Re: snd-usb-audio: list_add corruption in snd_complete_urb, fatal panic in softirq (7.2.9)

[Takashi Iwai <tiwai@suse.de>]

On Tue, 03 Nov 2026 21:33:21 +0100,
Juan M. Méndez Rey wrote:
> 
> Hi Linux Sound/ALSA team,
> 
> My desktop panicked with a list_add corruption inside snd_complete_urb().
> It happened in softirq context, so the box hung instead of logging to disk.
> I only got the trace because efi_pstore saved it.
> 
> Kernel is Debian 7.2.9+deb14-amd64 (7.2.9-1), not tainted, 16 days of uptime.
> Board is an ASUS ROG STRIX B650-A GAMING WIFI, BIOS 3042.
> 
> Two USB audio devices use snd-usb-audio:
> 
>   0b05:1a52 ASUS USB Audio (onboard), high speed, bus 1
>   338a:1517 Aisa Expert TEMPEST PRO 20 (headset), full speed, bus 5,
>             the default PipeWire sink
> 
> The trace doesn't say which one it was. As far as I know nobody was
> playing audio at that moment. A KDE notification popped up about 20 s
> before the crash, and PipeWire (1.6.9) keeps a speech-dispatcher dummy
> stream linked to the headset, so a short-lived stream is my best guess.
> I haven't reproduced it, and it's the first time I've seen it.
> 
>   list_add corruption. prev->next should be next (ffff8a5849b8f590), but was ffff8a5849b8e148. (prev=ffff8a5849b8e148).
>   kernel BUG at lib/list_debug.c:32!
>   Oops: invalid opcode: 0000 [#1] SMP NOPTI
>   CPU: 21 UID: 0 PID: 0 Comm: swapper/21 Not tainted 7.2.9+deb14-amd64 #1 PREEMPT(lazy)  Debian 7.2.9-1
>   RIP: 0010:__list_add_valid_or_report+0xa6/0xb0
>   Call Trace:
>    <IRQ>
>    snd_complete_urb+0xff/0x750 [snd_usb_audio]
>    __usb_hcd_giveback_urb+0xa0/0x120 [usbcore]
>    usb_giveback_urb_bh+0xb3/0x150 [usbcore]
>    process_one_work+0x19e/0x370
>    bh_worker+0x1cb/0x1f0
>    tasklet_hi_action+0x13/0x30
>    handle_softirqs+0xd9/0x310
>    __irq_exit_rcu+0xa1/0xf0
>    common_interrupt+0x85/0xa0
>    </IRQ>
>   Kernel panic - not syncing: Fatal exception in interrupt
> 
> I decoded it with the Debian 7.2.9 debug symbols. snd_complete_urb+0xff
> is the list_add_tail() in push_back_to_ready_list(), called from the
> low-latency / implicit-fb branch of snd_complete_urb():
> 
>   __list_add_valid       include/linux/list.h:96
>   list_add_tail          include/linux/list.h:198
>   push_back_to_ready_list sound/usb/endpoint.c:452
>   snd_complete_urb       sound/usb/endpoint.c:572
> 
> The addresses line up with one struct snd_usb_endpoint (5744 bytes, so
> kmalloc-8k, starting at ffff8a5849b8e000):
> 
>   next = ...f590 = ep + 0x1590 = &ep->ready_playback_urbs
>   prev = ...e148 = ep + 0x148  = &ep->urb[0].ready_list
> 
> So ep->ready_playback_urbs.prev still pointed at urb[0], but urb[0]'s
> ready_list was already self-linked, like after the list_del_init() in
> snd_usb_queue_pending_output_urbs(). The list head and the entry
> disagree. I'd guess urb[0] got onto the list twice, or the
> INIT_LIST_HEAD() in stop_urbs() raced with a completion, but I haven't
> proven either.
> 
> I looked through the stable changes up to 7.2.12 and didn't find a fix
> for this. The full pstore dump is attached, with the UPS serial removed.

This should have been already addressed in the upstream.
Could you try 7.3 kernel, or cherry-pick the fix commit
dbd9d1cbf970 ("ALSA: usb-audio: fix list_add double-add in
push_back_to_ready_list")?


thanks,

Takashi