cm109 1-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff8880550b8f00 submitted while active
WARNING: CPU: 1 PID: 7642 at drivers/usb/core/urb.c:380 usb_submit_urb+0xf8c/0x18b0 drivers/usb/core/urb.c:380
Modules linked in:
CPU: 1 UID: 0 PID: 7642 Comm: kworker/u8:26 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: writeback wb_workfn (flush-250:0)
RIP: 0010:usb_submit_urb+0xf8c/0x18b0 drivers/usb/core/urb.c:380
Code: 00 00 00 e8 f6 bf cc fa e9 25 f1 ff ff e8 ec bf cc fa c6 05 06 c7 73 08 01 90 48 c7 c7 a0 17 11 8c 48 89 de e8 c5 db 8f fa 90 <0f> 0b 90 90 e9 ec f0 ff ff e8 c6 bf cc fa c6 05 47 ff 89 08 01 41
RSP: 0018:ffffc90000a08878 EFLAGS: 00010046
RAX: 0ab0da3a194c1b00 RBX: ffff8880550b8f00 RCX: 0000000000040000
RDX: ffffc90002402000 RSI: 00000000000143a0 RDI: 00000000000143a1
RBP: 000000000000000f R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff1bba684 R12: 0000000000000820
R13: ffff88807d9e2830 R14: ffff8880550b8f08 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff888126239000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000020000019f030 CR3: 000000007bf72000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000c0e
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
cm109_submit_ctl drivers/input/misc/cm109.c:380 [inline]
cm109_urb_irq_callback+0x709/0xca0 drivers/input/misc/cm109.c:431
__usb_hcd_giveback_urb+0x376/0x540 drivers/usb/core/hcd.c:1661
dummy_timer+0x85f/0x44c0 drivers/usb/gadget/udc/dummy_hcd.c:1995
__run_hrtimer kernel/time/hrtimer.c:1777 [inline]
__hrtimer_run_queues+0x52c/0xc60 kernel/time/hrtimer.c:1841
hrtimer_run_softirq+0x187/0x2b0 kernel/time/hrtimer.c:1858
handle_softirqs+0x286/0x870 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1052
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xa8/0x110 kernel/locking/spinlock.c:194
Code: 74 05 e8 5b 8b 7e f6 48 c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f6 44 24 21 02 75 4f f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 83 b9 46 f6 65 8b 05 dc 38 25 07 85 c0 74 40 48 c7 04 24 0e 36
RSP: 0018:ffffc9001c60f160 EFLAGS: 00000206
RAX: 0ab0da3a194c1b00 RBX: 0000000000000a02 RCX: 0ab0da3a194c1b00
RDX: 0000000000000006 RSI: ffffffff8d70e87c RDI: 0000000000000001
RBP: ffffc9001c60f1e8 R08: ffffffff8f7cf077 R09: 1ffffffff1ef9e0e
R10: dffffc0000000000 R11: fffffbfff1ef9e0f R12: dffffc0000000000
R13: ffff8880591f9828 R14: ffff8880591f9890 R15: 1ffff920038c1e2c
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
end_buffer_async_write+0x20b/0x2e0 fs/buffer.c:418
end_bio_bh_io_sync+0xbd/0x120 fs/buffer.c:2776
blk_update_request+0x57e/0xe60 block/blk-mq.c:998
blk_mq_end_request+0x3e/0x70 block/blk-mq.c:1160
nullb_complete_cmd drivers/block/null_blk/main.c:1402 [inline]
null_handle_cmd drivers/block/null_blk/main.c:1454 [inline]
null_queue_rq+0xbfe/0xe30 drivers/block/null_blk/main.c:1693
null_queue_rqs+0x123/0x270 drivers/block/null_blk/main.c:1707
__blk_mq_flush_list block/blk-mq.c:2837 [inline]
blk_mq_dispatch_queue_requests+0x417/0x800 block/blk-mq.c:2882
blk_mq_flush_plug_list+0x432/0x550 block/blk-mq.c:2970
__blk_flush_plug+0x3d3/0x4b0 block/blk-core.c:1225
blk_finish_plug+0x5e/0x90 block/blk-core.c:1252
wb_writeback+0xa80/0xaf0 fs/fs-writeback.c:2233
wb_check_old_data_flush fs/fs-writeback.c:2301 [inline]
wb_do_writeback fs/fs-writeback.c:2354 [inline]
wb_workfn+0xaef/0xef0 fs/fs-writeback.c:2382
process_one_work kernel/workqueue.c:3263 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
----------------
Code disassembly (best guess):
0: 74 05 je 0x7
2: e8 5b 8b 7e f6 call 0xf67e8b62
7: 48 c7 44 24 20 00 00 movq $0x0,0x20(%rsp)
e: 00 00
10: 9c pushf
11: 8f 44 24 20 pop 0x20(%rsp)
15: f6 44 24 21 02 testb $0x2,0x21(%rsp)
1a: 75 4f jne 0x6b
1c: f7 c3 00 02 00 00 test $0x200,%ebx
22: 74 01 je 0x25
24: fb sti
25: bf 01 00 00 00 mov $0x1,%edi
* 2a: e8 83 b9 46 f6 call 0xf646b9b2 <-- trapping instruction
2f: 65 8b 05 dc 38 25 07 mov %gs:0x72538dc(%rip),%eax # 0x7253912
36: 85 c0 test %eax,%eax
38: 74 40 je 0x7a
3a: 48 rex.W
3b: c7 .byte 0xc7
3c: 04 24 add $0x24,%al
3e: 0e (bad)
3f: 36 ss