smsusb:smsusb_probe: board id=8, interface number 0 smsusb:siano_media_device_register: media controller created ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 1 PID: 6522 at drivers/usb/core/urb.c:504 usb_submit_urb+0xa00/0x1434 drivers/usb/core/urb.c:503 Modules linked in: CPU: 1 UID: 0 PID: 6522 Comm: kworker/1:4 Not tainted 6.14.0-rc5-syzkaller-g77c95b8c7a16 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Workqueue: usb_hub_wq hub_event pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0xa00/0x1434 drivers/usb/core/urb.c:503 lr : usb_submit_urb+0xa00/0x1434 drivers/usb/core/urb.c:503 sp : ffff8000a1606780 x29: ffff8000a16067c0 x28: ffff0000c6a83000 x27: 0000000000000003 x26: ffff80008d0f8d8c x25: ffff0000c9c53120 x24: ffff0000c1dd4150 x23: ffff80008d0ffca0 x22: dfff800000000000 x21: 0000000000000003 x20: 0000000000000820 x19: ffff0000c1dd4100 x18: 1fffe000366f6086 x17: ffff80008fbbd000 x16: ffff8000804696fc x15: 0000000000000001 x14: 1fffe000366f8af0 x13: ffff8000a1608000 x12: 0000000000000003 x11: 0000000000000001 x10: 0000000000000003 x9 : f6a4130d537f8c00 x8 : f6a4130d537f8c00 x7 : ffff8000803d4bfc x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000001 x3 : 0000000000000000 x2 : 0000000000000006 x1 : ffff80008b87a5a0 x0 : ffff800123ca8000 Call trace: usb_submit_urb+0xa00/0x1434 drivers/usb/core/urb.c:503 (P) smsusb_submit_urb+0x220/0x310 drivers/media/usb/siano/smsusb.c:173 smsusb_start_streaming+0x30/0x2e0 drivers/media/usb/siano/smsusb.c:197 smsusb_init_device drivers/media/usb/siano/smsusb.c:477 [inline] smsusb_probe+0x15cc/0x1bfc drivers/media/usb/siano/smsusb.c:575 usb_probe_interface+0x598/0xa40 drivers/usb/core/driver.c:396 really_probe+0x38c/0x8fc drivers/base/dd.c:658 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800 driver_probe_device+0x78/0x330 drivers/base/dd.c:830 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:462 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079 bus_probe_device+0x178/0x240 drivers/base/bus.c:537 device_add+0x728/0xa6c drivers/base/core.c:3665 usb_set_configuration+0x15cc/0x1b38 drivers/usb/core/message.c:2210 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:250 usb_probe_device+0x1a4/0x348 drivers/usb/core/driver.c:291 really_probe+0x38c/0x8fc drivers/base/dd.c:658 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800 driver_probe_device+0x78/0x330 drivers/base/dd.c:830 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:462 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079 bus_probe_device+0x178/0x240 drivers/base/bus.c:537 device_add+0x728/0xa6c drivers/base/core.c:3665 usb_new_device+0x908/0x14ac drivers/usb/core/hub.c:2663 hub_port_connect drivers/usb/core/hub.c:5533 [inline] hub_port_connect_change drivers/usb/core/hub.c:5673 [inline] port_event drivers/usb/core/hub.c:5833 [inline] hub_event+0x2454/0x4280 drivers/usb/core/hub.c:5915 process_one_work+0x810/0x1638 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x97c/0xeec kernel/workqueue.c:3400 kthread+0x65c/0x7b0 kernel/kthread.c:464 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862 irq event stamp: 65866 hardirqs last enabled at (65865): [] raw_spin_rq_unlock_irq kernel/sched/sched.h:1533 [inline] hardirqs last enabled at (65865): [] finish_lock_switch+0xbc/0x1e4 kernel/sched/core.c:5132 hardirqs last disabled at (65866): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:488 softirqs last enabled at (65842): [] softirq_handle_end kernel/softirq.c:407 [inline] softirqs last enabled at (65842): [] handle_softirqs+0xb44/0xd34 kernel/softirq.c:589 softirqs last disabled at (65825): [] __do_softirq+0x14/0x20 kernel/softirq.c:595 ---[ end trace 0000000000000000 ]--- smsusb:smsusb_start_streaming: smsusb_submit_urb(...) failed smsusb:smsusb_init_device: smsusb_start_streaming(...) failed ------------[ cut here ]------------ WARNING: CPU: 1 PID: 6522 at mm/slub.c:4719 free_large_kmalloc+0x34/0x188 mm/slub.c:4720 Modules linked in: CPU: 1 UID: 0 PID: 6522 Comm: kworker/1:4 Tainted: G W 6.14.0-rc5-syzkaller-g77c95b8c7a16 #0 Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Workqueue: usb_hub_wq hub_event pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : free_large_kmalloc+0x34/0x188 mm/slub.c:4720 lr : kfree+0x25c/0x478 mm/slub.c:4751 sp : ffff8000a16067b0 x29: ffff8000a16067b0 x28: ffff0000d756e000 x27: ffff0000d06cdb80 x26: 1fffe0001aeadc01 x25: 00000000000003f0 x24: 1fffe0001a16881e x23: dfff800000000000 x22: ffff0000dc762000 x21: ffff800080b51ec4 x20: ffff0000dc762000 x19: fffffdffc371d880 x18: ffff8000a1606060 x17: 00000000000131cd x16: ffff8000832b8f3c x15: 0000000000000001 x14: 1fffe000183ba820 x13: 0000000000000000 x12: 0000000000000000 x11: ffff6000183ba821 x10: 0000000000ff0100 x9 : 00003c000371d880 x8 : ffff800092f09000 x7 : ffff800086a3ade4 x6 : ffff800086a2ae80 x5 : ffff0000e7f66de8 x4 : ffff8000a1606638 x3 : ffff800086a4ff60 x2 : 0000000000000001 x1 : ffff0000dc762000 x0 : fffffdffc371d880 Call trace: free_large_kmalloc+0x34/0x188 mm/slub.c:4720 (P) kfree+0x25c/0x478 mm/slub.c:4751 urb_destroy drivers/usb/core/urb.c:25 [inline] kref_put include/linux/kref.h:65 [inline] usb_free_urb+0xd0/0x140 drivers/usb/core/urb.c:97 smsusb_term_device+0x1ac/0x32c drivers/media/usb/siano/smsusb.c:352 smsusb_init_device drivers/media/usb/siano/smsusb.c:497 [inline] smsusb_probe+0x1664/0x1bfc drivers/media/usb/siano/smsusb.c:575 usb_probe_interface+0x598/0xa40 drivers/usb/core/driver.c:396 really_probe+0x38c/0x8fc drivers/base/dd.c:658 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800 driver_probe_device+0x78/0x330 drivers/base/dd.c:830 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:462 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079 bus_probe_device+0x178/0x240 drivers/base/bus.c:537 device_add+0x728/0xa6c drivers/base/core.c:3665 usb_set_configuration+0x15cc/0x1b38 drivers/usb/core/message.c:2210 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:250 usb_probe_device+0x1a4/0x348 drivers/usb/core/driver.c:291 really_probe+0x38c/0x8fc drivers/base/dd.c:658 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800 driver_probe_device+0x78/0x330 drivers/base/dd.c:830 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:462 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079 bus_probe_device+0x178/0x240 drivers/base/bus.c:537 device_add+0x728/0xa6c drivers/base/core.c:3665 usb_new_device+0x908/0x14ac drivers/usb/core/hub.c:2663 hub_port_connect drivers/usb/core/hub.c:5533 [inline] hub_port_connect_change drivers/usb/core/hub.c:5673 [inline] port_event drivers/usb/core/hub.c:5833 [inline] hub_event+0x2454/0x4280 drivers/usb/core/hub.c:5915 process_one_work+0x810/0x1638 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x97c/0xeec kernel/workqueue.c:3400 kthread+0x65c/0x7b0 kernel/kthread.c:464 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862 irq event stamp: 66658 hardirqs last enabled at (66657): [] kasan_quarantine_put+0x1a0/0x1c8 mm/kasan/quarantine.c:234 hardirqs last disabled at (66658): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:488 softirqs last enabled at (66180): [] softirq_handle_end kernel/softirq.c:407 [inline] softirqs last enabled at (66180): [] handle_softirqs+0xb44/0xd34 kernel/softirq.c:589 softirqs last disabled at (66061): [] __do_softirq+0x14/0x20 kernel/softirq.c:595 ---[ end trace 0000000000000000 ]--- object pointer: 0x000000001a5a6ce4 ================================================================== BUG: KASAN: double-free in kfree+0x25c/0x478 mm/slub.c:4751 Free of addr ffff0000dc762000 by task kworker/1:4/6522 CPU: 1 UID: 0 PID: 6522 Comm: kworker/1:4 Tainted: G W 6.14.0-rc5-syzkaller-g77c95b8c7a16 #0 Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Workqueue: usb_hub_wq hub_event Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C) __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0x198/0x550 mm/kasan/report.c:521 kasan_report_invalid_free+0xc4/0x118 mm/kasan/report.c:596 check_page_allocation+0x1d8/0x2a8 __kasan_kfree_large+0x10/0x1c mm/kasan/common.c:303 kasan_kfree_large include/linux/kasan.h:241 [inline] free_large_kmalloc+0x64/0x188 mm/slub.c:4723 kfree+0x25c/0x478 mm/slub.c:4751 urb_destroy drivers/usb/core/urb.c:25 [inline] kref_put include/linux/kref.h:65 [inline] usb_free_urb+0xd0/0x140 drivers/usb/core/urb.c:97 smsusb_term_device+0x1ac/0x32c drivers/media/usb/siano/smsusb.c:352 smsusb_init_device drivers/media/usb/siano/smsusb.c:497 [inline] smsusb_probe+0x1664/0x1bfc drivers/media/usb/siano/smsusb.c:575 usb_probe_interface+0x598/0xa40 drivers/usb/core/driver.c:396 really_probe+0x38c/0x8fc drivers/base/dd.c:658 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800 driver_probe_device+0x78/0x330 drivers/base/dd.c:830 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:462 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079 bus_probe_device+0x178/0x240 drivers/base/bus.c:537 device_add+0x728/0xa6c drivers/base/core.c:3665 usb_set_configuration+0x15cc/0x1b38 drivers/usb/core/message.c:2210 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:250 usb_probe_device+0x1a4/0x348 drivers/usb/core/driver.c:291 really_probe+0x38c/0x8fc drivers/base/dd.c:658 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800 driver_probe_device+0x78/0x330 drivers/base/dd.c:830 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:462 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079 bus_probe_device+0x178/0x240 drivers/base/bus.c:537 device_add+0x728/0xa6c drivers/base/core.c:3665 usb_new_device+0x908/0x14ac drivers/usb/core/hub.c:2663 hub_port_connect drivers/usb/core/hub.c:5533 [inline] hub_port_connect_change drivers/usb/core/hub.c:5673 [inline] port_event drivers/usb/core/hub.c:5833 [inline] hub_event+0x2454/0x4280 drivers/usb/core/hub.c:5915 process_one_work+0x810/0x1638 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x97c/0xeec kernel/workqueue.c:3400 kthread+0x65c/0x7b0 kernel/kthread.c:464 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862 The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff0000dc762f50 pfn:0x11c762 flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 0000000000000000 dead000000000122 0000000000000000 raw: ffff0000dc762f50 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000dc761f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff0000dc761f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff0000dc762000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff0000dc762080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff0000dc762100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff0000dc762f50 pfn:0x11c762 flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 0000000000000000 dead000000000122 0000000000000000 raw: ffff0000dc762f50 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0) ------------[ cut here ]------------ kernel BUG at ./include/linux/mm.h:1153! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 1 UID: 0 PID: 6522 Comm: kworker/1:4 Tainted: G B W 6.14.0-rc5-syzkaller-g77c95b8c7a16 #0 Tainted: [B]=BAD_PAGE, [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Workqueue: usb_hub_wq hub_event pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : put_page_testzero include/linux/mm.h:1153 [inline] pc : folio_put_testzero include/linux/mm.h:1159 [inline] pc : folio_put include/linux/mm.h:1488 [inline] pc : free_large_kmalloc+0x158/0x188 mm/slub.c:4728 lr : put_page_testzero include/linux/mm.h:1153 [inline] lr : folio_put_testzero include/linux/mm.h:1159 [inline] lr : folio_put include/linux/mm.h:1488 [inline] lr : free_large_kmalloc+0x158/0x188 mm/slub.c:4728 sp : ffff8000a16067b0 x29: ffff8000a16067b0 x28: ffff0000d756e000 x27: ffff0000d06cdb80 x26: 1fffe0001aeadc01 x25: 00000000000003f0 x24: 1fffe0001a16881e x23: dfff800000000000 x22: 0000000000000000 x21: 0000000000000000 x20: fffffffffffff000 x19: fffffdffc371d880 x18: 0000000000000008 x17: 0000000000000000 x16: ffff8000832b8f3c x15: 0000000000000001 x14: 1ffff000142c0c04 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000001 x10: 0000000000ff0100 x9 : f6a4130d537f8c00 x8 : f6a4130d537f8c00 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff8000a1605d18 x4 : ffff80008fcaf7c0 x3 : ffff80008324af54 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000003e Call trace: put_page_testzero include/linux/mm.h:1153 [inline] (P) folio_put_testzero include/linux/mm.h:1159 [inline] (P) folio_put include/linux/mm.h:1488 [inline] (P) free_large_kmalloc+0x158/0x188 mm/slub.c:4728 (P) kfree+0x25c/0x478 mm/slub.c:4751 urb_destroy drivers/usb/core/urb.c:25 [inline] kref_put include/linux/kref.h:65 [inline] usb_free_urb+0xd0/0x140 drivers/usb/core/urb.c:97 smsusb_term_device+0x1ac/0x32c drivers/media/usb/siano/smsusb.c:352 smsusb_init_device drivers/media/usb/siano/smsusb.c:497 [inline] smsusb_probe+0x1664/0x1bfc drivers/media/usb/siano/smsusb.c:575 usb_probe_interface+0x598/0xa40 drivers/usb/core/driver.c:396 really_probe+0x38c/0x8fc drivers/base/dd.c:658 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800 driver_probe_device+0x78/0x330 drivers/base/dd.c:830 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:462 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079 bus_probe_device+0x178/0x240 drivers/base/bus.c:537 device_add+0x728/0xa6c drivers/base/core.c:3665 usb_set_configuration+0x15cc/0x1b38 drivers/usb/core/message.c:2210 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:250 usb_probe_device+0x1a4/0x348 drivers/usb/core/driver.c:291 really_probe+0x38c/0x8fc drivers/base/dd.c:658 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800 driver_probe_device+0x78/0x330 drivers/base/dd.c:830 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:462 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079 bus_probe_device+0x178/0x240 drivers/base/bus.c:537 device_add+0x728/0xa6c drivers/base/core.c:3665 usb_new_device+0x908/0x14ac drivers/usb/core/hub.c:2663 hub_port_connect drivers/usb/core/hub.c:5533 [inline] hub_port_connect_change drivers/usb/core/hub.c:5673 [inline] port_event drivers/usb/core/hub.c:5833 [inline] hub_event+0x2454/0x4280 drivers/usb/core/hub.c:5915 process_one_work+0x810/0x1638 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x97c/0xeec kernel/workqueue.c:3400 kthread+0x65c/0x7b0 kernel/kthread.c:464 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862 Code: b0072ee1 913de821 aa1303e0 97fc21b3 (d4210000) ---[ end trace 0000000000000000 ]---