==================================================================
BUG: KASAN: use-after-free in v4l2_fh_init drivers/media/v4l2-core/v4l2-fh.c:25 [inline]
BUG: KASAN: use-after-free in v4l2_fh_open+0xc7/0x430 drivers/media/v4l2-core/v4l2-fh.c:63
Read of size 8 at addr ffff8880757fc900 by task v4l_id/5762

CPU: 0 PID: 5762 Comm: v4l_id Not tainted 5.15.177-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106
 print_address_description+0x63/0x3b0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:434 [inline]
 kasan_report+0x16b/0x1c0 mm/kasan/report.c:451
 v4l2_fh_init drivers/media/v4l2-core/v4l2-fh.c:25 [inline]
 v4l2_fh_open+0xc7/0x430 drivers/media/v4l2-core/v4l2-fh.c:63
 em28xx_v4l2_open+0x15d/0xa10 drivers/media/usb/em28xx/em28xx-video.c:2163
 v4l2_open+0x228/0x360 drivers/media/v4l2-core/v4l2-dev.c:427
 chrdev_open+0x54a/0x630 fs/char_dev.c:414
 do_dentry_open+0x807/0xfb0 fs/open.c:826
 do_open fs/namei.c:3608 [inline]
 path_openat+0x2705/0x2f20 fs/namei.c:3742
 do_filp_open+0x21c/0x460 fs/namei.c:3769
 do_sys_openat2+0x13b/0x4f0 fs/open.c:1253
 do_sys_open fs/open.c:1269 [inline]
 __do_sys_openat fs/open.c:1285 [inline]
 __se_sys_openat fs/open.c:1280 [inline]
 __x64_sys_openat+0x243/0x290 fs/open.c:1280
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f99d54ca9a4
Code: 24 20 48 8d 44 24 30 48 89 44 24 28 64 8b 04 25 18 00 00 00 85 c0 75 2c 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 76 60 48 8b 15 55 a4 0d 00 f7 d8 64 89 02 48 83
RSP: 002b:00007ffda97e1df0 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007ffda97e2008 RCX: 00007f99d54ca9a4
RDX: 0000000000000000 RSI: 00007ffda97e2f1c RDI: 00000000ffffff9c
RBP: 00007ffda97e2f1c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffda97e2020 R14: 000055cd27999670 R15: 00007f99d5913a80
 </TASK>

The buggy address belongs to the page:
page:ffffea0001d5ff00 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x757fc
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 ffffea0001eaff08 ffff8880b8f409b0 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x102800(GFP_NOWAIT|__GFP_NOWARN|__GFP_HARDWALL), pid 5752, ts 121115262088, free_ts 121115266905
 prep_new_page mm/page_alloc.c:2426 [inline]
 get_page_from_freelist+0x3b78/0x3d40 mm/page_alloc.c:4192
 __alloc_pages+0x272/0x700 mm/page_alloc.c:5465
 stack_depot_save+0x319/0x440 lib/stackdepot.c:302
 kasan_save_stack mm/kasan/common.c:40 [inline]
 kasan_set_track+0x62/0x80 mm/kasan/common.c:46
 kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360
 ____kasan_slab_free+0xd8/0x120 mm/kasan/common.c:366
 kasan_slab_free include/linux/kasan.h:230 [inline]
 slab_free_hook mm/slub.c:1705 [inline]
 slab_free_freelist_hook+0xdd/0x160 mm/slub.c:1731
 slab_free mm/slub.c:3499 [inline]
 kmem_cache_free+0x91/0x1f0 mm/slub.c:3515
 free_buffer_head+0x45/0xb0 fs/buffer.c:3327
 try_to_free_buffers+0x464/0x5a0 fs/buffer.c:3268
 do_invalidatepage mm/truncate.c:157 [inline]
 truncate_cleanup_page+0x179/0x440 mm/truncate.c:176
 truncate_inode_pages_range+0x2e7/0x1290 mm/truncate.c:325
 ntfs_evict_big_inode+0x2c/0x480 fs/ntfs/inode.c:2251
 evict+0x529/0x930 fs/inode.c:622
 load_and_init_attrdef fs/ntfs/super.c:1623 [inline]
 load_system_files+0x2ab2/0x5700 fs/ntfs/super.c:1817
 ntfs_fill_super+0x1c7f/0x2e20 fs/ntfs/super.c:2894
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1340 [inline]
 free_pcp_prepare mm/page_alloc.c:1391 [inline]
 free_unref_page_prepare+0xc34/0xcf0 mm/page_alloc.c:3317
 free_unref_page+0x95/0x2d0 mm/page_alloc.c:3396
 stack_depot_save+0x3ef/0x440 lib/stackdepot.c:335
 kasan_save_stack mm/kasan/common.c:40 [inline]
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:434 [inline]
 ____kasan_kmalloc+0xd1/0xf0 mm/kasan/common.c:513
 kasan_kmalloc include/linux/kasan.h:264 [inline]
 __kmalloc+0x168/0x300 mm/slub.c:4407
 kmalloc_array include/linux/slab.h:631 [inline]
 kcalloc include/linux/slab.h:660 [inline]
 drm_atomic_state_init+0x9a/0x2b0 drivers/gpu/drm/drm_atomic.c:132
 drm_atomic_state_alloc+0xb5/0xf0 drivers/gpu/drm/drm_atomic.c:175
 drm_mode_atomic_ioctl+0x472/0xcb0 drivers/gpu/drm/drm_atomic_uapi.c:1367
 drm_ioctl_kernel+0x345/0x4f0 drivers/gpu/drm/drm_ioctl.c:801
 drm_ioctl+0x60d/0x9d0 drivers/gpu/drm/drm_ioctl.c:904
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:874 [inline]
 __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

Memory state around the buggy address:
 ffff8880757fc800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8880757fc880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8880757fc900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                   ^
 ffff8880757fc980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8880757fca00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================