cm109 4-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff88805bff8200 submitted while active
WARNING: CPU: 1 PID: 19963 at drivers/usb/core/urb.c:379 usb_submit_urb+0xff3/0x1890 drivers/usb/core/urb.c:379
Modules linked in:
CPU: 1 UID: 0 PID: 19963 Comm: syz.3.3677 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:usb_submit_urb+0xff3/0x1890 drivers/usb/core/urb.c:379
Code: 00 eb 5c e8 ff 58 a7 fa e9 be f0 ff ff e8 f5 58 a7 fa c6 05 1c e1 71 08 01 90 48 c7 c7 e0 5b 33 8c 48 89 de e8 7e 48 6b fa 90 <0f> 0b 90 90 e9 85 f0 ff ff e8 cf 58 a7 fa eb 11 e8 c8 58 a7 fa bd
RSP: 0018:ffffc90000a087b8 EFLAGS: 00010046
RAX: 75dcb60564720900 RBX: ffff88805bff8200 RCX: 0000000000040000
RDX: ffffc90002382000 RSI: 00000000000045d7 RDI: 00000000000045d8
RBP: 000000000000000f R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff1bfaa6c R12: 1ffff1100a4a0f0a
R13: dffffc0000000000 R14: ffff88805bff8208 R15: 0000000000000820
FS:  0000000000000000(0000) GS:ffff888125d57000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7c675b6980 CR3: 00000000529ee000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 cm109_submit_ctl drivers/input/misc/cm109.c:380 [inline]
 cm109_urb_irq_callback+0x718/0xc80 drivers/input/misc/cm109.c:431
 __usb_hcd_giveback_urb+0x417/0x690 drivers/usb/core/hcd.c:1650
 dummy_timer+0x862/0x4550 drivers/usb/gadget/udc/dummy_hcd.c:1995
 __run_hrtimer kernel/time/hrtimer.c:1761 [inline]
 __hrtimer_run_queues+0x52c/0xc60 kernel/time/hrtimer.c:1825
 hrtimer_run_softirq+0x187/0x2b0 kernel/time/hrtimer.c:1842
 handle_softirqs+0x283/0x870 kernel/softirq.c:579
 __do_softirq kernel/softirq.c:613 [inline]
 invoke_softirq kernel/softirq.c:453 [inline]
 __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1050
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xa8/0x110 kernel/locking/spinlock.c:194
Code: 74 05 e8 fb 9b 5e f6 48 c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f6 44 24 21 02 75 4f f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 <e8> 63 cc 27 f6 65 8b 05 1c 7a 33 07 85 c0 74 40 48 c7 04 24 0e 36
RSP: 0018:ffffc900042f76a0 EFLAGS: 00000206
RAX: 75dcb60564720900 RBX: 0000000000000a06 RCX: 75dcb60564720900
RDX: 0000000000000006 RSI: ffffffff8d982fba RDI: 0000000000000001
RBP: ffffc900042f7730 R08: ffffffff8fa0b3f7 R09: 1ffffffff1f4167e
R10: dffffc0000000000 R11: fffffbfff1f4167f R12: dffffc0000000000
R13: ffff88802696f300 R14: ffffffff8edcda60 R15: 1ffff9200085eed4
 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
 usb_hcd_poll_rh_status+0x406/0x620 drivers/usb/core/hcd.c:762
 dummy_pullup+0x19b/0x200 drivers/usb/gadget/udc/dummy_hcd.c:928
 usb_gadget_disconnect_locked+0x140/0x4b0 drivers/usb/gadget/udc/core.c:777
 gadget_unbind_driver+0xc4/0x430 drivers/usb/gadget/udc/core.c:1666
 device_remove drivers/base/dd.c:567 [inline]
 __device_release_driver drivers/base/dd.c:1272 [inline]
 device_release_driver_internal+0x46f/0x7c0 drivers/base/dd.c:1295
 driver_detach+0x1f3/0x2d0 drivers/base/dd.c:1358
 bus_remove_driver+0x226/0x2f0 drivers/base/bus.c:747
 usb_gadget_unregister_driver+0x4e/0x70 drivers/usb/gadget/udc/core.c:1732
 raw_release+0xd7/0x260 drivers/usb/gadget/legacy/raw_gadget.c:462
 __fput+0x449/0xa70 fs/file_table.c:465
 task_work_run+0x1d1/0x260 kernel/task_work.c:227
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0x6b5/0x22e0 kernel/exit.c:964
 do_group_exit+0x21c/0x2d0 kernel/exit.c:1105
 get_signal+0x125e/0x1310 kernel/signal.c:3034
 arch_do_signal_or_restart+0x9a/0x750 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline]
 irqentry_exit_to_user_mode+0x81/0x120 kernel/entry/common.c:184
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0033:0x7f2d57468035
Code: Unable to access opcode bytes at 0x7f2d5746800b.
RSP: 002b:00007ffcbe5fea90 EFLAGS: 00000297
RAX: 00007f2d5608db58 RBX: 00007f2d5600bf30 RCX: ffffffff82047e0f
RDX: ffffffff81b92f75 RSI: ffffffff818fa9cd RDI: 00007f2d560d3220
RBP: 00007f2d55ff9010 R08: 00007f2d56066110 R09: 00007f2d577a2000
R10: 00007f2d55ff9008 R11: 00000000000000ff R12: 00007f2d55ff9008
R13: 0000000000000022 R14: 00007ffcbe5feb98 R15: 00007f2d55ff9008
 </TASK>
----------------
Code disassembly (best guess):
   0:	74 05                	je     0x7
   2:	e8 fb 9b 5e f6       	call   0xf65e9c02
   7:	48 c7 44 24 20 00 00 	movq   $0x0,0x20(%rsp)
   e:	00 00
  10:	9c                   	pushf
  11:	8f 44 24 20          	pop    0x20(%rsp)
  15:	f6 44 24 21 02       	testb  $0x2,0x21(%rsp)
  1a:	75 4f                	jne    0x6b
  1c:	f7 c3 00 02 00 00    	test   $0x200,%ebx
  22:	74 01                	je     0x25
  24:	fb                   	sti
  25:	bf 01 00 00 00       	mov    $0x1,%edi
* 2a:	e8 63 cc 27 f6       	call   0xf627cc92 <-- trapping instruction
  2f:	65 8b 05 1c 7a 33 07 	mov    %gs:0x7337a1c(%rip),%eax        # 0x7337a52
  36:	85 c0                	test   %eax,%eax
  38:	74 40                	je     0x7a
  3a:	48                   	rex.W
  3b:	c7                   	.byte 0xc7
  3c:	04 24                	add    $0x24,%al
  3e:	0e                   	(bad)
  3f:	36                   	ss