cm109 10-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff8880611f7200 submitted while active
WARNING: drivers/usb/core/urb.c:380 at usb_submit_urb+0xf8c/0x18b0 drivers/usb/core/urb.c:380, CPU#0: syz-executor/23789
Modules linked in:
CPU: 0 UID: 0 PID: 23789 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:usb_submit_urb+0xf8c/0x18b0 drivers/usb/core/urb.c:380
Code: 00 00 00 e8 f6 fe c6 fa e9 25 f1 ff ff e8 ec fe c6 fa c6 05 d7 86 8f 08 01 90 48 c7 c7 e0 12 12 8c 48 89 de e8 d5 6c 8a fa 90 <0f> 0b 90 90 e9 ec f0 ff ff e8 c6 fe c6 fa c6 05 07 d2 a5 08 01 41
RSP: 0018:ffffc90000007878 EFLAGS: 00010046
RAX: 07bb836e000d3600 RBX: ffff8880611f7200 RCX: 0000000000040000
RDX: ffffc90002171000 RSI: 0000000000016039 RDI: 000000000001603a
RBP: 000000000000000f R08: ffff8880b8624293 R09: 1ffff110170c4852
R10: dffffc0000000000 R11: ffffed10170c4853 R12: 0000000000000820
R13: ffff88807398c030 R14: ffff8880611f7208 R15: dffffc0000000000
FS:  0000555584502500(0000) GS:ffff888125d18000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055558451d5c8 CR3: 00000000456fe000 CR4: 00000000003526f0
DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000083
DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 cm109_submit_ctl drivers/input/misc/cm109.c:380 [inline]
 cm109_urb_irq_callback+0x709/0xca0 drivers/input/misc/cm109.c:431
 __usb_hcd_giveback_urb+0x376/0x540 drivers/usb/core/hcd.c:1661
 dummy_timer+0x85f/0x44c0 drivers/usb/gadget/udc/dummy_hcd.c:1995
 __run_hrtimer kernel/time/hrtimer.c:1777 [inline]
 __hrtimer_run_queues+0x52c/0xc60 kernel/time/hrtimer.c:1841
 hrtimer_run_softirq+0x187/0x2b0 kernel/time/hrtimer.c:1858
 handle_softirqs+0x286/0x870 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1052
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:memset_orig+0x46/0xb0 arch/x86/lib/memset_64.S:74
Code: 75 74 48 89 d1 48 c1 e9 06 74 39 66 0f 1f 84 00 00 00 00 00 48 ff c9 48 89 07 48 89 47 08 48 89 47 10 48 89 47 18 48 89 47 20 <48> 89 47 28 48 89 47 30 48 89 47 38 48 8d 7f 40 75 d8 0f 1f 84 00
RSP: 0018:ffffc9000de3f990 EFLAGS: 00000206
RAX: 0000000000000000 RBX: ffff88801b728000 RCX: 0000000000000005
RDX: 0000000000001000 RSI: 0000000000000000 RDI: ffff88801b728e80
RBP: 0000000000000c40 R08: ffffffff8f9e6377 R09: 0000000000000000
R10: ffff88801b728000 R11: fffffbfff1f3cc6f R12: ffff88813fe27140
R13: 0000000000001000 R14: 0000000000001000 R15: 00000000008e5e00
 slab_post_alloc_hook mm/slub.c:4950 [inline]
 slab_alloc_node mm/slub.c:5246 [inline]
 __do_kmalloc_node mm/slub.c:5603 [inline]
 __kmalloc_noprof+0x3e7/0x7f0 mm/slub.c:5616
 kmalloc_noprof include/linux/slab.h:961 [inline]
 tomoyo_realpath_from_path+0xe3/0x5d0 security/tomoyo/realpath.c:251
 tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
 tomoyo_path_number_perm+0x1e8/0x5a0 security/tomoyo/file.c:723
 tomoyo_path_mkdir+0xa8/0xe0 security/tomoyo/tomoyo.c:179
 security_path_mkdir+0x171/0x380 security/security.c:1971
 do_mkdirat+0x1bd/0x590 fs/namei.c:4483
 __do_sys_mkdirat fs/namei.c:4503 [inline]
 __se_sys_mkdirat fs/namei.c:4501 [inline]
 __x64_sys_mkdirat+0x87/0xa0 fs/namei.c:4501
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ffb1338d617
Code: 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffda50e8228 EFLAGS: 00000206 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007ffda50e8280 RCX: 00007ffb1338d617
RDX: 00000000000001ff RSI: 00007ffda50e8280 RDI: 00000000ffffff9c
RBP: 00007ffda50e826c R08: 0000000000000005 R09: 00007ffda50e7fc5
R10: 0000000000000000 R11: 0000000000000206 R12: 00000000000000f7
R13: 0000000000000043 R14: 00000000000c7fad R15: 00007ffda50e82c0
 </TASK>
----------------
Code disassembly (best guess):
   0:	75 74                	jne    0x76
   2:	48 89 d1             	mov    %rdx,%rcx
   5:	48 c1 e9 06          	shr    $0x6,%rcx
   9:	74 39                	je     0x44
   b:	66 0f 1f 84 00 00 00 	nopw   0x0(%rax,%rax,1)
  12:	00 00
  14:	48 ff c9             	dec    %rcx
  17:	48 89 07             	mov    %rax,(%rdi)
  1a:	48 89 47 08          	mov    %rax,0x8(%rdi)
  1e:	48 89 47 10          	mov    %rax,0x10(%rdi)
  22:	48 89 47 18          	mov    %rax,0x18(%rdi)
  26:	48 89 47 20          	mov    %rax,0x20(%rdi)
* 2a:	48 89 47 28          	mov    %rax,0x28(%rdi) <-- trapping instruction
  2e:	48 89 47 30          	mov    %rax,0x30(%rdi)
  32:	48 89 47 38          	mov    %rax,0x38(%rdi)
  36:	48 8d 7f 40          	lea    0x40(%rdi),%rdi
  3a:	75 d8                	jne    0x14
  3c:	0f                   	.byte 0xf
  3d:	1f                   	(bad)
  3e:	84 00                	test   %al,(%rax)