em28xx 8-1:0.132: Closing input extension ================================================================== BUG: KASAN: slab-use-after-free in media_device_unregister+0x141/0x450 drivers/media/mc/mc-device.c:833 Read of size 8 at addr ffff888027c94210 by task kworker/1:2/12611 CPU: 1 UID: 0 PID: 12611 Comm: kworker/1:2 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Workqueue: usb_hub_wq hub_event Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description+0x55/0x1e0 mm/kasan/report.c:378 print_report+0x58/0x70 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 media_device_unregister+0x141/0x450 drivers/media/mc/mc-device.c:833 em28xx_unregister_media_device drivers/media/usb/em28xx/em28xx-cards.c:3518 [inline] em28xx_release_resources+0xac/0x240 drivers/media/usb/em28xx/em28xx-cards.c:3539 em28xx_usb_disconnect+0x19f/0x2f0 drivers/media/usb/em28xx/em28xx-cards.c:4208 usb_unbind_interface+0x26e/0x910 drivers/usb/core/driver.c:458 device_remove drivers/base/dd.c:633 [inline] __device_release_driver drivers/base/dd.c:1344 [inline] device_release_driver_internal+0x4d9/0x870 drivers/base/dd.c:1367 bus_remove_device+0x455/0x570 drivers/base/bus.c:657 device_del+0x527/0x8f0 drivers/base/core.c:3881 usb_disable_device+0x3d4/0x8d0 drivers/usb/core/message.c:1478 usb_disconnect+0x32f/0x990 drivers/usb/core/hub.c:2345 hub_port_connect drivers/usb/core/hub.c:5407 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x1cc9/0x4f30 drivers/usb/core/hub.c:5953 process_one_work+0x9a3/0x1710 kernel/workqueue.c:3288 process_scheduled_works kernel/workqueue.c:3379 [inline] worker_thread+0xba8/0x11e0 kernel/workqueue.c:3465 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 12621: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x31c/0x660 mm/slub.c:5412 kmalloc_noprof include/linux/slab.h:950 [inline] kzalloc_noprof include/linux/slab.h:1188 [inline] em28xx_v4l2_init+0x10b/0x2e70 drivers/media/usb/em28xx/em28xx-video.c:2538 em28xx_init_extension+0x120/0x1c0 drivers/media/usb/em28xx/em28xx-core.c:1117 process_one_work+0x9a3/0x1710 kernel/workqueue.c:3288 process_scheduled_works kernel/workqueue.c:3379 [inline] worker_thread+0xba8/0x11e0 kernel/workqueue.c:3465 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 12621: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2689 [inline] slab_free mm/slub.c:6242 [inline] kfree+0x1c5/0x640 mm/slub.c:6557 em28xx_free_v4l2 drivers/media/usb/em28xx/em28xx-video.c:2118 [inline] kref_put include/linux/kref.h:65 [inline] em28xx_v4l2_init+0x1683/0x2e70 drivers/media/usb/em28xx/em28xx-video.c:2907 em28xx_init_extension+0x120/0x1c0 drivers/media/usb/em28xx/em28xx-core.c:1117 process_one_work+0x9a3/0x1710 kernel/workqueue.c:3288 process_scheduled_works kernel/workqueue.c:3379 [inline] worker_thread+0xba8/0x11e0 kernel/workqueue.c:3465 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the object at ffff888027c94000 which belongs to the cache kmalloc-8k of size 8192 The buggy address is located 528 bytes inside of freed 8192-byte region [ffff888027c94000, ffff888027c96000) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x27c90 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801b042280 dead000000000100 dead000000000122 raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88801b042280 dead000000000100 dead000000000122 head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd28c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 13110, tgid 13110 (syz-executor), ts 843578367994, free_ts 843522958047 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x231/0x280 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0x2418/0x24b0 mm/page_alloc.c:3926 __alloc_frozen_pages_noprof+0x233/0x3d0 mm/page_alloc.c:5213 alloc_slab_page mm/slub.c:3278 [inline] allocate_slab+0x77/0x660 mm/slub.c:3467 new_slab mm/slub.c:3525 [inline] refill_objects+0x339/0x3d0 mm/slub.c:7247 refill_sheaf mm/slub.c:2816 [inline] __pcs_replace_empty_main+0x321/0x720 mm/slub.c:4651 alloc_from_pcs mm/slub.c:4749 [inline] slab_alloc_node mm/slub.c:4883 [inline] __do_kmalloc_node mm/slub.c:5291 [inline] __kvmalloc_node_noprof+0x657/0x8a0 mm/slub.c:6824 kvmalloc_array_node_noprof include/linux/slab.h:1216 [inline] __ptr_ring_init_queue_alloc_noprof include/linux/ptr_ring.h:481 [inline] ptr_ring_init_noprof include/linux/ptr_ring.h:499 [inline] skb_array_init_noprof include/linux/skb_array.h:182 [inline] pfifo_fast_init+0x372/0x6c0 net/sched/sch_generic.c:895 qdisc_create_dflt+0x13b/0x4e0 net/sched/sch_generic.c:1038 mq_init_common+0x25c/0x440 net/sched/sch_mq.c:91 mq_init+0x84/0x270 net/sched/sch_mq.c:112 qdisc_create_dflt+0x13b/0x4e0 net/sched/sch_generic.c:1038 attach_default_qdiscs net/sched/sch_generic.c:1220 [inline] dev_activate+0x1ce/0x1150 net/sched/sch_generic.c:1274 __dev_open+0x67a/0x830 net/core/dev.c:1711 __dev_change_flags+0x1f7/0x690 net/core/dev.c:9783 netif_change_flags+0x88/0x1a0 net/core/dev.c:9846 page last free pid 13110 tgid 13110 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1403 [inline] __free_frozen_pages+0xbc7/0xd30 mm/page_alloc.c:2944 __slab_free+0x274/0x2c0 mm/slub.c:5605 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4569 [inline] slab_alloc_node mm/slub.c:4898 [inline] __do_kmalloc_node mm/slub.c:5291 [inline] __kmalloc_noprof+0x316/0x760 mm/slub.c:5304 kmalloc_noprof include/linux/slab.h:954 [inline] kzalloc_noprof include/linux/slab.h:1188 [inline] fib6_info_alloc+0x30/0xf0 net/ipv6/ip6_fib.c:155 ip6_route_info_create+0x142/0x860 net/ipv6/route.c:3818 addrconf_f6i_alloc+0x38b/0x630 net/ipv6/route.c:4687 ipv6_add_addr+0x59c/0x1100 net/ipv6/addrconf.c:1125 addrconf_add_linklocal+0x20c/0x460 net/ipv6/addrconf.c:3310 addrconf_addr_gen+0x2f8/0x360 net/ipv6/addrconf.c:3446 addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3744 notifier_call_chain+0x1ad/0x3d0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2289 [inline] call_netdevice_notifiers net/core/dev.c:2303 [inline] __dev_notify_flags+0x1a9/0x310 net/core/dev.c:9822 netif_change_flags+0xe8/0x1a0 net/core/dev.c:9851 Memory state around the buggy address: ffff888027c94100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888027c94180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888027c94200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888027c94280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888027c94300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================