syzbot

cm109 1-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff8881437c1c00 submitted while active
WARNING: CPU: 1 PID: 0 at drivers/usb/core/urb.c:379 usb_submit_urb+0xf35/0x17d0 drivers/usb/core/urb.c:379
Modules linked in:
CPU: 1 PID: 0 Comm: swapper/1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:usb_submit_urb+0xf35/0x17d0 drivers/usb/core/urb.c:379
Code: 4a 8b 44 89 fa e8 bb b8 17 04 e9 28 fc ff ff e8 a1 11 36 fb c6 05 b8 b3 e5 07 01 48 c7 c7 c0 c1 4a 8b 48 89 de e8 ab 92 00 fb <0f> 0b e9 45 f1 ff ff e8 7f 11 36 fb eb 11 e8 78 11 36 fb bd 80 00
RSP: 0018:ffffc900001f0868 EFLAGS: 00010046
RAX: 0237c92c0112c500 RBX: ffff8881437c1c00 RCX: ffff88801ba63c00
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002
RBP: 000000000000000f R08: ffff8880b8f28c13 R09: 1ffff110171e5182
R10: dffffc0000000000 R11: ffffed10171e5183 R12: dffffc0000000000
R13: ffff88802c803030 R14: ffff8881437c1c08 R15: 0000000000000820
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d563fff CR3: 000000002e125000 CR4: 00000000003506e0
Call Trace:
 <IRQ>
 cm109_urb_irq_callback+0x72c/0xc90 drivers/input/misc/cm109.c:422
 __usb_hcd_giveback_urb+0x35f/0x520 drivers/usb/core/hcd.c:1650
 dummy_timer+0x8a3/0x31b0 drivers/usb/gadget/udc/dummy_hcd.c:1993
 __run_hrtimer kernel/time/hrtimer.c:1750 [inline]
 __hrtimer_run_queues+0x51e/0xc40 kernel/time/hrtimer.c:1814
 hrtimer_run_softirq+0x187/0x2b0 kernel/time/hrtimer.c:1831
 handle_softirqs+0x280/0x820 kernel/softirq.c:578
 __do_softirq kernel/softirq.c:612 [inline]
 invoke_softirq kernel/softirq.c:452 [inline]
 __irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:pv_native_safe_halt+0x13/0x20 arch/x86/kernel/paravirt.c:148
Code: cc cc cc cc cc cc cc f3 0f 1e fa 0f 0b 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 66 90 0f 00 2d 93 d8 39 00 f3 0f 1e fa fb f4 <c3> cc cc cc cc cc cc cc cc cc cc cc cc 66 0f 1f 00 55 41 57 41 56
RSP: 0018:ffffc90000187de0 EFLAGS: 000002c6
RAX: 0237c92c0112c500 RBX: ffffffff8161858b RCX: 0237c92c0112c500
RDX: 0000000000000001 RSI: ffffffff8aaabce0 RDI: ffffffff8afc63c0
RBP: ffffc90000187f20 R08: ffff8880b8f36b2b R09: 1ffff110171e6d65
R10: dffffc0000000000 R11: ffffed10171e6d66 R12: ffffffff8e4a8368
R13: 0000000000000001 R14: 0000000000000001 R15: 1ffff1100374c780
 arch_safe_halt arch/x86/include/asm/paravirt.h:108 [inline]
 default_idle+0x13/0x20 arch/x86/kernel/process.c:753
 default_idle_call+0x6c/0xa0 kernel/sched/idle.c:97
 cpuidle_idle_call kernel/sched/idle.c:170 [inline]
 do_idle+0x1eb/0x510 kernel/sched/idle.c:282
 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:380
 start_secondary+0xee/0xf0 arch/x86/kernel/smpboot.c:323
 secondary_startup_64_no_verify+0x179/0x17b
 </TASK>
----------------
Code disassembly (best guess):
   0:	cc                   	int3
   1:	cc                   	int3
   2:	cc                   	int3
   3:	cc                   	int3
   4:	cc                   	int3
   5:	cc                   	int3
   6:	cc                   	int3
   7:	f3 0f 1e fa          	endbr64
   b:	0f 0b                	ud2
   d:	66 2e 0f 1f 84 00 00 	cs nopw 0x0(%rax,%rax,1)
  14:	00 00 00
  17:	f3 0f 1e fa          	endbr64
  1b:	66 90                	xchg   %ax,%ax
  1d:	0f 00 2d 93 d8 39 00 	verw   0x39d893(%rip)        # 0x39d8b7
  24:	f3 0f 1e fa          	endbr64
  28:	fb                   	sti
  29:	f4                   	hlt
* 2a:	c3                   	ret <-- trapping instruction
  2b:	cc                   	int3
  2c:	cc                   	int3
  2d:	cc                   	int3
  2e:	cc                   	int3
  2f:	cc                   	int3
  30:	cc                   	int3
  31:	cc                   	int3
  32:	cc                   	int3
  33:	cc                   	int3
  34:	cc                   	int3
  35:	cc                   	int3
  36:	cc                   	int3
  37:	66 0f 1f 00          	nopw   (%rax)
  3b:	55                   	push   %rbp
  3c:	41 57                	push   %r15
  3e:	41 56                	push   %r14