cm109 3-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff888059e8a300 submitted while active
WARNING: CPU: 0 PID: 5234 at drivers/usb/core/urb.c:379 usb_submit_urb+0xfc1/0x1830 drivers/usb/core/urb.c:379
Modules linked in:
CPU: 0 UID: 0 PID: 5234 Comm: udevd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:usb_submit_urb+0xfc1/0x1830 drivers/usb/core/urb.c:379
Code: 44 89 f2 e8 91 b8 00 fa e9 13 fc ff ff e8 27 d2 93 fa c6 05 7e a9 61 08 01 90 48 c7 c7 c0 fe 34 8c 48 89 de e8 30 6e 57 fa 90 <0f> 0b 90 90 e9 b7 f0 ff ff e8 01 d2 93 fa eb 11 e8 fa d1 93 fa bd
RSP: 0018:ffffc90000007868 EFLAGS: 00010046
RAX: 2bd688e62563e300 RBX: ffff888059e8a300 RCX: 0000000000040000
RDX: ffffc900021a1000 RSI: 0000000000001e05 RDI: 0000000000001e06
RBP: 000000000000000f R08: ffff8880b8624253 R09: 1ffff110170c484a
R10: dffffc0000000000 R11: ffffed10170c484b R12: dffffc0000000000
R13: ffff88807f54b830 R14: ffff888059e8a308 R15: 0000000000000820
FS: 00007fcc0eca8880(0000) GS:ffff888125c18000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000559e8898b8e0 CR3: 000000007f08c000 CR4: 00000000003526f0
Call Trace:
cm109_submit_ctl drivers/input/misc/cm109.c:380 [inline]
cm109_urb_irq_callback+0x709/0xca0 drivers/input/misc/cm109.c:431
__usb_hcd_giveback_urb+0x373/0x540 drivers/usb/core/hcd.c:1661
dummy_timer+0x862/0x4550 drivers/usb/gadget/udc/dummy_hcd.c:1995
__run_hrtimer kernel/time/hrtimer.c:1761 [inline]
__hrtimer_run_queues+0x529/0xc60 kernel/time/hrtimer.c:1825
hrtimer_run_softirq+0x187/0x2b0 kernel/time/hrtimer.c:1842
handle_softirqs+0x283/0x870 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1050
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:do_dentry_open+0xc5f/0x13f0 fs/open.c:978
Code: c1 e8 03 42 80 3c 20 00 74 08 4c 89 ff e8 39 14 f0 ff 4d 8b 3f 4d 85 ff 74 42 49 83 c7 50 4c 89 f8 48 c1 e8 03 42 80 3c 20 00 <74> 08 4c 89 ff e8 17 14 f0 ff 49 83 3f 00 74 29 e8 ec a5 8c ff 48
RSP: 0018:ffffc90002fa7890 EFLAGS: 00000246
RAX: 1ffffffff1729b4a RBX: ffff888024e58fc0 RCX: ffff88807e3d8000
RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000000
RBP: 00000000044d801e R08: ffff88807e1a9e17 R09: 1ffff1100fc353c2
R10: dffffc0000000000 R11: ffffffff82012f00 R12: dffffc0000000000
R13: ffff888024e59010 R14: ffff8880530bf2a8 R15: ffffffff8b94da50
vfs_open+0x3b/0x340 fs/open.c:1095
do_open fs/namei.c:3887 [inline]
path_openat+0x2ee5/0x3830 fs/namei.c:4046
do_filp_open+0x1fa/0x410 fs/namei.c:4073
do_sys_openat2+0x121/0x1c0 fs/open.c:1435
do_sys_open fs/open.c:1450 [inline]
__do_sys_openat fs/open.c:1466 [inline]
__se_sys_openat fs/open.c:1461 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1461
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fcc0e4a7407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007fff35135b60 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fcc0eca8880 RCX: 00007fcc0e4a7407
RDX: 0000000000080141 RSI: 0000559e4c86d02e RDI: ffffffffffffff9c
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000000001a4 R11: 0000000000000202 R12: 00000000ffffffff
R13: 00000000ffffffff R14: ffffffffffffffff R15: 0000000000000000
----------------
Code disassembly (best guess):
0: c1 e8 03 shr $0x3,%eax
3: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1)
8: 74 08 je 0x12
a: 4c 89 ff mov %r15,%rdi
d: e8 39 14 f0 ff call 0xfff0144b
12: 4d 8b 3f mov (%r15),%r15
15: 4d 85 ff test %r15,%r15
18: 74 42 je 0x5c
1a: 49 83 c7 50 add $0x50,%r15
1e: 4c 89 f8 mov %r15,%rax
21: 48 c1 e8 03 shr $0x3,%rax
25: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1)
* 2a: 74 08 je 0x34 <-- trapping instruction
2c: 4c 89 ff mov %r15,%rdi
2f: e8 17 14 f0 ff call 0xfff0144b
34: 49 83 3f 00 cmpq $0x0,(%r15)
38: 74 29 je 0x63
3a: e8 ec a5 8c ff call 0xff8ca62b
3f: 48 rex.W