cm109 6-1:0.0: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff88801f8cf300 submitted while active
WARNING: CPU: 0 PID: 3608 at drivers/usb/core/urb.c:378 usb_submit_urb+0x14e2/0x18a0 drivers/usb/core/urb.c:378
Modules linked in:
CPU: 0 PID: 3608 Comm: strace-static-x Not tainted 5.19.0-rc1-next-20220610-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:usb_submit_urb+0x14e2/0x18a0 drivers/usb/core/urb.c:378
Code: 89 de e8 41 b6 eb fb 84 db 0f 85 a9 f3 ff ff e8 24 ba eb fb 4c 89 fe 48 c7 c7 00 1a 6f 8a c6 05 bc 67 18 08 01 e8 9f ea a6 03 <0f> 0b e9 87 f3 ff ff 41 be ed ff ff ff e9 7c f3 ff ff e8 f7 b9 eb
RSP: 0018:ffffc900000079d0 EFLAGS: 00010082
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff8880203bd7c0 RSI: ffffffff81614258 RDI: fffff52000000f2c
RBP: ffff88802153a000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000101 R11: 0000000000000001 R12: 0000000000000046
R13: ffff888076c08858 R14: 00000000fffffff0 R15: ffff88801f8cf300
FS: 0000000000a0b340(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055555654e708 CR3: 000000002211b000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
cm109_urb_irq_callback+0x44c/0xaa0 drivers/input/misc/cm109.c:422
__usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1670
usb_hcd_giveback_urb+0x367/0x410 drivers/usb/core/hcd.c:1747
dummy_timer+0x11f9/0x32b0 drivers/usb/gadget/udc/dummy_hcd.c:1988
call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1519 [inline]
__run_timers.part.0+0x679/0xa80 kernel/time/timer.c:1790
__run_timers kernel/time/timer.c:1768 [inline]
run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1803
__do_softirq+0x29b/0x9c2 kernel/softirq.c:571
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1106
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:__syscall_enter_from_user_work kernel/entry/common.c:89 [inline]
RIP: 0010:syscall_enter_from_user_mode+0x2b/0x70 kernel/entry/common.c:110
Code: 54 49 89 f4 55 48 89 fd 48 8b 7c 24 10 e8 cd f5 ff ff eb 27 eb 2b e8 44 0b 06 f8 e8 ff 08 06 f8 fb 65 48 8b 04 25 80 6f 02 00 <48> 8b 70 08 40 f6 c6 3f 75 19 4c 89 e0 5d 41 5c c3 eb 1b 0f 0b eb
RSP: 0018:ffffc90002f7ff28 EFLAGS: 00000202
RAX: ffff8880203bd7c0 RBX: 0000000000000000 RCX: 1ffffffff1b788b1
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90002f7ff58 R08: 0000000000000001 R09: 0000000000000001
R10: fffffbfff1b78e9a R11: 0000000000000001 R12: 000000000000003d
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
do_syscall_64+0x16/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x4d49a6
================================
WARNING: inconsistent lock state
5.19.0-rc1-next-20220610-syzkaller #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
strace-static-x/3608 [HC0[0]:SC1[1]:HE0:SE0] takes:
ffffffff8beba998 (vmap_area_lock){+.?.}-{2:2}, at: spin_lock include/linux/spinlock.h:360 [inline]
ffffffff8beba998 (vmap_area_lock){+.?.}-{2:2}, at: find_vmap_area mm/vmalloc.c:1836 [inline]
ffffffff8beba998 (vmap_area_lock){+.?.}-{2:2}, at: find_vm_area+0x1c/0x190 mm/vmalloc.c:2555
{SOFTIRQ-ON-W} state was registered at:
lock_acquire kernel/locking/lockdep.c:5665 [inline]
lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5630
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:360 [inline]
alloc_vmap_area+0xa0b/0x1d30 mm/vmalloc.c:1617
__get_vm_area_node+0x142/0x3f0 mm/vmalloc.c:2483
get_vm_area_caller+0x43/0x50 mm/vmalloc.c:2536
__ioremap_caller.constprop.0+0x292/0x600 arch/x86/mm/ioremap.c:280
acpi_os_ioremap include/acpi/acpi_io.h:13 [inline]
acpi_map drivers/acpi/osl.c:296 [inline]
acpi_os_map_iomem+0x463/0x550 drivers/acpi/osl.c:355
acpi_tb_acquire_table+0xd8/0x209 drivers/acpi/acpica/tbdata.c:142
acpi_tb_validate_table drivers/acpi/acpica/tbdata.c:317 [inline]
acpi_tb_validate_table+0x50/0x8c drivers/acpi/acpica/tbdata.c:308
acpi_tb_verify_temp_table+0x84/0x674 drivers/acpi/acpica/tbdata.c:504
acpi_reallocate_root_table+0x374/0x3e0 drivers/acpi/acpica/tbxface.c:180
acpi_early_init+0x13a/0x438 drivers/acpi/bus.c:1200
start_kernel+0x3d4/0x494 init/main.c:1103
secondary_startup_64_no_verify+0xce/0xdb
irq event stamp: 6125019
hardirqs last enabled at (6125018): [] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:159 [inline]
hardirqs last enabled at (6125018): [] _raw_spin_unlock_irq+0x1f/0x40 kernel/locking/spinlock.c:202
hardirqs last disabled at (6125019): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (6125019): [] _raw_spin_lock_irqsave+0x4e/0x50 kernel/locking/spinlock.c:162
softirqs last enabled at (6124838): [] invoke_softirq kernel/softirq.c:445 [inline]
softirqs last enabled at (6124838): [] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
softirqs last disabled at (6125015): [] invoke_softirq kernel/softirq.c:445 [inline]
softirqs last disabled at (6125015): [] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(vmap_area_lock);
lock(vmap_area_lock);
*** DEADLOCK ***
2 locks held by strace-static-x/3608:
#0: ffffc90000007d70 ((&dum_hcd->timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:31 [inline]
#0: ffffc90000007d70 ((&dum_hcd->timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x6b0 kernel/time/timer.c:1464
#1: ffff888076c08870 (&dev->ctl_submit_lock){..-.}-{2:2}, at: cm109_urb_irq_callback+0x252/0xaa0 drivers/input/misc/cm109.c:405
stack backtrace:
CPU: 0 PID: 3608 Comm: strace-static-x Not tainted 5.19.0-rc1-next-20220610-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_usage_bug kernel/locking/lockdep.c:3961 [inline]
valid_state kernel/locking/lockdep.c:3973 [inline]
mark_lock_irq kernel/locking/lockdep.c:4176 [inline]
mark_lock.part.0.cold+0x18/0xd8 kernel/locking/lockdep.c:4632
mark_lock kernel/locking/lockdep.c:4596 [inline]
mark_usage kernel/locking/lockdep.c:4527 [inline]
__lock_acquire+0x11e7/0x5660 kernel/locking/lockdep.c:5007
lock_acquire kernel/locking/lockdep.c:5665 [inline]
lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5630
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:360 [inline]
find_vmap_area mm/vmalloc.c:1836 [inline]
find_vm_area+0x1c/0x190 mm/vmalloc.c:2555
check_heap_object mm/usercopy.c:176 [inline]
__check_object_size mm/usercopy.c:252 [inline]
__check_object_size+0x1fb/0x7a0 mm/usercopy.c:214
check_object_size include/linux/thread_info.h:199 [inline]
__copy_from_user_inatomic include/linux/uaccess.h:62 [inline]
copy_from_user_nmi arch/x86/lib/usercopy.c:47 [inline]
copy_from_user_nmi+0xcb/0x130 arch/x86/lib/usercopy.c:31
copy_code arch/x86/kernel/dumpstack.c:91 [inline]
show_opcodes+0x59/0xb0 arch/x86/kernel/dumpstack.c:121
show_iret_regs+0xd/0x33 arch/x86/kernel/dumpstack.c:149
__show_regs+0x1e/0x60 arch/x86/kernel/process_64.c:74
show_trace_log_lvl+0x25b/0x2ba arch/x86/kernel/dumpstack.c:292
__warn+0xe7/0x190 kernel/panic.c:622
report_bug+0x1bc/0x210 lib/bug.c:198
handle_bug+0x3c/0x60 arch/x86/kernel/traps.c:316
exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:336
asm_exc_invalid_op+0x1b/0x20 arch/x86/include/asm/idtentry.h:568
RIP: 0010:usb_submit_urb+0x14e2/0x18a0 drivers/usb/core/urb.c:378
Code: 89 de e8 41 b6 eb fb 84 db 0f 85 a9 f3 ff ff e8 24 ba eb fb 4c 89 fe 48 c7 c7 00 1a 6f 8a c6 05 bc 67 18 08 01 e8 9f ea a6 03 <0f> 0b e9 87 f3 ff ff 41 be ed ff ff ff e9 7c f3 ff ff e8 f7 b9 eb
RSP: 0018:ffffc900000079d0 EFLAGS: 00010082
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff8880203bd7c0 RSI: ffffffff81614258 RDI: fffff52000000f2c
RBP: ffff88802153a000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000101 R11: 0000000000000001 R12: 0000000000000046
R13: ffff888076c08858 R14: 00000000fffffff0 R15: ffff88801f8cf300
cm109_urb_irq_callback+0x44c/0xaa0 drivers/input/misc/cm109.c:422
__usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1670
usb_hcd_giveback_urb+0x367/0x410 drivers/usb/core/hcd.c:1747
dummy_timer+0x11f9/0x32b0 drivers/usb/gadget/udc/dummy_hcd.c:1988
call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1519 [inline]
__run_timers.part.0+0x679/0xa80 kernel/time/timer.c:1790
__run_timers kernel/time/timer.c:1768 [inline]
run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1803
__do_softirq+0x29b/0x9c2 kernel/softirq.c:571
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1106
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:__syscall_enter_from_user_work kernel/entry/common.c:89 [inline]
RIP: 0010:syscall_enter_from_user_mode+0x2b/0x70 kernel/entry/common.c:110
Code: 54 49 89 f4 55 48 89 fd 48 8b 7c 24 10 e8 cd f5 ff ff eb 27 eb 2b e8 44 0b 06 f8 e8 ff 08 06 f8 fb 65 48 8b 04 25 80 6f 02 00 <48> 8b 70 08 40 f6 c6 3f 75 19 4c 89 e0 5d 41 5c c3 eb 1b 0f 0b eb
RSP: 0018:ffffc90002f7ff28 EFLAGS: 00000202
RAX: ffff8880203bd7c0 RBX: 0000000000000000 RCX: 1ffffffff1b788b1
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90002f7ff58 R08: 0000000000000001 R09: 0000000000000001
R10: fffffbfff1b78e9a R11: 0000000000000001 R12: 000000000000003d
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
do_syscall_64+0x16/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x4d49a6
Code: 00 00 00 90 31 c9 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 49 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 11 b8 3d 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 90 48 83 ec 28 89 54 24 14 48 89 74 24
RSP: 002b:00007fffd1f6a278 EFLAGS: 00000246 ORIG_RAX: 000000000000003d
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000004d49a6
RDX: 0000000040000001 RSI: 00007fffd1f6a29c RDI: 00000000ffffffff
RBP: 0000000000a14d90 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000a15f30
R13: 0000000000000e31 R14: 00007fffd1f6a29c R15: 0000000000617180
Code: 00 00 00 90 31 c9 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 49 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 11 b8 3d 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 90 48 83 ec 28 89 54 24 14 48 89 74 24
RSP: 002b:00007fffd1f6a278 EFLAGS: 00000246 ORIG_RAX: 000000000000003d
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000004d49a6
RDX: 0000000040000001 RSI: 00007fffd1f6a29c RDI: 00000000ffffffff
RBP: 0000000000a14d90 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000a15f30
R13: 0000000000000e31 R14: 00007fffd1f6a29c R15: 0000000000617180
----------------
Code disassembly (best guess):
0: 54 push %rsp
1: 49 89 f4 mov %rsi,%r12
4: 55 push %rbp
5: 48 89 fd mov %rdi,%rbp
8: 48 8b 7c 24 10 mov 0x10(%rsp),%rdi
d: e8 cd f5 ff ff callq 0xfffff5df
12: eb 27 jmp 0x3b
14: eb 2b jmp 0x41
16: e8 44 0b 06 f8 callq 0xf8060b5f
1b: e8 ff 08 06 f8 callq 0xf806091f
20: fb sti
21: 65 48 8b 04 25 80 6f mov %gs:0x26f80,%rax
28: 02 00
* 2a: 48 8b 70 08 mov 0x8(%rax),%rsi <-- trapping instruction
2e: 40 f6 c6 3f test $0x3f,%sil
32: 75 19 jne 0x4d
34: 4c 89 e0 mov %r12,%rax
37: 5d pop %rbp
38: 41 5c pop %r12
3a: c3 retq
3b: eb 1b jmp 0x58
3d: 0f 0b ud2
3f: eb .byte 0xeb