cm109 4-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff88802c6f9000 submitted while active
WARNING: CPU: 1 PID: 5354 at drivers/usb/core/urb.c:379 usb_submit_urb+0x1039/0x18c0 drivers/usb/core/urb.c:379
Modules linked in:
CPU: 1 PID: 5354 Comm: modprobe Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
RIP: 0010:usb_submit_urb+0x1039/0x18c0 drivers/usb/core/urb.c:379
Code: 00 eb 66 e8 79 69 8f fa e9 79 f0 ff ff e8 6f 69 8f fa c6 05 90 22 6b 08 01 90 48 c7 c7 c0 c2 4a 8c 4c 89 ee e8 98 3d 52 fa 90 <0f> 0b 90 90 e9 40 f0 ff ff e8 49 69 8f fa eb 12 e8 42 69 8f fa 41
RSP: 0018:ffffc90000a08750 EFLAGS: 00010046
RAX: f900592e0a911c00 RBX: 0000000000000820 RCX: 0000000000040000
RDX: ffffc900022c2000 RSI: 000000000000929c RDI: 000000000000929d
RBP: ffff88802c6f9008 R08: ffffffff8157cb22 R09: 1ffff110172a51a2
R10: dffffc0000000000 R11: ffffed10172a51a3 R12: ffff88805df08830
R13: ffff88802c6f9000 R14: dffffc0000000000 R15: ffff8880249189e1
FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2a0dcd66e4 CR3: 000000006564a000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
cm109_urb_irq_callback+0x6cc/0xc30 drivers/input/misc/cm109.c:422
__usb_hcd_giveback_urb+0x373/0x530 drivers/usb/core/hcd.c:1650
dummy_timer+0x8aa/0x3220 drivers/usb/gadget/udc/dummy_hcd.c:1987
call_timer_fn+0x17e/0x600 kernel/time/timer.c:1792
expire_timers kernel/time/timer.c:1843 [inline]
__run_timers kernel/time/timer.c:2408 [inline]
__run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2419
run_timer_base kernel/time/timer.c:2428 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2438
__do_softirq+0x2bc/0x943 kernel/softirq.c:554
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633
irq_exit_rcu+0x9/0x30 kernel/softirq.c:645
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__sanitizer_cov_trace_switch+0x6/0x120 kernel/kcov.c:317
Code: 20 c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 41 57 <41> 56 41 54 53 4c 8b 16 48 8b 46 08 48 83 c0 f8 48 c1 c0 3d 48 83
RSP: 0018:ffffc900096e7518 EFLAGS: 00000202
RAX: 0000000000000000 RBX: 0000000000000002 RCX: ffff8880255f1e00
RDX: ffffffff9012c78a RSI: ffffffff8dfa0870 RDI: 0000000000000002
RBP: ffffffff9012c78f R08: 0000000000000005 R09: ffffffff8140972e
R10: 0000000000000008 R11: ffff8880255f1e00 R12: ffffffff9012c78e
R13: dffffc0000000000 R14: ffffc900096e7650 R15: 1ffff920012dcec0
unwind_next_frame+0xff6/0x2a00 arch/x86/kernel/unwind_orc.c:581
arch_stack_walk+0x151/0x1b0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x118/0x1d0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
poison_slab_object+0xa6/0xe0 mm/kasan/common.c:240
__kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2106 [inline]
slab_free mm/slub.c:4280 [inline]
kmem_cache_free+0x102/0x2b0 mm/slub.c:4344
vma_lock_free kernel/fork.c:453 [inline]
__vm_area_free+0xe0/0x110 kernel/fork.c:509
remove_vma mm/mmap.c:146 [inline]
exit_mmap+0x6a9/0xd40 mm/mmap.c:3311
__mmput+0x115/0x3c0 kernel/fork.c:1345
exit_mm+0x220/0x310 kernel/exit.c:569
do_exit+0x99e/0x27e0 kernel/exit.c:865
do_group_exit+0x207/0x2c0 kernel/exit.c:1027
__do_sys_exit_group kernel/exit.c:1038 [inline]
__se_sys_exit_group kernel/exit.c:1036 [inline]
__x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1036
do_syscall_64+0xfb/0x240
entry_SYSCALL_64_after_hwframe+0x6d/0x75
RIP: 0033:0x7f42b9ef8a90
Code: Unable to access opcode bytes at 0x7f42b9ef8a66.
RSP: 002b:00007ffc6810d6f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f42b9fe9860 RCX: 00007f42b9ef8a90
RDX: 00000000000000e7 RSI: 000000000000003c RDI: 0000000000000001
RBP: 00007f42b9fe9860 R08: 00007ffc6810d570 R09: 00007ffc6810d650
R10: 00007ffc6810d5b0 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 00007f42b9fed658 R15: 0000000000000001
----------------
Code disassembly (best guess):
0: 20 c3 and %al,%bl
2: cc int3
3: cc int3
4: cc int3
5: cc int3
6: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1)
d: 00 00 00
10: 0f 1f 40 00 nopl 0x0(%rax)
14: 90 nop
15: 90 nop
16: 90 nop
17: 90 nop
18: 90 nop
19: 90 nop
1a: 90 nop
1b: 90 nop
1c: 90 nop
1d: 90 nop
1e: 90 nop
1f: 90 nop
20: 90 nop
21: 90 nop
22: 90 nop
23: 90 nop
24: f3 0f 1e fa endbr64
28: 41 57 push %r15
* 2a: 41 56 push %r14 <-- trapping instruction
2c: 41 54 push %r12
2e: 53 push %rbx
2f: 4c 8b 16 mov (%rsi),%r10
32: 48 8b 46 08 mov 0x8(%rsi),%rax
36: 48 83 c0 f8 add $0xfffffffffffffff8,%rax
3a: 48 c1 c0 3d rol $0x3d,%rax
3e: 48 rex.W
3f: 83 .byte 0x83