cm109 5-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff888024c70900 submitted while active
WARNING: CPU: 1 PID: 27089 at drivers/usb/core/urb.c:379 usb_submit_urb+0x1039/0x1930 drivers/usb/core/urb.c:379
Modules linked in:
CPU: 1 UID: 0 PID: 27089 Comm: syz.4.2545 Not tainted 6.13.0-rc3-syzkaller-00301-gbcde95ce32b6 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:usb_submit_urb+0x1039/0x1930 drivers/usb/core/urb.c:379
Code: 00 eb 66 e8 99 ed 5d fa e9 79 f0 ff ff e8 8f ed 5d fa c6 05 4c 34 c2 08 01 90 48 c7 c7 00 98 af 8c 4c 89 ee e8 38 91 1e fa 90 <0f> 0b 90 90 e9 40 f0 ff ff e8 69 ed 5d fa eb 12 e8 62 ed 5d fa 41
RSP: 0018:ffffc90000a18790 EFLAGS: 00010046
RAX: 341092c26aab3900 RBX: 0000000000000820 RCX: 0000000000040000
RDX: ffffc900023d2000 RSI: 0000000000006624 RDI: 0000000000006625
RBP: ffff888024c70908 R08: ffffffff81601a82 R09: 1ffff110170e519a
R10: dffffc0000000000 R11: ffffed10170e519b R12: 000000000000000f
R13: ffff888024c70900 R14: dffffc0000000000 R15: 0000000000000046
FS: 0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fcf8ced15e8 CR3: 0000000034820000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
cm109_submit_ctl drivers/input/misc/cm109.c:380 [inline]
cm109_urb_irq_callback+0x6ce/0xc20 drivers/input/misc/cm109.c:431
__usb_hcd_giveback_urb+0x42c/0x6e0 drivers/usb/core/hcd.c:1650
dummy_timer+0x856/0x4620 drivers/usb/gadget/udc/dummy_hcd.c:1993
__run_hrtimer kernel/time/hrtimer.c:1739 [inline]
__hrtimer_run_queues+0x59b/0xd30 kernel/time/hrtimer.c:1803
hrtimer_run_softirq+0x19a/0x2c0 kernel/time/hrtimer.c:1820
handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561
__do_softirq kernel/softirq.c:595 [inline]
invoke_softirq kernel/softirq.c:435 [inline]
__irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662
irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lock_acquire+0x96/0x550 kernel/locking/lockdep.c:5817
Code: 81 4c 8d 64 24 40 49 c1 ec 03 48 b8 f1 f1 f1 f1 00 f2 f2 f2 4b 89 04 2c 43 c7 44 2c 09 f2 f2 f2 00 43 c7 44 2c 11 f3 f3 f3 f3 <66> 43 c7 44 2c 15 f3 f3 43 c6 44 2c 17 f3 0f 1f 44 00 00 65 8b 05
RSP: 0018:ffffc900033c70e0 EFLAGS: 00000a06
RAX: f2f2f200f1f1f1f1 RBX: 00007f3fa5785d29 RCX: 0000000000000002
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8e937ae0
RBP: ffffc900033c7230 R08: 0000000000000000 R09: 0000000000000000
R10: ffffc900033c7330 R11: ffffffff818b3a20 R12: 1ffff92000678e24
R13: dffffc0000000000 R14: 0000000000000000 R15: 00007f3fa5785d29
rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
rcu_read_lock include/linux/rcupdate.h:849 [inline]
is_bpf_text_address+0x46/0x2a0 kernel/bpf/core.c:772
kernel_text_address+0xa7/0xe0 kernel/extable.c:125
__kernel_text_address+0xd/0x40 kernel/extable.c:79
unwind_get_return_address+0x4d/0x90 arch/x86/kernel/unwind_orc.c:369
arch_stack_walk+0xfd/0x150 arch/x86/kernel/stacktrace.c:26
stack_trace_save+0x118/0x1d0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__do_kmalloc_node mm/slub.c:4298 [inline]
__kmalloc_noprof+0x285/0x4c0 mm/slub.c:4310
kmalloc_noprof include/linux/slab.h:905 [inline]
kzalloc_noprof include/linux/slab.h:1037 [inline]
kobject_get_path+0xb8/0x230 lib/kobject.c:161
kobject_uevent_env+0x2a5/0x8e0 lib/kobject_uevent.c:545
device_remove drivers/base/dd.c:567 [inline]
__device_release_driver drivers/base/dd.c:1273 [inline]
device_release_driver_internal+0x4a9/0x7c0 drivers/base/dd.c:1296
driver_detach+0x1fb/0x2d0 drivers/base/dd.c:1359
bus_remove_driver+0x1f3/0x320 drivers/base/bus.c:744
usb_gadget_unregister_driver+0x4e/0x70 drivers/usb/gadget/udc/core.c:1732
raw_release+0xf6/0x1e0 drivers/usb/gadget/legacy/raw_gadget.c:462
__fput+0x23c/0xa50 fs/file_table.c:450
task_work_run+0x24f/0x310 kernel/task_work.c:239
exit_task_work include/linux/task_work.h:43 [inline]
do_exit+0xa2a/0x28e0 kernel/exit.c:938
do_group_exit+0x207/0x2c0 kernel/exit.c:1087
get_signal+0x16b2/0x1750 kernel/signal.c:3017
arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0xce/0x340 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3fa5785d29
Code: Unable to access opcode bytes at 0x7f3fa5785cff.
RSP: 002b:00007f3fa665e0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f3fa5976088 RCX: 00007f3fa5785d29
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f3fa5976088
RBP: 00007f3fa5976080 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f3fa597608c
R13: 0000000000000000 R14: 00007f3fa5a9f940 R15: 00007f3fa5a9fa28
----------------
Code disassembly (best guess):
0: 81 4c 8d 64 24 40 49 orl $0xc1494024,0x64(%rbp,%rcx,4)
7: c1
8: ec in (%dx),%al
9: 03 48 b8 add -0x48(%rax),%ecx
c: f1 int1
d: f1 int1
e: f1 int1
f: f1 int1
10: 00 f2 add %dh,%dl
12: f2 f2 4b 89 04 2c repnz repnz mov %rax,(%r12,%r13,1)
18: 43 c7 44 2c 09 f2 f2 movl $0xf2f2f2,0x9(%r12,%r13,1)
1f: f2 00
21: 43 c7 44 2c 11 f3 f3 movl $0xf3f3f3f3,0x11(%r12,%r13,1)
28: f3 f3
* 2a: 66 43 c7 44 2c 15 f3 movw $0xf3f3,0x15(%r12,%r13,1) <-- trapping instruction
31: f3
32: 43 c6 44 2c 17 f3 movb $0xf3,0x17(%r12,%r13,1)
38: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
3d: 65 gs
3e: 8b .byte 0x8b
3f: 05 .byte 0x5