WARNING: CPU: 1 PID: 1272 at drivers/usb/core/urb.c:379 usb_submit_urb+0x14d6/0x1730 drivers/usb/core/urb.c:379
Modules linked in:
CPU: 1 PID: 1272 Comm: kworker/1:2 Not tainted 6.7.0-rc5-syzkaller-00200-g3bd7d7488169 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_submit_urb+0x14d6/0x1730 drivers/usb/core/urb.c:379
Code: fe eb cb bb fe ff ff ff e9 c5 f3 ff ff e8 92 67 06 fb c6 05 35 85 82 08 01 90 48 c7 c7 e0 d5 85 8b 48 89 de e8 cb 8c cc fa 90 <0f> 0b 90 90 e9 b6 fe ff ff bb f8 ff ff ff e9 95 f3 ff ff 48 89 ef
RSP: 0018:ffffc90000aa0950 EFLAGS: 00010086
RAX: 0000000000000000 RBX: ffff88801db9fe00 RCX: ffffffff814ca799
RDX: ffff888020c8cb00 RSI: ffffffff814ca7a6 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 000000000000000b R12: 0000000000000046
R13: ffff88801c837858 R14: 000000000000000f R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff88806b700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555555a27ca8 CR3: 000000001dfc6000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 cm109_urb_irq_callback+0x2e7/0xb50 drivers/input/misc/cm109.c:422
 __usb_hcd_giveback_urb+0x359/0x5c0 drivers/usb/core/hcd.c:1650
 usb_hcd_giveback_urb+0x389/0x430 drivers/usb/core/hcd.c:1733
 dummy_timer+0x1415/0x3600 drivers/usb/gadget/udc/dummy_hcd.c:1987
 call_timer_fn+0x193/0x590 kernel/time/timer.c:1700
 expire_timers kernel/time/timer.c:1751 [inline]
 __run_timers+0x764/0xb20 kernel/time/timer.c:2022
 run_timer_softirq+0x58/0xd0 kernel/time/timer.c:2035
 __do_softirq+0x21a/0x8de kernel/softirq.c:553
 invoke_softirq kernel/softirq.c:427 [inline]
 __irq_exit_rcu kernel/softirq.c:632 [inline]
 irq_exit_rcu+0xb7/0x120 kernel/softirq.c:644
 sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1076
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:202
Code: 90 f3 0f 1e fa 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 aa 05 e4 f6 48 89 df e8 12 7d e4 f6 e8 bd 3d 0a f7 fb bf 01 00 00 00 <e8> 32 36 d6 f6 65 8b 05 03 c1 80 75 85 c0 74 02 5b c3 e8 90 84 7d
RSP: 0018:ffffc900076e76a0 EFLAGS: 00000202
RAX: 000000000002ef85 RBX: ffff8880142ef0f0 RCX: 1ffffffff23e3146
RDX: 0000000000000000 RSI: ffffffff8acca5a0 RDI: 0000000000000001
RBP: ffffc900076e7828 R08: 0000000000000001 R09: fffffbfff23e23d1
R10: ffffffff91f11e8f R11: 0000000000000061 R12: 1ffff92000edcee0
R13: ffff888020c8cb00 R14: ffffffff8165cd1d R15: ffffc900076e7730
 rwsem_down_write_slowpath kernel/locking/rwsem.c:1185 [inline]
 __down_write_common+0xc57/0x1400 kernel/locking/rwsem.c:1306
 kernfs_remove_by_name_ns+0x87/0x130 fs/kernfs/dir.c:1668
 driver_sysfs_remove drivers/base/dd.c:475 [inline]
 __device_release_driver drivers/base/dd.c:1266 [inline]
 device_release_driver_internal+0x414/0x610 drivers/base/dd.c:1295
 bus_remove_device+0x22c/0x420 drivers/base/bus.c:574
 device_del+0x39a/0xa50 drivers/base/core.c:3814
 usb_disable_device+0x36c/0x7f0 drivers/usb/core/message.c:1416
 usb_disconnect+0x2e1/0x910 drivers/usb/core/hub.c:2237
 hub_port_connect drivers/usb/core/hub.c:5280 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5580 [inline]
 port_event drivers/usb/core/hub.c:5740 [inline]
 hub_event+0x1db7/0x4e10 drivers/usb/core/hub.c:5822
 process_one_work+0x886/0x15d0 kernel/workqueue.c:2627
 process_scheduled_works kernel/workqueue.c:2700 [inline]
 worker_thread+0x8b9/0x1290 kernel/workqueue.c:2781
 kthread+0x2c6/0x3a0 kernel/kthread.c:388
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
 </TASK>
----------------
Code disassembly (best guess):
   0:	90                   	nop
   1:	f3 0f 1e fa          	endbr64
   5:	53                   	push   %rbx
   6:	48 8b 74 24 08       	mov    0x8(%rsp),%rsi
   b:	48 89 fb             	mov    %rdi,%rbx
   e:	48 83 c7 18          	add    $0x18,%rdi
  12:	e8 aa 05 e4 f6       	call   0xf6e405c1
  17:	48 89 df             	mov    %rbx,%rdi
  1a:	e8 12 7d e4 f6       	call   0xf6e47d31
  1f:	e8 bd 3d 0a f7       	call   0xf70a3de1
  24:	fb                   	sti
  25:	bf 01 00 00 00       	mov    $0x1,%edi
* 2a:	e8 32 36 d6 f6       	call   0xf6d63661 <-- trapping instruction
  2f:	65 8b 05 03 c1 80 75 	mov    %gs:0x7580c103(%rip),%eax        # 0x7580c139
  36:	85 c0                	test   %eax,%eax
  38:	74 02                	je     0x3c
  3a:	5b                   	pop    %rbx
  3b:	c3                   	ret
  3c:	e8                   	.byte 0xe8
  3d:	90                   	nop
  3e:	84                   	.byte 0x84
  3f:	7d                   	.byte 0x7d