[BUG] drivers/media: out-of-bounds in usbtv_iso_cb()

[co]

This is a bug report, not a patch submission.

We found a bug reachable in:

    path    drivers/media/usb/usbtv
    crash   out-of-bounds in usbtv_iso_cb()
    commit  2f1baf1fc892 ("Merge tag 'trace-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace")

Config, environment, the sanitizer report and a C reproducer follow.

== Notes ===============================================================
    If you fix this bug, this tag credits the report and lets us
    close it on our side:

Reported-by: co+f11f93b386afda5d@xxxxxxx

    Everything in this mail is validated by the reproducer below.

    We also hold an unreviewed LLM-generated analysis and candidate
    patch. The same reproducer panics the unpatched kernel and runs
    clean with that patch applied. Use it as a starting point, or ignore
    it and write your own:

        patch.diff  https://bugs.sh/b/f11f93b386afda5d/patch.diff
        report.md   https://bugs.sh/b/f11f93b386afda5d/report.md

    Happy to test patches. Complaints and suggestions about our work
    are welcome at:

        cedalion@xxxxxxx

== Environment =========================================================
    Reproduced on  2f1baf1fc892 ("Merge tag 'trace-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace")
    VM setup       https://bugs.sh/b/f11f93b386afda5d/run.sh
    config         https://bugs.sh/b/f11f93b386afda5d/config.gz
    poc            https://bugs.sh/b/f11f93b386afda5d/repro.c

== Sanitizer Report ====================================================
BUG: KASAN: slab-out-of-bounds in usbtv_iso_cb (drivers/media/usb/usbtv/usbtv-video.c:390 (discriminator 6) drivers/media/usb/usbtv/usbtv-video.c:435 (discriminator 6) drivers/media/usb/usbtv/usbtv-video.c:492 (discriminator 6))
Read of size 480 at addr ffff88802d529e5c by task vhci_rx/5017
Call Trace:
dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
kasan_report (mm/kasan/report.c:595)
kasan_check_range (mm/kasan/generic.c:186 mm/kasan/generic.c:200)
__asan_memcpy (mm/kasan/shadow.c:105 (discriminator 1))
usbtv_iso_cb (drivers/media/usb/usbtv/usbtv-video.c:390 (discriminator 6) drivers/media/usb/usbtv/usbtv-video.c:435 (discriminator 6) drivers/media/usb/usbtv/usbtv-video.c:492 (discriminator 6))
__usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1657)
usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1741)
vhci_rx_loop (drivers/usb/usbip/vhci_rx.c:107 (discriminator 1) drivers/usb/usbip/vhci_rx.c:242 (discriminator 1) drivers/usb/usbip/vhci_rx.c:265 (discriminator 1))
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
Allocated by task 5013:
kasan_save_stack (mm/kasan/common.c:57)
kasan_save_track (mm/kasan/common.c:78)
__kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)
__kmalloc_noprof (./include/linux/kasan.h:263 mm/slub.c:5414 mm/slub.c:5439)
usbtv_start_streaming (./include/linux/slab.h:995 ./include/linux/slab.h:1211 drivers/media/usb/usbtv/usbtv-video.c:517 drivers/media/usb/usbtv/usbtv-video.c:586 drivers/media/usb/usbtv/usbtv-video.c:771)
vb2_start_streaming (drivers/media/common/videobuf2/videobuf2-core.c:1783 (discriminator 1))
vb2_core_streamon (drivers/media/common/videobuf2/videobuf2-core.c:2336)
vb2_ioctl_streamon (drivers/media/common/videobuf2/videobuf2-v4l2.c:862 drivers/media/common/videobuf2/videobuf2-v4l2.c:1105)
__video_do_ioctl (drivers/media/v4l2-core/v4l2-ioctl.c:3135)
video_usercopy (drivers/media/v4l2-core/v4l2-ioctl.c:3477)
v4l2_ioctl (drivers/media/v4l2-core/v4l2-dev.c:366)
__x64_sys_ioctl (fs/ioctl.c:51 fs/ioctl.c:597 fs/ioctl.c:583 fs/ioctl.c:583)
do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
The buggy address belongs to the object at ffff88802d528000
which belongs to the cache kmalloc-8k of size 8192
The buggy address is located 7772 bytes inside of
allocated 8000-byte region [ffff88802d528000, ffff88802d529f40)


---
The report format is based on syzbot bug report.

This report is generated by a bot. It may contain errors.
See https://github.com/n132/cedalion for more information.

For any issue with this report, reach out to cedalion@xxxxxxx

If the report is already addressed, let us know by replying with:
#co fix: <commit hash>

If the report is a duplicate of another one, reply with:
#co dup: <lore link>

If you want to undo deduplication, reply with:
#co undup