cm109 9-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff88804f302100 submitted while active
WARNING: CPU: 2 PID: 10883 at drivers/usb/core/urb.c:379 usb_submit_urb+0x1519/0x1770 drivers/usb/core/urb.c:379
Modules linked in:
CPU: 2 UID: 0 PID: 10883 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:usb_submit_urb+0x1519/0x1770 drivers/usb/core/urb.c:379
Code: fd eb cb bb fe ff ff ff e9 96 f3 ff ff e8 3f 84 7a fa c6 05 dd a3 52 09 01 90 48 c7 c7 60 02 74 8c 48 89 de e8 e8 29 39 fa 90 <0f> 0b 90 90 e9 ac fe ff ff bb f8 ff ff ff e9 66 f3 ff ff 48 89 ef
RSP: 0018:ffffc90000648a80 EFLAGS: 00010086
RAX: 0000000000000000 RBX: ffff88804f302100 RCX: ffffffff817a3358
RDX: ffff888024aa2440 RSI: ffffffff817a3365 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001
R13: ffff888050bf2857 R14: ffff88803b31c840 R15: 000000000000000f
FS:  00007fc9ca270880(0000) GS:ffff8880d68b9000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f34539729a0 CR3: 000000004a325000 CR4: 0000000000352ef0
Call Trace:
 <IRQ>
 cm109_submit_ctl drivers/input/misc/cm109.c:380 [inline]
 cm109_urb_irq_callback+0x2ed/0xb80 drivers/input/misc/cm109.c:431
 __usb_hcd_giveback_urb+0x38b/0x610 drivers/usb/core/hcd.c:1661
 usb_hcd_giveback_urb+0x39b/0x450 drivers/usb/core/hcd.c:1745
 dummy_timer+0x1814/0x3a30 drivers/usb/gadget/udc/dummy_hcd.c:1995
 __run_hrtimer kernel/time/hrtimer.c:1761 [inline]
 __hrtimer_run_queues+0x1ff/0xad0 kernel/time/hrtimer.c:1825
 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1842
 handle_softirqs+0x216/0x8e0 kernel/softirq.c:579
 __do_softirq kernel/softirq.c:613 [inline]
 invoke_softirq kernel/softirq.c:453 [inline]
 __irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1050
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:check_kcov_mode kernel/kcov.c:185 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x3b/0x70 kernel/kcov.c:217
Code: 8b 05 19 e4 1a 12 a9 00 01 ff 00 74 1d f6 c4 01 74 43 a9 00 00 0f 00 75 3c a9 00 00 f0 00 75 35 8b 82 3c 16 00 00 85 c0 74 2b <8b> 82 18 16 00 00 83 f8 02 75 20 48 8b 8a 20 16 00 00 8b 92 1c 16
RSP: 0018:ffffc9000dbef7b0 EFLAGS: 00000246
RAX: 0000000080000001 RBX: 0000000000000003 RCX: ffffffff8b8a814f
RDX: ffff888024aa2440 RSI: ffffffff8b8a81c0 RDI: ffffc9000dbef948
RBP: 0000000000000002 R08: 0000000000000004 R09: 0000000000000002
R10: 0000000000000009 R11: 0000000000000000 R12: ffffc9000dbef8f8
R13: 0000000000000009 R14: 0000000000000003 R15: dffffc0000000000
 mas_mn lib/maple_tree.c:328 [inline]
 mas_wr_walk lib/maple_tree.c:3559 [inline]
 mas_wr_store_type+0x8b0/0x21d0 lib/maple_tree.c:4241
 mas_wr_preallocate lib/maple_tree.c:4287 [inline]
 mas_erase+0x599/0x1370 lib/maple_tree.c:6258
 mtree_erase+0xc7/0x110 lib/maple_tree.c:6591
 simple_offset_remove fs/libfs.c:333 [inline]
 simple_offset_rename+0x189/0x3d0 fs/libfs.c:358
 shmem_rename2+0x198/0x3a0 mm/shmem.c:4122
 vfs_rename+0xfba/0x22c0 fs/namei.c:5129
 do_renameat2+0x7f9/0xc50 fs/namei.c:5278
 __do_sys_rename fs/namei.c:5325 [inline]
 __se_sys_rename fs/namei.c:5323 [inline]
 __x64_sys_rename+0x7d/0xa0 fs/namei.c:5323
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc9c9a7acc7
Code: e8 5e a7 09 00 f7 d8 19 c0 5b c3 0f 1f 84 00 00 00 00 00 b8 ff ff ff ff 5b c3 66 0f 1f 84 00 00 00 00 00 b8 52 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 8b 15 01 61 17 00 f7 d8 64 89 02 b8
RSP: 002b:00007ffec5301308 EFLAGS: 00000206 ORIG_RAX: 0000000000000052
RAX: ffffffffffffffda RBX: 00005562989405c0 RCX: 00007fc9c9a7acc7
RDX: 00005562986f1010 RSI: 00007ffec5301320 RDI: 00007ffec5301720
RBP: 0000556298949860 R08: 00000000000001e0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 00007ffec5301320
R13: 00007ffec5301720 R14: 0000000000000000 R15: 00005562784529dd
 </TASK>
----------------
Code disassembly (best guess):
   0:	8b 05 19 e4 1a 12    	mov    0x121ae419(%rip),%eax        # 0x121ae41f
   6:	a9 00 01 ff 00       	test   $0xff0100,%eax
   b:	74 1d                	je     0x2a
   d:	f6 c4 01             	test   $0x1,%ah
  10:	74 43                	je     0x55
  12:	a9 00 00 0f 00       	test   $0xf0000,%eax
  17:	75 3c                	jne    0x55
  19:	a9 00 00 f0 00       	test   $0xf00000,%eax
  1e:	75 35                	jne    0x55
  20:	8b 82 3c 16 00 00    	mov    0x163c(%rdx),%eax
  26:	85 c0                	test   %eax,%eax
  28:	74 2b                	je     0x55
* 2a:	8b 82 18 16 00 00    	mov    0x1618(%rdx),%eax <-- trapping instruction
  30:	83 f8 02             	cmp    $0x2,%eax
  33:	75 20                	jne    0x55
  35:	48 8b 8a 20 16 00 00 	mov    0x1620(%rdx),%rcx
  3c:	8b                   	.byte 0x8b
  3d:	92                   	xchg   %eax,%edx
  3e:	1c 16                	sbb    $0x16,%al