cm109 5-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff8880736dce00 submitted while active
WARNING: CPU: 0 PID: 5217 at drivers/usb/core/urb.c:379 usb_submit_urb+0x1519/0x1770 drivers/usb/core/urb.c:379
Modules linked in:
CPU: 0 UID: 0 PID: 5217 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:usb_submit_urb+0x1519/0x1770 drivers/usb/core/urb.c:379
Code: fd eb cb bb fe ff ff ff e9 96 f3 ff ff e8 0f 86 7a fa c6 05 bd 9a 52 09 01 90 48 c7 c7 60 02 74 8c 48 89 de e8 c8 2b 39 fa 90 <0f> 0b 90 90 e9 ac fe ff ff bb f8 ff ff ff e9 66 f3 ff ff 48 89 ef
RSP: 0018:ffffc90000007a80 EFLAGS: 00010086
RAX: 0000000000000000 RBX: ffff8880736dce00 RCX: ffffc90002131000
RDX: 0000000000040000 RSI: ffffffff817a3365 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
R13: ffff888054386857 R14: ffff888029edda00 R15: 000000000000000f
FS:  00007fe70b571880(0000) GS:ffff8881246bc000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffcd246ecc8 CR3: 0000000021a9a000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 cm109_submit_ctl drivers/input/misc/cm109.c:380 [inline]
 cm109_urb_irq_callback+0x2ed/0xb80 drivers/input/misc/cm109.c:431
 __usb_hcd_giveback_urb+0x38d/0x6e0 drivers/usb/core/hcd.c:1663
 usb_hcd_giveback_urb+0x39b/0x450 drivers/usb/core/hcd.c:1747
 dummy_timer+0x1814/0x3a30 drivers/usb/gadget/udc/dummy_hcd.c:1995
 __run_hrtimer kernel/time/hrtimer.c:1761 [inline]
 __hrtimer_run_queues+0x1ff/0xad0 kernel/time/hrtimer.c:1825
 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1842
 handle_softirqs+0x216/0x8e0 kernel/softirq.c:579
 __do_softirq kernel/softirq.c:613 [inline]
 invoke_softirq kernel/softirq.c:453 [inline]
 __irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1050
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:is_bpf_text_address+0x5/0x1a0 kernel/bpf/core.c:773
Code: e9 14 fe ff ff 4c 89 ef e8 78 44 55 00 e9 37 fe ff ff 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 55 <48> 89 fd 53 e8 92 ec ee ff e8 cd fd d3 ff 45 31 c9 45 31 c0 b9 02
RSP: 0018:ffffc90003bf7678 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 00007fe70af15c3a RCX: 0000000000000002
RDX: 0000000000000000 RSI: ffffffff8c162880 RDI: 00007fe70af15c3a
RBP: ffffc90003bf7710 R08: 0000000000000000 R09: 0000000000000000
R10: 00007fe70af15000 R11: 0000000000000001 R12: ffffffff81a6db80
R13: ffffc90003bf7788 R14: 0000000000000000 R15: ffff888078b74880
 kernel_text_address kernel/extable.c:125 [inline]
 kernel_text_address+0x8d/0x100 kernel/extable.c:94
 __kernel_text_address+0xd/0x40 kernel/extable.c:79
 unwind_get_return_address+0x59/0xa0 arch/x86/kernel/unwind_orc.c:369
 arch_stack_walk+0xa6/0x100 arch/x86/kernel/stacktrace.c:26
 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 unpoison_slab_object mm/kasan/common.c:330 [inline]
 __kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:356
 kasan_slab_alloc include/linux/kasan.h:250 [inline]
 slab_post_alloc_hook mm/slub.c:4180 [inline]
 slab_alloc_node mm/slub.c:4229 [inline]
 kmem_cache_alloc_noprof+0x1cb/0x3b0 mm/slub.c:4236
 alloc_empty_file+0x55/0x1e0 fs/file_table.c:237
 path_openat+0xda/0x2cb0 fs/namei.c:4032
 do_filp_open+0x20b/0x470 fs/namei.c:4073
 do_sys_openat2+0x11b/0x1d0 fs/open.c:1435
 do_sys_open fs/open.c:1450 [inline]
 __do_sys_openat fs/open.c:1466 [inline]
 __se_sys_openat fs/open.c:1461 [inline]
 __x64_sys_openat+0x174/0x210 fs/open.c:1461
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe70af15c3a
Code: 41 89 f2 48 89 54 24 e0 41 83 e2 40 75 2a 89 f0 f7 d0 a9 00 00 41 00 74 1f 89 f2 b8 01 01 00 00 48 89 fe bf 9c ff ff ff 0f 05 <48> 3d 00 f0 ff ff 77 2e c3 0f 1f 44 00 00 48 8d 44 24 08 c7 44 24
RSP: 002b:00007fffa295dc18 EFLAGS: 00000206 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00005605ff2fe8d0 RCX: 00007fe70af15c3a
RDX: 0000000000090800 RSI: 00005605ff2bd9c0 RDI: 00000000ffffff9c
RBP: 00005605ff2bd9c0 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000206 R12: 00005605ff2cd170
R13: 00000000000000ff R14: 00005605d44babe0 R15: 00007fffa295dea0
 </TASK>
----------------
Code disassembly (best guess):
   0:	e9 14 fe ff ff       	jmp    0xfffffe19
   5:	4c 89 ef             	mov    %r13,%rdi
   8:	e8 78 44 55 00       	call   0x554485
   d:	e9 37 fe ff ff       	jmp    0xfffffe49
  12:	0f 1f 00             	nopl   (%rax)
  15:	90                   	nop
  16:	90                   	nop
  17:	90                   	nop
  18:	90                   	nop
  19:	90                   	nop
  1a:	90                   	nop
  1b:	90                   	nop
  1c:	90                   	nop
  1d:	90                   	nop
  1e:	90                   	nop
  1f:	90                   	nop
  20:	90                   	nop
  21:	90                   	nop
  22:	90                   	nop
  23:	90                   	nop
  24:	90                   	nop
  25:	66 0f 1f 00          	nopw   (%rax)
  29:	55                   	push   %rbp
* 2a:	48 89 fd             	mov    %rdi,%rbp <-- trapping instruction
  2d:	53                   	push   %rbx
  2e:	e8 92 ec ee ff       	call   0xffeeecc5
  33:	e8 cd fd d3 ff       	call   0xffd3fe05
  38:	45 31 c9             	xor    %r9d,%r9d
  3b:	45 31 c0             	xor    %r8d,%r8d
  3e:	b9                   	.byte 0xb9
  3f:	02                   	.byte 0x2