------------[ cut here ]------------
WARNING: CPU: 0 PID: 16 at kernel/kcov.c:870 kcov_remote_start+0x5a2/0x7e0 kernel/kcov.c:870
Modules linked in:
CPU: 0 PID: 16 Comm: ksoftirqd/0 Tainted: G        W          6.10.0-rc2-next-20240604-syzkaller #0
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
RIP: 0010:kcov_remote_start+0x5a2/0x7e0 kernel/kcov.c:870
Code: 24 00 00 00 00 9c 8f 04 24 f7 04 24 00 02 00 00 0f 85 a6 01 00 00 41 f7 c6 00 02 00 00 0f 84 93 fa ff ff fb e9 8d fa ff ff 90 <0f> 0b 90 e8 b6 7d f6 09 89 c0 48 c7 c7 c8 d4 02 00 48 03 3c c5 20
RSP: 0018:ffffc900000079c0 EFLAGS: 00010002
RAX: 0000000080010101 RBX: ffff8880172cda00 RCX: 0000000000000002
RDX: dffffc0000000000 RSI: ffffffff8bcad060 RDI: ffffffff8c2005c0
RBP: 0100000000000003 R08: ffffffff92fc2737 R09: 1ffffffff25f84e6
R10: dffffc0000000000 R11: fffffbfff25f84e7 R12: ffffffff819694ae
R13: 00000000ffffffb9 R14: 0000000000000006 R15: ffff8880b942d4c8
FS:  0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b32e24000 CR3: 000000002bc98000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 kcov_remote_start_usb include/linux/kcov.h:53 [inline]
 kcov_remote_start_usb_softirq include/linux/kcov.h:66 [inline]
 __usb_hcd_giveback_urb+0x34a/0x530 drivers/usb/core/hcd.c:1647
 dummy_timer+0x830/0x45d0 drivers/usb/gadget/udc/dummy_hcd.c:1987
 __run_hrtimer kernel/time/hrtimer.c:1687 [inline]
 __hrtimer_run_queues+0x59b/0xd50 kernel/time/hrtimer.c:1751
 hrtimer_interrupt+0x396/0x990 kernel/time/hrtimer.c:1813
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline]
 __sysvec_apic_timer_interrupt+0x110/0x3f0 arch/x86/kernel/apic/apic.c:1049
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1043
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xd8/0x140 kernel/locking/spinlock.c:194
Code: 9c 8f 44 24 20 42 80 3c 23 00 74 08 4c 89 f7 e8 ce a1 64 f6 f6 44 24 21 02 75 52 41 f7 c7 00 02 00 00 74 01 fb bf 01 00 00 00 <e8> 33 e5 cd f5 65 8b 05 d4 fc 6b 74 85 c0 74 43 48 c7 04 24 0e 36
RSP: 0018:ffffc900001577e0 EFLAGS: 00000206
RAX: 26540e7ed7580a00 RBX: 1ffff9200002af00 RCX: ffffffff8172f95a
RDX: dffffc0000000000 RSI: ffffffff8bcabee0 RDI: 0000000000000001
RBP: ffffc90000157880 R08: ffffffff92fc2737 R09: 1ffffffff25f84e6
R10: dffffc0000000000 R11: fffffbfff25f84e7 R12: dffffc0000000000
R13: 1ffff9200002aefc R14: ffffc90000157800 R15: 0000000000000246
 __usb_hcd_giveback_urb+0x373/0x530 drivers/usb/core/hcd.c:1648
 usb_giveback_urb_bh+0x306/0x4e0 drivers/usb/core/hcd.c:1682
 process_one_work kernel/workqueue.c:3248 [inline]
 process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3329
 bh_worker+0x2a5/0x620 kernel/workqueue.c:3588
 tasklet_hi_action+0xf/0x90 kernel/softirq.c:816
 handle_softirqs+0x2c4/0x970 kernel/softirq.c:554
 run_ksoftirqd+0xca/0x130 kernel/softirq.c:928
 smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
----------------
Code disassembly (best guess):
   0:	9c                   	pushf
   1:	8f 44 24 20          	pop    0x20(%rsp)
   5:	42 80 3c 23 00       	cmpb   $0x0,(%rbx,%r12,1)
   a:	74 08                	je     0x14
   c:	4c 89 f7             	mov    %r14,%rdi
   f:	e8 ce a1 64 f6       	call   0xf664a1e2
  14:	f6 44 24 21 02       	testb  $0x2,0x21(%rsp)
  19:	75 52                	jne    0x6d
  1b:	41 f7 c7 00 02 00 00 	test   $0x200,%r15d
  22:	74 01                	je     0x25
  24:	fb                   	sti
  25:	bf 01 00 00 00       	mov    $0x1,%edi
* 2a:	e8 33 e5 cd f5       	call   0xf5cde562 <-- trapping instruction
  2f:	65 8b 05 d4 fc 6b 74 	mov    %gs:0x746bfcd4(%rip),%eax        # 0x746bfd0a
  36:	85 c0                	test   %eax,%eax
  38:	74 43                	je     0x7d
  3a:	48                   	rex.W
  3b:	c7                   	.byte 0xc7
  3c:	04 24                	add    $0x24,%al
  3e:	0e                   	(bad)
  3f:	36                   	ss