input: CM109 USB driver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input72 list_add double add: new=ffff888029994d18, prev=ffff888029994d18, next=ffff888079f45070. ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:37! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 4163 Comm: kworker/1:2 Not tainted 6.6.0-rc3-syzkaller-g6465e260f487 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Workqueue: usb_hub_wq hub_event RIP: 0010:__list_add_valid_or_report+0x9e/0xf0 lib/list_debug.c:35 Code: 39 e7 74 11 4d 39 f7 74 0c b0 01 5b 41 5c 41 5d 41 5e 41 5f c3 48 c7 c7 60 9d 59 8b 4c 89 fe 4c 89 e2 4c 89 f1 e8 d2 f6 84 06 <0f> 0b 48 c7 c7 60 9b 59 8b e8 c4 f6 84 06 0f 0b 48 c7 c7 00 9c 59 RSP: 0018:ffffc9000318e9c8 EFLAGS: 00010046 RAX: 0000000000000058 RBX: ffff888079f45078 RCX: 33613c56f2ee4900 RDX: 0000000000000000 RSI: 0000000080000002 RDI: 0000000000000000 RBP: ffff888079f45078 R08: ffffffff8171098c R09: 1ffff1101732516a R10: dffffc0000000000 R11: ffffed101732516b R12: ffff888029994d18 R13: dffffc0000000000 R14: ffff888079f45070 R15: ffff888029994d18 FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555d1bcc1a98 CR3: 00000000258de000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __list_add_valid include/linux/list.h:88 [inline] __list_add include/linux/list.h:150 [inline] list_add_tail include/linux/list.h:183 [inline] usb_hcd_link_urb_to_ep+0x1b7/0x310 drivers/usb/core/hcd.c:1160 dummy_urb_enqueue+0x2b6/0x760 drivers/usb/gadget/udc/dummy_hcd.c:1284 usb_hcd_submit_urb+0x35c/0x1e90 drivers/usb/core/hcd.c:1535 cm109_input_open+0x1f9/0x460 drivers/input/misc/cm109.c:572 input_open_device+0x18c/0x2e0 drivers/input/input.c:654 kbd_connect+0xe9/0x130 drivers/tty/vt/keyboard.c:1593 input_attach_handler drivers/input/input.c:1064 [inline] input_register_device+0xcf0/0x1090 drivers/input/input.c:2396 cm109_usb_probe+0x10c3/0x1600 drivers/input/misc/cm109.c:806 usb_probe_interface+0x5c4/0xb00 drivers/usb/core/driver.c:396 really_probe+0x294/0xc30 drivers/base/dd.c:658 __driver_probe_device+0x1a2/0x3d0 drivers/base/dd.c:800 driver_probe_device+0x50/0x420 drivers/base/dd.c:830 __device_attach_driver+0x2d3/0x520 drivers/base/dd.c:958 bus_for_each_drv+0x24a/0x2d0 drivers/base/bus.c:457 __device_attach+0x32f/0x510 drivers/base/dd.c:1030 bus_probe_device+0x185/0x260 drivers/base/bus.c:532 device_add+0x956/0xd30 drivers/base/core.c:3624 usb_set_configuration+0x1976/0x1fb0 drivers/usb/core/message.c:2207 usb_generic_driver_probe+0x88/0x140 drivers/usb/core/generic.c:238 usb_probe_device+0x134/0x270 drivers/usb/core/driver.c:293 really_probe+0x294/0xc30 drivers/base/dd.c:658 __driver_probe_device+0x1a2/0x3d0 drivers/base/dd.c:800 driver_probe_device+0x50/0x420 drivers/base/dd.c:830 __device_attach_driver+0x2d3/0x520 drivers/base/dd.c:958 bus_for_each_drv+0x24a/0x2d0 drivers/base/bus.c:457 __device_attach+0x32f/0x510 drivers/base/dd.c:1030 bus_probe_device+0x185/0x260 drivers/base/bus.c:532 device_add+0x956/0xd30 drivers/base/core.c:3624 usb_new_device+0xb7e/0x18d0 drivers/usb/core/hub.c:2589 hub_port_connect drivers/usb/core/hub.c:5440 [inline] hub_port_connect_change drivers/usb/core/hub.c:5580 [inline] port_event drivers/usb/core/hub.c:5740 [inline] hub_event+0x2e3c/0x5090 drivers/usb/core/hub.c:5822 process_one_work kernel/workqueue.c:2630 [inline] process_scheduled_works+0x90f/0x1400 kernel/workqueue.c:2703 worker_thread+0xa5f/0xff0 kernel/workqueue.c:2784 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__list_add_valid_or_report+0x9e/0xf0 lib/list_debug.c:35 Code: 39 e7 74 11 4d 39 f7 74 0c b0 01 5b 41 5c 41 5d 41 5e 41 5f c3 48 c7 c7 60 9d 59 8b 4c 89 fe 4c 89 e2 4c 89 f1 e8 d2 f6 84 06 <0f> 0b 48 c7 c7 60 9b 59 8b e8 c4 f6 84 06 0f 0b 48 c7 c7 00 9c 59 RSP: 0018:ffffc9000318e9c8 EFLAGS: 00010046 RAX: 0000000000000058 RBX: ffff888079f45078 RCX: 33613c56f2ee4900 RDX: 0000000000000000 RSI: 0000000080000002 RDI: 0000000000000000 RBP: ffff888079f45078 R08: ffffffff8171098c R09: 1ffff1101732516a R10: dffffc0000000000 R11: ffffed101732516b R12: ffff888029994d18 R13: dffffc0000000000 R14: ffff888079f45070 R15: ffff888029994d18 FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555d1bcc1a98 CR3: 00000000258de000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400