URB ffff8881077a0000 submitted while active
WARNING: CPU: 3 PID: 7535 at drivers/usb/core/urb.c:379 usb_submit_urb+0x14da/0x1730 drivers/usb/core/urb.c:379
Modules linked in:
CPU: 3 UID: 0 PID: 7535 Comm: syz.1.463 Not tainted 6.13.0-rc3-syzkaller-00044-gaef25be35d23 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:usb_submit_urb+0x14da/0x1730 drivers/usb/core/urb.c:379
Code: fd eb cb bb fe ff ff ff e9 c1 f3 ff ff e8 1e 02 af fa c6 05 f4 cf 5c 09 01 90 48 c7 c7 40 1b 2e 8c 48 89 de e8 97 3b 6f fa 90 <0f> 0b 90 90 e9 b6 fe ff ff bb f8 ff ff ff e9 91 f3 ff ff 48 89 ef
RSP: 0018:ffffc90000708a88 EFLAGS: 00010086
RAX: 0000000000000000 RBX: ffff8881077a0000 RCX: ffffffff815a5079
RDX: ffff88802f76a440 RSI: ffffffff815a5086 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000002 R12: 0000000000000046
R13: ffff888023d89058 R14: 000000000000000f R15: 0000000000000000
FS:  00007f3a196596c0(0000) GS:ffff88806a900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000002002c000 CR3: 0000000023aee000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 cm109_submit_ctl drivers/input/misc/cm109.c:380 [inline]
 cm109_urb_irq_callback+0x2e7/0xb60 drivers/input/misc/cm109.c:431
 __usb_hcd_giveback_urb+0x389/0x6e0 drivers/usb/core/hcd.c:1650
 usb_hcd_giveback_urb+0x396/0x450 drivers/usb/core/hcd.c:1734
 dummy_timer+0x17f7/0x3960 drivers/usb/gadget/udc/dummy_hcd.c:1993
 __run_hrtimer kernel/time/hrtimer.c:1739 [inline]
 __hrtimer_run_queues+0x20a/0xae0 kernel/time/hrtimer.c:1803
 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1820
 handle_softirqs+0x213/0x8f0 kernel/softirq.c:561
 __do_softirq kernel/softirq.c:595 [inline]
 invoke_softirq kernel/softirq.c:435 [inline]
 __irq_exit_rcu+0x109/0x170 kernel/softirq.c:662
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lock_acquire.part.0+0x155/0x380 kernel/locking/lockdep.c:5814
Code: b8 ff ff ff ff 65 0f c1 05 90 c2 8b 7e 83 f8 01 0f 85 d0 01 00 00 9c 58 f6 c4 02 0f 85 e5 01 00 00 48 85 ed 0f 85 b6 01 00 00 <48> b8 00 00 00 00 00 fc ff df 48 01 c3 48 c7 03 00 00 00 00 48 c7
RSP: 0018:ffffc900056bfac0 EFLAGS: 00000206
RAX: 0000000000000046 RBX: 1ffff92000ad7f59 RCX: ffffffff8175d0de
RDX: 0000000000000001 RSI: ffffffff8b6cdb60 RDI: ffffffff8bd1e920
RBP: 0000000000000200 R08: 0000000000000000 R09: fffffbfff2dca19f
R10: ffffffff96e50cff R11: 0000000000000000 R12: 0000000000000000
R13: ffff8880318681e0 R14: 0000000000000000 R15: 0000000000000000
 __might_fault mm/memory.c:6751 [inline]
 __might_fault+0x11b/0x190 mm/memory.c:6744
 _copy_to_iter+0x1c4/0x1560 lib/iov_iter.c:184
 copy_to_iter include/linux/uio.h:211 [inline]
 get_random_bytes_user+0x180/0x3c0 drivers/char/random.c:472
 __do_sys_getrandom drivers/char/random.c:1414 [inline]
 __se_sys_getrandom drivers/char/random.c:1388 [inline]
 __x64_sys_getrandom+0x184/0x290 drivers/char/random.c:1388
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3a18785d29
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3a19659038 EFLAGS: 00000246 ORIG_RAX: 000000000000013e
RAX: ffffffffffffffda RBX: 00007f3a18975fa0 RCX: 00007f3a18785d29
RDX: 0000000000000000 RSI: 00000000ffffff9a RDI: 0000000020000240
RBP: 00007f3a18801a20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3a18975fa0 R15: 00007ffd49f4c658
 </TASK>
----------------
Code disassembly (best guess):
   0:	b8 ff ff ff ff       	mov    $0xffffffff,%eax
   5:	65 0f c1 05 90 c2 8b 	xadd   %eax,%gs:0x7e8bc290(%rip)        # 0x7e8bc29d
   c:	7e
   d:	83 f8 01             	cmp    $0x1,%eax
  10:	0f 85 d0 01 00 00    	jne    0x1e6
  16:	9c                   	pushf
  17:	58                   	pop    %rax
  18:	f6 c4 02             	test   $0x2,%ah
  1b:	0f 85 e5 01 00 00    	jne    0x206
  21:	48 85 ed             	test   %rbp,%rbp
  24:	0f 85 b6 01 00 00    	jne    0x1e0
* 2a:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax <-- trapping instruction
  31:	fc ff df
  34:	48 01 c3             	add    %rax,%rbx
  37:	48 c7 03 00 00 00 00 	movq   $0x0,(%rbx)
  3e:	48                   	rex.W
  3f:	c7                   	.byte 0xc7