From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f179.google.com (mail-qk1-f179.google.com [209.85.222.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1013424676D for ; Mon, 15 Jun 2026 02:36:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.179 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781491002; cv=none; b=KxCxQPP81vxmZy6F7TuojtF5AuezB3B9gx+k8X0WgSGybYSm2AD0hpOYYLgcLkrheJt7ilqiyFTVVuhmsh0JLqbZQSRTE68OCHLAux55lPOX798YuvIrU2aWAqAWtKRkiW2XpLFDMVa4mW+OP1OVtNn/FvpYA5YQPhvzqVPBlBU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781491002; c=relaxed/simple; bh=3xZXV15nfu/kDl0x+P8csHbIrvDz1ccGEuR1+nsH+Pg=; h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type; b=aJ+rjZuyie3YaLDt2APnLCFUQb+z7Ksp9ZPVMMp0rOL01eemuIfDvXq1RWNwyFQDOVPWjJf/J7Ww4f1+Z1fKMubZ/xxW8TRfbN4FJP2AefdcYVkZ0L1mrIWaOPwzoUPtEYsd+e2ifbhVLH32aMlF4INx35v2d02KVpjdcioCOQk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=LQGnIL+1; arc=none smtp.client-ip=209.85.222.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="LQGnIL+1" Received: by mail-qk1-f179.google.com with SMTP id af79cd13be357-9159951f05aso320438985a.0 for ; Sun, 14 Jun 2026 19:36:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781490996; x=1782095796; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:from:to:cc:subject:date:message-id:reply-to; bh=Mr50aan00YSZlZIxK83jWpHkvDxONUHESMJpth2W5As=; b=LQGnIL+1TdklqzLbkyGUvFbvIP7W2o0XwD4eNroKu3XosEKYcxNSi9YsoAHyn2FhUp BgCcOjOoqvHNv5JGQdpw/x53o9MMLOCrDNspBwAUaFaPlYSc7XrZ7s7SGgU5Vm4ie0WS tyvgODfk0OlVSYBDczHAMwhy8i6aOMb9OqH/QJrji32AbM7MCiB2p6fkbrAjd3axBDf4 Ye2iA1ewLQ1NObjRQVHGrc9YZTbbbe8QhFeWxQjVN8d9upcAvJIaaTZ8rxJSMJq9WCc0 v49cu2DOmiXO6AotZdInQCwXXcM3dJ9Y5BFVAB8SxUQv8tnf3xjUolP5p4wiSBoxY3yC gS/g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781490996; x=1782095796; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=Mr50aan00YSZlZIxK83jWpHkvDxONUHESMJpth2W5As=; b=WTx5m3FKyxevew9R3Zrgy3JmEqm3Lfz/WSxKw+FINT2T75TEMRb6RZY/eUsubrlTs+ XVksllBNSZ8vPODL5JlKvDnaMBeyABfa6q3oWDNBRM7BSLUI/qyAdbLFpG6Pr2efqFUT +dzxE4cX27pm6qMeDohmSDzD8M2J/Q+9iuQ04mRYanvLnbTrfsDvLeN+LSfsxdFyR4BH vVErOF0d6qgD/C0NdbwPmExqj2s9KsWIRN4d4WL7PR6ry+O8kYuP2Zfp1U9DYU1LebRc mSgOShit5XZAraKMwNjQtm367sCc0kfchRcH+1OjHBgqQJeLIUbK7RhLNQtVa+eJYiz2 T5xg== X-Forwarded-Encrypted: i=1; AFNElJ8ToJPqvsSGVlpgv1NkidDxgvIy8tz2oC25aJs4gTJoJUQu0CHfkgUj/BVqu7X7FrWIfAm0rIaIgMCRWpg=@vger.kernel.org X-Gm-Message-State: AOJu0Yw+NcsNOwHFeQ7VRdqfQX21JUJiRF4jLGpZ8XfBBcU3lqu7UqWT c3XLVvTnXTsgMxHw1HudTEKhbxZHeUKxPEPXJHbPXjTLnpRWTiYDbSnd X-Gm-Gg: Acq92OFRLhNM5v15DNU9Yl+i+XSMI6bbl/hnjA7yVI35vWod+o3dNHLLa32mzVii9br IE46EtYXUnLSPKodL8C4LiutoTBJ7pUaAdXSBRPkFTm/xCo92r9BJfD2p+nSzmX16QJOjCLfvem Ibqfufzk1moMsGcMowf5v6xvlRwxGu4SmJ8ATaSzQL+gPUQoF7LOUl8sFlmkoMFNDsQyo8Q65c2 dngM7+JZf7b6oOqhbTaqYydUZOIZ7jQo4nlv2z3ss+lJtmNYdPS9SrxJaLCCHlGN/XEj4zUx8RN xaC5CNE2ZGNwy9gn4m2ehHFqQPsIr0saichSiwJGYO8+dpaSKr5wRa51AvUAzBrzTAfbOC/jCmm wtxm9P3aZ6Fv5yjHrCwcZ8Q1IOU0+/x0daM9Bv2Tx5jO6ShoM3Awx2xMWlvj7i89r6ywV3ZZtvd U4pUFOhU02PPtPaj6H3meq5U05JPxNV1fQOf/c68LvbI83/WHJcjReVOD4jdbRUYykpX1Qghuj2 tgctHyY X-Received: by 2002:a05:620a:1791:b0:915:d5d6:f1fa with SMTP id af79cd13be357-9161bd3a595mr1906241285a.31.1781490995970; Sun, 14 Jun 2026 19:36:35 -0700 (PDT) Received: from localhost.localdomain ([2601:985:4601:5df0:2106:6ce9:6b1:8f70]) by smtp.gmail.com with ESMTPSA id af79cd13be357-91619ed7f16sm947806785a.1.2026.06.14.19.36.35 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Sun, 14 Jun 2026 19:36:35 -0700 (PDT) From: Shuangpeng Bai To: mchehab@kernel.org, kees@kernel.org, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [BUG] media: siano: WARNING in free_large_kmalloc from smsusb_term_device Date: Sun, 14 Jun 2026 22:36:34 -0400 Message-ID: <178144969601.60470.6468623939816148386@gmail.com> X-Mailer: git-send-email 2.47.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Hi, I hit the following report while testing current upstream kernel: WARNING in free_large_kmalloc from smsusb_term_device I reproduced this on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026) The issue was reproduced with a Siano USB DVB raw gadget. The reproducer and .config files are here. https://gist.github.com/shuangpengbai/8e2dbdcbfc6362c50e18028dc5ecb810 I'm happy to test debug patches or provide additional information. Reported-by: Shuangpeng Bai [ 122.434215][ T776] WARNING: mm/slub.c:6476 at free_large_kmalloc+0x96/0xf0, CPU#0: kworker/0:2/776 [ 122.434930][ T776] Modules linked in: [ 122.436062][ T776] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 122.436866][ T776] Workqueue: usb_hub_wq hub_event [ 122.437246][ T776] RIP: 0010:free_large_kmalloc (mm/slub.c:6491) [ 122.437623][ T776] Code: 8b 43 30 83 f8 ff 74 13 25 00 00 00 ff 3d 00 00 00 f8 75 55 c7 43 30 ff ff ff ff 48 89 df 44 89 f6 5b 41 5e 5d e9 ba f9 fc ff <0f> 0b 48 89 df 48 c7 c6 b0 ee 9c 8c 5b 41 5e 5d e9 45 df f0 ff 0f [ 122.438900][ T776] RSP: 0000:ffff88810cb373c0 EFLAGS: 00010206 [ 122.439409][ T776] RAX: 00000000ff000000 RBX: ffffea00048cf880 RCX: 0000000000000028 [ 122.440124][ T776] RDX: 0000000000000001 RSI: ffff8881233e2000 RDI: ffffea00048cf880 [ 122.440674][ T776] RBP: ffff8881233e2000 R08: ffff8881187e4f03 R09: 1ffff110230fc9e0 [ 122.441228][ T776] R10: dffffc0000000000 R11: ffffed10230fc9e1 R12: ffff888170006800 [ 122.441817][ T776] R13: ffffffff90eec020 R14: 0000000000000000 R15: ffffffff86bdeb1c [ 122.442384][ T776] FS: 0000000000000000(0000) GS:ffff8882c5d34000(0000) knlGS:0000000000000000 [ 122.443011][ T776] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 122.443485][ T776] CR2: 0000563ae7328600 CR3: 0000000169f46000 CR4: 00000000000006f0 [ 122.444038][ T776] Call Trace: [ 122.444289][ T776] [ 122.444498][ T776] kfree (mm/slub.c:6561) [ 122.445204][ T776] usb_free_urb (drivers/usb/core/urb.c:25 include/linux/kref.h:65 drivers/usb/core/urb.c:96) [ 122.445513][ T776] smsusb_term_device (drivers/media/usb/siano/smsusb.c:352) [ 122.445872][ T776] usb_unbind_interface (drivers/usb/core/driver.c:458) [ 122.446999][ T776] device_release_driver_internal (drivers/base/dd.c:621 drivers/base/dd.c:1352 drivers/base/dd.c:1375) [ 122.447444][ T776] bus_remove_device (drivers/base/bus.c:657) [ 122.448591][ T776] device_del (drivers/base/core.c:3895) [ 122.449952][ T776] usb_disable_device (drivers/usb/core/message.c:1478) [ 122.450311][ T776] usb_disconnect (drivers/usb/core/hub.c:2315) [ 122.450636][ T776] hub_event (drivers/usb/core/hub.c:5407 drivers/usb/core/hub.c:5707 drivers/usb/core/hub.c:5871 drivers/usb/core/hub.c:5953) [ 122.453252][ T776] process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397) [ 122.453653][ T776] worker_thread (kernel/workqueue.c:3478) [ 122.454355][ T776] kthread (kernel/kthread.c:436) [ 122.455464][ T776] ret_from_fork (arch/x86/kernel/process.c:158) [ 122.456865][ T776] ret_from_fork_asm (arch/x86/entry/entry_64.S:245) [ 122.457222][ T776] [ 122.457452][ T776] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 122.458826][ T776] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 122.459672][ T776] Workqueue: usb_hub_wq hub_event [ 122.460034][ T776] Call Trace: [ 122.460284][ T776] [ 122.460501][ T776] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) [ 122.460838][ T776] vpanic (kernel/panic.c:650) [ 122.462244][ T776] panic (kernel/panic.c:787) [ 122.463524][ T776] __report_bug (lib/bug.c:246) [ 122.467504][ T776] report_bug (lib/bug.c:278) [ 122.468548][ T776] handle_bug (arch/x86/kernel/traps.c:436) [ 122.468865][ T776] exc_invalid_op (arch/x86/kernel/traps.c:490) [ 122.469198][ T776] asm_exc_invalid_op (arch/x86/include/asm/idtentry.h:616) [ 122.469558][ T776] RIP: 0010:free_large_kmalloc (mm/slub.c:6491) [ 122.469951][ T776] Code: 8b 43 30 83 f8 ff 74 13 25 00 00 00 ff 3d 00 00 00 f8 75 55 c7 43 30 ff ff ff ff 48 89 df 44 89 f6 5b 41 5e 5d e9 ba f9 fc ff <0f> 0b 48 89 df 48 c7 c6 b0 ee 9c 8c 5b 41 5e 5d e9 45 df f0 ff 0f [ 122.471301][ T776] RSP: 0000:ffff88810cb373c0 EFLAGS: 00010206 [ 122.471724][ T776] RAX: 00000000ff000000 RBX: ffffea00048cf880 RCX: 0000000000000028 [ 122.472283][ T776] RDX: 0000000000000001 RSI: ffff8881233e2000 RDI: ffffea00048cf880 [ 122.472849][ T776] RBP: ffff8881233e2000 R08: ffff8881187e4f03 R09: 1ffff110230fc9e0 [ 122.473431][ T776] R10: dffffc0000000000 R11: ffffed10230fc9e1 R12: ffff888170006800 [ 122.474003][ T776] R13: ffffffff90eec020 R14: 0000000000000000 R15: ffffffff86bdeb1c [ 122.474904][ T776] kfree (mm/slub.c:6561) [ 122.475616][ T776] usb_free_urb (drivers/usb/core/urb.c:25 include/linux/kref.h:65 drivers/usb/core/urb.c:96) [ 122.475927][ T776] smsusb_term_device (drivers/media/usb/siano/smsusb.c:352) [ 122.476283][ T776] usb_unbind_interface (drivers/usb/core/driver.c:458) Best, Shuangpeng