cm109 1-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff88802884d300 submitted while active
WARNING: CPU: 1 PID: 8021 at drivers/usb/core/urb.c:379 usb_submit_urb+0xff9/0x1920 drivers/usb/core/urb.c:379
Modules linked in:
CPU: 1 PID: 8021 Comm: syz.4.1677 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:usb_submit_urb+0xff9/0x1920 drivers/usb/core/urb.c:379
Code: 9d 2e 8b 89 ea e8 da 0a ff 03 e9 f7 fb ff ff e8 7d 0c 5c fb c6 05 ca fd e4 07 01 48 c7 c7 e0 9b 2e 8b 48 89 de e8 07 7b 27 fb <0f> 0b e9 7d f0 ff ff e8 5b 0c 5c fb eb 21 e8 54 0c 5c fb 44 8b 6c
RSP: 0018:ffffc900001e0820 EFLAGS: 00010046
RAX: 0ea3d412c0151f00 RBX: ffff88802884d300 RCX: 0000000000040000
RDX: ffffc900022f2000 RSI: 0000000000001e39 RDI: 0000000000001e3a
RBP: 000000000000000f R08: ffff8880b8f279db R09: 1ffff110171e4f3b
R10: dffffc0000000000 R11: ffffed10171e4f3c R12: dffffc0000000000
R13: 0000000000000a20 R14: ffff88802884d308 R15: ffff8880554b4848
FS:  00007ffad3ff76c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000b00 CR3: 000000004984d000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 cm109_urb_irq_callback+0x701/0xc70 drivers/input/misc/cm109.c:422
 __usb_hcd_giveback_urb+0x35f/0x520 drivers/usb/core/hcd.c:1675
 dummy_timer+0xbf6/0x3090 drivers/usb/gadget/udc/dummy_hcd.c:1994
 __run_hrtimer kernel/time/hrtimer.c:1747 [inline]
 __hrtimer_run_queues+0x560/0xd70 kernel/time/hrtimer.c:1811
 hrtimer_run_softirq+0x183/0x2a0 kernel/time/hrtimer.c:1828
 handle_softirqs+0x2a1/0x930 kernel/softirq.c:596
 __do_softirq kernel/softirq.c:630 [inline]
 invoke_softirq kernel/softirq.c:470 [inline]
 __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:arch_irqs_disabled_flags arch/x86/include/asm/irqflags.h:125 [inline]
RIP: 0010:__might_resched+0x17a/0x630 kernel/sched/core.c:9933
Code: 00 41 8b 06 c1 e0 08 44 01 e0 3b 44 24 2c 75 72 42 c6 44 2b 0c 00 48 c7 84 24 a0 00 00 00 00 00 00 00 9c 8f 84 24 a0 00 00 00 <f7> 84 24 a0 00 00 00 00 02 00 00 42 c6 44 2b 0c f8 74 45 4c 8d 62
RSP: 0018:ffffc9001b8a7700 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 1ffff92003714ee8 RCX: 0ea3d412c0151f00
RDX: ffff888078628000 RSI: ffffffff8a8c23a0 RDI: ffffffff8adf0de0
RBP: ffffc9001b8a7818 R08: ffffc9001bdad04b R09: 1ffff920037b5a09
R10: dffffc0000000000 R11: fffff520037b5a0a R12: 0000000000000000
R13: dffffc0000000000 R14: ffff88807862843c R15: 1ffff1100f0c5087
 htable_selective_cleanup+0x299/0x320 net/netfilter/xt_hashlimit.c:375
 htable_put+0x1e9/0x240 net/netfilter/xt_hashlimit.c:430
 cleanup_match net/ipv6/netfilter/ip6_tables.c:479 [inline]
 find_check_entry net/ipv6/netfilter/ip6_tables.c:583 [inline]
 translate_table+0x1a09/0x2090 net/ipv6/netfilter/ip6_tables.c:735
 do_replace net/ipv6/netfilter/ip6_tables.c:1156 [inline]
 do_ip6t_set_ctl+0x9f8/0xe10 net/ipv6/netfilter/ip6_tables.c:1646
 nf_setsockopt+0x25f/0x280 net/netfilter/nf_sockopt.c:101
 rawv6_setsockopt+0x29e/0x660 net/ipv6/raw.c:1052
 __sys_setsockopt+0x2bf/0x3d0 net/socket.c:2287
 __do_sys_setsockopt net/socket.c:2298 [inline]
 __se_sys_setsockopt net/socket.c:2295 [inline]
 __x64_sys_setsockopt+0xb1/0xc0 net/socket.c:2295
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7ffad319c629
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffad3ff7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 00007ffad3415fa0 RCX: 00007ffad319c629
RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000003
RBP: 00007ffad3232b39 R08: 0000000000000488 R09: 0000000000000000
R10: 0000200000000b00 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffad3416038 R14: 00007ffad3415fa0 R15: 00007ffd9c6aaa78
 </TASK>
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	41 8b 06             	mov    (%r14),%eax
   3:	c1 e0 08             	shl    $0x8,%eax
   6:	44 01 e0             	add    %r12d,%eax
   9:	3b 44 24 2c          	cmp    0x2c(%rsp),%eax
   d:	75 72                	jne    0x81
   f:	42 c6 44 2b 0c 00    	movb   $0x0,0xc(%rbx,%r13,1)
  15:	48 c7 84 24 a0 00 00 	movq   $0x0,0xa0(%rsp)
  1c:	00 00 00 00 00
  21:	9c                   	pushf
  22:	8f 84 24 a0 00 00 00 	pop    0xa0(%rsp)
* 29:	f7 84 24 a0 00 00 00 	testl  $0x200,0xa0(%rsp) <-- trapping instruction
  30:	00 02 00 00
  34:	42 c6 44 2b 0c f8    	movb   $0xf8,0xc(%rbx,%r13,1)
  3a:	74 45                	je     0x81
  3c:	4c                   	rex.WR
  3d:	8d                   	.byte 0x8d
  3e:	62                   	.byte 0x62