smsmdtv:smscore_start_device: set device mode failed , rc -71 smsusb:smsusb_init_device: smscore_start_device(...) failed ------------[ cut here ]------------ WARNING: mm/slub.c:6630 at free_large_kmalloc+0xc4/0x134 mm/slub.c:6631, CPU#0: kworker/0:4/4755 Modules linked in: CPU: 0 UID: 0 PID: 4755 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026 Workqueue: usb_hub_wq hub_event pstate: 23400005 (nzCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : free_large_kmalloc+0xc4/0x134 mm/slub.c:6631 lr : kfree+0xcc/0x690 mm/slub.c:6715 sp : ffff8000980d6c30 x29: ffff8000980d6c40 x28: dfff800000000000 x27: ffff60001a058c83 x26: ffff60001a058c84 x25: ffff0000dbced7c0 x24: 0000000000000030 x23: 1fffe0001a25b61e x22: ffff0000c4ae2000 x21: fffffdffc312b880 x20: 0000000000000000 x19: fffffdffc312b880 x18: 00000000ffffffff x17: ffff80008a74f000 x16: 0000000000000008 x15: ffff8000824e24dc x14: ffff8000824ed198 x13: 0000000000000001 x12: 0000000000000000 x11: 0000000000000000 x10: 000000000000003d x9 : ffffffffffffffff x8 : 00000000000000ff x7 : 0000000000000000 x6 : ffff800083112cec x5 : ffff0000dd068e38 x4 : 0000000000000008 x3 : ffff8000801a409c x2 : 0000000000000000 x1 : ffff800088493360 x0 : fffffdffc312b880 Call trace: free_large_kmalloc+0xc4/0x134 mm/slub.c:6631 (P) kfree+0xcc/0x690 mm/slub.c:6715 urb_destroy drivers/usb/core/urb.c:25 [inline] kref_put include/linux/kref.h:65 [inline] usb_free_urb+0xd0/0x140 drivers/usb/core/urb.c:96 smsusb_term_device+0xc4/0x188 drivers/media/usb/siano/smsusb.c:352 smsusb_init_device drivers/media/usb/siano/smsusb.c:497 [inline] smsusb_probe+0x1218/0x1918 drivers/media/usb/siano/smsusb.c:575 usb_probe_interface+0x308/0x788 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x29c/0x800 drivers/base/dd.c:706 __driver_probe_device+0x1e0/0x350 drivers/base/dd.c:868 driver_probe_device+0x6c/0x19c drivers/base/dd.c:898 __device_attach_driver+0x198/0x2f8 drivers/base/dd.c:1026 bus_for_each_drv+0x144/0x1dc drivers/base/bus.c:500 __device_attach+0x248/0x390 drivers/base/dd.c:1098 device_initial_probe+0x90/0xc8 drivers/base/dd.c:1153 bus_probe_device+0x58/0x120 drivers/base/bus.c:620 device_add+0x6cc/0x9e0 drivers/base/core.c:3772 usb_set_configuration+0x1184/0x158c drivers/usb/core/message.c:2268 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:250 usb_probe_device+0x114/0x2b0 drivers/usb/core/driver.c:291 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x29c/0x800 drivers/base/dd.c:706 __driver_probe_device+0x1e0/0x350 drivers/base/dd.c:868 driver_probe_device+0x6c/0x19c drivers/base/dd.c:898 __device_attach_driver+0x198/0x2f8 drivers/base/dd.c:1026 bus_for_each_drv+0x144/0x1dc drivers/base/bus.c:500 __device_attach+0x248/0x390 drivers/base/dd.c:1098 device_initial_probe+0x90/0xc8 drivers/base/dd.c:1153 bus_probe_device+0x58/0x120 drivers/base/bus.c:620 device_add+0x6cc/0x9e0 drivers/base/core.c:3772 usb_new_device+0x9bc/0x11f0 drivers/usb/core/hub.c:2695 hub_port_connect drivers/usb/core/hub.c:5567 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x1ef0/0x39fc drivers/usb/core/hub.c:5953 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0x788/0x10b8 kernel/workqueue.c:3405 worker_thread+0x798/0xbd0 kernel/workqueue.c:3486 kthread+0x304/0x3d4 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:842 irq event stamp: 20688 hardirqs last enabled at (20687): [] kasan_quarantine_put+0xb4/0x1c4 mm/kasan/quarantine.c:234 hardirqs last disabled at (20688): [] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:425 softirqs last enabled at (20096): [] softirq_handle_end kernel/softirq.c:468 [inline] softirqs last enabled at (20096): [] handle_softirqs+0xc28/0xd98 kernel/softirq.c:650 softirqs last disabled at (20087): [] __do_softirq+0x14/0x20 kernel/softirq.c:656 ---[ end trace 0000000000000000 ]--- page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104ae2 flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 0000000000000000 fffffdffc312b888 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: Not a kmalloc allocation page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104ae0 flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 0000000000000000 fffffdffc312b808 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: Not a kmalloc allocation page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104ade flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 0000000000000000 fffffdffc312b788 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: Not a kmalloc allocation page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104adc flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 0000000000000000 fffffdffc312b708 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: Not a kmalloc allocation page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104ada flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 0000000000000000 fffffdffc312b688 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: Not a kmalloc allocation page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104ad8 flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 0000000000000000 fffffdffc312b608 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: Not a kmalloc allocation page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104ad6 flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 0000000000000000 fffffdffc312b588 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: Not a kmalloc allocation page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104ad4 flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 0000000000000000 fffffdffc312b508 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: Not a kmalloc allocation page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104ad2 flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 0000000000000000 fffffdffc312b488 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: Not a kmalloc allocation page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104ad0 flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 0000000000000000 fffffdffc312b408 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: Not a kmalloc allocation smsusb:smsusb_probe: Device initialized with return code -71 smsusb 1-1:208.0: probe with driver smsusb failed with error -71 smsusb:smsusb_probe: board id=8, interface number 40 smsusb:smsusb_probe: board id=8, interface number 150 usb 1-1: USB disconnect, device number 2