[v6.1] WARNING in cm109_urb_irq_callback/usb_submit_urb

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: d7543167affd Linux 6.1.82
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=13d25c6e180000
kernel config: https://syzkaller.appspot.com/x/.config?x=59059e181681c079
dashboard link: https://syzkaller.appspot.com/bug?extid=3a36eba60163258dde8d
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/88220954516a/disk-d7543167.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/c9062e074717/vmlinux-d7543167.xz
kernel image: https://storage.googleapis.com/syzbot-assets/70391b45a752/bzImage-d7543167.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3a36eb...@syzkaller.appspotmail.com

cm109 2-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff888095713600 submitted while active
WARNING: CPU: 1 PID: 10779 at drivers/usb/core/urb.c:379 usb_submit_urb+0x10b1/0x1990 drivers/usb/core/urb.c:379
Modules linked in:
CPU: 1 PID: 10779 Comm: syz-executor.2 Not tainted 6.1.82-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
RIP: 0010:usb_submit_urb+0x10b1/0x1990 drivers/usb/core/urb.c:379
Code: c9 24 fb eb 4d e8 cf c9 24 fb e9 fc ef ff ff e8 c5 c9 24 fb c6 05 48 b5 f9 07 01 48 c7 c7 c0 fb 89 8b 4c 89 ee e8 1f c2 ec fa <0f> 0b e9 c7 ef ff ff e8 a3 c9 24 fb eb 1a e8 9c c9 24 fb eb 13 e8
RSP: 0018:ffffc900001e0718 EFLAGS: 00010046
RAX: 9474fcfd36953000 RBX: ffff888077ac9848 RCX: 0000000000040000
RDX: ffffc90002331000 RSI: 0000000000001a12 RDI: 0000000000001a13
RBP: ffff888095713608 R08: ffffffff81527e8e R09: ffffed1017324f1c
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: ffff888095713600 R14: 0000000000000a20 R15: ffff88801eb96551
FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b30f24000 CR3: 00000000accfb000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
cm109_urb_irq_callback+0x6c4/0xc20 drivers/input/misc/cm109.c:422
__usb_hcd_giveback_urb+0x371/0x530 drivers/usb/core/hcd.c:1675
dummy_timer+0x8ad/0x3200 drivers/usb/gadget/udc/dummy_hcd.c:1988
call_timer_fn+0x1ad/0x6b0 kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1519 [inline]
__run_timers+0x67c/0x890 kernel/time/timer.c:1790
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1803
__do_softirq+0x2e9/0xa4c kernel/softirq.c:571
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x155/0x240 kernel/softirq.c:650
irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1106
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0010:lock_is_held_type+0x137/0x180
Code: 75 40 48 c7 04 24 00 00 00 00 9c 8f 04 24 f7 04 24 00 02 00 00 75 46 41 f7 c4 00 02 00 00 74 01 fb 65 48 8b 04 25 28 00 00 00 <48> 3b 44 24 08 75 3c 89 e8 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f
RSP: 0018:ffffc9000adef260 EFLAGS: 00000206
RAX: 9474fcfd36953000 RBX: 0000000000000002 RCX: 0000000080000001
RDX: 0000000000000000 RSI: ffffffff8aebffc0 RDI: ffffffff8b3d2b40
RBP: 0000000000000001 R08: ffffffff81ec907a R09: fffffbfff2092c45
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000246
R13: ffff888027408000 R14: 00000000ffffffff R15: ffffffff8d12a940
lookup_page_ext mm/page_ext.c:277 [inline]
page_ext_get+0x18e/0x2a0 mm/page_ext.c:158
page_table_check_clear+0x59/0x720 mm/page_table_check.c:71
zap_pte_range mm/memory.c:1435 [inline]
zap_pmd_range mm/memory.c:1574 [inline]
zap_pud_range mm/memory.c:1603 [inline]
zap_p4d_range mm/memory.c:1624 [inline]
unmap_page_range+0x1b4a/0x2740 mm/memory.c:1645
unmap_vmas+0x48b/0x640 mm/memory.c:1730
exit_mmap+0x252/0x9f0 mm/mmap.c:3227
__mmput+0x115/0x3c0 kernel/fork.c:1199
exit_mm+0x226/0x300 kernel/exit.c:563
do_exit+0x9f6/0x26a0 kernel/exit.c:856
do_group_exit+0x202/0x2b0 kernel/exit.c:1019
get_signal+0x16f7/0x17d0 kernel/signal.c:2862
arch_do_signal_or_restart+0xb0/0x1a10 arch/x86/kernel/signal.c:871
exit_to_user_mode_loop+0x6a/0x100 kernel/entry/common.c:168
exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x60/0x270 kernel/entry/common.c:297
do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:87
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f18a407dda9
Code: Unable to access opcode bytes at 0x7f18a407dd7f.
RSP: 002b:00007f18a4dd2178 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000001 RBX: 00007f18a41abf88 RCX: 00007f18a407dda9
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f18a41abf8c
RBP: 00007f18a41abf80 R08: 0000000000000010 R09: 00007f18a4dd26c0
R10: ffffffffffffffff R11: 0000000000000246 R12: 00007f18a41abf8c
R13: 000000000000000b R14: 00007ffe1faa8f80 R15: 00007ffe1faa9068
</TASK>
----------------
Code disassembly (best guess):
0: 75 40 jne 0x42
2: 48 c7 04 24 00 00 00 movq $0x0,(%rsp)
9: 00
a: 9c pushf
b: 8f 04 24 pop (%rsp)
e: f7 04 24 00 02 00 00 testl $0x200,(%rsp)
15: 75 46 jne 0x5d
17: 41 f7 c4 00 02 00 00 test $0x200,%r12d
1e: 74 01 je 0x21
20: fb sti
21: 65 48 8b 04 25 28 00 mov %gs:0x28,%rax
28: 00 00
* 2a: 48 3b 44 24 08 cmp 0x8(%rsp),%rax <-- trapping instruction
2f: 75 3c jne 0x6d
31: 89 e8 mov %ebp,%eax
33: 48 83 c4 10 add $0x10,%rsp
37: 5b pop %rbx
38: 41 5c pop %r12
3a: 41 5d pop %r13
3c: 41 5e pop %r14
3e: 41 5f pop %r15


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: b95c01af2113 Linux 5.15.152
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=17cc783a180000
kernel config: https://syzkaller.appspot.com/x/.config?x=5794ebfbd890383f
dashboard link: https://syzkaller.appspot.com/bug?extid=03aad5eada4d375d6b97

compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11a1f946180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1626bffa180000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ff79808f6ebe/disk-b95c01af.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a4d83399ac47/vmlinux-b95c01af.xz
kernel image: https://storage.googleapis.com/syzbot-assets/f783260a6e28/Image-b95c01af.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:

Reported-by: syzbot+03aad5...@syzkaller.appspotmail.com

cm109 1-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB 00000000da8318b3 submitted while active
WARNING: CPU: 0 PID: 0 at drivers/usb/core/urb.c:378 usb_submit_urb+0xdbc/0x1588
Modules linked in:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.15.152-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024

pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : usb_submit_urb+0xdbc/0x1588
lr : usb_submit_urb+0xdb8/0x1588 drivers/usb/core/urb.c:378
sp : ffff800008007650
x29: ffff800008007690 x28: 000000000000000f x27: 1fffe0001b406e0a
x26: dfff800000000000 x25: ffff0000cb8d4c01 x24: ffff0000cb8d4c02
x23: 000000000000000f x22: dfff800000000000 x21: ffff0000c1409e08
x20: ffff800016d13000 x19: ffff0000c1409e00 x18: 0000000000000102
x17: 0000000000000000 x16: ffff80001197c3d4 x15: 0000000000000012
x14: 1ffff0000292206a x13: dfff800000000000 x12: 0000000000000001
x11: 0000000000000102 x10: 0000000000000000 x9 : db209300ab6a0e00
x8 : db209300ab6a0e00 x7 : ffff800008328b8c x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : ffff80000854e694
x2 : 0000000000000001 x1 : 0000000000000102 x0 : 00000000fffffff0
Call trace:
usb_submit_urb+0xdbc/0x1588
cm109_urb_irq_callback+0x5a8/0xa4c drivers/input/misc/cm109.c:422
__usb_hcd_giveback_urb+0x2e0/0x518 drivers/usb/core/hcd.c:1674
usb_hcd_giveback_urb+0x108/0x41c drivers/usb/core/hcd.c:1757
dummy_timer+0x66c/0x26cc drivers/usb/gadget/udc/dummy_hcd.c:1987
call_timer_fn+0x19c/0x8f0 kernel/time/timer.c:1421
expire_timers kernel/time/timer.c:1466 [inline]
__run_timers+0x554/0x718 kernel/time/timer.c:1737
run_timer_softirq+0x7c/0x114 kernel/time/timer.c:1750
__do_softirq+0x344/0xdb0 kernel/softirq.c:558
do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
invoke_softirq kernel/softirq.c:439 [inline]
__irq_exit_rcu+0x264/0x4d4 kernel/softirq.c:637
irq_exit+0x14/0x88 kernel/softirq.c:661
handle_domain_irq+0xf4/0x178 kernel/irq/irqdesc.c:710
gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:758
call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:899
do_interrupt_handler+0x74/0x94 arch/arm64/kernel/entry-common.c:267
el1_interrupt+0x30/0x58 arch/arm64/kernel/entry-common.c:454
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:470
el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:580
arch_local_irq_enable+0xc/0x18 arch/arm64/include/asm/irqflags.h:35
default_idle_call+0xcc/0x4a8 kernel/sched/idle.c:112
cpuidle_idle_call kernel/sched/idle.c:194 [inline]
do_idle+0x1d4/0x4dc kernel/sched/idle.c:306
cpu_startup_entry+0x24/0x28 kernel/sched/idle.c:403
rest_init+0x364/0x38c init/main.c:738
arch_call_rest_init+0x14/0x20 init/main.c:890
start_kernel+0x440/0x600 init/main.c:1137
__primary_switched+0xa8/0xb0 arch/arm64/kernel/head.S:468
irq event stamp: 146027
hardirqs last enabled at (146026): [<ffff800011a51aa8>] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:168 [inline]
hardirqs last enabled at (146026): [<ffff800011a51aa8>] _raw_spin_unlock_irq+0x9c/0x134 kernel/locking/spinlock.c:202
hardirqs last disabled at (146027): [<ffff800011a5143c>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (146027): [<ffff800011a5143c>] _raw_spin_lock_irqsave+0xfc/0x14c kernel/locking/spinlock.c:162
softirqs last enabled at (145812): [<ffff800008021c64>] softirq_handle_end kernel/softirq.c:401 [inline]
softirqs last enabled at (145812): [<ffff800008021c64>] __do_softirq+0xb5c/0xdb0 kernel/softirq.c:587
softirqs last disabled at (146023): [<ffff8000081b6568>] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
softirqs last disabled at (146023): [<ffff8000081b6568>] invoke_softirq kernel/softirq.c:439 [inline]
softirqs last disabled at (146023): [<ffff8000081b6568>] __irq_exit_rcu+0x264/0x4d4 kernel/softirq.c:637
---[ end trace c4da27feebdb24b5 ]---
cm109 1-1:0.8: cm109_urb_irq_callback: usb_submit_urb (urb_ctl) failed -16
cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -2
cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71
cm109 1-1:0.8: cm109_urb_irq_callback: urb status -71
cm109 1-1:0.8: cm109_urb_irq_callback: usb_submit_urb (urb_ctl) failed -16
cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71
cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -2
cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: bf1e3b1cb1e0 Linux 6.1.85
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16bc9233180000
kernel config: https://syzkaller.appspot.com/x/.config?x=d3e21b90946dbbab

dashboard link: https://syzkaller.appspot.com/bug?extid=3a36eba60163258dde8d
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13e6914d180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1353ec85180000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/75265c862e54/disk-bf1e3b1c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1d22ca40ea90/vmlinux-bf1e3b1c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a5fcb5ebd870/bzImage-bf1e3b1c.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3a36eb...@syzkaller.appspotmail.com

cm109 1-1:0.8: cm109_urb_irq_callback: urb status -71
------------[ cut here ]------------
URB ffff888018244600 submitted while active
WARNING: CPU: 0 PID: 155 at drivers/usb/core/urb.c:379 usb_submit_urb+0x10b1/0x1990 drivers/usb/core/urb.c:379
Modules linked in:
CPU: 0 PID: 155 Comm: kworker/0:2 Not tainted 6.1.85-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: usb_hub_wq hub_event

RIP: 0010:usb_submit_urb+0x10b1/0x1990 drivers/usb/core/urb.c:379

Code: 54 24 fb eb 4d e8 0f 54 24 fb e9 fc ef ff ff e8 05 54 24 fb c6 05 7c 37 f9 07 01 48 c7 c7 c0 1c 8a 8b 4c 89 ee e8 1f 49 ec fa <0f> 0b e9 c7 ef ff ff e8 e3 53 24 fb eb 1a e8 dc 53 24 fb eb 13 e8
RSP: 0018:ffffc90000007718 EFLAGS: 00010046
RAX: 63cdd8ff760bb700 RBX: ffff88807dbce048 RCX: ffff888016398000
RDX: 0000000000000102 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff888018244608 R08: ffffffff81528eae R09: ffffed1017304f1c

R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000

R13: ffff888018244600 R14: 0000000000000a20 R15: ffff888022675b91
FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007f4cb3875b38 CR3: 0000000075f8c000 CR4: 00000000003506f0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
cm109_urb_irq_callback+0x6c4/0xc20 drivers/input/misc/cm109.c:422
__usb_hcd_giveback_urb+0x371/0x530 drivers/usb/core/hcd.c:1675
dummy_timer+0x8ad/0x3200 drivers/usb/gadget/udc/dummy_hcd.c:1988

call_timer_fn+0x1ad/0x6b0 kernel/time/timer.c:1504
expire_timers kernel/time/timer.c:1549 [inline]
__run_timers+0x67c/0x890 kernel/time/timer.c:1820
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1833

__do_softirq+0x2e9/0xa4c kernel/softirq.c:571
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x155/0x240 kernel/softirq.c:650
irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1106
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:653

RIP: 0010:console_emit_next_record+0xd67/0x1000 kernel/printk/printk.c:2786
Code: 32 1c 00 44 0f b6 74 24 1f 48 83 7c 24 30 00 75 07 e8 0d 32 1c 00 eb 06 e8 06 32 1c 00 fb 48 c7 84 24 a0 00 00 00 0e 36 e0 45 <43> c7 04 2c 00 00 00 00 4b c7 44 2c 0a 00 00 00 00 4b c7 44 2c 12
RSP: 0018:ffffc90002e0f0a0 EFLAGS: 00000293
RAX: ffffffff816e64ea RBX: ffffffff816e622c RCX: ffff888016398000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90002e0f350 R08: ffffffff816e64c2 R09: fffffbfff2093045

R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000

R13: 1ffff920005c1e28 R14: 0000000000000001 R15: 0000000000000000
console_unlock+0x278/0x7c0 kernel/printk/printk.c:2906
vprintk_emit+0x523/0x740 kernel/printk/printk.c:2303
dev_vprintk_emit+0x2aa/0x323 drivers/base/core.c:4922
dev_printk_emit+0xd9/0x118 drivers/base/core.c:4933
_dev_info+0x11e/0x165 drivers/base/core.c:4991
usb_disconnect+0xde/0x8c0 drivers/usb/core/hub.c:2251
hub_port_connect drivers/usb/core/hub.c:5309 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5605 [inline]
port_event drivers/usb/core/hub.c:5761 [inline]
hub_event+0x1f78/0x5730 drivers/usb/core/hub.c:5843
process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
kthread+0x28d/0x320 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308

</TASK>
----------------
Code disassembly (best guess):

0: 32 1c 00 xor (%rax,%rax,1),%bl
3: 44 0f b6 74 24 1f movzbl 0x1f(%rsp),%r14d
9: 48 83 7c 24 30 00 cmpq $0x0,0x30(%rsp)
f: 75 07 jne 0x18
11: e8 0d 32 1c 00 call 0x1c3223
16: eb 06 jmp 0x1e
18: e8 06 32 1c 00 call 0x1c3223
1d: fb sti
1e: 48 c7 84 24 a0 00 00 movq $0x45e0360e,0xa0(%rsp)
25: 00 0e 36 e0 45
* 2a: 43 c7 04 2c 00 00 00 movl $0x0,(%r12,%r13,1) <-- trapping instruction
31: 00
32: 4b c7 44 2c 0a 00 00 movq $0x0,0xa(%r12,%r13,1)
39: 00 00
3b: 4b rex.WXB
3c: c7 .byte 0xc7
3d: 44 2c 12 rex.R sub $0x12,%al


---