cm109 2-1:0.0: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff888146fb0a00 submitted while active
WARNING: CPU: 0 PID: 4510 at drivers/usb/core/urb.c:378 usb_submit_urb+0x14e2/0x18a0 drivers/usb/core/urb.c:378
Modules linked in:
CPU: 0 PID: 4510 Comm: udevd Not tainted 5.19.0-rc1-next-20220610-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:usb_submit_urb+0x14e2/0x18a0 drivers/usb/core/urb.c:378
Code: 89 de e8 41 b6 eb fb 84 db 0f 85 a9 f3 ff ff e8 24 ba eb fb 4c 89 fe 48 c7 c7 00 1a 6f 8a c6 05 bc 67 18 08 01 e8 9f ea a6 03 <0f> 0b e9 87 f3 ff ff 41 be ed ff ff ff e9 7c f3 ff ff e8 f7 b9 eb
RSP: 0018:ffffc900000079d0 EFLAGS: 00010082
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000040000 RSI: ffffffff81614258 RDI: fffff52000000f2c
RBP: ffff88807d2ab9d8 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000101 R11: 0000000000000001 R12: 0000000000000016
R13: ffff888040712858 R14: 00000000fffffff0 R15: ffff888146fb0a00
FS: 00007fae5baf5840(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007feebf03bfc0 CR3: 000000007df2a000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
cm109_urb_irq_callback+0x44c/0xaa0 drivers/input/misc/cm109.c:422
__usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1670
usb_hcd_giveback_urb+0x367/0x410 drivers/usb/core/hcd.c:1747
dummy_timer+0x11f9/0x32b0 drivers/usb/gadget/udc/dummy_hcd.c:1988
call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1519 [inline]
__run_timers.part.0+0x679/0xa80 kernel/time/timer.c:1790
__run_timers kernel/time/timer.c:1768 [inline]
run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1803
__do_softirq+0x29b/0x9c2 kernel/softirq.c:571
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1106
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:lock_acquire+0x1ef/0x570 kernel/locking/lockdep.c:5633
Code: b7 a3 7e 83 f8 01 0f 85 e8 02 00 00 9c 58 f6 c4 02 0f 85 fb 02 00 00 48 83 7c 24 08 00 74 01 fb 48 b8 00 00 00 00 00 fc ff df <48> 01 c3 48 c7 03 00 00 00 00 48 c7 43 08 00 00 00 00 48 8b 84 24
RSP: 0018:ffffc9000d61fb68 EFLAGS: 00000206
RAX: dffffc0000000000 RBX: 1ffff92001ac3f6f RCX: ffffffff815e6c4e
RDX: 1ffff11004f7ec41 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffff90693937
R10: fffffbfff20d2726 R11: 0000000000000001 R12: 0000000000000001
R13: 0000000000000000 R14: ffff88807ba01718 R15: 0000000000000000
__might_fault mm/memory.c:5589 [inline]
__might_fault+0x104/0x170 mm/memory.c:5582
_copy_to_user+0x25/0x140 lib/usercopy.c:28
copy_to_user include/linux/uaccess.h:160 [inline]
cp_new_stat+0x47b/0x5b0 fs/stat.c:391
__do_sys_newfstatat+0x104/0x110 fs/stat.c:428
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7fae5b7251da
================================
WARNING: inconsistent lock state
5.19.0-rc1-next-20220610-syzkaller #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
udevd/4510 [HC0[0]:SC1[1]:HE0:SE0] takes:
ffffffff8beba998 (vmap_area_lock){+.?.}-{2:2}, at: spin_lock include/linux/spinlock.h:360 [inline]
ffffffff8beba998 (vmap_area_lock){+.?.}-{2:2}, at: find_vmap_area mm/vmalloc.c:1836 [inline]
ffffffff8beba998 (vmap_area_lock){+.?.}-{2:2}, at: find_vm_area+0x1c/0x190 mm/vmalloc.c:2555
{SOFTIRQ-ON-W} state was registered at:
lock_acquire kernel/locking/lockdep.c:5665 [inline]
lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5630
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:360 [inline]
alloc_vmap_area+0xa0b/0x1d30 mm/vmalloc.c:1617
__get_vm_area_node+0x142/0x3f0 mm/vmalloc.c:2483
get_vm_area_caller+0x43/0x50 mm/vmalloc.c:2536
__ioremap_caller.constprop.0+0x292/0x600 arch/x86/mm/ioremap.c:280
acpi_os_ioremap include/acpi/acpi_io.h:13 [inline]
acpi_map drivers/acpi/osl.c:296 [inline]
acpi_os_map_iomem+0x463/0x550 drivers/acpi/osl.c:355
acpi_tb_acquire_table+0xd8/0x209 drivers/acpi/acpica/tbdata.c:142
acpi_tb_validate_table drivers/acpi/acpica/tbdata.c:317 [inline]
acpi_tb_validate_table+0x50/0x8c drivers/acpi/acpica/tbdata.c:308
acpi_tb_verify_temp_table+0x84/0x674 drivers/acpi/acpica/tbdata.c:504
acpi_reallocate_root_table+0x374/0x3e0 drivers/acpi/acpica/tbxface.c:180
acpi_early_init+0x13a/0x438 drivers/acpi/bus.c:1200
start_kernel+0x3d4/0x494 init/main.c:1103
secondary_startup_64_no_verify+0xce/0xdb
irq event stamp: 676127
hardirqs last enabled at (676126): [] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:159 [inline]
hardirqs last enabled at (676126): [] _raw_spin_unlock_irq+0x1f/0x40 kernel/locking/spinlock.c:202
hardirqs last disabled at (676127): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (676127): [] _raw_spin_lock_irqsave+0x4e/0x50 kernel/locking/spinlock.c:162
softirqs last enabled at (673826): [] invoke_softirq kernel/softirq.c:445 [inline]
softirqs last enabled at (673826): [] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
softirqs last disabled at (676123): [] invoke_softirq kernel/softirq.c:445 [inline]
softirqs last disabled at (676123): [] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(vmap_area_lock);
lock(vmap_area_lock);
*** DEADLOCK ***
3 locks held by udevd/4510:
#0: ffff88807ba01718 (&mm->mmap_lock#2){++++}-{3:3}, at: __might_fault+0xa1/0x170 mm/memory.c:5588
#1: ffffc90000007d70 ((&dum_hcd->timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:31 [inline]
#1: ffffc90000007d70 ((&dum_hcd->timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x6b0 kernel/time/timer.c:1464
#2: ffff888040712870 (&dev->ctl_submit_lock){..-.}-{2:2}, at: cm109_urb_irq_callback+0x252/0xaa0 drivers/input/misc/cm109.c:405
stack backtrace:
CPU: 0 PID: 4510 Comm: udevd Not tainted 5.19.0-rc1-next-20220610-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_usage_bug kernel/locking/lockdep.c:3961 [inline]
valid_state kernel/locking/lockdep.c:3973 [inline]
mark_lock_irq kernel/locking/lockdep.c:4176 [inline]
mark_lock.part.0.cold+0x18/0xd8 kernel/locking/lockdep.c:4632
mark_lock kernel/locking/lockdep.c:4596 [inline]
mark_usage kernel/locking/lockdep.c:4527 [inline]
__lock_acquire+0x11e7/0x5660 kernel/locking/lockdep.c:5007
lock_acquire kernel/locking/lockdep.c:5665 [inline]
lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5630
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:360 [inline]
find_vmap_area mm/vmalloc.c:1836 [inline]
find_vm_area+0x1c/0x190 mm/vmalloc.c:2555
check_heap_object mm/usercopy.c:176 [inline]
__check_object_size mm/usercopy.c:252 [inline]
__check_object_size+0x1fb/0x7a0 mm/usercopy.c:214
check_object_size include/linux/thread_info.h:199 [inline]
__copy_from_user_inatomic include/linux/uaccess.h:62 [inline]
copy_from_user_nmi arch/x86/lib/usercopy.c:47 [inline]
copy_from_user_nmi+0xcb/0x130 arch/x86/lib/usercopy.c:31
copy_code arch/x86/kernel/dumpstack.c:91 [inline]
show_opcodes+0x59/0xb0 arch/x86/kernel/dumpstack.c:121
show_iret_regs+0xd/0x33 arch/x86/kernel/dumpstack.c:149
__show_regs+0x1e/0x60 arch/x86/kernel/process_64.c:74
show_trace_log_lvl+0x25b/0x2ba arch/x86/kernel/dumpstack.c:292
__warn+0xe7/0x190 kernel/panic.c:622
report_bug+0x1bc/0x210 lib/bug.c:198
handle_bug+0x3c/0x60 arch/x86/kernel/traps.c:316
exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:336
asm_exc_invalid_op+0x1b/0x20 arch/x86/include/asm/idtentry.h:568
RIP: 0010:usb_submit_urb+0x14e2/0x18a0 drivers/usb/core/urb.c:378
Code: 89 de e8 41 b6 eb fb 84 db 0f 85 a9 f3 ff ff e8 24 ba eb fb 4c 89 fe 48 c7 c7 00 1a 6f 8a c6 05 bc 67 18 08 01 e8 9f ea a6 03 <0f> 0b e9 87 f3 ff ff 41 be ed ff ff ff e9 7c f3 ff ff e8 f7 b9 eb
RSP: 0018:ffffc900000079d0 EFLAGS: 00010082
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000040000 RSI: ffffffff81614258 RDI: fffff52000000f2c
RBP: ffff88807d2ab9d8 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000101 R11: 0000000000000001 R12: 0000000000000016
R13: ffff888040712858 R14: 00000000fffffff0 R15: ffff888146fb0a00
cm109_urb_irq_callback+0x44c/0xaa0 drivers/input/misc/cm109.c:422
__usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1670
usb_hcd_giveback_urb+0x367/0x410 drivers/usb/core/hcd.c:1747
dummy_timer+0x11f9/0x32b0 drivers/usb/gadget/udc/dummy_hcd.c:1988
call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1519 [inline]
__run_timers.part.0+0x679/0xa80 kernel/time/timer.c:1790
__run_timers kernel/time/timer.c:1768 [inline]
run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1803
__do_softirq+0x29b/0x9c2 kernel/softirq.c:571
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1106
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:lock_acquire+0x1ef/0x570 kernel/locking/lockdep.c:5633
Code: b7 a3 7e 83 f8 01 0f 85 e8 02 00 00 9c 58 f6 c4 02 0f 85 fb 02 00 00 48 83 7c 24 08 00 74 01 fb 48 b8 00 00 00 00 00 fc ff df <48> 01 c3 48 c7 03 00 00 00 00 48 c7 43 08 00 00 00 00 48 8b 84 24
RSP: 0018:ffffc9000d61fb68 EFLAGS: 00000206
RAX: dffffc0000000000 RBX: 1ffff92001ac3f6f RCX: ffffffff815e6c4e
RDX: 1ffff11004f7ec41 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffff90693937
R10: fffffbfff20d2726 R11: 0000000000000001 R12: 0000000000000001
R13: 0000000000000000 R14: ffff88807ba01718 R15: 0000000000000000
__might_fault mm/memory.c:5589 [inline]
__might_fault+0x104/0x170 mm/memory.c:5582
_copy_to_user+0x25/0x140 lib/usercopy.c:28
copy_to_user include/linux/uaccess.h:160 [inline]
cp_new_stat+0x47b/0x5b0 fs/stat.c:391
__do_sys_newfstatat+0x104/0x110 fs/stat.c:428
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7fae5b7251da
Code: 48 89 f2 b9 00 01 00 00 48 89 fe bf 9c ff ff ff e9 0b 00 00 00 66 2e 0f 1f 84 00 00 00 00 00 90 41 89 ca b8 06 01 00 00 0f 05 <3d> 00 f0 ff ff 77 07 31 c0 c3 0f 1f 40 00 48 8b 15 69 fc 0c 00 f7
RSP: 002b:00007ffec661e568 EFLAGS: 00000202 ORIG_RAX: 0000000000000106
RAX: ffffffffffffffda RBX: 00007fae5b7f2380 RCX: 00007fae5b7251da
RDX: 00007ffec661e570 RSI: 00007fae5b7bb75a RDI: 0000000000000008
RBP: 00005588119d10c0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000001000 R11: 0000000000000202 R12: 00005588119d10c0
R13: 0000000000000000 R14: 00007ffec661eb48 R15: 0000000000003fff
Code: 48 89 f2 b9 00 01 00 00 48 89 fe bf 9c ff ff ff e9 0b 00 00 00 66 2e 0f 1f 84 00 00 00 00 00 90 41 89 ca b8 06 01 00 00 0f 05 <3d> 00 f0 ff ff 77 07 31 c0 c3 0f 1f 40 00 48 8b 15 69 fc 0c 00 f7
RSP: 002b:00007ffec661e568 EFLAGS: 00000202 ORIG_RAX: 0000000000000106
RAX: ffffffffffffffda RBX: 00007fae5b7f2380 RCX: 00007fae5b7251da
RDX: 00007ffec661e570 RSI: 00007fae5b7bb75a RDI: 0000000000000008
RBP: 00005588119d10c0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000001000 R11: 0000000000000202 R12: 00005588119d10c0
R13: 0000000000000000 R14: 00007ffec661eb48 R15: 0000000000003fff
----------------
Code disassembly (best guess):
0: b7 a3 mov $0xa3,%bh
2: 7e 83 jle 0xffffff87
4: f8 clc
5: 01 0f add %ecx,(%rdi)
7: 85 e8 test %ebp,%eax
9: 02 00 add (%rax),%al
b: 00 9c 58 f6 c4 02 0f add %bl,0xf02c4f6(%rax,%rbx,2)
12: 85 fb test %edi,%ebx
14: 02 00 add (%rax),%al
16: 00 48 83 add %cl,-0x7d(%rax)
19: 7c 24 jl 0x3f
1b: 08 00 or %al,(%rax)
1d: 74 01 je 0x20
1f: fb sti
20: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
27: fc ff df
* 2a: 48 01 c3 add %rax,%rbx <-- trapping instruction
2d: 48 c7 03 00 00 00 00 movq $0x0,(%rbx)
34: 48 c7 43 08 00 00 00 movq $0x0,0x8(%rbx)
3b: 00
3c: 48 rex.W
3d: 8b .byte 0x8b
3e: 84 .byte 0x84
3f: 24 .byte 0x24