 RBX: ffff88814c9ff000 RCX: 0000000000040000
RDX: ffffc90002372000 RSI: 0000000000002ccc RDI: 0000000000002ccd
RBP: 000000000000000f R08: ffff8880b8724253 R09: 1ffff110170e484a
R10: dffffc0000000000 R11: ffffed10170e484b R12: dffffc0000000000
R13: ffff888028d2f030 R14: ffff88814c9ff008 R15: 0000000000000820
FS: 0000000000000000(0000) GS:ffff888125d1b000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00002000000fd030 CR3: 000000000df36000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 000000000000000c DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
cm109_submit_ctl drivers/input/misc/cm109.c:380 [inline]
cm109_urb_irq_callback+0x709/0xca0 drivers/input/misc/cm109.c:431
__usb_hcd_giveback_urb+0x376/0x540 drivers/usb/core/hcd.c:1661
dummy_timer+0x862/0x4550 drivers/usb/gadget/udc/dummy_hcd.c:1995
__run_hrtimer kernel/time/hrtimer.c:1761 [inline]
__hrtimer_run_queues+0x529/0xc60 kernel/time/hrtimer.c:1825
hrtimer_run_softirq+0x187/0x2b0 kernel/time/hrtimer.c:1842
handle_softirqs+0x283/0x870 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1050
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:rcu_read_unlock include/linux/rcupdate.h:869 [inline]
RIP: 0010:batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:412 [inline]
RIP: 0010:batadv_nc_worker+0x1ff/0x610 net/batman-adv/network-coding.c:719
Code: 48 85 ed 74 10 48 81 c5 38 fe ff ff 74 07 e8 98 73 78 f6 eb b8 e8 91 73 78 f6 e8 dc 76 32 00 89 c3 31 ff 89 c6 e8 c1 77 78 f6 <85> db 74 15 e8 18 25 5f f6 84 c0 74 18 e8 6f 73 78 f6 48 8b 5c 24
RSP: 0018:ffffc9000c387a20 EFLAGS: 00000293
RAX: ffffffff8b47380f RBX: 0000000000000001 RCX: 0000000000000000
RDX: ffff888030a7bc00 RSI: 0000000000000001 RDI: 0000000000000000
RBP: fffffffffffffe38 R08: 0000000000000000 R09: ffffffff8b4736e2
R10: dffffc0000000000 R11: ffffffff8b473610 R12: dffffc0000000000
R13: ffffffff8b4736e2 R14: ffff888079948d80 R15: 000000000000019c
process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3319
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
kthread+0x70e/0x8a0 kernel/kthread.c:463
ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
----------------
Code disassembly (best guess):
0: 48 85 ed test %rbp,%rbp
3: 74 10 je 0x15
5: 48 81 c5 38 fe ff ff add $0xfffffffffffffe38,%rbp
c: 74 07 je 0x15
e: e8 98 73 78 f6 call 0xf67873ab
13: eb b8 jmp 0xffffffcd
15: e8 91 73 78 f6 call 0xf67873ab
1a: e8 dc 76 32 00 call 0x3276fb
1f: 89 c3 mov %eax,%ebx
21: 31 ff xor %edi,%edi
23: 89 c6 mov %eax,%esi
25: e8 c1 77 78 f6 call 0xf67877eb
* 2a: 85 db test %ebx,%ebx <-- trapping instruction
2c: 74 15 je 0x43
2e: e8 18 25 5f f6 call 0xf65f254b
33: 84 c0 test %al,%al
35: 74 18 je 0x4f
37: e8 6f 73 78 f6 call 0xf67873ab
3c: 48 rex.W
3d: 8b .byte 0x8b
3e: 5c pop %rsp
3f: 24 .byte 0x24