cm109 3-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff888075ff8b00 submitted while active
WARNING: CPU: 0 PID: 8591 at drivers/usb/core/urb.c:379 usb_submit_urb+0xff3/0x1890 drivers/usb/core/urb.c:379
Modules linked in:
CPU: 0 UID: 0 PID: 8591 Comm: kworker/u8:17 Not tainted 6.16.0-syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Workqueue: bat_events batadv_nc_worker
RIP: 0010:usb_submit_urb+0xff3/0x1890 drivers/usb/core/urb.c:379
Code: 00 eb 5c e8 ff 58 a7 fa e9 be f0 ff ff e8 f5 58 a7 fa c6 05 1c e1 71 08 01 90 48 c7 c7 e0 5b 33 8c 48 89 de e8 7e 48 6b fa 90 <0f> 0b 90 90 e9 85 f0 ff ff e8 cf 58 a7 fa eb 11 e8 c8 58 a7 fa bd
RSP: 0018:ffffc900000077b8 EFLAGS: 00010046
RAX: 459aa21eb70a2d00 RBX: ffff888075ff8b00 RCX: 0000000000040000
RDX: ffffc90002171000 RSI: 00000000000004e7 RDI: 00000000000004e8
RBP: 000000000000000f R08: ffffffff8e1332a3 R09: 1ffffffff1c26654
R10: dffffc0000000000 R11: fffffbfff1c26655 R12: 1ffff1100a6d6a0a
R13: dffffc0000000000 R14: ffff888075ff8b08 R15: 0000000000000820
FS: 0000000000000000(0000) GS:ffff888125c57000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5815a72d58 CR3: 000000007e944000 CR4: 00000000003526f0
Call Trace:
cm109_submit_ctl drivers/input/misc/cm109.c:380 [inline]
cm109_urb_irq_callback+0x718/0xc80 drivers/input/misc/cm109.c:431
__usb_hcd_giveback_urb+0x417/0x690 drivers/usb/core/hcd.c:1650
dummy_timer+0x862/0x4550 drivers/usb/gadget/udc/dummy_hcd.c:1995
__run_hrtimer kernel/time/hrtimer.c:1761 [inline]
__hrtimer_run_queues+0x52c/0xc60 kernel/time/hrtimer.c:1825
hrtimer_run_softirq+0x187/0x2b0 kernel/time/hrtimer.c:1842
handle_softirqs+0x283/0x870 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1050
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lock_acquire+0x175/0x360 kernel/locking/lockdep.c:5875
Code: 00 00 00 00 9c 8f 44 24 30 f7 44 24 30 00 02 00 00 0f 85 cd 00 00 00 f7 44 24 08 00 02 00 00 74 01 fb 65 48 8b 05 6b 55 fe 10 <48> 3b 44 24 58 0f 85 f2 00 00 00 48 83 c4 60 5b 41 5c 41 5d 41 5e
RSP: 0018:ffffc90002fb7980 EFLAGS: 00000206
RAX: 459aa21eb70a2d00 RBX: 0000000000000000 RCX: 459aa21eb70a2d00
RDX: 0000000000000000 RSI: ffffffff8db6fcc6 RDI: ffffffff8be1ba40
RBP: ffffffff8b345592 R08: 0000000000000000 R09: ffffffff8b345592
R10: dffffc0000000000 R11: ffffffff8b3454c0 R12: 0000000000000002
R13: ffffffff8e13f0e0 R14: 0000000000000000 R15: 0000000000000246
rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
rcu_read_lock include/linux/rcupdate.h:841 [inline]
batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:408 [inline]
batadv_nc_worker+0xef/0x610 net/batman-adv/network-coding.c:719
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3321
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 00 00 add %al,(%rax)
4: 9c pushf
5: 8f 44 24 30 pop 0x30(%rsp)
9: f7 44 24 30 00 02 00 testl $0x200,0x30(%rsp)
10: 00
11: 0f 85 cd 00 00 00 jne 0xe4
17: f7 44 24 08 00 02 00 testl $0x200,0x8(%rsp)
1e: 00
1f: 74 01 je 0x22
21: fb sti
22: 65 48 8b 05 6b 55 fe mov %gs:0x10fe556b(%rip),%rax # 0x10fe5595
29: 10
* 2a: 48 3b 44 24 58 cmp 0x58(%rsp),%rax <-- trapping instruction
2f: 0f 85 f2 00 00 00 jne 0x127
35: 48 83 c4 60 add $0x60,%rsp
39: 5b pop %rbx
3a: 41 5c pop %r12
3c: 41 5d pop %r13
3e: 41 5e pop %r14