* Re: WARNING in usb_free_urb
2024-06-02 1:44 [syzbot] [media?] [usb?] " syzbot
@ 2026-04-17 12:05 ` Tetsuo Handa
0 siblings, 0 replies; 2+ messages in thread
From: Tetsuo Handa @ 2026-04-17 12:05 UTC (permalink / raw)
To: syzbot+b466336413a1fba398a5, LKML
#syz test
diff --git a/drivers/media/common/siano/smscoreapi.c b/drivers/media/common/siano/smscoreapi.c
index 017629e3cf84..10159c07d295 100644
--- a/drivers/media/common/siano/smscoreapi.c
+++ b/drivers/media/common/siano/smscoreapi.c
@@ -612,8 +612,24 @@ static int smscore_notify_callbacks(struct smscore_device_t *coredev,
}
static struct
-smscore_buffer_t *smscore_createbuffer(u8 *buffer, void *common_buffer,
- dma_addr_t common_buffer_phys)
+smscore_buffer_t *smscore_create_usb_buffer(int buffer_size)
+{
+ struct smscore_buffer_t *cb;
+
+ cb = kzalloc_obj(*cb);
+ if (!cb)
+ return NULL;
+ cb->p = kzalloc(buffer_size, GFP_KERNEL);
+ if (!cb->p) {
+ kfree(cb);
+ return NULL;
+ }
+ return cb;
+}
+
+static struct
+smscore_buffer_t *smscore_create_dma_buffer(u8 *buffer, void *common_buffer,
+ dma_addr_t common_buffer_phys)
{
struct smscore_buffer_t *cb;
@@ -622,9 +638,8 @@ smscore_buffer_t *smscore_createbuffer(u8 *buffer, void *common_buffer,
return NULL;
cb->p = buffer;
- cb->offset_in_common = buffer - (u8 *) common_buffer;
if (common_buffer_phys)
- cb->phys = common_buffer_phys + cb->offset_in_common;
+ cb->phys = common_buffer_phys + (buffer - (u8 *) common_buffer);
return cb;
}
@@ -684,27 +699,32 @@ int smscore_register_device(struct smsdevice_params_t *params,
init_waitqueue_head(&dev->buffer_mng_waitq);
/* alloc common buffer */
- dev->common_buffer_size = params->buffer_size * params->num_buffers;
- if (params->usb_device)
- buffer = kzalloc(dev->common_buffer_size, GFP_KERNEL);
- else
+ if (params->usb_device) {
+ dev->common_dma_buffer_size = 0;
+ buffer = NULL;
+ } else {
+ dev->common_dma_buffer_size = params->buffer_size * params->num_buffers;
buffer = dma_alloc_coherent(params->device,
- dev->common_buffer_size,
- &dev->common_buffer_phys,
+ dev->common_dma_buffer_size,
+ &dev->common_dma_buffer_phys,
GFP_KERNEL | dev->gfp_buf_flags);
- if (!buffer) {
- smscore_unregister_device(dev);
- return -ENOMEM;
+ if (!buffer) {
+ smscore_unregister_device(dev);
+ return -ENOMEM;
+ }
}
- dev->common_buffer = buffer;
+ dev->common_dma_buffer = buffer;
/* prepare dma buffers */
for (; dev->num_buffers < params->num_buffers;
dev->num_buffers++, buffer += params->buffer_size) {
struct smscore_buffer_t *cb;
- cb = smscore_createbuffer(buffer, dev->common_buffer,
- dev->common_buffer_phys);
+ if (params->usb_device)
+ cb = smscore_create_usb_buffer(params->buffer_size);
+ else
+ cb = smscore_create_dma_buffer(buffer, dev->common_dma_buffer,
+ dev->common_dma_buffer_phys);
if (!cb) {
smscore_unregister_device(dev);
return -ENOMEM;
@@ -1204,6 +1224,8 @@ void smscore_unregister_device(struct smscore_device_t *coredev)
while (!list_empty(&coredev->buffers)) {
cb = (struct smscore_buffer_t *) coredev->buffers.next;
list_del(&cb->entry);
+ if (coredev->usb_device)
+ kfree(cb->p);
kfree(cb);
num_buffers++;
}
@@ -1223,15 +1245,11 @@ void smscore_unregister_device(struct smscore_device_t *coredev)
pr_debug("freed %d buffers\n", num_buffers);
- if (coredev->common_buffer) {
- if (coredev->usb_device)
- kfree(coredev->common_buffer);
- else
- dma_free_coherent(coredev->device,
- coredev->common_buffer_size,
- coredev->common_buffer,
- coredev->common_buffer_phys);
- }
+ if (coredev->common_dma_buffer)
+ dma_free_coherent(coredev->device,
+ coredev->common_dma_buffer_size,
+ coredev->common_dma_buffer,
+ coredev->common_dma_buffer_phys);
kfree(coredev->fw_buf);
list_del(&coredev->entry);
diff --git a/drivers/media/common/siano/smscoreapi.h b/drivers/media/common/siano/smscoreapi.h
index d945a2d6d624..a06c8af6eb3a 100644
--- a/drivers/media/common/siano/smscoreapi.h
+++ b/drivers/media/common/siano/smscoreapi.h
@@ -112,7 +112,6 @@ struct smscore_buffer_t {
/* private members, read-only for clients */
void *p;
dma_addr_t phys;
- unsigned long offset_in_common;
};
struct smsdevice_params_t {
@@ -154,9 +153,9 @@ struct smscore_device_t {
spinlock_t bufferslock;
int num_buffers;
- void *common_buffer;
- int common_buffer_size;
- dma_addr_t common_buffer_phys;
+ void *common_dma_buffer;
+ int common_dma_buffer_size;
+ dma_addr_t common_dma_buffer_phys;
void *context;
struct device *device;
^ permalink raw reply related [flat|nested] 2+ messages in thread
* WARNING in usb_free_urb
@ 2026-06-26 21:27 sanan.hasanou
0 siblings, 0 replies; 2+ messages in thread
From: sanan.hasanou @ 2026-06-26 21:27 UTC (permalink / raw)
To: vbabka, akpm, cl, rientjes, roman.gushchin, harry.yoo, linux-mm,
linux-kernel
Cc: syzkaller, contact
Good day, dear maintainers,
We found a bug using a modified version of syzkaller.
Kernel Branch: 7.0-rc1
Kernel Config: <https://drive.google.com/open?id=1zJHAs5GUroGFBkxAlzfDaWAd_NVPZTfJ>
Unfortunately, we don't have any reproducer for this bug yet.
Thank you!
Best regards,
Sanan Hasanov
179683 pages reserved
0 pages cma reserved
Memory cgroup min protection 0kB -- low protection 0kB
------------[ cut here ]------------
!PageLargeKmalloc(page)
WARNING: mm/slub.c:6352 at free_large_kmalloc+0xb3/0x160 mm/slub.c:6352, CPU#1: kworker/1:4/12317
Modules linked in:
CPU: 1 UID: 0 PID: 12317 Comm: kworker/1:4 Tainted: G L 7.0.0-rc1 #1 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: events request_module_async
RIP: 0010:free_large_kmalloc+0xb3/0x160 mm/slub.c:6352
Code: 25 00 00 00 ff 3d 00 00 00 f8 0f 85 a6 00 00 00 c7 43 30 ff ff ff ff 48 89 df 44 89 f6 e8 45 d9 fc ff 5b 41 5e 41 5f 5d c3 90 <0f> 0b 90 48 89 df 48 c7 c6 b7 4c 72 8d e8 cb e8 08 ff eb e4 90 0f
RSP: 0018:ffffc900028e76f8 EFLAGS: 00010287
RAX: 00000000f0000000 RBX: ffffea00019a5c00 RCX: ffff888067550001
RDX: 0000000000000000 RSI: ffff888066970000 RDI: ffffea00019a5c00
RBP: ffffc900028e7710 R08: ffff888049c40603 R09: 1ffff110093880c0
R10: dffffc0000000000 R11: ffffed10093880c1 R12: ffff888066970000
R13: ffffffff870bc0f1 R14: 0000000000000000 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880ef136000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fba7e4bf008 CR3: 000000005776b000 CR4: 00000000000006f0
Call Trace:
<TASK>
kfree+0xae/0x630 mm/slub.c:6437
urb_destroy drivers/usb/core/urb.c:25 [inline]
kref_put include/linux/kref.h:65 [inline]
usb_free_urb+0xd1/0x120 drivers/usb/core/urb.c:96
em28xx_uninit_usb_xfer+0x165/0x310 drivers/media/usb/em28xx/em28xx-core.c:833
em28xx_alloc_urbs+0xf2a/0x1130 drivers/media/usb/em28xx/em28xx-core.c:-1
em28xx_dvb_init+0x2b0/0x4a20 drivers/media/usb/em28xx/em28xx-dvb.c:-1
em28xx_init_extension+0x121/0x1d0 drivers/media/usb/em28xx/em28xx-core.c:1117
request_module_async+0x5e/0x80 drivers/media/usb/em28xx/em28xx-cards.c:3457
process_one_work kernel/workqueue.c:3275 [inline]
process_scheduled_works+0xae1/0x1800 kernel/workqueue.c:3358
worker_thread+0xa0f/0xf70 kernel/workqueue.c:3439
kthread+0x37d/0x470 kernel/kthread.c:467
ret_from_fork+0x507/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:245
</TASK>
<<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>
Modules linked in:
CPU: 1 UID: 0 PID: 12317 Comm: kworker/1:4 Tainted: G L 7.0.0-rc1 #1 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: events request_module_async
RIP: 0010:free_large_kmalloc+0xb3/0x160
Code: 25 00 00 00 ff 3d 00 00 00 f8 0f 85 a6 00 00 00 c7 43 30 ff ff ff ff 48 89 df 44 89 f6 e8 45 d9 fc ff 5b 41 5e 41 5f 5d c3 90 <0f> 0b 90 48 89 df 48 c7 c6 b7 4c 72 8d e8 cb e8 08 ff eb e4 90 0f
RSP: 0018:ffffc900028e76f8 EFLAGS: 00010287
RAX: 00000000f0000000 RBX: ffffea00019a5c00 RCX: ffff888067550001
RDX: 0000000000000000 RSI: ffff888066970000 RDI: ffffea00019a5c00
RBP: ffffc900028e7710 R08: ffff888049c40603 R09: 1ffff110093880c0
R10: dffffc0000000000 R11: ffffed10093880c1 R12: ffff888066970000
R13: ffffffff870bc0f1 R14: 0000000000000000 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880ef136000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fba7e4bf008 CR3: 000000005776b000 CR4: 00000000000006f0
Call Trace:
<TASK>
kfree+0xae/0x630
usb_free_urb+0xd1/0x120
em28xx_uninit_usb_xfer+0x165/0x310
em28xx_alloc_urbs+0xf2a/0x1130
em28xx_dvb_init+0x2b0/0x4a20
em28xx_init_extension+0x121/0x1d0
request_module_async+0x5e/0x80
process_scheduled_works+0xae1/0x1800
worker_thread+0xa0f/0xf70
kthread+0x37d/0x470
ret_from_fork+0x507/0xb90
ret_from_fork_asm+0x11/0x20
</TASK>
Kernel panic - not syncing: kernel: panic_on_warn set ...
CPU: 1 UID: 0 PID: 12317 Comm: kworker/1:4 Tainted: G L 7.0.0-rc1 #1 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: events request_module_async
Call Trace:
<TASK>
__dump_stack+0x21/0x30
dump_stack_lvl+0x2b/0x150
dump_stack+0x19/0x20
vpanic+0x53e/0xa20
panic+0xb9/0xc0
__warn+0x320/0x500
__report_bug+0x28d/0x500
report_bug+0x175/0x220
handle_bug+0x9c/0x200
exc_invalid_op+0x1f/0x50
asm_exc_invalid_op+0x1f/0x30
RIP: 0010:free_large_kmalloc+0xb3/0x160
Code: 25 00 00 00 ff 3d 00 00 00 f8 0f 85 a6 00 00 00 c7 43 30 ff ff ff ff 48 89 df 44 89 f6 e8 45 d9 fc ff 5b 41 5e 41 5f 5d c3 90 <0f> 0b 90 48 89 df 48 c7 c6 b7 4c 72 8d e8 cb e8 08 ff eb e4 90 0f
RSP: 0018:ffffc900028e76f8 EFLAGS: 00010287
RAX: 00000000f0000000 RBX: ffffea00019a5c00 RCX: ffff888067550001
RDX: 0000000000000000 RSI: ffff888066970000 RDI: ffffea00019a5c00
RBP: ffffc900028e7710 R08: ffff888049c40603 R09: 1ffff110093880c0
R10: dffffc0000000000 R11: ffffed10093880c1 R12: ffff888066970000
R13: ffffffff870bc0f1 R14: 0000000000000000 R15: dffffc0000000000
kfree+0xae/0x630
usb_free_urb+0xd1/0x120
em28xx_uninit_usb_xfer+0x165/0x310
em28xx_alloc_urbs+0xf2a/0x1130
em28xx_dvb_init+0x2b0/0x4a20
em28xx_init_extension+0x121/0x1d0
request_module_async+0x5e/0x80
process_scheduled_works+0xae1/0x1800
worker_thread+0xa0f/0xf70
kthread+0x37d/0x470
ret_from_fork+0x507/0xb90
ret_from_fork_asm+0x11/0x20
</TASK>
Kernel Offset: disabled
Rebooting in 86400 seconds..
<<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-06-26 21:27 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-26 21:27 WARNING in usb_free_urb sanan.hasanou
-- strict thread matches above, loose matches on Subject: below --
2024-06-02 1:44 [syzbot] [media?] [usb?] " syzbot
2026-04-17 12:05 ` Tetsuo Handa
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox