cm109 10-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff88803e6cfa00 submitted while active
WARNING: CPU: 0 PID: 15985 at drivers/usb/core/urb.c:380 usb_submit_urb+0x16f5/0x1990 drivers/usb/core/urb.c:380
Modules linked in:
CPU: 0 UID: 0 PID: 15985 Comm: syz.9.7776 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:usb_submit_urb+0x16f5/0x1990 drivers/usb/core/urb.c:380
Code: ff ff ff bb fe ff ff ff e9 c9 f1 ff ff e8 13 00 b5 fa c6 05 2e c1 62 09 01 90 48 c7 c7 a0 15 50 8c 48 89 de e8 5c 33 73 fa 90 <0f> 0b 90 90 e9 a6 fe ff ff bb f8 ff ff ff e9 99 f1 ff ff c7 44 24
RSP: 0018:ffffc90000007a90 EFLAGS: 00010082
RAX: 0000000000000000 RBX: ffff88803e6cfa00 RCX: ffffc90001761000
RDX: 0000000000040000 RSI: ffffffff817b1ce5 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: ffff888058716857 R14: ffff88801369fac0 R15: 000000000000000f
FS: 00007f3b55a096c0(0000) GS:ffff8880d6a05000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c349638 CR3: 000000005ab8e000 CR4: 0000000000352ef0
DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000083
DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
cm109_submit_ctl drivers/input/misc/cm109.c:380 [inline]
cm109_urb_irq_callback+0x2ed/0xb80 drivers/input/misc/cm109.c:431
__usb_hcd_giveback_urb+0x38b/0x610 drivers/usb/core/hcd.c:1661
usb_hcd_giveback_urb+0x39b/0x450 drivers/usb/core/hcd.c:1745
dummy_timer+0x1809/0x3a00 drivers/usb/gadget/udc/dummy_hcd.c:1995
__run_hrtimer kernel/time/hrtimer.c:1777 [inline]
__hrtimer_run_queues+0x202/0xad0 kernel/time/hrtimer.c:1841
hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1858
handle_softirqs+0x219/0x8e0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1052
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:finish_task_switch.isra.0+0x22a/0xc10 kernel/sched/core.c:5193
Code: fb 09 00 00 44 8b 05 49 36 f8 0e 45 85 c0 0f 85 be 01 00 00 4c 89 e7 e8 a4 f6 ff ff e8 bf d3 3a 00 fb 65 48 8b 1d ee 99 17 12 <48> 8d bb 58 16 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1
RSP: 0018:ffffc900058078b0 EFLAGS: 00000202
RAX: 0000000000077aa1 RBX: ffff88804c412480 RCX: ffffffff81c4e8df
RDX: 0000000000000000 RSI: ffffffff8da2c97f RDI: ffffffff8bf073c0
RBP: ffffc900058078f8 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff90821bd7 R11: 0000000000000001 R12: ffff88806a43a380
R13: ffff888037410000 R14: ffff88806a43a380 R15: ffff88806a43b1b0
context_switch kernel/sched/core.c:5328 [inline]
__schedule+0x1198/0x5de0 kernel/sched/core.c:6929
__schedule_loop kernel/sched/core.c:7011 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:7026
futex_do_wait+0x88/0x180 kernel/futex/waitwake.c:358
__futex_wait+0x1b8/0x2f0 kernel/futex/waitwake.c:687
futex_wait+0xe8/0x380 kernel/futex/waitwake.c:715
do_futex+0x229/0x350 kernel/futex/syscalls.c:130
__do_sys_futex kernel/futex/syscalls.c:207 [inline]
__se_sys_futex kernel/futex/syscalls.c:188 [inline]
__x64_sys_futex+0x1e0/0x4c0 kernel/futex/syscalls.c:188
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3b54b8f7c9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3b55a090e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: ffffffffffffffda RBX: 00007f3b54de6098 RCX: 00007f3b54b8f7c9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f3b54de6098
RBP: 00007f3b54de6090 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3b54de6128 R14: 00007ffc4a970fd0 R15: 00007ffc4a9710b8
----------------
Code disassembly (best guess), 2 bytes skipped:
0: 00 00 add %al,(%rax)
2: 44 8b 05 49 36 f8 0e mov 0xef83649(%rip),%r8d # 0xef83652
9: 45 85 c0 test %r8d,%r8d
c: 0f 85 be 01 00 00 jne 0x1d0
12: 4c 89 e7 mov %r12,%rdi
15: e8 a4 f6 ff ff call 0xfffff6be
1a: e8 bf d3 3a 00 call 0x3ad3de
1f: fb sti
20: 65 48 8b 1d ee 99 17 mov %gs:0x121799ee(%rip),%rbx # 0x12179a16
27: 12
* 28: 48 8d bb 58 16 00 00 lea 0x1658(%rbx),%rdi <-- trapping instruction
2f: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
36: fc ff df
39: 48 89 fa mov %rdi,%rdx
3c: 48 rex.W
3d: c1 .byte 0xc1