snd-usb-audio: list_add corruption in snd_complete_urb, fatal panic in softirq (7.2.9)

snd-usb-audio: list_add corruption in snd_complete_urb, fatal panic in softirq (7.2.9)

[Juan M. Méndez Rey]

[-- Attachment #1: Type: text/plain, Size: 2936 bytes --]

Hi Linux Sound/ALSA team,

My desktop panicked with a list_add corruption inside snd_complete_urb().
It happened in softirq context, so the box hung instead of logging to disk.
I only got the trace because efi_pstore saved it.

Kernel is Debian 7.2.9+deb14-amd64 (7.2.9-1), not tainted, 16 days of uptime.
Board is an ASUS ROG STRIX B650-A GAMING WIFI, BIOS 3042.

Two USB audio devices use snd-usb-audio:

  0b05:1a52 ASUS USB Audio (onboard), high speed, bus 1
  338a:1517 Aisa Expert TEMPEST PRO 20 (headset), full speed, bus 5,
            the default PipeWire sink

The trace doesn't say which one it was. As far as I know nobody was
playing audio at that moment. A KDE notification popped up about 20 s
before the crash, and PipeWire (1.6.9) keeps a speech-dispatcher dummy
stream linked to the headset, so a short-lived stream is my best guess.
I haven't reproduced it, and it's the first time I've seen it.

  list_add corruption. prev->next should be next (ffff8a5849b8f590), but was ffff8a5849b8e148. (prev=ffff8a5849b8e148).
  kernel BUG at lib/list_debug.c:32!
  Oops: invalid opcode: 0000 [#1] SMP NOPTI
  CPU: 21 UID: 0 PID: 0 Comm: swapper/21 Not tainted 7.2.9+deb14-amd64 #1 PREEMPT(lazy)  Debian 7.2.9-1
  RIP: 0010:__list_add_valid_or_report+0xa6/0xb0
  Call Trace:
   <IRQ>
   snd_complete_urb+0xff/0x750 [snd_usb_audio]
   __usb_hcd_giveback_urb+0xa0/0x120 [usbcore]
   usb_giveback_urb_bh+0xb3/0x150 [usbcore]
   process_one_work+0x19e/0x370
   bh_worker+0x1cb/0x1f0
   tasklet_hi_action+0x13/0x30
   handle_softirqs+0xd9/0x310
   __irq_exit_rcu+0xa1/0xf0
   common_interrupt+0x85/0xa0
   </IRQ>
  Kernel panic - not syncing: Fatal exception in interrupt

I decoded it with the Debian 7.2.9 debug symbols. snd_complete_urb+0xff
is the list_add_tail() in push_back_to_ready_list(), called from the
low-latency / implicit-fb branch of snd_complete_urb():

  __list_add_valid       include/linux/list.h:96
  list_add_tail          include/linux/list.h:198
  push_back_to_ready_list sound/usb/endpoint.c:452
  snd_complete_urb       sound/usb/endpoint.c:572

The addresses line up with one struct snd_usb_endpoint (5744 bytes, so
kmalloc-8k, starting at ffff8a5849b8e000):

  next = ...f590 = ep + 0x1590 = &ep->ready_playback_urbs
  prev = ...e148 = ep + 0x148  = &ep->urb[0].ready_list

So ep->ready_playback_urbs.prev still pointed at urb[0], but urb[0]'s
ready_list was already self-linked, like after the list_del_init() in
snd_usb_queue_pending_output_urbs(). The list head and the entry
disagree. I'd guess urb[0] got onto the list twice, or the
INIT_LIST_HEAD() in stop_urbs() raced with a completion, but I haven't
proven either.

I looked through the stable changes up to 7.2.12 and didn't find a fix
for this. The full pstore dump is attached, with the UPS serial removed.

Thanks,
Juan

[-- Attachment #2: pstore-oops-2026-11-01.txt --]
[-- Type: text/plain, Size: 35324 bytes --]

<6>[1188676.673871] traps: loop[1689193] trap int3 ip:55555556a9a5 sp:7fffffffd930 error:0 in loop[159a5,555555569000+40000]
<6>[1188676.877833] traps: loop[1689269] trap int3 ip:55555556a9a5 sp:7fffffffd930 error:0 in loop[159a5,555555569000+40000]
<6>[1188979.624036] traps: main.dbg[1699679] trap int3 ip:5555555682f5 sp:7fffffffd6b0 error:0 in main.dbg[132f5,555555568000+3e000]
<6>[1189124.604839] traps: main.dbg[1726838] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1189149.041071] traps: main.dbg[1729543] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1189367.387201] traps: main.dbg[1761397] trap int3 ip:5555555682f5 sp:7fffffffd5e0 error:0 in main.dbg[132f5,555555568000+3e000]
<4>[1189367.387237] coredump: 1761397(main.dbg): RLIMIT_CORE is set to 1, aborting core
<6>[1189652.477360] traps: main.dbg[1776344] trap int3 ip:555555568209 sp:7fffffffd600 error:0 in main.dbg[13209,555555567000+3f000]
<4>[1189652.477393] coredump: 1776344(main.dbg): RLIMIT_CORE is set to 1, aborting core
<6>[1189700.577742] traps: main.dbg[1777529] trap int3 ip:555555568209 sp:7fffffffd600 error:0 in main.dbg[13209,555555567000+3f000]
<4>[1189700.577775] coredump: 1777529(main.dbg): RLIMIT_CORE is set to 1, aborting core
<6>[1191386.721301] traps: main.dbg[1887772] trap int3 ip:5555555682f5 sp:7fffffffd6b0 error:0 in main.dbg[132f5,555555568000+3e000]
<6>[1192001.212790] traps: main.dbg[1902674] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1192073.225564] traps: main.dbg[1904835] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1192796.662266] traps: main.dbg[1923135] trap int3 ip:5555555682f5 sp:7fffffffd6d0 error:0 in main.dbg[132f5,555555568000+3e000]
<6>[1192942.619069] traps: main.dbg[1937593] trap int3 ip:555555568209 sp:7fffffffd6f0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1192967.075193] traps: main.dbg[1943348] trap int3 ip:555555568209 sp:7fffffffd6f0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1194439.087711] traps: main.dbg[2325784] trap int3 ip:55555556aa81 sp:7fffffffd6e0 error:0 in main.dbg[15a81,555555569000+40000]
<6>[1194487.223979] traps: main.dbg[2333489] trap int3 ip:55555556aa81 sp:7fffffffd6e0 error:0 in main.dbg[15a81,555555569000+40000]
<6>[1194533.352085] traps: main.dbg[2342037] trap int3 ip:55555556aa81 sp:7fffffffd6e0 error:0 in main.dbg[15a81,555555569000+40000]
<6>[1194983.610925] traps: main.dbg[2416255] trap int3 ip:5555555682f5 sp:7fffffffd6b0 error:0 in main.dbg[132f5,555555568000+3e000]
<6>[1195129.404039] traps: main.dbg[2443114] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1195153.824030] traps: main.dbg[2451070] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1195348.756952] traps: main.dbg[2484806] trap int3 ip:5555555682f5 sp:7fffffffd5e0 error:0 in main.dbg[132f5,555555568000+3e000]
<4>[1195348.756988] coredump: 2484806(main.dbg): RLIMIT_CORE is set to 1, aborting core
<6>[1195634.022400] traps: main.dbg[2556162] trap int3 ip:555555568209 sp:7fffffffd600 error:0 in main.dbg[13209,555555567000+3f000]
<4>[1195634.022433] coredump: 2556162(main.dbg): RLIMIT_CORE is set to 1, aborting core
<6>[1195682.130743] traps: main.dbg[2556784] trap int3 ip:555555568209 sp:7fffffffd600 error:0 in main.dbg[13209,555555567000+3f000]
<4>[1195682.130768] coredump: 2556784(main.dbg): RLIMIT_CORE is set to 1, aborting core
<6>[1197512.742059] traps: main.dbg[2593553] trap int3 ip:5555555682f5 sp:7fffffffd6b0 error:0 in main.dbg[132f5,555555568000+3e000]
<6>[1198127.243465] traps: main.dbg[2634053] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1198198.923817] traps: main.dbg[2640397] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1200099.274893] traps: main.dbg[2826200] trap int3 ip:55555556aa81 sp:7fffffffd6d0 error:0 in main.dbg[15a81,555555569000+40000]
<6>[1200282.375875] traps: main.dbg[2850015] trap int3 ip:55555556aa81 sp:7fffffffd6d0 error:0 in main.dbg[15a81,555555569000+40000]
<6>[1200677.714195] traps: main.dbg[2903107] trap int3 ip:5555555682f5 sp:7fffffffd6c0 error:0 in main.dbg[132f5,555555568000+3e000]
<6>[1200823.243269] traps: main.dbg[2925358] trap int3 ip:555555568209 sp:7fffffffd6f0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1200847.679203] traps: main.dbg[2926340] trap int3 ip:555555568209 sp:7fffffffd6f0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1203582.553631] traps: main.dbg[3377475] trap int3 ip:5555555682f5 sp:7fffffffd6b0 error:0 in main.dbg[132f5,555555568000+3e000]
<6>[1203728.557939] traps: main.dbg[3406395] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1203752.982055] traps: main.dbg[3407998] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1203960.419259] traps: main.dbg[3450443] trap int3 ip:5555555682f5 sp:7fffffffd5e0 error:0 in main.dbg[132f5,555555568000+3e000]
<4>[1203960.419297] coredump: 3450443(main.dbg): RLIMIT_CORE is set to 1, aborting core
<6>[1204246.748747] traps: main.dbg[3488775] trap int3 ip:555555568209 sp:7fffffffd600 error:0 in main.dbg[13209,555555567000+3f000]
<4>[1204246.748806] coredump: 3488775(main.dbg): RLIMIT_CORE is set to 1, aborting core
<6>[1204294.836665] traps: main.dbg[3504994] trap int3 ip:555555568209 sp:7fffffffd600 error:0 in main.dbg[13209,555555567000+3f000]
<4>[1204294.836693] coredump: 3504994(main.dbg): RLIMIT_CORE is set to 1, aborting core
<6>[1206124.662200] traps: main.dbg[3793409] trap int3 ip:5555555682f5 sp:7fffffffd6b0 error:0 in main.dbg[132f5,555555568000+3e000]
<6>[1206740.035532] traps: main.dbg[3867253] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1206811.963781] traps: main.dbg[3873769] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1208264.810021] traps: main.dbg[4124364] trap int3 ip:5555555682f5 sp:7fffffffd6b0 error:0 in main.dbg[132f5,555555568000+3e000]
<6>[1208413.542116] traps: main.dbg[4147022] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1208437.966078] traps: main.dbg[4147593] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1217047.435029] traps: main.dbg[788617] trap int3 ip:5555555682f5 sp:7fffffffd6a0 error:0 in main.dbg[132f5,555555568000+3e000]
<6>[1217378.987650] usb 1-12: USB disconnect, device number 10
<6>[1217379.313158] usb 1-12: new full-speed USB device number 28 using xhci_hcd
<6>[1217379.648969] usb 1-12: New USB device found, idVendor=0483, idProduct=a430, bcdDevice= 2.00
<6>[1217379.691684] usb 1-12: New USB device strings: Mfr=3, Product=1, SerialNumber=2
<6>[1217379.691690] usb 1-12: Product: 2000
<6>[1217379.691693] usb 1-12: Manufacturer: UPS Manufacturer 
<6>[1217379.691694] usb 1-12: SerialNumber: [redacted]
<6>[1217379.730252] hid-generic 0003:0483:A430.000D: hiddev5,hidraw11: USB HID v1.11 Device [UPS Manufacturer  2000] on usb-0000:0c:00.0-12/input0
<6>[1217720.662982] traps: main.dbg[884124] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1217804.777879] traps: main.dbg[897243] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<46>[1220190.888885] systemd-journald[2604336]: Under memory pressure, flushing caches.
<6>[1223476.640283] traps: main.dbg[1703612] trap int3 ip:5555555682f5 sp:7fffffffd690 error:0 in main.dbg[132f5,555555568000+3e000]
<6>[1223622.865152] traps: main.dbg[1708694] trap int3 ip:555555568209 sp:7fffffffd6c0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1223647.313331] traps: main.dbg[1709185] trap int3 ip:555555568209 sp:7fffffffd6b0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1224350.325564] traps: main.dbg[1724835] trap int3 ip:55555556aa27 sp:7fffffffd6c0 error:0 in main.dbg[15a27,555555569000+40000]
<6>[1224392.817999] traps: main.dbg[1725434] trap int3 ip:55555556acfc sp:7fffffffd690 error:0 in main.dbg[15cfc,555555569000+41000]
<6>[1224548.654707] traps: main.dbg[1730089] trap int3 ip:55555556aa27 sp:7fffffffd6b0 error:0 in main.dbg[15a27,555555569000+40000]
<6>[1224632.774495] usb 1-9: USB disconnect, device number 7
<6>[1224633.431077] usb 1-9: new low-speed USB device number 29 using xhci_hcd
<6>[1224633.717228] usb 1-9: New USB device found, idVendor=04f3, idProduct=0103, bcdDevice= 1.07
<6>[1224633.731221] usb 1-9: New USB device strings: Mfr=0, Product=0, SerialNumber=0
<6>[1224633.761524] input: HID 04f3:0103 as /devices/pci0000:00/0000:00:02.1/0000:05:00.0/0000:06:0c.0/0000:0c:00.0/usb1/1-9/1-9:1.0/0003:04F3:0103.000E/input/input27
<6>[1224633.803147] hid-generic 0003:04F3:0103.000E: input,hidraw7: USB HID v1.10 Keyboard [HID 04f3:0103] on usb-0000:0c:00.0-9/input0
<6>[1224633.813507] input: HID 04f3:0103 Consumer Control as /devices/pci0000:00/0000:00:02.1/0000:05:00.0/0000:06:0c.0/0000:0c:00.0/usb1/1-9/1-9:1.1/0003:04F3:0103.000F/input/input28
<6>[1224633.813605] input: HID 04f3:0103 System Control as /devices/pci0000:00/0000:00:02.1/0000:05:00.0/0000:06:0c.0/0000:0c:00.0/usb1/1-9/1-9:1.1/0003:04F3:0103.000F/input/input29
<6>[1224633.813700] hid-generic 0003:04F3:0103.000F: input,hidraw8: USB HID v1.10 Device [HID 04f3:0103] on usb-0000:0c:00.0-9/input1
<6>[1224633.813830] usb 1-12: USB disconnect, device number 28
<6>[1224634.143020] usb 1-12: new full-speed USB device number 30 using xhci_hcd
<6>[1224634.483417] usb 1-12: New USB device found, idVendor=0483, idProduct=a430, bcdDevice= 2.00
<6>[1224634.526152] usb 1-12: New USB device strings: Mfr=3, Product=1, SerialNumber=2
<6>[1224634.526156] usb 1-12: Product: 2000
<6>[1224634.526158] usb 1-12: Manufacturer: UPS Manufacturer 
<6>[1224634.526160] usb 1-12: SerialNumber: [redacted]
<6>[1224634.564743] hid-generic 0003:0483:A430.0010: hiddev5,hidraw11: USB HID v1.11 Device [UPS Manufacturer  2000] on usb-0000:0c:00.0-12/input0
<6>[1224648.359019] traps: main.dbg[1733361] trap int3 ip:55555556aa27 sp:7fffffffd6b0 error:0 in main.dbg[15a27,555555569000+40000]
<6>[1225105.294077] traps: main.dbg[1746619] trap int3 ip:55555556aa27 sp:7fffffffd6c0 error:0 in main.dbg[15a27,555555569000+40000]
<6>[1225202.578691] traps: main.dbg[1748649] trap int3 ip:55555556acfc sp:7fffffffd690 error:0 in main.dbg[15cfc,555555569000+41000]
<6>[1225234.414878] traps: main.dbg[1749219] trap int3 ip:5555555682f5 sp:7fffffffd6a0 error:0 in main.dbg[132f5,555555568000+3e000]
<6>[1225380.439897] traps: main.dbg[1753380] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1225404.883977] traps: main.dbg[1753707] trap int3 ip:555555568209 sp:7fffffffd6c0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1226811.088441] traps: main.dbg[1782740] trap int3 ip:55555556aa27 sp:7fffffffd6c0 error:0 in main.dbg[15a27,555555569000+40000]
<6>[1226908.312884] traps: main.dbg[1784758] trap int3 ip:55555556acfc sp:7fffffffd690 error:0 in main.dbg[15cfc,555555569000+41000]
<6>[1227207.723864] traps: main.dbg[1789444] trap int3 ip:5555555682f5 sp:7fffffffd6a0 error:0 in main.dbg[132f5,555555568000+3e000]
<6>[1227821.897683] traps: main.dbg[1802207] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1227893.922276] traps: main.dbg[1804016] trap int3 ip:555555568209 sp:7fffffffd6c0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1228406.633998] traps: main.dbg[1814861] trap int3 ip:55555556acfc sp:7fffffffd690 error:0 in main.dbg[15cfc,555555569000+41000]
<6>[1228740.976711] traps: main.dbg[1824036] trap int3 ip:55555556aa27 sp:7fffffffd680 error:0 in main.dbg[15a27,555555569000+40000]
<4>[1228740.976755] coredump: 1824036(main.dbg): RLIMIT_CORE is set to 1, aborting core
<6>[1228803.040814] traps: main.dbg[1825751] trap int3 ip:55555556acfc sp:7fffffffd650 error:0 in main.dbg[15cfc,555555569000+41000]
<4>[1228803.040846] coredump: 1825751(main.dbg): RLIMIT_CORE is set to 1, aborting core
<6>[1228843.761300] traps: main.dbg[1827328] trap int3 ip:5555555682f5 sp:7fffffffd660 error:0 in main.dbg[132f5,555555568000+3e000]
<4>[1228843.761336] coredump: 1827328(main.dbg): RLIMIT_CORE is set to 1, aborting core
<6>[1229047.930738] traps: main.dbg[1835036] trap int3 ip:555555568209 sp:7fffffffd690 error:0 in main.dbg[13209,555555567000+3f000]
<4>[1229047.930771] coredump: 1835036(main.dbg): RLIMIT_CORE is set to 1, aborting core
<6>[1229084.906574] traps: main.dbg[1836472] trap int3 ip:555555568209 sp:7fffffffd690 error:0 in main.dbg[13209,555555567000+3f000]
<4>[1229084.906620] coredump: 1836472(main.dbg): RLIMIT_CORE is set to 1, aborting core
<6>[1229564.289715] traps: main.dbg[1849258] trap int3 ip:55555556aa27 sp:7fffffffd6e0 error:0 in main.dbg[15a27,555555569000+40000]
<6>[1229664.399207] traps: main.dbg[1855010] trap int3 ip:55555556aa27 sp:7fffffffd6e0 error:0 in main.dbg[15a27,555555569000+40000]
<6>[1230064.365485] traps: main.dbg[1873133] trap int3 ip:55555556aa27 sp:7fffffffd6e0 error:0 in main.dbg[15a27,555555569000+40000]
<6>[1230099.185626] traps: main.dbg[1874523] trap int3 ip:55555556aa27 sp:7fffffffd6c0 error:0 in main.dbg[15a27,555555569000+40000]
<6>[1230160.897792] traps: main.dbg[1877324] trap int3 ip:55555556acfc sp:7fffffffd690 error:0 in main.dbg[15cfc,555555569000+41000]
<6>[1230555.679160] traps: main.dbg[1891960] trap int3 ip:55555556acfc sp:7fffffffd630 error:0 in main.dbg[15cfc,555555569000+41000]
<6>[1231196.337793] traps: main.dbg[1911298] trap int3 ip:55555556aa27 sp:7fffffffd6c0 error:0 in main.dbg[15a27,555555569000+40000]
<6>[1231258.338080] traps: main.dbg[1914139] trap int3 ip:55555556acfc sp:7fffffffd690 error:0 in main.dbg[15cfc,555555569000+41000]
<6>[1231369.878546] traps: main.dbg[1919035] trap int3 ip:55555556aa27 sp:7fffffffd680 error:0 in main.dbg[15a27,555555569000+40000]
<4>[1231369.878594] coredump: 1919035(main.dbg): RLIMIT_CORE is set to 1, aborting core
<6>[1231431.734792] traps: main.dbg[1920804] trap int3 ip:55555556acfc sp:7fffffffd650 error:0 in main.dbg[15cfc,555555569000+41000]
<4>[1231431.734823] coredump: 1920804(main.dbg): RLIMIT_CORE is set to 1, aborting core
<6>[1231519.719171] traps: main.dbg[1923117] trap int3 ip:5555555682f5 sp:7fffffffd660 error:0 in main.dbg[132f5,555555568000+3e000]
<4>[1231519.719205] coredump: 1923117(main.dbg): RLIMIT_CORE is set to 1, aborting core
<6>[1231557.687373] traps: main.dbg[1924945] trap int3 ip:5555555682f5 sp:7fffffffd6b0 error:0 in main.dbg[132f5,555555568000+3e000]
<6>[1231723.752321] traps: main.dbg[1931973] trap int3 ip:555555568209 sp:7fffffffd690 error:0 in main.dbg[13209,555555567000+3f000]
<4>[1231723.752366] coredump: 1931973(main.dbg): RLIMIT_CORE is set to 1, aborting core
<6>[1231760.564276] traps: main.dbg[1933476] trap int3 ip:555555568209 sp:7fffffffd690 error:0 in main.dbg[13209,555555567000+3f000]
<4>[1231760.564311] coredump: 1933476(main.dbg): RLIMIT_CORE is set to 1, aborting core
<6>[1232171.473891] traps: main.dbg[1953582] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1232243.206201] traps: main.dbg[1956053] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1242496.910987] traps: main.dbg[2081441] trap int3 ip:55555556aa27 sp:7fffffffd6c0 error:0 in main.dbg[15a27,555555569000+40000]
<6>[1242559.099409] traps: main.dbg[2083175] trap int3 ip:55555556acfc sp:7fffffffd690 error:0 in main.dbg[15cfc,555555569000+41000]
<6>[1242858.806070] traps: main.dbg[2087723] trap int3 ip:5555555682f5 sp:7fffffffd6a0 error:0 in main.dbg[132f5,555555568000+3e000]
<6>[1243529.919197] traps: main.dbg[2101940] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1243614.039556] traps: main.dbg[2104169] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1273469.874057] traps: main.dbg[2416663] trap int3 ip:55555556ed3f sp:7fffffffd4b0 error:0 in main.dbg[19d3f,55555556b000+44000]
<6>[1274380.770691] traps: main.dbg[2433323] trap int3 ip:55555556ed3f sp:7fffffffd4b0 error:0 in main.dbg[19d3f,55555556b000+44000]
<6>[1274411.083188] traps: main.dbg[2434776] trap int3 ip:55555556ed3f sp:7fffffffd490 error:0 in main.dbg[19d3f,55555556b000+44000]
<6>[1275523.343785] traps: main.dbg[2452933] trap int3 ip:55555556aa27 sp:7fffffffd6c0 error:0 in main.dbg[15a27,555555569000+40000]
<6>[1275585.344105] traps: main.dbg[2454633] trap int3 ip:55555556acfc sp:7fffffffd690 error:0 in main.dbg[15cfc,555555569000+41000]
<6>[1275884.878700] traps: main.dbg[2459185] trap int3 ip:5555555682f5 sp:7fffffffd6b0 error:0 in main.dbg[132f5,555555568000+3e000]
<6>[1276500.150640] traps: main.dbg[2472101] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1276572.251220] traps: main.dbg[2473972] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1277138.758813] traps: main.dbg[2485329] trap int3 ip:55555556ed3f sp:7fffffffd4c0 error:0 in main.dbg[19d3f,55555556b000+44000]
<6>[1278790.769476] traps: main.dbg[2506057] trap int3 ip:55555556ed3f sp:7fffffffd470 error:0 in main.dbg[19d3f,55555556b000+44000]
<4>[1278790.769521] coredump: 2506057(main.dbg): RLIMIT_CORE is set to 1, aborting core
<6>[1279112.391384] traps: main.dbg[2510551] trap int3 ip:55555556ed3f sp:7fffffffd420 error:0 in main.dbg[19d3f,55555556b000+44000]
<6>[1281094.877250] traps: main.dbg[2533621] trap int3 ip:55555556ed3f sp:7fffffffd500 error:0 in main.dbg[19d3f,55555556b000+44000]
<6>[1281920.651269] traps: main.dbg[2553050] trap int3 ip:55555556aa27 sp:7fffffffd6e0 error:0 in main.dbg[15a27,555555569000+40000]
<6>[1281982.495569] traps: main.dbg[2554806] trap int3 ip:55555556acfc sp:7fffffffd6b0 error:0 in main.dbg[15cfc,555555569000+41000]
<6>[1282282.209633] traps: main.dbg[2561773] trap int3 ip:5555555682f5 sp:7fffffffd6d0 error:0 in main.dbg[132f5,555555568000+3e000]
<6>[1282896.445668] traps: main.dbg[2575745] trap int3 ip:555555568209 sp:7fffffffd6f0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1282968.542132] traps: main.dbg[2577601] trap int3 ip:555555568209 sp:7fffffffd6f0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1283098.310947] traps: main.dbg[2582328] trap int3 ip:55555556ed3f sp:7fffffffd490 error:0 in main.dbg[19d3f,55555556b000+44000]
<4>[1283098.310979] coredump: 2582328(main.dbg): RLIMIT_CORE is set to 1, aborting core
<6>[1283534.701917] traps: main.dbg[2590753] trap int3 ip:55555556ed3f sp:7fffffffd4e0 error:0 in main.dbg[19d3f,55555556b000+44000]
<4>[1285696.829900] amdgpu 0000:03:00.0: VM memory stats for proc kscreenlocker_g(3398182) task kscreenloc:cs0(3398175) is non-zero when fini
<6>[1288978.126935] traps: main.dbg[2666422] trap int3 ip:55555556aa27 sp:7fffffffd660 error:0 in main.dbg[15a27,555555569000+40000]
<6>[1289040.139387] traps: main.dbg[2668299] trap int3 ip:55555556acfc sp:7fffffffd630 error:0 in main.dbg[15cfc,555555569000+41000]
<6>[1289339.617589] traps: main.dbg[2673867] trap int3 ip:5555555682f5 sp:7fffffffd640 error:0 in main.dbg[132f5,555555568000+3e000]
<6>[1289959.401870] traps: main.dbg[2691048] trap int3 ip:555555568209 sp:7fffffffd670 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1290031.466339] traps: main.dbg[2693457] trap int3 ip:555555568209 sp:7fffffffd660 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1290644.346202] traps: main.dbg[2706734] trap int3 ip:55555556ed3f sp:7fffffffd450 error:0 in main.dbg[19d3f,55555556b000+44000]
<6>[1293251.279741] traps: main.dbg[2748794] trap int3 ip:55555556aa27 sp:7fffffffd660 error:0 in main.dbg[15a27,555555569000+40000]
<6>[1293313.531989] traps: main.dbg[2750749] trap int3 ip:55555556acfc sp:7fffffffd630 error:0 in main.dbg[15cfc,555555569000+41000]
<6>[1293613.325447] traps: main.dbg[2756456] trap int3 ip:5555555682f5 sp:7fffffffd640 error:0 in main.dbg[132f5,555555568000+3e000]
<6>[1294228.356550] traps: main.dbg[2770223] trap int3 ip:555555568209 sp:7fffffffd670 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1294300.152950] traps: main.dbg[2772195] trap int3 ip:555555568209 sp:7fffffffd660 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1294912.720243] traps: main.dbg[2786021] trap int3 ip:55555556ed3f sp:7fffffffd450 error:0 in main.dbg[19d3f,55555556b000+44000]
<6>[1296072.262996] traps: main.dbg[2839836] trap int3 ip:55555556ed3f sp:7fffffffd470 error:0 in main.dbg[19d3f,55555556b000+44000]
<4>[1296072.263023] coredump: 2839836(main.dbg): RLIMIT_CORE is set to 1, aborting core
<6>[1297342.099104] traps: main.dbg[2872444] trap int3 ip:55555556aa27 sp:7fffffffd660 error:0 in main.dbg[15a27,555555569000+40000]
<6>[1297404.279584] traps: main.dbg[2874364] trap int3 ip:55555556acfc sp:7fffffffd630 error:0 in main.dbg[15cfc,555555569000+41000]
<6>[1297703.717352] traps: main.dbg[2880718] trap int3 ip:5555555682f5 sp:7fffffffd640 error:0 in main.dbg[132f5,555555568000+3e000]
<6>[1297975.971021] traps: main.dbg[2887441] trap int3 ip:55555556ed3f sp:7fffffffd4d0 error:0 in main.dbg[19d3f,55555556b000+44000]
<6>[1298319.189309] traps: main.dbg[2896833] trap int3 ip:555555568209 sp:7fffffffd670 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1298391.229774] traps: main.dbg[2898880] trap int3 ip:555555568209 sp:7fffffffd660 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1298943.083883] traps: main.dbg[2912281] trap int3 ip:55555556ed3f sp:7fffffffd4a0 error:0 in main.dbg[19d3f,55555556b000+44000]
<4>[1298943.083919] coredump: 2912281(main.dbg): RLIMIT_CORE is set to 1, aborting core
<6>[1299004.460825] traps: main.dbg[2914163] trap int3 ip:55555556ed3f sp:7fffffffd450 error:0 in main.dbg[19d3f,55555556b000+44000]
<4>[1303425.891494] coredump: 2993513(a68g): RLIMIT_CORE is set to 1, aborting core
<4>[1303445.461864] coredump: 2994721(a68g): RLIMIT_CORE is set to 1, aborting core
<4>[1303461.467547] coredump: 2994895(a68g): RLIMIT_CORE is set to 1, aborting core
<4>[1303480.235137] coredump: 2995065(a68g): RLIMIT_CORE is set to 1, aborting core
<4>[1303502.619326] coredump: 2995298(a68g): RLIMIT_CORE is set to 1, aborting core
<4>[1303517.317241] coredump: 2995712(a68g): RLIMIT_CORE is set to 1, aborting core
<4>[1303532.018452] coredump: 2995914(a68g): RLIMIT_CORE is set to 1, aborting core
<4>[1303629.847961] coredump: 3000103(a68g): RLIMIT_CORE is set to 1, aborting core
<4>[1303718.387302] coredump: 3001498(a68g): RLIMIT_CORE is set to 1, aborting core
<4>[1303741.807856] coredump: 3002762(a68g): RLIMIT_CORE is set to 1, aborting core
<4>[1303883.440107] coredump: 3005588(a68g): RLIMIT_CORE is set to 1, aborting core
<4>[1304063.312329] coredump: 3011934(a68g): RLIMIT_CORE is set to 1, aborting core
<4>[1304076.785104] coredump: 3012426(a68g): RLIMIT_CORE is set to 1, aborting core
<4>[1304090.252572] coredump: 3012597(a68g): RLIMIT_CORE is set to 1, aborting core
<4>[1304103.713452] coredump: 3012869(a68g): RLIMIT_CORE is set to 1, aborting core
<4>[1304167.141876] coredump: 3014066(a68g): RLIMIT_CORE is set to 1, aborting core
<4>[1309161.820908] coredump: 3117386(a68g): RLIMIT_CORE is set to 1, aborting core
<4>[1309181.386178] coredump: 3118674(a68g): RLIMIT_CORE is set to 1, aborting core
<4>[1309197.398021] coredump: 3118838(a68g): RLIMIT_CORE is set to 1, aborting core
<4>[1309216.163454] coredump: 3119052(a68g): RLIMIT_CORE is set to 1, aborting core
<4>[1309238.548702] coredump: 3119287(a68g): RLIMIT_CORE is set to 1, aborting core
<4>[1309253.244218] coredump: 3119482(a68g): RLIMIT_CORE is set to 1, aborting core
<4>[1309267.947377] coredump: 3119818(a68g): RLIMIT_CORE is set to 1, aborting core
<4>[1309365.768670] coredump: 3123084(a68g): RLIMIT_CORE is set to 1, aborting core
<4>[1309454.275048] coredump: 3124712(a68g): RLIMIT_CORE is set to 1, aborting core
<4>[1309477.693727] coredump: 3126077(a68g): RLIMIT_CORE is set to 1, aborting core
<4>[1309619.299711] coredump: 3147189(a68g): RLIMIT_CORE is set to 1, aborting core
<4>[1309799.338674] coredump: 3153711(a68g): RLIMIT_CORE is set to 1, aborting core
<4>[1309812.792649] coredump: 3154163(a68g): RLIMIT_CORE is set to 1, aborting core
<4>[1309826.264967] coredump: 3154377(a68g): RLIMIT_CORE is set to 1, aborting core
<4>[1309839.723775] coredump: 3154721(a68g): RLIMIT_CORE is set to 1, aborting core
<4>[1309903.146589] coredump: 3155979(a68g): RLIMIT_CORE is set to 1, aborting core
<6>[1328237.074292] traps: main.dbg[3440460] trap int3 ip:55555556aa27 sp:7fffffffd6c0 error:0 in main.dbg[15a27,555555569000+40000]
<6>[1328299.110572] traps: main.dbg[3443153] trap int3 ip:55555556acfc sp:7fffffffd690 error:0 in main.dbg[15cfc,555555569000+41000]
<6>[1328598.712361] traps: main.dbg[3450468] trap int3 ip:5555555682f5 sp:7fffffffd6a0 error:0 in main.dbg[132f5,555555568000+3e000]
<6>[1329213.916205] traps: main.dbg[3487986] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1329285.896533] traps: main.dbg[3490370] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1329898.503671] traps: main.dbg[3511972] trap int3 ip:55555556ed3f sp:7fffffffd4b0 error:0 in main.dbg[19d3f,55555556b000+44000]
<6>[1333284.731928] traps: main.dbg[3589363] trap int3 ip:55555556aa27 sp:7fffffffd6c0 error:0 in main.dbg[15a27,555555569000+40000]
<6>[1333346.904551] traps: main.dbg[3591238] trap int3 ip:55555556acfc sp:7fffffffd690 error:0 in main.dbg[15cfc,555555569000+41000]
<6>[1333646.715518] traps: main.dbg[3596557] trap int3 ip:5555555682f5 sp:7fffffffd6b0 error:0 in main.dbg[132f5,555555568000+3e000]
<6>[1334262.194138] traps: main.dbg[3611080] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1334334.094714] traps: main.dbg[3613106] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1334947.279778] traps: main.dbg[3627016] trap int3 ip:55555556ed3f sp:7fffffffd4c0 error:0 in main.dbg[19d3f,55555556b000+44000]
<6>[1339458.729827] traps: main.dbg[3692098] trap int3 ip:55555556aa27 sp:7fffffffd6c0 error:0 in main.dbg[15a27,555555569000+40000]
<6>[1339520.730261] traps: main.dbg[3693959] trap int3 ip:55555556acfc sp:7fffffffd690 error:0 in main.dbg[15cfc,555555569000+41000]
<6>[1339820.622566] traps: main.dbg[3699268] trap int3 ip:5555555682f5 sp:7fffffffd6a0 error:0 in main.dbg[132f5,555555568000+3e000]
<6>[1340435.246798] traps: main.dbg[3713278] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1340507.183086] traps: main.dbg[3715253] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1341120.086104] traps: main.dbg[3728415] trap int3 ip:55555556ed3f sp:7fffffffd4b0 error:0 in main.dbg[19d3f,55555556b000+44000]
<6>[1343716.341593] traps: main.dbg[3778525] trap int3 ip:55555556aa27 sp:7fffffffd6c0 error:0 in main.dbg[15a27,555555569000+40000]
<6>[1343778.209924] traps: main.dbg[3780403] trap int3 ip:55555556acfc sp:7fffffffd690 error:0 in main.dbg[15cfc,555555569000+41000]
<6>[1344077.903577] traps: main.dbg[3786268] trap int3 ip:5555555682f5 sp:7fffffffd6b0 error:0 in main.dbg[132f5,555555568000+3e000]
<6>[1344692.427364] traps: main.dbg[3800196] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1344764.219385] traps: main.dbg[3802709] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1345377.247295] traps: main.dbg[3816285] trap int3 ip:55555556ed3f sp:7fffffffd4c0 error:0 in main.dbg[19d3f,55555556b000+44000]
<6>[1383728.103339] traps: main.dbg[26243] trap int3 ip:55555556aa27 sp:7fffffffd6c0 error:0 in main.dbg[15a27,555555569000+40000]
<6>[1383790.083805] traps: main.dbg[28477] trap int3 ip:55555556acfc sp:7fffffffd690 error:0 in main.dbg[15cfc,555555569000+41000]
<6>[1384089.517728] traps: main.dbg[50463] trap int3 ip:5555555682f5 sp:7fffffffd6a0 error:0 in main.dbg[132f5,555555568000+3e000]
<6>[1384760.042373] traps: main.dbg[109345] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1384844.427162] traps: main.dbg[119611] trap int3 ip:555555568209 sp:7fffffffd6d0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1385488.227216] traps: main.dbg[139099] trap int3 ip:55555556ed3f sp:7fffffffd4b0 error:0 in main.dbg[19d3f,55555556b000+44000]
<6>[1402220.178897] traps: main.dbg[1520949] trap int3 ip:55555556aa27 sp:7fffffffd5e0 error:0 in main.dbg[15a27,555555569000+40000]
<6>[1402282.407505] traps: main.dbg[1523371] trap int3 ip:55555556acfc sp:7fffffffd5b0 error:0 in main.dbg[15cfc,555555569000+41000]
<6>[1402581.597873] traps: main.dbg[1531489] trap int3 ip:5555555682f5 sp:7fffffffd5c0 error:0 in main.dbg[132f5,555555568000+3e000]
<6>[1403196.070366] traps: main.dbg[1546582] trap int3 ip:555555568209 sp:7fffffffd5f0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1403267.830916] traps: main.dbg[1548635] trap int3 ip:555555568209 sp:7fffffffd5f0 error:0 in main.dbg[13209,555555567000+3f000]
<6>[1403984.248467] traps: main.dbg[1565278] trap int3 ip:55555556ed3f sp:7fffffffd3d0 error:0 in main.dbg[19d3f,55555556b000+44000]
<4>[1404022.104779]  slab kmalloc-8k start ffff8a5849b8e000 pointer offset 328 size 8192
<3>[1404022.104790] list_add corruption. prev->next should be next (ffff8a5849b8f590), but was ffff8a5849b8e148. (prev=ffff8a5849b8e148).
<6>[1404022.104798] ------------[ cut here ]------------
<2>[1404022.104799] kernel BUG at lib/list_debug.c:32!
<4>[1404022.104812] Oops: invalid opcode: 0000 [#1] SMP NOPTI
<4>[1404022.104816] CPU: 21 UID: 0 PID: 0 Comm: swapper/21 Not tainted 7.2.9+deb14-amd64 #1 PREEMPT(lazy)  Debian 7.2.9-1 
<4>[1404022.104820] Hardware name: ASUS System Product Name/ROG STRIX B650-A GAMING WIFI, BIOS 3042 09/30/2024
<4>[1404022.104823] RIP: 0010:__list_add_valid_or_report+0xa6/0xb0
<4>[1404022.104829] Code: c7 48 89 54 24 08 48 89 04 24 e8 c5 86 b9 ff 48 8b 04 24 48 8b 74 24 08 48 c7 c7 50 fe 45 96 48 8b 10 48 89 c1 e8 5a 22 6c ff <0f> 0b 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90
<4>[1404022.104831] RSP: 0018:ffffd2d580698e08 EFLAGS: 00010046
<4>[1404022.104835] RAX: 0000000000000075 RBX: ffff8a5849b8e000 RCX: 0000000000000027
<4>[1404022.104837] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8a677df5d100
<4>[1404022.104839] RBP: ffff8a5849b8e058 R08: 0000000000000000 R09: ffff8a677d9bff90
<4>[1404022.104841] R10: 3fffffffffffdfff R11: ffffd2d580698cb8 R12: 0000000000000000
<4>[1404022.104843] R13: 0000000000000000 R14: 0000000000000202 R15: ffff8a58420d3980
<4>[1404022.104845] FS:  0000000000000000(0000) GS:ffff8a67e6734000(0000) knlGS:0000000000000000
<4>[1404022.104847] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
<4>[1404022.104849] CR2: 00007fa90a9392b0 CR3: 000000096202a000 CR4: 0000000000f50ef0
<4>[1404022.104852] PKRU: 55555554
<4>[1404022.104853] Call Trace:
<4>[1404022.104856]  <IRQ>
<4>[1404022.104860]  snd_complete_urb+0xff/0x750 [snd_usb_audio]
<4>[1404022.104877]  ? srso_alias_return_thunk+0x5/0xfbef5
<4>[1404022.104882]  ? led_trigger_blink_oneshot+0x88/0xc0
<4>[1404022.104887]  ? srso_alias_return_thunk+0x5/0xfbef5
<4>[1404022.104891]  __usb_hcd_giveback_urb+0xa0/0x120 [usbcore]
<4>[1404022.104904]  usb_giveback_urb_bh+0xb3/0x150 [usbcore]
<4>[1404022.104914]  ? srso_alias_return_thunk+0x5/0xfbef5
<4>[1404022.104917]  ? move_linked_works+0x88/0xd0
<4>[1404022.104921]  process_one_work+0x19e/0x370
<4>[1404022.104925]  bh_worker+0x1cb/0x1f0
<4>[1404022.104929]  tasklet_hi_action+0x13/0x30
<4>[1404022.104933]  handle_softirqs+0xd9/0x310
<4>[1404022.104936]  ? srso_alias_return_thunk+0x5/0xfbef5
<4>[1404022.104940]  ? srso_alias_return_thunk+0x5/0xfbef5
<4>[1404022.104943]  __irq_exit_rcu+0xa1/0xf0
<4>[1404022.104946]  common_interrupt+0x85/0xa0
<4>[1404022.104951]  </IRQ>
<4>[1404022.104953]  <TASK>
<4>[1404022.104955]  asm_common_interrupt+0x26/0x40
<4>[1404022.104958] RIP: 0010:cpuidle_enter_state+0xcd/0x650
<4>[1404022.104962] Code: 00 00 e8 c6 33 19 ff e8 31 ef ff ff 49 89 c4 0f 1f 44 00 00 31 ff e8 22 75 16 ff 45 84 ff 0f 85 76 01 00 00 fb 0f 1f 44 00 00 <45> 85 f6 0f 88 ed 01 00 00 44 89 f5 41 83 fe 09 0f 87 8e 04 00 00
<4>[1404022.104965] RSP: 0018:ffffd2d580237e58 EFLAGS: 00000246
<4>[1404022.104967] RAX: ffff8a67e6734000 RBX: ffff8a58644c9c00 RCX: 0000000000000000
<4>[1404022.104969] RDX: 0004fcf35ecfc2d4 RSI: 0000000000000000 RDI: 0000000000000000
<4>[1404022.104971] RBP: 0000000000000003 R08: fffffff2a9231cf5 R09: 0000000000000000
<4>[1404022.104973] R10: 0004fd00b6e09a7e R11: 0000000000000000 R12: 0004fcf35ecfc2d4
<4>[1404022.104974] R13: ffffffff96e6b520 R14: 0000000000000003 R15: 0000000000000000
<4>[1404022.104982]  ? cpuidle_enter_state+0xbe/0x650
<4>[1404022.104986]  cpuidle_enter+0x31/0x50
<4>[1404022.104992]  do_idle+0x1df/0x310
<4>[1404022.104997]  cpu_startup_entry+0x29/0x30
<4>[1404022.105000]  start_secondary+0x126/0x180
<4>[1404022.105004]  common_startup_64+0x13e/0x151
<4>[1404022.105012]  </TASK>
<4>[1404022.105014] Modules linked in: vhost_net vhost vhost_iotlb tap ip6t_REJECT nf_reject_ipv6 nft_fib_ipv6 nft_ct nft_fib_ipv4 nft_fib wireguard libcurve25519 libchacha20poly1305 libchacha libpoly1305 dummy nf_conntrack_netlink veth sctp ip6_udp_tunnel udp_tunnel tcp_diag inet_diag btrfs libblake2b raid6_pq xor ufs qnx4 hfsplus hfs cdrom minix ntfs msdos jfs nls_ucs2_utils xfs cpuid unix_diag sd_mod rfcomm xt_CHECKSUM ipt_REJECT nf_reject_ipv4 bridge stp llc snd_seq_dummy snd_hrtimer snd_seq xt_set ip_set xt_addrtype xfrm_user xfrm_algo xt_connmark xt_conntrack xt_MASQUERADE xt_tcpudp xt_mark nft_compat x_tables nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ccm tun nf_tables overlay qrtr algif_hash algif_skcipher af_alg bnep binfmt_misc nls_ascii nls_cp437 vfat fat amd_atl intel_rapl_msr intel_rapl_common mt7921e mt7921_common btusb mt792x_lib edac_mce_amd btmtk mt76_connac_lib snd_hda_codec_atihdmi btrtl snd_hda_codec_hdmi kvm_amd btbcm mt76 btintel snd_hda_intel mac80211 kvm bluetooth snd_usb_audio
<4>[1404022.105110]  asus_armoury snd_hda_codec snd_hda_core snd_usbmidi_lib ecdh_generic snd_intel_dspcfg snd_rawmidi snd_seq_device snd_intel_sdw_acpi irqbypass cfg80211 mc eeepc_wmi snd_hwdep firmware_attributes_class aesni_intel asus_wmi joydev snd_pcm sparse_keymap gf128mul battery rapl wmi_bmof snd_timer pcspkr snd rfkill libarc4 soundcore spd5118 k10temp ccp evdev nfsd auth_rpcgss nfs_acl lockd grace sunrpc dm_mod parport_pc lp ppdev parport i2c_dev msr efi_pstore configfs efivarfs autofs4 ext4 mbcache jbd2 crc32c_cryptoapi hid_logitech_hidpp amdgpu hid_logitech_dj hid_generic drm_buddy amdxcp drm_panel_backlight_quirks gpu_sched usbhid drm_ttm_helper hid ttm drm_exec i2c_algo_bit drm_suballoc_helper drm_display_helper ahci cec libahci rc_core drm_client_lib libata drm_kms_helper sp5100_tco watchdog xhci_pci drm xhci_hcd nvme scsi_mod igc usbcore nvme_core video scsi_common crc16 nvme_keyring usb_common gpio_amdpt i2c_piix4 nvme_auth button wmi gpio_generic i2c_smbus
<4>[1404022.105208] ---[ end trace 0000000000000000 ]---

Re: snd-usb-audio: list_add corruption in snd_complete_urb, fatal panic in softirq (7.2.9)

[Takashi Iwai]

On Tue, 03 Nov 2026 21:33:21 +0100,
Juan M. Méndez Rey wrote:
> 
> Hi Linux Sound/ALSA team,
> 
> My desktop panicked with a list_add corruption inside snd_complete_urb().
> It happened in softirq context, so the box hung instead of logging to disk.
> I only got the trace because efi_pstore saved it.
> 
> Kernel is Debian 7.2.9+deb14-amd64 (7.2.9-1), not tainted, 16 days of uptime.
> Board is an ASUS ROG STRIX B650-A GAMING WIFI, BIOS 3042.
> 
> Two USB audio devices use snd-usb-audio:
> 
>   0b05:1a52 ASUS USB Audio (onboard), high speed, bus 1
>   338a:1517 Aisa Expert TEMPEST PRO 20 (headset), full speed, bus 5,
>             the default PipeWire sink
> 
> The trace doesn't say which one it was. As far as I know nobody was
> playing audio at that moment. A KDE notification popped up about 20 s
> before the crash, and PipeWire (1.6.9) keeps a speech-dispatcher dummy
> stream linked to the headset, so a short-lived stream is my best guess.
> I haven't reproduced it, and it's the first time I've seen it.
> 
>   list_add corruption. prev->next should be next (ffff8a5849b8f590), but was ffff8a5849b8e148. (prev=ffff8a5849b8e148).
>   kernel BUG at lib/list_debug.c:32!
>   Oops: invalid opcode: 0000 [#1] SMP NOPTI
>   CPU: 21 UID: 0 PID: 0 Comm: swapper/21 Not tainted 7.2.9+deb14-amd64 #1 PREEMPT(lazy)  Debian 7.2.9-1
>   RIP: 0010:__list_add_valid_or_report+0xa6/0xb0
>   Call Trace:
>    <IRQ>
>    snd_complete_urb+0xff/0x750 [snd_usb_audio]
>    __usb_hcd_giveback_urb+0xa0/0x120 [usbcore]
>    usb_giveback_urb_bh+0xb3/0x150 [usbcore]
>    process_one_work+0x19e/0x370
>    bh_worker+0x1cb/0x1f0
>    tasklet_hi_action+0x13/0x30
>    handle_softirqs+0xd9/0x310
>    __irq_exit_rcu+0xa1/0xf0
>    common_interrupt+0x85/0xa0
>    </IRQ>
>   Kernel panic - not syncing: Fatal exception in interrupt
> 
> I decoded it with the Debian 7.2.9 debug symbols. snd_complete_urb+0xff
> is the list_add_tail() in push_back_to_ready_list(), called from the
> low-latency / implicit-fb branch of snd_complete_urb():
> 
>   __list_add_valid       include/linux/list.h:96
>   list_add_tail          include/linux/list.h:198
>   push_back_to_ready_list sound/usb/endpoint.c:452
>   snd_complete_urb       sound/usb/endpoint.c:572
> 
> The addresses line up with one struct snd_usb_endpoint (5744 bytes, so
> kmalloc-8k, starting at ffff8a5849b8e000):
> 
>   next = ...f590 = ep + 0x1590 = &ep->ready_playback_urbs
>   prev = ...e148 = ep + 0x148  = &ep->urb[0].ready_list
> 
> So ep->ready_playback_urbs.prev still pointed at urb[0], but urb[0]'s
> ready_list was already self-linked, like after the list_del_init() in
> snd_usb_queue_pending_output_urbs(). The list head and the entry
> disagree. I'd guess urb[0] got onto the list twice, or the
> INIT_LIST_HEAD() in stop_urbs() raced with a completion, but I haven't
> proven either.
> 
> I looked through the stable changes up to 7.2.12 and didn't find a fix
> for this. The full pstore dump is attached, with the UPS serial removed.

This should have been already addressed in the upstream.
Could you try 7.3 kernel, or cherry-pick the fix commit
dbd9d1cbf970 ("ALSA: usb-audio: fix list_add double-add in
push_back_to_ready_list")?


thanks,

Takashi

Re: snd-usb-audio: list_add corruption in snd_complete_urb, fatal panic in softirq (7.2.9)

[Juan M. Méndez Rey]

El miércoles, 4 de noviembre de 2026 a las 07:59, Takashi Iwai <tiwai@suse.de> escribió:


> This should have been already addressed in the upstream.
> Could you try 7.3 kernel, or cherry-pick the fix commit
> dbd9d1cbf970 ("ALSA: usb-audio: fix list_add double-add in
> push_back_to_ready_list")?
> 

That matches what I see. 

In Debian: 7.2.15 doesn't have it yet, so I'm moving to Debian's 7.3.1. I've only hit this once in 16 days and can't trigger it on demand, so I can't really confirm the fix. I'll report back if it shows up again on 7.3.

Thanks for the quick answer,

Juan