smsusb:smsusb_probe: board id=8, interface number 0
smsusb:siano_media_device_register: media controller created
------------[ cut here ]------------
usb 1-1: BOGUS urb xfer, pipe 3 != type 1
WARNING: CPU: 0 PID: 10 at drivers/usb/core/urb.c:504 usb_submit_urb+0xa00/0x148c drivers/usb/core/urb.c:503
Modules linked in:
CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.13.0-rc3-syzkaller-g573067a5a685 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: usb_hub_wq hub_event
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : usb_submit_urb+0xa00/0x148c drivers/usb/core/urb.c:503
lr : usb_submit_urb+0xa00/0x148c drivers/usb/core/urb.c:503
sp : ffff800097a76800
x29: ffff800097a76840 x28: ffff0000d4fc6000 x27: 0000000000000003
x26: ffff80008cf76b4c x25: ffff0000c2401120 x24: ffff0000c23cab50
x23: ffff80008cf7d8c0 x22: dfff800000000000 x21: 0000000000000003
x20: 0000000000000820 x19: ffff0000c23cab00 x18: 0000000000000008
x17: 0000000000000000 x16: ffff800083275834 x15: 0000000000000001
x14: 1fffe000366fc2ea x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000002 x10: 0000000000ff0100 x9 : 4c2ddb16bd3ca900
x8 : 4c2ddb16bd3ca900 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff800097a75f38 x4 : ffff80008fa8f840 x3 : ffff80008073f2fc
x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000000
Call trace:
 usb_submit_urb+0xa00/0x148c drivers/usb/core/urb.c:503 (P)
 smsusb_submit_urb+0x220/0x310 drivers/media/usb/siano/smsusb.c:173
 smsusb_start_streaming+0x30/0x2e0 drivers/media/usb/siano/smsusb.c:197
 smsusb_init_device drivers/media/usb/siano/smsusb.c:477 [inline]
 smsusb_probe+0x15a8/0x1bd8 drivers/media/usb/siano/smsusb.c:575
 usb_probe_interface+0x598/0xa40 drivers/usb/core/driver.c:396
 really_probe+0x38c/0x8fc drivers/base/dd.c:658
 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800
 driver_probe_device+0x78/0x330 drivers/base/dd.c:830
 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958
 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:459
 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030
 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079
 bus_probe_device+0x178/0x240 drivers/base/bus.c:534
 device_add+0x728/0xa6c drivers/base/core.c:3665
 usb_set_configuration+0x15cc/0x1b38 drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:254
 usb_probe_device+0x1a4/0x348 drivers/usb/core/driver.c:291
 really_probe+0x38c/0x8fc drivers/base/dd.c:658
 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800
 driver_probe_device+0x78/0x330 drivers/base/dd.c:830
 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958
 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:459
 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030
 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079
 bus_probe_device+0x178/0x240 drivers/base/bus.c:534
 device_add+0x728/0xa6c drivers/base/core.c:3665
 usb_new_device+0x908/0x149c drivers/usb/core/hub.c:2651
 hub_port_connect drivers/usb/core/hub.c:5521 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5661 [inline]
 port_event drivers/usb/core/hub.c:5821 [inline]
 hub_event+0x2454/0x4280 drivers/usb/core/hub.c:5903
 process_one_work+0x7a8/0x15cc kernel/workqueue.c:3229
 process_scheduled_works kernel/workqueue.c:3310 [inline]
 worker_thread+0x97c/0xeec kernel/workqueue.c:3391
 kthread+0x288/0x310 kernel/kthread.c:389
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862
irq event stamp: 110918
hardirqs last  enabled at (110917): [<ffff8000804aab50>] __up_console_sem kernel/printk/printk.c:344 [inline]
hardirqs last  enabled at (110917): [<ffff8000804aab50>] __console_unlock+0x70/0xc4 kernel/printk/printk.c:2869
hardirqs last disabled at (110918): [<ffff80008b69c83c>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:488
softirqs last  enabled at (110438): [<ffff80008030e7b4>] softirq_handle_end kernel/softirq.c:407 [inline]
softirqs last  enabled at (110438): [<ffff80008030e7b4>] handle_softirqs+0xb44/0xd34 kernel/softirq.c:589
softirqs last disabled at (110433): [<ffff800080020db4>] __do_softirq+0x14/0x20 kernel/softirq.c:595
---[ end trace 0000000000000000 ]---
smsusb:smsusb_start_streaming: smsusb_submit_urb(...) failed
smsusb:smsusb_init_device: smsusb_start_streaming(...) failed
------------[ cut here ]------------
WARNING: CPU: 0 PID: 10 at mm/slub.c:4723 free_large_kmalloc+0x34/0x188 mm/slub.c:4724
Modules linked in:
CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Tainted: G        W          6.13.0-rc3-syzkaller-g573067a5a685 #0
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: usb_hub_wq hub_event
pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : free_large_kmalloc+0x34/0x188 mm/slub.c:4724
lr : kfree+0x25c/0x478 mm/slub.c:4755
sp : ffff800097a76830
x29: ffff800097a76830 x28: ffff0000c304a000 x27: ffff0000c19e1e40
x26: 1fffe00018609401 x25: 00000000000003f0 x24: 1fffe0001a9f8e1e
x23: dfff800000000000 x22: ffff0000dcd62000 x21: ffff800080b49da0
x20: ffff0000dcd62000 x19: fffffdffc3735880 x18: ffff800097a760e0
x17: 000000000000e3ed x16: ffff800083275834 x15: 0000000000000001
x14: 1fffe00018479560 x13: 0000000000000000 x12: 0000000000000000
x11: ffff600018479561 x10: 0000000000ff0100 x9 : 00003c0003735880
x8 : ffff800092c5e000 x7 : ffff800086978c44 x6 : ffff800086968d84
x5 : ffff0000c1ffe4c8 x4 : ffff800097a766b8 x3 : ffff80008698dcb4
x2 : 0000000000000001 x1 : ffff0000dcd62000 x0 : fffffdffc3735880
Call trace:
 free_large_kmalloc+0x34/0x188 mm/slub.c:4724 (P)
 kfree+0x25c/0x478 mm/slub.c:4755
 urb_destroy drivers/usb/core/urb.c:25 [inline]
 kref_put include/linux/kref.h:65 [inline]
 usb_free_urb+0xd0/0x140 drivers/usb/core/urb.c:97
 smsusb_term_device+0x1ac/0x32c drivers/media/usb/siano/smsusb.c:352
 smsusb_init_device drivers/media/usb/siano/smsusb.c:497 [inline]
 smsusb_probe+0x1640/0x1bd8 drivers/media/usb/siano/smsusb.c:575
 usb_probe_interface+0x598/0xa40 drivers/usb/core/driver.c:396
 really_probe+0x38c/0x8fc drivers/base/dd.c:658
 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800
 driver_probe_device+0x78/0x330 drivers/base/dd.c:830
 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958
 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:459
 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030
 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079
 bus_probe_device+0x178/0x240 drivers/base/bus.c:534
 device_add+0x728/0xa6c drivers/base/core.c:3665
 usb_set_configuration+0x15cc/0x1b38 drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:254
 usb_probe_device+0x1a4/0x348 drivers/usb/core/driver.c:291
 really_probe+0x38c/0x8fc drivers/base/dd.c:658
 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800
 driver_probe_device+0x78/0x330 drivers/base/dd.c:830
 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958
 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:459
 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030
 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079
 bus_probe_device+0x178/0x240 drivers/base/bus.c:534
 device_add+0x728/0xa6c drivers/base/core.c:3665
 usb_new_device+0x908/0x149c drivers/usb/core/hub.c:2651
 hub_port_connect drivers/usb/core/hub.c:5521 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5661 [inline]
 port_event drivers/usb/core/hub.c:5821 [inline]
 hub_event+0x2454/0x4280 drivers/usb/core/hub.c:5903
 process_one_work+0x7a8/0x15cc kernel/workqueue.c:3229
 process_scheduled_works kernel/workqueue.c:3310 [inline]
 worker_thread+0x97c/0xeec kernel/workqueue.c:3391
 kthread+0x288/0x310 kernel/kthread.c:389
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862
irq event stamp: 111460
hardirqs last  enabled at (111459): [<ffff800080bf2374>] kasan_quarantine_put+0x1a0/0x1c8 mm/kasan/quarantine.c:234
hardirqs last disabled at (111460): [<ffff80008b69c83c>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:488
softirqs last  enabled at (110984): [<ffff80008030e7b4>] softirq_handle_end kernel/softirq.c:407 [inline]
softirqs last  enabled at (110984): [<ffff80008030e7b4>] handle_softirqs+0xb44/0xd34 kernel/softirq.c:589
softirqs last disabled at (110975): [<ffff800080020db4>] __do_softirq+0x14/0x20 kernel/softirq.c:595
---[ end trace 0000000000000000 ]---
object pointer: 0x00000000d2f1f08c
==================================================================
BUG: KASAN: double-free in kfree+0x25c/0x478 mm/slub.c:4755
Free of addr ffff0000dcd62000 by task kworker/0:1/10

CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Tainted: G        W          6.13.0-rc3-syzkaller-g573067a5a685 #0
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: usb_hub_wq hub_event
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C)
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x198/0x538 mm/kasan/report.c:489
 kasan_report_invalid_free+0xc4/0x118 mm/kasan/report.c:564
 check_page_allocation+0x1d8/0x2a8
 __kasan_kfree_large+0x10/0x1c mm/kasan/common.c:303
 kasan_kfree_large include/linux/kasan.h:241 [inline]
 free_large_kmalloc+0x64/0x188 mm/slub.c:4727
 kfree+0x25c/0x478 mm/slub.c:4755
 urb_destroy drivers/usb/core/urb.c:25 [inline]
 kref_put include/linux/kref.h:65 [inline]
 usb_free_urb+0xd0/0x140 drivers/usb/core/urb.c:97
 smsusb_term_device+0x1ac/0x32c drivers/media/usb/siano/smsusb.c:352
 smsusb_init_device drivers/media/usb/siano/smsusb.c:497 [inline]
 smsusb_probe+0x1640/0x1bd8 drivers/media/usb/siano/smsusb.c:575
 usb_probe_interface+0x598/0xa40 drivers/usb/core/driver.c:396
 really_probe+0x38c/0x8fc drivers/base/dd.c:658
 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800
 driver_probe_device+0x78/0x330 drivers/base/dd.c:830
 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958
 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:459
 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030
 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079
 bus_probe_device+0x178/0x240 drivers/base/bus.c:534
 device_add+0x728/0xa6c drivers/base/core.c:3665
 usb_set_configuration+0x15cc/0x1b38 drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:254
 usb_probe_device+0x1a4/0x348 drivers/usb/core/driver.c:291
 really_probe+0x38c/0x8fc drivers/base/dd.c:658
 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800
 driver_probe_device+0x78/0x330 drivers/base/dd.c:830
 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958
 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:459
 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030
 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079
 bus_probe_device+0x178/0x240 drivers/base/bus.c:534
 device_add+0x728/0xa6c drivers/base/core.c:3665
 usb_new_device+0x908/0x149c drivers/usb/core/hub.c:2651
 hub_port_connect drivers/usb/core/hub.c:5521 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5661 [inline]
 port_event drivers/usb/core/hub.c:5821 [inline]
 hub_event+0x2454/0x4280 drivers/usb/core/hub.c:5903
 process_one_work+0x7a8/0x15cc kernel/workqueue.c:3229
 process_scheduled_works kernel/workqueue.c:3310 [inline]
 worker_thread+0x97c/0xeec kernel/workqueue.c:3391
 kthread+0x288/0x310 kernel/kthread.c:389
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11cd62
flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000000 0000000000000000 fffffdffc3735888 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000dcd61f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff0000dcd61f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff0000dcd62000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                   ^
 ffff0000dcd62080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff0000dcd62100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11cd62
flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000000 0000000000000000 fffffdffc3735888 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0)
------------[ cut here ]------------
kernel BUG at ./include/linux/mm.h:1152!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Tainted: G    B   W          6.13.0-rc3-syzkaller-g573067a5a685 #0
Tainted: [B]=BAD_PAGE, [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: usb_hub_wq hub_event
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : put_page_testzero include/linux/mm.h:1152 [inline]
pc : folio_put_testzero include/linux/mm.h:1158 [inline]
pc : folio_put include/linux/mm.h:1487 [inline]
pc : free_large_kmalloc+0x158/0x188 mm/slub.c:4732
lr : put_page_testzero include/linux/mm.h:1152 [inline]
lr : folio_put_testzero include/linux/mm.h:1158 [inline]
lr : folio_put include/linux/mm.h:1487 [inline]
lr : free_large_kmalloc+0x158/0x188 mm/slub.c:4732
sp : ffff800097a76830
x29: ffff800097a76830 x28: ffff0000c304a000 x27: ffff0000c19e1e40
x26: 1fffe00018609401 x25: 00000000000003f0 x24: 1fffe0001a9f8e1e
x23: dfff800000000000 x22: 0000000000000000 x21: 0000000000000000
x20: fffffffffffff000 x19: fffffdffc3735880 x18: 0000000000000008
x17: 0000000000000000 x16: ffff800083275834 x15: 0000000000000001
x14: 1fffe000366fc2ea x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000001 x10: 0000000000ff0100 x9 : 4c2ddb16bd3ca900
x8 : 4c2ddb16bd3ca900 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff800097a75d18 x4 : ffff80008fa8f840 x3 : ffff80008073f2fc
x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000003e
Call trace:
 put_page_testzero include/linux/mm.h:1152 [inline] (P)
 folio_put_testzero include/linux/mm.h:1158 [inline] (P)
 folio_put include/linux/mm.h:1487 [inline] (P)
 free_large_kmalloc+0x158/0x188 mm/slub.c:4732 (P)
 kfree+0x25c/0x478 mm/slub.c:4755
 urb_destroy drivers/usb/core/urb.c:25 [inline]
 kref_put include/linux/kref.h:65 [inline]
 usb_free_urb+0xd0/0x140 drivers/usb/core/urb.c:97
 smsusb_term_device+0x1ac/0x32c drivers/media/usb/siano/smsusb.c:352
 smsusb_init_device drivers/media/usb/siano/smsusb.c:497 [inline]
 smsusb_probe+0x1640/0x1bd8 drivers/media/usb/siano/smsusb.c:575
 usb_probe_interface+0x598/0xa40 drivers/usb/core/driver.c:396
 really_probe+0x38c/0x8fc drivers/base/dd.c:658
 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800
 driver_probe_device+0x78/0x330 drivers/base/dd.c:830
 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958
 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:459
 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030
 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079
 bus_probe_device+0x178/0x240 drivers/base/bus.c:534
 device_add+0x728/0xa6c drivers/base/core.c:3665
 usb_set_configuration+0x15cc/0x1b38 drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:254
 usb_probe_device+0x1a4/0x348 drivers/usb/core/driver.c:291
 really_probe+0x38c/0x8fc drivers/base/dd.c:658
 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800
 driver_probe_device+0x78/0x330 drivers/base/dd.c:830
 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958
 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:459
 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030
 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079
 bus_probe_device+0x178/0x240 drivers/base/bus.c:534
 device_add+0x728/0xa6c drivers/base/core.c:3665
 usb_new_device+0x908/0x149c drivers/usb/core/hub.c:2651
 hub_port_connect drivers/usb/core/hub.c:5521 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5661 [inline]
 port_event drivers/usb/core/hub.c:5821 [inline]
 hub_event+0x2454/0x4280 drivers/usb/core/hub.c:5903
 process_one_work+0x7a8/0x15cc kernel/workqueue.c:3229
 process_scheduled_works kernel/workqueue.c:3310 [inline]
 worker_thread+0x97c/0xeec kernel/workqueue.c:3391
 kthread+0x288/0x310 kernel/kthread.c:389
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862
Code: b0071f41 911d7421 aa1303e0 97fc23ab (d4210000) 
---[ end trace 0000000000000000 ]---