Extracting prog: 2m50.681962391s Minimizing prog: 19m10.358976815s Simplifying prog options: 0s Extracting C: 30.734054512s Simplifying C: 8m22.826412285s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x48, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000a180c52040200055c8a9010203010902360001000a0000090400000496fe090009050505000404000009050d0000000000000905a9", @ANYBLOB, @ANYRES64, @ANYRES16=0x0, @ANYRES64], 0x0) program did not crash single: failed to extract reproducer single: executing 1 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x48, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000a180c52040200055c8a9010203010902360001000a0000090400000496fe090009050505000404000009050d0000000000000905a9", @ANYBLOB, @ANYRES64, @ANYRES16=0x0, @ANYRES64], 0x0) program crashed: WARNING in smsusb_start_streaming/usb_submit_urb single: successfully extracted reproducer found reproducer with 1 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x48, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x48, &(0x7f0000000100)=ANY=[], 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x48, &(0x7f0000000100)=ANY=[@ANYBLOB, @ANYBLOB, @ANYRES64, @ANYRES16=0x0, @ANYRES64], 0x0) program did not crash extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: WARNING in smsusb_start_streaming/usb_submit_urb simplifying C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: WARNING in smsusb_start_streaming/usb_submit_urb testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: WARNING in smsusb_start_streaming/usb_submit_urb testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: WARNING in smsusb_start_streaming/usb_submit_urb testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: WARNING in smsusb_start_streaming/usb_submit_urb testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: WARNING in smsusb_start_streaming/usb_submit_urb testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: WARNING in smsusb_start_streaming/usb_submit_urb testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: WARNING in smsusb_start_streaming/usb_submit_urb reproducing took 30m54.601434188s repro crashed as (corrupted=false): smsusb:smsusb_probe: board id=8, interface number 0 smsusb:siano_media_device_register: media controller created ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 10 at drivers/usb/core/urb.c:504 usb_submit_urb+0xa00/0x148c drivers/usb/core/urb.c:503 Modules linked in: CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.13.0-rc3-syzkaller-g573067a5a685 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: usb_hub_wq hub_event pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0xa00/0x148c drivers/usb/core/urb.c:503 lr : usb_submit_urb+0xa00/0x148c drivers/usb/core/urb.c:503 sp : ffff800097a76800 x29: ffff800097a76840 x28: ffff0000d4fc6000 x27: 0000000000000003 x26: ffff80008cf76b4c x25: ffff0000c2401120 x24: ffff0000c23cab50 x23: ffff80008cf7d8c0 x22: dfff800000000000 x21: 0000000000000003 x20: 0000000000000820 x19: ffff0000c23cab00 x18: 0000000000000008 x17: 0000000000000000 x16: ffff800083275834 x15: 0000000000000001 x14: 1fffe000366fc2ea x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000002 x10: 0000000000ff0100 x9 : 4c2ddb16bd3ca900 x8 : 4c2ddb16bd3ca900 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff800097a75f38 x4 : ffff80008fa8f840 x3 : ffff80008073f2fc x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000000 Call trace: usb_submit_urb+0xa00/0x148c drivers/usb/core/urb.c:503 (P) smsusb_submit_urb+0x220/0x310 drivers/media/usb/siano/smsusb.c:173 smsusb_start_streaming+0x30/0x2e0 drivers/media/usb/siano/smsusb.c:197 smsusb_init_device drivers/media/usb/siano/smsusb.c:477 [inline] smsusb_probe+0x15a8/0x1bd8 drivers/media/usb/siano/smsusb.c:575 usb_probe_interface+0x598/0xa40 drivers/usb/core/driver.c:396 really_probe+0x38c/0x8fc drivers/base/dd.c:658 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800 driver_probe_device+0x78/0x330 drivers/base/dd.c:830 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:459 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079 bus_probe_device+0x178/0x240 drivers/base/bus.c:534 device_add+0x728/0xa6c drivers/base/core.c:3665 usb_set_configuration+0x15cc/0x1b38 drivers/usb/core/message.c:2210 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:254 usb_probe_device+0x1a4/0x348 drivers/usb/core/driver.c:291 really_probe+0x38c/0x8fc drivers/base/dd.c:658 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800 driver_probe_device+0x78/0x330 drivers/base/dd.c:830 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:459 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079 bus_probe_device+0x178/0x240 drivers/base/bus.c:534 device_add+0x728/0xa6c drivers/base/core.c:3665 usb_new_device+0x908/0x149c drivers/usb/core/hub.c:2651 hub_port_connect drivers/usb/core/hub.c:5521 [inline] hub_port_connect_change drivers/usb/core/hub.c:5661 [inline] port_event drivers/usb/core/hub.c:5821 [inline] hub_event+0x2454/0x4280 drivers/usb/core/hub.c:5903 process_one_work+0x7a8/0x15cc kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x97c/0xeec kernel/workqueue.c:3391 kthread+0x288/0x310 kernel/kthread.c:389 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862 irq event stamp: 110918 hardirqs last enabled at (110917): [] __up_console_sem kernel/printk/printk.c:344 [inline] hardirqs last enabled at (110917): [] __console_unlock+0x70/0xc4 kernel/printk/printk.c:2869 hardirqs last disabled at (110918): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:488 softirqs last enabled at (110438): [] softirq_handle_end kernel/softirq.c:407 [inline] softirqs last enabled at (110438): [] handle_softirqs+0xb44/0xd34 kernel/softirq.c:589 softirqs last disabled at (110433): [] __do_softirq+0x14/0x20 kernel/softirq.c:595 ---[ end trace 0000000000000000 ]--- smsusb:smsusb_start_streaming: smsusb_submit_urb(...) failed smsusb:smsusb_init_device: smsusb_start_streaming(...) failed ------------[ cut here ]------------ WARNING: CPU: 0 PID: 10 at mm/slub.c:4723 free_large_kmalloc+0x34/0x188 mm/slub.c:4724 Modules linked in: CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Tainted: G W 6.13.0-rc3-syzkaller-g573067a5a685 #0 Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: usb_hub_wq hub_event pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : free_large_kmalloc+0x34/0x188 mm/slub.c:4724 lr : kfree+0x25c/0x478 mm/slub.c:4755 sp : ffff800097a76830 x29: ffff800097a76830 x28: ffff0000c304a000 x27: ffff0000c19e1e40 x26: 1fffe00018609401 x25: 00000000000003f0 x24: 1fffe0001a9f8e1e x23: dfff800000000000 x22: ffff0000dcd62000 x21: ffff800080b49da0 x20: ffff0000dcd62000 x19: fffffdffc3735880 x18: ffff800097a760e0 x17: 000000000000e3ed x16: ffff800083275834 x15: 0000000000000001 x14: 1fffe00018479560 x13: 0000000000000000 x12: 0000000000000000 x11: ffff600018479561 x10: 0000000000ff0100 x9 : 00003c0003735880 x8 : ffff800092c5e000 x7 : ffff800086978c44 x6 : ffff800086968d84 x5 : ffff0000c1ffe4c8 x4 : ffff800097a766b8 x3 : ffff80008698dcb4 x2 : 0000000000000001 x1 : ffff0000dcd62000 x0 : fffffdffc3735880 Call trace: free_large_kmalloc+0x34/0x188 mm/slub.c:4724 (P) kfree+0x25c/0x478 mm/slub.c:4755 urb_destroy drivers/usb/core/urb.c:25 [inline] kref_put include/linux/kref.h:65 [inline] usb_free_urb+0xd0/0x140 drivers/usb/core/urb.c:97 smsusb_term_device+0x1ac/0x32c drivers/media/usb/siano/smsusb.c:352 smsusb_init_device drivers/media/usb/siano/smsusb.c:497 [inline] smsusb_probe+0x1640/0x1bd8 drivers/media/usb/siano/smsusb.c:575 usb_probe_interface+0x598/0xa40 drivers/usb/core/driver.c:396 really_probe+0x38c/0x8fc drivers/base/dd.c:658 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800 driver_probe_device+0x78/0x330 drivers/base/dd.c:830 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:459 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079 bus_probe_device+0x178/0x240 drivers/base/bus.c:534 device_add+0x728/0xa6c drivers/base/core.c:3665 usb_set_configuration+0x15cc/0x1b38 drivers/usb/core/message.c:2210 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:254 usb_probe_device+0x1a4/0x348 drivers/usb/core/driver.c:291 really_probe+0x38c/0x8fc drivers/base/dd.c:658 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800 driver_probe_device+0x78/0x330 drivers/base/dd.c:830 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:459 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079 bus_probe_device+0x178/0x240 drivers/base/bus.c:534 device_add+0x728/0xa6c drivers/base/core.c:3665 usb_new_device+0x908/0x149c drivers/usb/core/hub.c:2651 hub_port_connect drivers/usb/core/hub.c:5521 [inline] hub_port_connect_change drivers/usb/core/hub.c:5661 [inline] port_event drivers/usb/core/hub.c:5821 [inline] hub_event+0x2454/0x4280 drivers/usb/core/hub.c:5903 process_one_work+0x7a8/0x15cc kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x97c/0xeec kernel/workqueue.c:3391 kthread+0x288/0x310 kernel/kthread.c:389 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862 irq event stamp: 111460 hardirqs last enabled at (111459): [] kasan_quarantine_put+0x1a0/0x1c8 mm/kasan/quarantine.c:234 hardirqs last disabled at (111460): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:488 softirqs last enabled at (110984): [] softirq_handle_end kernel/softirq.c:407 [inline] softirqs last enabled at (110984): [] handle_softirqs+0xb44/0xd34 kernel/softirq.c:589 softirqs last disabled at (110975): [] __do_softirq+0x14/0x20 kernel/softirq.c:595 ---[ end trace 0000000000000000 ]--- object pointer: 0x00000000d2f1f08c ================================================================== BUG: KASAN: double-free in kfree+0x25c/0x478 mm/slub.c:4755 Free of addr ffff0000dcd62000 by task kworker/0:1/10 CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Tainted: G W 6.13.0-rc3-syzkaller-g573067a5a685 #0 Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: usb_hub_wq hub_event Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C) __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x198/0x538 mm/kasan/report.c:489 kasan_report_invalid_free+0xc4/0x118 mm/kasan/report.c:564 check_page_allocation+0x1d8/0x2a8 __kasan_kfree_large+0x10/0x1c mm/kasan/common.c:303 kasan_kfree_large include/linux/kasan.h:241 [inline] free_large_kmalloc+0x64/0x188 mm/slub.c:4727 kfree+0x25c/0x478 mm/slub.c:4755 urb_destroy drivers/usb/core/urb.c:25 [inline] kref_put include/linux/kref.h:65 [inline] usb_free_urb+0xd0/0x140 drivers/usb/core/urb.c:97 smsusb_term_device+0x1ac/0x32c drivers/media/usb/siano/smsusb.c:352 smsusb_init_device drivers/media/usb/siano/smsusb.c:497 [inline] smsusb_probe+0x1640/0x1bd8 drivers/media/usb/siano/smsusb.c:575 usb_probe_interface+0x598/0xa40 drivers/usb/core/driver.c:396 really_probe+0x38c/0x8fc drivers/base/dd.c:658 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800 driver_probe_device+0x78/0x330 drivers/base/dd.c:830 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:459 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079 bus_probe_device+0x178/0x240 drivers/base/bus.c:534 device_add+0x728/0xa6c drivers/base/core.c:3665 usb_set_configuration+0x15cc/0x1b38 drivers/usb/core/message.c:2210 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:254 usb_probe_device+0x1a4/0x348 drivers/usb/core/driver.c:291 really_probe+0x38c/0x8fc drivers/base/dd.c:658 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800 driver_probe_device+0x78/0x330 drivers/base/dd.c:830 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:459 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079 bus_probe_device+0x178/0x240 drivers/base/bus.c:534 device_add+0x728/0xa6c drivers/base/core.c:3665 usb_new_device+0x908/0x149c drivers/usb/core/hub.c:2651 hub_port_connect drivers/usb/core/hub.c:5521 [inline] hub_port_connect_change drivers/usb/core/hub.c:5661 [inline] port_event drivers/usb/core/hub.c:5821 [inline] hub_event+0x2454/0x4280 drivers/usb/core/hub.c:5903 process_one_work+0x7a8/0x15cc kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x97c/0xeec kernel/workqueue.c:3391 kthread+0x288/0x310 kernel/kthread.c:389 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862 The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11cd62 flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 0000000000000000 fffffdffc3735888 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000dcd61f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff0000dcd61f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff0000dcd62000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff0000dcd62080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff0000dcd62100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11cd62 flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 0000000000000000 fffffdffc3735888 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0) ------------[ cut here ]------------ kernel BUG at ./include/linux/mm.h:1152! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Tainted: G B W 6.13.0-rc3-syzkaller-g573067a5a685 #0 Tainted: [B]=BAD_PAGE, [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: usb_hub_wq hub_event pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : put_page_testzero include/linux/mm.h:1152 [inline] pc : folio_put_testzero include/linux/mm.h:1158 [inline] pc : folio_put include/linux/mm.h:1487 [inline] pc : free_large_kmalloc+0x158/0x188 mm/slub.c:4732 lr : put_page_testzero include/linux/mm.h:1152 [inline] lr : folio_put_testzero include/linux/mm.h:1158 [inline] lr : folio_put include/linux/mm.h:1487 [inline] lr : free_large_kmalloc+0x158/0x188 mm/slub.c:4732 sp : ffff800097a76830 x29: ffff800097a76830 x28: ffff0000c304a000 x27: ffff0000c19e1e40 x26: 1fffe00018609401 x25: 00000000000003f0 x24: 1fffe0001a9f8e1e x23: dfff800000000000 x22: 0000000000000000 x21: 0000000000000000 x20: fffffffffffff000 x19: fffffdffc3735880 x18: 0000000000000008 x17: 0000000000000000 x16: ffff800083275834 x15: 0000000000000001 x14: 1fffe000366fc2ea x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000001 x10: 0000000000ff0100 x9 : 4c2ddb16bd3ca900 x8 : 4c2ddb16bd3ca900 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff800097a75d18 x4 : ffff80008fa8f840 x3 : ffff80008073f2fc x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000003e Call trace: put_page_testzero include/linux/mm.h:1152 [inline] (P) folio_put_testzero include/linux/mm.h:1158 [inline] (P) folio_put include/linux/mm.h:1487 [inline] (P) free_large_kmalloc+0x158/0x188 mm/slub.c:4732 (P) kfree+0x25c/0x478 mm/slub.c:4755 urb_destroy drivers/usb/core/urb.c:25 [inline] kref_put include/linux/kref.h:65 [inline] usb_free_urb+0xd0/0x140 drivers/usb/core/urb.c:97 smsusb_term_device+0x1ac/0x32c drivers/media/usb/siano/smsusb.c:352 smsusb_init_device drivers/media/usb/siano/smsusb.c:497 [inline] smsusb_probe+0x1640/0x1bd8 drivers/media/usb/siano/smsusb.c:575 usb_probe_interface+0x598/0xa40 drivers/usb/core/driver.c:396 really_probe+0x38c/0x8fc drivers/base/dd.c:658 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800 driver_probe_device+0x78/0x330 drivers/base/dd.c:830 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:459 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079 bus_probe_device+0x178/0x240 drivers/base/bus.c:534 device_add+0x728/0xa6c drivers/base/core.c:3665 usb_set_configuration+0x15cc/0x1b38 drivers/usb/core/message.c:2210 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:254 usb_probe_device+0x1a4/0x348 drivers/usb/core/driver.c:291 really_probe+0x38c/0x8fc drivers/base/dd.c:658 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800 driver_probe_device+0x78/0x330 drivers/base/dd.c:830 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:459 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079 bus_probe_device+0x178/0x240 drivers/base/bus.c:534 device_add+0x728/0xa6c drivers/base/core.c:3665 usb_new_device+0x908/0x149c drivers/usb/core/hub.c:2651 hub_port_connect drivers/usb/core/hub.c:5521 [inline] hub_port_connect_change drivers/usb/core/hub.c:5661 [inline] port_event drivers/usb/core/hub.c:5821 [inline] hub_event+0x2454/0x4280 drivers/usb/core/hub.c:5903 process_one_work+0x7a8/0x15cc kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x97c/0xeec kernel/workqueue.c:3391 kthread+0x288/0x310 kernel/kthread.c:389 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862 Code: b0071f41 911d7421 aa1303e0 97fc23ab (d4210000) ---[ end trace 0000000000000000 ]--- final repro crashed as (corrupted=false): smsusb:smsusb_probe: board id=8, interface number 0 smsusb:siano_media_device_register: media controller created ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 10 at drivers/usb/core/urb.c:504 usb_submit_urb+0xa00/0x148c drivers/usb/core/urb.c:503 Modules linked in: CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.13.0-rc3-syzkaller-g573067a5a685 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: usb_hub_wq hub_event pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0xa00/0x148c drivers/usb/core/urb.c:503 lr : usb_submit_urb+0xa00/0x148c drivers/usb/core/urb.c:503 sp : ffff800097a76800 x29: ffff800097a76840 x28: ffff0000d4fc6000 x27: 0000000000000003 x26: ffff80008cf76b4c x25: ffff0000c2401120 x24: ffff0000c23cab50 x23: ffff80008cf7d8c0 x22: dfff800000000000 x21: 0000000000000003 x20: 0000000000000820 x19: ffff0000c23cab00 x18: 0000000000000008 x17: 0000000000000000 x16: ffff800083275834 x15: 0000000000000001 x14: 1fffe000366fc2ea x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000002 x10: 0000000000ff0100 x9 : 4c2ddb16bd3ca900 x8 : 4c2ddb16bd3ca900 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff800097a75f38 x4 : ffff80008fa8f840 x3 : ffff80008073f2fc x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000000 Call trace: usb_submit_urb+0xa00/0x148c drivers/usb/core/urb.c:503 (P) smsusb_submit_urb+0x220/0x310 drivers/media/usb/siano/smsusb.c:173 smsusb_start_streaming+0x30/0x2e0 drivers/media/usb/siano/smsusb.c:197 smsusb_init_device drivers/media/usb/siano/smsusb.c:477 [inline] smsusb_probe+0x15a8/0x1bd8 drivers/media/usb/siano/smsusb.c:575 usb_probe_interface+0x598/0xa40 drivers/usb/core/driver.c:396 really_probe+0x38c/0x8fc drivers/base/dd.c:658 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800 driver_probe_device+0x78/0x330 drivers/base/dd.c:830 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:459 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079 bus_probe_device+0x178/0x240 drivers/base/bus.c:534 device_add+0x728/0xa6c drivers/base/core.c:3665 usb_set_configuration+0x15cc/0x1b38 drivers/usb/core/message.c:2210 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:254 usb_probe_device+0x1a4/0x348 drivers/usb/core/driver.c:291 really_probe+0x38c/0x8fc drivers/base/dd.c:658 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800 driver_probe_device+0x78/0x330 drivers/base/dd.c:830 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:459 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079 bus_probe_device+0x178/0x240 drivers/base/bus.c:534 device_add+0x728/0xa6c drivers/base/core.c:3665 usb_new_device+0x908/0x149c drivers/usb/core/hub.c:2651 hub_port_connect drivers/usb/core/hub.c:5521 [inline] hub_port_connect_change drivers/usb/core/hub.c:5661 [inline] port_event drivers/usb/core/hub.c:5821 [inline] hub_event+0x2454/0x4280 drivers/usb/core/hub.c:5903 process_one_work+0x7a8/0x15cc kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x97c/0xeec kernel/workqueue.c:3391 kthread+0x288/0x310 kernel/kthread.c:389 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862 irq event stamp: 110918 hardirqs last enabled at (110917): [] __up_console_sem kernel/printk/printk.c:344 [inline] hardirqs last enabled at (110917): [] __console_unlock+0x70/0xc4 kernel/printk/printk.c:2869 hardirqs last disabled at (110918): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:488 softirqs last enabled at (110438): [] softirq_handle_end kernel/softirq.c:407 [inline] softirqs last enabled at (110438): [] handle_softirqs+0xb44/0xd34 kernel/softirq.c:589 softirqs last disabled at (110433): [] __do_softirq+0x14/0x20 kernel/softirq.c:595 ---[ end trace 0000000000000000 ]--- smsusb:smsusb_start_streaming: smsusb_submit_urb(...) failed smsusb:smsusb_init_device: smsusb_start_streaming(...) failed ------------[ cut here ]------------ WARNING: CPU: 0 PID: 10 at mm/slub.c:4723 free_large_kmalloc+0x34/0x188 mm/slub.c:4724 Modules linked in: CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Tainted: G W 6.13.0-rc3-syzkaller-g573067a5a685 #0 Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: usb_hub_wq hub_event pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : free_large_kmalloc+0x34/0x188 mm/slub.c:4724 lr : kfree+0x25c/0x478 mm/slub.c:4755 sp : ffff800097a76830 x29: ffff800097a76830 x28: ffff0000c304a000 x27: ffff0000c19e1e40 x26: 1fffe00018609401 x25: 00000000000003f0 x24: 1fffe0001a9f8e1e x23: dfff800000000000 x22: ffff0000dcd62000 x21: ffff800080b49da0 x20: ffff0000dcd62000 x19: fffffdffc3735880 x18: ffff800097a760e0 x17: 000000000000e3ed x16: ffff800083275834 x15: 0000000000000001 x14: 1fffe00018479560 x13: 0000000000000000 x12: 0000000000000000 x11: ffff600018479561 x10: 0000000000ff0100 x9 : 00003c0003735880 x8 : ffff800092c5e000 x7 : ffff800086978c44 x6 : ffff800086968d84 x5 : ffff0000c1ffe4c8 x4 : ffff800097a766b8 x3 : ffff80008698dcb4 x2 : 0000000000000001 x1 : ffff0000dcd62000 x0 : fffffdffc3735880 Call trace: free_large_kmalloc+0x34/0x188 mm/slub.c:4724 (P) kfree+0x25c/0x478 mm/slub.c:4755 urb_destroy drivers/usb/core/urb.c:25 [inline] kref_put include/linux/kref.h:65 [inline] usb_free_urb+0xd0/0x140 drivers/usb/core/urb.c:97 smsusb_term_device+0x1ac/0x32c drivers/media/usb/siano/smsusb.c:352 smsusb_init_device drivers/media/usb/siano/smsusb.c:497 [inline] smsusb_probe+0x1640/0x1bd8 drivers/media/usb/siano/smsusb.c:575 usb_probe_interface+0x598/0xa40 drivers/usb/core/driver.c:396 really_probe+0x38c/0x8fc drivers/base/dd.c:658 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800 driver_probe_device+0x78/0x330 drivers/base/dd.c:830 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:459 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079 bus_probe_device+0x178/0x240 drivers/base/bus.c:534 device_add+0x728/0xa6c drivers/base/core.c:3665 usb_set_configuration+0x15cc/0x1b38 drivers/usb/core/message.c:2210 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:254 usb_probe_device+0x1a4/0x348 drivers/usb/core/driver.c:291 really_probe+0x38c/0x8fc drivers/base/dd.c:658 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800 driver_probe_device+0x78/0x330 drivers/base/dd.c:830 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:459 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079 bus_probe_device+0x178/0x240 drivers/base/bus.c:534 device_add+0x728/0xa6c drivers/base/core.c:3665 usb_new_device+0x908/0x149c drivers/usb/core/hub.c:2651 hub_port_connect drivers/usb/core/hub.c:5521 [inline] hub_port_connect_change drivers/usb/core/hub.c:5661 [inline] port_event drivers/usb/core/hub.c:5821 [inline] hub_event+0x2454/0x4280 drivers/usb/core/hub.c:5903 process_one_work+0x7a8/0x15cc kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x97c/0xeec kernel/workqueue.c:3391 kthread+0x288/0x310 kernel/kthread.c:389 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862 irq event stamp: 111460 hardirqs last enabled at (111459): [] kasan_quarantine_put+0x1a0/0x1c8 mm/kasan/quarantine.c:234 hardirqs last disabled at (111460): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:488 softirqs last enabled at (110984): [] softirq_handle_end kernel/softirq.c:407 [inline] softirqs last enabled at (110984): [] handle_softirqs+0xb44/0xd34 kernel/softirq.c:589 softirqs last disabled at (110975): [] __do_softirq+0x14/0x20 kernel/softirq.c:595 ---[ end trace 0000000000000000 ]--- object pointer: 0x00000000d2f1f08c ================================================================== BUG: KASAN: double-free in kfree+0x25c/0x478 mm/slub.c:4755 Free of addr ffff0000dcd62000 by task kworker/0:1/10 CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Tainted: G W 6.13.0-rc3-syzkaller-g573067a5a685 #0 Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: usb_hub_wq hub_event Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C) __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x198/0x538 mm/kasan/report.c:489 kasan_report_invalid_free+0xc4/0x118 mm/kasan/report.c:564 check_page_allocation+0x1d8/0x2a8 __kasan_kfree_large+0x10/0x1c mm/kasan/common.c:303 kasan_kfree_large include/linux/kasan.h:241 [inline] free_large_kmalloc+0x64/0x188 mm/slub.c:4727 kfree+0x25c/0x478 mm/slub.c:4755 urb_destroy drivers/usb/core/urb.c:25 [inline] kref_put include/linux/kref.h:65 [inline] usb_free_urb+0xd0/0x140 drivers/usb/core/urb.c:97 smsusb_term_device+0x1ac/0x32c drivers/media/usb/siano/smsusb.c:352 smsusb_init_device drivers/media/usb/siano/smsusb.c:497 [inline] smsusb_probe+0x1640/0x1bd8 drivers/media/usb/siano/smsusb.c:575 usb_probe_interface+0x598/0xa40 drivers/usb/core/driver.c:396 really_probe+0x38c/0x8fc drivers/base/dd.c:658 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800 driver_probe_device+0x78/0x330 drivers/base/dd.c:830 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:459 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079 bus_probe_device+0x178/0x240 drivers/base/bus.c:534 device_add+0x728/0xa6c drivers/base/core.c:3665 usb_set_configuration+0x15cc/0x1b38 drivers/usb/core/message.c:2210 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:254 usb_probe_device+0x1a4/0x348 drivers/usb/core/driver.c:291 really_probe+0x38c/0x8fc drivers/base/dd.c:658 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800 driver_probe_device+0x78/0x330 drivers/base/dd.c:830 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:459 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079 bus_probe_device+0x178/0x240 drivers/base/bus.c:534 device_add+0x728/0xa6c drivers/base/core.c:3665 usb_new_device+0x908/0x149c drivers/usb/core/hub.c:2651 hub_port_connect drivers/usb/core/hub.c:5521 [inline] hub_port_connect_change drivers/usb/core/hub.c:5661 [inline] port_event drivers/usb/core/hub.c:5821 [inline] hub_event+0x2454/0x4280 drivers/usb/core/hub.c:5903 process_one_work+0x7a8/0x15cc kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x97c/0xeec kernel/workqueue.c:3391 kthread+0x288/0x310 kernel/kthread.c:389 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862 The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11cd62 flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 0000000000000000 fffffdffc3735888 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000dcd61f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff0000dcd61f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff0000dcd62000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff0000dcd62080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff0000dcd62100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11cd62 flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 0000000000000000 fffffdffc3735888 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0) ------------[ cut here ]------------ kernel BUG at ./include/linux/mm.h:1152! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Tainted: G B W 6.13.0-rc3-syzkaller-g573067a5a685 #0 Tainted: [B]=BAD_PAGE, [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: usb_hub_wq hub_event pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : put_page_testzero include/linux/mm.h:1152 [inline] pc : folio_put_testzero include/linux/mm.h:1158 [inline] pc : folio_put include/linux/mm.h:1487 [inline] pc : free_large_kmalloc+0x158/0x188 mm/slub.c:4732 lr : put_page_testzero include/linux/mm.h:1152 [inline] lr : folio_put_testzero include/linux/mm.h:1158 [inline] lr : folio_put include/linux/mm.h:1487 [inline] lr : free_large_kmalloc+0x158/0x188 mm/slub.c:4732 sp : ffff800097a76830 x29: ffff800097a76830 x28: ffff0000c304a000 x27: ffff0000c19e1e40 x26: 1fffe00018609401 x25: 00000000000003f0 x24: 1fffe0001a9f8e1e x23: dfff800000000000 x22: 0000000000000000 x21: 0000000000000000 x20: fffffffffffff000 x19: fffffdffc3735880 x18: 0000000000000008 x17: 0000000000000000 x16: ffff800083275834 x15: 0000000000000001 x14: 1fffe000366fc2ea x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000001 x10: 0000000000ff0100 x9 : 4c2ddb16bd3ca900 x8 : 4c2ddb16bd3ca900 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff800097a75d18 x4 : ffff80008fa8f840 x3 : ffff80008073f2fc x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000003e Call trace: put_page_testzero include/linux/mm.h:1152 [inline] (P) folio_put_testzero include/linux/mm.h:1158 [inline] (P) folio_put include/linux/mm.h:1487 [inline] (P) free_large_kmalloc+0x158/0x188 mm/slub.c:4732 (P) kfree+0x25c/0x478 mm/slub.c:4755 urb_destroy drivers/usb/core/urb.c:25 [inline] kref_put include/linux/kref.h:65 [inline] usb_free_urb+0xd0/0x140 drivers/usb/core/urb.c:97 smsusb_term_device+0x1ac/0x32c drivers/media/usb/siano/smsusb.c:352 smsusb_init_device drivers/media/usb/siano/smsusb.c:497 [inline] smsusb_probe+0x1640/0x1bd8 drivers/media/usb/siano/smsusb.c:575 usb_probe_interface+0x598/0xa40 drivers/usb/core/driver.c:396 really_probe+0x38c/0x8fc drivers/base/dd.c:658 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800 driver_probe_device+0x78/0x330 drivers/base/dd.c:830 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:459 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079 bus_probe_device+0x178/0x240 drivers/base/bus.c:534 device_add+0x728/0xa6c drivers/base/core.c:3665 usb_set_configuration+0x15cc/0x1b38 drivers/usb/core/message.c:2210 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:254 usb_probe_device+0x1a4/0x348 drivers/usb/core/driver.c:291 really_probe+0x38c/0x8fc drivers/base/dd.c:658 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800 driver_probe_device+0x78/0x330 drivers/base/dd.c:830 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:459 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079 bus_probe_device+0x178/0x240 drivers/base/bus.c:534 device_add+0x728/0xa6c drivers/base/core.c:3665 usb_new_device+0x908/0x149c drivers/usb/core/hub.c:2651 hub_port_connect drivers/usb/core/hub.c:5521 [inline] hub_port_connect_change drivers/usb/core/hub.c:5661 [inline] port_event drivers/usb/core/hub.c:5821 [inline] hub_event+0x2454/0x4280 drivers/usb/core/hub.c:5903 process_one_work+0x7a8/0x15cc kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x97c/0xeec kernel/workqueue.c:3391 kthread+0x288/0x310 kernel/kthread.c:389 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862 Code: b0071f41 911d7421 aa1303e0 97fc23ab (d4210000) ---[ end trace 0000000000000000 ]---