==================================================================
BUG: KASAN: use-after-free in v4l2_open+0x398/0x3a0
Read of size 4 at addr ffff8881707e89d0 by task v4l_id/15337

CPU: 1 UID: 0 PID: 15337 Comm: v4l_id Tainted: G             L      syzkaller #0 PREEMPT_{RT,(full)} 
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150
 print_address_description+0x55/0x1e0
 print_report+0x58/0x70
 kasan_report+0x117/0x150
 v4l2_open+0x398/0x3a0
 chrdev_open+0x4d0/0x5f0
 do_dentry_open+0x83d/0x13e0
 vfs_open+0x3b/0x350
 path_openat+0x2e43/0x38a0
 do_file_open+0x23e/0x4a0
 do_sys_openat2+0x113/0x200
 __x64_sys_openat+0x138/0x170
 do_syscall_64+0x15f/0xf80
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f52e15b19a4
Code: 24 20 48 8d 44 24 30 48 89 44 24 28 64 8b 04 25 18 00 00 00 85 c0 75 2c 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 76 60 48 8b 15 55 a4 0d 00 f7 d8 64 89 02 48 83
RSP: 002b:00007fffbe1e79e0 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fffbe1e7bf8 RCX: 00007f52e15b19a4
RDX: 0000000000000000 RSI: 00007fffbe1e8f1b RDI: 00000000ffffff9c
RBP: 00007fffbe1e8f1b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffbe1e7c10 R14: 000056385aee3670 R15: 00007f52e1a02a80
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x200000188 pfn:0x1707e8
flags: 0x500000000000000(node=1|zone=2)
raw: 0500000000000000 ffffea00062f0608 ffff88823c643040 0000000000000000
raw: 0000000200000188 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x40dc0(GFP_KERNEL|__GFP_ZERO|__GFP_COMP), pid 32, tgid 32 (kworker/1:0), ts 1787254821447, free_ts 1787790889687
 post_alloc_hook+0x1f9/0x250
 get_page_from_freelist+0x27d6/0x2850
 __alloc_frozen_pages_noprof+0x18d/0x380
 alloc_pages_mpol+0xd1/0x380
 ___kmalloc_large_node+0x4e/0x120
 __kmalloc_large_noprof+0x1a/0x90
 em28xx_v4l2_init+0xe0/0x3320
 em28xx_init_extension+0x120/0x1c0
 process_one_work+0x98b/0x1630
 worker_thread+0xb49/0x1140
 kthread+0x388/0x470
 ret_from_fork+0x514/0xb70
 ret_from_fork_asm+0x1a/0x30
page last free pid 32 tgid 32 stack trace:
 __free_frozen_pages+0x1075/0x11b0
 em28xx_v4l2_init+0x18e9/0x3320
 em28xx_init_extension+0x120/0x1c0
 process_one_work+0x98b/0x1630
 worker_thread+0xb49/0x1140
 kthread+0x388/0x470
 ret_from_fork+0x514/0xb70
 ret_from_fork_asm+0x1a/0x30

Memory state around the buggy address:
 ffff8881707e8880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8881707e8900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8881707e8980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                 ^
 ffff8881707e8a00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8881707e8a80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
