cm109 1-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff8880253c9f00 submitted while active
WARNING: CPU: 1 PID: 10910 at drivers/usb/core/urb.c:379 usb_submit_urb+0x1039/0x1930 drivers/usb/core/urb.c:379
Modules linked in:
CPU: 1 UID: 0 PID: 10910 Comm: syz.0.814 Not tainted 6.12.0-syzkaller-01782-gbf9aa14fc523 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
RIP: 0010:usb_submit_urb+0x1039/0x1930 drivers/usb/core/urb.c:379
Code: 00 eb 66 e8 89 05 5a fa e9 79 f0 ff ff e8 7f 05 5a fa c6 05 19 90 cc 08 01 90 48 c7 c7 a0 47 b1 8c 4c 89 ee e8 28 fd 1a fa 90 <0f> 0b 90 90 e9 40 f0 ff ff e8 59 05 5a fa eb 12 e8 52 05 5a fa 41
RSP: 0018:ffffc90000a187a8 EFLAGS: 00010046
RAX: ba3f338a8502b300 RBX: 0000000000000820 RCX: 0000000000040000
RDX: ffffc900022d2000 RSI: 00000000000004ee RDI: 00000000000004ef
RBP: ffff8880253c9f08 R08: ffffffff8155e432 R09: 1ffff110170e519a
R10: dffffc0000000000 R11: ffffed10170e519b R12: ffff88805b666030
R13: ffff8880253c9f00 R14: dffffc0000000000 R15: ffff8880591ccd01
FS:  000055556e438500(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffb4b6c85e8 CR3: 00000000413fc000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 cm109_urb_irq_callback+0x6cc/0xc30 drivers/input/misc/cm109.c:422
 __usb_hcd_giveback_urb+0x42c/0x6e0 drivers/usb/core/hcd.c:1650
 dummy_timer+0x856/0x4620 drivers/usb/gadget/udc/dummy_hcd.c:1993
 __run_hrtimer kernel/time/hrtimer.c:1739 [inline]
 __hrtimer_run_queues+0x59b/0xd50 kernel/time/hrtimer.c:1803
 hrtimer_run_softirq+0x19a/0x2c0 kernel/time/hrtimer.c:1820
 handle_softirqs+0x2c5/0x980 kernel/softirq.c:554
 __do_softirq kernel/softirq.c:588 [inline]
 invoke_softirq kernel/softirq.c:428 [inline]
 __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:655
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:671
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__slab_alloc_node mm/slub.c:3956 [inline]
RIP: 0010:slab_alloc_node mm/slub.c:4122 [inline]
RIP: 0010:kmem_cache_alloc_node_noprof+0x9f/0x320 mm/slub.c:4186
Code: ed 44 8b 4c 24 04 0f 84 2b 01 00 00 85 c0 0f 85 23 01 00 00 0f 1f 44 00 00 65 48 8b 05 6a 34 0f 7e 49 8b 4d 00 48 8b 54 08 08 <48> 8b 2c 08 48 85 ed 0f 84 3e 01 00 00 48 8b 7c 08 10 48 85 ff 0f
RSP: 0018:ffffc900105a79d0 EFLAGS: 00000246
RAX: ffff8880b8700000 RBX: 0000000000000000 RCX: 0000000000046c90
RDX: 00000000001b8391 RSI: 00000000000000f0 RDI: ffffffff8ea56d40
RBP: ffffc900105a7af0 R08: ffffffff901dad77 R09: 0000000000000cc0
R10: dffffc0000000000 R11: fffffbfff203b5af R12: ffffffff898e24c3
R13: ffff888140ed3780 R14: 00000000ffffffff R15: 00000000000000f0
 __alloc_skb+0x1c3/0x440 net/core/skbuff.c:668
 alloc_skb include/linux/skbuff.h:1322 [inline]
 alloc_uevent_skb+0x74/0x230 lib/kobject_uevent.c:289
 uevent_net_broadcast_untagged lib/kobject_uevent.c:326 [inline]
 kobject_uevent_net_broadcast+0x2fd/0x580 lib/kobject_uevent.c:410
 kobject_uevent_env+0x57d/0x8e0 lib/kobject_uevent.c:608
 device_remove drivers/base/dd.c:567 [inline]
 __device_release_driver drivers/base/dd.c:1273 [inline]
 device_release_driver_internal+0x4a9/0x7c0 drivers/base/dd.c:1296
 driver_detach+0x1fb/0x2d0 drivers/base/dd.c:1359
 bus_remove_driver+0x1f3/0x320 drivers/base/bus.c:744
 usb_gadget_unregister_driver+0x4e/0x70 drivers/usb/gadget/udc/core.c:1732
 raw_release+0xf6/0x1e0 drivers/usb/gadget/legacy/raw_gadget.c:462
 __fput+0x23c/0xa50 fs/file_table.c:450
 task_work_run+0x24f/0x310 kernel/task_work.c:239
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x13f/0x340 kernel/entry/common.c:218
 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0cd9b7e819
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f0cd9e5fb88 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 000000000004b8b4 RCX: 00007f0cd9b7e819
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f0cd9d37ba0 R08: 0000000000000001 R09: 00007f0cd9e5fe7f
R10: 00007f0cd9a00000 R11: 0000000000000246 R12: 000000000004cacc
R13: 00007f0cd9d35fa0 R14: 0000000000000bea R15: ffffffffffffffff
 </TASK>
----------------
Code disassembly (best guess):
   0:	ed                   	in     (%dx),%eax
   1:	44 8b 4c 24 04       	mov    0x4(%rsp),%r9d
   6:	0f 84 2b 01 00 00    	je     0x137
   c:	85 c0                	test   %eax,%eax
   e:	0f 85 23 01 00 00    	jne    0x137
  14:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
  19:	65 48 8b 05 6a 34 0f 	mov    %gs:0x7e0f346a(%rip),%rax        # 0x7e0f348b
  20:	7e
  21:	49 8b 4d 00          	mov    0x0(%r13),%rcx
  25:	48 8b 54 08 08       	mov    0x8(%rax,%rcx,1),%rdx
* 2a:	48 8b 2c 08          	mov    (%rax,%rcx,1),%rbp <-- trapping instruction
  2e:	48 85 ed             	test   %rbp,%rbp
  31:	0f 84 3e 01 00 00    	je     0x175
  37:	48 8b 7c 08 10       	mov    0x10(%rax,%rcx,1),%rdi
  3c:	48 85 ff             	test   %rdi,%rdi
  3f:	0f                   	.byte 0xf