WARNING in vb2_video_unregister_device

Status: upstream: reported C repro on 2026/08/22 00:21
Subsystems: media usb
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+f26bc23e42eeb548dee1@syzkaller.appspotmail.com
Fix commit: 2579cbe68005 media: em28xx: use video_unregister_device for radio_dev
Patched on: [ci-qemu-gce-upstream-auto ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-snapshot-upstream-root ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-linux-next-kasan-gce-root ci-upstream-rust-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce], missing on: [ci-qemu-native-arm64-kvm ci-qemu2-riscv64 ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-usb]
First crash: 54d, last: 24d
▶ ▼ ✨ AI Jobs (4)
ID Workflow Result Correct Bug Created Started Finished Revision
baddf7a6 patching 💥 WARNING in vb2_video_unregister_device 2026/09/22 19:35 2026/09/22 19:35 2026/09/22 21:37 5207b90e
9f5fdeee patching 💥 WARNING in vb2_video_unregister_device 2026/09/22 05:12 2026/09/22 05:12 2026/09/22 08:10 e12281bd
37293f62 patching 💥 WARNING in vb2_video_unregister_device 2026/09/19 03:04 2026/09/19 03:04 2026/09/19 06:16 853b104b
39fb9c0c assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ WARNING in vb2_video_unregister_device 2026/08/19 03:52 2026/08/19 03:52 2026/08/19 04:36 1e72964b
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[PATCH] media: em28xx: use video_unregister_device for radio_dev 2 (2) 2026/09/23 12:12
[syzbot] [media?] WARNING in vb2_video_unregister_device 0 (2) 2026/09/16 19:06

Sample crash report:
em28xx 1-1:1.0: Registered radio device as radio2
usb 1-1: Decoder not found
em28xx 1-1:1.0: failed to create media graph
em28xx 1-1:1.0: V4L2 device radio2 deregistered
------------[ cut here ]------------
WARNING: drivers/media/common/videobuf2/videobuf2-v4l2.c:1264 at vb2_video_unregister_device+0x1c8/0x1d0 drivers/media/common/videobuf2/videobuf2-v4l2.c:1264, CPU#1: kworker/1:2/1094
Modules linked in:
CPU: 1 UID: 0 PID: 1094 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Workqueue: events request_module_async
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : vb2_video_unregister_device+0x1c8/0x1d0 drivers/media/common/videobuf2/videobuf2-v4l2.c:1264
lr : vb2_video_unregister_device+0x1c8/0x1d0 drivers/media/common/videobuf2/videobuf2-v4l2.c:1264
sp : ffff800094617a20
x29: ffff800094617a20 x28: dfff800000000000 x27: 1fffe0001945a826
x26: ffff800087610300 x25: ffff800087611620 x24: 1fffe00018d04aa1
x23: ffff0000c6825508 x22: dfff800000000000 x21: ffff0000c6824000
x20: 0000000000000001 x19: ffff0000c6824f58 x18: 00000000ffffffff
x17: ffff800083d9271c x16: ffff800083da2fd4 x15: ffff800083a47b40
x14: 0000000000000001 x13: 0000000000000001 x12: 0000000000000003
x11: 0000000000000000 x10: 0000000000000001 x9 : 0000000000000000
x8 : 0000000000000000 x7 : ffff80008048e314 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff800083b611c0
x2 : 0000000000000001 x1 : ffff0000c74cbb00 x0 : 0000000000000000
Call trace:
 vb2_video_unregister_device+0x1c8/0x1d0 drivers/media/common/videobuf2/videobuf2-v4l2.c:1264 (P)
 em28xx_v4l2_init+0x1320/0x247c drivers/media/usb/em28xx/em28xx-video.c:3085
 em28xx_init_extension+0x10c/0x1b4 drivers/media/usb/em28xx/em28xx-core.c:1248
 request_module_async+0x24/0x34 drivers/media/usb/em28xx/em28xx-cards.c:-1
 process_one_work kernel/workqueue.c:3387 [inline]
 process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3470
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3551
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838
irq event stamp: 35758
hardirqs last  enabled at (35757): [<ffff8000804918ac>] vprintk_store+0x924/0xb94 kernel/printk/printk.c:2385
hardirqs last disabled at (35758): [<ffff8000869841d4>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:445
softirqs last  enabled at (35698): [<ffff800084c72d48>] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:698
softirqs last disabled at (35696): [<ffff800084c72d30>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (35696): [<ffff800084c72d30>] __alloc_skb+0x1a8/0x610 net/core/skbuff.c:697
---[ end trace 0000000000000000 ]---
em28xx 1-1:1.0: V4L2 device video11 deregistered
INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 1 UID: 0 PID: 1094 Comm: kworker/1:2 Tainted: G        W           syzkaller #0 PREEMPT 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Workqueue: events request_module_async
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 dump_stack+0x1c/0x28 lib/dump_stack.c:129
 assign_lock_key+0xcc/0xdc kernel/locking/lockdep.c:1000
 register_lock_class+0xf8/0x31c kernel/locking/lockdep.c:1315
 __lock_acquire+0xc0/0x2a6c kernel/locking/lockdep.c:5128
 lock_acquire+0x150/0x370 kernel/locking/lockdep.c:5908
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:155 [inline]
 _raw_spin_lock_irqsave+0x5c/0x7c kernel/locking/spinlock.c:181
 __wake_up_common_lock+0x30/0x78 kernel/sched/wait.c:125
 __wake_up+0x18/0x24 kernel/sched/wait.c:147
 __vb2_queue_cancel+0x248/0xa78 drivers/media/common/videobuf2/videobuf2-core.c:2244
 vb2_core_queue_release+0x34/0x13c drivers/media/common/videobuf2/videobuf2-core.c:2677
 vb2_queue_release drivers/media/common/videobuf2/videobuf2-v4l2.c:943 [inline]
 vb2_video_unregister_device+0x12c/0x1d0 drivers/media/common/videobuf2/videobuf2-v4l2.c:1279
 em28xx_v4l2_init+0x1368/0x247c drivers/media/usb/em28xx/em28xx-video.c:3097
 em28xx_init_extension+0x10c/0x1b4 drivers/media/usb/em28xx/em28xx-core.c:1248
 request_module_async+0x24/0x34 drivers/media/usb/em28xx/em28xx-cards.c:-1
 process_one_work kernel/workqueue.c:3387 [inline]
 process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3470
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3551
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838
Unable to handle kernel paging request at virtual address dfff800000000000
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
Mem abort info:
  ESR = 0x0000000096000005
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x05: level 1 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0
[dfff800000000000] address between user and kernel address ranges
Internal error: Oops: 0000000096000005 [#1]  SMP
Modules linked in:
CPU: 1 UID: 0 PID: 1094 Comm: kworker/1:2 Tainted: G        W           syzkaller #0 PREEMPT 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Workqueue: events request_module_async
pstate: 034000c5 (nzcv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : __wake_up_common+0xac/0x180 kernel/sched/wait.c:105
lr : __wake_up_common_lock+0x4c/0x78 kernel/sched/wait.c:126
sp : ffff8000946178a0
x29: ffff8000946178a0 x28: dfff800000000000 x27: dfff800000000000
x26: dfff800000000000 x25: ffff0000c682576c x24: 0000000000000000
x23: ffff0000c6825800 x22: 0000000000000003 x21: 0000000000000000
x20: 0000000000000000 x19: 0000000000000000 x18: 00000000ffffffff
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000004
x11: ffff7000128c2f04 x10: ffff7000128c2f04 x9 : 0000000000000003
x8 : 0000000000000000 x7 : 0000000000000000 x6 : ffff80008048e314
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
x2 : 0000000000000000 x1 : 0000000000000003 x0 : ffff0000c68257c0
Call trace:
 __wake_up_common+0xac/0x180 kernel/sched/wait.c:105 (P)
 __wake_up_common_lock+0x4c/0x78 kernel/sched/wait.c:126
 __wake_up+0x18/0x24 kernel/sched/wait.c:147
 __vb2_queue_cancel+0x248/0xa78 drivers/media/common/videobuf2/videobuf2-core.c:2244
 vb2_core_queue_release+0x34/0x13c drivers/media/common/videobuf2/videobuf2-core.c:2677
 vb2_queue_release drivers/media/common/videobuf2/videobuf2-v4l2.c:943 [inline]
 vb2_video_unregister_device+0x12c/0x1d0 drivers/media/common/videobuf2/videobuf2-v4l2.c:1279
 em28xx_v4l2_init+0x1368/0x247c drivers/media/usb/em28xx/em28xx-video.c:3097
 em28xx_init_extension+0x10c/0x1b4 drivers/media/usb/em28xx/em28xx-core.c:1248
 request_module_async+0x24/0x34 drivers/media/usb/em28xx/em28xx-cards.c:-1
 process_one_work kernel/workqueue.c:3387 [inline]
 process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3470
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3551
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838
Code: f94002f8 eb17031f 54000500 d343ff08 (387b6908) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	f94002f8 	ldr	x24, [x23]
   4:	eb17031f 	cmp	x24, x23
   8:	54000500 	b.eq	0xa8  // b.none
   c:	d343ff08 	lsr	x8, x24, #3
* 10:	387b6908 	ldrb	w8, [x8, x27] <-- trapping instruction

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/16 19:05 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 5445d6419962 95928915 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in vb2_video_unregister_device
2026/08/17 22:25 linux-next 4477a78374a5 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce WARNING in vb2_video_unregister_device
* Struck through repros no longer work on HEAD.