WARNING in usb_free_urb

WARNING in usb_free_urb

[sanan.hasanou]

Good day, dear maintainers,

We found a bug using a modified version of syzkaller.

Kernel Branch: 7.0-rc1
Kernel Config: <https://drive.google.com/open?id=1zJHAs5GUroGFBkxAlzfDaWAd_NVPZTfJ>
Unfortunately, we don't have any reproducer for this bug yet.
Thank you!

Best regards,
Sanan Hasanov

179683 pages reserved
0 pages cma reserved
Memory cgroup min protection 0kB -- low protection 0kB
------------[ cut here ]------------
!PageLargeKmalloc(page)
WARNING: mm/slub.c:6352 at free_large_kmalloc+0xb3/0x160 mm/slub.c:6352, CPU#1: kworker/1:4/12317
Modules linked in:
CPU: 1 UID: 0 PID: 12317 Comm: kworker/1:4 Tainted: G             L      7.0.0-rc1 #1 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: events request_module_async
RIP: 0010:free_large_kmalloc+0xb3/0x160 mm/slub.c:6352
Code: 25 00 00 00 ff 3d 00 00 00 f8 0f 85 a6 00 00 00 c7 43 30 ff ff ff ff 48 89 df 44 89 f6 e8 45 d9 fc ff 5b 41 5e 41 5f 5d c3 90 <0f> 0b 90 48 89 df 48 c7 c6 b7 4c 72 8d e8 cb e8 08 ff eb e4 90 0f
RSP: 0018:ffffc900028e76f8 EFLAGS: 00010287
RAX: 00000000f0000000 RBX: ffffea00019a5c00 RCX: ffff888067550001
RDX: 0000000000000000 RSI: ffff888066970000 RDI: ffffea00019a5c00
RBP: ffffc900028e7710 R08: ffff888049c40603 R09: 1ffff110093880c0
R10: dffffc0000000000 R11: ffffed10093880c1 R12: ffff888066970000
R13: ffffffff870bc0f1 R14: 0000000000000000 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880ef136000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fba7e4bf008 CR3: 000000005776b000 CR4: 00000000000006f0
Call Trace:
 <TASK>
 kfree+0xae/0x630 mm/slub.c:6437
 urb_destroy drivers/usb/core/urb.c:25 [inline]
 kref_put include/linux/kref.h:65 [inline]
 usb_free_urb+0xd1/0x120 drivers/usb/core/urb.c:96
 em28xx_uninit_usb_xfer+0x165/0x310 drivers/media/usb/em28xx/em28xx-core.c:833
 em28xx_alloc_urbs+0xf2a/0x1130 drivers/media/usb/em28xx/em28xx-core.c:-1
 em28xx_dvb_init+0x2b0/0x4a20 drivers/media/usb/em28xx/em28xx-dvb.c:-1
 em28xx_init_extension+0x121/0x1d0 drivers/media/usb/em28xx/em28xx-core.c:1117
 request_module_async+0x5e/0x80 drivers/media/usb/em28xx/em28xx-cards.c:3457
 process_one_work kernel/workqueue.c:3275 [inline]
 process_scheduled_works+0xae1/0x1800 kernel/workqueue.c:3358
 worker_thread+0xa0f/0xf70 kernel/workqueue.c:3439
 kthread+0x37d/0x470 kernel/kthread.c:467
 ret_from_fork+0x507/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:245
 </TASK>

<<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>

Modules linked in:
CPU: 1 UID: 0 PID: 12317 Comm: kworker/1:4 Tainted: G             L      7.0.0-rc1 #1 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: events request_module_async
RIP: 0010:free_large_kmalloc+0xb3/0x160
Code: 25 00 00 00 ff 3d 00 00 00 f8 0f 85 a6 00 00 00 c7 43 30 ff ff ff ff 48 89 df 44 89 f6 e8 45 d9 fc ff 5b 41 5e 41 5f 5d c3 90 <0f> 0b 90 48 89 df 48 c7 c6 b7 4c 72 8d e8 cb e8 08 ff eb e4 90 0f
RSP: 0018:ffffc900028e76f8 EFLAGS: 00010287
RAX: 00000000f0000000 RBX: ffffea00019a5c00 RCX: ffff888067550001
RDX: 0000000000000000 RSI: ffff888066970000 RDI: ffffea00019a5c00
RBP: ffffc900028e7710 R08: ffff888049c40603 R09: 1ffff110093880c0
R10: dffffc0000000000 R11: ffffed10093880c1 R12: ffff888066970000
R13: ffffffff870bc0f1 R14: 0000000000000000 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880ef136000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fba7e4bf008 CR3: 000000005776b000 CR4: 00000000000006f0
Call Trace:
 <TASK>
 kfree+0xae/0x630
 usb_free_urb+0xd1/0x120
 em28xx_uninit_usb_xfer+0x165/0x310
 em28xx_alloc_urbs+0xf2a/0x1130
 em28xx_dvb_init+0x2b0/0x4a20
 em28xx_init_extension+0x121/0x1d0
 request_module_async+0x5e/0x80
 process_scheduled_works+0xae1/0x1800
 worker_thread+0xa0f/0xf70
 kthread+0x37d/0x470
 ret_from_fork+0x507/0xb90
 ret_from_fork_asm+0x11/0x20
 </TASK>
Kernel panic - not syncing: kernel: panic_on_warn set ...
CPU: 1 UID: 0 PID: 12317 Comm: kworker/1:4 Tainted: G             L      7.0.0-rc1 #1 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: events request_module_async
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30
 dump_stack_lvl+0x2b/0x150
 dump_stack+0x19/0x20
 vpanic+0x53e/0xa20
 panic+0xb9/0xc0
 __warn+0x320/0x500
 __report_bug+0x28d/0x500
 report_bug+0x175/0x220
 handle_bug+0x9c/0x200
 exc_invalid_op+0x1f/0x50
 asm_exc_invalid_op+0x1f/0x30
RIP: 0010:free_large_kmalloc+0xb3/0x160
Code: 25 00 00 00 ff 3d 00 00 00 f8 0f 85 a6 00 00 00 c7 43 30 ff ff ff ff 48 89 df 44 89 f6 e8 45 d9 fc ff 5b 41 5e 41 5f 5d c3 90 <0f> 0b 90 48 89 df 48 c7 c6 b7 4c 72 8d e8 cb e8 08 ff eb e4 90 0f
RSP: 0018:ffffc900028e76f8 EFLAGS: 00010287
RAX: 00000000f0000000 RBX: ffffea00019a5c00 RCX: ffff888067550001
RDX: 0000000000000000 RSI: ffff888066970000 RDI: ffffea00019a5c00
RBP: ffffc900028e7710 R08: ffff888049c40603 R09: 1ffff110093880c0
R10: dffffc0000000000 R11: ffffed10093880c1 R12: ffff888066970000
R13: ffffffff870bc0f1 R14: 0000000000000000 R15: dffffc0000000000
 kfree+0xae/0x630
 usb_free_urb+0xd1/0x120
 em28xx_uninit_usb_xfer+0x165/0x310
 em28xx_alloc_urbs+0xf2a/0x1130
 em28xx_dvb_init+0x2b0/0x4a20
 em28xx_init_extension+0x121/0x1d0
 request_module_async+0x5e/0x80
 process_scheduled_works+0xae1/0x1800
 worker_thread+0xa0f/0xf70
 kthread+0x37d/0x470
 ret_from_fork+0x507/0xb90
 ret_from_fork_asm+0x11/0x20
 </TASK>
Kernel Offset: disabled
Rebooting in 86400 seconds..

<<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>

[syzbot] [media?] [usb?] WARNING in usb_free_urb

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    e0cce98fe279 Merge tag 'tpmdd-next-6.10-rc2' of git://git...
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15c9b13c980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=238430243a58f702
dashboard link: https://syzkaller.appspot.com/bug?extid=b466336413a1fba398a5
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=15f3e2fc980000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=157ada62980000

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7bc7510fe41f/non_bootable_disk-e0cce98f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/5a8fbe5a0be1/vmlinux-e0cce98f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/1f8ed6b81845/bzImage-e0cce98f.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b466336413a1fba398a5@syzkaller.appspotmail.com

usb 5-1: Product: syz
usb 5-1: Manufacturer: syz
usb 5-1: SerialNumber: syz
smsusb:smsusb_probe: board id=7, interface number 55
smsusb:smsusb_probe: board id=7, interface number 147
smsusb:smsusb_probe: board id=7, interface number 0
smsusb:siano_media_device_register: media controller created
smsusb:smsusb_start_streaming: smsusb_submit_urb(...) failed
smsusb:smsusb_init_device: smsusb_start_streaming(...) failed
------------[ cut here ]------------
WARNING: CPU: 2 PID: 55 at mm/slub.c:4519 free_large_kmalloc+0xda/0x140 mm/slub.c:4519
Modules linked in:
CPU: 2 PID: 55 Comm: kworker/2:1 Not tainted 6.10.0-rc1-syzkaller-00021-ge0cce98fe279 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Workqueue: usb_hub_wq hub_event
RIP: 0010:free_large_kmalloc+0xda/0x140 mm/slub.c:4519
Code: 56 fb 8b 43 34 85 c0 75 c7 48 c7 c6 90 f0 26 8d 48 89 df e8 e8 08 f1 ff 90 0f 0b 48 89 df 5b 5d 41 5c 41 5d e9 47 a2 e4 ff 90 <0f> 0b 90 80 3d 3c b9 ee 0d 00 74 28 48 8b 74 24 20 48 89 ef e8 bd
RSP: 0018:ffffc90000a76e18 EFLAGS: 00010246
RAX: 00fff00000000000 RBX: ffffea0000c9d880 RCX: ffffffff813e21dc
RDX: ffff88801a924880 RSI: ffff888032762000 RDI: ffffea0000c9d880
RBP: ffff888032762000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88801ade0000
R13: ffff88801ac2b000 R14: dffffc0000000000 R15: ffff88801ade00f0
FS:  0000000000000000(0000) GS:ffff88806b200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f66ab5c8388 CR3: 000000002a16a000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 urb_destroy drivers/usb/core/urb.c:25 [inline]
 kref_put include/linux/kref.h:65 [inline]
 usb_free_urb.part.0+0xf8/0x110 drivers/usb/core/urb.c:97
 usb_free_urb+0x1f/0x30 drivers/usb/core/urb.c:96
 smsusb_term_device+0x108/0x1e0 drivers/media/usb/siano/smsusb.c:352
 smsusb_init_device+0xaa2/0xe10 drivers/media/usb/siano/smsusb.c:497
 smsusb_probe+0x5e2/0x10b0 drivers/media/usb/siano/smsusb.c:575
 usb_probe_interface+0x309/0x9d0 drivers/usb/core/driver.c:399
 call_driver_probe drivers/base/dd.c:578 [inline]
 really_probe+0x23e/0xa90 drivers/base/dd.c:656
 __driver_probe_device+0x1de/0x440 drivers/base/dd.c:798
 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:828
 __device_attach_driver+0x1df/0x310 drivers/base/dd.c:956
 bus_for_each_drv+0x157/0x1e0 drivers/base/bus.c:457
 __device_attach+0x1e8/0x4b0 drivers/base/dd.c:1028
 bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:532
 device_add+0x114b/0x1a70 drivers/base/core.c:3721
 usb_set_configuration+0x10cb/0x1c50 drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0xb1/0x110 drivers/usb/core/generic.c:254
 usb_probe_device+0xec/0x3e0 drivers/usb/core/driver.c:294
 call_driver_probe drivers/base/dd.c:578 [inline]
 really_probe+0x23e/0xa90 drivers/base/dd.c:656
 __driver_probe_device+0x1de/0x440 drivers/base/dd.c:798
 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:828
 __device_attach_driver+0x1df/0x310 drivers/base/dd.c:956
 bus_for_each_drv+0x157/0x1e0 drivers/base/bus.c:457
 __device_attach+0x1e8/0x4b0 drivers/base/dd.c:1028
 bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:532
 device_add+0x114b/0x1a70 drivers/base/core.c:3721
 usb_new_device+0xd90/0x1a10 drivers/usb/core/hub.c:2651
 hub_port_connect drivers/usb/core/hub.c:5521 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5661 [inline]
 port_event drivers/usb/core/hub.c:5821 [inline]
 hub_event+0x2db0/0x4e20 drivers/usb/core/hub.c:5903
 process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: WARNING in usb_free_urb

[Tetsuo Handa]

#syz test

diff --git a/drivers/media/common/siano/smscoreapi.c b/drivers/media/common/siano/smscoreapi.c
index 017629e3cf84..10159c07d295 100644
--- a/drivers/media/common/siano/smscoreapi.c
+++ b/drivers/media/common/siano/smscoreapi.c
@@ -612,8 +612,24 @@ static int smscore_notify_callbacks(struct smscore_device_t *coredev,
 }
 
 static struct
-smscore_buffer_t *smscore_createbuffer(u8 *buffer, void *common_buffer,
-				       dma_addr_t common_buffer_phys)
+smscore_buffer_t *smscore_create_usb_buffer(int buffer_size)
+{
+	struct smscore_buffer_t *cb;
+
+	cb = kzalloc_obj(*cb);
+	if (!cb)
+		return NULL;
+	cb->p = kzalloc(buffer_size, GFP_KERNEL);
+	if (!cb->p) {
+		kfree(cb);
+		return NULL;
+	}
+	return cb;
+}
+
+static struct
+smscore_buffer_t *smscore_create_dma_buffer(u8 *buffer, void *common_buffer,
+					    dma_addr_t common_buffer_phys)
 {
 	struct smscore_buffer_t *cb;
 
@@ -622,9 +638,8 @@ smscore_buffer_t *smscore_createbuffer(u8 *buffer, void *common_buffer,
 		return NULL;
 
 	cb->p = buffer;
-	cb->offset_in_common = buffer - (u8 *) common_buffer;
 	if (common_buffer_phys)
-		cb->phys = common_buffer_phys + cb->offset_in_common;
+		cb->phys = common_buffer_phys + (buffer - (u8 *) common_buffer);
 
 	return cb;
 }
@@ -684,27 +699,32 @@ int smscore_register_device(struct smsdevice_params_t *params,
 	init_waitqueue_head(&dev->buffer_mng_waitq);
 
 	/* alloc common buffer */
-	dev->common_buffer_size = params->buffer_size * params->num_buffers;
-	if (params->usb_device)
-		buffer = kzalloc(dev->common_buffer_size, GFP_KERNEL);
-	else
+	if (params->usb_device) {
+		dev->common_dma_buffer_size = 0;
+		buffer = NULL;
+	} else {
+		dev->common_dma_buffer_size = params->buffer_size * params->num_buffers;
 		buffer = dma_alloc_coherent(params->device,
-					    dev->common_buffer_size,
-					    &dev->common_buffer_phys,
+					    dev->common_dma_buffer_size,
+					    &dev->common_dma_buffer_phys,
 					    GFP_KERNEL | dev->gfp_buf_flags);
-	if (!buffer) {
-		smscore_unregister_device(dev);
-		return -ENOMEM;
+		if (!buffer) {
+			smscore_unregister_device(dev);
+			return -ENOMEM;
+		}
 	}
-	dev->common_buffer = buffer;
+	dev->common_dma_buffer = buffer;
 
 	/* prepare dma buffers */
 	for (; dev->num_buffers < params->num_buffers;
 	     dev->num_buffers++, buffer += params->buffer_size) {
 		struct smscore_buffer_t *cb;
 
-		cb = smscore_createbuffer(buffer, dev->common_buffer,
-					  dev->common_buffer_phys);
+		if (params->usb_device)
+			cb = smscore_create_usb_buffer(params->buffer_size);
+		else
+			cb = smscore_create_dma_buffer(buffer, dev->common_dma_buffer,
+						       dev->common_dma_buffer_phys);
 		if (!cb) {
 			smscore_unregister_device(dev);
 			return -ENOMEM;
@@ -1204,6 +1224,8 @@ void smscore_unregister_device(struct smscore_device_t *coredev)
 		while (!list_empty(&coredev->buffers)) {
 			cb = (struct smscore_buffer_t *) coredev->buffers.next;
 			list_del(&cb->entry);
+			if (coredev->usb_device)
+				kfree(cb->p);
 			kfree(cb);
 			num_buffers++;
 		}
@@ -1223,15 +1245,11 @@ void smscore_unregister_device(struct smscore_device_t *coredev)
 
 	pr_debug("freed %d buffers\n", num_buffers);
 
-	if (coredev->common_buffer) {
-		if (coredev->usb_device)
-			kfree(coredev->common_buffer);
-		else
-			dma_free_coherent(coredev->device,
-					  coredev->common_buffer_size,
-					  coredev->common_buffer,
-					  coredev->common_buffer_phys);
-	}
+	if (coredev->common_dma_buffer)
+		dma_free_coherent(coredev->device,
+				  coredev->common_dma_buffer_size,
+				  coredev->common_dma_buffer,
+				  coredev->common_dma_buffer_phys);
 	kfree(coredev->fw_buf);
 
 	list_del(&coredev->entry);
diff --git a/drivers/media/common/siano/smscoreapi.h b/drivers/media/common/siano/smscoreapi.h
index d945a2d6d624..a06c8af6eb3a 100644
--- a/drivers/media/common/siano/smscoreapi.h
+++ b/drivers/media/common/siano/smscoreapi.h
@@ -112,7 +112,6 @@ struct smscore_buffer_t {
 	/* private members, read-only for clients */
 	void *p;
 	dma_addr_t phys;
-	unsigned long offset_in_common;
 };
 
 struct smsdevice_params_t {
@@ -154,9 +153,9 @@ struct smscore_device_t {
 	spinlock_t bufferslock;
 	int num_buffers;
 
-	void *common_buffer;
-	int common_buffer_size;
-	dma_addr_t common_buffer_phys;
+	void *common_dma_buffer;
+	int common_dma_buffer_size;
+	dma_addr_t common_dma_buffer_phys;
 
 	void *context;
 	struct device *device;