cm109 5-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff888108104600 submitted while active
WARNING: CPU: 2 PID: 8289 at drivers/usb/core/urb.c:379 usb_submit_urb+0x14da/0x1730 drivers/usb/core/urb.c:379
Modules linked in:
CPU: 2 UID: 0 PID: 8289 Comm: syz.0.601 Not tainted 6.13.0-rc4-syzkaller-00004-gf07044dd0df0 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:usb_submit_urb+0x14da/0x1730 drivers/usb/core/urb.c:379
Code: fd eb cb bb fe ff ff ff e9 c1 f3 ff ff e8 fe ef ae fa c6 05 b8 c2 5c 09 01 90 48 c7 c7 a0 1f 2e 8c 48 89 de e8 77 29 6f fa 90 <0f> 0b 90 90 e9 b6 fe ff ff bb f8 ff ff ff e9 91 f3 ff ff 48 89 ef
RSP: 0018:ffffc90000658a88 EFLAGS: 00010086
RAX: 0000000000000000 RBX: ffff888108104600 RCX: ffffc90001be2000
RDX: 0000000000040000 RSI: ffffffff815a50e6 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000003 R12: 0000000000000083
R13: ffff888028059858 R14: 000000000000000f R15: 0000000000000000
FS: 0000555578503500(0000) GS:ffff88806a800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000002000a9c4 CR3: 0000000021420000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
cm109_submit_ctl drivers/input/misc/cm109.c:380 [inline]
cm109_urb_irq_callback+0x2e7/0xb60 drivers/input/misc/cm109.c:431
__usb_hcd_giveback_urb+0x389/0x6e0 drivers/usb/core/hcd.c:1650
usb_hcd_giveback_urb+0x396/0x450 drivers/usb/core/hcd.c:1734
dummy_timer+0x17f7/0x3960 drivers/usb/gadget/udc/dummy_hcd.c:1993
__run_hrtimer kernel/time/hrtimer.c:1739 [inline]
__hrtimer_run_queues+0x20a/0xae0 kernel/time/hrtimer.c:1803
hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1820
handle_softirqs+0x213/0x8f0 kernel/softirq.c:561
__do_softirq kernel/softirq.c:595 [inline]
invoke_softirq kernel/softirq.c:435 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:662
irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__skb_dst_copy include/net/dst.h:284 [inline]
RIP: 0010:skb_dst_copy include/net/dst.h:290 [inline]
RIP: 0010:__copy_skb_header+0x190/0x5a0 net/core/skbuff.c:1534
Code: 48 89 fa 88 83 84 00 00 00 48 c1 ea 03 48 b8 00 00 00 00 00 fc ff df 80 3c 02 00 0f 85 86 03 00 00 4d 89 e5 31 ff 4c 89 63 58 <41> 83 e5 01 4c 89 ee e8 04 a1 96 f8 4d 85 ed 0f 84 c7 01 00 00 e8
RSP: 0018:ffffc9000593fa08 EFLAGS: 00000246
RAX: dffffc0000000000 RBX: ffff8880126bb2c0 RCX: ffffffff890376c2
RDX: 1ffff110024d7663 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff888027df72c0 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000002 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: dffffc0000000000
__skb_clone+0x94/0x760 net/core/skbuff.c:1585
skb_clone+0x1e0/0x3f0 net/core/skbuff.c:2091
do_one_broadcast net/netlink/af_netlink.c:1452 [inline]
netlink_broadcast_filtered+0xb11/0xef0 net/netlink/af_netlink.c:1530
netlink_broadcast+0x39/0x50 net/netlink/af_netlink.c:1554
uevent_net_broadcast_untagged lib/kobject_uevent.c:331 [inline]
kobject_uevent_net_broadcast lib/kobject_uevent.c:410 [inline]
kobject_uevent_env+0xc69/0x1870 lib/kobject_uevent.c:608
device_remove+0xc8/0x170 drivers/base/dd.c:567
__device_release_driver drivers/base/dd.c:1273 [inline]
device_release_driver_internal+0x44a/0x610 drivers/base/dd.c:1296
driver_detach+0xd8/0x1b0 drivers/base/dd.c:1359
bus_remove_driver+0x13b/0x2c0 drivers/base/bus.c:744
driver_unregister+0x76/0xb0 drivers/base/driver.c:274
usb_gadget_unregister_driver+0x49/0x70 drivers/usb/gadget/udc/core.c:1732
raw_release+0x1ae/0x2b0 drivers/usb/gadget/legacy/raw_gadget.c:462
__fput+0x3f8/0xb60 fs/file_table.c:450
task_work_run+0x14e/0x250 kernel/task_work.c:239
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x27b/0x2a0 kernel/entry/common.c:218
do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4cf0785d29
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc0339b208 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 000000000001dcb6 RCX: 00007f4cf0785d29
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f4cf0977ba0 R08: 0000000000000001 R09: 00007ffc0339b4ff
R10: 00007f4cf0600000 R11: 0000000000000246 R12: 000000000001e5d1
R13: 00007f4cf0975fa0 R14: 0000000000000032 R15: ffffffffffffffff
----------------
Code disassembly (best guess):
0: 48 89 fa mov %rdi,%rdx
3: 88 83 84 00 00 00 mov %al,0x84(%rbx)
9: 48 c1 ea 03 shr $0x3,%rdx
d: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
14: fc ff df
17: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
1b: 0f 85 86 03 00 00 jne 0x3a7
21: 4d 89 e5 mov %r12,%r13
24: 31 ff xor %edi,%edi
26: 4c 89 63 58 mov %r12,0x58(%rbx)
* 2a: 41 83 e5 01 and $0x1,%r13d <-- trapping instruction
2e: 4c 89 ee mov %r13,%rsi
31: e8 04 a1 96 f8 call 0xf896a13a
36: 4d 85 ed test %r13,%r13
39: 0f 84 c7 01 00 00 je 0x206
3f: e8 .byte 0xe8