em28xx 2-1:0.132: Closing input extension
==================================================================
BUG: KFENCE: use-after-free read in media_devnode_unregister+0x92/0xf0

Use-after-free read at 0xffff888136598cf0 (in kfence-#203):
 media_devnode_unregister+0x92/0xf0
 media_device_unregister+0x37c/0x400
 em28xx_release_resources+0xac/0x240
 em28xx_usb_disconnect+0x19f/0x2f0
 usb_unbind_interface+0x26e/0x910
 device_release_driver_internal+0x4d9/0x800
 bus_remove_device+0x34d/0x410
 device_del+0x511/0x8e0
 usb_disable_device+0x3e9/0x8a0
 usb_disconnect+0x330/0x950
 hub_event+0x1cf5/0x4a20
 process_scheduled_works+0xae1/0x17b0
 worker_thread+0x8a0/0xda0
 kthread+0x711/0x8a0
 ret_from_fork+0x47f/0x820
 ret_from_fork_asm+0x1a/0x30

kfence-#203: 0xffff888136598800-0xffff888136598d07, size=1288, cache=kmalloc-2k

allocated by task 1271 on cpu 1 at 148.733962s (0.143139s ago):
 __media_device_register+0x58/0x280
 em28xx_usb_probe+0x1764/0x2a20
 usb_probe_interface+0x668/0xc30
 really_probe+0x26d/0x9e0
 __driver_probe_device+0x18c/0x2f0
 driver_probe_device+0x4f/0x430
 __device_attach_driver+0x2ce/0x530
 bus_for_each_drv+0x251/0x2e0
 __device_attach+0x2b8/0x400
 bus_probe_device+0x185/0x260
 device_add+0x7b6/0xb50
 usb_set_configuration+0x1a87/0x20e0
 usb_generic_driver_probe+0x8d/0x150
 usb_probe_device+0x1c4/0x390
 really_probe+0x26d/0x9e0
 __driver_probe_device+0x18c/0x2f0
 driver_probe_device+0x4f/0x430
 __device_attach_driver+0x2ce/0x530
 bus_for_each_drv+0x251/0x2e0
 __device_attach+0x2b8/0x400
 bus_probe_device+0x185/0x260
 device_add+0x7b6/0xb50
 usb_new_device+0xa39/0x16f0
 hub_event+0x2958/0x4a20
 process_scheduled_works+0xae1/0x17b0
 worker_thread+0x8a0/0xda0
 kthread+0x711/0x8a0
 ret_from_fork+0x47f/0x820
 ret_from_fork_asm+0x1a/0x30

freed by task 1271 on cpu 1 at 148.828574s (0.109804s ago):
 media_devnode_release+0x61/0xa0
 device_release+0x9c/0x1c0
 kobject_put+0x22b/0x480
 media_devnode_unregister+0x6d/0xf0
 media_device_unregister+0x37c/0x400
 em28xx_release_resources+0xac/0x240
 em28xx_usb_disconnect+0x19f/0x2f0
 usb_unbind_interface+0x26e/0x910
 device_release_driver_internal+0x4d9/0x800
 bus_remove_device+0x34d/0x410
 device_del+0x511/0x8e0
 usb_disable_device+0x3e9/0x8a0
 usb_disconnect+0x330/0x950
 hub_event+0x1cf5/0x4a20
 process_scheduled_works+0xae1/0x17b0
 worker_thread+0x8a0/0xda0
 kthread+0x711/0x8a0
 ret_from_fork+0x47f/0x820
 ret_from_fork_asm+0x1a/0x30

CPU: 1 UID: 0 PID: 1271 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Workqueue: usb_hub_wq hub_event
RIP: 0010:media_devnode_unregister+0x92/0xf0
Code: e8 93 d6 38 fe 48 c7 c7 c0 1a 20 8f 31 f6 e8 b5 21 b9 03 48 81 c3 f0 04 00 00 48 89 d8 48 c1 e8 03 42 0f b6 04 38 84 c0 75 3c <48> 63 1b 8d 43 3f 85 db 0f 49 c3 c1 f8 06 48 98 48 8d 3c c5 c0 81
RSP: 0018:ffffc900078ef328 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888136598cf0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8c036560 RDI: 00000000ffffffff
RBP: 1ffff11022754bee R08: ffffffff8fc3ce37 R09: 1ffffffff1f879c6
R10: dffffc0000000000 R11: fffffbfff1f879c7 R12: ffff8881271d0918
R13: ffff8881271d0918 R14: ffff888136598810 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8881a39ed000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff888136598cf0 CR3: 000000010fc32000 CR4: 00000000000006f0
Call Trace:
 <TASK>
 media_device_unregister+0x37c/0x400
 em28xx_release_resources+0xac/0x240
 em28xx_usb_disconnect+0x19f/0x2f0
 usb_unbind_interface+0x26e/0x910
 device_release_driver_internal+0x4d9/0x800
 bus_remove_device+0x34d/0x410
 device_del+0x511/0x8e0
 usb_disable_device+0x3e9/0x8a0
 usb_disconnect+0x330/0x950
 hub_event+0x1cf5/0x4a20
 process_scheduled_works+0xae1/0x17b0
 worker_thread+0x8a0/0xda0
 kthread+0x711/0x8a0
 ret_from_fork+0x47f/0x820
 ret_from_fork_asm+0x1a/0x30
 </TASK>
==================================================================
