Re: [syzbot] [mm?] [usb?] WARNING in corrupted (4)

[Andrew Morton <akpm@linux-foundation.org>]

On Tue, 27 Oct 2026 05:08:56 -0700 syzbot <syzbot+9fe09db3795456e0b442@syzkaller.appspotmail.com> wrote:

> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    5b0764a53235 Merge tag 'drm-next-2026-10-21' of https://gi..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=13739fc9580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=fd1433abd362f255
> dashboard link: https://syzkaller.appspot.com/bug?extid=9fe09db3795456e0b442
> compiler:       Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
> userspace arch: i386
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11cb9b0d580000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/05ac8658d211/disk-5b0764a5.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/9cfb73243216/vmlinux-5b0764a5.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/fc45c7faf785/bzImage-5b0764a5.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+9fe09db3795456e0b442@syzkaller.appspotmail.com
> 
> ------------[ cut here ]------------
> !PageLargeKmalloc(page)
> WARNING: mm/slub.c:6855 at free_large_kmalloc+0x97/0x110 mm/slub.c:6855, CPU#0: kworker/0:1/10
> 

Thanks.

> This report is generated by a bot.

So is this report ;)

This looks like a double free in the Siano USB media driver, rather
than an MM bug.

The failure occurs during USB probe error recovery. The allocation
comes from smscore_register_device(), and the page-owner records show
that smscore_unregister_device() has already freed it. The USB core
can then attempt to free the same memory because smsusb_submit_urb()
sets URB_FREE_BUFFER on a buffer owned by the Siano core.

Rohith Matam posted a patch in June which removes URB_FREE_BUFFER
and fixes several related URB teardown races:

https://lore.kernel.org/r/20260601201639.63171-1-rohithmatham@gmail.com

I don't know why that patch hasn't resolved this problem, but it
would be worth revisiting before developing another fix.

This doesn't appear to need any MM changes.