[syzbot] [mm?] [usb?] WARNING in corrupted (4)

[syzbot] [mm?] [usb?] WARNING in corrupted (4)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    5b0764a53235 Merge tag 'drm-next-2026-10-21' of https://gi..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13739fc9580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=fd1433abd362f255
dashboard link: https://syzkaller.appspot.com/bug?extid=9fe09db3795456e0b442
compiler:       Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
userspace arch: i386
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11cb9b0d580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/05ac8658d211/disk-5b0764a5.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/9cfb73243216/vmlinux-5b0764a5.xz
kernel image: https://storage.googleapis.com/syzbot-assets/fc45c7faf785/bzImage-5b0764a5.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9fe09db3795456e0b442@syzkaller.appspotmail.com

------------[ cut here ]------------
!PageLargeKmalloc(page)
WARNING: mm/slub.c:6855 at free_large_kmalloc+0x97/0x110 mm/slub.c:6855, CPU#0: kworker/0:1/10


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Forwarded: Re: [syzbot] [mm?] [usb?] WARNING in corrupted (4)

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: Re: [syzbot] [mm?] [usb?] WARNING in corrupted (4)
Author: harry@kernel.org

Testing whether the pending siano fix ("media: usb: siano: don't set
URB_FREE_BUFFER flag",
https://lore.kernel.org/all/09b616df-ea9f-4ea1-86be-ab600119f9ae@I-love.SAKURA.ne.jp/)
resolves this report.

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 5b0764a53235

diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c
index 0fdc2e0950b7..8140dc0c8b7d 100644
--- a/drivers/media/usb/siano/smsusb.c
+++ b/drivers/media/usb/siano/smsusb.c
@@ -168,7 +168,6 @@ static int smsusb_submit_urb(struct smsusb_device_t *dev,
 		smsusb_onresponse,
 		surb
 	);
-	surb->urb->transfer_flags |= URB_FREE_BUFFER;
 
 	return usb_submit_urb(surb->urb, GFP_ATOMIC);
 }

Re: [syzbot] [mm?] [usb?] WARNING in corrupted (4)

[Andrew Morton]

On Tue, 27 Oct 2026 05:08:56 -0700 syzbot <syzbot+9fe09db3795456e0b442@syzkaller.appspotmail.com> wrote:

> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    5b0764a53235 Merge tag 'drm-next-2026-10-21' of https://gi..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=13739fc9580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=fd1433abd362f255
> dashboard link: https://syzkaller.appspot.com/bug?extid=9fe09db3795456e0b442
> compiler:       Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
> userspace arch: i386
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11cb9b0d580000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/05ac8658d211/disk-5b0764a5.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/9cfb73243216/vmlinux-5b0764a5.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/fc45c7faf785/bzImage-5b0764a5.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+9fe09db3795456e0b442@syzkaller.appspotmail.com
> 
> ------------[ cut here ]------------
> !PageLargeKmalloc(page)
> WARNING: mm/slub.c:6855 at free_large_kmalloc+0x97/0x110 mm/slub.c:6855, CPU#0: kworker/0:1/10
> 

Thanks.

> This report is generated by a bot.

So is this report ;)

This looks like a double free in the Siano USB media driver, rather
than an MM bug.

The failure occurs during USB probe error recovery. The allocation
comes from smscore_register_device(), and the page-owner records show
that smscore_unregister_device() has already freed it. The USB core
can then attempt to free the same memory because smsusb_submit_urb()
sets URB_FREE_BUFFER on a buffer owned by the Siano core.

Rohith Matam posted a patch in June which removes URB_FREE_BUFFER
and fixes several related URB teardown races:

https://lore.kernel.org/r/20260601201639.63171-1-rohithmatham@gmail.com

I don't know why that patch hasn't resolved this problem, but it
would be worth revisiting before developing another fix.

This doesn't appear to need any MM changes.

Re: [syzbot] [mm?] [usb?] WARNING in corrupted (4)

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in enable_work

------------[ cut here ]------------
workqueue: work disable count underflowed
WARNING: kernel/workqueue.c:4691 at work_offqd_enable kernel/workqueue.c:4691 [inline], CPU#1: kworker/1:0/24
WARNING: kernel/workqueue.c:4691 at enable_work+0x1c7/0x230 kernel/workqueue.c:4862, CPU#1: kworker/1:0/24
Modules linked in:
CPU: 1 UID: 0 PID: 24 Comm: kworker/1:0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Workqueue: usb_hub_wq hub_event
RIP: 0010:work_offqd_enable kernel/workqueue.c:4691 [inline]
RIP: 0010:enable_work+0x1c7/0x230 kernel/workqueue.c:4862
Code: af a8 39 00 4d 85 f6 75 48 e8 a5 a8 39 00 eb 47 e8 9e a8 39 00 90 0f 0b 90 e9 bc fe ff ff e8 90 a8 39 00 48 8d 3d 39 2e f0 0f <67> 48 0f b9 3a e9 d2 fe ff ff e8 7a a8 39 00 90 0f 0b 90 e9 1d ff
RSP: 0018:ffffc900001e6ae8 EFLAGS: 00010093
RAX: ffffffff818f4e50 RBX: 0000000000000000 RCX: ffff88801fa85dc0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff917f7c90
RBP: 0000000000000000 R08: ffff8880b853b803 R09: 1ffff110170a7700
R10: dffffc0000000000 R11: ffffed10170a7701 R12: 1ffff1100ec47807
R13: 0000000001800001 R14: ffff88807623c038 R15: 00000000ffffffb9
FS:  0000000000000000(0000) GS:ffff888123b48000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff21fa87440 CR3: 0000000075588000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 __cancel_work_sync kernel/workqueue.c:4732 [inline]
 cancel_work_sync+0xd9/0xf0 kernel/workqueue.c:4766
 smsusb_stop_streaming drivers/media/usb/siano/smsusb.c:182 [inline]
 smsusb_term_device+0xdd/0x3d0 drivers/media/usb/siano/smsusb.c:344
 smsusb_init_device drivers/media/usb/siano/smsusb.c:496 [inline]
 smsusb_probe+0x1aba/0x2280 drivers/media/usb/siano/smsusb.c:574
 usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:503
 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:623
 device_add+0x7d7/0xb80 drivers/base/core.c:3776
 usb_set_configuration+0x1bb5/0x2260 drivers/usb/core/message.c:2274
 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:503
 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:623
 device_add+0x7d7/0xb80 drivers/base/core.c:3776
 usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2713
 hub_port_connect drivers/usb/core/hub.c:5585 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5725 [inline]
 port_event drivers/usb/core/hub.c:5889 [inline]
 hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5971
 process_one_work kernel/workqueue.c:3495 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3578
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3659
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
----------------
Code disassembly (best guess):
   0:	af                   	scas   %es:(%rdi),%eax
   1:	a8 39                	test   $0x39,%al
   3:	00 4d 85             	add    %cl,-0x7b(%rbp)
   6:	f6 75 48             	divb   0x48(%rbp)
   9:	e8 a5 a8 39 00       	call   0x39a8b3
   e:	eb 47                	jmp    0x57
  10:	e8 9e a8 39 00       	call   0x39a8b3
  15:	90                   	nop
  16:	0f 0b                	ud2
  18:	90                   	nop
  19:	e9 bc fe ff ff       	jmp    0xfffffeda
  1e:	e8 90 a8 39 00       	call   0x39a8b3
  23:	48 8d 3d 39 2e f0 0f 	lea    0xff02e39(%rip),%rdi        # 0xff02e63
* 2a:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2f:	e9 d2 fe ff ff       	jmp    0xffffff06
  34:	e8 7a a8 39 00       	call   0x39a8b3
  39:	90                   	nop
  3a:	0f 0b                	ud2
  3c:	90                   	nop
  3d:	e9                   	.byte 0xe9
  3e:	1d                   	.byte 0x1d
  3f:	ff                   	.byte 0xff


Tested on:

commit:         5b0764a5 Merge tag 'drm-next-2026-10-21' of https://gi..
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=176c7d31580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=fd1433abd362f255
dashboard link: https://syzkaller.appspot.com/bug?extid=9fe09db3795456e0b442
compiler:       Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
userspace arch: i386
patch:          https://syzkaller.appspot.com/x/patch.diff?x=175c482d580000