Extracting prog: 15m14.556165851s
Minimizing prog: 28m16.84780726s
Simplifying prog options: 0s
Extracting C: 1m25.298716008s
Simplifying C: 10m20.880892741s


extracting reproducer from 70 programs
testing a last program of every proc
single: executing 20 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ncm-syz_usb_control_io-syz_usb_control_io$uac1-syz_usb_control_io$uac1-syz_usb_control_io$cdc_ecm-syz_usb_control_io$cdc_ecm-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_open_dev$evdev-syz_usb_ep_write-read$hidraw-syz_open_dev$evdev-write$char_usb-syz_usb_control_io$cdc_ecm-syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$hid
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000700)={{0x12, 0x1, 0x0, 0x4b, 0xec, 0x2, 0x20, 0x6a2, 0x3, 0xb48c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x9, 0x0, 0x0, 0xc9, 0xc8, 0xb7}}]}}]}}, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) (async)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) (async)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x20d6, 0xcb17, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, &(0x7f0000000280)={0x24, 0x0, 0x0, &(0x7f0000000200)={0x0, 0x22, 0x5, {[@main=@item_4={0x3, 0x0, 0x8, "a5247d20"}]}}, 0x0}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000000)={0x0, 0x16, 0x4, "bbce0ccc"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000500)=ANY=[@ANYBLOB="000002"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 64)
r2 = syz_open_dev$evdev(&(0x7f0000001900), 0x0, 0x0) (async, rerun: 64)
syz_usb_ep_write(r0, 0xd, 0x96, &(0x7f0000000100)="c884b5b577e6f66a6845f2fbdeb1a79a47403950b05c1d100f95648de296716728d6286cd0615c1e80cd06f9227de49d48d204bc2c755ed6324d98be1c691bb7c76172506943c9ba3d85fbfa2b10f98641444b403685777b01af50ca5b764d6500768dee9a7b8cbc7c862e843c7a6b13a91f644617001791b309e666dbe812b98b5013989fe99778c6f3e1e7ece6ecd3b9d4db00b567")
read$hidraw(r2, 0x0, 0x49)
r3 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01)
write$char_usb(r3, &(0x7f0000000040)="e2", 0x1068) (async)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) (async, rerun: 64)
r4 = syz_usb_connect(0x3, 0x44, &(0x7f0000000480)={{0x12, 0x1, 0x200, 0x1d, 0x6, 0x27, 0x40, 0x1df7, 0x2500, 0x5e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x32, 0x2, 0x0, 0x0, 0x20, 0x1, [{{0x9, 0x4, 0x1, 0xcf, 0x0, 0x38, 0x36, 0x7c, 0x1}}, {{0x9, 0x4, 0x8e, 0x0, 0x0, 0x83, 0xb5, 0x75, 0xb, [@cdc_ecm={{0x5}, {0x5, 0x24, 0x0, 0xfff8}, {0xd, 0x24, 0xf, 0x1, 0x7, 0x8, 0x10, 0xff}}]}}]}}]}}, 0x0) (rerun: 64)
syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) (async)
syz_usb_control_io$hid(r4, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$cdc_ecm-syz_usb_control_io$uac1-syz_usb_disconnect-syz_usb_connect$printer-syz_usb_connect-syz_usb_connect$hid-syz_usb_connect-syz_usb_connect-syz_usb_control_io-syz_usb_ep_write$ath9k_ep2-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io$hid-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0xd9, 0x72, 0xa4, 0x40, 0x20b7, 0x1540, 0xb75a, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xff}}]}}]}}, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) (async)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) (async)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000580)={0x44, &(0x7f0000000280)={0x40, 0x9, 0x5, "6b5603b630"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_disconnect(0xffffffffffffffff) (async)
syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000580)={{0x12, 0x1, 0x140, 0x0, 0x0, 0x0, 0x10, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0xe, 0x30, 0x7, [{{0x9, 0x4, 0x0, 0xa, 0x1, 0x7, 0x1, 0x1, 0x1, "", {{{0x9, 0x5, 0x1, 0x2, 0x3ff, 0x9, 0x1, 0x5}}}}}]}}]}}, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x2, 0x0}]}) (async)
r1 = syz_usb_connect(0x0, 0x60, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000c665cf40dd08ff905a5d010203010902120001000000000904000000cdf8f300"], 0x0)
syz_usb_connect$hid(0x6, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000000000010ac0100000001000000010902240001000000000904000001030000000921ffff0001220500090581030008"], 0x0) (async)
syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000dae11c105e048402"], 0x0) (async)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)={{0x12, 0x1, 0x300, 0xc3, 0xfe, 0x5d, 0x8, 0x16c0, 0x5df, 0x6b16, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x7, 0x7, 0x20, 0x0, [{{0x9, 0x4, 0x43, 0x0, 0x1, 0x3, 0x0, 0x0, 0x2, [], [{{0x9, 0x5, 0x8a, 0x13, 0x8, 0x3, 0x7, 0xdb}}]}}]}}]}}, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r1, 0x0, 0x0) (async)
syz_usb_ep_write$ath9k_ep2(r1, 0x83, 0x101, &(0x7f0000000100)=@generic={0x0, 0x0, 0xf9, "3046cb47", "f04762ae9e4dd5ccd37890169b8a0b93468e4aa3425f0962106515c4c4b780062e23c0bde702a1817afddcf59283f1cc57bdc8947b03bd29a91c4afcbffc8394af70fee701ccff19d4e609c2fabe29c083e9f8c62ec73a845b8c99a37734cfe7fcea136b0e2c86401305f5dab2b698a3e4d9321d983b967e4eeb066f330bfbe73ff7db1f3a12b4343830541fe8c760de149cee28f36ea7d0a6f1297b1aa4049c1b9105d50db3a0e282ff0c6231ed1df482a5bf232d9b5c949f83b807a83828b2738d7252ec9a6a86b9637e36d2355aae94d2c7cf4e241023069054086da6188aeb7937ce333443d27f865b948337c77b71d0457ffd2ddc1f3b"}) (async)
syz_usb_control_io$hid(r1, 0x0, 0x0)
r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000a00)=ANY=[@ANYBLOB="120100007856bb40da0b53813de20102030109021200010000000009040000000206"], 0x0)
syz_usb_control_io$uac1(r2, 0x0, &(0x7f0000000d80)={0x44, &(0x7f0000000b40)=ANY=[@ANYBLOB="000b0400000092102ef3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r1, 0x0, 0x0) (async)
syz_usb_connect(0x0, 0x52, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0xd4, 0xb8, 0x58, 0x20, 0x2040, 0xb990, 0xadbc, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x40, 0x1, 0x2, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xf6, 0x0, 0x0, 0xc2, 0xdb, 0xb3, 0x0, [@uac_control={{0xa, 0x24, 0x1, 0x2, 0x1}, [@mixer_unit={0x7, 0x24, 0x4, 0x0, 0x5, "8691"}, @output_terminal={0x9, 0x24, 0x3, 0x6, 0x306, 0x5, 0x4, 0x5}, @selector_unit={0x7, 0x24, 0x5, 0x6, 0x57, "c7cc"}, @output_terminal={0x9, 0x24, 0x3, 0x2, 0x302, 0x5, 0x2, 0x2}, @mixer_unit={0x5, 0x24, 0x4, 0x4, 0xd9}]}]}}]}}]}}, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_connect-syz_usb_control_io$uac1-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$cdc_ncm-syz_open_dev$evdev-ioctl$EVIOCGEFFECTS-syz_usb_connect$hid-syz_usb_control_io-syz_usb_connect$cdc_ncm-syz_usb_control_io$hid
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x5, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_connect(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000fc4c2608fd0b24019f3a010203010902240001000000000904000002c55bef000905ad1e000000000009050202"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x45, 0x6f, 0xf3, 0x8, 0x41e, 0x401d, 0x7681, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x5b, 0x29, 0xa9}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000680)={0x14, &(0x7f00000005c0)={0x20, 0x22, 0x64, {0x64, 0x2, "f2305041ff6675172103a2ae624f09d15f969cb800698e730c07976c242e808e7042c78a51cd398905aa25350039c89288f416109c4844587740903281868a1b2fec7f09ad99961e8177919afd89983b9b47986bfbd9ded7076521a019b2208795ec"}}, &(0x7f0000000640)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000940)={0x44, &(0x7f00000006c0)={0x20, 0x9, 0x9a, "f59e64600564bcd49a989cc44b9e5fcc2fc2f1a115f6a42ba196a65683a5742d19c54a423bd996902f75e8b608f0816a4b8c07a804fbfb10dec1c6e76611889eb7ff0ba8cd1c9760c8fe9af33cba9f7c5a2edff50c0d742179d49d46bdc917ad491be558c8bc0d1d388df62b83fc2f57795cb32bbcc2ae9010d7538b7c71223374d8750ca32edbf2edab0997ddb456b331fa36a8bdd8a67028c0"}, &(0x7f0000000780)={0x0, 0xa, 0x1, 0xa}, &(0x7f00000007c0)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000800)={0x20, 0x80, 0x1c, {0x401, 0x81, 0x3, 0x7, 0x582f, 0x4, 0x5, 0xd, 0x82dd, 0x3, 0x5, 0x3d}}, &(0x7f0000000840)={0x20, 0x85, 0x4, 0x6f940df}, &(0x7f0000000880)={0x20, 0x83, 0x2, 0x1}, &(0x7f00000008c0)={0x20, 0x87, 0x2, 0x6ff}, &(0x7f0000000900)={0x20, 0x89, 0x2, 0x1}})
r1 = syz_open_dev$evdev(&(0x7f00000009c0), 0x90000000, 0x202000)
ioctl$EVIOCGEFFECTS(r1, 0x80044584, &(0x7f0000000a00)=""/5)
r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x458, 0x138, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x2, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x4f8}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io(r2, 0x0, 0x0)
syz_usb_connect$cdc_ncm(0x2, 0x168, &(0x7f0000000100)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x156, 0x2, 0x1, 0xe, 0x30, 0x10, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "410432700700"}, {0x5, 0x24, 0x0, 0x8}, {0xd, 0x24, 0xf, 0x1, 0xc160, 0x81, 0x1, 0x40}, {0x6, 0x24, 0x1a, 0x9f6, 0x8}, [@network_terminal={0x7, 0x24, 0xa, 0xcd, 0x34, 0xfc, 0x7a}, @mdlm_detail={0xed, 0x24, 0x13, 0x3, "68091a16a1558af3cdc7407642919696f60080a9ce576013a5dcc8497ca9aff17d7077eef2da9d994d70fcd248a25db99a21e85d64b9a25537cee5b7e437b7fcd330924615e874ce0e479922432b91cd8c5b81d8d78edb3314bda6663a143ba13ef1a144f998887b74daf6d9d683e456135ab87b7a98b4ccf1c69f03db50fc4dae8f6d33e82ee8b1d5e3a269bcaf96c3ac07c0732cf5e7add2df87dafb8f329079ac62ee08939443988f87fb8c9ac967d9071ece2833e7a2a9771dcbf708030629674dd9cc97f3d93052afe5e6360df8321a2c9da4375331e1c1246458b8eb213771eca035266c8cf3"}]}, {{0x9, 0x5, 0x81, 0x3, 0x10, 0xd5, 0xf, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x20, 0xf3, 0x5f, 0x6}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x6, 0x40, 0x3}}}}}}}]}}, &(0x7f0000000540)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x250, 0x9, 0x7, 0x6, 0x40, 0x29}, 0x4d, &(0x7f0000000a40)=ANY=[@ANYBLOB="050f4d000507100210b4030018100ab98300000000ff07000f0000000fc0000030ffff0003100b0a1003020900d30409001c100a08a4c700000000790600000000f858506ac000ff00003f0000ab476a4ff8285ae5a5b52c3690caee61d6b6fc559ec03c5d23b7c4fce91b9a4bbad7987bf9acf5a4627dca50c533de83e2c9283a63e6f37710041860511522bfee554a73c566a53bf44d28b103fb2e3b755c2a7c32d29fde173f5d1d93249bdec5b34737ac5f6b237a40d1ebf839b8dc78aacf2aac1e2330e641380ec28efa40ea36b64327199ee72aa31227fece714163942592b3747ac3db579ee8d08e361125ed733a86be99e058695addc7c2c89e42c699f007d928e5e49b1d4c460ac08d37038dd7a731cdbe158b1c2720dda5fd90a2348f05a9b2edd2"], 0x7, [{0x4, &(0x7f0000000080)=@lang_id={0x4, 0x3, 0xc0c}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x448}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0xc1a}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x401}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x441}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x280a}}, {0x95, &(0x7f0000000480)=@string={0x95, 0x3, "ef4c3ad7173889c3de6d386e95d4102e869f38e65b5342061c6e2092a250ff72ab2fd6ea4484a4a5e37c62ad7df5543a5fbe802c944759ee8d0d7b72a731acfb8a1d692d0e4d3a1d2e0db7f5ebd9323219a9f51ec772864aa4f199880bc7c3a0758d8056ef5c57de0b98fa317d12a9370b7acb2764ad52eac2bbf85f27f4df986ac9275eb414eedd45bc02ab6e54496d06b02e"}}]})
syz_usb_control_io$hid(r2, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="00220508", @ANYRES16=0x0, @ANYBLOB="1b7dd1ce99475246afab416df1"], 0x0}, 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
single: successfully extracted reproducer
found reproducer with 13 syscalls
minimizing guilty program
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_connect-syz_usb_control_io$uac1-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$cdc_ncm-syz_open_dev$evdev-ioctl$EVIOCGEFFECTS-syz_usb_connect$hid-syz_usb_control_io-syz_usb_connect$cdc_ncm
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x5, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_connect(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000fc4c2608fd0b24019f3a010203010902240001000000000904000002c55bef000905ad1e000000000009050202"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x45, 0x6f, 0xf3, 0x8, 0x41e, 0x401d, 0x7681, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x5b, 0x29, 0xa9}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000680)={0x14, &(0x7f00000005c0)={0x20, 0x22, 0x64, {0x64, 0x2, "f2305041ff6675172103a2ae624f09d15f969cb800698e730c07976c242e808e7042c78a51cd398905aa25350039c89288f416109c4844587740903281868a1b2fec7f09ad99961e8177919afd89983b9b47986bfbd9ded7076521a019b2208795ec"}}, &(0x7f0000000640)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000940)={0x44, &(0x7f00000006c0)={0x20, 0x9, 0x9a, "f59e64600564bcd49a989cc44b9e5fcc2fc2f1a115f6a42ba196a65683a5742d19c54a423bd996902f75e8b608f0816a4b8c07a804fbfb10dec1c6e76611889eb7ff0ba8cd1c9760c8fe9af33cba9f7c5a2edff50c0d742179d49d46bdc917ad491be558c8bc0d1d388df62b83fc2f57795cb32bbcc2ae9010d7538b7c71223374d8750ca32edbf2edab0997ddb456b331fa36a8bdd8a67028c0"}, &(0x7f0000000780)={0x0, 0xa, 0x1, 0xa}, &(0x7f00000007c0)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000800)={0x20, 0x80, 0x1c, {0x401, 0x81, 0x3, 0x7, 0x582f, 0x4, 0x5, 0xd, 0x82dd, 0x3, 0x5, 0x3d}}, &(0x7f0000000840)={0x20, 0x85, 0x4, 0x6f940df}, &(0x7f0000000880)={0x20, 0x83, 0x2, 0x1}, &(0x7f00000008c0)={0x20, 0x87, 0x2, 0x6ff}, &(0x7f0000000900)={0x20, 0x89, 0x2, 0x1}})
r1 = syz_open_dev$evdev(&(0x7f00000009c0), 0x90000000, 0x202000)
ioctl$EVIOCGEFFECTS(r1, 0x80044584, &(0x7f0000000a00)=""/5)
r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x458, 0x138, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x2, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x4f8}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io(r2, 0x0, 0x0)
syz_usb_connect$cdc_ncm(0x2, 0x168, &(0x7f0000000100)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x156, 0x2, 0x1, 0xe, 0x30, 0x10, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "410432700700"}, {0x5, 0x24, 0x0, 0x8}, {0xd, 0x24, 0xf, 0x1, 0xc160, 0x81, 0x1, 0x40}, {0x6, 0x24, 0x1a, 0x9f6, 0x8}, [@network_terminal={0x7, 0x24, 0xa, 0xcd, 0x34, 0xfc, 0x7a}, @mdlm_detail={0xed, 0x24, 0x13, 0x3, "68091a16a1558af3cdc7407642919696f60080a9ce576013a5dcc8497ca9aff17d7077eef2da9d994d70fcd248a25db99a21e85d64b9a25537cee5b7e437b7fcd330924615e874ce0e479922432b91cd8c5b81d8d78edb3314bda6663a143ba13ef1a144f998887b74daf6d9d683e456135ab87b7a98b4ccf1c69f03db50fc4dae8f6d33e82ee8b1d5e3a269bcaf96c3ac07c0732cf5e7add2df87dafb8f329079ac62ee08939443988f87fb8c9ac967d9071ece2833e7a2a9771dcbf708030629674dd9cc97f3d93052afe5e6360df8321a2c9da4375331e1c1246458b8eb213771eca035266c8cf3"}]}, {{0x9, 0x5, 0x81, 0x3, 0x10, 0xd5, 0xf, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x20, 0xf3, 0x5f, 0x6}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x6, 0x40, 0x3}}}}}}}]}}, &(0x7f0000000540)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x250, 0x9, 0x7, 0x6, 0x40, 0x29}, 0x4d, &(0x7f0000000a40)=ANY=[@ANYBLOB="050f4d000507100210b4030018100ab98300000000ff07000f0000000fc0000030ffff0003100b0a1003020900d30409001c100a08a4c700000000790600000000f858506ac000ff00003f0000ab476a4ff8285ae5a5b52c3690caee61d6b6fc559ec03c5d23b7c4fce91b9a4bbad7987bf9acf5a4627dca50c533de83e2c9283a63e6f37710041860511522bfee554a73c566a53bf44d28b103fb2e3b755c2a7c32d29fde173f5d1d93249bdec5b34737ac5f6b237a40d1ebf839b8dc78aacf2aac1e2330e641380ec28efa40ea36b64327199ee72aa31227fece714163942592b3747ac3db579ee8d08e361125ed733a86be99e058695addc7c2c89e42c699f007d928e5e49b1d4c460ac08d37038dd7a731cdbe158b1c2720dda5fd90a2348f05a9b2edd2"], 0x7, [{0x4, &(0x7f0000000080)=@lang_id={0x4, 0x3, 0xc0c}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x448}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0xc1a}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x401}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x441}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x280a}}, {0x95, &(0x7f0000000480)=@string={0x95, 0x3, "ef4c3ad7173889c3de6d386e95d4102e869f38e65b5342061c6e2092a250ff72ab2fd6ea4484a4a5e37c62ad7df5543a5fbe802c944759ee8d0d7b72a731acfb8a1d692d0e4d3a1d2e0db7f5ebd9323219a9f51ec772864aa4f199880bc7c3a0758d8056ef5c57de0b98fa317d12a9370b7acb2764ad52eac2bbf85f27f4df986ac9275eb414eedd45bc02ab6e54496d06b02e"}}]})

program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_connect-syz_usb_control_io$uac1-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$cdc_ncm-syz_open_dev$evdev-ioctl$EVIOCGEFFECTS-syz_usb_connect$hid-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x5, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_connect(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000fc4c2608fd0b24019f3a010203010902240001000000000904000002c55bef000905ad1e000000000009050202"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x45, 0x6f, 0xf3, 0x8, 0x41e, 0x401d, 0x7681, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x5b, 0x29, 0xa9}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000680)={0x14, &(0x7f00000005c0)={0x20, 0x22, 0x64, {0x64, 0x2, "f2305041ff6675172103a2ae624f09d15f969cb800698e730c07976c242e808e7042c78a51cd398905aa25350039c89288f416109c4844587740903281868a1b2fec7f09ad99961e8177919afd89983b9b47986bfbd9ded7076521a019b2208795ec"}}, &(0x7f0000000640)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000940)={0x44, &(0x7f00000006c0)={0x20, 0x9, 0x9a, "f59e64600564bcd49a989cc44b9e5fcc2fc2f1a115f6a42ba196a65683a5742d19c54a423bd996902f75e8b608f0816a4b8c07a804fbfb10dec1c6e76611889eb7ff0ba8cd1c9760c8fe9af33cba9f7c5a2edff50c0d742179d49d46bdc917ad491be558c8bc0d1d388df62b83fc2f57795cb32bbcc2ae9010d7538b7c71223374d8750ca32edbf2edab0997ddb456b331fa36a8bdd8a67028c0"}, &(0x7f0000000780)={0x0, 0xa, 0x1, 0xa}, &(0x7f00000007c0)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000800)={0x20, 0x80, 0x1c, {0x401, 0x81, 0x3, 0x7, 0x582f, 0x4, 0x5, 0xd, 0x82dd, 0x3, 0x5, 0x3d}}, &(0x7f0000000840)={0x20, 0x85, 0x4, 0x6f940df}, &(0x7f0000000880)={0x20, 0x83, 0x2, 0x1}, &(0x7f00000008c0)={0x20, 0x87, 0x2, 0x6ff}, &(0x7f0000000900)={0x20, 0x89, 0x2, 0x1}})
r1 = syz_open_dev$evdev(&(0x7f00000009c0), 0x90000000, 0x202000)
ioctl$EVIOCGEFFECTS(r1, 0x80044584, &(0x7f0000000a00)=""/5)
r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x458, 0x138, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x2, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x4f8}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io(r2, 0x0, 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_connect-syz_usb_control_io$uac1-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$cdc_ncm-syz_open_dev$evdev-ioctl$EVIOCGEFFECTS-syz_usb_connect$hid
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x5, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_connect(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000fc4c2608fd0b24019f3a010203010902240001000000000904000002c55bef000905ad1e000000000009050202"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x45, 0x6f, 0xf3, 0x8, 0x41e, 0x401d, 0x7681, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x5b, 0x29, 0xa9}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000680)={0x14, &(0x7f00000005c0)={0x20, 0x22, 0x64, {0x64, 0x2, "f2305041ff6675172103a2ae624f09d15f969cb800698e730c07976c242e808e7042c78a51cd398905aa25350039c89288f416109c4844587740903281868a1b2fec7f09ad99961e8177919afd89983b9b47986bfbd9ded7076521a019b2208795ec"}}, &(0x7f0000000640)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000940)={0x44, &(0x7f00000006c0)={0x20, 0x9, 0x9a, "f59e64600564bcd49a989cc44b9e5fcc2fc2f1a115f6a42ba196a65683a5742d19c54a423bd996902f75e8b608f0816a4b8c07a804fbfb10dec1c6e76611889eb7ff0ba8cd1c9760c8fe9af33cba9f7c5a2edff50c0d742179d49d46bdc917ad491be558c8bc0d1d388df62b83fc2f57795cb32bbcc2ae9010d7538b7c71223374d8750ca32edbf2edab0997ddb456b331fa36a8bdd8a67028c0"}, &(0x7f0000000780)={0x0, 0xa, 0x1, 0xa}, &(0x7f00000007c0)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000800)={0x20, 0x80, 0x1c, {0x401, 0x81, 0x3, 0x7, 0x582f, 0x4, 0x5, 0xd, 0x82dd, 0x3, 0x5, 0x3d}}, &(0x7f0000000840)={0x20, 0x85, 0x4, 0x6f940df}, &(0x7f0000000880)={0x20, 0x83, 0x2, 0x1}, &(0x7f00000008c0)={0x20, 0x87, 0x2, 0x6ff}, &(0x7f0000000900)={0x20, 0x89, 0x2, 0x1}})
r1 = syz_open_dev$evdev(&(0x7f00000009c0), 0x90000000, 0x202000)
ioctl$EVIOCGEFFECTS(r1, 0x80044584, &(0x7f0000000a00)=""/5)
syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x458, 0x138, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x2, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x4f8}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x4}}}}}]}}]}}, 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_connect-syz_usb_control_io$uac1-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$cdc_ncm-syz_open_dev$evdev-ioctl$EVIOCGEFFECTS
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x5, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_connect(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000fc4c2608fd0b24019f3a010203010902240001000000000904000002c55bef000905ad1e000000000009050202"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x45, 0x6f, 0xf3, 0x8, 0x41e, 0x401d, 0x7681, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x5b, 0x29, 0xa9}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000680)={0x14, &(0x7f00000005c0)={0x20, 0x22, 0x64, {0x64, 0x2, "f2305041ff6675172103a2ae624f09d15f969cb800698e730c07976c242e808e7042c78a51cd398905aa25350039c89288f416109c4844587740903281868a1b2fec7f09ad99961e8177919afd89983b9b47986bfbd9ded7076521a019b2208795ec"}}, &(0x7f0000000640)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000940)={0x44, &(0x7f00000006c0)={0x20, 0x9, 0x9a, "f59e64600564bcd49a989cc44b9e5fcc2fc2f1a115f6a42ba196a65683a5742d19c54a423bd996902f75e8b608f0816a4b8c07a804fbfb10dec1c6e76611889eb7ff0ba8cd1c9760c8fe9af33cba9f7c5a2edff50c0d742179d49d46bdc917ad491be558c8bc0d1d388df62b83fc2f57795cb32bbcc2ae9010d7538b7c71223374d8750ca32edbf2edab0997ddb456b331fa36a8bdd8a67028c0"}, &(0x7f0000000780)={0x0, 0xa, 0x1, 0xa}, &(0x7f00000007c0)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000800)={0x20, 0x80, 0x1c, {0x401, 0x81, 0x3, 0x7, 0x582f, 0x4, 0x5, 0xd, 0x82dd, 0x3, 0x5, 0x3d}}, &(0x7f0000000840)={0x20, 0x85, 0x4, 0x6f940df}, &(0x7f0000000880)={0x20, 0x83, 0x2, 0x1}, &(0x7f00000008c0)={0x20, 0x87, 0x2, 0x6ff}, &(0x7f0000000900)={0x20, 0x89, 0x2, 0x1}})
r1 = syz_open_dev$evdev(&(0x7f00000009c0), 0x90000000, 0x202000)
ioctl$EVIOCGEFFECTS(r1, 0x80044584, &(0x7f0000000a00)=""/5)

program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_connect-syz_usb_control_io$uac1-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$cdc_ncm-syz_open_dev$evdev
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x5, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_connect(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000fc4c2608fd0b24019f3a010203010902240001000000000904000002c55bef000905ad1e000000000009050202"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x45, 0x6f, 0xf3, 0x8, 0x41e, 0x401d, 0x7681, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x5b, 0x29, 0xa9}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000680)={0x14, &(0x7f00000005c0)={0x20, 0x22, 0x64, {0x64, 0x2, "f2305041ff6675172103a2ae624f09d15f969cb800698e730c07976c242e808e7042c78a51cd398905aa25350039c89288f416109c4844587740903281868a1b2fec7f09ad99961e8177919afd89983b9b47986bfbd9ded7076521a019b2208795ec"}}, &(0x7f0000000640)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000940)={0x44, &(0x7f00000006c0)={0x20, 0x9, 0x9a, "f59e64600564bcd49a989cc44b9e5fcc2fc2f1a115f6a42ba196a65683a5742d19c54a423bd996902f75e8b608f0816a4b8c07a804fbfb10dec1c6e76611889eb7ff0ba8cd1c9760c8fe9af33cba9f7c5a2edff50c0d742179d49d46bdc917ad491be558c8bc0d1d388df62b83fc2f57795cb32bbcc2ae9010d7538b7c71223374d8750ca32edbf2edab0997ddb456b331fa36a8bdd8a67028c0"}, &(0x7f0000000780)={0x0, 0xa, 0x1, 0xa}, &(0x7f00000007c0)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000800)={0x20, 0x80, 0x1c, {0x401, 0x81, 0x3, 0x7, 0x582f, 0x4, 0x5, 0xd, 0x82dd, 0x3, 0x5, 0x3d}}, &(0x7f0000000840)={0x20, 0x85, 0x4, 0x6f940df}, &(0x7f0000000880)={0x20, 0x83, 0x2, 0x1}, &(0x7f00000008c0)={0x20, 0x87, 0x2, 0x6ff}, &(0x7f0000000900)={0x20, 0x89, 0x2, 0x1}})
syz_open_dev$evdev(&(0x7f00000009c0), 0x90000000, 0x202000)

program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_connect-syz_usb_control_io$uac1-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$cdc_ncm
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x5, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_connect(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000fc4c2608fd0b24019f3a010203010902240001000000000904000002c55bef000905ad1e000000000009050202"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x45, 0x6f, 0xf3, 0x8, 0x41e, 0x401d, 0x7681, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x5b, 0x29, 0xa9}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000680)={0x14, &(0x7f00000005c0)={0x20, 0x22, 0x64, {0x64, 0x2, "f2305041ff6675172103a2ae624f09d15f969cb800698e730c07976c242e808e7042c78a51cd398905aa25350039c89288f416109c4844587740903281868a1b2fec7f09ad99961e8177919afd89983b9b47986bfbd9ded7076521a019b2208795ec"}}, &(0x7f0000000640)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000940)={0x44, &(0x7f00000006c0)={0x20, 0x9, 0x9a, "f59e64600564bcd49a989cc44b9e5fcc2fc2f1a115f6a42ba196a65683a5742d19c54a423bd996902f75e8b608f0816a4b8c07a804fbfb10dec1c6e76611889eb7ff0ba8cd1c9760c8fe9af33cba9f7c5a2edff50c0d742179d49d46bdc917ad491be558c8bc0d1d388df62b83fc2f57795cb32bbcc2ae9010d7538b7c71223374d8750ca32edbf2edab0997ddb456b331fa36a8bdd8a67028c0"}, &(0x7f0000000780)={0x0, 0xa, 0x1, 0xa}, &(0x7f00000007c0)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000800)={0x20, 0x80, 0x1c, {0x401, 0x81, 0x3, 0x7, 0x582f, 0x4, 0x5, 0xd, 0x82dd, 0x3, 0x5, 0x3d}}, &(0x7f0000000840)={0x20, 0x85, 0x4, 0x6f940df}, &(0x7f0000000880)={0x20, 0x83, 0x2, 0x1}, &(0x7f00000008c0)={0x20, 0x87, 0x2, 0x6ff}, &(0x7f0000000900)={0x20, 0x89, 0x2, 0x1}})

program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_connect-syz_usb_control_io$uac1-syz_usb_connect-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x5, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_connect(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000fc4c2608fd0b24019f3a010203010902240001000000000904000002c55bef000905ad1e000000000009050202"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x45, 0x6f, 0xf3, 0x8, 0x41e, 0x401d, 0x7681, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x5b, 0x29, 0xa9}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_connect-syz_usb_control_io$uac1-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x5, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_connect(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000fc4c2608fd0b24019f3a010203010902240001000000000904000002c55bef000905ad1e000000000009050202"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x45, 0x6f, 0xf3, 0x8, 0x41e, 0x401d, 0x7681, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x5b, 0x29, 0xa9}}]}}]}}, 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_connect-syz_usb_control_io$uac1
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x5, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_connect(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000fc4c2608fd0b24019f3a010203010902240001000000000904000002c55bef000905ad1e000000000009050202"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x5, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_connect(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000fc4c2608fd0b24019f3a010203010902240001000000000904000002c55bef000905ad1e000000000009050202"], 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x5, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x0, 0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
simplifying C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
reproducing took 55m17.58363004s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-use-after-free in v4l2_fh_init+0x27d/0x2c0 drivers/media/v4l2-core/v4l2-fh.c:25
Read of size 8 at addr ffff888120d9c730 by task v4l_id/3132

CPU: 1 UID: 0 PID: 3132 Comm: v4l_id Not tainted 6.16.0-rc1-syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xcd/0x680 mm/kasan/report.c:521
 kasan_report+0xe0/0x110 mm/kasan/report.c:634
 v4l2_fh_init+0x27d/0x2c0 drivers/media/v4l2-core/v4l2-fh.c:25
 v4l2_fh_open+0x83/0xc0 drivers/media/v4l2-core/v4l2-fh.c:63
 em28xx_v4l2_open+0x24e/0x7e0 drivers/media/usb/em28xx/em28xx-video.c:2153
 v4l2_open+0x225/0x490 drivers/media/v4l2-core/v4l2-dev.c:429
 chrdev_open+0x231/0x6a0 fs/char_dev.c:414
 do_dentry_open+0x6d7/0x13a0 fs/open.c:964
 vfs_open+0x82/0x3f0 fs/open.c:1094
 do_open fs/namei.c:3887 [inline]
 path_openat+0x1de4/0x2cb0 fs/namei.c:4046
 do_filp_open+0x20b/0x470 fs/namei.c:4073
 do_sys_openat2+0x11b/0x1d0 fs/open.c:1437
 do_sys_open fs/open.c:1452 [inline]
 __do_sys_openat fs/open.c:1468 [inline]
 __se_sys_openat fs/open.c:1463 [inline]
 __x64_sys_openat+0x174/0x210 fs/open.c:1463
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f42dba63407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffcadeb0ac0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f42db975880 RCX: 00007f42dba63407
RDX: 0000000000000000 RSI: 00007ffcadeb1f25 RDI: ffffffffffffff9c
RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 00007ffcadeb0d10 R14: 00007f42dc1f9000 R15: 0000561ec45094d8
 </TASK>

Allocated by task 9:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
 __kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:394
 kmalloc_noprof include/linux/slab.h:905 [inline]
 kzalloc_noprof include/linux/slab.h:1039 [inline]
 em28xx_v4l2_init+0x114/0x40c0 drivers/media/usb/em28xx/em28xx-video.c:2532
 em28xx_init_extension+0x13a/0x200 drivers/media/usb/em28xx/em28xx-core.c:1117
 request_module_async+0x61/0x70 drivers/media/usb/em28xx/em28xx-cards.c:3457
 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3321 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
 kthread+0x3c5/0x780 kernel/kthread.c:464
 ret_from_fork+0x5b3/0x6c0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Freed by task 9:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x37/0x50 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2381 [inline]
 slab_free mm/slub.c:4643 [inline]
 kfree+0x283/0x470 mm/slub.c:4842
 em28xx_free_v4l2 drivers/media/usb/em28xx/em28xx-video.c:2118 [inline]
 kref_put include/linux/kref.h:65 [inline]
 em28xx_v4l2_init+0x22c5/0x40c0 drivers/media/usb/em28xx/em28xx-video.c:2901
 em28xx_init_extension+0x13a/0x200 drivers/media/usb/em28xx/em28xx-core.c:1117
 request_module_async+0x61/0x70 drivers/media/usb/em28xx/em28xx-cards.c:3457
 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3321 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
 kthread+0x3c5/0x780 kernel/kthread.c:464
 ret_from_fork+0x5b3/0x6c0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

The buggy address belongs to the object at ffff888120d9c000
 which belongs to the cache kmalloc-8k of size 8192
The buggy address is located 1840 bytes inside of
 freed 8192-byte region [ffff888120d9c000, ffff888120d9e000)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x120d98
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x200000000000040(head|node=0|zone=2)
page_type: f5(slab)
raw: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
head: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000
head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
head: 0200000000000003 ffffea0004836601 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 2966, tgid 2966 (kworker/0:3), ts 47454659795, free_ts 47363481208
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1c0/0x230 mm/page_alloc.c:1704
 prep_new_page mm/page_alloc.c:1712 [inline]
 get_page_from_freelist+0xf98/0x2ce0 mm/page_alloc.c:3669
 __alloc_frozen_pages_noprof+0x259/0x21e0 mm/page_alloc.c:4959
 alloc_pages_mpol+0xe4/0x410 mm/mempolicy.c:2419
 alloc_slab_page mm/slub.c:2451 [inline]
 allocate_slab mm/slub.c:2619 [inline]
 new_slab+0x23b/0x330 mm/slub.c:2673
 ___slab_alloc+0xda5/0x1940 mm/slub.c:3859
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3949
 __slab_alloc_node mm/slub.c:4024 [inline]
 slab_alloc_node mm/slub.c:4185 [inline]
 __kmalloc_cache_noprof+0x209/0x3c0 mm/slub.c:4354
 kmalloc_noprof include/linux/slab.h:905 [inline]
 kzalloc_noprof include/linux/slab.h:1039 [inline]
 em28xx_v4l2_init+0x114/0x40c0 drivers/media/usb/em28xx/em28xx-video.c:2532
 em28xx_init_extension+0x13a/0x200 drivers/media/usb/em28xx/em28xx-core.c:1117
 request_module_async+0x61/0x70 drivers/media/usb/em28xx/em28xx-cards.c:3457
 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3321 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
 kthread+0x3c5/0x780 kernel/kthread.c:464
 ret_from_fork+0x5b3/0x6c0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
page last free pid 3106 tgid 3106 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1248 [inline]
 __free_frozen_pages+0x78a/0x1040 mm/page_alloc.c:2706
 discard_slab mm/slub.c:2717 [inline]
 __put_partials+0x16d/0x1c0 mm/slub.c:3186
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x4d/0x120 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x195/0x1e0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x4e/0x70 mm/kasan/common.c:329
 kasan_slab_alloc include/linux/kasan.h:250 [inline]
 slab_post_alloc_hook mm/slub.c:4148 [inline]
 slab_alloc_node mm/slub.c:4197 [inline]
 kmem_cache_alloc_noprof+0x14f/0x3b0 mm/slub.c:4204
 getname_flags.part.0+0x4c/0x550 fs/namei.c:146
 getname_flags+0x93/0xf0 include/linux/audit.h:322
 getname include/linux/fs.h:2903 [inline]
 do_sys_openat2+0xb8/0x1d0 fs/open.c:1431
 do_sys_open fs/open.c:1452 [inline]
 __do_sys_openat fs/open.c:1468 [inline]
 __se_sys_openat fs/open.c:1463 [inline]
 __x64_sys_openat+0x174/0x210 fs/open.c:1463
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff888120d9c600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888120d9c680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888120d9c700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                     ^
 ffff888120d9c780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888120d9c800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-use-after-free in v4l2_fh_init+0x27d/0x2c0 drivers/media/v4l2-core/v4l2-fh.c:25
Read of size 8 at addr ffff888120d9c730 by task v4l_id/3132

CPU: 1 UID: 0 PID: 3132 Comm: v4l_id Not tainted 6.16.0-rc1-syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xcd/0x680 mm/kasan/report.c:521
 kasan_report+0xe0/0x110 mm/kasan/report.c:634
 v4l2_fh_init+0x27d/0x2c0 drivers/media/v4l2-core/v4l2-fh.c:25
 v4l2_fh_open+0x83/0xc0 drivers/media/v4l2-core/v4l2-fh.c:63
 em28xx_v4l2_open+0x24e/0x7e0 drivers/media/usb/em28xx/em28xx-video.c:2153
 v4l2_open+0x225/0x490 drivers/media/v4l2-core/v4l2-dev.c:429
 chrdev_open+0x231/0x6a0 fs/char_dev.c:414
 do_dentry_open+0x6d7/0x13a0 fs/open.c:964
 vfs_open+0x82/0x3f0 fs/open.c:1094
 do_open fs/namei.c:3887 [inline]
 path_openat+0x1de4/0x2cb0 fs/namei.c:4046
 do_filp_open+0x20b/0x470 fs/namei.c:4073
 do_sys_openat2+0x11b/0x1d0 fs/open.c:1437
 do_sys_open fs/open.c:1452 [inline]
 __do_sys_openat fs/open.c:1468 [inline]
 __se_sys_openat fs/open.c:1463 [inline]
 __x64_sys_openat+0x174/0x210 fs/open.c:1463
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f42dba63407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffcadeb0ac0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f42db975880 RCX: 00007f42dba63407
RDX: 0000000000000000 RSI: 00007ffcadeb1f25 RDI: ffffffffffffff9c
RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 00007ffcadeb0d10 R14: 00007f42dc1f9000 R15: 0000561ec45094d8
 </TASK>

Allocated by task 9:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
 __kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:394
 kmalloc_noprof include/linux/slab.h:905 [inline]
 kzalloc_noprof include/linux/slab.h:1039 [inline]
 em28xx_v4l2_init+0x114/0x40c0 drivers/media/usb/em28xx/em28xx-video.c:2532
 em28xx_init_extension+0x13a/0x200 drivers/media/usb/em28xx/em28xx-core.c:1117
 request_module_async+0x61/0x70 drivers/media/usb/em28xx/em28xx-cards.c:3457
 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3321 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
 kthread+0x3c5/0x780 kernel/kthread.c:464
 ret_from_fork+0x5b3/0x6c0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Freed by task 9:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x37/0x50 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2381 [inline]
 slab_free mm/slub.c:4643 [inline]
 kfree+0x283/0x470 mm/slub.c:4842
 em28xx_free_v4l2 drivers/media/usb/em28xx/em28xx-video.c:2118 [inline]
 kref_put include/linux/kref.h:65 [inline]
 em28xx_v4l2_init+0x22c5/0x40c0 drivers/media/usb/em28xx/em28xx-video.c:2901
 em28xx_init_extension+0x13a/0x200 drivers/media/usb/em28xx/em28xx-core.c:1117
 request_module_async+0x61/0x70 drivers/media/usb/em28xx/em28xx-cards.c:3457
 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3321 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
 kthread+0x3c5/0x780 kernel/kthread.c:464
 ret_from_fork+0x5b3/0x6c0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

The buggy address belongs to the object at ffff888120d9c000
 which belongs to the cache kmalloc-8k of size 8192
The buggy address is located 1840 bytes inside of
 freed 8192-byte region [ffff888120d9c000, ffff888120d9e000)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x120d98
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x200000000000040(head|node=0|zone=2)
page_type: f5(slab)
raw: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
head: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000
head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
head: 0200000000000003 ffffea0004836601 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 2966, tgid 2966 (kworker/0:3), ts 47454659795, free_ts 47363481208
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1c0/0x230 mm/page_alloc.c:1704
 prep_new_page mm/page_alloc.c:1712 [inline]
 get_page_from_freelist+0xf98/0x2ce0 mm/page_alloc.c:3669
 __alloc_frozen_pages_noprof+0x259/0x21e0 mm/page_alloc.c:4959
 alloc_pages_mpol+0xe4/0x410 mm/mempolicy.c:2419
 alloc_slab_page mm/slub.c:2451 [inline]
 allocate_slab mm/slub.c:2619 [inline]
 new_slab+0x23b/0x330 mm/slub.c:2673
 ___slab_alloc+0xda5/0x1940 mm/slub.c:3859
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3949
 __slab_alloc_node mm/slub.c:4024 [inline]
 slab_alloc_node mm/slub.c:4185 [inline]
 __kmalloc_cache_noprof+0x209/0x3c0 mm/slub.c:4354
 kmalloc_noprof include/linux/slab.h:905 [inline]
 kzalloc_noprof include/linux/slab.h:1039 [inline]
 em28xx_v4l2_init+0x114/0x40c0 drivers/media/usb/em28xx/em28xx-video.c:2532
 em28xx_init_extension+0x13a/0x200 drivers/media/usb/em28xx/em28xx-core.c:1117
 request_module_async+0x61/0x70 drivers/media/usb/em28xx/em28xx-cards.c:3457
 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3321 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
 kthread+0x3c5/0x780 kernel/kthread.c:464
 ret_from_fork+0x5b3/0x6c0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
page last free pid 3106 tgid 3106 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1248 [inline]
 __free_frozen_pages+0x78a/0x1040 mm/page_alloc.c:2706
 discard_slab mm/slub.c:2717 [inline]
 __put_partials+0x16d/0x1c0 mm/slub.c:3186
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x4d/0x120 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x195/0x1e0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x4e/0x70 mm/kasan/common.c:329
 kasan_slab_alloc include/linux/kasan.h:250 [inline]
 slab_post_alloc_hook mm/slub.c:4148 [inline]
 slab_alloc_node mm/slub.c:4197 [inline]
 kmem_cache_alloc_noprof+0x14f/0x3b0 mm/slub.c:4204
 getname_flags.part.0+0x4c/0x550 fs/namei.c:146
 getname_flags+0x93/0xf0 include/linux/audit.h:322
 getname include/linux/fs.h:2903 [inline]
 do_sys_openat2+0xb8/0x1d0 fs/open.c:1431
 do_sys_open fs/open.c:1452 [inline]
 __do_sys_openat fs/open.c:1468 [inline]
 __se_sys_openat fs/open.c:1463 [inline]
 __x64_sys_openat+0x174/0x210 fs/open.c:1463
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff888120d9c600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888120d9c680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888120d9c700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                     ^
 ffff888120d9c780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888120d9c800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================