smsmdtv:smscore_set_device_mode: mode detect failed -22
smsmdtv:smscore_start_device: set device mode failed , rc -22
smsusb:smsusb_init_device: smscore_start_device(...) failed
------------[ cut here ]------------
WARNING: CPU: 1 PID: 6416 at mm/slub.c:4723 free_large_kmalloc+0x34/0x188 mm/slub.c:4724
Modules linked in:
CPU: 1 UID: 0 PID: 6416 Comm: kworker/1:3 Not tainted 6.13.0-rc3-syzkaller-g573067a5a685 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: usb_hub_wq hub_event
pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : free_large_kmalloc+0x34/0x188 mm/slub.c:4724
lr : kfree+0x25c/0x478 mm/slub.c:4755
sp : ffff8000a3b56830
x29: ffff8000a3b56830 x28: ffff0000c2fb7000 x27: ffff0000d5581e40
x26: 1fffe000185f6e01 x25: 00000000000003f0 x24: 1fffe000185f6a1e
x23: dfff800000000000 x22: ffff0000dce62000 x21: ffff800080b49da0
x20: ffff0000dce62000 x19: fffffdffc3739880 x18: ffff8000a3b560e0
x17: 000000000000f0b3 x16: ffff800083275834 x15: 0000000000000001
x14: 1fffe000183b7ee0 x13: 0000000000000000 x12: 0000000000000000
x11: ffff6000183b7ee1 x10: 0000000000ff0100 x9 : 00003c0003739880
x8 : ffff800092c5e000 x7 : ffff800086978c44 x6 : ffff800086968d84
x5 : ffff0000c58dfd28 x4 : ffff8000a3b566b8 x3 : ffff80008698dcb4
x2 : 0000000000000001 x1 : ffff0000dce62000 x0 : fffffdffc3739880
Call trace:
 free_large_kmalloc+0x34/0x188 mm/slub.c:4724 (P)
 kfree+0x25c/0x478 mm/slub.c:4755
 urb_destroy drivers/usb/core/urb.c:25 [inline]
 kref_put include/linux/kref.h:65 [inline]
 usb_free_urb+0xd0/0x140 drivers/usb/core/urb.c:97
 smsusb_term_device+0x1ac/0x32c drivers/media/usb/siano/smsusb.c:352
 smsusb_init_device drivers/media/usb/siano/smsusb.c:497 [inline]
 smsusb_probe+0x1640/0x1bd8 drivers/media/usb/siano/smsusb.c:575
 usb_probe_interface+0x598/0xa40 drivers/usb/core/driver.c:396
 really_probe+0x38c/0x8fc drivers/base/dd.c:658
 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800
 driver_probe_device+0x78/0x330 drivers/base/dd.c:830
 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958
 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:459
 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030
 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079
 bus_probe_device+0x178/0x240 drivers/base/bus.c:534
 device_add+0x728/0xa6c drivers/base/core.c:3665
 usb_set_configuration+0x15cc/0x1b38 drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:254
 usb_probe_device+0x1a4/0x348 drivers/usb/core/driver.c:291
 really_probe+0x38c/0x8fc drivers/base/dd.c:658
 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800
 driver_probe_device+0x78/0x330 drivers/base/dd.c:830
 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958
 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:459
 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030
 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079
 bus_probe_device+0x178/0x240 drivers/base/bus.c:534
 device_add+0x728/0xa6c drivers/base/core.c:3665
 usb_new_device+0x908/0x149c drivers/usb/core/hub.c:2651
 hub_port_connect drivers/usb/core/hub.c:5521 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5661 [inline]
 port_event drivers/usb/core/hub.c:5821 [inline]
 hub_event+0x2454/0x4280 drivers/usb/core/hub.c:5903
 process_one_work+0x7a8/0x15cc kernel/workqueue.c:3229
 process_scheduled_works kernel/workqueue.c:3310 [inline]
 worker_thread+0x97c/0xeec kernel/workqueue.c:3391
 kthread+0x288/0x310 kernel/kthread.c:389
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862
irq event stamp: 4458
hardirqs last  enabled at (4457): [<ffff800080bf2374>] kasan_quarantine_put+0x1a0/0x1c8 mm/kasan/quarantine.c:234
hardirqs last disabled at (4458): [<ffff80008b69c83c>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:488
softirqs last  enabled at (3844): [<ffff80008030e7b4>] softirq_handle_end kernel/softirq.c:407 [inline]
softirqs last  enabled at (3844): [<ffff80008030e7b4>] handle_softirqs+0xb44/0xd34 kernel/softirq.c:589
softirqs last disabled at (3835): [<ffff800080020db4>] __do_softirq+0x14/0x20 kernel/softirq.c:595
---[ end trace 0000000000000000 ]---
object pointer: 0x0000000089fb30a5
==================================================================
BUG: KASAN: double-free in kfree+0x25c/0x478 mm/slub.c:4755
Free of addr ffff0000dce62000 by task kworker/1:3/6416

CPU: 1 UID: 0 PID: 6416 Comm: kworker/1:3 Tainted: G        W          6.13.0-rc3-syzkaller-g573067a5a685 #0
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: usb_hub_wq hub_event
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C)
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x198/0x538 mm/kasan/report.c:489
 kasan_report_invalid_free+0xc4/0x118 mm/kasan/report.c:564
 check_page_allocation+0x1d8/0x2a8
 __kasan_kfree_large+0x10/0x1c mm/kasan/common.c:303
 kasan_kfree_large include/linux/kasan.h:241 [inline]
 free_large_kmalloc+0x64/0x188 mm/slub.c:4727
 kfree+0x25c/0x478 mm/slub.c:4755
 urb_destroy drivers/usb/core/urb.c:25 [inline]
 kref_put include/linux/kref.h:65 [inline]
 usb_free_urb+0xd0/0x140 drivers/usb/core/urb.c:97
 smsusb_term_device+0x1ac/0x32c drivers/media/usb/siano/smsusb.c:352
 smsusb_init_device drivers/media/usb/siano/smsusb.c:497 [inline]
 smsusb_probe+0x1640/0x1bd8 drivers/media/usb/siano/smsusb.c:575
 usb_probe_interface+0x598/0xa40 drivers/usb/core/driver.c:396
 really_probe+0x38c/0x8fc drivers/base/dd.c:658
 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800
 driver_probe_device+0x78/0x330 drivers/base/dd.c:830
 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958
 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:459
 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030
 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079
 bus_probe_device+0x178/0x240 drivers/base/bus.c:534
 device_add+0x728/0xa6c drivers/base/core.c:3665
 usb_set_configuration+0x15cc/0x1b38 drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:254
 usb_probe_device+0x1a4/0x348 drivers/usb/core/driver.c:291
 really_probe+0x38c/0x8fc drivers/base/dd.c:658
 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800
 driver_probe_device+0x78/0x330 drivers/base/dd.c:830
 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958
 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:459
 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030
 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079
 bus_probe_device+0x178/0x240 drivers/base/bus.c:534
 device_add+0x728/0xa6c drivers/base/core.c:3665
 usb_new_device+0x908/0x149c drivers/usb/core/hub.c:2651
 hub_port_connect drivers/usb/core/hub.c:5521 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5661 [inline]
 port_event drivers/usb/core/hub.c:5821 [inline]
 hub_event+0x2454/0x4280 drivers/usb/core/hub.c:5903
 process_one_work+0x7a8/0x15cc kernel/workqueue.c:3229
 process_scheduled_works kernel/workqueue.c:3310 [inline]
 worker_thread+0x97c/0xeec kernel/workqueue.c:3391
 kthread+0x288/0x310 kernel/kthread.c:389
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11ce62
flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000000 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000dce61f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff0000dce61f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff0000dce62000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                   ^
 ffff0000dce62080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff0000dce62100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11ce62
flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000000 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0)
------------[ cut here ]------------
kernel BUG at ./include/linux/mm.h:1152!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 UID: 0 PID: 6416 Comm: kworker/1:3 Tainted: G    B   W          6.13.0-rc3-syzkaller-g573067a5a685 #0
Tainted: [B]=BAD_PAGE, [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: usb_hub_wq hub_event
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : put_page_testzero include/linux/mm.h:1152 [inline]
pc : folio_put_testzero include/linux/mm.h:1158 [inline]
pc : folio_put include/linux/mm.h:1487 [inline]
pc : free_large_kmalloc+0x158/0x188 mm/slub.c:4732
lr : put_page_testzero include/linux/mm.h:1152 [inline]
lr : folio_put_testzero include/linux/mm.h:1158 [inline]
lr : folio_put include/linux/mm.h:1487 [inline]
lr : free_large_kmalloc+0x158/0x188 mm/slub.c:4732
sp : ffff8000a3b56830
x29: ffff8000a3b56830 x28: ffff0000c2fb7000 x27: ffff0000d5581e40
x26: 1fffe000185f6e01 x25: 00000000000003f0 x24: 1fffe000185f6a1e
x23: dfff800000000000 x22: 0000000000000000 x21: 0000000000000000
x20: fffffffffffff000 x19: fffffdffc3739880 x18: 0000000000000008
x17: 0000000000000000 x16: ffff800083275834 x15: 0000000000000001
x14: 1fffe00036700aea x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000001 x10: 0000000000ff0100 x9 : 1de891dfb4985100
x8 : 1de891dfb4985100 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff8000a3b55d18 x4 : ffff80008fa8f840 x3 : ffff80008073f2fc
x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000003e
Call trace:
 put_page_testzero include/linux/mm.h:1152 [inline] (P)
 folio_put_testzero include/linux/mm.h:1158 [inline] (P)
 folio_put include/linux/mm.h:1487 [inline] (P)
 free_large_kmalloc+0x158/0x188 mm/slub.c:4732 (P)
 kfree+0x25c/0x478 mm/slub.c:4755
 urb_destroy drivers/usb/core/urb.c:25 [inline]
 kref_put include/linux/kref.h:65 [inline]
 usb_free_urb+0xd0/0x140 drivers/usb/core/urb.c:97
 smsusb_term_device+0x1ac/0x32c drivers/media/usb/siano/smsusb.c:352
 smsusb_init_device drivers/media/usb/siano/smsusb.c:497 [inline]
 smsusb_probe+0x1640/0x1bd8 drivers/media/usb/siano/smsusb.c:575
 usb_probe_interface+0x598/0xa40 drivers/usb/core/driver.c:396
 really_probe+0x38c/0x8fc drivers/base/dd.c:658
 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800
 driver_probe_device+0x78/0x330 drivers/base/dd.c:830
 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958
 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:459
 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030
 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079
 bus_probe_device+0x178/0x240 drivers/base/bus.c:534
 device_add+0x728/0xa6c drivers/base/core.c:3665
 usb_set_configuration+0x15cc/0x1b38 drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:254
 usb_probe_device+0x1a4/0x348 drivers/usb/core/driver.c:291
 really_probe+0x38c/0x8fc drivers/base/dd.c:658
 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800
 driver_probe_device+0x78/0x330 drivers/base/dd.c:830
 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958
 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:459
 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030
 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079
 bus_probe_device+0x178/0x240 drivers/base/bus.c:534
 device_add+0x728/0xa6c drivers/base/core.c:3665
 usb_new_device+0x908/0x149c drivers/usb/core/hub.c:2651
 hub_port_connect drivers/usb/core/hub.c:5521 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5661 [inline]
 port_event drivers/usb/core/hub.c:5821 [inline]
 hub_event+0x2454/0x4280 drivers/usb/core/hub.c:5903
 process_one_work+0x7a8/0x15cc kernel/workqueue.c:3229
 process_scheduled_works kernel/workqueue.c:3310 [inline]
 worker_thread+0x97c/0xeec kernel/workqueue.c:3391
 kthread+0x288/0x310 kernel/kthread.c:389
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862
Code: b0071f41 911d7421 aa1303e0 97fc23ab (d4210000) 
---[ end trace 0000000000000000 ]---