Extracting prog: 3m10.752768203s
Minimizing prog: 43m39.902373436s
Simplifying prog options: 0s
Extracting C: 1m32.004570747s
Simplifying C: 13m13.675669479s


30 programs, timeouts [6m0s]
extracting reproducer from 30 programs
testing a last program of every proc
single: executing 5 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect$uac1-syz_usb_connect$hid-syz_usb_control_io-syz_open_dev$hiddev-syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-syz_usb_control_io$uac1-syz_usb_control_io-syz_usb_disconnect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io$uac1-syz_usb_control_io$printer-syz_usb_connect$hid-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm-syz_usb_connect$hid
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000007c0)={{0x12, 0x1, 0x0, 0xfa, 0x70, 0x10, 0x8, 0x413, 0x6023, 0xb636, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xbf, 0x0, 0x1, 0x7a, 0x9e, 0xc0, 0x0, [], [{{0x9, 0x5, 0x82}}]}}]}}]}}, 0x0)
r0 = syz_usb_connect$uac1(0x0, 0xad, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x9b, 0x3, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{}, [@extension_unit={0x9, 0x24, 0x8, 0x0, 0x0, 0x0, 'LX'}, @mixer_unit={0x6, 0x24, 0x4, 0x0, 0x0, 'R'}, @selector_unit={0x7, 0x24, 0x5, 0x0, 0x0, "53f1"}, @selector_unit={0xb, 0x24, 0x5, 0x0, 0x0, "133b9bda531c"}, @selector_unit={0x9, 0x24, 0x5, 0x0, 0x5, "96efc359"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x7f, 0x2, 0x0, 0x1, "8b7e", "8e"}, @as_header={0x7}]}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x0, 0x0, 0x0, {0x7, 0x25, 0x1, 0x81}}}}}}}]}}, 0x0)
r1 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_open_dev$hiddev(0x0, 0x0, 0x0)
r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000004200)=ANY=[@ANYBLOB="12010000e2793b10d10501200004010203010902120001000000000904"], 0x0)
syz_usb_control_io$uac1(r0, &(0x7f0000001100)={0x14, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0)
syz_usb_control_io(r0, &(0x7f00000021c0)={0x2c, 0x0, &(0x7f0000002080)={0x0, 0x3, 0x4, @lang_id={0x4}}, 0x0, 0x0, 0x0}, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_disconnect(r1)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000a40)={0x24, 0x0, 0x0, &(0x7f0000000800), &(0x7f0000000a00)={0x0, 0x21, 0x9, {0x9, 0x21, 0x1, 0x3, 0x1, {0x22, 0xb11}}}}, 0x0)
syz_usb_control_io$uac1(r0, &(0x7f00000001c0)={0x14, 0x0, 0x0}, &(0x7f00000004c0)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000380)={0x20, 0x81, 0x1, 'a'}, 0x0, 0x0, 0x0, &(0x7f0000000c80)={0x20, 0x85, 0x3, "a3bdb8"}})
syz_usb_control_io$printer(0xffffffffffffffff, &(0x7f0000000300)={0x14, &(0x7f0000000240)={0x20, 0x7, 0x5d, {0x5d, 0x10, "e90e7c97cdd8906842b7d5f1a602c0aaebb986ae5cebc058e012a11256f6f7423f89435d2ad2923431c58c28ca6ef071b6a71c7903b9d36ad6ffd6340cfc09d18b4147b7798a3ae61b74c9828214a1f296ae667f807f5057f22b16"}}, &(0x7f0000000840)={0x0, 0x3, 0x8a, @string={0x8a, 0x3, "049c86a1ffc079d3c6241adf45b51f1aed418fa6fbd6e2c7b92fd90529241657e5c65d6bc7dfdd3f69cf32d615af8d406b73a445b0dbee0fffe4f10282296b929d4bb91f1c471014526e0346dc0f859ecf0434ca1b949a48a3d0194d0413e3254a9aaecb0da42b9fee34a44ed30aa84fc8aaae3b1dfa7edf4fccacb3210aa86eb4c27cca00000000"}}}, &(0x7f0000000680)={0x34, &(0x7f00000003c0)={0x40, 0x15, 0xd5, "d7777a83a05f5d2744ae76e2f75a6e3bd65c81482f884d9a91716aaabd3ccfc3dc1ee564aed4940aae70d5069e2276ff442175ea1763bc9d5f6667d60d4e4c2c2d248868064cefb9cd03250a1d04e11f7b3298fc65b92d63e727c14c30cf3119e811642e58a65b86af306067967c310a71dc1dacf20962ee0c2c3df3590e64585c997253b91a82f93c8baa189836729b87dd01122a263e1614c2955d2e23b615e3719929b1f78836011d2e308a7e4824791f46aa9f3c5fae4209ecc1fe5c79d89c1e41e153dd29fff46e1b403d00303c746869d35e"}, &(0x7f00000002c0)={0x0, 0xa, 0x1, 0xe1}, &(0x7f0000000540)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000580)={0x20, 0x0, 0x41, {0x3f, "95cef8ecd8db625e2694efe097d55742558c36b688d0bef56abd3342722a55f685b68efe9dfc09c370fcd36e2eb138e42f344a9619e6af068d4aa3de99b1df"}}, &(0x7f0000000600)={0x20, 0x1, 0x1, 0x3}, &(0x7f00000006c0)={0x20, 0x0, 0x1, 0x6}})
syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000c40)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x10, 0x93a, 0x8003, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x7, 0x10, 0x8, [{{0x9, 0x4, 0x0, 0x8, 0x1, 0x3, 0x1, 0x0, 0x8, {0x9, 0x21, 0x9, 0x3, 0x1, {0x22, 0xd92}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x7, 0x1, 0xb4}}}}}]}}]}}, &(0x7f0000001080)={0xa, &(0x7f0000000d40)={0xa, 0x6, 0x300, 0x9, 0x2, 0x2, 0x8, 0x6}, 0x59, &(0x7f0000000d80)={0x5, 0xf, 0x59, 0x6, [@ptm_cap={0x3}, @wireless={0xb, 0x10, 0x1, 0xe, 0x8, 0x8, 0x1, 0x8, 0x1}, @wireless={0xb, 0x10, 0x1, 0x0, 0x2, 0x0, 0x77, 0xff, 0x9}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x2, "98dd4bf769b670cb6931fce56cd7b389"}, @ssp_cap={0x24, 0x10, 0xa, 0xaa, 0x6, 0x401, 0xf000, 0x7, [0x3f, 0xc00f, 0xff000f, 0x7e00, 0xff00cf, 0x3f00]}]}, 0x4, [{0x4, &(0x7f0000000e00)=@lang_id={0x4, 0x3, 0x2c09}}, {0x4, &(0x7f0000000e40)=@lang_id={0x4, 0x3, 0x1c0a}}, {0x53, &(0x7f0000000e80)=@string={0x53, 0x3, "d149d12345d47273003906303ca8d299839c9026591282c02e740bb373e8808f5b549fbae34ce0626e691c88fb9bf7790f6a342279ed4a6305e4431f495d39ba6975ed3b869b948f30c8648baf5ba8d76b"}}, {0x102, &(0x7f0000000f00)=@string={0x102, 0x3, "6886c39a76f81147430b82220419b8d202abf9c4c0c907d37d959d1c1efb4fdbe8408bee7516eec8880015068d73f815fe268b41b0812d60c6adc04b6c11b4698c16e5786ef8558b940f7899fd554dff5408453d0837b2bfb813d1952dc5ab76356cbd467382853d73738485ae9aee0aef406c2a269e9e1d120873e9f2155d3c8b2ef0e648a14aed7caaa898db1bc12c797fc0fbc4fb3b34de0f7a86e146ce5292469cad9b836e99659865b8df7a91736dc0454aaf6bdbac44ed49fe7a17856515bf87aa0e6a2656813e9525044b04ab8ff0b5fdae34ecd9cf99ead6f1ca40a900b57d8c88dad13f1f919c3bf2bfcdb027b29e27c5b2445a7a6d8d3cafd3d0ea"}}]})
syz_usb_control_io$cdc_ncm(r2, &(0x7f0000000640)={0x14, &(0x7f0000000700)={0x20, 0x11, 0xcc, {0xcc, 0xa, "7fa96646314203ad6c48589b26b4edacfcbd86d0552789b9e8548ac5c778b4e1b27b8ba7b4f1b79a0a4a6c4df3ac0f5fd5e425502b6a9bd5f7c6630a94959df28a33889a6b2c900d0fdc5f56ceda72d4fd3197c5940a246f42c9b7c3754c97f04d4ac4793c6cface90cf39e91536c135907d056a1554c04b6fd3e25227a9a27b512b8db1d3737ea3ac1b4eb0b66ab8c6ba9af252cc9c4357695936b9dfca78dda8eea51cf3ed981eb9a566a8b139c837acdf8b04c811b2346678cfbe65be36e46ed7a86f0534ea4e5ae5"}}, &(0x7f0000000340)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000cc0)={0x44, &(0x7f0000000900)={0x20, 0x13, 0xde, "aca10bb0cf02d5b6ba63ce6df0fc8367baf1ba39b5059e4fb9035f592530a0ad63d13728fa70d5b2cf8a935fd437e94d2b413a4011a6de3e172948a3a5e0850c992e47b414fe510beede1063f9541cf7d529928af603ec1c4a86da434f5ac55de1d400895cf524e34a891935efc03894c1d0a1c669ba2a8dd22208dfddc1b8c7c498ad1d4c3997a6176f5cecbb19c0b26de0c6c187e5496b5f7cfcfc5e6ca04565aab6e8efa3816413292fe5cb042f12e5f7e5624e279d279d6c163af18a9030ecd1e5c96db02701ac47b6c0d87e8448f3effa367a589d3f02c2cdebd213"}, &(0x7f0000000a80)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000ac0)={0x0, 0x8, 0x1}, &(0x7f0000000b00)={0x20, 0x80, 0x1c, {0x2, 0x7, 0x8, 0x3, 0x9, 0x101, 0x4, 0x1, 0x1ff, 0x800, 0xfc01, 0x1}}, &(0x7f0000000b40)={0x20, 0x85, 0x4, 0x37}, &(0x7f0000000b80)={0x20, 0x83, 0x2, 0x1}, &(0x7f0000000bc0)={0x20, 0x87, 0x2, 0xe}, &(0x7f0000000c00)={0x20, 0x89, 0x2}})
syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0)
syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x5ac, 0x232, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x3, 0x40, 0xf9, [{{0x9, 0x4, 0x0, 0x2, 0x2, 0x3, 0x1, 0x4, 0xd2, {0x9, 0x21, 0xf, 0x4, 0x1, {0x22, 0x1ba}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x9, 0x1, 0x8b}}}}}]}}]}}, &(0x7f0000000200)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x310, 0x0, 0x4, 0x8e, 0x8, 0x2}, 0xc, &(0x7f0000000080)={0x5, 0xf, 0xc, 0x1, [@ext_cap={0x7, 0x10, 0x2, 0x2, 0x2, 0x7, 0x2}]}, 0x1, [{0x58, &(0x7f00000000c0)=@string={0x58, 0x3, "d64f657e2dd8d4f7723a3efed1620ddb8e1376fd2d9f443c54c729055cb07bb0999a5ebdf9b8811792775b47498883a4ce8e17dd59d6762a1cf5c4de2e80fc4494c47cc2219c2234d9e52e4f6d18dd8d9cbf6aa8b5a9"}}]})

program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
single: successfully extracted reproducer
found reproducer with 19 syscalls
minimizing guilty program
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect$uac1-syz_usb_connect$hid-syz_usb_control_io-syz_open_dev$hiddev-syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-syz_usb_control_io$uac1-syz_usb_control_io-syz_usb_disconnect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io$uac1-syz_usb_control_io$printer-syz_usb_connect$hid-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000007c0)={{0x12, 0x1, 0x0, 0xfa, 0x70, 0x10, 0x8, 0x413, 0x6023, 0xb636, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xbf, 0x0, 0x1, 0x7a, 0x9e, 0xc0, 0x0, [], [{{0x9, 0x5, 0x82}}]}}]}}]}}, 0x0)
r0 = syz_usb_connect$uac1(0x0, 0xad, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x9b, 0x3, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{}, [@extension_unit={0x9, 0x24, 0x8, 0x0, 0x0, 0x0, 'LX'}, @mixer_unit={0x6, 0x24, 0x4, 0x0, 0x0, 'R'}, @selector_unit={0x7, 0x24, 0x5, 0x0, 0x0, "53f1"}, @selector_unit={0xb, 0x24, 0x5, 0x0, 0x0, "133b9bda531c"}, @selector_unit={0x9, 0x24, 0x5, 0x0, 0x5, "96efc359"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x7f, 0x2, 0x0, 0x1, "8b7e", "8e"}, @as_header={0x7}]}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x0, 0x0, 0x0, {0x7, 0x25, 0x1, 0x81}}}}}}}]}}, 0x0)
r1 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_open_dev$hiddev(0x0, 0x0, 0x0)
r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000004200)=ANY=[@ANYBLOB="12010000e2793b10d10501200004010203010902120001000000000904"], 0x0)
syz_usb_control_io$uac1(r0, &(0x7f0000001100)={0x14, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0)
syz_usb_control_io(r0, &(0x7f00000021c0)={0x2c, 0x0, &(0x7f0000002080)={0x0, 0x3, 0x4, @lang_id={0x4}}, 0x0, 0x0, 0x0}, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_disconnect(r1)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000a40)={0x24, 0x0, 0x0, &(0x7f0000000800), &(0x7f0000000a00)={0x0, 0x21, 0x9, {0x9, 0x21, 0x1, 0x3, 0x1, {0x22, 0xb11}}}}, 0x0)
syz_usb_control_io$uac1(r0, &(0x7f00000001c0)={0x14, 0x0, 0x0}, &(0x7f00000004c0)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000380)={0x20, 0x81, 0x1, 'a'}, 0x0, 0x0, 0x0, &(0x7f0000000c80)={0x20, 0x85, 0x3, "a3bdb8"}})
syz_usb_control_io$printer(0xffffffffffffffff, &(0x7f0000000300)={0x14, &(0x7f0000000240)={0x20, 0x7, 0x5d, {0x5d, 0x10, "e90e7c97cdd8906842b7d5f1a602c0aaebb986ae5cebc058e012a11256f6f7423f89435d2ad2923431c58c28ca6ef071b6a71c7903b9d36ad6ffd6340cfc09d18b4147b7798a3ae61b74c9828214a1f296ae667f807f5057f22b16"}}, &(0x7f0000000840)={0x0, 0x3, 0x8a, @string={0x8a, 0x3, "049c86a1ffc079d3c6241adf45b51f1aed418fa6fbd6e2c7b92fd90529241657e5c65d6bc7dfdd3f69cf32d615af8d406b73a445b0dbee0fffe4f10282296b929d4bb91f1c471014526e0346dc0f859ecf0434ca1b949a48a3d0194d0413e3254a9aaecb0da42b9fee34a44ed30aa84fc8aaae3b1dfa7edf4fccacb3210aa86eb4c27cca00000000"}}}, &(0x7f0000000680)={0x34, &(0x7f00000003c0)={0x40, 0x15, 0xd5, "d7777a83a05f5d2744ae76e2f75a6e3bd65c81482f884d9a91716aaabd3ccfc3dc1ee564aed4940aae70d5069e2276ff442175ea1763bc9d5f6667d60d4e4c2c2d248868064cefb9cd03250a1d04e11f7b3298fc65b92d63e727c14c30cf3119e811642e58a65b86af306067967c310a71dc1dacf20962ee0c2c3df3590e64585c997253b91a82f93c8baa189836729b87dd01122a263e1614c2955d2e23b615e3719929b1f78836011d2e308a7e4824791f46aa9f3c5fae4209ecc1fe5c79d89c1e41e153dd29fff46e1b403d00303c746869d35e"}, &(0x7f00000002c0)={0x0, 0xa, 0x1, 0xe1}, &(0x7f0000000540)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000580)={0x20, 0x0, 0x41, {0x3f, "95cef8ecd8db625e2694efe097d55742558c36b688d0bef56abd3342722a55f685b68efe9dfc09c370fcd36e2eb138e42f344a9619e6af068d4aa3de99b1df"}}, &(0x7f0000000600)={0x20, 0x1, 0x1, 0x3}, &(0x7f00000006c0)={0x20, 0x0, 0x1, 0x6}})
syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000c40)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x10, 0x93a, 0x8003, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x7, 0x10, 0x8, [{{0x9, 0x4, 0x0, 0x8, 0x1, 0x3, 0x1, 0x0, 0x8, {0x9, 0x21, 0x9, 0x3, 0x1, {0x22, 0xd92}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x7, 0x1, 0xb4}}}}}]}}]}}, &(0x7f0000001080)={0xa, &(0x7f0000000d40)={0xa, 0x6, 0x300, 0x9, 0x2, 0x2, 0x8, 0x6}, 0x59, &(0x7f0000000d80)={0x5, 0xf, 0x59, 0x6, [@ptm_cap={0x3}, @wireless={0xb, 0x10, 0x1, 0xe, 0x8, 0x8, 0x1, 0x8, 0x1}, @wireless={0xb, 0x10, 0x1, 0x0, 0x2, 0x0, 0x77, 0xff, 0x9}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x2, "98dd4bf769b670cb6931fce56cd7b389"}, @ssp_cap={0x24, 0x10, 0xa, 0xaa, 0x6, 0x401, 0xf000, 0x7, [0x3f, 0xc00f, 0xff000f, 0x7e00, 0xff00cf, 0x3f00]}]}, 0x4, [{0x4, &(0x7f0000000e00)=@lang_id={0x4, 0x3, 0x2c09}}, {0x4, &(0x7f0000000e40)=@lang_id={0x4, 0x3, 0x1c0a}}, {0x53, &(0x7f0000000e80)=@string={0x53, 0x3, "d149d12345d47273003906303ca8d299839c9026591282c02e740bb373e8808f5b549fbae34ce0626e691c88fb9bf7790f6a342279ed4a6305e4431f495d39ba6975ed3b869b948f30c8648baf5ba8d76b"}}, {0x102, &(0x7f0000000f00)=@string={0x102, 0x3, "6886c39a76f81147430b82220419b8d202abf9c4c0c907d37d959d1c1efb4fdbe8408bee7516eec8880015068d73f815fe268b41b0812d60c6adc04b6c11b4698c16e5786ef8558b940f7899fd554dff5408453d0837b2bfb813d1952dc5ab76356cbd467382853d73738485ae9aee0aef406c2a269e9e1d120873e9f2155d3c8b2ef0e648a14aed7caaa898db1bc12c797fc0fbc4fb3b34de0f7a86e146ce5292469cad9b836e99659865b8df7a91736dc0454aaf6bdbac44ed49fe7a17856515bf87aa0e6a2656813e9525044b04ab8ff0b5fdae34ecd9cf99ead6f1ca40a900b57d8c88dad13f1f919c3bf2bfcdb027b29e27c5b2445a7a6d8d3cafd3d0ea"}}]})
syz_usb_control_io$cdc_ncm(r2, &(0x7f0000000640)={0x14, &(0x7f0000000700)={0x20, 0x11, 0xcc, {0xcc, 0xa, "7fa96646314203ad6c48589b26b4edacfcbd86d0552789b9e8548ac5c778b4e1b27b8ba7b4f1b79a0a4a6c4df3ac0f5fd5e425502b6a9bd5f7c6630a94959df28a33889a6b2c900d0fdc5f56ceda72d4fd3197c5940a246f42c9b7c3754c97f04d4ac4793c6cface90cf39e91536c135907d056a1554c04b6fd3e25227a9a27b512b8db1d3737ea3ac1b4eb0b66ab8c6ba9af252cc9c4357695936b9dfca78dda8eea51cf3ed981eb9a566a8b139c837acdf8b04c811b2346678cfbe65be36e46ed7a86f0534ea4e5ae5"}}, &(0x7f0000000340)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000cc0)={0x44, &(0x7f0000000900)={0x20, 0x13, 0xde, "aca10bb0cf02d5b6ba63ce6df0fc8367baf1ba39b5059e4fb9035f592530a0ad63d13728fa70d5b2cf8a935fd437e94d2b413a4011a6de3e172948a3a5e0850c992e47b414fe510beede1063f9541cf7d529928af603ec1c4a86da434f5ac55de1d400895cf524e34a891935efc03894c1d0a1c669ba2a8dd22208dfddc1b8c7c498ad1d4c3997a6176f5cecbb19c0b26de0c6c187e5496b5f7cfcfc5e6ca04565aab6e8efa3816413292fe5cb042f12e5f7e5624e279d279d6c163af18a9030ecd1e5c96db02701ac47b6c0d87e8448f3effa367a589d3f02c2cdebd213"}, &(0x7f0000000a80)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000ac0)={0x0, 0x8, 0x1}, &(0x7f0000000b00)={0x20, 0x80, 0x1c, {0x2, 0x7, 0x8, 0x3, 0x9, 0x101, 0x4, 0x1, 0x1ff, 0x800, 0xfc01, 0x1}}, &(0x7f0000000b40)={0x20, 0x85, 0x4, 0x37}, &(0x7f0000000b80)={0x20, 0x83, 0x2, 0x1}, &(0x7f0000000bc0)={0x20, 0x87, 0x2, 0xe}, &(0x7f0000000c00)={0x20, 0x89, 0x2}})
syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect$uac1-syz_usb_connect$hid-syz_usb_control_io-syz_open_dev$hiddev-syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-syz_usb_control_io$uac1-syz_usb_control_io-syz_usb_disconnect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io$uac1-syz_usb_control_io$printer-syz_usb_connect$hid-syz_usb_control_io$cdc_ncm
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000007c0)={{0x12, 0x1, 0x0, 0xfa, 0x70, 0x10, 0x8, 0x413, 0x6023, 0xb636, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xbf, 0x0, 0x1, 0x7a, 0x9e, 0xc0, 0x0, [], [{{0x9, 0x5, 0x82}}]}}]}}]}}, 0x0)
r0 = syz_usb_connect$uac1(0x0, 0xad, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x9b, 0x3, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{}, [@extension_unit={0x9, 0x24, 0x8, 0x0, 0x0, 0x0, 'LX'}, @mixer_unit={0x6, 0x24, 0x4, 0x0, 0x0, 'R'}, @selector_unit={0x7, 0x24, 0x5, 0x0, 0x0, "53f1"}, @selector_unit={0xb, 0x24, 0x5, 0x0, 0x0, "133b9bda531c"}, @selector_unit={0x9, 0x24, 0x5, 0x0, 0x5, "96efc359"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x7f, 0x2, 0x0, 0x1, "8b7e", "8e"}, @as_header={0x7}]}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x0, 0x0, 0x0, {0x7, 0x25, 0x1, 0x81}}}}}}}]}}, 0x0)
r1 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_open_dev$hiddev(0x0, 0x0, 0x0)
r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000004200)=ANY=[@ANYBLOB="12010000e2793b10d10501200004010203010902120001000000000904"], 0x0)
syz_usb_control_io$uac1(r0, &(0x7f0000001100)={0x14, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0)
syz_usb_control_io(r0, &(0x7f00000021c0)={0x2c, 0x0, &(0x7f0000002080)={0x0, 0x3, 0x4, @lang_id={0x4}}, 0x0, 0x0, 0x0}, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_disconnect(r1)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000a40)={0x24, 0x0, 0x0, &(0x7f0000000800), &(0x7f0000000a00)={0x0, 0x21, 0x9, {0x9, 0x21, 0x1, 0x3, 0x1, {0x22, 0xb11}}}}, 0x0)
syz_usb_control_io$uac1(r0, &(0x7f00000001c0)={0x14, 0x0, 0x0}, &(0x7f00000004c0)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000380)={0x20, 0x81, 0x1, 'a'}, 0x0, 0x0, 0x0, &(0x7f0000000c80)={0x20, 0x85, 0x3, "a3bdb8"}})
syz_usb_control_io$printer(0xffffffffffffffff, &(0x7f0000000300)={0x14, &(0x7f0000000240)={0x20, 0x7, 0x5d, {0x5d, 0x10, "e90e7c97cdd8906842b7d5f1a602c0aaebb986ae5cebc058e012a11256f6f7423f89435d2ad2923431c58c28ca6ef071b6a71c7903b9d36ad6ffd6340cfc09d18b4147b7798a3ae61b74c9828214a1f296ae667f807f5057f22b16"}}, &(0x7f0000000840)={0x0, 0x3, 0x8a, @string={0x8a, 0x3, "049c86a1ffc079d3c6241adf45b51f1aed418fa6fbd6e2c7b92fd90529241657e5c65d6bc7dfdd3f69cf32d615af8d406b73a445b0dbee0fffe4f10282296b929d4bb91f1c471014526e0346dc0f859ecf0434ca1b949a48a3d0194d0413e3254a9aaecb0da42b9fee34a44ed30aa84fc8aaae3b1dfa7edf4fccacb3210aa86eb4c27cca00000000"}}}, &(0x7f0000000680)={0x34, &(0x7f00000003c0)={0x40, 0x15, 0xd5, "d7777a83a05f5d2744ae76e2f75a6e3bd65c81482f884d9a91716aaabd3ccfc3dc1ee564aed4940aae70d5069e2276ff442175ea1763bc9d5f6667d60d4e4c2c2d248868064cefb9cd03250a1d04e11f7b3298fc65b92d63e727c14c30cf3119e811642e58a65b86af306067967c310a71dc1dacf20962ee0c2c3df3590e64585c997253b91a82f93c8baa189836729b87dd01122a263e1614c2955d2e23b615e3719929b1f78836011d2e308a7e4824791f46aa9f3c5fae4209ecc1fe5c79d89c1e41e153dd29fff46e1b403d00303c746869d35e"}, &(0x7f00000002c0)={0x0, 0xa, 0x1, 0xe1}, &(0x7f0000000540)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000580)={0x20, 0x0, 0x41, {0x3f, "95cef8ecd8db625e2694efe097d55742558c36b688d0bef56abd3342722a55f685b68efe9dfc09c370fcd36e2eb138e42f344a9619e6af068d4aa3de99b1df"}}, &(0x7f0000000600)={0x20, 0x1, 0x1, 0x3}, &(0x7f00000006c0)={0x20, 0x0, 0x1, 0x6}})
syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000c40)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x10, 0x93a, 0x8003, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x7, 0x10, 0x8, [{{0x9, 0x4, 0x0, 0x8, 0x1, 0x3, 0x1, 0x0, 0x8, {0x9, 0x21, 0x9, 0x3, 0x1, {0x22, 0xd92}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x7, 0x1, 0xb4}}}}}]}}]}}, &(0x7f0000001080)={0xa, &(0x7f0000000d40)={0xa, 0x6, 0x300, 0x9, 0x2, 0x2, 0x8, 0x6}, 0x59, &(0x7f0000000d80)={0x5, 0xf, 0x59, 0x6, [@ptm_cap={0x3}, @wireless={0xb, 0x10, 0x1, 0xe, 0x8, 0x8, 0x1, 0x8, 0x1}, @wireless={0xb, 0x10, 0x1, 0x0, 0x2, 0x0, 0x77, 0xff, 0x9}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x2, "98dd4bf769b670cb6931fce56cd7b389"}, @ssp_cap={0x24, 0x10, 0xa, 0xaa, 0x6, 0x401, 0xf000, 0x7, [0x3f, 0xc00f, 0xff000f, 0x7e00, 0xff00cf, 0x3f00]}]}, 0x4, [{0x4, &(0x7f0000000e00)=@lang_id={0x4, 0x3, 0x2c09}}, {0x4, &(0x7f0000000e40)=@lang_id={0x4, 0x3, 0x1c0a}}, {0x53, &(0x7f0000000e80)=@string={0x53, 0x3, "d149d12345d47273003906303ca8d299839c9026591282c02e740bb373e8808f5b549fbae34ce0626e691c88fb9bf7790f6a342279ed4a6305e4431f495d39ba6975ed3b869b948f30c8648baf5ba8d76b"}}, {0x102, &(0x7f0000000f00)=@string={0x102, 0x3, "6886c39a76f81147430b82220419b8d202abf9c4c0c907d37d959d1c1efb4fdbe8408bee7516eec8880015068d73f815fe268b41b0812d60c6adc04b6c11b4698c16e5786ef8558b940f7899fd554dff5408453d0837b2bfb813d1952dc5ab76356cbd467382853d73738485ae9aee0aef406c2a269e9e1d120873e9f2155d3c8b2ef0e648a14aed7caaa898db1bc12c797fc0fbc4fb3b34de0f7a86e146ce5292469cad9b836e99659865b8df7a91736dc0454aaf6bdbac44ed49fe7a17856515bf87aa0e6a2656813e9525044b04ab8ff0b5fdae34ecd9cf99ead6f1ca40a900b57d8c88dad13f1f919c3bf2bfcdb027b29e27c5b2445a7a6d8d3cafd3d0ea"}}]})
syz_usb_control_io$cdc_ncm(r2, &(0x7f0000000640)={0x14, &(0x7f0000000700)={0x20, 0x11, 0xcc, {0xcc, 0xa, "7fa96646314203ad6c48589b26b4edacfcbd86d0552789b9e8548ac5c778b4e1b27b8ba7b4f1b79a0a4a6c4df3ac0f5fd5e425502b6a9bd5f7c6630a94959df28a33889a6b2c900d0fdc5f56ceda72d4fd3197c5940a246f42c9b7c3754c97f04d4ac4793c6cface90cf39e91536c135907d056a1554c04b6fd3e25227a9a27b512b8db1d3737ea3ac1b4eb0b66ab8c6ba9af252cc9c4357695936b9dfca78dda8eea51cf3ed981eb9a566a8b139c837acdf8b04c811b2346678cfbe65be36e46ed7a86f0534ea4e5ae5"}}, &(0x7f0000000340)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000cc0)={0x44, &(0x7f0000000900)={0x20, 0x13, 0xde, "aca10bb0cf02d5b6ba63ce6df0fc8367baf1ba39b5059e4fb9035f592530a0ad63d13728fa70d5b2cf8a935fd437e94d2b413a4011a6de3e172948a3a5e0850c992e47b414fe510beede1063f9541cf7d529928af603ec1c4a86da434f5ac55de1d400895cf524e34a891935efc03894c1d0a1c669ba2a8dd22208dfddc1b8c7c498ad1d4c3997a6176f5cecbb19c0b26de0c6c187e5496b5f7cfcfc5e6ca04565aab6e8efa3816413292fe5cb042f12e5f7e5624e279d279d6c163af18a9030ecd1e5c96db02701ac47b6c0d87e8448f3effa367a589d3f02c2cdebd213"}, &(0x7f0000000a80)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000ac0)={0x0, 0x8, 0x1}, &(0x7f0000000b00)={0x20, 0x80, 0x1c, {0x2, 0x7, 0x8, 0x3, 0x9, 0x101, 0x4, 0x1, 0x1ff, 0x800, 0xfc01, 0x1}}, &(0x7f0000000b40)={0x20, 0x85, 0x4, 0x37}, &(0x7f0000000b80)={0x20, 0x83, 0x2, 0x1}, &(0x7f0000000bc0)={0x20, 0x87, 0x2, 0xe}, &(0x7f0000000c00)={0x20, 0x89, 0x2}})

program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect$uac1-syz_usb_connect$hid-syz_usb_control_io-syz_open_dev$hiddev-syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-syz_usb_control_io$uac1-syz_usb_control_io-syz_usb_disconnect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io$uac1-syz_usb_control_io$printer-syz_usb_connect$hid
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000007c0)={{0x12, 0x1, 0x0, 0xfa, 0x70, 0x10, 0x8, 0x413, 0x6023, 0xb636, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xbf, 0x0, 0x1, 0x7a, 0x9e, 0xc0, 0x0, [], [{{0x9, 0x5, 0x82}}]}}]}}]}}, 0x0)
r0 = syz_usb_connect$uac1(0x0, 0xad, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x9b, 0x3, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{}, [@extension_unit={0x9, 0x24, 0x8, 0x0, 0x0, 0x0, 'LX'}, @mixer_unit={0x6, 0x24, 0x4, 0x0, 0x0, 'R'}, @selector_unit={0x7, 0x24, 0x5, 0x0, 0x0, "53f1"}, @selector_unit={0xb, 0x24, 0x5, 0x0, 0x0, "133b9bda531c"}, @selector_unit={0x9, 0x24, 0x5, 0x0, 0x5, "96efc359"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x7f, 0x2, 0x0, 0x1, "8b7e", "8e"}, @as_header={0x7}]}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x0, 0x0, 0x0, {0x7, 0x25, 0x1, 0x81}}}}}}}]}}, 0x0)
r1 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_open_dev$hiddev(0x0, 0x0, 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f0000004200)=ANY=[@ANYBLOB="12010000e2793b10d10501200004010203010902120001000000000904"], 0x0)
syz_usb_control_io$uac1(r0, &(0x7f0000001100)={0x14, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0)
syz_usb_control_io(r0, &(0x7f00000021c0)={0x2c, 0x0, &(0x7f0000002080)={0x0, 0x3, 0x4, @lang_id={0x4}}, 0x0, 0x0, 0x0}, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_disconnect(r1)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000a40)={0x24, 0x0, 0x0, &(0x7f0000000800), &(0x7f0000000a00)={0x0, 0x21, 0x9, {0x9, 0x21, 0x1, 0x3, 0x1, {0x22, 0xb11}}}}, 0x0)
syz_usb_control_io$uac1(r0, &(0x7f00000001c0)={0x14, 0x0, 0x0}, &(0x7f00000004c0)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000380)={0x20, 0x81, 0x1, 'a'}, 0x0, 0x0, 0x0, &(0x7f0000000c80)={0x20, 0x85, 0x3, "a3bdb8"}})
syz_usb_control_io$printer(0xffffffffffffffff, &(0x7f0000000300)={0x14, &(0x7f0000000240)={0x20, 0x7, 0x5d, {0x5d, 0x10, "e90e7c97cdd8906842b7d5f1a602c0aaebb986ae5cebc058e012a11256f6f7423f89435d2ad2923431c58c28ca6ef071b6a71c7903b9d36ad6ffd6340cfc09d18b4147b7798a3ae61b74c9828214a1f296ae667f807f5057f22b16"}}, &(0x7f0000000840)={0x0, 0x3, 0x8a, @string={0x8a, 0x3, "049c86a1ffc079d3c6241adf45b51f1aed418fa6fbd6e2c7b92fd90529241657e5c65d6bc7dfdd3f69cf32d615af8d406b73a445b0dbee0fffe4f10282296b929d4bb91f1c471014526e0346dc0f859ecf0434ca1b949a48a3d0194d0413e3254a9aaecb0da42b9fee34a44ed30aa84fc8aaae3b1dfa7edf4fccacb3210aa86eb4c27cca00000000"}}}, &(0x7f0000000680)={0x34, &(0x7f00000003c0)={0x40, 0x15, 0xd5, "d7777a83a05f5d2744ae76e2f75a6e3bd65c81482f884d9a91716aaabd3ccfc3dc1ee564aed4940aae70d5069e2276ff442175ea1763bc9d5f6667d60d4e4c2c2d248868064cefb9cd03250a1d04e11f7b3298fc65b92d63e727c14c30cf3119e811642e58a65b86af306067967c310a71dc1dacf20962ee0c2c3df3590e64585c997253b91a82f93c8baa189836729b87dd01122a263e1614c2955d2e23b615e3719929b1f78836011d2e308a7e4824791f46aa9f3c5fae4209ecc1fe5c79d89c1e41e153dd29fff46e1b403d00303c746869d35e"}, &(0x7f00000002c0)={0x0, 0xa, 0x1, 0xe1}, &(0x7f0000000540)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000580)={0x20, 0x0, 0x41, {0x3f, "95cef8ecd8db625e2694efe097d55742558c36b688d0bef56abd3342722a55f685b68efe9dfc09c370fcd36e2eb138e42f344a9619e6af068d4aa3de99b1df"}}, &(0x7f0000000600)={0x20, 0x1, 0x1, 0x3}, &(0x7f00000006c0)={0x20, 0x0, 0x1, 0x6}})
syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000c40)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x10, 0x93a, 0x8003, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x7, 0x10, 0x8, [{{0x9, 0x4, 0x0, 0x8, 0x1, 0x3, 0x1, 0x0, 0x8, {0x9, 0x21, 0x9, 0x3, 0x1, {0x22, 0xd92}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x7, 0x1, 0xb4}}}}}]}}]}}, &(0x7f0000001080)={0xa, &(0x7f0000000d40)={0xa, 0x6, 0x300, 0x9, 0x2, 0x2, 0x8, 0x6}, 0x59, &(0x7f0000000d80)={0x5, 0xf, 0x59, 0x6, [@ptm_cap={0x3}, @wireless={0xb, 0x10, 0x1, 0xe, 0x8, 0x8, 0x1, 0x8, 0x1}, @wireless={0xb, 0x10, 0x1, 0x0, 0x2, 0x0, 0x77, 0xff, 0x9}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x2, "98dd4bf769b670cb6931fce56cd7b389"}, @ssp_cap={0x24, 0x10, 0xa, 0xaa, 0x6, 0x401, 0xf000, 0x7, [0x3f, 0xc00f, 0xff000f, 0x7e00, 0xff00cf, 0x3f00]}]}, 0x4, [{0x4, &(0x7f0000000e00)=@lang_id={0x4, 0x3, 0x2c09}}, {0x4, &(0x7f0000000e40)=@lang_id={0x4, 0x3, 0x1c0a}}, {0x53, &(0x7f0000000e80)=@string={0x53, 0x3, "d149d12345d47273003906303ca8d299839c9026591282c02e740bb373e8808f5b549fbae34ce0626e691c88fb9bf7790f6a342279ed4a6305e4431f495d39ba6975ed3b869b948f30c8648baf5ba8d76b"}}, {0x102, &(0x7f0000000f00)=@string={0x102, 0x3, "6886c39a76f81147430b82220419b8d202abf9c4c0c907d37d959d1c1efb4fdbe8408bee7516eec8880015068d73f815fe268b41b0812d60c6adc04b6c11b4698c16e5786ef8558b940f7899fd554dff5408453d0837b2bfb813d1952dc5ab76356cbd467382853d73738485ae9aee0aef406c2a269e9e1d120873e9f2155d3c8b2ef0e648a14aed7caaa898db1bc12c797fc0fbc4fb3b34de0f7a86e146ce5292469cad9b836e99659865b8df7a91736dc0454aaf6bdbac44ed49fe7a17856515bf87aa0e6a2656813e9525044b04ab8ff0b5fdae34ecd9cf99ead6f1ca40a900b57d8c88dad13f1f919c3bf2bfcdb027b29e27c5b2445a7a6d8d3cafd3d0ea"}}]})

program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect$uac1-syz_usb_connect$hid-syz_usb_control_io-syz_open_dev$hiddev-syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-syz_usb_control_io$uac1-syz_usb_control_io-syz_usb_disconnect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io$uac1-syz_usb_control_io$printer
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000007c0)={{0x12, 0x1, 0x0, 0xfa, 0x70, 0x10, 0x8, 0x413, 0x6023, 0xb636, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xbf, 0x0, 0x1, 0x7a, 0x9e, 0xc0, 0x0, [], [{{0x9, 0x5, 0x82}}]}}]}}]}}, 0x0)
r0 = syz_usb_connect$uac1(0x0, 0xad, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x9b, 0x3, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{}, [@extension_unit={0x9, 0x24, 0x8, 0x0, 0x0, 0x0, 'LX'}, @mixer_unit={0x6, 0x24, 0x4, 0x0, 0x0, 'R'}, @selector_unit={0x7, 0x24, 0x5, 0x0, 0x0, "53f1"}, @selector_unit={0xb, 0x24, 0x5, 0x0, 0x0, "133b9bda531c"}, @selector_unit={0x9, 0x24, 0x5, 0x0, 0x5, "96efc359"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x7f, 0x2, 0x0, 0x1, "8b7e", "8e"}, @as_header={0x7}]}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x0, 0x0, 0x0, {0x7, 0x25, 0x1, 0x81}}}}}}}]}}, 0x0)
r1 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_open_dev$hiddev(0x0, 0x0, 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f0000004200)=ANY=[@ANYBLOB="12010000e2793b10d10501200004010203010902120001000000000904"], 0x0)
syz_usb_control_io$uac1(r0, &(0x7f0000001100)={0x14, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0)
syz_usb_control_io(r0, &(0x7f00000021c0)={0x2c, 0x0, &(0x7f0000002080)={0x0, 0x3, 0x4, @lang_id={0x4}}, 0x0, 0x0, 0x0}, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_disconnect(r1)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000a40)={0x24, 0x0, 0x0, &(0x7f0000000800), &(0x7f0000000a00)={0x0, 0x21, 0x9, {0x9, 0x21, 0x1, 0x3, 0x1, {0x22, 0xb11}}}}, 0x0)
syz_usb_control_io$uac1(r0, &(0x7f00000001c0)={0x14, 0x0, 0x0}, &(0x7f00000004c0)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000380)={0x20, 0x81, 0x1, 'a'}, 0x0, 0x0, 0x0, &(0x7f0000000c80)={0x20, 0x85, 0x3, "a3bdb8"}})
syz_usb_control_io$printer(0xffffffffffffffff, &(0x7f0000000300)={0x14, &(0x7f0000000240)={0x20, 0x7, 0x5d, {0x5d, 0x10, "e90e7c97cdd8906842b7d5f1a602c0aaebb986ae5cebc058e012a11256f6f7423f89435d2ad2923431c58c28ca6ef071b6a71c7903b9d36ad6ffd6340cfc09d18b4147b7798a3ae61b74c9828214a1f296ae667f807f5057f22b16"}}, &(0x7f0000000840)={0x0, 0x3, 0x8a, @string={0x8a, 0x3, "049c86a1ffc079d3c6241adf45b51f1aed418fa6fbd6e2c7b92fd90529241657e5c65d6bc7dfdd3f69cf32d615af8d406b73a445b0dbee0fffe4f10282296b929d4bb91f1c471014526e0346dc0f859ecf0434ca1b949a48a3d0194d0413e3254a9aaecb0da42b9fee34a44ed30aa84fc8aaae3b1dfa7edf4fccacb3210aa86eb4c27cca00000000"}}}, &(0x7f0000000680)={0x34, &(0x7f00000003c0)={0x40, 0x15, 0xd5, "d7777a83a05f5d2744ae76e2f75a6e3bd65c81482f884d9a91716aaabd3ccfc3dc1ee564aed4940aae70d5069e2276ff442175ea1763bc9d5f6667d60d4e4c2c2d248868064cefb9cd03250a1d04e11f7b3298fc65b92d63e727c14c30cf3119e811642e58a65b86af306067967c310a71dc1dacf20962ee0c2c3df3590e64585c997253b91a82f93c8baa189836729b87dd01122a263e1614c2955d2e23b615e3719929b1f78836011d2e308a7e4824791f46aa9f3c5fae4209ecc1fe5c79d89c1e41e153dd29fff46e1b403d00303c746869d35e"}, &(0x7f00000002c0)={0x0, 0xa, 0x1, 0xe1}, &(0x7f0000000540)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000580)={0x20, 0x0, 0x41, {0x3f, "95cef8ecd8db625e2694efe097d55742558c36b688d0bef56abd3342722a55f685b68efe9dfc09c370fcd36e2eb138e42f344a9619e6af068d4aa3de99b1df"}}, &(0x7f0000000600)={0x20, 0x1, 0x1, 0x3}, &(0x7f00000006c0)={0x20, 0x0, 0x1, 0x6}})

program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect$uac1-syz_usb_connect$hid-syz_usb_control_io-syz_open_dev$hiddev-syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-syz_usb_control_io$uac1-syz_usb_control_io-syz_usb_disconnect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io$uac1
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000007c0)={{0x12, 0x1, 0x0, 0xfa, 0x70, 0x10, 0x8, 0x413, 0x6023, 0xb636, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xbf, 0x0, 0x1, 0x7a, 0x9e, 0xc0, 0x0, [], [{{0x9, 0x5, 0x82}}]}}]}}]}}, 0x0)
r0 = syz_usb_connect$uac1(0x0, 0xad, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x9b, 0x3, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{}, [@extension_unit={0x9, 0x24, 0x8, 0x0, 0x0, 0x0, 'LX'}, @mixer_unit={0x6, 0x24, 0x4, 0x0, 0x0, 'R'}, @selector_unit={0x7, 0x24, 0x5, 0x0, 0x0, "53f1"}, @selector_unit={0xb, 0x24, 0x5, 0x0, 0x0, "133b9bda531c"}, @selector_unit={0x9, 0x24, 0x5, 0x0, 0x5, "96efc359"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x7f, 0x2, 0x0, 0x1, "8b7e", "8e"}, @as_header={0x7}]}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x0, 0x0, 0x0, {0x7, 0x25, 0x1, 0x81}}}}}}}]}}, 0x0)
r1 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_open_dev$hiddev(0x0, 0x0, 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f0000004200)=ANY=[@ANYBLOB="12010000e2793b10d10501200004010203010902120001000000000904"], 0x0)
syz_usb_control_io$uac1(r0, &(0x7f0000001100)={0x14, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0)
syz_usb_control_io(r0, &(0x7f00000021c0)={0x2c, 0x0, &(0x7f0000002080)={0x0, 0x3, 0x4, @lang_id={0x4}}, 0x0, 0x0, 0x0}, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_disconnect(r1)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000a40)={0x24, 0x0, 0x0, &(0x7f0000000800), &(0x7f0000000a00)={0x0, 0x21, 0x9, {0x9, 0x21, 0x1, 0x3, 0x1, {0x22, 0xb11}}}}, 0x0)
syz_usb_control_io$uac1(r0, &(0x7f00000001c0)={0x14, 0x0, 0x0}, &(0x7f00000004c0)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000380)={0x20, 0x81, 0x1, 'a'}, 0x0, 0x0, 0x0, &(0x7f0000000c80)={0x20, 0x85, 0x3, "a3bdb8"}})

program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect$uac1-syz_usb_connect$hid-syz_usb_control_io-syz_open_dev$hiddev-syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-syz_usb_control_io$uac1-syz_usb_control_io-syz_usb_disconnect-syz_usb_control_io-syz_usb_control_io$hid
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000007c0)={{0x12, 0x1, 0x0, 0xfa, 0x70, 0x10, 0x8, 0x413, 0x6023, 0xb636, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xbf, 0x0, 0x1, 0x7a, 0x9e, 0xc0, 0x0, [], [{{0x9, 0x5, 0x82}}]}}]}}]}}, 0x0)
r0 = syz_usb_connect$uac1(0x0, 0xad, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x9b, 0x3, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{}, [@extension_unit={0x9, 0x24, 0x8, 0x0, 0x0, 0x0, 'LX'}, @mixer_unit={0x6, 0x24, 0x4, 0x0, 0x0, 'R'}, @selector_unit={0x7, 0x24, 0x5, 0x0, 0x0, "53f1"}, @selector_unit={0xb, 0x24, 0x5, 0x0, 0x0, "133b9bda531c"}, @selector_unit={0x9, 0x24, 0x5, 0x0, 0x5, "96efc359"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x7f, 0x2, 0x0, 0x1, "8b7e", "8e"}, @as_header={0x7}]}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x0, 0x0, 0x0, {0x7, 0x25, 0x1, 0x81}}}}}}}]}}, 0x0)
r1 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_open_dev$hiddev(0x0, 0x0, 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f0000004200)=ANY=[@ANYBLOB="12010000e2793b10d10501200004010203010902120001000000000904"], 0x0)
syz_usb_control_io$uac1(r0, &(0x7f0000001100)={0x14, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0)
syz_usb_control_io(r0, &(0x7f00000021c0)={0x2c, 0x0, &(0x7f0000002080)={0x0, 0x3, 0x4, @lang_id={0x4}}, 0x0, 0x0, 0x0}, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_disconnect(r1)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000a40)={0x24, 0x0, 0x0, &(0x7f0000000800), &(0x7f0000000a00)={0x0, 0x21, 0x9, {0x9, 0x21, 0x1, 0x3, 0x1, {0x22, 0xb11}}}}, 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect$uac1-syz_usb_connect$hid-syz_usb_control_io-syz_open_dev$hiddev-syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-syz_usb_control_io$uac1-syz_usb_control_io-syz_usb_disconnect-syz_usb_control_io
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000007c0)={{0x12, 0x1, 0x0, 0xfa, 0x70, 0x10, 0x8, 0x413, 0x6023, 0xb636, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xbf, 0x0, 0x1, 0x7a, 0x9e, 0xc0, 0x0, [], [{{0x9, 0x5, 0x82}}]}}]}}]}}, 0x0)
r0 = syz_usb_connect$uac1(0x0, 0xad, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x9b, 0x3, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{}, [@extension_unit={0x9, 0x24, 0x8, 0x0, 0x0, 0x0, 'LX'}, @mixer_unit={0x6, 0x24, 0x4, 0x0, 0x0, 'R'}, @selector_unit={0x7, 0x24, 0x5, 0x0, 0x0, "53f1"}, @selector_unit={0xb, 0x24, 0x5, 0x0, 0x0, "133b9bda531c"}, @selector_unit={0x9, 0x24, 0x5, 0x0, 0x5, "96efc359"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x7f, 0x2, 0x0, 0x1, "8b7e", "8e"}, @as_header={0x7}]}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x0, 0x0, 0x0, {0x7, 0x25, 0x1, 0x81}}}}}}}]}}, 0x0)
r1 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_open_dev$hiddev(0x0, 0x0, 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f0000004200)=ANY=[@ANYBLOB="12010000e2793b10d10501200004010203010902120001000000000904"], 0x0)
syz_usb_control_io$uac1(r0, &(0x7f0000001100)={0x14, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0)
syz_usb_control_io(r0, &(0x7f00000021c0)={0x2c, 0x0, &(0x7f0000002080)={0x0, 0x3, 0x4, @lang_id={0x4}}, 0x0, 0x0, 0x0}, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_disconnect(r1)
syz_usb_control_io(r0, 0x0, 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect$uac1-syz_usb_connect$hid-syz_usb_control_io-syz_open_dev$hiddev-syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-syz_usb_control_io$uac1-syz_usb_control_io-syz_usb_disconnect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000007c0)={{0x12, 0x1, 0x0, 0xfa, 0x70, 0x10, 0x8, 0x413, 0x6023, 0xb636, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xbf, 0x0, 0x1, 0x7a, 0x9e, 0xc0, 0x0, [], [{{0x9, 0x5, 0x82}}]}}]}}]}}, 0x0)
r0 = syz_usb_connect$uac1(0x0, 0xad, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x9b, 0x3, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{}, [@extension_unit={0x9, 0x24, 0x8, 0x0, 0x0, 0x0, 'LX'}, @mixer_unit={0x6, 0x24, 0x4, 0x0, 0x0, 'R'}, @selector_unit={0x7, 0x24, 0x5, 0x0, 0x0, "53f1"}, @selector_unit={0xb, 0x24, 0x5, 0x0, 0x0, "133b9bda531c"}, @selector_unit={0x9, 0x24, 0x5, 0x0, 0x5, "96efc359"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x7f, 0x2, 0x0, 0x1, "8b7e", "8e"}, @as_header={0x7}]}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x0, 0x0, 0x0, {0x7, 0x25, 0x1, 0x81}}}}}}}]}}, 0x0)
r1 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_open_dev$hiddev(0x0, 0x0, 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f0000004200)=ANY=[@ANYBLOB="12010000e2793b10d10501200004010203010902120001000000000904"], 0x0)
syz_usb_control_io$uac1(r0, &(0x7f0000001100)={0x14, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0)
syz_usb_control_io(r0, &(0x7f00000021c0)={0x2c, 0x0, &(0x7f0000002080)={0x0, 0x3, 0x4, @lang_id={0x4}}, 0x0, 0x0, 0x0}, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_disconnect(r1)

program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect$uac1-syz_usb_connect$hid-syz_usb_control_io-syz_open_dev$hiddev-syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-syz_usb_control_io$uac1-syz_usb_control_io
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000007c0)={{0x12, 0x1, 0x0, 0xfa, 0x70, 0x10, 0x8, 0x413, 0x6023, 0xb636, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xbf, 0x0, 0x1, 0x7a, 0x9e, 0xc0, 0x0, [], [{{0x9, 0x5, 0x82}}]}}]}}]}}, 0x0)
r0 = syz_usb_connect$uac1(0x0, 0xad, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x9b, 0x3, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{}, [@extension_unit={0x9, 0x24, 0x8, 0x0, 0x0, 0x0, 'LX'}, @mixer_unit={0x6, 0x24, 0x4, 0x0, 0x0, 'R'}, @selector_unit={0x7, 0x24, 0x5, 0x0, 0x0, "53f1"}, @selector_unit={0xb, 0x24, 0x5, 0x0, 0x0, "133b9bda531c"}, @selector_unit={0x9, 0x24, 0x5, 0x0, 0x5, "96efc359"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x7f, 0x2, 0x0, 0x1, "8b7e", "8e"}, @as_header={0x7}]}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x0, 0x0, 0x0, {0x7, 0x25, 0x1, 0x81}}}}}}}]}}, 0x0)
r1 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_open_dev$hiddev(0x0, 0x0, 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f0000004200)=ANY=[@ANYBLOB="12010000e2793b10d10501200004010203010902120001000000000904"], 0x0)
syz_usb_control_io$uac1(r0, &(0x7f0000001100)={0x14, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0)
syz_usb_control_io(r0, &(0x7f00000021c0)={0x2c, 0x0, &(0x7f0000002080)={0x0, 0x3, 0x4, @lang_id={0x4}}, 0x0, 0x0, 0x0}, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect$uac1-syz_usb_connect$hid-syz_usb_control_io-syz_open_dev$hiddev-syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-syz_usb_control_io$uac1
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000007c0)={{0x12, 0x1, 0x0, 0xfa, 0x70, 0x10, 0x8, 0x413, 0x6023, 0xb636, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xbf, 0x0, 0x1, 0x7a, 0x9e, 0xc0, 0x0, [], [{{0x9, 0x5, 0x82}}]}}]}}]}}, 0x0)
r0 = syz_usb_connect$uac1(0x0, 0xad, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x9b, 0x3, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{}, [@extension_unit={0x9, 0x24, 0x8, 0x0, 0x0, 0x0, 'LX'}, @mixer_unit={0x6, 0x24, 0x4, 0x0, 0x0, 'R'}, @selector_unit={0x7, 0x24, 0x5, 0x0, 0x0, "53f1"}, @selector_unit={0xb, 0x24, 0x5, 0x0, 0x0, "133b9bda531c"}, @selector_unit={0x9, 0x24, 0x5, 0x0, 0x5, "96efc359"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x7f, 0x2, 0x0, 0x1, "8b7e", "8e"}, @as_header={0x7}]}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x0, 0x0, 0x0, {0x7, 0x25, 0x1, 0x81}}}}}}}]}}, 0x0)
r1 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_open_dev$hiddev(0x0, 0x0, 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f0000004200)=ANY=[@ANYBLOB="12010000e2793b10d10501200004010203010902120001000000000904"], 0x0)
syz_usb_control_io$uac1(r0, &(0x7f0000001100)={0x14, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0)
syz_usb_control_io(r0, &(0x7f00000021c0)={0x2c, 0x0, &(0x7f0000002080)={0x0, 0x3, 0x4, @lang_id={0x4}}, 0x0, 0x0, 0x0}, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect$uac1-syz_usb_connect$hid-syz_usb_control_io-syz_open_dev$hiddev-syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000007c0)={{0x12, 0x1, 0x0, 0xfa, 0x70, 0x10, 0x8, 0x413, 0x6023, 0xb636, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xbf, 0x0, 0x1, 0x7a, 0x9e, 0xc0, 0x0, [], [{{0x9, 0x5, 0x82}}]}}]}}]}}, 0x0)
r0 = syz_usb_connect$uac1(0x0, 0xad, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x9b, 0x3, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{}, [@extension_unit={0x9, 0x24, 0x8, 0x0, 0x0, 0x0, 'LX'}, @mixer_unit={0x6, 0x24, 0x4, 0x0, 0x0, 'R'}, @selector_unit={0x7, 0x24, 0x5, 0x0, 0x0, "53f1"}, @selector_unit={0xb, 0x24, 0x5, 0x0, 0x0, "133b9bda531c"}, @selector_unit={0x9, 0x24, 0x5, 0x0, 0x5, "96efc359"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x7f, 0x2, 0x0, 0x1, "8b7e", "8e"}, @as_header={0x7}]}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x0, 0x0, 0x0, {0x7, 0x25, 0x1, 0x81}}}}}}}]}}, 0x0)
r1 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_open_dev$hiddev(0x0, 0x0, 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f0000004200)=ANY=[@ANYBLOB="12010000e2793b10d10501200004010203010902120001000000000904"], 0x0)
syz_usb_control_io$uac1(r0, &(0x7f0000001100)={0x14, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0)
syz_usb_control_io(r0, &(0x7f00000021c0)={0x2c, 0x0, &(0x7f0000002080)={0x0, 0x3, 0x4, @lang_id={0x4}}, 0x0, 0x0, 0x0}, 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect$uac1-syz_usb_connect$hid-syz_usb_control_io-syz_open_dev$hiddev-syz_usb_connect-syz_usb_control_io$uac1
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000007c0)={{0x12, 0x1, 0x0, 0xfa, 0x70, 0x10, 0x8, 0x413, 0x6023, 0xb636, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xbf, 0x0, 0x1, 0x7a, 0x9e, 0xc0, 0x0, [], [{{0x9, 0x5, 0x82}}]}}]}}]}}, 0x0)
r0 = syz_usb_connect$uac1(0x0, 0xad, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x9b, 0x3, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{}, [@extension_unit={0x9, 0x24, 0x8, 0x0, 0x0, 0x0, 'LX'}, @mixer_unit={0x6, 0x24, 0x4, 0x0, 0x0, 'R'}, @selector_unit={0x7, 0x24, 0x5, 0x0, 0x0, "53f1"}, @selector_unit={0xb, 0x24, 0x5, 0x0, 0x0, "133b9bda531c"}, @selector_unit={0x9, 0x24, 0x5, 0x0, 0x5, "96efc359"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x7f, 0x2, 0x0, 0x1, "8b7e", "8e"}, @as_header={0x7}]}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x0, 0x0, 0x0, {0x7, 0x25, 0x1, 0x81}}}}}}}]}}, 0x0)
r1 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_open_dev$hiddev(0x0, 0x0, 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f0000004200)=ANY=[@ANYBLOB="12010000e2793b10d10501200004010203010902120001000000000904"], 0x0)
syz_usb_control_io$uac1(r0, &(0x7f0000001100)={0x14, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect$uac1-syz_usb_connect$hid-syz_usb_control_io-syz_open_dev$hiddev-syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000007c0)={{0x12, 0x1, 0x0, 0xfa, 0x70, 0x10, 0x8, 0x413, 0x6023, 0xb636, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xbf, 0x0, 0x1, 0x7a, 0x9e, 0xc0, 0x0, [], [{{0x9, 0x5, 0x82}}]}}]}}]}}, 0x0)
syz_usb_connect$uac1(0x0, 0xad, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x9b, 0x3, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{}, [@extension_unit={0x9, 0x24, 0x8, 0x0, 0x0, 0x0, 'LX'}, @mixer_unit={0x6, 0x24, 0x4, 0x0, 0x0, 'R'}, @selector_unit={0x7, 0x24, 0x5, 0x0, 0x0, "53f1"}, @selector_unit={0xb, 0x24, 0x5, 0x0, 0x0, "133b9bda531c"}, @selector_unit={0x9, 0x24, 0x5, 0x0, 0x5, "96efc359"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x7f, 0x2, 0x0, 0x1, "8b7e", "8e"}, @as_header={0x7}]}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x0, 0x0, 0x0, {0x7, 0x25, 0x1, 0x81}}}}}}}]}}, 0x0)
r0 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_open_dev$hiddev(0x0, 0x0, 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f0000004200)=ANY=[@ANYBLOB="12010000e2793b10d10501200004010203010902120001000000000904"], 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect$uac1-syz_usb_connect$hid-syz_usb_control_io-syz_open_dev$hiddev
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000007c0)={{0x12, 0x1, 0x0, 0xfa, 0x70, 0x10, 0x8, 0x413, 0x6023, 0xb636, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xbf, 0x0, 0x1, 0x7a, 0x9e, 0xc0, 0x0, [], [{{0x9, 0x5, 0x82}}]}}]}}]}}, 0x0)
syz_usb_connect$uac1(0x0, 0xad, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x9b, 0x3, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{}, [@extension_unit={0x9, 0x24, 0x8, 0x0, 0x0, 0x0, 'LX'}, @mixer_unit={0x6, 0x24, 0x4, 0x0, 0x0, 'R'}, @selector_unit={0x7, 0x24, 0x5, 0x0, 0x0, "53f1"}, @selector_unit={0xb, 0x24, 0x5, 0x0, 0x0, "133b9bda531c"}, @selector_unit={0x9, 0x24, 0x5, 0x0, 0x5, "96efc359"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x7f, 0x2, 0x0, 0x1, "8b7e", "8e"}, @as_header={0x7}]}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x0, 0x0, 0x0, {0x7, 0x25, 0x1, 0x81}}}}}}}]}}, 0x0)
r0 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_open_dev$hiddev(0x0, 0x0, 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect$uac1-syz_usb_connect$hid-syz_usb_control_io
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000007c0)={{0x12, 0x1, 0x0, 0xfa, 0x70, 0x10, 0x8, 0x413, 0x6023, 0xb636, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xbf, 0x0, 0x1, 0x7a, 0x9e, 0xc0, 0x0, [], [{{0x9, 0x5, 0x82}}]}}]}}]}}, 0x0)
syz_usb_connect$uac1(0x0, 0xad, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x9b, 0x3, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{}, [@extension_unit={0x9, 0x24, 0x8, 0x0, 0x0, 0x0, 'LX'}, @mixer_unit={0x6, 0x24, 0x4, 0x0, 0x0, 'R'}, @selector_unit={0x7, 0x24, 0x5, 0x0, 0x0, "53f1"}, @selector_unit={0xb, 0x24, 0x5, 0x0, 0x0, "133b9bda531c"}, @selector_unit={0x9, 0x24, 0x5, 0x0, 0x5, "96efc359"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x7f, 0x2, 0x0, 0x1, "8b7e", "8e"}, @as_header={0x7}]}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x0, 0x0, 0x0, {0x7, 0x25, 0x1, 0x81}}}}}}}]}}, 0x0)
r0 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect$uac1-syz_usb_connect$hid
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000007c0)={{0x12, 0x1, 0x0, 0xfa, 0x70, 0x10, 0x8, 0x413, 0x6023, 0xb636, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xbf, 0x0, 0x1, 0x7a, 0x9e, 0xc0, 0x0, [], [{{0x9, 0x5, 0x82}}]}}]}}]}}, 0x0)
syz_usb_connect$uac1(0x0, 0xad, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x9b, 0x3, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{}, [@extension_unit={0x9, 0x24, 0x8, 0x0, 0x0, 0x0, 'LX'}, @mixer_unit={0x6, 0x24, 0x4, 0x0, 0x0, 'R'}, @selector_unit={0x7, 0x24, 0x5, 0x0, 0x0, "53f1"}, @selector_unit={0xb, 0x24, 0x5, 0x0, 0x0, "133b9bda531c"}, @selector_unit={0x9, 0x24, 0x5, 0x0, 0x5, "96efc359"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x7f, 0x2, 0x0, 0x1, "8b7e", "8e"}, @as_header={0x7}]}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x0, 0x0, 0x0, {0x7, 0x25, 0x1, 0x81}}}}}}}]}}, 0x0)
syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect$uac1
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000007c0)={{0x12, 0x1, 0x0, 0xfa, 0x70, 0x10, 0x8, 0x413, 0x6023, 0xb636, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xbf, 0x0, 0x1, 0x7a, 0x9e, 0xc0, 0x0, [], [{{0x9, 0x5, 0x82}}]}}]}}]}}, 0x0)
syz_usb_connect$uac1(0x0, 0xad, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x9b, 0x3, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{}, [@extension_unit={0x9, 0x24, 0x8, 0x0, 0x0, 0x0, 'LX'}, @mixer_unit={0x6, 0x24, 0x4, 0x0, 0x0, 'R'}, @selector_unit={0x7, 0x24, 0x5, 0x0, 0x0, "53f1"}, @selector_unit={0xb, 0x24, 0x5, 0x0, 0x0, "133b9bda531c"}, @selector_unit={0x9, 0x24, 0x5, 0x0, 0x5, "96efc359"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x7f, 0x2, 0x0, 0x1, "8b7e", "8e"}, @as_header={0x7}]}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x0, 0x0, 0x0, {0x7, 0x25, 0x1, 0x81}}}}}}}]}}, 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000007c0)={{0x12, 0x1, 0x0, 0xfa, 0x70, 0x10, 0x8, 0x413, 0x6023, 0xb636, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xbf, 0x0, 0x1, 0x7a, 0x9e, 0xc0, 0x0, [], [{{0x9, 0x5, 0x82}}]}}]}}]}}, 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x0, 0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
simplifying C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init
reproducing took 1h1m36.335400314s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-use-after-free in v4l2_fh_init+0x27d/0x2c0 drivers/media/v4l2-core/v4l2-fh.c:25
Read of size 8 at addr ffff88811abd8738 by task v4l_id/3056

CPU: 1 UID: 0 PID: 3056 Comm: v4l_id Not tainted 6.11.0-rc7-syzkaller-00152-g68d4209158f4 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:93 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0xc3/0x620 mm/kasan/report.c:488
 kasan_report+0xd9/0x110 mm/kasan/report.c:601
 v4l2_fh_init+0x27d/0x2c0 drivers/media/v4l2-core/v4l2-fh.c:25
 v4l2_fh_open+0x89/0xc0 drivers/media/v4l2-core/v4l2-fh.c:63
 em28xx_v4l2_open+0x250/0x7e0 drivers/media/usb/em28xx/em28xx-video.c:2155
 v4l2_open+0x228/0x490 drivers/media/v4l2-core/v4l2-dev.c:427
 chrdev_open+0x26d/0x6f0 fs/char_dev.c:414
 do_dentry_open+0x957/0x1490 fs/open.c:959
 vfs_open+0x82/0x3f0 fs/open.c:1089
 do_open fs/namei.c:3727 [inline]
 path_openat+0x2141/0x2d20 fs/namei.c:3886
 do_filp_open+0x1dc/0x430 fs/namei.c:3913
 do_sys_openat2+0x17a/0x1e0 fs/open.c:1416
 do_sys_open fs/open.c:1431 [inline]
 __do_sys_openat fs/open.c:1447 [inline]
 __se_sys_openat fs/open.c:1442 [inline]
 __x64_sys_openat+0x175/0x210 fs/open.c:1442
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f59b83bc9a4
Code: 24 20 48 8d 44 24 30 48 89 44 24 28 64 8b 04 25 18 00 00 00 85 c0 75 2c 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 76 60 48 8b 15 55 a4 0d 00 f7 d8 64 89 02 48 83
RSP: 002b:00007fffca1ebb70 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fffca1ebd88 RCX: 00007f59b83bc9a4
RDX: 0000000000000000 RSI: 00007fffca1edf24 RDI: 00000000ffffff9c
RBP: 00007fffca1edf24 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffca1ebda0 R14: 0000559e527f0670 R15: 00007f59b880ba80
 </TASK>

Allocated by task 2663:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
 __kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:387
 kmalloc_noprof include/linux/slab.h:681 [inline]
 kzalloc_noprof include/linux/slab.h:807 [inline]
 em28xx_v4l2_init+0x114/0x4050 drivers/media/usb/em28xx/em28xx-video.c:2534
 em28xx_init_extension+0x137/0x200 drivers/media/usb/em28xx/em28xx-core.c:1117
 request_module_async+0x61/0x70 drivers/media/usb/em28xx/em28xx-cards.c:3457
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Freed by task 2663:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
 poison_slab_object+0xf7/0x160 mm/kasan/common.c:240
 __kasan_slab_free+0x14/0x30 mm/kasan/common.c:256
 kasan_slab_free include/linux/kasan.h:184 [inline]
 slab_free_hook mm/slub.c:2256 [inline]
 slab_free mm/slub.c:4477 [inline]
 kfree+0x10b/0x380 mm/slub.c:4598
 em28xx_free_v4l2 drivers/media/usb/em28xx/em28xx-video.c:2120 [inline]
 kref_put include/linux/kref.h:65 [inline]
 em28xx_v4l2_init+0x22a4/0x4050 drivers/media/usb/em28xx/em28xx-video.c:2903
 em28xx_init_extension+0x137/0x200 drivers/media/usb/em28xx/em28xx-core.c:1117
 request_module_async+0x61/0x70 drivers/media/usb/em28xx/em28xx-cards.c:3457
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

The buggy address belongs to the object at ffff88811abd8000
 which belongs to the cache kmalloc-8k of size 8192
The buggy address is located 1848 bytes inside of
 freed 8192-byte region [ffff88811abd8000, ffff88811abda000)

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11abd8
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0x200000000000040(head|node=0|zone=2)
page_type: 0xfdffffff(slab)
raw: 0200000000000040 ffff888100042280 0000000000000000 0000000000000001
raw: 0000000000000000 0000000080020002 00000001fdffffff 0000000000000000
head: 0200000000000040 ffff888100042280 0000000000000000 0000000000000001
head: 0000000000000000 0000000080020002 00000001fdffffff 0000000000000000
head: 0200000000000003 ffffea00046af601 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 2680, tgid 2680 (kworker/0:4), ts 121161688878, free_ts 121161148989
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1500
 prep_new_page mm/page_alloc.c:1508 [inline]
 get_page_from_freelist+0x1311/0x25f0 mm/page_alloc.c:3446
 __alloc_pages_noprof+0x21e/0x2290 mm/page_alloc.c:4702
 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
 alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
 alloc_slab_page+0x4e/0xf0 mm/slub.c:2325
 allocate_slab mm/slub.c:2488 [inline]
 new_slab+0x84/0x260 mm/slub.c:2541
 ___slab_alloc+0xdac/0x1870 mm/slub.c:3727
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3817
 __slab_alloc_node mm/slub.c:3870 [inline]
 slab_alloc_node mm/slub.c:4029 [inline]
 __kmalloc_cache_noprof+0x27a/0x2c0 mm/slub.c:4188
 kmalloc_noprof include/linux/slab.h:681 [inline]
 kzalloc_noprof include/linux/slab.h:807 [inline]
 em28xx_v4l2_init+0x114/0x4050 drivers/media/usb/em28xx/em28xx-video.c:2534
 em28xx_init_extension+0x137/0x200 drivers/media/usb/em28xx/em28xx-core.c:1117
 request_module_async+0x61/0x70 drivers/media/usb/em28xx/em28xx-cards.c:3457
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
page last free pid 2550 tgid 2550 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1101 [inline]
 free_unref_page+0x698/0xce0 mm/page_alloc.c:2619
 __put_partials+0x14c/0x170 mm/slub.c:3055
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x4e/0x140 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x4e/0x70 mm/kasan/common.c:322
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook mm/slub.c:3992 [inline]
 slab_alloc_node mm/slub.c:4041 [inline]
 kmem_cache_alloc_noprof+0x11c/0x2b0 mm/slub.c:4048
 getname_flags.part.0+0x4c/0x550 fs/namei.c:139
 getname_flags include/linux/audit.h:322 [inline]
 getname+0x8d/0xe0 fs/namei.c:225
 do_sys_openat2+0x104/0x1e0 fs/open.c:1410
 do_sys_open fs/open.c:1431 [inline]
 __do_sys_openat fs/open.c:1447 [inline]
 __se_sys_openat fs/open.c:1442 [inline]
 __x64_sys_openat+0x175/0x210 fs/open.c:1442
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff88811abd8600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88811abd8680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88811abd8700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                        ^
 ffff88811abd8780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88811abd8800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-use-after-free in v4l2_fh_init+0x27d/0x2c0 drivers/media/v4l2-core/v4l2-fh.c:25
Read of size 8 at addr ffff88811abd8738 by task v4l_id/3056

CPU: 1 UID: 0 PID: 3056 Comm: v4l_id Not tainted 6.11.0-rc7-syzkaller-00152-g68d4209158f4 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:93 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0xc3/0x620 mm/kasan/report.c:488
 kasan_report+0xd9/0x110 mm/kasan/report.c:601
 v4l2_fh_init+0x27d/0x2c0 drivers/media/v4l2-core/v4l2-fh.c:25
 v4l2_fh_open+0x89/0xc0 drivers/media/v4l2-core/v4l2-fh.c:63
 em28xx_v4l2_open+0x250/0x7e0 drivers/media/usb/em28xx/em28xx-video.c:2155
 v4l2_open+0x228/0x490 drivers/media/v4l2-core/v4l2-dev.c:427
 chrdev_open+0x26d/0x6f0 fs/char_dev.c:414
 do_dentry_open+0x957/0x1490 fs/open.c:959
 vfs_open+0x82/0x3f0 fs/open.c:1089
 do_open fs/namei.c:3727 [inline]
 path_openat+0x2141/0x2d20 fs/namei.c:3886
 do_filp_open+0x1dc/0x430 fs/namei.c:3913
 do_sys_openat2+0x17a/0x1e0 fs/open.c:1416
 do_sys_open fs/open.c:1431 [inline]
 __do_sys_openat fs/open.c:1447 [inline]
 __se_sys_openat fs/open.c:1442 [inline]
 __x64_sys_openat+0x175/0x210 fs/open.c:1442
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f59b83bc9a4
Code: 24 20 48 8d 44 24 30 48 89 44 24 28 64 8b 04 25 18 00 00 00 85 c0 75 2c 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 76 60 48 8b 15 55 a4 0d 00 f7 d8 64 89 02 48 83
RSP: 002b:00007fffca1ebb70 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fffca1ebd88 RCX: 00007f59b83bc9a4
RDX: 0000000000000000 RSI: 00007fffca1edf24 RDI: 00000000ffffff9c
RBP: 00007fffca1edf24 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffca1ebda0 R14: 0000559e527f0670 R15: 00007f59b880ba80
 </TASK>

Allocated by task 2663:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
 __kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:387
 kmalloc_noprof include/linux/slab.h:681 [inline]
 kzalloc_noprof include/linux/slab.h:807 [inline]
 em28xx_v4l2_init+0x114/0x4050 drivers/media/usb/em28xx/em28xx-video.c:2534
 em28xx_init_extension+0x137/0x200 drivers/media/usb/em28xx/em28xx-core.c:1117
 request_module_async+0x61/0x70 drivers/media/usb/em28xx/em28xx-cards.c:3457
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Freed by task 2663:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
 poison_slab_object+0xf7/0x160 mm/kasan/common.c:240
 __kasan_slab_free+0x14/0x30 mm/kasan/common.c:256
 kasan_slab_free include/linux/kasan.h:184 [inline]
 slab_free_hook mm/slub.c:2256 [inline]
 slab_free mm/slub.c:4477 [inline]
 kfree+0x10b/0x380 mm/slub.c:4598
 em28xx_free_v4l2 drivers/media/usb/em28xx/em28xx-video.c:2120 [inline]
 kref_put include/linux/kref.h:65 [inline]
 em28xx_v4l2_init+0x22a4/0x4050 drivers/media/usb/em28xx/em28xx-video.c:2903
 em28xx_init_extension+0x137/0x200 drivers/media/usb/em28xx/em28xx-core.c:1117
 request_module_async+0x61/0x70 drivers/media/usb/em28xx/em28xx-cards.c:3457
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

The buggy address belongs to the object at ffff88811abd8000
 which belongs to the cache kmalloc-8k of size 8192
The buggy address is located 1848 bytes inside of
 freed 8192-byte region [ffff88811abd8000, ffff88811abda000)

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11abd8
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0x200000000000040(head|node=0|zone=2)
page_type: 0xfdffffff(slab)
raw: 0200000000000040 ffff888100042280 0000000000000000 0000000000000001
raw: 0000000000000000 0000000080020002 00000001fdffffff 0000000000000000
head: 0200000000000040 ffff888100042280 0000000000000000 0000000000000001
head: 0000000000000000 0000000080020002 00000001fdffffff 0000000000000000
head: 0200000000000003 ffffea00046af601 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 2680, tgid 2680 (kworker/0:4), ts 121161688878, free_ts 121161148989
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1500
 prep_new_page mm/page_alloc.c:1508 [inline]
 get_page_from_freelist+0x1311/0x25f0 mm/page_alloc.c:3446
 __alloc_pages_noprof+0x21e/0x2290 mm/page_alloc.c:4702
 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
 alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
 alloc_slab_page+0x4e/0xf0 mm/slub.c:2325
 allocate_slab mm/slub.c:2488 [inline]
 new_slab+0x84/0x260 mm/slub.c:2541
 ___slab_alloc+0xdac/0x1870 mm/slub.c:3727
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3817
 __slab_alloc_node mm/slub.c:3870 [inline]
 slab_alloc_node mm/slub.c:4029 [inline]
 __kmalloc_cache_noprof+0x27a/0x2c0 mm/slub.c:4188
 kmalloc_noprof include/linux/slab.h:681 [inline]
 kzalloc_noprof include/linux/slab.h:807 [inline]
 em28xx_v4l2_init+0x114/0x4050 drivers/media/usb/em28xx/em28xx-video.c:2534
 em28xx_init_extension+0x137/0x200 drivers/media/usb/em28xx/em28xx-core.c:1117
 request_module_async+0x61/0x70 drivers/media/usb/em28xx/em28xx-cards.c:3457
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
page last free pid 2550 tgid 2550 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1101 [inline]
 free_unref_page+0x698/0xce0 mm/page_alloc.c:2619
 __put_partials+0x14c/0x170 mm/slub.c:3055
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x4e/0x140 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x4e/0x70 mm/kasan/common.c:322
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook mm/slub.c:3992 [inline]
 slab_alloc_node mm/slub.c:4041 [inline]
 kmem_cache_alloc_noprof+0x11c/0x2b0 mm/slub.c:4048
 getname_flags.part.0+0x4c/0x550 fs/namei.c:139
 getname_flags include/linux/audit.h:322 [inline]
 getname+0x8d/0xe0 fs/namei.c:225
 do_sys_openat2+0x104/0x1e0 fs/open.c:1410
 do_sys_open fs/open.c:1431 [inline]
 __do_sys_openat fs/open.c:1447 [inline]
 __se_sys_openat fs/open.c:1442 [inline]
 __x64_sys_openat+0x175/0x210 fs/open.c:1442
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff88811abd8600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88811abd8680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88811abd8700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                        ^
 ffff88811abd8780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88811abd8800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================