em28xx 2-1:0.0: No AC97 audio processor
usb 2-1: USB disconnect, device number 4
em28xx 2-1:0.0: Disconnecting em28xx
==================================================================
BUG: KFENCE: use-after-free read in media_devnode_unregister+0x92/0xf0

Use-after-free read at 0xffff88813644e4f0 (in kfence-#38):
 media_devnode_unregister+0x92/0xf0
 media_device_unregister+0x37c/0x400
 em28xx_release_resources+0xac/0x240
 em28xx_usb_disconnect+0x19f/0x2f0
 usb_unbind_interface+0x26e/0x910
 device_release_driver_internal+0x4d9/0x800
 bus_remove_device+0x34d/0x410
 device_del+0x511/0x8e0
 usb_disable_device+0x3e9/0x8a0
 usb_disconnect+0x330/0x950
 hub_event+0x1cf5/0x4a20
 process_scheduled_works+0xae1/0x17b0
 worker_thread+0x8a0/0xda0
 kthread+0x711/0x8a0
 ret_from_fork+0x47f/0x820
 ret_from_fork_asm+0x1a/0x30

kfence-#38: 0xffff88813644e000-0xffff88813644e507, size=1288, cache=kmalloc-2k

allocated by task 5918 on cpu 0 at 80.215972s (0.099226s ago):
 __media_device_register+0x58/0x280
 em28xx_usb_probe+0x1764/0x2a20
 usb_probe_interface+0x668/0xc30
 really_probe+0x26d/0x9e0
 __driver_probe_device+0x18c/0x2f0
 driver_probe_device+0x4f/0x430
 __device_attach_driver+0x2ce/0x530
 bus_for_each_drv+0x251/0x2e0
 __device_attach+0x2b8/0x400
 bus_probe_device+0x185/0x260
 device_add+0x7b6/0xb50
 usb_set_configuration+0x1a87/0x20e0
 usb_generic_driver_probe+0x8d/0x150
 usb_probe_device+0x1c4/0x390
 really_probe+0x26d/0x9e0
 __driver_probe_device+0x18c/0x2f0
 driver_probe_device+0x4f/0x430
 __device_attach_driver+0x2ce/0x530
 bus_for_each_drv+0x251/0x2e0
 __device_attach+0x2b8/0x400
 bus_probe_device+0x185/0x260
 device_add+0x7b6/0xb50
 usb_new_device+0xa39/0x16f0
 hub_event+0x2958/0x4a20
 process_scheduled_works+0xae1/0x17b0
 worker_thread+0x8a0/0xda0
 kthread+0x711/0x8a0
 ret_from_fork+0x47f/0x820
 ret_from_fork_asm+0x1a/0x30

freed by task 5918 on cpu 0 at 80.265140s (0.112102s ago):
 media_devnode_release+0x61/0xa0
 device_release+0x9c/0x1c0
 kobject_put+0x22b/0x480
 media_devnode_unregister+0x6d/0xf0
 media_device_unregister+0x37c/0x400
 em28xx_release_resources+0xac/0x240
 em28xx_usb_disconnect+0x19f/0x2f0
 usb_unbind_interface+0x26e/0x910
 device_release_driver_internal+0x4d9/0x800
 bus_remove_device+0x34d/0x410
 device_del+0x511/0x8e0
 usb_disable_device+0x3e9/0x8a0
 usb_disconnect+0x330/0x950
 hub_event+0x1cf5/0x4a20
 process_scheduled_works+0xae1/0x17b0
 worker_thread+0x8a0/0xda0
 kthread+0x711/0x8a0
 ret_from_fork+0x47f/0x820
 ret_from_fork_asm+0x1a/0x30

CPU: 0 UID: 0 PID: 5918 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Workqueue: usb_hub_wq hub_event
RIP: 0010:media_devnode_unregister+0x92/0xf0
Code: e8 f3 e5 38 fe 48 c7 c7 60 13 20 8f 31 f6 e8 75 d8 b8 03 48 81 c3 f0 04 00 00 48 89 d8 48 c1 e8 03 42 0f b6 04 38 84 c0 75 3c <48> 63 1b 8d 43 3f 85 db 0f 49 c3 c1 f8 06 48 98 48 8d 3c c5 a0 41
RSP: 0018:ffffc90003d9f328 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff88813644e4f0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8c035de0 RDI: 00000000ffffffff
RBP: 1ffff1100517fbee R08: ffffffff8fc3c837 R09: 1ffffffff1f87906
R10: dffffc0000000000 R11: fffffbfff1f87907 R12: ffff888034926118
R13: ffff888034926118 R14: ffff88813644e010 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880b83f1000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88813644e4f0 CR3: 0000000032c06000 CR4: 00000000000006f0
Call Trace:
 <TASK>
 media_device_unregister+0x37c/0x400
 em28xx_release_resources+0xac/0x240
 em28xx_usb_disconnect+0x19f/0x2f0
 usb_unbind_interface+0x26e/0x910
 device_release_driver_internal+0x4d9/0x800
 bus_remove_device+0x34d/0x410
 device_del+0x511/0x8e0
 usb_disable_device+0x3e9/0x8a0
 usb_disconnect+0x330/0x950
 hub_event+0x1cf5/0x4a20
 process_scheduled_works+0xae1/0x17b0
 worker_thread+0x8a0/0xda0
 kthread+0x711/0x8a0
 ret_from_fork+0x47f/0x820
 ret_from_fork_asm+0x1a/0x30
 </TASK>
==================================================================
