cm109 2-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff88807ad1cd00 submitted while active
WARNING: CPU: 0 PID: 28931 at drivers/usb/core/urb.c:380 usb_submit_urb+0xf8c/0x18b0 drivers/usb/core/urb.c:380
Modules linked in:
CPU: 0 UID: 0 PID: 28931 Comm: syz.3.7259 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:usb_submit_urb+0xf8c/0x18b0 drivers/usb/core/urb.c:380
Code: 00 00 00 e8 66 b7 d0 fa e9 25 f1 ff ff e8 5c b7 d0 fa c6 05 7f 82 58 08 01 90 48 c7 c7 e0 e4 ef 8b 48 89 de e8 25 26 94 fa 90 <0f> 0b 90 90 e9 ec f0 ff ff e8 36 b7 d0 fa c6 05 d7 cc 6e 08 01 41
RSP: 0000:ffffc90000007878 EFLAGS: 00010046
RAX: 026f332b00fad500 RBX: ffff88807ad1cd00 RCX: 0000000000040000
RDX: ffffc900021a1000 RSI: 0000000000002c3f RDI: 0000000000002c40
RBP: 000000000000000f R08: ffff8880b8824293 R09: 1ffff11017104852
R10: dffffc0000000000 R11: ffffed1017104853 R12: 0000000000000820
R13: ffff888079162030 R14: ffff88807ad1cd08 R15: dffffc0000000000
FS:  000055556650c500(0000) GS:ffff888126378000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6a73fe2000 CR3: 000000007d5c4000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 cm109_submit_ctl drivers/input/misc/cm109.c:380 [inline]
 cm109_urb_irq_callback+0x709/0xca0 drivers/input/misc/cm109.c:431
 __usb_hcd_giveback_urb+0x376/0x540 drivers/usb/core/hcd.c:1661
 dummy_timer+0x85f/0x44c0 drivers/usb/gadget/udc/dummy_hcd.c:1995
 __run_hrtimer kernel/time/hrtimer.c:1777 [inline]
 __hrtimer_run_queues+0x52c/0xc60 kernel/time/hrtimer.c:1841
 hrtimer_run_softirq+0x187/0x2b0 kernel/time/hrtimer.c:1858
 handle_softirqs+0x283/0x870 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1052
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:memcg1_commit_charge+0x0/0x280 mm/memcontrol-v1.c:575
Code: 8c 61 fe ff ff 49 89 fe 48 89 df e8 ea 21 f9 ff 4c 89 f7 e9 4e fe ff ff 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <f3> 0f 1e fa 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 e4 e0 48
RSP: 0000:ffffc90004e279b0 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffffea000121cac0 RCX: 026f332b00fad500
RDX: 0000000000000001 RSI: ffff8880237f8000 RDI: ffffea000121cac0
RBP: 0000000000000cc0 R08: 0000000000000000 R09: ffffffff822cac79
R10: dffffc0000000000 R11: fffff94000243959 R12: dffffc0000000000
R13: 1ffffd400024395f R14: ffff8880237f8000 R15: ffffea000121caf8
 charge_memcg+0x10b/0x180 mm/memcontrol.c:4706
 __mem_cgroup_charge+0x25/0x80 mm/memcontrol.c:4717
 mem_cgroup_charge include/linux/memcontrol.h:662 [inline]
 folio_prealloc+0x51/0x180 mm/memory.c:1196
 wp_page_copy mm/memory.c:3679 [inline]
 do_wp_page+0x1231/0x5800 mm/memory.c:4140
 handle_pte_fault mm/memory.c:6193 [inline]
 __handle_mm_fault+0x1033/0x5400 mm/memory.c:6318
 handle_mm_fault+0x40a/0x8e0 mm/memory.c:6487
 do_user_addr_fault+0xa7c/0x1380 arch/x86/mm/fault.c:1336
 handle_page_fault arch/x86/mm/fault.c:1476 [inline]
 exc_page_fault+0x76/0xf0 arch/x86/mm/fault.c:1532
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x7f6a73c610c8
Code: 80 3d 5b 0f 38 00 00 89 7c 24 0c 88 54 24 10 48 89 74 24 28 0f 85 c8 09 00 00 80 3d 26 46 eb 00 00 48 89 f5 41 89 d4 41 89 cd <c6> 05 31 0f 38 00 01 0f 85 23 04 00 00 80 3d f4 45 eb 00 00 0f 85
RSP: 002b:00007f6a7410fad0 EFLAGS: 00010202
RAX: 00007f6a73fe5fa0 RBX: 000000000013adb0 RCX: 000000000000000d
RDX: 0000000000000003 RSI: 00007f6a73fe6038 RDI: 0000000000000000
RBP: 00007f6a73fe6038 R08: 0000000000000000 R09: 000000000000000d
R10: 00007f6a7410fc80 R11: 0000000000000246 R12: 0000000000000003
R13: 000000000000000d R14: 000000000013ade2 R15: 00007f6a7410fca0
 </TASK>
----------------
Code disassembly (best guess), 5 bytes skipped:
   0:	49 89 fe             	mov    %rdi,%r14
   3:	48 89 df             	mov    %rbx,%rdi
   6:	e8 ea 21 f9 ff       	call   0xfff921f5
   b:	4c 89 f7             	mov    %r14,%rdi
   e:	e9 4e fe ff ff       	jmp    0xfffffe61
  13:	66 90                	xchg   %ax,%ax
  15:	90                   	nop
  16:	90                   	nop
  17:	90                   	nop
  18:	90                   	nop
  19:	90                   	nop
  1a:	90                   	nop
  1b:	90                   	nop
  1c:	90                   	nop
  1d:	90                   	nop
  1e:	90                   	nop
  1f:	90                   	nop
  20:	90                   	nop
  21:	90                   	nop
  22:	90                   	nop
  23:	90                   	nop
  24:	90                   	nop
* 25:	f3 0f 1e fa          	endbr64 <-- trapping instruction
  29:	55                   	push   %rbp
  2a:	48 89 e5             	mov    %rsp,%rbp
  2d:	41 57                	push   %r15
  2f:	41 56                	push   %r14
  31:	41 55                	push   %r13
  33:	41 54                	push   %r12
  35:	53                   	push   %rbx
  36:	48 83 e4 e0          	and    $0xffffffffffffffe0,%rsp
  3a:	48                   	rex.W