cm109 3-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff888145759200 submitted while active
WARNING: CPU: 0 PID: 9397 at drivers/usb/core/urb.c:379 usb_submit_urb+0xfa8/0x1870 drivers/usb/core/urb.c:379
Modules linked in:
CPU: 0 UID: 0 PID: 9397 Comm: syz.4.804 Not tainted 6.15.0-rc4-syzkaller-00291-g2a239ffbebb5 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025
RIP: 0010:usb_submit_urb+0xfa8/0x1870 drivers/usb/core/urb.c:379
Code: 00 eb 5c e8 fa e0 aa fa e9 09 f1 ff ff e8 f0 e0 aa fa c6 05 de ff 53 08 01 90 48 c7 c7 c0 63 12 8c 48 89 de e8 29 3d 6f fa 90 <0f> 0b 90 90 e9 d0 f0 ff ff e8 ca e0 aa fa eb 11 e8 c3 e0 aa fa bd
RSP: 0018:ffffc900000077b8 EFLAGS: 00010046
RAX: f9f1872175ccdf00 RBX: ffff888145759200 RCX: 0000000000040000
RDX: ffffc90002203000 RSI: 00000000000088d5 RDI: 00000000000088d6
RBP: 000000000000000f R08: ffff8880b8823e93 R09: 1ffff110171047d2
R10: dffffc0000000000 R11: ffffed10171047d3 R12: 1ffff1100462060a
R13: dffffc0000000000 R14: ffff888145759208 R15: 0000000000000820
FS: 00007ff3a7cc26c0(0000) GS:ffff8881260cb000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff39d5ff000 CR3: 00000000342cc000 CR4: 0000000000350ef0
Call Trace:
cm109_submit_ctl drivers/input/misc/cm109.c:380 [inline]
cm109_urb_irq_callback+0x718/0xc80 drivers/input/misc/cm109.c:431
__usb_hcd_giveback_urb+0x41a/0x690 drivers/usb/core/hcd.c:1650
dummy_timer+0x862/0x4550 drivers/usb/gadget/udc/dummy_hcd.c:1994
__run_hrtimer kernel/time/hrtimer.c:1761 [inline]
__hrtimer_run_queues+0x52c/0xc60 kernel/time/hrtimer.c:1825
hrtimer_run_softirq+0x187/0x2b0 kernel/time/hrtimer.c:1842
handle_softirqs+0x286/0x870 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:memcg1_commit_charge+0x1f4/0x2b0 mm/memcontrol-v1.c:582
Code: d4 9e ff 48 c7 44 24 40 00 00 00 00 9c 8f 44 24 40 f6 44 24 41 02 75 6e f7 c3 00 02 00 00 74 01 fb 48 c7 44 24 20 0e 36 e0 45 <4b> c7 44 3d 00 00 00 00 00 66 43 c7 44 3d 09 00 00 43 c6 44 3d 0b
RSP: 0018:ffffc9000b52f760 EFLAGS: 00000206
RAX: f9f1872175ccdf00 RBX: 0000000000000216 RCX: f9f1872175ccdf00
RDX: 0000000000000006 RSI: ffffffff8d74aa91 RDI: ffffffff8bc1d220
RBP: ffffc9000b52f838 R08: ffffffff8f7ed977 R09: 1ffffffff1efdb2e
R10: dffffc0000000000 R11: fffffbfff1efdb2f R12: 0000000000000001
R13: 1ffff920016a5ef0 R14: ffffea00014c5d00 R15: dffffc0000000000
charge_memcg+0x10b/0x180 mm/memcontrol.c:4598
__mem_cgroup_charge+0x25/0x80 mm/memcontrol.c:4609
mem_cgroup_charge include/linux/memcontrol.h:642 [inline]
shmem_alloc_and_add_folio+0x7c1/0xf60 mm/shmem.c:1903
shmem_get_folio_gfp+0x597/0x15f0 mm/shmem.c:2533
shmem_get_folio mm/shmem.c:2639 [inline]
shmem_write_begin+0xf7/0x2b0 mm/shmem.c:3289
generic_perform_write+0x2c7/0x910 mm/filemap.c:4103
shmem_file_write_iter+0xf8/0x120 mm/shmem.c:3464
new_sync_write fs/read_write.c:591 [inline]
vfs_write+0x54b/0xa90 fs/read_write.c:684
ksys_write+0x145/0x250 fs/read_write.c:736
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff3a6d8d41f
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007ff3a7cc1df0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000001000000 RCX: 00007ff3a6d8d41f
RDX: 0000000001000000 RSI: 00007ff39c600000 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 00000000000050fb
R10: 0000000000000002 R11: 0000000000000293 R12: 0000000000000003
R13: 00007ff3a7cc1ef0 R14: 00007ff3a7cc1eb0 R15: 00007ff39c600000
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 9e sahf
1: ff 48 c7 decl -0x39(%rax)
4: 44 24 40 rex.R and $0x40,%al
7: 00 00 add %al,(%rax)
9: 00 00 add %al,(%rax)
b: 9c pushf
c: 8f 44 24 40 pop 0x40(%rsp)
10: f6 44 24 41 02 testb $0x2,0x41(%rsp)
15: 75 6e jne 0x85
17: f7 c3 00 02 00 00 test $0x200,%ebx
1d: 74 01 je 0x20
1f: fb sti
20: 48 c7 44 24 20 0e 36 movq $0x45e0360e,0x20(%rsp)
27: e0 45
* 29: 4b c7 44 3d 00 00 00 movq $0x0,0x0(%r13,%r15,1) <-- trapping instruction
30: 00 00
32: 66 43 c7 44 3d 09 00 movw $0x0,0x9(%r13,%r15,1)
39: 00
3a: 43 rex.XB
3b: c6 .byte 0xc6
3c: 44 rex.R
3d: 3d .byte 0x3d
3e: 0b .byte 0xb