program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r0, 0xc0145608, &(0x7f0000000b00)="00000000010000000100"/20)
ioctl(r0, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r0, 0xc058560f, &(0x7f0000000700)="0000000001000000002c0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000400000000000000002c0100"/88)
ioctl(r0, 0xc058560f, &(0x7f0000000800)="0000000001000000002c0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/88)
ioctl(r0, 0xc058560f, &(0x7f0000000900)="0000000001000000002c0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000600000000000000002c0100"/88)
ioctl(r0, 0xc058560f, &(0x7f0000000a00)="0000000001000000002c0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000700000000000000002c0100"/88)
ioctl(r0, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)
[ 70.233612][ T4649] Bluetooth: hci0: command tx timeout
[ 70.552765][ T806] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 70.704799][ T806] usb 5-1: New USB device found, idVendor=045e, idProduct=0775, bcdDevice= 1.00
[ 70.713470][ T806] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 70.717021][ T806] usb 5-1: Product: syz
[ 70.719132][ T806] usb 5-1: Manufacturer: syz
[ 71.823235][ T806] input: Samsung SUR40 as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/input/input5
[ 71.952125][ T806] usb 5-1: USB disconnect, device number 2
[ 72.034481][ T5319] ==================================================================
[ 72.034513][ T5319] BUG: KASAN: slab-use-after-free in v4l2_release+0xb5/0x350
[ 72.034599][ T5319] Read of size 8 at addr ffff8880529de658 by task v4l_id/5319
[ 72.034609][ T5319]
[ 72.034617][ T5319] CPU: 0 UID: 0 PID: 5319 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full)
[ 72.034630][ T5319] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 72.034637][ T5319] Call Trace:
[ 72.034643][ T5319]
[ 72.034648][ T5319] dump_stack_lvl+0xe8/0x150
[ 72.034665][ T5319] print_address_description+0x55/0x1e0
[ 72.034682][ T5319] ? v4l2_release+0xb5/0x350
[ 72.034694][ T5319] print_report+0x58/0x70
[ 72.034708][ T5319] kasan_report+0x117/0x150
[ 72.034720][ T5319] ? __pfx___fsnotify_parent+0x10/0x10
[ 72.034737][ T5319] ? v4l2_release+0xb5/0x350
[ 72.034751][ T5319] v4l2_release+0xb5/0x350
[ 72.034764][ T5319] ? __pfx_v4l2_release+0x10/0x10
[ 72.034777][ T5319] __fput+0x418/0xa50
[ 72.034798][ T5319] fput_close_sync+0x11f/0x240
[ 72.034810][ T5319] ? __pfx_fput_close_sync+0x10/0x10
[ 72.034825][ T5319] __x64_sys_close+0x7e/0x110
[ 72.034838][ T5319] do_syscall_64+0x166/0x520
[ 72.034886][ T5319] ? trace_irq_disable+0x3b/0x140
[ 72.034898][ T5319] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 72.034910][ T5319] ? clear_bhb_loop+0x70/0xc0
[ 72.034923][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 72.034935][ T5319] RIP: 0033:0x7f889b4a7407
[ 72.034945][ T5319] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[ 72.034955][ T5319] RSP: 002b:00007ffea6e925e0 EFLAGS: 00000202 ORIG_RAX: 0000000000000003
[ 72.034969][ T5319] RAX: ffffffffffffffda RBX: 00007f889bbcc880 RCX: 00007f889b4a7407
[ 72.034978][ T5319] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
[ 72.034985][ T5319] RBP: 00007f889bbcc6e8 R08: 0000000000000000 R09: 0000000000000000
[ 72.034992][ T5319] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000002
[ 72.034999][ T5319] R13: 00007ffea6e92810 R14: 00007f889bd33000 R15: 000056198f9394d8
[ 72.035011][ T5319]
[ 72.035016][ T5319]
[ 72.035018][ T5319] Allocated by task 806:
[ 72.035024][ T5319] kasan_save_track+0x3e/0x80
[ 72.035057][ T5319] __kasan_kmalloc+0x93/0xb0
[ 72.035069][ T5319] __kmalloc_cache_noprof+0x321/0x600
[ 72.035083][ T5319] sur40_probe+0x16c/0xfa0
[ 72.035093][ T5319] usb_probe_interface+0x788/0xe50
[ 72.035104][ T5319] really_probe+0x254/0xae0
[ 72.035143][ T5319] __driver_probe_device+0x1e8/0x360
[ 72.035157][ T5319] driver_probe_device+0x4f/0x240
[ 72.035167][ T5319] __device_attach_driver+0x270/0x410
[ 72.035182][ T5319] bus_for_each_drv+0x258/0x2f0
[ 72.035193][ T5319] __device_attach+0x2c4/0x450
[ 72.035207][ T5319] device_initial_probe+0xa1/0xd0
[ 72.035221][ T5319] bus_probe_device+0x12a/0x220
[ 72.035232][ T5319] device_add+0x7d7/0xb80
[ 72.035245][ T5319] usb_set_configuration+0x1ad8/0x2180
[ 72.035261][ T5319] usb_generic_driver_probe+0x8d/0x150
[ 72.035276][ T5319] usb_probe_device+0x1c3/0x3b0
[ 72.035285][ T5319] really_probe+0x254/0xae0
[ 72.035293][ T5319] __driver_probe_device+0x1e8/0x360
[ 72.035308][ T5319] driver_probe_device+0x4f/0x240
[ 72.035317][ T5319] __device_attach_driver+0x270/0x410
[ 72.035331][ T5319] bus_for_each_drv+0x258/0x2f0
[ 72.035342][ T5319] __device_attach+0x2c4/0x450
[ 72.035356][ T5319] device_initial_probe+0xa1/0xd0
[ 72.035370][ T5319] bus_probe_device+0x12a/0x220
[ 72.035381][ T5319] device_add+0x7d7/0xb80
[ 72.035393][ T5319] usb_new_device+0x9aa/0x1690
[ 72.035406][ T5319] hub_event+0x28e8/0x4d30
[ 72.035420][ T5319] process_scheduled_works+0xc3d/0x1630
[ 72.035433][ T5319] worker_thread+0xa47/0xfb0
[ 72.035445][ T5319] kthread+0x38b/0x480
[ 72.035455][ T5319] ret_from_fork+0x514/0xb70
[ 72.035464][ T5319] ret_from_fork_asm+0x1a/0x30
[ 72.035479][ T5319]
[ 72.035482][ T5319] Freed by task 806:
[ 72.035487][ T5319] kasan_save_track+0x3e/0x80
[ 72.035502][ T5319] kasan_save_free_info+0x40/0x50
[ 72.035515][ T5319] __kasan_slab_free+0x5c/0x80
[ 72.035524][ T5319] kfree+0x1c5/0x650
[ 72.035535][ T5319] sur40_disconnect+0xaf/0x140
[ 72.035545][ T5319] usb_unbind_interface+0x295/0x9f0
[ 72.035555][ T5319] device_release_driver_internal+0x4f5/0x880
[ 72.035570][ T5319] bus_remove_device+0x444/0x560
[ 72.035581][ T5319] device_del+0x524/0x8f0
[ 72.035594][ T5319] usb_disable_device+0x3d4/0x8d0
[ 72.035608][ T5319] usb_disconnect+0x346/0x9a0
[ 72.035620][ T5319] hub_event+0x1bbb/0x4d30
[ 72.035635][ T5319] process_scheduled_works+0xc3d/0x1630
[ 72.035647][ T5319] worker_thread+0xa47/0xfb0
[ 72.035660][ T5319] kthread+0x38b/0x480
[ 72.035668][ T5319] ret_from_fork+0x514/0xb70
[ 72.035677][ T5319] ret_from_fork_asm+0x1a/0x30
[ 72.035692][ T5319]
[ 72.035695][ T5319] The buggy address belongs to the object at ffff8880529de000
[ 72.035695][ T5319] which belongs to the cache kmalloc-4k of size 4096
[ 72.035704][ T5319] The buggy address is located 1624 bytes inside of
[ 72.035704][ T5319] freed 4096-byte region [ffff8880529de000, ffff8880529df000)
[ 72.035716][ T5319]
[ 72.035719][ T5319] The buggy address belongs to the physical page:
[ 72.035725][ T5319] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x529d8
[ 72.035736][ T5319] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 72.035745][ T5319] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff)
[ 72.035756][ T5319] page_type: f5(slab)
[ 72.035766][ T5319] raw: 04fff00000000040 ffff88801b042140 dead000000000122 0000000000000000
[ 72.035775][ T5319] raw: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000
[ 72.035790][ T5319] head: 04fff00000000040 ffff88801b042140 dead000000000122 0000000000000000
[ 72.035799][ T5319] head: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000
[ 72.035809][ T5319] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 72.035818][ T5319] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 72.035823][ T5319] page dumped because: kasan: bad access detected
[ 72.035829][ T5319] page_owner tracks the page as allocated
[ 72.035833][ T5319] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 806, tgid 806 (kworker/0:2), ts 70749478428
[ 72.035851][ T5319] post_alloc_hook+0x1f9/0x250
[ 72.035864][ T5319] get_page_from_freelist+0x2209/0x2280
[ 72.035879][ T5319] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 72.035894][ T5319] allocate_slab+0x7d/0x620
[ 72.035904][ T5319] refill_objects+0x2d5/0x350
[ 72.035915][ T5319] __pcs_replace_empty_main+0x2c8/0x6c0
[ 72.035926][ T5319] __kmalloc_cache_noprof+0x39b/0x600
[ 72.035939][ T5319] sur40_probe+0x16c/0xfa0
[ 72.035949][ T5319] usb_probe_interface+0x788/0xe50
[ 72.035959][ T5319] really_probe+0x254/0xae0
[ 72.035968][ T5319] __driver_probe_device+0x1e8/0x360
[ 72.035982][ T5319] driver_probe_device+0x4f/0x240
[ 72.035991][ T5319] __device_attach_driver+0x270/0x410
[ 72.036005][ T5319] bus_for_each_drv+0x258/0x2f0
[ 72.036016][ T5319] __device_attach+0x2c4/0x450
[ 72.036030][ T5319] device_initial_probe+0xa1/0xd0
[ 72.036044][ T5319] page_owner free stack trace missing
[ 72.036048][ T5319]
[ 72.036050][ T5319] Memory state around the buggy address:
[ 72.036056][ T5319] ffff8880529de500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 72.036064][ T5319] ffff8880529de580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 72.036075][ T5319] >ffff8880529de600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 72.036080][ T5319] ^
[ 72.036090][ T5319] ffff8880529de680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 72.036099][ T5319] ffff8880529de700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 72.036105][ T5319] ==================================================================
[ 72.286076][ T4649] Bluetooth: hci0: command tx timeout
[ 72.422058][ T5319] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 72.425365][ T5319] CPU: 0 UID: 0 PID: 5319 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full)
[ 72.429805][ T5319] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 72.434687][ T5319] Call Trace:
[ 72.436359][ T5319]
[ 72.437904][ T5319] vpanic+0x56d/0xa60
[ 72.440137][ T5319] ? __pfx_vpanic+0x10/0x10
[ 72.442419][ T5319] panic+0xc5/0xd0
[ 72.444067][ T5319] ? __pfx_panic+0x10/0x10
[ 72.446016][ T5319] ? preempt_schedule_thunk+0x16/0x40
[ 72.448400][ T5319] ? preempt_schedule_thunk+0x16/0x40
[ 72.450717][ T5319] ? v4l2_release+0xb5/0x350
[ 72.452781][ T5319] check_panic_on_warn+0x89/0xb0
[ 72.455108][ T5319] ? v4l2_release+0xb5/0x350
[ 72.457254][ T5319] end_report+0x73/0x170
[ 72.459250][ T5319] ? v4l2_release+0xb5/0x350
[ 72.461345][ T5319] kasan_report+0x128/0x150
[ 72.463390][ T5319] ? __pfx___fsnotify_parent+0x10/0x10
[ 72.465904][ T5319] ? v4l2_release+0xb5/0x350
[ 72.468045][ T5319] v4l2_release+0xb5/0x350
[ 72.470096][ T5319] ? __pfx_v4l2_release+0x10/0x10
[ 72.472387][ T5319] __fput+0x418/0xa50
[ 72.474181][ T5319] fput_close_sync+0x11f/0x240
[ 72.476402][ T5319] ? __pfx_fput_close_sync+0x10/0x10
[ 72.478383][ T5319] __x64_sys_close+0x7e/0x110
[ 72.480269][ T5319] do_syscall_64+0x166/0x520
[ 72.482229][ T5319] ? trace_irq_disable+0x3b/0x140
[ 72.484408][ T5319] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 72.487016][ T5319] ? clear_bhb_loop+0x70/0xc0
[ 72.489133][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 72.491748][ T5319] RIP: 0033:0x7f889b4a7407
[ 72.493712][ T5319] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[ 72.501920][ T5319] RSP: 002b:00007ffea6e925e0 EFLAGS: 00000202 ORIG_RAX: 0000000000000003
[ 72.505511][ T5319] RAX: ffffffffffffffda RBX: 00007f889bbcc880 RCX: 00007f889b4a7407
[ 72.509492][ T5319] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
[ 72.513676][ T5319] RBP: 00007f889bbcc6e8 R08: 0000000000000000 R09: 0000000000000000
[ 72.517098][ T5319] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000002
[ 72.520381][ T5319] R13: 00007ffea6e92810 R14: 00007f889bd33000 R15: 000056198f9394d8
[ 72.523669][ T5319]
[ 72.525374][ T5319] Kernel Offset: disabled
[ 72.527125][ T5319] Rebooting in 86400 seconds..