Hi!
I've got the following report while fuzzing the kernel with syzkaller.
On commit 3a99df9a3d14cd866b5516f8cba515a3bfd554ab (4.14-rc7+).
em28xx 1-1:2.0: New device a @ 480 Mbps (eb1a:2801, interface 0, class 0)
em28xx 1-1:2.0: Audio interface 0 found (Vendor Class)
em28xx 1-1:2.0: chip ID is em2860
em28xx 1-1:2.0: Config register raw data: 0x22
em28xx 1-1:2.0: I2S Audio (3 sample rate(s))
em28xx 1-1:2.0: No AC97 audio processor
em28xx 1-1:2.0: Binding audio extension
em28xx 1-1:2.0: em28xx-audio.c: Copyright (C) 2006 Markus Rechberger
em28xx 1-1:2.0: em28xx-audio.c: Copyright (C) 2007-2016 Mauro Carvalho Chehab
em28xx 1-1:2.0: alt 0 doesn't exist on interface 7
usb 1-1: USB disconnect, device number 2
em28xx 1-1:2.0: Disconnecting
em28xx 1-1:2.0: Closing audio extension
em28xx 1-1:2.0: Freeing device
==================================================================
BUG: KASAN: use-after-free in em28xx_dvb_fini+0x74b/0x8e0
Read of size 1 at addr ffff880069d2c12c by task kworker/0:1/24
CPU: 0 PID: 24 Comm: kworker/0:1 Not tainted
4.14.0-rc7-44290-gf28444df2601-dirty #52
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack lib/dump_stack.c:16
dump_stack+0xe1/0x157 lib/dump_stack.c:52
print_address_description+0x71/0x234 mm/kasan/report.c:252
kasan_report_error mm/kasan/report.c:351
kasan_report+0x173/0x270 mm/kasan/report.c:409
__asan_report_load1_noabort+0x19/0x20 mm/kasan/report.c:427
em28xx_dvb_fini+0x74b/0x8e0 drivers/media/usb/em28xx/em28xx-dvb.c:2076
em28xx_close_extension+0x71/0x220 drivers/media/usb/em28xx/em28xx-core.c:1122
em28xx_usb_disconnect+0xd7/0x140 drivers/media/usb/em28xx/em28xx-cards.c:3763
usb_unbind_interface+0x1b6/0x950 drivers/usb/core/driver.c:423
__device_release_driver drivers/base/dd.c:861
device_release_driver_internal+0x529/0x5f0 drivers/base/dd.c:893
device_release_driver+0x1e/0x30 drivers/base/dd.c:918
bus_remove_device+0x2fc/0x4b0 drivers/base/bus.c:565
device_del+0x591/0xa70 drivers/base/core.c:1985
usb_disable_device+0x223/0x710 drivers/usb/core/message.c:1170
usb_disconnect+0x285/0x7f0 drivers/usb/core/hub.c:2205
hub_port_connect drivers/usb/core/hub.c:4838
hub_port_connect_change drivers/usb/core/hub.c:5093
port_event drivers/usb/core/hub.c:5199
hub_event_impl+0x10ec/0x3440 drivers/usb/core/hub.c:5311
hub_event+0x38/0x50 drivers/usb/core/hub.c:5209
process_one_work+0x925/0x15d0 kernel/workqueue.c:2113
worker_thread+0xef/0x10d0 kernel/workqueue.c:2247
kthread+0x346/0x410 kernel/kthread.c:231
ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431
The buggy address belongs to the page:
page:ffffea0001a74b00 count:0 mapcount:-127 mapping: (null) index:0x0
flags: 0x100000000000000()
raw: 0100000000000000 0000000000000000 0000000000000000 00000000ffffff80
raw: ffffea00019f0320 ffff88007fffa690 0000000000000002 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff880069d2c000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff880069d2c080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff880069d2c100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff880069d2c180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff880069d2c200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
