cm109 2-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff88807b3ed200 submitted while active
WARNING: CPU: 0 PID: 10146 at drivers/usb/core/urb.c:379 usb_submit_urb+0x1039/0x1930 drivers/usb/core/urb.c:379
Modules linked in:
CPU: 0 UID: 0 PID: 10146 Comm: syz.1.749 Not tainted 6.13.0-rc3-syzkaller-00136-g8faabc041a00 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024
RIP: 0010:usb_submit_urb+0x1039/0x1930 drivers/usb/core/urb.c:379
Code: 00 eb 66 e8 79 07 5e fa e9 79 f0 ff ff e8 6f 07 5e fa c6 05 ec 4c c2 08 01 90 48 c7 c7 00 97 af 8c 4c 89 ee e8 18 ab 1e fa 90 <0f> 0b 90 90 e9 40 f0 ff ff e8 49 07 5e fa eb 12 e8 42 07 5e fa 41
RSP: 0018:ffffc90000007790 EFLAGS: 00010046
RAX: d27d5d4bf8af5300 RBX: 0000000000000820 RCX: 0000000000040000
RDX: ffffc900021d1000 RSI: 000000000000537c RDI: 000000000000537d
RBP: ffff88807b3ed208 R08: ffffffff81601a42 R09: 1ffff110170c519a
R10: dffffc0000000000 R11: ffffed10170c519b R12: 000000000000000f
R13: ffff88807b3ed200 R14: dffffc0000000000 R15: 0000000000000046
FS:  000055557911b500(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb1bd7f95e8 CR3: 000000004c92a000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 cm109_submit_ctl drivers/input/misc/cm109.c:380 [inline]
 cm109_urb_irq_callback+0x6ce/0xc20 drivers/input/misc/cm109.c:431
 __usb_hcd_giveback_urb+0x42c/0x6e0 drivers/usb/core/hcd.c:1650
 dummy_timer+0x856/0x4620 drivers/usb/gadget/udc/dummy_hcd.c:1993
 __run_hrtimer kernel/time/hrtimer.c:1739 [inline]
 __hrtimer_run_queues+0x59b/0xd30 kernel/time/hrtimer.c:1803
 hrtimer_run_softirq+0x19a/0x2c0 kernel/time/hrtimer.c:1820
 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561
 __do_softirq kernel/softirq.c:595 [inline]
 invoke_softirq kernel/softirq.c:435 [inline]
 __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:stack_trace_consume_entry+0x64/0x280 kernel/stacktrace.c:89
Code: 10 48 8d 6b 08 49 89 ec 49 c1 ec 03 41 0f b6 04 14 84 c0 0f 85 1a 01 00 00 44 3b 45 00 73 3c 48 8d 7b 0c 49 89 fd 49 c1 ed 03 <41> 0f b6 44 15 00 84 c0 0f 85 36 01 00 00 44 8b 37 45 85 f6 74 22
RSP: 0018:ffffc90003dff710 EFLAGS: 00000a07
RAX: 0000000000000000 RBX: ffffc90003dff840 RCX: ffffffff91791000
RDX: dffffc0000000000 RSI: ffffffff87b8cd46 RDI: ffffc90003dff84c
RBP: ffffc90003dff848 R08: 0000000000000008 R09: ffffc90003dff850
R10: ffffc90003dff7b0 R11: ffffffff818b39e0 R12: 1ffff920007bff09
R13: 1ffff920007bff09 R14: ffffc90003dff840 R15: 1ffff920007bff0a
 arch_stack_walk+0x10e/0x150 arch/x86/kernel/stacktrace.c:27
 stack_trace_save+0x118/0x1d0 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
 __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
 kasan_kmalloc include/linux/kasan.h:260 [inline]
 __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329
 kmalloc_noprof include/linux/slab.h:901 [inline]
 kzalloc_noprof include/linux/slab.h:1037 [inline]
 kobject_uevent_env+0x28b/0x8e0 lib/kobject_uevent.c:540
 device_remove drivers/base/dd.c:567 [inline]
 __device_release_driver drivers/base/dd.c:1273 [inline]
 device_release_driver_internal+0x4a9/0x7c0 drivers/base/dd.c:1296
 driver_detach+0x1fb/0x2d0 drivers/base/dd.c:1359
 bus_remove_driver+0x1f3/0x320 drivers/base/bus.c:744
 usb_gadget_unregister_driver+0x4e/0x70 drivers/usb/gadget/udc/core.c:1732
 raw_release+0xf6/0x1e0 drivers/usb/gadget/legacy/raw_gadget.c:462
 __fput+0x23c/0xa50 fs/file_table.c:450
 task_work_run+0x24f/0x310 kernel/task_work.c:239
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x13f/0x340 kernel/entry/common.c:218
 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa206d85d29
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa20709fb88 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007fa206f77ba0 RCX: 00007fa206d85d29
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007fa206f77ba0 R08: 000000000000010c R09: 00007fa20709fe7f
R10: 00000000003ffcd0 R11: 0000000000000246 R12: 0000000000042124
R13: 00007fa206f76080 R14: 0000000000000032 R15: ffffffffffffffff
 </TASK>
----------------
Code disassembly (best guess):
   0:	10 48 8d             	adc    %cl,-0x73(%rax)
   3:	6b 08 49             	imul   $0x49,(%rax),%ecx
   6:	89 ec                	mov    %ebp,%esp
   8:	49 c1 ec 03          	shr    $0x3,%r12
   c:	41 0f b6 04 14       	movzbl (%r12,%rdx,1),%eax
  11:	84 c0                	test   %al,%al
  13:	0f 85 1a 01 00 00    	jne    0x133
  19:	44 3b 45 00          	cmp    0x0(%rbp),%r8d
  1d:	73 3c                	jae    0x5b
  1f:	48 8d 7b 0c          	lea    0xc(%rbx),%rdi
  23:	49 89 fd             	mov    %rdi,%r13
  26:	49 c1 ed 03          	shr    $0x3,%r13
* 2a:	41 0f b6 44 15 00    	movzbl 0x0(%r13,%rdx,1),%eax <-- trapping instruction
  30:	84 c0                	test   %al,%al
  32:	0f 85 36 01 00 00    	jne    0x16e
  38:	44 8b 37             	mov    (%rdi),%r14d
  3b:	45 85 f6             	test   %r14d,%r14d
  3e:	74 22                	je     0x62