cm109 3-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff88801f256400 submitted while active
WARNING: CPU: 1 PID: 8837 at drivers/usb/core/urb.c:379 usb_submit_urb+0x1039/0x18c0 drivers/usb/core/urb.c:379
Modules linked in:
CPU: 1 PID: 8837 Comm: syz-executor.3 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
RIP: 0010:usb_submit_urb+0x1039/0x18c0 drivers/usb/core/urb.c:379
Code: 00 eb 66 e8 b9 b2 86 fa e9 79 f0 ff ff e8 af b2 86 fa c6 05 1e 90 63 08 01 90 48 c7 c7 c0 96 4b 8c 4c 89 ee e8 c8 86 49 fa 90 <0f> 0b 90 90 e9 40 f0 ff ff e8 89 b2 86 fa eb 12 e8 82 b2 86 fa 41
RSP: 0018:ffffc90000a08750 EFLAGS: 00010046
RAX: 01b17368f73c7500 RBX: 0000000000000820 RCX: 0000000000040000
RDX: ffffc900022e1000 RSI: 0000000000007f76 RDI: 0000000000007f77
RBP: ffff88801f256408 R08: ffffffff8157cc12 R09: fffffbfff1bf9650
R10: dffffc0000000000 R11: fffffbfff1bf9650 R12: ffff88805dc00830
R13: ffff88801f256400 R14: dffffc0000000000 R15: ffff88802503fb01
FS:  0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000200000c0 CR3: 000000000df32000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 cm109_urb_irq_callback+0x6cc/0xc30 drivers/input/misc/cm109.c:422
 __usb_hcd_giveback_urb+0x373/0x530 drivers/usb/core/hcd.c:1650
 dummy_timer+0x8aa/0x3220 drivers/usb/gadget/udc/dummy_hcd.c:1987
 call_timer_fn+0x17e/0x600 kernel/time/timer.c:1792
 expire_timers kernel/time/timer.c:1843 [inline]
 __run_timers kernel/time/timer.c:2408 [inline]
 __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2419
 run_timer_base kernel/time/timer.c:2428 [inline]
 run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2438
 __do_softirq+0x2bc/0x943 kernel/softirq.c:554
 invoke_softirq kernel/softirq.c:428 [inline]
 __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__nr_to_section include/linux/mmzone.h:1855 [inline]
RIP: 0010:__pfn_to_section include/linux/mmzone.h:1963 [inline]
RIP: 0010:lookup_page_ext mm/page_ext.c:237 [inline]
RIP: 0010:page_ext_get+0x138/0x2a0 mm/page_ext.c:509
Code: 53 94 e8 fb 56 f4 ff 48 8b 05 a4 aa 4f 12 48 85 c0 74 41 4c 89 e1 48 c1 e9 16 48 8d 1c c8 48 89 d8 48 c1 e8 03 42 80 3c 38 00 <74> 08 48 89 df e8 ce 56 f4 ff 48 8b 1b 48 85 db 74 1f 4c 89 e5 48
RSP: 0018:ffffc9000538f5a8 EFLAGS: 00000246
RAX: 1ffff11047ffde00 RBX: ffff88823ffef000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 00000000017c6980 RDI: 000000ffffffffc0
RBP: 000000ffffffffc0 R08: ffffffff8203ed4e R09: 1ffffffff259caa0
R10: dffffc0000000000 R11: fffffbfff259caa1 R12: 000000000005f1a6
R13: ffffc9000538fae0 R14: ffffffff8203ec80 R15: dffffc0000000000
 page_table_check_clear+0x59/0x730 mm/page_table_check.c:72
 zap_pte_range mm/memory.c:1452 [inline]
 zap_pmd_range mm/memory.c:1597 [inline]
 zap_pud_range mm/memory.c:1626 [inline]
 zap_p4d_range mm/memory.c:1647 [inline]
 unmap_page_range+0x1f7a/0x3610 mm/memory.c:1668
 unmap_vmas+0x3cc/0x5f0 mm/memory.c:1758
 exit_mmap+0x2c6/0xd40 mm/mmap.c:3287
 __mmput+0x115/0x3c0 kernel/fork.c:1345
 exit_mm+0x220/0x310 kernel/exit.c:569
 do_exit+0x99e/0x27e0 kernel/exit.c:865
 do_group_exit+0x207/0x2c0 kernel/exit.c:1027
 __do_sys_exit_group kernel/exit.c:1038 [inline]
 __se_sys_exit_group kernel/exit.c:1036 [inline]
 __ia32_sys_exit_group+0x3f/0x40 kernel/exit.c:1036
 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
 __do_fast_syscall_32+0xbe/0x120 arch/x86/entry/common.c:321
 do_fast_syscall_32+0x34/0x80 arch/x86/entry/common.c:346
 entry_SYSENTER_compat_after_hwframe+0x7a/0x84
RIP: 0023:0xf7313579
Code: Unable to access opcode bytes at 0xf731354f.
RSP: 002b:00000000f75b4d1c EFLAGS: 00000206 ORIG_RAX: 00000000000000fc
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000000000
RDX: 00000000ffffffff RSI: 00000000ffffff9c RDI: 00000000f746aff4
RBP: 000000000000001e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	53                   	push   %rbx
   1:	94                   	xchg   %eax,%esp
   2:	e8 fb 56 f4 ff       	call   0xfff45702
   7:	48 8b 05 a4 aa 4f 12 	mov    0x124faaa4(%rip),%rax        # 0x124faab2
   e:	48 85 c0             	test   %rax,%rax
  11:	74 41                	je     0x54
  13:	4c 89 e1             	mov    %r12,%rcx
  16:	48 c1 e9 16          	shr    $0x16,%rcx
  1a:	48 8d 1c c8          	lea    (%rax,%rcx,8),%rbx
  1e:	48 89 d8             	mov    %rbx,%rax
  21:	48 c1 e8 03          	shr    $0x3,%rax
  25:	42 80 3c 38 00       	cmpb   $0x0,(%rax,%r15,1)
* 2a:	74 08                	je     0x34 <-- trapping instruction
  2c:	48 89 df             	mov    %rbx,%rdi
  2f:	e8 ce 56 f4 ff       	call   0xfff45702
  34:	48 8b 1b             	mov    (%rbx),%rbx
  37:	48 85 db             	test   %rbx,%rbx
  3a:	74 1f                	je     0x5b
  3c:	4c 89 e5             	mov    %r12,%rbp
  3f:	48                   	rex.W