cm109 6-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff88807969a700 submitted while active
WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x79/0x18b0 drivers/usb/core/urb.c:379, CPU#0: syz.4.4145/15802
Modules linked in:
CPU: 0 UID: 0 PID: 15802 Comm: syz.4.4145 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
RIP: 0010:usb_submit_urb+0x7c/0x18b0 drivers/usb/core/urb.c:379
Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 69 18 ef fa 49 83 3e 00 74 40 e8 4e 97 81 fa 48 8d 3d a7 ca fa 08 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 33 97 81 fa eb 05 e8 2c 97
RSP: 0018:ffffc90000007a18 EFLAGS: 00010083
RAX: ffffffff87449d62 RBX: ffff88807969a700 RCX: 0000000000040000
RDX: ffffc90002081000 RSI: ffff88807969a700 RDI: ffffffff903f6810
RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52000000f40 R12: ffff8880297c2848
R13: ffff8880297c2830 R14: ffff88807969a708 R15: 0000000000000820
FS: 0000000000000000(0000) GS:ffff888125253000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000002020 CR3: 000000005a4cb000 CR4: 0000000000350ef0
Call Trace:
cm109_submit_ctl drivers/input/misc/cm109.c:380 [inline]
cm109_urb_irq_callback+0x6fb/0xca0 drivers/input/misc/cm109.c:431
__usb_hcd_giveback_urb+0x374/0x530 drivers/usb/core/hcd.c:1655
dummy_timer+0xac3/0x4b40 drivers/usb/gadget/udc/dummy_hcd.c:2005
__run_hrtimer kernel/time/hrtimer.c:2032 [inline]
__hrtimer_run_queues+0x3bc/0xa10 kernel/time/hrtimer.c:2096
hrtimer_run_softirq+0x17a/0x240 kernel/time/hrtimer.c:2113
handle_softirqs+0x225/0x840 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0xca/0x220 kernel/softirq.c:735
irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:get_current arch/x86/include/asm/current.h:25 [inline]
RIP: 0010:write_comp_data kernel/kcov.c:245 [inline]
RIP: 0010:__sanitizer_cov_trace_const_cmp1+0x8/0x90 kernel/kcov.c:300
Code: e9 78 09 4a ff cc 66 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 8b 04 24 <65> 48 8b 15 48 98 76 11 65 8b 0d 69 98 76 11 81 e1 00 01 ff 00 74
RSP: 0018:ffffc900061d7098 EFLAGS: 00000293
RAX: ffffffff822ab588 RBX: 0000000000000180 RCX: ffff888032090000
RDX: 0000000000000000 RSI: 000000000000000c RDI: 000000000000001f
RBP: ffffc900061d7328 R08: ffffea0001666207 R09: 1ffffd40002ccc40
R10: dffffc0000000000 R11: fffff940002ccc41 R12: 000000000000000d
R13: dffffc0000000000 R14: ffffea0001666200 R15: 000000000000000c
folio_batch_add include/linux/folio_batch.h:77 [inline]
free_pages_and_swap_cache+0x258/0x490 mm/swap_state.c:585
__tlb_batch_free_encoded_pages mm/mmu_gather.c:138 [inline]
tlb_batch_pages_flush mm/mmu_gather.c:151 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:417 [inline]
tlb_flush_mmu+0x6d3/0xa30 mm/mmu_gather.c:424
zap_pte_range mm/memory.c:1973 [inline]
zap_pmd_range mm/memory.c:2020 [inline]
zap_pud_range mm/memory.c:2048 [inline]
zap_p4d_range mm/memory.c:2069 [inline]
__zap_vma_range+0x4130/0x4f10 mm/memory.c:2109
unmap_vmas+0x390/0x550 mm/memory.c:2178
exit_mmap+0x293/0x9f0 mm/mmap.c:1300
__mmput+0x118/0x420 kernel/fork.c:1182
exit_mm+0x221/0x2d0 kernel/exit.c:610
do_exit+0x6cd/0x2360 kernel/exit.c:992
do_group_exit+0x22d/0x2f0 kernel/exit.c:1147
get_signal+0x121b/0x12c0 kernel/signal.c:3038
arch_do_signal_or_restart+0xbb/0x860 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
exit_to_user_mode_loop+0x104/0x730 kernel/entry/common.c:101
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
do_syscall_64+0x353/0x580 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd51e99ce59
Code: Unable to access opcode bytes at 0x7fd51e99ce2f.
RSP: 002b:00007fd51f8a70e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000001 RBX: 00007fd51ec15fa8 RCX: 00007fd51e99ce59
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fd51ec15fac
RBP: 00007fd51ec15fa0 R08: 3fffffffffffffff R09: 0000000000000000
R10: 000000000000003c R11: 0000000000000246 R12: 0000000000000000
R13: 00007fd51ec16038 R14: 00007fff90173000 R15: 00007fff901730e8
----------------
Code disassembly (best guess):
0: 4c 89 f0 mov %r14,%rax
3: 48 c1 e8 03 shr $0x3,%rax
7: 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1)
b: 74 08 je 0x15
d: 4c 89 f7 mov %r14,%rdi
10: e8 69 18 ef fa call 0xfaef187e
15: 49 83 3e 00 cmpq $0x0,(%r14)
19: 74 40 je 0x5b
1b: e8 4e 97 81 fa call 0xfa81976e
20: 48 8d 3d a7 ca fa 08 lea 0x8facaa7(%rip),%rdi # 0x8facace
27: 48 89 de mov %rbx,%rsi
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: b8 f0 ff ff ff mov $0xfffffff0,%eax
34: eb 11 jmp 0x47
36: e8 33 97 81 fa call 0xfa81976e
3b: eb 05 jmp 0x42
3d: e8 .byte 0xe8
3e: 2c 97 sub $0x97,%al