TITLE: KASAN: use-after-free Read in usbvision_release
ALT: bad-access in usbvision_release
TYPE: KASAN-USE-AFTER-FREE-READ

[  472.680102][ T9268] ==================================================================
[  472.689737][ T9268] BUG: KASAN: use-after-free in sysfs_remove_file_ns+0x5f/0x70
[  472.697269][ T9268] Read of size 8 at addr ffff8881d53ec5c0 by task v4l_id/9268
[  472.704705][ T9268]
[  472.707042][ T9268] CPU: 1 PID: 9268 Comm: v4l_id Not tainted 5.3.0-rc7+ #0
[  472.714167][ T9268] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  472.724226][ T9268] Call Trace:
[  472.727595][ T9268]  dump_stack+0xca/0x13e
[  472.731846][ T9268]  ? sysfs_remove_file_ns+0x5f/0x70
[  472.737047][ T9268]  ? sysfs_remove_file_ns+0x5f/0x70
[  472.742424][ T9268]  print_address_description+0x6a/0x32c
[  472.747986][ T9268]  ? sysfs_remove_file_ns+0x5f/0x70
[  472.753193][ T9268]  ? sysfs_remove_file_ns+0x5f/0x70
[  472.758401][ T9268]  __kasan_report.cold+0x1a/0x33
[  472.763349][ T9268]  ? sysfs_remove_file_ns+0x5f/0x70
[  472.768550][ T9268]  kasan_report+0xe/0x12
[  472.772798][ T9268]  sysfs_remove_file_ns+0x5f/0x70
[  472.777900][ T9268]  device_remove_file+0x25/0x30
[  472.782796][ T9268]  usbvision_release+0x97/0x1c0
[  472.787651][ T9268]  usbvision_radio_close.cold+0x6f/0x74
[  472.793199][ T9268]  ? usbvision_disconnect+0x1d0/0x1d0
[  472.798643][ T9268]  v4l2_release+0x2e7/0x390
[  472.803154][ T9268]  ? dev_debug_store+0x100/0x100
[  472.808140][ T9268]  __fput+0x2d7/0x840
[  472.812127][ T9268]  task_work_run+0x13f/0x1c0
[  472.816718][ T9268]  exit_to_usermode_loop+0x1d2/0x200
[  472.822007][ T9268]  do_syscall_64+0x45f/0x580
[  472.826662][ T9268]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  472.832558][ T9268] RIP: 0033:0x7f09895112b0
[  472.836981][ T9268] Code: 40 75 0b 31 c0 48 83 c4 08 e9 0c ff ff ff 48 8d 3d c5 32 08 00 e8 c0 07 02 00 83 3d 45 a3 2b 00 00 75 10 b8 03 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 ce 8a 01 00 48 89 04 24
[  472.856593][ T9268] RSP: 002b:00007ffd9be4b9e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
[  472.865009][ T9268] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00007f09895112b0
[  472.872994][ T9268] RDX: 00007f09897c7df0 RSI: 0000000000000001 RDI: 0000000000000003
[  472.880969][ T9268] RBP: 0000000000000000 R08: 00007f09897c7df0 R09: 000000000000000a
[  472.888965][ T9268] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000400884
[  472.897029][ T9268] R13: 00007ffd9be4bb40 R14: 0000000000000000 R15: 0000000000000000
[  472.905001][ T9268]
[  472.907342][ T9268] Allocated by task 2747:
[  472.911675][ T9268]  save_stack+0x1b/0x80
[  472.915833][ T9268]  __kasan_kmalloc.constprop.0+0xbf/0xd0
[  472.921466][ T9268]  usbvision_probe.cold+0x586/0x1e57
[  472.926853][ T9268]  usb_probe_interface+0x305/0x7a0
[  472.932021][ T9268]  really_probe+0x281/0x6d0
[  472.936532][ T9268]  driver_probe_device+0x101/0x1b0
[  472.941646][ T9268]  __device_attach_driver+0x1c2/0x220
[  472.947021][ T9268]  bus_for_each_drv+0x162/0x1e0
[  472.951873][ T9268]  __device_attach+0x217/0x360
[  472.956635][ T9268]  bus_probe_device+0x1e4/0x290
[  472.961480][ T9268]  device_add+0xae6/0x16f0
[  472.965956][ T9268]  usb_set_configuration+0xdf6/0x1670
[  472.971375][ T9268]  generic_probe+0x9d/0xd5
[  472.975808][ T9268]  usb_probe_device+0x99/0x100
[  472.980569][ T9268]  really_probe+0x281/0x6d0
[  472.985075][ T9268]  driver_probe_device+0x101/0x1b0
[  472.990272][ T9268]  __device_attach_driver+0x1c2/0x220
[  472.995641][ T9268]  bus_for_each_drv+0x162/0x1e0
[  473.000489][ T9268]  __device_attach+0x217/0x360
[  473.005250][ T9268]  bus_probe_device+0x1e4/0x290
[  473.010101][ T9268]  device_add+0xae6/0x16f0
[  473.014521][ T9268]  usb_new_device.cold+0x6a4/0xe79
[  473.019635][ T9268]  hub_event+0x1b5c/0x3640
[  473.024050][ T9268]  process_one_work+0x92b/0x1530
[  473.028985][ T9268]  worker_thread+0x96/0xe20
[  473.033492][ T9268]  kthread+0x318/0x420
[  473.037558][ T9268]  ret_from_fork+0x24/0x30
[  473.041964][ T9268]
[  473.044289][ T9268] Freed by task 2943:
[  473.048268][ T9268]  save_stack+0x1b/0x80
[  473.052423][ T9268]  __kasan_slab_free+0x130/0x180
[  473.057361][ T9268]  kfree+0xe4/0x2f0
[  473.061170][ T9268]  usbvision_release+0x181/0x1c0
[  473.066104][ T9268]  usbvision_disconnect+0x16c/0x1d0
[  473.071300][ T9268]  usb_unbind_interface+0x1bd/0x8a0
[  473.076501][ T9268]  device_release_driver_internal+0x42f/0x500
[  473.082567][ T9268]  bus_remove_device+0x2dc/0x4a0
[  473.087500][ T9268]  device_del+0x420/0xb10
[  473.091843][ T9268]  usb_disable_device+0x211/0x690
[  473.096867][ T9268]  usb_disconnect+0x284/0x8d0
[  473.101554][ T9268]  hub_event+0x1454/0x3640
[  473.106000][ T9268]  process_one_work+0x92b/0x1530
[  473.110940][ T9268]  worker_thread+0x96/0xe20
[  473.115446][ T9268]  kthread+0x318/0x420
[  473.119514][ T9268]  ret_from_fork+0x24/0x30
[  473.123918][ T9268]
[  473.126269][ T9268] The buggy address belongs to the object at ffff8881d53ec200
[  473.126269][ T9268]  which belongs to the cache kmalloc-8k of size 8192
[  473.140316][ T9268] The buggy address is located 960 bytes inside of
[  473.140316][ T9268]  8192-byte region [ffff8881d53ec200, ffff8881d53ee200)
[  473.153655][ T9268] The buggy address belongs to the page:
[  473.159409][ T9268] page:ffffea000754fa00 refcount:1 mapcount:0 mapping:ffff8881da00c500 index:0x0 compound_mapcount: 0
[  473.170434][ T9268] flags: 0x200000000010200(slab|head)
[  473.175813][ T9268] raw: 0200000000010200 0000000000000000 0000000100000001 ffff8881da00c500
[  473.184643][ T9268] raw: 0000000000000000 0000000080030003 00000001ffffffff 0000000000000000
[  473.193209][ T9268] page dumped because: kasan: bad access detected
[  473.199599][ T9268]
[  473.201910][ T9268] Memory state around the buggy address:
[  473.207527][ T9268]  ffff8881d53ec480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  473.215575][ T9268]  ffff8881d53ec500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  473.223641][ T9268] >ffff8881d53ec580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  473.233156][ T9268]                                            ^
[  473.239291][ T9268]  ffff8881d53ec600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  473.247344][ T9268]  ffff8881d53ec680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  473.255385][ T9268] ==================================================================
