Extracting prog: 3m12.152321299s
Minimizing prog: 6m22.386611098s
Simplifying prog options: 0s
Extracting C: 36.214930553s
Simplifying C: 17m51.335953516s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x2d, &(0x7f00000005c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b000100000000090400000190f19c000905f3ede8e9384088477da5163aeacac5aef6b35899848f884763144ec6a2aeada635e54cdc8fb569daf4797849ac735823c41a718ab016b0c1ec7613250780", @ANYRESHEX=0x0, @ANYRESDEC=0x0, @ANYRESHEX, @ANYRES32, @ANYRES8=0x0], 0x0)

program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x2d, &(0x7f00000005c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b000100000000090400000190f19c000905f3ede8e9384088477da5163aeacac5aef6b35899848f884763144ec6a2aeada635e54cdc8fb569daf4797849ac735823c41a718ab016b0c1ec7613250780", @ANYRESHEX=0x0, @ANYRESDEC=0x0, @ANYRESHEX, @ANYRES32, @ANYRES8=0x0], 0x0)

program crashed: KASAN: use-after-free Read in em28xx_init_extension
single: successfully extracted reproducer
found reproducer with 1 syscalls
minimizing guilty program
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x2d, 0x0, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x2d, &(0x7f00000005c0)=ANY=[], 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x2d, &(0x7f00000005c0)=ANY=[@ANYBLOB, @ANYRESHEX=0x0, @ANYRESDEC=0x0, @ANYRESHEX, @ANYRES32, @ANYRES8=0x0], 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: use-after-free Read in em28xx_init_extension
simplifying C reproducer
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in em28xx_init_extension
a never seen crash title: KASAN: slab-use-after-free Read in em28xx_init_extension, ignore
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in em28xx_init_extension
a never seen crash title: KASAN: slab-use-after-free Read in em28xx_init_extension, ignore
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in em28xx_init_extension
a never seen crash title: KASAN: slab-use-after-free Read in em28xx_init_extension, ignore
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: use-after-free Read in em28xx_init_extension
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: BUG: corrupted list in em28xx_init_extension
a never seen crash title: BUG: corrupted list in em28xx_init_extension, ignore
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in em28xx_init_extension
a never seen crash title: KASAN: slab-use-after-free Read in em28xx_init_extension, ignore
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in em28xx_init_extension
a never seen crash title: KASAN: slab-use-after-free Read in em28xx_init_extension, ignore
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-out-of-bounds Read in em28xx_init_extension
a never seen crash title: KASAN: slab-out-of-bounds Read in em28xx_init_extension, ignore
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in em28xx_init_extension
a never seen crash title: KASAN: slab-use-after-free Read in em28xx_init_extension, ignore
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: BUG: corrupted list in em28xx_init_extension
a never seen crash title: BUG: corrupted list in em28xx_init_extension, ignore
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in em28xx_init_extension
a never seen crash title: KASAN: slab-use-after-free Read in em28xx_init_extension, ignore
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: BUG: corrupted list in em28xx_init_extension
a never seen crash title: BUG: corrupted list in em28xx_init_extension, ignore
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-out-of-bounds Read in em28xx_init_extension
a never seen crash title: KASAN: slab-out-of-bounds Read in em28xx_init_extension, ignore
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: use-after-free Read in em28xx_init_extension
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in em28xx_init_extension
a never seen crash title: KASAN: slab-use-after-free Read in em28xx_init_extension, ignore
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x2d, &(0x7f00000005c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b000100000000090400000190f19c000905f3ede8e9384088477da5163aeacac5aef6b35899848f884763144ec6a2aeada635e54cdc8fb569daf4797849ac735823c41a718ab016b0c1ec7613250780", @ANYRESHEX=0x0, @ANYRESDEC=0x0, @ANYRESHEX, @ANYRES32, @ANYRES8=0x0], 0x0)

program crashed: BUG: corrupted list in em28xx_init_extension
validation run: crashed=true
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x2d, &(0x7f00000005c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b000100000000090400000190f19c000905f3ede8e9384088477da5163aeacac5aef6b35899848f884763144ec6a2aeada635e54cdc8fb569daf4797849ac735823c41a718ab016b0c1ec7613250780", @ANYRESHEX=0x0, @ANYRESDEC=0x0, @ANYRESHEX, @ANYRES32, @ANYRES8=0x0], 0x0)

program crashed: KASAN: use-after-free Read in em28xx_init_extension
validation run: crashed=true
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x2d, &(0x7f00000005c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b000100000000090400000190f19c000905f3ede8e9384088477da5163aeacac5aef6b35899848f884763144ec6a2aeada635e54cdc8fb569daf4797849ac735823c41a718ab016b0c1ec7613250780", @ANYRESHEX=0x0, @ANYRESDEC=0x0, @ANYRESHEX, @ANYRES32, @ANYRES8=0x0], 0x0)

program crashed: KASAN: slab-out-of-bounds Read in em28xx_init_extension
validation run: crashed=true
reproducing took 32m2.751192807s
repro crashed as (corrupted=false):
em28xx 1-1:0.0: AC97 chip type couldn't be determined
em28xx 1-1:0.0: No AC97 
em28xx 1-1:0.0: No AC97 audio processor
==================================================================
BUG: KASAN: slab-out-of-bounds in __list_add_valid_or_report+0x6c/0x148 lib/list_debug.c:32
Read of size 8 at addr ffff0000f18cc250 by task kworker/0:5/6784

CPU: 0 UID: 0 PID: 6784 Comm: kworker/0:5 Not tainted 6.16.0-rc7-syzkaller-g82af5ea7c611 #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: usb_hub_wq hub_event
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 print_address_description+0xa8/0x220 mm/kasan/report.c:378
 print_report+0x68/0x84 mm/kasan/report.c:480
 kasan_report+0xb0/0x110 mm/kasan/report.c:593
 __asan_report_load8_noabort+0x20/0x2c mm/kasan/report_generic.c:381
 __list_add_valid_or_report+0x6c/0x148 lib/list_debug.c:32
 __list_add_valid include/linux/list.h:88 [inline]
 __list_add include/linux/list.h:150 [inline]
 list_add_tail include/linux/list.h:183 [inline]
 em28xx_init_extension+0x60/0x1b4 drivers/media/usb/em28xx/em28xx-core.c:1114
 em28xx_init_dev+0x80c/0x1bf4 drivers/media/usb/em28xx/em28xx-cards.c:3679
 em28xx_usb_probe+0x10c4/0x2440 drivers/media/usb/em28xx/em28xx-cards.c:4034
 usb_probe_interface+0x584/0xa44 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x394/0x910 drivers/base/dd.c:657
 __driver_probe_device+0x180/0x2d4 drivers/base/dd.c:799
 driver_probe_device+0x78/0x330 drivers/base/dd.c:829
 __device_attach_driver+0x290/0x4e0 drivers/base/dd.c:957
 bus_for_each_drv+0x220/0x2b4 drivers/base/bus.c:462
 __device_attach+0x26c/0x388 drivers/base/dd.c:1029
 device_initial_probe+0x24/0x34 drivers/base/dd.c:1078
 bus_probe_device+0x178/0x240 drivers/base/bus.c:537
 device_add+0x71c/0xa60 drivers/base/core.c:3692
 usb_set_configuration+0x1640/0x1bac drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0x8c/0x144 drivers/usb/core/generic.c:250
 usb_probe_device+0x1a4/0x348 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x394/0x910 drivers/base/dd.c:657
 __driver_probe_device+0x180/0x2d4 drivers/base/dd.c:799
 driver_probe_device+0x78/0x330 drivers/base/dd.c:829
 __device_attach_driver+0x290/0x4e0 drivers/base/dd.c:957
 bus_for_each_drv+0x220/0x2b4 drivers/base/bus.c:462
 __device_attach+0x26c/0x388 drivers/base/dd.c:1029
 device_initial_probe+0x24/0x34 drivers/base/dd.c:1078
 bus_probe_device+0x178/0x240 drivers/base/bus.c:537
 device_add+0x71c/0xa60 drivers/base/core.c:3692
 usb_new_device+0x7f0/0x1220 drivers/usb/core/hub.c:2694
 hub_port_connect drivers/usb/core/hub.c:5566 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5706 [inline]
 port_event drivers/usb/core/hub.c:5870 [inline]
 hub_event+0x211c/0x3c78 drivers/usb/core/hub.c:5952
 process_one_work+0x7e8/0x155c kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3321 [inline]
 worker_thread+0x990/0xed8 kernel/workqueue.c:3402
 kthread+0x5fc/0x75c kernel/kthread.c:464
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:844

Allocated by task 6708:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x40/0x78 mm/kasan/common.c:68
 kasan_save_alloc_info+0x44/0x54 mm/kasan/generic.c:562
 poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
 __kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:394
 kasan_kmalloc include/linux/kasan.h:260 [inline]
 __do_kmalloc_node mm/slub.c:4328 [inline]
 __kmalloc_node_track_caller_noprof+0x304/0x4d0 mm/slub.c:4347
 kmalloc_reserve+0x124/0x268 net/core/skbuff.c:601
 __alloc_skb+0x170/0x2ec net/core/skbuff.c:670
 alloc_skb include/linux/skbuff.h:1336 [inline]
 alloc_skb_with_frags+0xb8/0x678 net/core/skbuff.c:6665
 sock_alloc_send_pskb+0x758/0x874 net/core/sock.c:2999
 unix_dgram_sendmsg+0x394/0x13bc net/unix/af_unix.c:2083
 sock_sendmsg_nosec net/socket.c:712 [inline]
 __sock_sendmsg net/socket.c:727 [inline]
 sock_write_iter+0x25c/0x378 net/socket.c:1131
 new_sync_write fs/read_write.c:593 [inline]
 vfs_write+0x62c/0x97c fs/read_write.c:686
 ksys_write+0x120/0x210 fs/read_write.c:738
 __do_sys_write fs/read_write.c:749 [inline]
 __se_sys_write fs/read_write.c:746 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:746
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x58/0x180 arch/arm64/kernel/entry-common.c:879
 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596

Freed by task 6141:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x40/0x78 mm/kasan/common.c:68
 kasan_save_free_info+0x58/0x70 mm/kasan/generic.c:576
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x68/0x88 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2381 [inline]
 slab_free mm/slub.c:4643 [inline]
 kfree+0x17c/0x474 mm/slub.c:4842
 skb_kfree_head net/core/skbuff.c:1048 [inline]
 skb_free_head+0xe4/0x198 net/core/skbuff.c:1060
 skb_release_data+0x4d4/0x664 net/core/skbuff.c:1087
 skb_release_all net/core/skbuff.c:1152 [inline]
 __kfree_skb net/core/skbuff.c:1166 [inline]
 consume_skb+0xb0/0x130 net/core/skbuff.c:1398
 skb_free_datagram+0x20/0x30 net/core/datagram.c:324
 __unix_dgram_recvmsg+0x7fc/0xb8c net/unix/af_unix.c:2599
 unix_dgram_recvmsg+0xd0/0xe8 net/unix/af_unix.c:2616
 sock_recvmsg_nosec net/socket.c:1017 [inline]
 sock_recvmsg net/socket.c:1039 [inline]
 ____sys_recvmsg+0x24c/0x744 net/socket.c:2786
 ___sys_recvmsg+0x188/0x45c net/socket.c:2828
 __sys_recvmsg net/socket.c:2861 [inline]
 __do_sys_recvmsg net/socket.c:2867 [inline]
 __se_sys_recvmsg net/socket.c:2864 [inline]
 __arm64_sys_recvmsg+0x180/0x234 net/socket.c:2864
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x58/0x180 arch/arm64/kernel/entry-common.c:879
 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596

The buggy address belongs to the object at ffff0000f18cc000
 which belongs to the cache kmalloc-cg-512 of size 512
The buggy address is located 80 bytes to the right of
 allocated 512-byte region [ffff0000f18cc000, ffff0000f18cc200)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1318cc
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff0000ee650501
flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 05ffc00000000040 ffff0000c000b140 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000100010 00000000f5000000 ffff0000ee650501
head: 05ffc00000000040 ffff0000c000b140 dead000000000122 0000000000000000
head: 0000000000000000 0000000000100010 00000000f5000000 ffff0000ee650501
head: 05ffc00000000002 fffffdffc3c63301 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000f18cc100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff0000f18cc180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff0000f18cc200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                                                 ^
 ffff0000f18cc280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff0000f18cc300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
 slab kmalloc-cg-512 start ffff0000f18cc000 pointer offset 592 size 512
list_add corruption. prev->next should be next (ffff800091dd7180), but was 0000000000000000. (prev=ffff0000f18cc250).
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:34!
Internal error: Oops - BUG: 00000000f2000800 [#1]  SMP
Modules linked in:
CPU: 0 UID: 0 PID: 6784 Comm: kworker/0:5 Tainted: G    B               6.16.0-rc7-syzkaller-g82af5ea7c611 #0 PREEMPT 
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: usb_hub_wq hub_event
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __list_add_valid_or_report+0x144/0x148 lib/list_debug.c:32
lr : __list_add_valid_or_report+0x144/0x148 lib/list_debug.c:32
sp : ffff80009df16940
x29: ffff80009df16940 x28: dfff800000000000 x27: 1fffe0001dcd2bbe
x26: 1fffe0001dcd2827 x25: ffff0000d37e6820 x24: 1ffff000123bae31
x23: dfff800000000000 x22: 1fffe0001e31984a x21: ffff0000ee694250
x20: ffff0000f18cc250 x19: ffff800091dd7180 x18: 1fffe000337d1c76
x17: 3038313764643139 x16: ffff80008ae69508 x15: ffff700011ee0158
x14: 1ffff00011ee0158 x13: 0000000000000004 x12: ffffffffffffffff
x11: ffff700011ee0158 x10: 0000000000ff0100 x9 : 88135f36fae71a00
x8 : 88135f36fae71a00 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff80009df162d8 x4 : ffff80008f776bc0 x3 : ffff80008054bdfc
x2 : 0000000000000000 x1 : 0000000100000000 x0 : 0000000000000075
Call trace:
 __list_add_valid_or_report+0x144/0x148 lib/list_debug.c:32 (P)
 __list_add_valid include/linux/list.h:88 [inline]
 __list_add include/linux/list.h:150 [inline]
 list_add_tail include/linux/list.h:183 [inline]
 em28xx_init_extension+0x60/0x1b4 drivers/media/usb/em28xx/em28xx-core.c:1114
 em28xx_init_dev+0x80c/0x1bf4 drivers/media/usb/em28xx/em28xx-cards.c:3679
 em28xx_usb_probe+0x10c4/0x2440 drivers/media/usb/em28xx/em28xx-cards.c:4034
 usb_probe_interface+0x584/0xa44 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x394/0x910 drivers/base/dd.c:657
 __driver_probe_device+0x180/0x2d4 drivers/base/dd.c:799
 driver_probe_device+0x78/0x330 drivers/base/dd.c:829
 __device_attach_driver+0x290/0x4e0 drivers/base/dd.c:957
 bus_for_each_drv+0x220/0x2b4 drivers/base/bus.c:462
 __device_attach+0x26c/0x388 drivers/base/dd.c:1029
 device_initial_probe+0x24/0x34 drivers/base/dd.c:1078
 bus_probe_device+0x178/0x240 drivers/base/bus.c:537
 device_add+0x71c/0xa60 drivers/base/core.c:3692
 usb_set_configuration+0x1640/0x1bac drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0x8c/0x144 drivers/usb/core/generic.c:250
 usb_probe_device+0x1a4/0x348 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x394/0x910 drivers/base/dd.c:657
 __driver_probe_device+0x180/0x2d4 drivers/base/dd.c:799
 driver_probe_device+0x78/0x330 drivers/base/dd.c:829
 __device_attach_driver+0x290/0x4e0 drivers/base/dd.c:957
 bus_for_each_drv+0x220/0x2b4 drivers/base/bus.c:462
 __device_attach+0x26c/0x388 drivers/base/dd.c:1029
 device_initial_probe+0x24/0x34 drivers/base/dd.c:1078
 bus_probe_device+0x178/0x240 drivers/base/bus.c:537
 device_add+0x71c/0xa60 drivers/base/core.c:3692
 usb_new_device+0x7f0/0x1220 drivers/usb/core/hub.c:2694
 hub_port_connect drivers/usb/core/hub.c:5566 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5706 [inline]
 port_event drivers/usb/core/hub.c:5870 [inline]
 hub_event+0x211c/0x3c78 drivers/usb/core/hub.c:5952
 process_one_work+0x7e8/0x155c kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3321 [inline]
 worker_thread+0x990/0xed8 kernel/workqueue.c:3402
 kthread+0x5fc/0x75c kernel/kthread.c:464
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:844
Code: 91040000 aa1303e1 aa1403e3 9741c66c (d4210000) 
---[ end trace 0000000000000000 ]---

final repro crashed as (corrupted=false):
em28xx 1-1:0.0: AC97 chip type couldn't be determined
em28xx 1-1:0.0: No AC97 
em28xx 1-1:0.0: No AC97 audio processor
==================================================================
BUG: KASAN: slab-out-of-bounds in __list_add_valid_or_report+0x6c/0x148 lib/list_debug.c:32
Read of size 8 at addr ffff0000f18cc250 by task kworker/0:5/6784

CPU: 0 UID: 0 PID: 6784 Comm: kworker/0:5 Not tainted 6.16.0-rc7-syzkaller-g82af5ea7c611 #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: usb_hub_wq hub_event
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 print_address_description+0xa8/0x220 mm/kasan/report.c:378
 print_report+0x68/0x84 mm/kasan/report.c:480
 kasan_report+0xb0/0x110 mm/kasan/report.c:593
 __asan_report_load8_noabort+0x20/0x2c mm/kasan/report_generic.c:381
 __list_add_valid_or_report+0x6c/0x148 lib/list_debug.c:32
 __list_add_valid include/linux/list.h:88 [inline]
 __list_add include/linux/list.h:150 [inline]
 list_add_tail include/linux/list.h:183 [inline]
 em28xx_init_extension+0x60/0x1b4 drivers/media/usb/em28xx/em28xx-core.c:1114
 em28xx_init_dev+0x80c/0x1bf4 drivers/media/usb/em28xx/em28xx-cards.c:3679
 em28xx_usb_probe+0x10c4/0x2440 drivers/media/usb/em28xx/em28xx-cards.c:4034
 usb_probe_interface+0x584/0xa44 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x394/0x910 drivers/base/dd.c:657
 __driver_probe_device+0x180/0x2d4 drivers/base/dd.c:799
 driver_probe_device+0x78/0x330 drivers/base/dd.c:829
 __device_attach_driver+0x290/0x4e0 drivers/base/dd.c:957
 bus_for_each_drv+0x220/0x2b4 drivers/base/bus.c:462
 __device_attach+0x26c/0x388 drivers/base/dd.c:1029
 device_initial_probe+0x24/0x34 drivers/base/dd.c:1078
 bus_probe_device+0x178/0x240 drivers/base/bus.c:537
 device_add+0x71c/0xa60 drivers/base/core.c:3692
 usb_set_configuration+0x1640/0x1bac drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0x8c/0x144 drivers/usb/core/generic.c:250
 usb_probe_device+0x1a4/0x348 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x394/0x910 drivers/base/dd.c:657
 __driver_probe_device+0x180/0x2d4 drivers/base/dd.c:799
 driver_probe_device+0x78/0x330 drivers/base/dd.c:829
 __device_attach_driver+0x290/0x4e0 drivers/base/dd.c:957
 bus_for_each_drv+0x220/0x2b4 drivers/base/bus.c:462
 __device_attach+0x26c/0x388 drivers/base/dd.c:1029
 device_initial_probe+0x24/0x34 drivers/base/dd.c:1078
 bus_probe_device+0x178/0x240 drivers/base/bus.c:537
 device_add+0x71c/0xa60 drivers/base/core.c:3692
 usb_new_device+0x7f0/0x1220 drivers/usb/core/hub.c:2694
 hub_port_connect drivers/usb/core/hub.c:5566 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5706 [inline]
 port_event drivers/usb/core/hub.c:5870 [inline]
 hub_event+0x211c/0x3c78 drivers/usb/core/hub.c:5952
 process_one_work+0x7e8/0x155c kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3321 [inline]
 worker_thread+0x990/0xed8 kernel/workqueue.c:3402
 kthread+0x5fc/0x75c kernel/kthread.c:464
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:844

Allocated by task 6708:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x40/0x78 mm/kasan/common.c:68
 kasan_save_alloc_info+0x44/0x54 mm/kasan/generic.c:562
 poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
 __kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:394
 kasan_kmalloc include/linux/kasan.h:260 [inline]
 __do_kmalloc_node mm/slub.c:4328 [inline]
 __kmalloc_node_track_caller_noprof+0x304/0x4d0 mm/slub.c:4347
 kmalloc_reserve+0x124/0x268 net/core/skbuff.c:601
 __alloc_skb+0x170/0x2ec net/core/skbuff.c:670
 alloc_skb include/linux/skbuff.h:1336 [inline]
 alloc_skb_with_frags+0xb8/0x678 net/core/skbuff.c:6665
 sock_alloc_send_pskb+0x758/0x874 net/core/sock.c:2999
 unix_dgram_sendmsg+0x394/0x13bc net/unix/af_unix.c:2083
 sock_sendmsg_nosec net/socket.c:712 [inline]
 __sock_sendmsg net/socket.c:727 [inline]
 sock_write_iter+0x25c/0x378 net/socket.c:1131
 new_sync_write fs/read_write.c:593 [inline]
 vfs_write+0x62c/0x97c fs/read_write.c:686
 ksys_write+0x120/0x210 fs/read_write.c:738
 __do_sys_write fs/read_write.c:749 [inline]
 __se_sys_write fs/read_write.c:746 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:746
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x58/0x180 arch/arm64/kernel/entry-common.c:879
 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596

Freed by task 6141:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x40/0x78 mm/kasan/common.c:68
 kasan_save_free_info+0x58/0x70 mm/kasan/generic.c:576
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x68/0x88 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2381 [inline]
 slab_free mm/slub.c:4643 [inline]
 kfree+0x17c/0x474 mm/slub.c:4842
 skb_kfree_head net/core/skbuff.c:1048 [inline]
 skb_free_head+0xe4/0x198 net/core/skbuff.c:1060
 skb_release_data+0x4d4/0x664 net/core/skbuff.c:1087
 skb_release_all net/core/skbuff.c:1152 [inline]
 __kfree_skb net/core/skbuff.c:1166 [inline]
 consume_skb+0xb0/0x130 net/core/skbuff.c:1398
 skb_free_datagram+0x20/0x30 net/core/datagram.c:324
 __unix_dgram_recvmsg+0x7fc/0xb8c net/unix/af_unix.c:2599
 unix_dgram_recvmsg+0xd0/0xe8 net/unix/af_unix.c:2616
 sock_recvmsg_nosec net/socket.c:1017 [inline]
 sock_recvmsg net/socket.c:1039 [inline]
 ____sys_recvmsg+0x24c/0x744 net/socket.c:2786
 ___sys_recvmsg+0x188/0x45c net/socket.c:2828
 __sys_recvmsg net/socket.c:2861 [inline]
 __do_sys_recvmsg net/socket.c:2867 [inline]
 __se_sys_recvmsg net/socket.c:2864 [inline]
 __arm64_sys_recvmsg+0x180/0x234 net/socket.c:2864
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x58/0x180 arch/arm64/kernel/entry-common.c:879
 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596

The buggy address belongs to the object at ffff0000f18cc000
 which belongs to the cache kmalloc-cg-512 of size 512
The buggy address is located 80 bytes to the right of
 allocated 512-byte region [ffff0000f18cc000, ffff0000f18cc200)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1318cc
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff0000ee650501
flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 05ffc00000000040 ffff0000c000b140 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000100010 00000000f5000000 ffff0000ee650501
head: 05ffc00000000040 ffff0000c000b140 dead000000000122 0000000000000000
head: 0000000000000000 0000000000100010 00000000f5000000 ffff0000ee650501
head: 05ffc00000000002 fffffdffc3c63301 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000f18cc100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff0000f18cc180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff0000f18cc200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                                                 ^
 ffff0000f18cc280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff0000f18cc300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
 slab kmalloc-cg-512 start ffff0000f18cc000 pointer offset 592 size 512
list_add corruption. prev->next should be next (ffff800091dd7180), but was 0000000000000000. (prev=ffff0000f18cc250).
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:34!
Internal error: Oops - BUG: 00000000f2000800 [#1]  SMP
Modules linked in:
CPU: 0 UID: 0 PID: 6784 Comm: kworker/0:5 Tainted: G    B               6.16.0-rc7-syzkaller-g82af5ea7c611 #0 PREEMPT 
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: usb_hub_wq hub_event
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __list_add_valid_or_report+0x144/0x148 lib/list_debug.c:32
lr : __list_add_valid_or_report+0x144/0x148 lib/list_debug.c:32
sp : ffff80009df16940
x29: ffff80009df16940 x28: dfff800000000000 x27: 1fffe0001dcd2bbe
x26: 1fffe0001dcd2827 x25: ffff0000d37e6820 x24: 1ffff000123bae31
x23: dfff800000000000 x22: 1fffe0001e31984a x21: ffff0000ee694250
x20: ffff0000f18cc250 x19: ffff800091dd7180 x18: 1fffe000337d1c76
x17: 3038313764643139 x16: ffff80008ae69508 x15: ffff700011ee0158
x14: 1ffff00011ee0158 x13: 0000000000000004 x12: ffffffffffffffff
x11: ffff700011ee0158 x10: 0000000000ff0100 x9 : 88135f36fae71a00
x8 : 88135f36fae71a00 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff80009df162d8 x4 : ffff80008f776bc0 x3 : ffff80008054bdfc
x2 : 0000000000000000 x1 : 0000000100000000 x0 : 0000000000000075
Call trace:
 __list_add_valid_or_report+0x144/0x148 lib/list_debug.c:32 (P)
 __list_add_valid include/linux/list.h:88 [inline]
 __list_add include/linux/list.h:150 [inline]
 list_add_tail include/linux/list.h:183 [inline]
 em28xx_init_extension+0x60/0x1b4 drivers/media/usb/em28xx/em28xx-core.c:1114
 em28xx_init_dev+0x80c/0x1bf4 drivers/media/usb/em28xx/em28xx-cards.c:3679
 em28xx_usb_probe+0x10c4/0x2440 drivers/media/usb/em28xx/em28xx-cards.c:4034
 usb_probe_interface+0x584/0xa44 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x394/0x910 drivers/base/dd.c:657
 __driver_probe_device+0x180/0x2d4 drivers/base/dd.c:799
 driver_probe_device+0x78/0x330 drivers/base/dd.c:829
 __device_attach_driver+0x290/0x4e0 drivers/base/dd.c:957
 bus_for_each_drv+0x220/0x2b4 drivers/base/bus.c:462
 __device_attach+0x26c/0x388 drivers/base/dd.c:1029
 device_initial_probe+0x24/0x34 drivers/base/dd.c:1078
 bus_probe_device+0x178/0x240 drivers/base/bus.c:537
 device_add+0x71c/0xa60 drivers/base/core.c:3692
 usb_set_configuration+0x1640/0x1bac drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0x8c/0x144 drivers/usb/core/generic.c:250
 usb_probe_device+0x1a4/0x348 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x394/0x910 drivers/base/dd.c:657
 __driver_probe_device+0x180/0x2d4 drivers/base/dd.c:799
 driver_probe_device+0x78/0x330 drivers/base/dd.c:829
 __device_attach_driver+0x290/0x4e0 drivers/base/dd.c:957
 bus_for_each_drv+0x220/0x2b4 drivers/base/bus.c:462
 __device_attach+0x26c/0x388 drivers/base/dd.c:1029
 device_initial_probe+0x24/0x34 drivers/base/dd.c:1078
 bus_probe_device+0x178/0x240 drivers/base/bus.c:537
 device_add+0x71c/0xa60 drivers/base/core.c:3692
 usb_new_device+0x7f0/0x1220 drivers/usb/core/hub.c:2694
 hub_port_connect drivers/usb/core/hub.c:5566 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5706 [inline]
 port_event drivers/usb/core/hub.c:5870 [inline]
 hub_event+0x211c/0x3c78 drivers/usb/core/hub.c:5952
 process_one_work+0x7e8/0x155c kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3321 [inline]
 worker_thread+0x990/0xed8 kernel/workqueue.c:3402
 kthread+0x5fc/0x75c kernel/kthread.c:464
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:844
Code: 91040000 aa1303e1 aa1403e3 9741c66c (d4210000) 
---[ end trace 0000000000000000 ]---