list_add corruption. prev->next should be next (ffff888116f3e450), but was ffff88810b312859. (prev=ffff88810b7fe858).
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:32!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 9152 Comm: syz.9.2339 Tainted: G        W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2025
RIP: 0010:__list_add_valid+0xe3/0xf0 lib/list_debug.c:30
Code: 31 02 0f 0b 48 c7 c7 a0 24 20 85 4c 89 f6 48 89 d9 e8 71 ff 31 02 0f 0b 48 c7 c7 20 25 20 85 48 89 de 4c 89 f1 e8 5d ff 31 02 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 90 55 48 89 e5 41 57 41 56 41
RSP: 0018:ffffc900011073e8 EFLAGS: 00010246
RAX: 0000000000000075 RBX: ffff888116f3e450 RCX: 8a3bbbcff1618f00
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000
RBP: ffffc90001107410 R08: dffffc0000000000 R09: ffffed103ee0a5f8
R10: ffffed103ee0a5f8 R11: 1ffff1103ee0a5f7 R12: ffff888116f3e458
R13: dffffc0000000000 R14: ffff88810b7fe858 R15: ffffc90001107560
FS:  00007f627870e6c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6279caa060 CR3: 00000001183e8000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __list_add include/linux/list.h:67 [inline]
 list_add_tail include/linux/list.h:100 [inline]
 __mutex_add_waiter+0xc7/0x270 kernel/locking/mutex.c:218
 __mutex_lock_common kernel/locking/mutex.c:1002 [inline]
 __mutex_lock+0x3ce/0xc50 kernel/locking/mutex.c:1117
 __mutex_lock_slowpath+0xe/0x10 kernel/locking/mutex.c:1379
 mutex_lock+0xcf/0xe0 kernel/locking/mutex.c:299
 steam_input_open+0x91/0x160 drivers/hid/hid-steam.c:297
 input_open_device+0x14c/0x2a0 drivers/input/input.c:635
 evdev_open_device drivers/input/evdev.c:400 [inline]
 evdev_open+0x4d2/0x5e0 drivers/input/evdev.c:487
 chrdev_open+0x597/0x670 fs/char_dev.c:414
 do_dentry_open+0x793/0x1090 fs/open.c:819
 vfs_open+0x73/0x80 fs/open.c:942
 do_open fs/namei.c:3391 [inline]
 path_openat+0x27ad/0x3160 fs/namei.c:3509
 do_filp_open+0x1b3/0x3e0 fs/namei.c:3536
 do_sys_openat2+0x14c/0x6d0 fs/open.c:1217
 do_sys_open fs/open.c:1233 [inline]
 __do_sys_openat fs/open.c:1249 [inline]
 __se_sys_openat fs/open.c:1244 [inline]
 __x64_sys_openat+0x136/0x160 fs/open.c:1244
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f6279cc5590
Code: 48 89 44 24 20 75 93 44 89 54 24 0c e8 49 94 02 00 44 8b 54 24 0c 89 da 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 38 44 89 c7 89 44 24 0c e8 9c 94 02 00 8b 44
RSP: 002b:00007f627870db70 EFLAGS: 00000293 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6279cc5590
RDX: 0000000000000000 RSI: 00007f627870dc10 RDI: 00000000ffffff9c
RBP: 00007f627870dc10 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: cccccccccccccccd
R13: 00007f6279f0e128 R14: 00007f6279f0e090 R15: 00007ffd5833f568
Modules linked in:
---[ end trace 2ca89ac7fbc2c485 ]---
RIP: 0010:__list_add_valid+0xe3/0xf0 lib/list_debug.c:30
Code: 31 02 0f 0b 48 c7 c7 a0 24 20 85 4c 89 f6 48 89 d9 e8 71 ff 31 02 0f 0b 48 c7 c7 20 25 20 85 48 89 de 4c 89 f1 e8 5d ff 31 02 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 90 55 48 89 e5 41 57 41 56 41
RSP: 0018:ffffc900011073e8 EFLAGS: 00010246
RAX: 0000000000000075 RBX: ffff888116f3e450 RCX: 8a3bbbcff1618f00
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000
RBP: ffffc90001107410 R08: dffffc0000000000 R09: ffffed103ee0a5f8
R10: ffffed103ee0a5f8 R11: 1ffff1103ee0a5f7 R12: ffff888116f3e458
R13: dffffc0000000000 R14: ffff88810b7fe858 R15: ffffc90001107560
FS:  00007f627870e6c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6279caa060 CR3: 00000001183e8000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400