From: CJ <firefly0158@163.com>
To: dmitry.torokhov@gmail.com
Cc: linux-input@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: WARNING in cm109_urb_irq_callback/usb_submit_urb on v7.2-rc3
Date: Tue, 10 Nov 2026 14:43:17 +0800 (CST) [thread overview]
Message-ID: <4ffee3ca.5062.1a1c4325d29.Coremail.firefly0158@163.com> (raw)
Hi,
syzbot reported "WARNING in cm109_urb_irq_callback/usb_submit_urb" on linux-5.15. The same failure is still reproducible on v7.2-rc3 with the reproducer below.
Tested kernel:
Linux v7.2-rc3
HEAD a13c140cc289c0b7b3770bce5b3ad42ab35074aa
Observed failure:
[ 47.220397][ C0] WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x15ab/0x18e0, CPU#0: c/8999
[ 47.222030][ C0] Modules linked in:
[ 47.222725][ C0] CPU: 0 UID: 0 PID: 8999 Comm: c Not tainted 7.2.0-rc3 #1 PREEMPT(full)
[ 47.224157][ C0] Hardware name: QEMU Ubuntu 24.10 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 47.225941][ C0] RIP: 0010:usb_submit_urb+0x15ae/0x18e0
[ 47.226903][ C0] Code: 8c 48 c7 c6 e0 ff 1a 8c 89 da 48 8d b8 b0 00 00 00 e8 86 aa d7 fe e9 9a f1 ff ff e8 6c a9 ae fa 48 8d 3d a5 6d 4e 09 48 89 ee <67> 48 0f b9 3a 41 bf f0 ff ff ff e9 f7 f2 ff ff e8 4d a9 ae fa 66
[ 47.230124][ C0] RSP: 0018:ffffc90000007b20 EFLAGS: 00010046
[ 47.231153][ C0] RAX: 0000000000000000 RBX: ffff888024959000 RCX: ffffffff8794e5f7
[ 47.232476][ C0] RDX: 1ffff11003f8cb21 RSI: ffff88801fc65900 RDI: ffffffff905e4020
[ 47.233808][ C0] RBP: ffff88801fc65900 R08: 0000000000000000 R09: fffff52000000f64
[ 47.235151][ C0] R10: fffff52000000f63 R11: 0000000000000003 R12: 0000000000000046
[ 47.236473][ C0] R13: ffff888024959058 R14: 000000000000000f R15: 0000000000000001
[ 47.237808][ C0] FS: 00007fbf3dadc740(0000) GS:ffff88809819a000(0000) knlGS:0000000000000000
[ 47.239305][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 47.240407][ C0] CR2: 000020000000203c CR3: 0000000046527000 CR4: 00000000000006f0
[ 47.241731][ C0] Call Trace:
[ 47.242313][ C0] <IRQ>
[ 47.242806][ C0] ? __sanitizer_cov_trace_pc+0x20/0x50
[ 47.243767][ C0] ? ___ratelimit+0x185/0x9e0
[ 47.244608][ C0] cm109_urb_irq_callback+0x471/0xb90
[ 47.245530][ C0] ? __sanitizer_cov_trace_pc+0x20/0x50
[ 47.246478][ C0] __usb_hcd_giveback_urb+0x2ec/0x5f0
[ 47.247401][ C0] ? dummy_timer+0x1359/0x35a0
[ 47.248237][ C0] usb_hcd_giveback_urb+0x391/0x450
[ 47.249145][ C0] dummy_timer+0x136b/0x35a0
[ 47.249943][ C0] ? __sanitizer_cov_trace_pc+0x20/0x50
[ 47.250891][ C0] ? do_raw_spin_lock+0x122/0x290
[ 47.251749][ C0] ? find_held_lock+0x2b/0x80
[ 47.252566][ C0] ? debug_object_deactivate+0x2ad/0x390
[ 47.253531][ C0] ? do_raw_spin_unlock+0x54/0x230
[ 47.254420][ C0] ? debug_object_deactivate+0x2ad/0x390
[ 47.255385][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 47.256239][ C0] ? _raw_spin_unlock_irqrestore+0x58/0x70
[ 47.257234][ C0] __hrtimer_run_queues+0x183/0xa10
[ 47.258132][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 47.258985][ C0] hrtimer_run_softirq+0x17f/0x2d0
[ 47.259887][ C0] handle_softirqs+0x1be/0x8e0
[ 47.260707][ C0] ? irqtime_account_delta.isra.0+0x9f/0x110
[ 47.261731][ C0] irq_exit_rcu+0x166/0x200
[ 47.262516][ C0] sysvec_apic_timer_interrupt+0xa6/0xd0
[ 47.263473][ C0] </IRQ>
[ 47.263988][ C0] <TASK>
[ 47.264490][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 47.265508][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x3c/0x70
[ 47.266600][ C0] Code: 74 24 10 e8 06 7e 6b f6 48 89 ef e8 5e d5 6b f6 81 e3 00 02 00 00 75 29 9c 58 f6 c4 02 75 35 48 85 db 74 01 fb bf 01 00 00 00 <e8> ff 42 5a f6 65 8b 05 58 91 39 08 85 c0 74 0e 5b 5d c3 cc cc cc
[ 47.269810][ C0] RSP: 0018:ffffc90002717b58 EFLAGS: 00000206
[ 47.270835][ C0] RAX: 0000000000000006 RBX: 0000000000000200 RCX: 0000000000000006
[ 47.272171][ C0] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001
[ 47.273493][ C0] RBP: ffffffff8f4cb580 R08: 0000000000000001 R09: 0000000000000001
[ 47.274815][ C0] R10: 0000000000000001 R11: ffffffff905109d7 R12: 1ffff920004e2f71
[ 47.276162][ C0] R13: ffff888024155234 R14: ffffc90002717ba8 R15: ffff8880203e5300
[ 47.277491][ C0] usb_hcd_poll_rh_status+0x46d/0x620
[ 47.278412][ C0] ? __pfx_usb_hcd_poll_rh_status+0x10/0x10
[ 47.279415][ C0] ? _raw_spin_unlock_irqrestore+0x58/0x70
[ 47.280406][ C0] dummy_pullup+0x132/0x170
This is the assertion site reported by syzbot; I am not claiming a specific root cause.
This is a report of a still-reproducible failure, not a bisected root cause.
Reproducer:
C reproducer: https://pastebin.com/raw/Z2kJBKK4
Artifacts:
console: https://pastebin.com/raw/vJFgd0Fk
kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=353ae28c40b35af5
Thanks.
reply other threads:[~2026-11-10 6:43 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4ffee3ca.5062.1a1c4325d29.Coremail.firefly0158@163.com \
--to=firefly0158@163.com \
--cc=dmitry.torokhov@gmail.com \
--cc=linux-input@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®