WARNING in cm109_urb_irq_callback/usb_submit_urb on v7.2-rc3

WARNING in cm109_urb_irq_callback/usb_submit_urb on v7.2-rc3

[CJ]

Hi,


syzbot reported "WARNING in cm109_urb_irq_callback/usb_submit_urb" on linux-5.15. The same failure is still reproducible on v7.2-rc3 with the reproducer below.


Tested kernel:
  Linux v7.2-rc3
  HEAD a13c140cc289c0b7b3770bce5b3ad42ab35074aa


Observed failure:
[   47.220397][    C0] WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x15ab/0x18e0, CPU#0: c/8999
[   47.222030][    C0] Modules linked in:
[   47.222725][    C0] CPU: 0 UID: 0 PID: 8999 Comm: c Not tainted 7.2.0-rc3 #1 PREEMPT(full) 
[   47.224157][    C0] Hardware name: QEMU Ubuntu 24.10 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   47.225941][    C0] RIP: 0010:usb_submit_urb+0x15ae/0x18e0
[   47.226903][    C0] Code: 8c 48 c7 c6 e0 ff 1a 8c 89 da 48 8d b8 b0 00 00 00 e8 86 aa d7 fe e9 9a f1 ff ff e8 6c a9 ae fa 48 8d 3d a5 6d 4e 09 48 89 ee <67> 48 0f b9 3a 41 bf f0 ff ff ff e9 f7 f2 ff ff e8 4d a9 ae fa 66
[   47.230124][    C0] RSP: 0018:ffffc90000007b20 EFLAGS: 00010046
[   47.231153][    C0] RAX: 0000000000000000 RBX: ffff888024959000 RCX: ffffffff8794e5f7
[   47.232476][    C0] RDX: 1ffff11003f8cb21 RSI: ffff88801fc65900 RDI: ffffffff905e4020
[   47.233808][    C0] RBP: ffff88801fc65900 R08: 0000000000000000 R09: fffff52000000f64
[   47.235151][    C0] R10: fffff52000000f63 R11: 0000000000000003 R12: 0000000000000046
[   47.236473][    C0] R13: ffff888024959058 R14: 000000000000000f R15: 0000000000000001
[   47.237808][    C0] FS:  00007fbf3dadc740(0000) GS:ffff88809819a000(0000) knlGS:0000000000000000
[   47.239305][    C0] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   47.240407][    C0] CR2: 000020000000203c CR3: 0000000046527000 CR4: 00000000000006f0
[   47.241731][    C0] Call Trace:
[   47.242313][    C0]  <IRQ>
[   47.242806][    C0]  ? __sanitizer_cov_trace_pc+0x20/0x50
[   47.243767][    C0]  ? ___ratelimit+0x185/0x9e0
[   47.244608][    C0]  cm109_urb_irq_callback+0x471/0xb90
[   47.245530][    C0]  ? __sanitizer_cov_trace_pc+0x20/0x50
[   47.246478][    C0]  __usb_hcd_giveback_urb+0x2ec/0x5f0
[   47.247401][    C0]  ? dummy_timer+0x1359/0x35a0
[   47.248237][    C0]  usb_hcd_giveback_urb+0x391/0x450
[   47.249145][    C0]  dummy_timer+0x136b/0x35a0
[   47.249943][    C0]  ? __sanitizer_cov_trace_pc+0x20/0x50
[   47.250891][    C0]  ? do_raw_spin_lock+0x122/0x290
[   47.251749][    C0]  ? find_held_lock+0x2b/0x80
[   47.252566][    C0]  ? debug_object_deactivate+0x2ad/0x390
[   47.253531][    C0]  ? do_raw_spin_unlock+0x54/0x230
[   47.254420][    C0]  ? debug_object_deactivate+0x2ad/0x390
[   47.255385][    C0]  ? __pfx_dummy_timer+0x10/0x10
[   47.256239][    C0]  ? _raw_spin_unlock_irqrestore+0x58/0x70
[   47.257234][    C0]  __hrtimer_run_queues+0x183/0xa10
[   47.258132][    C0]  ? __pfx_dummy_timer+0x10/0x10
[   47.258985][    C0]  hrtimer_run_softirq+0x17f/0x2d0
[   47.259887][    C0]  handle_softirqs+0x1be/0x8e0
[   47.260707][    C0]  ? irqtime_account_delta.isra.0+0x9f/0x110
[   47.261731][    C0]  irq_exit_rcu+0x166/0x200
[   47.262516][    C0]  sysvec_apic_timer_interrupt+0xa6/0xd0
[   47.263473][    C0]  </IRQ>
[   47.263988][    C0]  <TASK>
[   47.264490][    C0]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
[   47.265508][    C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x3c/0x70
[   47.266600][    C0] Code: 74 24 10 e8 06 7e 6b f6 48 89 ef e8 5e d5 6b f6 81 e3 00 02 00 00 75 29 9c 58 f6 c4 02 75 35 48 85 db 74 01 fb bf 01 00 00 00 <e8> ff 42 5a f6 65 8b 05 58 91 39 08 85 c0 74 0e 5b 5d c3 cc cc cc
[   47.269810][    C0] RSP: 0018:ffffc90002717b58 EFLAGS: 00000206
[   47.270835][    C0] RAX: 0000000000000006 RBX: 0000000000000200 RCX: 0000000000000006
[   47.272171][    C0] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001
[   47.273493][    C0] RBP: ffffffff8f4cb580 R08: 0000000000000001 R09: 0000000000000001
[   47.274815][    C0] R10: 0000000000000001 R11: ffffffff905109d7 R12: 1ffff920004e2f71
[   47.276162][    C0] R13: ffff888024155234 R14: ffffc90002717ba8 R15: ffff8880203e5300
[   47.277491][    C0]  usb_hcd_poll_rh_status+0x46d/0x620
[   47.278412][    C0]  ? __pfx_usb_hcd_poll_rh_status+0x10/0x10
[   47.279415][    C0]  ? _raw_spin_unlock_irqrestore+0x58/0x70
[   47.280406][    C0]  dummy_pullup+0x132/0x170


This is the assertion site reported by syzbot; I am not claiming a specific root cause.


This is a report of a still-reproducible failure, not a bisected root cause.


Reproducer:
  C reproducer: https://pastebin.com/raw/Z2kJBKK4


Artifacts:
  console: https://pastebin.com/raw/vJFgd0Fk
  kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=353ae28c40b35af5


Thanks.