Message-ID: <6928015c.a70a0220.d98e3.00f3.GAE@google.com>
Date: Wed, 26 Nov 2025 23:44:28 -0800
From: syzbot <syzbot+7e6ce34763ef58212c4a@...kaller.appspotmail.com>
To: linux-i2c@...r.kernel.org, linux-kernel@...r.kernel.org, 
	syzkaller-bugs@...glegroups.com, wsa+renesas@...g-engineering.com
Subject: [syzbot] [i2c?] WARNING: ODEBUG bug in i2c_device_remove

Hello,

syzbot found the following issue on:

HEAD commit:    fd95357fd8c6 Merge tag 'sched_ext-for-6.18-rc6-fixes-2' of..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=174c5742580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=38a0c4cddc846161
dashboard link: https://syzkaller.appspot.com/bug?extid=7e6ce34763ef58212c4a
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c3725d56dc16/disk-fd95357f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/5ae11d958530/vmlinux-fd95357f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b484995bf333/bzImage-fd95357f.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+7e6ce34763ef58212c4a@...kaller.appspotmail.com

------------[ cut here ]------------
ODEBUG: free active (active state 0) object: ffff88805d740690 object type: work_struct hint: rtl2832_i2c_gate_work+0x0/0xd0 drivers/media/dvb-frontends/rtl2832.c:-1
WARNING: CPU: 1 PID: 1232 at lib/debugobjects.c:615 debug_print_object+0x16b/0x1e0 lib/debugobjects.c:612
Modules linked in:
CPU: 1 UID: 0 PID: 1232 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: usb_hub_wq hub_event
RIP: 0010:debug_print_object+0x16b/0x1e0 lib/debugobjects.c:612
Code: 4c 89 ff e8 07 ad 9d fd 4d 8b 0f 48 c7 c7 80 e9 3d 8b 48 8b 34 24 4c 89 ea 89 e9 4d 89 f0 41 54 e8 2a 35 00 fd 48 83 c4 08 90 <0f> 0b 90 90 ff 05 27 93 53 0a 48 83 c4 08 5b 41 5c 41 5d 41 5e 41
RSP: 0018:ffffc90004eae760 EFLAGS: 00010296
RAX: 9a1ddaa657264c00 RBX: dffffc0000000000 RCX: 0000000000100000
RDX: ffffc9001b1c7000 RSI: 000000000002da78 RDI: 000000000002da79
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed101712487b R12: ffffffff8709b290
R13: ffffffff8b3deb00 R14: ffff88805d740690 R15: ffffffff8ae9e880
FS:  0000000000000000(0000) GS:ffff888126ef6000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00002000001f4030 CR3: 000000003179c000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 __debug_check_no_obj_freed lib/debugobjects.c:1099 [inline]
 debug_check_no_obj_freed+0x3a2/0x470 lib/debugobjects.c:1129
 slab_free_hook mm/slub.c:2474 [inline]
 slab_free mm/slub.c:6642 [inline]
 kfree+0x114/0x950 mm/slub.c:6849
 i2c_device_remove+0x88/0x200 drivers/i2c/i2c-core-base.c:631
 device_remove drivers/base/dd.c:569 [inline]
 __device_release_driver drivers/base/dd.c:1274 [inline]
 device_release_driver_internal+0x46f/0x800 drivers/base/dd.c:1297
 bus_remove_device+0x355/0x420 drivers/base/bus.c:579
 device_del+0x515/0x8e0 drivers/base/core.c:3878
 device_unregister+0x20/0xc0 drivers/base/core.c:3919
 rtl28xxu_frontend_detach+0x167/0x1e0 drivers/media/usb/dvb-usb-v2/rtl28xxu.c:1105
 dvb_usbv2_adapter_frontend_exit drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:732 [inline]
 dvb_usbv2_adapter_exit drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:829 [inline]
 dvb_usbv2_exit+0x435/0x9e0 drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:843
 dvb_usbv2_probe+0x4c4/0x41c0 drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:993
 usb_probe_interface+0x668/0xc30 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x26d/0x9e0 drivers/base/dd.c:659
 __driver_probe_device+0x18c/0x2f0 drivers/base/dd.c:801
 driver_probe_device+0x4f/0x430 drivers/base/dd.c:831
 __device_attach_driver+0x2ce/0x530 drivers/base/dd.c:959
 bus_for_each_drv+0x254/0x2e0 drivers/base/bus.c:462
 __device_attach+0x2bb/0x400 drivers/base/dd.c:1031
 bus_probe_device+0x188/0x260 drivers/base/bus.c:537
 device_add+0x7b6/0xb50 drivers/base/core.c:3689
 usb_set_configuration+0x1a87/0x20e0 drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
 usb_probe_device+0x1c4/0x390 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x26d/0x9e0 drivers/base/dd.c:659
 __driver_probe_device+0x18c/0x2f0 drivers/base/dd.c:801
 driver_probe_device+0x4f/0x430 drivers/base/dd.c:831
 __device_attach_driver+0x2ce/0x530 drivers/base/dd.c:959
 bus_for_each_drv+0x254/0x2e0 drivers/base/bus.c:462
 __device_attach+0x2bb/0x400 drivers/base/dd.c:1031
 bus_probe_device+0x188/0x260 drivers/base/bus.c:537
 device_add+0x7b6/0xb50 drivers/base/core.c:3689
 usb_new_device+0xa29/0x16e0 drivers/usb/core/hub.c:2694
 hub_port_connect drivers/usb/core/hub.c:5566 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5706 [inline]
 port_event drivers/usb/core/hub.c:5870 [inline]
 hub_event+0x2958/0x4a20 drivers/usb/core/hub.c:5952
 process_one_work kernel/workqueue.c:3263 [inline]
 process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@...glegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Powered by blists - more mailing lists