[syzbot] [media?] WARNING in vb2_video_unregister_device

[syzbot] [media?] WARNING in vb2_video_unregister_device

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    4477a78374a5 Add linux-next specific files for 20260814
git tree:       linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=15cda679580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=5042554017b3879d
dashboard link: https://syzkaller.appspot.com/bug?extid=f26bc23e42eeb548dee1
compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d1a5728edb0d/disk-4477a783.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3aebe8202fcd/vmlinux-4477a783.xz
kernel image: https://storage.googleapis.com/syzbot-assets/7e9f7367a2bd/bzImage-4477a783.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f26bc23e42eeb548dee1@syzkaller.appspotmail.com

usb 3-1: Decoder not found
em28xx 3-1:1.0: failed to create media graph
em28xx 3-1:1.0: V4L2 device radio0 deregistered
------------[ cut here ]------------
!vdev->queue
WARNING: drivers/media/common/videobuf2/videobuf2-v4l2.c:1264 at vb2_video_unregister_device+0x1f8/0x200 drivers/media/common/videobuf2/videobuf2-v4l2.c:1264, CPU#1: kworker/1:1/44
Modules linked in:
CPU: 1 UID: 0 PID: 44 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events request_module_async
RIP: 0010:vb2_video_unregister_device+0x1f8/0x200 drivers/media/common/videobuf2/videobuf2-v4l2.c:1264
Code: c6 28 4c 89 f0 48 c1 e8 03 80 3c 28 00 4c 8b 24 24 74 08 4c 89 f7 e8 97 0b 09 fa 49 c7 06 00 00 00 00 eb a6 e8 49 90 9a f9 90 <0f> 0b 90 e9 ae fe ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc90000b47990 EFLAGS: 00010293
RAX: ffffffff882d4ce7 RBX: 1ffff1100581b29b RCX: ffff888020ec9f40
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffff88802c0d953f R09: 1ffff1100581b2a7
R10: dffffc0000000000 R11: ffffed100581b2a8 R12: ffff88802bb40c00
R13: ffff88802c0d8000 R14: ffff88802c0d94d8 R15: ffff88802c0d8f38
FS:  0000000000000000(0000) GS:ffff8881249ab000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9b1ded3000 CR3: 000000000ed48000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 em28xx_v4l2_init+0x1c39/0x3150 drivers/media/usb/em28xx/em28xx-video.c:3085
 em28xx_init_extension+0x120/0x1d0 drivers/media/usb/em28xx/em28xx-core.c:1248
 process_one_work kernel/workqueue.c:3387 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3470
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3551
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [media?] [usb?] WARNING in vb2_video_unregister_device

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit:    5445d6419962 arm64: Don't read GMID_EL1 when MTE is disabled
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=151998c9580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=56ed23170c168d4c
dashboard link: https://syzkaller.appspot.com/bug?extid=f26bc23e42eeb548dee1
compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11ec93f9580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=17e15bf9580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e8b70e3bd109/disk-5445d641.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e5227e56ac93/vmlinux-5445d641.xz
kernel image: https://storage.googleapis.com/syzbot-assets/54905f78be59/Image-5445d641.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f26bc23e42eeb548dee1@syzkaller.appspotmail.com

em28xx 1-1:1.0: Registered radio device as radio2
usb 1-1: Decoder not found
em28xx 1-1:1.0: failed to create media graph
em28xx 1-1:1.0: V4L2 device radio2 deregistered
------------[ cut here ]------------
WARNING: drivers/media/common/videobuf2/videobuf2-v4l2.c:1264 at vb2_video_unregister_device+0x1c8/0x1d0 drivers/media/common/videobuf2/videobuf2-v4l2.c:1264, CPU#1: kworker/1:2/1094
Modules linked in:
CPU: 1 UID: 0 PID: 1094 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Workqueue: events request_module_async
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : vb2_video_unregister_device+0x1c8/0x1d0 drivers/media/common/videobuf2/videobuf2-v4l2.c:1264
lr : vb2_video_unregister_device+0x1c8/0x1d0 drivers/media/common/videobuf2/videobuf2-v4l2.c:1264
sp : ffff800094617a20
x29: ffff800094617a20 x28: dfff800000000000 x27: 1fffe0001945a826
x26: ffff800087610300 x25: ffff800087611620 x24: 1fffe00018d04aa1
x23: ffff0000c6825508 x22: dfff800000000000 x21: ffff0000c6824000
x20: 0000000000000001 x19: ffff0000c6824f58 x18: 00000000ffffffff
x17: ffff800083d9271c x16: ffff800083da2fd4 x15: ffff800083a47b40
x14: 0000000000000001 x13: 0000000000000001 x12: 0000000000000003
x11: 0000000000000000 x10: 0000000000000001 x9 : 0000000000000000
x8 : 0000000000000000 x7 : ffff80008048e314 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff800083b611c0
x2 : 0000000000000001 x1 : ffff0000c74cbb00 x0 : 0000000000000000
Call trace:
 vb2_video_unregister_device+0x1c8/0x1d0 drivers/media/common/videobuf2/videobuf2-v4l2.c:1264 (P)
 em28xx_v4l2_init+0x1320/0x247c drivers/media/usb/em28xx/em28xx-video.c:3085
 em28xx_init_extension+0x10c/0x1b4 drivers/media/usb/em28xx/em28xx-core.c:1248
 request_module_async+0x24/0x34 drivers/media/usb/em28xx/em28xx-cards.c:-1
 process_one_work kernel/workqueue.c:3387 [inline]
 process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3470
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3551
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838
irq event stamp: 35758
hardirqs last  enabled at (35757): [<ffff8000804918ac>] vprintk_store+0x924/0xb94 kernel/printk/printk.c:2385
hardirqs last disabled at (35758): [<ffff8000869841d4>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:445
softirqs last  enabled at (35698): [<ffff800084c72d48>] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:698
softirqs last disabled at (35696): [<ffff800084c72d30>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (35696): [<ffff800084c72d30>] __alloc_skb+0x1a8/0x610 net/core/skbuff.c:697
---[ end trace 0000000000000000 ]---
em28xx 1-1:1.0: V4L2 device video11 deregistered
INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 1 UID: 0 PID: 1094 Comm: kworker/1:2 Tainted: G        W           syzkaller #0 PREEMPT 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Workqueue: events request_module_async
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 dump_stack+0x1c/0x28 lib/dump_stack.c:129
 assign_lock_key+0xcc/0xdc kernel/locking/lockdep.c:1000
 register_lock_class+0xf8/0x31c kernel/locking/lockdep.c:1315
 __lock_acquire+0xc0/0x2a6c kernel/locking/lockdep.c:5128
 lock_acquire+0x150/0x370 kernel/locking/lockdep.c:5908
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:155 [inline]
 _raw_spin_lock_irqsave+0x5c/0x7c kernel/locking/spinlock.c:181
 __wake_up_common_lock+0x30/0x78 kernel/sched/wait.c:125
 __wake_up+0x18/0x24 kernel/sched/wait.c:147
 __vb2_queue_cancel+0x248/0xa78 drivers/media/common/videobuf2/videobuf2-core.c:2244
 vb2_core_queue_release+0x34/0x13c drivers/media/common/videobuf2/videobuf2-core.c:2677
 vb2_queue_release drivers/media/common/videobuf2/videobuf2-v4l2.c:943 [inline]
 vb2_video_unregister_device+0x12c/0x1d0 drivers/media/common/videobuf2/videobuf2-v4l2.c:1279
 em28xx_v4l2_init+0x1368/0x247c drivers/media/usb/em28xx/em28xx-video.c:3097
 em28xx_init_extension+0x10c/0x1b4 drivers/media/usb/em28xx/em28xx-core.c:1248
 request_module_async+0x24/0x34 drivers/media/usb/em28xx/em28xx-cards.c:-1
 process_one_work kernel/workqueue.c:3387 [inline]
 process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3470
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3551
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838
Unable to handle kernel paging request at virtual address dfff800000000000
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
Mem abort info:
  ESR = 0x0000000096000005
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x05: level 1 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0
[dfff800000000000] address between user and kernel address ranges
Internal error: Oops: 0000000096000005 [#1]  SMP
Modules linked in:
CPU: 1 UID: 0 PID: 1094 Comm: kworker/1:2 Tainted: G        W           syzkaller #0 PREEMPT 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Workqueue: events request_module_async
pstate: 034000c5 (nzcv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : __wake_up_common+0xac/0x180 kernel/sched/wait.c:105
lr : __wake_up_common_lock+0x4c/0x78 kernel/sched/wait.c:126
sp : ffff8000946178a0
x29: ffff8000946178a0 x28: dfff800000000000 x27: dfff800000000000
x26: dfff800000000000 x25: ffff0000c682576c x24: 0000000000000000
x23: ffff0000c6825800 x22: 0000000000000003 x21: 0000000000000000
x20: 0000000000000000 x19: 0000000000000000 x18: 00000000ffffffff
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000004
x11: ffff7000128c2f04 x10: ffff7000128c2f04 x9 : 0000000000000003
x8 : 0000000000000000 x7 : 0000000000000000 x6 : ffff80008048e314
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
x2 : 0000000000000000 x1 : 0000000000000003 x0 : ffff0000c68257c0
Call trace:
 __wake_up_common+0xac/0x180 kernel/sched/wait.c:105 (P)
 __wake_up_common_lock+0x4c/0x78 kernel/sched/wait.c:126
 __wake_up+0x18/0x24 kernel/sched/wait.c:147
 __vb2_queue_cancel+0x248/0xa78 drivers/media/common/videobuf2/videobuf2-core.c:2244
 vb2_core_queue_release+0x34/0x13c drivers/media/common/videobuf2/videobuf2-core.c:2677
 vb2_queue_release drivers/media/common/videobuf2/videobuf2-v4l2.c:943 [inline]
 vb2_video_unregister_device+0x12c/0x1d0 drivers/media/common/videobuf2/videobuf2-v4l2.c:1279
 em28xx_v4l2_init+0x1368/0x247c drivers/media/usb/em28xx/em28xx-video.c:3097
 em28xx_init_extension+0x10c/0x1b4 drivers/media/usb/em28xx/em28xx-core.c:1248
 request_module_async+0x24/0x34 drivers/media/usb/em28xx/em28xx-cards.c:-1
 process_one_work kernel/workqueue.c:3387 [inline]
 process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3470
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3551
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838
Code: f94002f8 eb17031f 54000500 d343ff08 (387b6908) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	f94002f8 	ldr	x24, [x23]
   4:	eb17031f 	cmp	x24, x23
   8:	54000500 	b.eq	0xa8  // b.none
   c:	d343ff08 	lsr	x8, x24, #3
* 10:	387b6908 	ldrb	w8, [x8, x27] <-- trapping instruction


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.