smsusb:smsusb_probe: board id=9, interface number 0 smsusb:siano_media_device_register: media controller created ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 2271 at drivers/usb/core/urb.c:504 usb_submit_urb+0xa00/0x1434 drivers/usb/core/urb.c:503 Modules linked in: CPU: 0 UID: 0 PID: 2271 Comm: kworker/0:2 Not tainted 6.14.0-rc5-syzkaller-00037-g77c95b8c7a16 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Workqueue: usb_hub_wq hub_event pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_submit_urb+0xa00/0x1434 drivers/usb/core/urb.c:503 lr : usb_submit_urb+0xa00/0x1434 drivers/usb/core/urb.c:503 sp : ffff8000a1876780 x29: ffff8000a18767c0 x28: ffff0000dad25000 x27: 0000000000000003 x26: ffff80008d0f8dac x25: ffff0000c267ab60 x24: ffff0000c4163a50 x23: ffff80008d0ffcc0 x22: dfff800000000000 x21: 0000000000000003 x20: 0000000000000820 x19: ffff0000c4163a00 x18: 1fffe000366f1886 x17: ffff80008fbbd000 x16: ffff8000804696fc x15: 0000000000000001 x14: 1fffe000366f42f0 x13: ffff8000a1878000 x12: 0000000000000003 x11: 0000000000000001 x10: 0000000000000003 x9 : 5c560b0e3511f500 x8 : 5c560b0e3511f500 x7 : ffff8000803d4bfc x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000001 x3 : 0000000000000000 x2 : 0000000000000006 x1 : ffff80008b87a5a0 x0 : ffff800123c84000 Call trace: usb_submit_urb+0xa00/0x1434 drivers/usb/core/urb.c:503 (P) smsusb_submit_urb+0x220/0x310 drivers/media/usb/siano/smsusb.c:173 smsusb_start_streaming+0x30/0x2e0 drivers/media/usb/siano/smsusb.c:197 smsusb_init_device drivers/media/usb/siano/smsusb.c:477 [inline] smsusb_probe+0x15cc/0x1bfc drivers/media/usb/siano/smsusb.c:575 usb_probe_interface+0x598/0xa40 drivers/usb/core/driver.c:396 really_probe+0x38c/0x8fc drivers/base/dd.c:658 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800 driver_probe_device+0x78/0x330 drivers/base/dd.c:830 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:462 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079 bus_probe_device+0x178/0x240 drivers/base/bus.c:537 device_add+0x728/0xa6c drivers/base/core.c:3665 usb_set_configuration+0x15cc/0x1b38 drivers/usb/core/message.c:2210 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:250 usb_probe_device+0x1a4/0x348 drivers/usb/core/driver.c:291 really_probe+0x38c/0x8fc drivers/base/dd.c:658 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800 driver_probe_device+0x78/0x330 drivers/base/dd.c:830 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:462 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079 bus_probe_device+0x178/0x240 drivers/base/bus.c:537 device_add+0x728/0xa6c drivers/base/core.c:3665 usb_new_device+0x908/0x14ac drivers/usb/core/hub.c:2663 hub_port_connect drivers/usb/core/hub.c:5533 [inline] hub_port_connect_change drivers/usb/core/hub.c:5673 [inline] port_event drivers/usb/core/hub.c:5833 [inline] hub_event+0x2454/0x4280 drivers/usb/core/hub.c:5915 process_one_work+0x810/0x1638 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x97c/0xeec kernel/workqueue.c:3400 kthread+0x65c/0x7b0 kernel/kthread.c:464 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862 irq event stamp: 104356 hardirqs last enabled at (104355): [] raw_spin_rq_unlock_irq kernel/sched/sched.h:1533 [inline] hardirqs last enabled at (104355): [] finish_lock_switch+0xbc/0x1e4 kernel/sched/core.c:5132 hardirqs last disabled at (104356): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:488 softirqs last enabled at (103736): [] softirq_handle_end kernel/softirq.c:407 [inline] softirqs last enabled at (103736): [] handle_softirqs+0xb44/0xd34 kernel/softirq.c:589 softirqs last disabled at (103727): [] __do_softirq+0x14/0x20 kernel/softirq.c:595 ---[ end trace 0000000000000000 ]--- smsusb:smsusb_start_streaming: smsusb_submit_urb(...) failed smsusb:smsusb_init_device: smsusb_start_streaming(...) failed ------------[ cut here ]------------ WARNING: CPU: 0 PID: 2271 at mm/slub.c:4719 free_large_kmalloc+0x34/0x188 mm/slub.c:4720 Modules linked in: CPU: 0 UID: 0 PID: 2271 Comm: kworker/0:2 Tainted: G W 6.14.0-rc5-syzkaller-00037-g77c95b8c7a16 #0 Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Workqueue: usb_hub_wq hub_event pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : free_large_kmalloc+0x34/0x188 mm/slub.c:4720 lr : kfree+0x25c/0x478 mm/slub.c:4751 sp : ffff8000a18767b0 x29: ffff8000a18767b0 x28: ffff0000de28b000 x27: ffff0000cd535b80 x26: 1fffe0001bc51601 x25: 00000000000003f0 x24: 1fffe0001bc5181e x23: dfff800000000000 x22: ffff0000e1ee2000 x21: ffff800080b51ec4 x20: ffff0000e1ee2000 x19: fffffdffc387b880 x18: ffff8000a1876060 x17: 000000000001316c x16: ffff8000832b8f3c x15: 0000000000000001 x14: 1fffe0001882c740 x13: 0000000000000000 x12: 0000000000000000 x11: ffff60001882c741 x10: 0000000000ff0100 x9 : 00003c000387b880 x8 : ffff800092f09000 x7 : ffff800086a3ade4 x6 : ffff800086a2ae80 x5 : ffff0000d1820c38 x4 : ffff8000a1876638 x3 : ffff800086a4ff60 x2 : 0000000000000001 x1 : ffff0000e1ee2000 x0 : fffffdffc387b880 Call trace: free_large_kmalloc+0x34/0x188 mm/slub.c:4720 (P) kfree+0x25c/0x478 mm/slub.c:4751 urb_destroy drivers/usb/core/urb.c:25 [inline] kref_put include/linux/kref.h:65 [inline] usb_free_urb+0xd0/0x140 drivers/usb/core/urb.c:97 smsusb_term_device+0x1ac/0x32c drivers/media/usb/siano/smsusb.c:352 smsusb_init_device drivers/media/usb/siano/smsusb.c:497 [inline] smsusb_probe+0x1664/0x1bfc drivers/media/usb/siano/smsusb.c:575 usb_probe_interface+0x598/0xa40 drivers/usb/core/driver.c:396 really_probe+0x38c/0x8fc drivers/base/dd.c:658 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800 driver_probe_device+0x78/0x330 drivers/base/dd.c:830 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:462 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079 bus_probe_device+0x178/0x240 drivers/base/bus.c:537 device_add+0x728/0xa6c drivers/base/core.c:3665 usb_set_configuration+0x15cc/0x1b38 drivers/usb/core/message.c:2210 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:250 usb_probe_device+0x1a4/0x348 drivers/usb/core/driver.c:291 really_probe+0x38c/0x8fc drivers/base/dd.c:658 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800 driver_probe_device+0x78/0x330 drivers/base/dd.c:830 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:462 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079 bus_probe_device+0x178/0x240 drivers/base/bus.c:537 device_add+0x728/0xa6c drivers/base/core.c:3665 usb_new_device+0x908/0x14ac drivers/usb/core/hub.c:2663 hub_port_connect drivers/usb/core/hub.c:5533 [inline] hub_port_connect_change drivers/usb/core/hub.c:5673 [inline] port_event drivers/usb/core/hub.c:5833 [inline] hub_event+0x2454/0x4280 drivers/usb/core/hub.c:5915 process_one_work+0x810/0x1638 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x97c/0xeec kernel/workqueue.c:3400 kthread+0x65c/0x7b0 kernel/kthread.c:464 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862 irq event stamp: 104974 hardirqs last enabled at (104973): [] kasan_quarantine_put+0x1a0/0x1c8 mm/kasan/quarantine.c:234 hardirqs last disabled at (104974): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:488 softirqs last enabled at (104460): [] softirq_handle_end kernel/softirq.c:407 [inline] softirqs last enabled at (104460): [] handle_softirqs+0xb44/0xd34 kernel/softirq.c:589 softirqs last disabled at (104359): [] __do_softirq+0x14/0x20 kernel/softirq.c:595 ---[ end trace 0000000000000000 ]--- object pointer: 0x000000006eb5fa59 ================================================================== BUG: KASAN: double-free in kfree+0x25c/0x478 mm/slub.c:4751 Free of addr ffff0000e1ee2000 by task kworker/0:2/2271 CPU: 0 UID: 0 PID: 2271 Comm: kworker/0:2 Tainted: G W 6.14.0-rc5-syzkaller-00037-g77c95b8c7a16 #0 Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Workqueue: usb_hub_wq hub_event Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C) __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0x198/0x550 mm/kasan/report.c:521 kasan_report_invalid_free+0xc4/0x118 mm/kasan/report.c:596 check_page_allocation+0x1d8/0x2a8 __kasan_kfree_large+0x10/0x1c mm/kasan/common.c:303 kasan_kfree_large include/linux/kasan.h:241 [inline] free_large_kmalloc+0x64/0x188 mm/slub.c:4723 kfree+0x25c/0x478 mm/slub.c:4751 urb_destroy drivers/usb/core/urb.c:25 [inline] kref_put include/linux/kref.h:65 [inline] usb_free_urb+0xd0/0x140 drivers/usb/core/urb.c:97 smsusb_term_device+0x1ac/0x32c drivers/media/usb/siano/smsusb.c:352 smsusb_init_device drivers/media/usb/siano/smsusb.c:497 [inline] smsusb_probe+0x1664/0x1bfc drivers/media/usb/siano/smsusb.c:575 usb_probe_interface+0x598/0xa40 drivers/usb/core/driver.c:396 really_probe+0x38c/0x8fc drivers/base/dd.c:658 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800 driver_probe_device+0x78/0x330 drivers/base/dd.c:830 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:462 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079 bus_probe_device+0x178/0x240 drivers/base/bus.c:537 device_add+0x728/0xa6c drivers/base/core.c:3665 usb_set_configuration+0x15cc/0x1b38 drivers/usb/core/message.c:2210 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:250 usb_probe_device+0x1a4/0x348 drivers/usb/core/driver.c:291 really_probe+0x38c/0x8fc drivers/base/dd.c:658 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800 driver_probe_device+0x78/0x330 drivers/base/dd.c:830 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:462 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079 bus_probe_device+0x178/0x240 drivers/base/bus.c:537 device_add+0x728/0xa6c drivers/base/core.c:3665 usb_new_device+0x908/0x14ac drivers/usb/core/hub.c:2663 hub_port_connect drivers/usb/core/hub.c:5533 [inline] hub_port_connect_change drivers/usb/core/hub.c:5673 [inline] port_event drivers/usb/core/hub.c:5833 [inline] hub_event+0x2454/0x4280 drivers/usb/core/hub.c:5915 process_one_work+0x810/0x1638 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x97c/0xeec kernel/workqueue.c:3400 kthread+0x65c/0x7b0 kernel/kthread.c:464 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862 The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x121ee2 flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 0000000000000000 fffffdffc387b888 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000e1ee1f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff0000e1ee1f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff0000e1ee2000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff0000e1ee2080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff0000e1ee2100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x121ee2 flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 0000000000000000 fffffdffc387b888 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0) ------------[ cut here ]------------ kernel BUG at ./include/linux/mm.h:1153! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 0 UID: 0 PID: 2271 Comm: kworker/0:2 Tainted: G B W 6.14.0-rc5-syzkaller-00037-g77c95b8c7a16 #0 Tainted: [B]=BAD_PAGE, [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Workqueue: usb_hub_wq hub_event pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : put_page_testzero include/linux/mm.h:1153 [inline] pc : folio_put_testzero include/linux/mm.h:1159 [inline] pc : folio_put include/linux/mm.h:1488 [inline] pc : free_large_kmalloc+0x158/0x188 mm/slub.c:4728 lr : put_page_testzero include/linux/mm.h:1153 [inline] lr : folio_put_testzero include/linux/mm.h:1159 [inline] lr : folio_put include/linux/mm.h:1488 [inline] lr : free_large_kmalloc+0x158/0x188 mm/slub.c:4728 sp : ffff8000a18767b0 x29: ffff8000a18767b0 x28: ffff0000de28b000 x27: ffff0000cd535b80 x26: 1fffe0001bc51601 x25: 00000000000003f0 x24: 1fffe0001bc5181e x23: dfff800000000000 x22: 0000000000000000 x21: 0000000000000000 x20: fffffffffffff000 x19: fffffdffc387b880 x18: 0000000000000008 x17: 0000000000000000 x16: ffff80008b72ce6c x15: ffff700011f87b38 x14: 1ffff00011f87b38 x13: 0000000000000004 x12: ffffffffffffffff x11: 0000000000000001 x10: 0000000000ff0100 x9 : 5c560b0e3511f500 x8 : 5c560b0e3511f500 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff8000a1875d18 x4 : ffff80008fcaf7c0 x3 : ffff8000804a7bb4 x2 : 0000000000000000 x1 : 0000000100000000 x0 : 000000000000003e Call trace: put_page_testzero include/linux/mm.h:1153 [inline] (P) folio_put_testzero include/linux/mm.h:1159 [inline] (P) folio_put include/linux/mm.h:1488 [inline] (P) free_large_kmalloc+0x158/0x188 mm/slub.c:4728 (P) kfree+0x25c/0x478 mm/slub.c:4751 urb_destroy drivers/usb/core/urb.c:25 [inline] kref_put include/linux/kref.h:65 [inline] usb_free_urb+0xd0/0x140 drivers/usb/core/urb.c:97 smsusb_term_device+0x1ac/0x32c drivers/media/usb/siano/smsusb.c:352 smsusb_init_device drivers/media/usb/siano/smsusb.c:497 [inline] smsusb_probe+0x1664/0x1bfc drivers/media/usb/siano/smsusb.c:575 usb_probe_interface+0x598/0xa40 drivers/usb/core/driver.c:396 really_probe+0x38c/0x8fc drivers/base/dd.c:658 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800 driver_probe_device+0x78/0x330 drivers/base/dd.c:830 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:462 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079 bus_probe_device+0x178/0x240 drivers/base/bus.c:537 device_add+0x728/0xa6c drivers/base/core.c:3665 usb_set_configuration+0x15cc/0x1b38 drivers/usb/core/message.c:2210 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:250 usb_probe_device+0x1a4/0x348 drivers/usb/core/driver.c:291 really_probe+0x38c/0x8fc drivers/base/dd.c:658 __driver_probe_device+0x194/0x374 drivers/base/dd.c:800 driver_probe_device+0x78/0x330 drivers/base/dd.c:830 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:958 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:462 __device_attach+0x2b4/0x434 drivers/base/dd.c:1030 device_initial_probe+0x24/0x34 drivers/base/dd.c:1079 bus_probe_device+0x178/0x240 drivers/base/bus.c:537 device_add+0x728/0xa6c drivers/base/core.c:3665 usb_new_device+0x908/0x14ac drivers/usb/core/hub.c:2663 hub_port_connect drivers/usb/core/hub.c:5533 [inline] hub_port_connect_change drivers/usb/core/hub.c:5673 [inline] port_event drivers/usb/core/hub.c:5833 [inline] hub_event+0x2454/0x4280 drivers/usb/core/hub.c:5915 process_one_work+0x810/0x1638 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x97c/0xeec kernel/workqueue.c:3400 kthread+0x65c/0x7b0 kernel/kthread.c:464 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862 Code: b0072ee1 913ee821 aa1303e0 97fc21b3 (d4210000) ---[ end trace 0000000000000000 ]---