cm109 5-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff88805a210d00 submitted while active
WARNING: CPU: 0 PID: 6237 at drivers/usb/core/urb.c:380 usb_submit_urb+0x16f5/0x1990 drivers/usb/core/urb.c:380
Modules linked in:
CPU: 0 UID: 0 PID: 6237 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:usb_submit_urb+0x16f5/0x1990 drivers/usb/core/urb.c:380
Code: ff ff ff bb fe ff ff ff e9 c9 f1 ff ff e8 03 ce b9 fa c6 05 f3 f1 46 09 01 90 48 c7 c7 00 fe 2d 8c 48 89 de e8 ac 54 78 fa 90 <0f> 0b 90 90 e9 a6 fe ff ff bb f8 ff ff ff e9 99 f1 ff ff c7 44 24
RSP: 0018:ffffc90000007a90 EFLAGS: 00010082
RAX: 0000000000000000 RBX: ffff88805a210d00 RCX: ffffc90002181000
RDX: 0000000000040000 RSI: ffffffff81799b95 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88807767b057 R14: ffff8881447f2960 R15: 000000000000000f
FS:  0000555594910500(0000) GS:ffff888124e67000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555688745c8 CR3: 000000004421a000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 cm109_submit_ctl drivers/input/misc/cm109.c:380 [inline]
 cm109_urb_irq_callback+0x2ed/0xb80 drivers/input/misc/cm109.c:431
 __usb_hcd_giveback_urb+0x38b/0x610 drivers/usb/core/hcd.c:1661
 usb_hcd_giveback_urb+0x39b/0x450 drivers/usb/core/hcd.c:1745
 dummy_timer+0x1809/0x3a00 drivers/usb/gadget/udc/dummy_hcd.c:1995
 __run_hrtimer kernel/time/hrtimer.c:1777 [inline]
 __hrtimer_run_queues+0x202/0xad0 kernel/time/hrtimer.c:1841
 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1858
 handle_softirqs+0x219/0x8e0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x109/0x170 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1052
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:check_kcov_mode kernel/kcov.c:185 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x3b/0x70 kernel/kcov.c:217
Code: 8b 05 e9 7c c0 11 a9 00 01 ff 00 74 1d f6 c4 01 74 43 a9 00 00 0f 00 75 3c a9 00 00 f0 00 75 35 8b 82 7c 16 00 00 85 c0 74 2b <8b> 82 58 16 00 00 83 f8 02 75 20 48 8b 8a 60 16 00 00 8b 92 5c 16
RSP: 0018:ffffc90005d27580 EFLAGS: 00000246
RAX: 0000000080000002 RBX: 000000000007486d RCX: ffffffff822f31dc
RDX: ffff8880256e8000 RSI: ffffffff822f34e0 RDI: 0000000000000006
RBP: 0000000000000001 R08: 0000000000000006 R09: 0000000000000001
R10: 0000000000000001 R11: 0000000000000000 R12: ffff88801ed6a210
R13: 0000000000000001 R14: 0000000000000000 R15: 000000000000486d
 rcu_read_unlock include/linux/rcupdate.h:895 [inline]
 page_table_check_set+0x600/0x750 mm/page_table_check.c:124
 __page_table_check_ptes_set+0x318/0x420 mm/page_table_check.c:209
 page_table_check_ptes_set include/linux/page_table_check.h:76 [inline]
 set_ptes include/linux/pgtable.h:292 [inline]
 __copy_present_ptes mm/memory.c:1100 [inline]
 copy_present_ptes mm/memory.c:1179 [inline]
 copy_pte_range mm/memory.c:1302 [inline]
 copy_pmd_range mm/memory.c:1389 [inline]
 copy_pud_range mm/memory.c:1426 [inline]
 copy_p4d_range mm/memory.c:1450 [inline]
 copy_page_range+0x2a48/0x6930 mm/memory.c:1538
 dup_mmap+0xe80/0x2280 mm/mmap.c:1834
 dup_mm kernel/fork.c:1489 [inline]
 copy_mm kernel/fork.c:1541 [inline]
 copy_process+0x3f0c/0x76a0 kernel/fork.c:2181
 kernel_clone+0xfc/0x930 kernel/fork.c:2609
 __do_sys_clone+0xce/0x120 kernel/fork.c:2750
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4e0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f55e3b85613
Code: 1f 84 00 00 00 00 00 64 48 8b 04 25 10 00 00 00 45 31 c0 31 d2 31 f6 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 89 c2 85 c0 75 2c 64 48 8b 04 25 10 00 00
RSP: 002b:00007ffddcb03a48 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f55e3b85613
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000001
R10: 00005555949107d0 R11: 0000000000000246 R12: 0000000000000000
R13: 00000000000927c0 R14: 00000000000601ba R15: 00007ffddcb03be0
 </TASK>
----------------
Code disassembly (best guess):
   0:	8b 05 e9 7c c0 11    	mov    0x11c07ce9(%rip),%eax        # 0x11c07cef
   6:	a9 00 01 ff 00       	test   $0xff0100,%eax
   b:	74 1d                	je     0x2a
   d:	f6 c4 01             	test   $0x1,%ah
  10:	74 43                	je     0x55
  12:	a9 00 00 0f 00       	test   $0xf0000,%eax
  17:	75 3c                	jne    0x55
  19:	a9 00 00 f0 00       	test   $0xf00000,%eax
  1e:	75 35                	jne    0x55
  20:	8b 82 7c 16 00 00    	mov    0x167c(%rdx),%eax
  26:	85 c0                	test   %eax,%eax
  28:	74 2b                	je     0x55
* 2a:	8b 82 58 16 00 00    	mov    0x1658(%rdx),%eax <-- trapping instruction
  30:	83 f8 02             	cmp    $0x2,%eax
  33:	75 20                	jne    0x55
  35:	48 8b 8a 60 16 00 00 	mov    0x1660(%rdx),%rcx
  3c:	8b                   	.byte 0x8b
  3d:	92                   	xchg   %eax,%edx
  3e:	5c                   	pop    %rsp
  3f:	16                   	(bad)