em28xx 5-1:0.130: Config register raw data: 0xfffffffb
em28xx 5-1:0.130: AC97 chip type couldn't be determined
em28xx 5-1:0.130: No AC97 audio processor
==================================================================
BUG: KASAN: use-after-free in __list_add_valid_or_report+0xe4/0x100 lib/list_debug.c:32
Read of size 8 at addr ffff88803551c250 by task kworker/1:2/5193

CPU: 1 PID: 5193 Comm: kworker/1:2 Not tainted 6.8.0-rc3-syzkaller-g54be6c6c5ae8 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Workqueue: usb_hub_wq hub_event
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0xc4/0x620 mm/kasan/report.c:488
 kasan_report+0xda/0x110 mm/kasan/report.c:601
 __list_add_valid_or_report+0xe4/0x100 lib/list_debug.c:32
 __list_add_valid include/linux/list.h:88 [inline]
 __list_add include/linux/list.h:150 [inline]
 list_add_tail include/linux/list.h:183 [inline]
 em28xx_init_extension+0x48/0x200 drivers/media/usb/em28xx/em28xx-core.c:1113
 em28xx_init_dev.constprop.0+0x197b/0x3090 drivers/media/usb/em28xx/em28xx-cards.c:3627
 em28xx_usb_probe+0x10db/0x3730 drivers/media/usb/em28xx/em28xx-cards.c:3982
 usb_probe_interface+0x309/0x940 drivers/usb/core/driver.c:399
 call_driver_probe drivers/base/dd.c:579 [inline]
 really_probe+0x23a/0xcb0 drivers/base/dd.c:658
 __driver_probe_device+0x1de/0x4b0 drivers/base/dd.c:800
 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:830
 __device_attach_driver+0x1df/0x310 drivers/base/dd.c:958
 bus_for_each_drv+0x157/0x1e0 drivers/base/bus.c:457
 __device_attach+0x1e8/0x4b0 drivers/base/dd.c:1030
 bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:532
 device_add+0x1188/0x1ab0 drivers/base/core.c:3625
 usb_set_configuration+0x10cb/0x1c50 drivers/usb/core/message.c:2207
 usb_generic_driver_probe+0xb1/0x110 drivers/usb/core/generic.c:254
 usb_probe_device+0xec/0x360 drivers/usb/core/driver.c:294
 call_driver_probe drivers/base/dd.c:579 [inline]
 really_probe+0x23a/0xcb0 drivers/base/dd.c:658
 __driver_probe_device+0x1de/0x4b0 drivers/base/dd.c:800
 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:830
 __device_attach_driver+0x1df/0x310 drivers/base/dd.c:958
 bus_for_each_drv+0x157/0x1e0 drivers/base/bus.c:457
 __device_attach+0x1e8/0x4b0 drivers/base/dd.c:1030
 bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:532
 device_add+0x1188/0x1ab0 drivers/base/core.c:3625
 usb_new_device+0xd90/0x1a10 drivers/usb/core/hub.c:2614
 hub_port_connect drivers/usb/core/hub.c:5483 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5623 [inline]
 port_event drivers/usb/core/hub.c:5783 [inline]
 hub_event+0x2db0/0x4e20 drivers/usb/core/hub.c:5865
 process_one_work+0x889/0x15e0 kernel/workqueue.c:2633
 process_scheduled_works kernel/workqueue.c:2706 [inline]
 worker_thread+0x8b9/0x12a0 kernel/workqueue.c:2787
 kthread+0x2c6/0x3b0 kernel/kthread.c:388
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242
 </TASK>

The buggy address belongs to the physical page:
page:ffffea0000d54700 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3551c
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000000 ffffea0000d54788 ffffea00008b8988 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x140cc0(GFP_USER|__GFP_COMP), pid 5193, tgid 5193 (kworker/1:2), ts 75655524867, free_ts 76077533017
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x2d4/0x350 mm/page_alloc.c:1533
 prep_new_page mm/page_alloc.c:1540 [inline]
 get_page_from_freelist+0xa28/0x3780 mm/page_alloc.c:3311
 __alloc_pages+0x22f/0x2440 mm/page_alloc.c:4567
 __alloc_pages_node include/linux/gfp.h:238 [inline]
 alloc_pages_node include/linux/gfp.h:261 [inline]
 __kmalloc_large_node+0x7f/0x1a0 mm/slub.c:3926
 __do_kmalloc_node mm/slub.c:3969 [inline]
 __kmalloc_node_track_caller.cold+0x5/0x5f mm/slub.c:4001
 kmemdup+0x29/0x60 mm/util.c:131
 kmemdup include/linux/fortify-string.h:710 [inline]
 em28xx_duplicate_dev drivers/media/usb/em28xx/em28xx-cards.c:3680 [inline]
 em28xx_usb_probe+0x1ed0/0x3730 drivers/media/usb/em28xx/em28xx-cards.c:4030
 usb_probe_interface+0x309/0x940 drivers/usb/core/driver.c:399
 call_driver_probe drivers/base/dd.c:579 [inline]
 really_probe+0x23a/0xcb0 drivers/base/dd.c:658
 __driver_probe_device+0x1de/0x4b0 drivers/base/dd.c:800
 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:830
 __device_attach_driver+0x1df/0x310 drivers/base/dd.c:958
 bus_for_each_drv+0x157/0x1e0 drivers/base/bus.c:457
 __device_attach+0x1e8/0x4b0 drivers/base/dd.c:1030
 bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:532
 device_add+0x1188/0x1ab0 drivers/base/core.c:3625
page last free pid 5193 tgid 5193 stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1140 [inline]
 free_unref_page_prepare+0x527/0xb10 mm/page_alloc.c:2346
 free_unref_page+0x33/0x3c0 mm/page_alloc.c:2486
 __folio_put+0xeb/0x110 mm/swap.c:127
 em28xx_free_device drivers/media/usb/em28xx/em28xx-cards.c:3514 [inline]
 kref_put include/linux/kref.h:65 [inline]
 em28xx_usb_disconnect+0x4eb/0x640 drivers/media/usb/em28xx/em28xx-cards.c:4148
 usb_unbind_interface+0x1e0/0x8d0 drivers/usb/core/driver.c:461
 device_remove drivers/base/dd.c:569 [inline]
 device_remove+0x122/0x170 drivers/base/dd.c:561
 __device_release_driver drivers/base/dd.c:1272 [inline]
 device_release_driver_internal+0x44a/0x610 drivers/base/dd.c:1295
 bus_remove_device+0x22f/0x420 drivers/base/bus.c:574
 device_del+0x39d/0xa60 drivers/base/core.c:3814
 usb_disable_device+0x36c/0x7f0 drivers/usb/core/message.c:1416
 usb_disconnect+0x2e1/0x920 drivers/usb/core/hub.c:2267
 hub_port_connect drivers/usb/core/hub.c:5323 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5623 [inline]
 port_event drivers/usb/core/hub.c:5783 [inline]
 hub_event+0x1dbb/0x4e20 drivers/usb/core/hub.c:5865
 process_one_work+0x889/0x15e0 kernel/workqueue.c:2633
 process_scheduled_works kernel/workqueue.c:2706 [inline]
 worker_thread+0x8b9/0x12a0 kernel/workqueue.c:2787
 kthread+0x2c6/0x3b0 kernel/kthread.c:388
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147

Memory state around the buggy address:
 ffff88803551c100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88803551c180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88803551c200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                 ^
 ffff88803551c280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88803551c300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================