cm109 3-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff888033616400 submitted while active
WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x15fa/0x1910 drivers/usb/core/urb.c:379, CPU#1: vhost-8414/8416
Modules linked in:
CPU: 1 UID: 0 PID: 8416 Comm: vhost-8414 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
RIP: 0010:usb_submit_urb+0x15fd/0x1910 drivers/usb/core/urb.c:379
Code: 00 48 8b 04 24 48 8b 90 b0 00 00 00 e9 73 ff ff ff bb ed ff ff ff e9 be f2 ff ff e8 cd 2b b7 fa 48 8d 3d f6 ca 94 09 48 89 de <67> 48 0f b9 3a bb f0 ff ff ff e9 a0 f2 ff ff c7 44 24 30 00 00 00
RSP: 0018:ffffc90000a08ab0 EFLAGS: 00010083
RAX: 0000000000003a4c RBX: ffff888033616400 RCX: ffffc90002342000
RDX: 0000000000040000 RSI: ffff888033616400 RDI: ffffffff90e696d0
RBP: ffff88801bb04058 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88801bb04057 R14: ffff88807a8cd9a0 R15: 000000000000000f
FS:  00007fc7558c66c0(0000) GS:ffff888124438000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000020000022a030 CR3: 0000000058b33000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 cm109_submit_ctl drivers/input/misc/cm109.c:380 [inline]
 cm109_urb_irq_callback+0x479/0xa90 drivers/input/misc/cm109.c:431
 __usb_hcd_giveback_urb+0x38d/0x610 drivers/usb/core/hcd.c:1657
 usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
 dummy_timer+0xda1/0x36c0 drivers/usb/gadget/udc/dummy_hcd.c:2005
 __run_hrtimer kernel/time/hrtimer.c:1785 [inline]
 __hrtimer_run_queues+0x50e/0xa70 kernel/time/hrtimer.c:1849
 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1866
 handle_softirqs+0x1eb/0x9e0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xef/0x150 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1056
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:lock_acquire+0x5e/0x380 kernel/locking/lockdep.c:5872
Code: 05 7b 7b 29 12 83 f8 07 0f 87 f0 00 00 00 48 0f a3 05 46 d6 f4 0e 0f 82 c2 02 00 00 8b 35 2e 0a f5 0e 85 f6 0f 85 dd 00 00 00 <48> 8b 44 24 30 65 48 2b 05 1d 7b 29 12 0f 85 02 03 00 00 48 83 c4
RSP: 0018:ffffc9001bb8f3b0 EFLAGS: 00000206
RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000002
RDX: 0000000000000000 RSI: ffffffff8de5506b RDI: ffffffff8c1b1ea0
RBP: ffffffff8e7e7920 R08: 00000000f12aaf06 R09: 0000000000000007
R10: 0000000000000200 R11: 0000000000000000 R12: 0000000000000002
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 rcu_read_lock include/linux/rcupdate.h:850 [inline]
 mt_find+0x14a/0x8e0 lib/maple_tree.c:6495
 find_vma+0xbf/0x140 mm/mmap.c:907
 gup_vma_lookup+0x20/0x170 mm/gup.c:1275
 __get_user_pages+0x241/0x34d0 mm/gup.c:1396
 __get_user_pages_locked mm/gup.c:1692 [inline]
 __gup_longterm_locked+0x87d/0x16f0 mm/gup.c:2476
 gup_fast_fallback+0x18c6/0x2460 mm/gup.c:3209
 pin_user_pages_fast+0xa7/0xf0 mm/gup.c:3315
 set_bit_to_user drivers/vhost/vhost.c:2420 [inline]
 log_write+0x25b/0x320 drivers/vhost/vhost.c:2446
 log_used.isra.0+0x175/0x1e0 drivers/vhost/vhost.c:2502
 vhost_update_used_flags+0x32a/0x400 drivers/vhost/vhost.c:2577
 vhost_disable_notify+0xbe/0x1b0 drivers/vhost/vhost.c:3258
 vhost_vsock_handle_tx_kick+0x18e/0xdc0 drivers/vhost/vsock.c:513
 vhost_run_work_list+0x183/0x220 drivers/vhost/vhost.c:454
 vhost_task_fn+0x156/0x430 kernel/vhost_task.c:49
 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
----------------
Code disassembly (best guess):
   0:	00 48 8b             	add    %cl,-0x75(%rax)
   3:	04 24                	add    $0x24,%al
   5:	48 8b 90 b0 00 00 00 	mov    0xb0(%rax),%rdx
   c:	e9 73 ff ff ff       	jmp    0xffffff84
  11:	bb ed ff ff ff       	mov    $0xffffffed,%ebx
  16:	e9 be f2 ff ff       	jmp    0xfffff2d9
  1b:	e8 cd 2b b7 fa       	call   0xfab72bed
  20:	48 8d 3d f6 ca 94 09 	lea    0x994caf6(%rip),%rdi        # 0x994cb1d
  27:	48 89 de             	mov    %rbx,%rsi
* 2a:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2f:	bb f0 ff ff ff       	mov    $0xfffffff0,%ebx
  34:	e9 a0 f2 ff ff       	jmp    0xfffff2d9
  39:	c7                   	.byte 0xc7
  3a:	44 24 30             	rex.R and $0x30,%al
  3d:	00 00                	add    %al,(%rax)