syzbot

==================================================================
BUG: KASAN: use-after-free in constant_test_bit arch/x86/include/asm/bitops.h:311 [inline]
BUG: KASAN: use-after-free in fuse_dev_do_read.isra.29.constprop.34+0x10c7/0x1220 fs/fuse/dev.c:1303
Read of size 8 at addr ffff8801d06e0278 by task syz-executor209/8903

CPU: 0 PID: 8903 Comm: syz-executor209 Not tainted 4.9.113-g47bbcd6 #10
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801cf7e7968 ffffffff81eb32a9 ffffea000741b800 ffff8801d06e0278
 0000000000000000 ffff8801d06e0278 ffff8801b84aab40 ffff8801cf7e79a0
 ffffffff81567bd9 ffff8801d06e0278 0000000000000008 0000000000000000
Call Trace:
 [<ffffffff81eb32a9>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81eb32a9>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81567bd9>] print_address_description+0x6c/0x234 mm/kasan/report.c:256
 [<ffffffff81567fe3>] kasan_report_error mm/kasan/report.c:355 [inline]
 [<ffffffff81567fe3>] kasan_report.cold.6+0x242/0x2fe mm/kasan/report.c:412
 [<ffffffff8153bc34>] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
 [<ffffffff81911917>] constant_test_bit arch/x86/include/asm/bitops.h:311 [inline]
 [<ffffffff81911917>] fuse_dev_do_read.isra.29.constprop.34+0x10c7/0x1220 fs/fuse/dev.c:1303
 [<ffffffff81911bce>] fuse_dev_read+0x15e/0x1f0 fs/fuse/dev.c:1345
 [<ffffffff815711bd>] new_sync_read fs/read_write.c:439 [inline]
 [<ffffffff815711bd>] __vfs_read+0x3dd/0x570 fs/read_write.c:451
 [<ffffffff815726c0>] vfs_read+0x120/0x380 fs/read_write.c:472
 [<ffffffff81576719>] SYSC_read fs/read_write.c:588 [inline]
 [<ffffffff81576719>] SyS_read+0xd9/0x1c0 fs/read_write.c:581
 [<ffffffff81006316>] do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
 [<ffffffff839f9f93>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Allocated by task 8903:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:505
 set_track mm/kasan/kasan.c:517 [inline]
 kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:609
 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:547
 slab_post_alloc_hook mm/slab.h:417 [inline]
 slab_alloc_node mm/slub.c:2715 [inline]
 slab_alloc mm/slub.c:2723 [inline]
 kmem_cache_alloc+0xbe/0x290 mm/slub.c:2728
 __fuse_request_alloc+0x27/0xe0 fs/fuse/dev.c:58
 fuse_request_alloc+0x18/0x20 fs/fuse/dev.c:86
 fuse_fill_super+0xcd3/0x1550 fs/fuse/inode.c:1141
 mount_nodev+0x5b/0x100 fs/super.c:1146
 fuse_mount+0x2c/0x40 fs/fuse/inode.c:1198
 mount_fs+0x28c/0x370 fs/super.c:1206
 vfs_kern_mount.part.29+0xd1/0x3d0 fs/namespace.c:991
 vfs_kern_mount fs/namespace.c:973 [inline]
 do_new_mount fs/namespace.c:2513 [inline]
 do_mount+0x3c9/0x2740 fs/namespace.c:2835
 SYSC_mount fs/namespace.c:3051 [inline]
 SyS_mount+0xfe/0x110 fs/namespace.c:3028
 do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
 entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Freed by task 8918:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:505
 set_track mm/kasan/kasan.c:517 [inline]
 kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:582
 slab_free_hook mm/slub.c:1355 [inline]
 slab_free_freelist_hook mm/slub.c:1377 [inline]
 slab_free mm/slub.c:2958 [inline]
 kmem_cache_free+0xbe/0x310 mm/slub.c:2980
 fuse_request_free+0x8b/0xa0 fs/fuse/dev.c:101
 fuse_put_request+0x259/0x300 fs/fuse/dev.c:288
 request_end+0x183/0x610 fs/fuse/dev.c:398
 fuse_dev_do_write+0x1099/0x20a0 fs/fuse/dev.c:1905
 fuse_dev_write+0x14b/0x1e0 fs/fuse/dev.c:1929
 new_sync_write fs/read_write.c:496 [inline]
 __vfs_write+0x3e0/0x580 fs/read_write.c:509
 vfs_write+0x187/0x530 fs/read_write.c:557
 SYSC_write fs/read_write.c:604 [inline]
 SyS_write+0xd9/0x1c0 fs/read_write.c:596
 do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
 entry_SYSCALL_64_after_swapgs+0x5d/0xdb

The buggy address belongs to the object at ffff8801d06e0248
 which belongs to the cache fuse_request of size 456
The buggy address is located 48 bytes inside of
 456-byte region [ffff8801d06e0248, ffff8801d06e0410)
The buggy address belongs to the page:
page:ffffea000741b800 count:1 mapcount:0 mapping:          (null) index:0x0 compound_mapcount: 0
flags: 0x8000000000004080(slab|head)
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801d06e0100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8801d06e0180: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
>ffff8801d06e0200: fc fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb
                                                                ^
 ffff8801d06e0280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801d06e0300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================