cm109 1-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff88807f841700 submitted while active
WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0xfc1/0x1830 drivers/usb/core/urb.c:379, CPU#0: syz.6.3746/19132
Modules linked in:
CPU: 0 UID: 0 PID: 19132 Comm: syz.6.3746 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:usb_submit_urb+0xfc1/0x1830 drivers/usb/core/urb.c:379
Code: 44 89 f2 e8 51 7c f5 f9 e9 13 fc ff ff e8 87 69 89 fa c6 05 e0 ba 97 08 01 90 48 c7 c7 c0 6f 56 8c 48 89 de e8 50 09 4d fa 90 <0f> 0b 90 90 e9 b7 f0 ff ff e8 61 69 89 fa eb 11 e8 5a 69 89 fa bd
RSP: 0018:ffffc90000007868 EFLAGS: 00010046
RAX: 0be1ab14dc723b00 RBX: ffff88807f841700 RCX: 0000000000040000
RDX: ffffc90002191000 RSI: 0000000000000524 RDI: 0000000000000525
RBP: 000000000000000f R08: ffff8880b8624253 R09: 1ffff110170c484a
R10: dffffc0000000000 R11: ffffed10170c484b R12: dffffc0000000000
R13: ffff8880355c4030 R14: ffff88807f841708 R15: 0000000000000820
FS: 0000555562f88500(0000) GS:ffff8881257c4000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200001000000 CR3: 0000000050f86000 CR4: 00000000003526f0
Call Trace:
cm109_submit_ctl drivers/input/misc/cm109.c:380 [inline]
cm109_urb_irq_callback+0x709/0xca0 drivers/input/misc/cm109.c:431
__usb_hcd_giveback_urb+0x376/0x540 drivers/usb/core/hcd.c:1661
dummy_timer+0x862/0x4550 drivers/usb/gadget/udc/dummy_hcd.c:1995
__run_hrtimer kernel/time/hrtimer.c:1761 [inline]
__hrtimer_run_queues+0x52c/0xc60 kernel/time/hrtimer.c:1825
hrtimer_run_softirq+0x187/0x2b0 kernel/time/hrtimer.c:1842
handle_softirqs+0x283/0x870 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1050
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:202
Code: 90 f3 0f 1e fa 53 48 89 fb 48 83 c7 18 48 8b 74 24 08 e8 5a db 15 f6 48 89 df e8 b2 72 16 f6 e8 7d c0 3f f6 fb bf 01 00 00 00 12 6d 08 f6 65 8b 05 1b 07 5d 07 85 c0 74 07 5b e9 81 4c 00 00
RSP: 0018:ffffc90004c87c80 EFLAGS: 00000282
RAX: 0be1ab14dc723b00 RBX: ffff88801ebdd340 RCX: 0be1ab14dc723b00
RDX: 0000000000000000 RSI: ffffffff8c04e5e0 RDI: 0000000000000001
RBP: 0000000000000011 R08: ffffffff8fe52d37 R09: 1ffffffff1fca5a6
R10: dffffc0000000000 R11: fffffbfff1fca5a7 R12: 1ffff11003d7babb
R13: 0000000000000000 R14: 0000000004000000 R15: ffff88801ebdd5d8
spin_unlock_irq include/linux/spinlock.h:401 [inline]
get_signal+0x11a8/0x1340 kernel/signal.c:3037
arch_do_signal_or_restart+0x9a/0x750 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop+0x75/0x130 kernel/entry/common.c:40
exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
do_syscall_64+0x2bd/0xfa0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9e4b2550b3
Code: 8b 44 24 08 48 85 c0 74 17 48 8b 54 24 18 48 0f ca 48 89 54 24 18 48 83 f8 01 0f 85 7a 02 00 00 48 8b 44 24 10 48 8b 54 24 18 <48> 89 10 e9 d2 fd ff ff 48 8b 44 24 10 0f b7 10 48 8b 44 24 08 48
RSP: 002b:00007ffe652233c0 EFLAGS: 00010246
RAX: 0000200000002980 RBX: 0000000000000008 RCX: 0000000000000000
RDX: 0000000400808080 RSI: 0000000000000000 RDI: 0000555562f883c8
RBP: 00007ffe652234c8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000005 R12: 00007f9e4b5c5fac
R13: 00007ffe652234f0 R14: fffffffffffffffe R15: 00007ffe65223510
----------------
Code disassembly (best guess):
0: 90 nop
1: f3 0f 1e fa endbr64
5: 53 push %rbx
6: 48 89 fb mov %rdi,%rbx
9: 48 83 c7 18 add $0x18,%rdi
d: 48 8b 74 24 08 mov 0x8(%rsp),%rsi
12: e8 5a db 15 f6 call 0xf615db71
17: 48 89 df mov %rbx,%rdi
1a: e8 b2 72 16 f6 call 0xf61672d1
1f: e8 7d c0 3f f6 call 0xf63fc0a1
24: fb sti
25: bf 01 00 00 00 mov $0x1,%edi
* 2a: e8 12 6d 08 f6 call 0xf6086d41 <-- trapping instruction
2f: 65 8b 05 1b 07 5d 07 mov %gs:0x75d071b(%rip),%eax # 0x75d0751
36: 85 c0 test %eax,%eax
38: 74 07 je 0x41
3a: 5b pop %rbx
3b: e9 81 4c 00 00 jmp 0x4cc1