[syzbot] [mm?] [usb?] WARNING in corrupted (4)

[syzbot] [mm?] [usb?] WARNING in corrupted (4)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    5b0764a53235 Merge tag 'drm-next-2026-10-21' of https://gi..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13739fc9580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=fd1433abd362f255
dashboard link: https://syzkaller.appspot.com/bug?extid=9fe09db3795456e0b442
compiler:       Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
userspace arch: i386
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11cb9b0d580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/05ac8658d211/disk-5b0764a5.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/9cfb73243216/vmlinux-5b0764a5.xz
kernel image: https://storage.googleapis.com/syzbot-assets/fc45c7faf785/bzImage-5b0764a5.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9fe09db3795456e0b442@syzkaller.appspotmail.com

------------[ cut here ]------------
!PageLargeKmalloc(page)
WARNING: mm/slub.c:6855 at free_large_kmalloc+0x97/0x110 mm/slub.c:6855, CPU#0: kworker/0:1/10


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [mm?] [usb?] WARNING in corrupted (4)

[Andrew Morton]

On Tue, 27 Oct 2026 05:08:56 -0700 syzbot <syzbot+9fe09db3795456e0b442@syzkaller.appspotmail.com> wrote:

> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    5b0764a53235 Merge tag 'drm-next-2026-10-21' of https://gi..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=13739fc9580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=fd1433abd362f255
> dashboard link: https://syzkaller.appspot.com/bug?extid=9fe09db3795456e0b442
> compiler:       Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
> userspace arch: i386
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11cb9b0d580000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/05ac8658d211/disk-5b0764a5.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/9cfb73243216/vmlinux-5b0764a5.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/fc45c7faf785/bzImage-5b0764a5.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+9fe09db3795456e0b442@syzkaller.appspotmail.com
> 
> ------------[ cut here ]------------
> !PageLargeKmalloc(page)
> WARNING: mm/slub.c:6855 at free_large_kmalloc+0x97/0x110 mm/slub.c:6855, CPU#0: kworker/0:1/10
> 

Thanks.

> This report is generated by a bot.

So is this report ;)

This looks like a double free in the Siano USB media driver, rather
than an MM bug.

The failure occurs during USB probe error recovery. The allocation
comes from smscore_register_device(), and the page-owner records show
that smscore_unregister_device() has already freed it. The USB core
can then attempt to free the same memory because smsusb_submit_urb()
sets URB_FREE_BUFFER on a buffer owned by the Siano core.

Rohith Matam posted a patch in June which removes URB_FREE_BUFFER
and fixes several related URB teardown races:

https://lore.kernel.org/r/20260601201639.63171-1-rohithmatham@gmail.com

I don't know why that patch hasn't resolved this problem, but it
would be worth revisiting before developing another fix.

This doesn't appear to need any MM changes.