cm109 1-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff88802ffba500 submitted while active
WARNING: CPU: 0 PID: 3459 at drivers/usb/core/urb.c:379 usb_submit_urb+0xf35/0x17d0 drivers/usb/core/urb.c:379
Modules linked in:
CPU: 0 PID: 3459 Comm: kworker/u4:8 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Workqueue: events_unbound nsim_dev_trap_report_work
RIP: 0010:usb_submit_urb+0xf35/0x17d0 drivers/usb/core/urb.c:379
Code: 4a 8b 44 89 fa e8 bb ac 17 04 e9 28 fc ff ff e8 81 22 36 fb c6 05 46 b4 e5 07 01 48 c7 c7 c0 d7 4a 8b 48 89 de e8 db 96 00 fb <0f> 0b e9 45 f1 ff ff e8 5f 22 36 fb eb 11 e8 58 22 36 fb bd 80 00
RSP: 0018:ffffc90000007868 EFLAGS: 00010046
RAX: c9e5132275673f00 RBX: ffff88802ffba500 RCX: 0000000000040000
RDX: ffffc900020a2000 RSI: 00000000000188cb RDI: 00000000000188cc
RBP: 000000000000000f R08: ffffc90000007467 R09: 1ffff92000000e8c
R10: dffffc0000000000 R11: fffff52000000e8d R12: dffffc0000000000
R13: ffff888077b52030 R14: ffff88802ffba508 R15: 0000000000000820
FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f90f8fe1000 CR3: 000000002d538000 CR4: 00000000003526f0
Call Trace:
cm109_urb_irq_callback+0x72c/0xc90 drivers/input/misc/cm109.c:422
__usb_hcd_giveback_urb+0x35f/0x520 drivers/usb/core/hcd.c:1650
dummy_timer+0x8a3/0x31b0 drivers/usb/gadget/udc/dummy_hcd.c:1993
__run_hrtimer kernel/time/hrtimer.c:1750 [inline]
__hrtimer_run_queues+0x51e/0xc40 kernel/time/hrtimer.c:1814
hrtimer_run_softirq+0x187/0x2b0 kernel/time/hrtimer.c:1831
handle_softirqs+0x280/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:unwind_next_frame+0x1622/0x2970 arch/x86/kernel/unwind_orc.c:590
Code: 00 49 89 c6 48 8b 44 24 40 42 80 3c 28 00 48 8b 5c 24 20 74 08 48 89 df e8 8b 2a a2 00 4c 89 33 48 8b 44 24 68 42 80 3c 28 00 <48> 8b 5c 24 60 74 08 48 89 df e8 6f 2a a2 00 48 8b 44 24 08 48 89
RSP: 0018:ffffc9000c5074d8 EFLAGS: 00000246
RAX: 1ffff920018a0ebc RBX: ffffc9000c5075f0 RCX: ffff88802d5d9e00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffc9000c507968
RBP: ffffc9000c5075f8 R08: ffff88802d5d9e00 R09: 0000000000000003
R10: 0000000000000004 R11: 0000000000000000 R12: ffffc9000c5075a8
R13: dffffc0000000000 R14: ffffffff81dc9180 R15: ffffffff8ed9393e
arch_stack_walk+0x144/0x190 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4e/0x70 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x50 mm/kasan/generic.c:522
____kasan_slab_free+0x126/0x1e0 mm/kasan/common.c:236
kasan_slab_free include/linux/kasan.h:164 [inline]
slab_free_hook mm/slub.c:1811 [inline]
slab_free_freelist_hook+0x130/0x1b0 mm/slub.c:1837
slab_free mm/slub.c:3830 [inline]
__kmem_cache_free+0xba/0x1f0 mm/slub.c:3843
skb_kfree_head net/core/skbuff.c:945 [inline]
skb_free_head net/core/skbuff.c:957 [inline]
skb_release_data+0x634/0x800 net/core/skbuff.c:987
skb_release_all net/core/skbuff.c:1053 [inline]
__kfree_skb net/core/skbuff.c:1067 [inline]
consume_skb+0xb2/0x110 net/core/skbuff.c:1283
nsim_dev_trap_report drivers/net/netdevsim/dev.c:821 [inline]
nsim_dev_trap_report_work+0x76f/0xb00 drivers/net/netdevsim/dev.c:851
process_one_work kernel/workqueue.c:2634 [inline]
process_scheduled_works+0xa45/0x15b0 kernel/workqueue.c:2711
worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 49 89 c6 mov %rax,%r14
3: 48 8b 44 24 40 mov 0x40(%rsp),%rax
8: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1)
d: 48 8b 5c 24 20 mov 0x20(%rsp),%rbx
12: 74 08 je 0x1c
14: 48 89 df mov %rbx,%rdi
17: e8 8b 2a a2 00 call 0xa22aa7
1c: 4c 89 33 mov %r14,(%rbx)
1f: 48 8b 44 24 68 mov 0x68(%rsp),%rax
24: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1)
* 29: 48 8b 5c 24 60 mov 0x60(%rsp),%rbx <-- trapping instruction
2e: 74 08 je 0x38
30: 48 89 df mov %rbx,%rdi
33: e8 6f 2a a2 00 call 0xa22aa7
38: 48 8b 44 24 08 mov 0x8(%rsp),%rax
3d: 48 rex.W
3e: 89 .byte 0x89