cm109 7-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff8880591ffe00 submitted while active
WARNING: CPU: 0 PID: 12690 at drivers/usb/core/urb.c:379 usb_submit_urb+0x104a/0x1970 drivers/usb/core/urb.c:379
Modules linked in:
CPU: 0 PID: 12690 Comm: modprobe Not tainted 6.1.141-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:usb_submit_urb+0x104a/0x1970 drivers/usb/core/urb.c:379
Code: cc 6a fb eb 52 e8 f6 cc 6a fb e9 61 f0 ff ff e8 ec cc 6a fb c6 05 af 23 d4 07 01 48 c7 c7 60 48 0e 8b 48 89 de e8 86 df 36 fb <0f> 0b e9 2c f0 ff ff e8 ca cc 6a fb eb 1f e8 c3 cc 6a fb 4c 8b 74
RSP: 0018:ffffc90000007808 EFLAGS: 00010046
RAX: 83c0c1dcd58e0e00 RBX: ffff8880591ffe00 RCX: 0000000000040000
RDX: ffffc90002141000 RSI: 000000000001be3d RDI: 000000000001be3e
RBP: 000000000000000f R08: dffffc0000000000 R09: ffffed10171c4f34
R10: ffffed10171c4f34 R11: 1ffff110171c4f33 R12: 0000000000000a20
R13: dffffc0000000000 R14: ffff8880591ffe08 R15: ffff88802fa1e048
FS:  0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f38b7fdd000 CR3: 0000000067581000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 cm109_urb_irq_callback+0x728/0xc90 drivers/input/misc/cm109.c:422
 __usb_hcd_giveback_urb+0x35f/0x520 drivers/usb/core/hcd.c:1675
 dummy_timer+0x888/0x31b0 drivers/usb/gadget/udc/dummy_hcd.c:1994
 __run_hrtimer kernel/time/hrtimer.c:1752 [inline]
 __hrtimer_run_queues+0x554/0xd60 kernel/time/hrtimer.c:1816
 hrtimer_run_softirq+0x183/0x2a0 kernel/time/hrtimer.c:1833
 handle_softirqs+0x2a1/0x920 kernel/softirq.c:596
 __do_softirq kernel/softirq.c:630 [inline]
 invoke_softirq kernel/softirq.c:470 [inline]
 __irq_exit_rcu+0x12f/0x220 kernel/softirq.c:679
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:_compound_head include/linux/page-flags.h:255 [inline]
RIP: 0010:virt_to_folio include/linux/mm.h:904 [inline]
RIP: 0010:virt_to_slab mm/slab.h:175 [inline]
RIP: 0010:____kasan_slab_free+0x5d/0x1e0 mm/kasan/common.c:214
Code: 48 89 f3 49 89 fe 45 89 c4 89 cd 48 89 f7 e8 9a 1b 67 ff 48 c1 e8 06 48 83 e0 c0 48 ba 00 00 00 00 00 ea ff ff 48 8b 4c 10 08 <f6> c1 01 0f 85 66 01 00 00 48 01 d0 0f 1f 44 00 00 48 8b 48 08 f6
RSP: 0018:ffffc900033e7288 EFLAGS: 00000206
RAX: 0000000001766cc0 RBX: ffff88805d9b3c00 RCX: ffffea0001766c81
RDX: ffffea0000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000001 R08: 0000000000000000 R09: fffffbfff211704f
R10: fffffbfff211704f R11: 1ffffffff211704e R12: 0000000000000000
R13: ffffc900033e7350 R14: ffff8880174c5000 R15: ffffffff81d18d78
 kasan_slab_free include/linux/kasan.h:177 [inline]
 slab_free_hook mm/slub.c:1724 [inline]
 slab_free_freelist_hook+0x131/0x1a0 mm/slub.c:1750
 slab_free mm/slub.c:3661 [inline]
 kmem_cache_free_bulk+0x348/0x460 mm/slub.c:3779
 mt_free_bulk lib/maple_tree.c:162 [inline]
 mas_destroy+0x2489/0x2c60 lib/maple_tree.c:5859
 mas_store_prealloc+0x31a/0x400 lib/maple_tree.c:5789
 do_mas_align_munmap+0xb43/0x1220 mm/mmap.c:2562
 do_mas_munmap+0x240/0x2b0 mm/mmap.c:2638
 __mmap_region mm/mmap.c:2686 [inline]
 mmap_region+0x713/0x1d30 mm/mmap.c:2904
 do_mmap+0x894/0xf30 mm/mmap.c:1424
 vm_mmap_pgoff+0x1b2/0x2b0 mm/util.c:520
 ksys_mmap_pgoff+0x516/0x6f0 mm/mmap.c:1470
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f38b82fe242
Code: 08 00 04 00 00 eb e2 90 41 f7 c1 ff 0f 00 00 75 27 55 89 cd 53 48 89 fb 48 85 ff 74 33 41 89 ea 48 89 df b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 5e 5b 5d c3 0f 1f 00 c7 05 46 40 01 00 16 00
RSP: 002b:00007ffd7d231ca8 EFLAGS: 00000206 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007f38b7fd8000 RCX: 00007f38b82fe242
RDX: 0000000000000001 RSI: 0000000000002000 RDI: 00007f38b7fd8000
RBP: 0000000000000812 R08: 0000000000000000 R09: 0000000000005000
R10: 0000000000000812 R11: 0000000000000206 R12: 00007ffd7d231d30
R13: 00007f38b7fdd0c0 R14: 00007ffd7d2320e0 R15: 00000fffafa46398
 </TASK>
----------------
Code disassembly (best guess):
   0:	48 89 f3             	mov    %rsi,%rbx
   3:	49 89 fe             	mov    %rdi,%r14
   6:	45 89 c4             	mov    %r8d,%r12d
   9:	89 cd                	mov    %ecx,%ebp
   b:	48 89 f7             	mov    %rsi,%rdi
   e:	e8 9a 1b 67 ff       	call   0xff671bad
  13:	48 c1 e8 06          	shr    $0x6,%rax
  17:	48 83 e0 c0          	and    $0xffffffffffffffc0,%rax
  1b:	48 ba 00 00 00 00 00 	movabs $0xffffea0000000000,%rdx
  22:	ea ff ff
  25:	48 8b 4c 10 08       	mov    0x8(%rax,%rdx,1),%rcx
* 2a:	f6 c1 01             	test   $0x1,%cl <-- trapping instruction
  2d:	0f 85 66 01 00 00    	jne    0x199
  33:	48 01 d0             	add    %rdx,%rax
  36:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
  3b:	48 8b 48 08          	mov    0x8(%rax),%rcx
  3f:	f6                   	.byte 0xf6