cm109 4-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff88802ad15200 submitted while active
WARNING: CPU: 1 PID: 7090 at drivers/usb/core/urb.c:379 usb_submit_urb+0x1519/0x1770 drivers/usb/core/urb.c:379
Modules linked in:
CPU: 1 UID: 0 PID: 7090 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:usb_submit_urb+0x1519/0x1770 drivers/usb/core/urb.c:379
Code: fd eb cb bb fe ff ff ff e9 96 f3 ff ff e8 2f 4e 7a fa c6 05 20 8a 52 09 01 90 48 c7 c7 00 08 74 8c 48 89 de e8 38 f1 38 fa 90 <0f> 0b 90 90 e9 ac fe ff ff bb f8 ff ff ff e9 66 f3 ff ff 48 89 ef
RSP: 0018:ffffc90000a08a80 EFLAGS: 00010086
RAX: 0000000000000000 RBX: ffff88802ad15200 RCX: ffffc90002391000
RDX: 0000000000040000 RSI: ffffffff817a3395 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88806966f057 R14: ffff88805642b640 R15: 000000000000000f
FS:  00007f9c2a149880(0000) GS:ffff8881247b5000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f30fe4f56c0 CR3: 00000000298b3000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 cm109_submit_ctl drivers/input/misc/cm109.c:380 [inline]
 cm109_urb_irq_callback+0x2ed/0xb80 drivers/input/misc/cm109.c:431
 __usb_hcd_giveback_urb+0x388/0x610 drivers/usb/core/hcd.c:1661
 usb_hcd_giveback_urb+0x39b/0x450 drivers/usb/core/hcd.c:1745
 dummy_timer+0x1814/0x3a30 drivers/usb/gadget/udc/dummy_hcd.c:1995
 __run_hrtimer kernel/time/hrtimer.c:1761 [inline]
 __hrtimer_run_queues+0x1ff/0xad0 kernel/time/hrtimer.c:1825
 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1842
 handle_softirqs+0x219/0x8e0 kernel/softirq.c:579
 __do_softirq kernel/softirq.c:613 [inline]
 invoke_softirq kernel/softirq.c:453 [inline]
 __irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1050
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lock_acquire+0x62/0x350 kernel/locking/lockdep.c:5872
Code: e6 3e 12 83 f8 07 0f 87 bc 02 00 00 89 c0 48 0f a3 05 22 a2 13 0f 0f 82 74 02 00 00 8b 35 da d3 13 0f 85 f6 0f 85 8d 00 00 00 <48> 8b 44 24 30 65 48 2b 05 79 e6 3e 12 0f 85 c7 02 00 00 48 83 c4
RSP: 0018:ffffc9001b74f970 EFLAGS: 00000206
RAX: 0000000000000046 RBX: ffffffff8e5c1260 RCX: 00000000ef9d33e4
RDX: 0000000000000000 RSI: ffffffff8de2cdb0 RDI: ffffffff8c162d80
RBP: 0000000000000002 R08: 0ac0d5affe09d4ff R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 rcu_read_lock include/linux/rcupdate.h:841 [inline]
 class_rcu_constructor include/linux/rcupdate.h:1155 [inline]
 unwind_next_frame+0xd1/0x20a0 arch/x86/kernel/unwind_orc.c:479
 arch_stack_walk+0x94/0x100 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:388 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:405
 kasan_kmalloc include/linux/kasan.h:260 [inline]
 __do_kmalloc_node mm/slub.c:4376 [inline]
 __kmalloc_noprof+0x223/0x510 mm/slub.c:4388
 kmalloc_noprof include/linux/slab.h:909 [inline]
 inotify_handle_inode_event+0x1cf/0x6f0 fs/notify/inotify/inotify_fsnotify.c:96
 inotify_ignored_and_remove_idr+0x28/0x70 fs/notify/inotify/inotify_user.c:526
 fsnotify_free_mark+0xe9/0x140 fs/notify/mark.c:589
 __do_sys_inotify_rm_watch fs/notify/inotify/inotify_user.c:805 [inline]
 __se_sys_inotify_rm_watch fs/notify/inotify/inotify_user.c:786 [inline]
 __x64_sys_inotify_rm_watch+0x112/0x1a0 fs/notify/inotify/inotify_user.c:786
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9c2a24fa07
Code: 73 01 c3 48 8b 0d f1 f3 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 ff 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c1 f3 0c 00 f7 d8 64 89 01 48
RSP: 002b:00007ffeed8bcd28 EFLAGS: 00000246 ORIG_RAX: 00000000000000ff
RAX: ffffffffffffffda RBX: 0000558c61f40d50 RCX: 00007f9c2a24fa07
RDX: 0000000000000007 RSI: 0000000000000364 RDI: 0000000000000007
RBP: 0000000000000364 R08: 00000000000001e0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffeed8bcd30
R13: 0000000003938700 R14: 0000558c35c8c100 R15: 0000558c35c8c140
 </TASK>
----------------
Code disassembly (best guess):
   0:	e6 3e                	out    %al,$0x3e
   2:	12 83 f8 07 0f 87    	adc    -0x78f0f808(%rbx),%al
   8:	bc 02 00 00 89       	mov    $0x89000002,%esp
   d:	c0 48 0f a3          	rorb   $0xa3,0xf(%rax)
  11:	05 22 a2 13 0f       	add    $0xf13a222,%eax
  16:	0f 82 74 02 00 00    	jb     0x290
  1c:	8b 35 da d3 13 0f    	mov    0xf13d3da(%rip),%esi        # 0xf13d3fc
  22:	85 f6                	test   %esi,%esi
  24:	0f 85 8d 00 00 00    	jne    0xb7
* 2a:	48 8b 44 24 30       	mov    0x30(%rsp),%rax <-- trapping instruction
  2f:	65 48 2b 05 79 e6 3e 	sub    %gs:0x123ee679(%rip),%rax        # 0x123ee6b0
  36:	12
  37:	0f 85 c7 02 00 00    	jne    0x304
  3d:	48                   	rex.W
  3e:	83                   	.byte 0x83
  3f:	c4                   	.byte 0xc4