syzbot

==================================================================
BUG: KASAN: use-after-free in constant_test_bit arch/x86/include/asm/bitops.h:311 [inline]
BUG: KASAN: use-after-free in buffer_locked include/linux/buffer_head.h:119 [inline]
BUG: KASAN: use-after-free in wait_on_buffer include/linux/buffer_head.h:346 [inline]
BUG: KASAN: use-after-free in jbd2_log_do_checkpoint+0xe1a/0xed0 fs/jbd2/checkpoint.c:341
Read of size 8 at addr ffff8801989372a0 by task syz-executor2/20870

CPU: 1 PID: 20870 Comm: syz-executor2 Not tainted 4.9.130+ #46
 ffff8801cec4f8a0 ffffffff81b36c89 ffffea0006624dc0 ffff8801989372a0
 0000000000000000 ffff8801989372a0 ffff8801d43e7200 ffff8801cec4f8d8
 ffffffff8150080d ffff8801989372a0 0000000000000008 0000000000000000
Call Trace:
 [<ffffffff81b36c89>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81b36c89>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff8150080d>] print_address_description+0x6c/0x234 mm/kasan/report.c:256
 [<ffffffff81500c17>] kasan_report_error mm/kasan/report.c:355 [inline]
 [<ffffffff81500c17>] kasan_report.cold.6+0x242/0x2fe mm/kasan/report.c:412
 [<ffffffff814f2e24>] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
 [<ffffffff817fbf1a>] constant_test_bit arch/x86/include/asm/bitops.h:311 [inline]
 [<ffffffff817fbf1a>] buffer_locked include/linux/buffer_head.h:119 [inline]
 [<ffffffff817fbf1a>] wait_on_buffer include/linux/buffer_head.h:346 [inline]
 [<ffffffff817fbf1a>] jbd2_log_do_checkpoint+0xe1a/0xed0 fs/jbd2/checkpoint.c:341
 [<ffffffff8180d9d6>] jbd2_journal_flush+0x156/0x4f0 fs/jbd2/journal.c:1974
 [<ffffffff816ec308>] ext4_ioctl+0x15e8/0x3620 fs/ext4/ioctl.c:634
 [<ffffffff81546c3c>] vfs_ioctl fs/ioctl.c:43 [inline]
 [<ffffffff81546c3c>] file_ioctl fs/ioctl.c:493 [inline]
 [<ffffffff81546c3c>] do_vfs_ioctl+0x1ac/0x11a0 fs/ioctl.c:677
 [<ffffffff81547cbf>] SYSC_ioctl fs/ioctl.c:694 [inline]
 [<ffffffff81547cbf>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
 [<ffffffff810056ef>] do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
 [<ffffffff82803013>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Allocated by task 20821:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack mm/kasan/kasan.c:505 [inline]
 set_track mm/kasan/kasan.c:517 [inline]
 kasan_kmalloc.part.1+0x62/0xf0 mm/kasan/kasan.c:609
 kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:594
 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:547
 slab_post_alloc_hook mm/slab.h:417 [inline]
 slab_alloc_node mm/slub.c:2715 [inline]
 slab_alloc mm/slub.c:2723 [inline]
 kmem_cache_alloc+0xd5/0x2b0 mm/slub.c:2728
 kmem_cache_zalloc include/linux/slab.h:626 [inline]
 alloc_buffer_head+0x22/0xd0 fs/buffer.c:3383
 alloc_page_buffers+0xb7/0x200 fs/buffer.c:875
 create_empty_buffers+0x39/0x470 fs/buffer.c:1582
 create_page_buffers+0x154/0x1c0 fs/buffer.c:1657
 __block_write_begin_int+0x1b1/0x1020 fs/buffer.c:1966
 __block_write_begin+0x30/0x40 fs/buffer.c:2038
 ext4_write_begin+0x4ac/0x1400 fs/ext4/inode.c:1259
 generic_perform_write+0x28a/0x500 mm/filemap.c:2753
 __generic_file_write_iter+0x352/0x540 mm/filemap.c:2878
 ext4_file_write_iter+0x63d/0xd70 fs/ext4/file.c:165
 aio_write+0x2f2/0x510 fs/aio.c:1505
 io_submit_one fs/aio.c:1586 [inline]
 do_io_submit+0xd35/0x1080 fs/aio.c:1654
 SYSC_io_submit fs/aio.c:1679 [inline]
 SyS_io_submit+0x27/0x30 fs/aio.c:1676
 do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
 entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Freed by task 20827:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack mm/kasan/kasan.c:505 [inline]
 set_track mm/kasan/kasan.c:517 [inline]
 kasan_slab_free+0xac/0x190 mm/kasan/kasan.c:582
 slab_free_hook mm/slub.c:1355 [inline]
 slab_free_freelist_hook mm/slub.c:1377 [inline]
 slab_free mm/slub.c:2958 [inline]
 kmem_cache_free+0xbe/0x310 mm/slub.c:2980
 free_buffer_head+0x47/0xb0 fs/buffer.c:3398
 try_to_free_buffers+0x1aa/0x290 fs/buffer.c:3313
 jbd2_journal_invalidatepage+0x717/0x970 fs/jbd2/transaction.c:2319
 __ext4_journalled_invalidatepage+0x155/0x410 fs/ext4/inode.c:3283
 ext4_journalled_invalidatepage+0x25/0x50 fs/ext4/inode.c:3291
 do_invalidatepage mm/truncate.c:99 [inline]
 truncate_complete_page mm/truncate.c:119 [inline]
 truncate_inode_page+0x125/0x260 mm/truncate.c:167
 truncate_inode_pages_range+0x2be/0x1060 mm/truncate.c:291
 truncate_inode_pages mm/truncate.c:401 [inline]
 truncate_pagecache+0x66/0x90 mm/truncate.c:706
 ext4_setattr+0x14ef/0x2170 fs/ext4/inode.c:5301
 notify_change2+0xad7/0xe00 fs/attr.c:313
 do_truncate2+0x13d/0x1f0 fs/open.c:63
 handle_truncate fs/namei.c:2990 [inline]
 do_last fs/namei.c:3419 [inline]
 path_openat+0xb86/0x2790 fs/namei.c:3534
 do_filp_open+0x197/0x270 fs/namei.c:3568
 do_sys_open+0x30d/0x5c0 fs/open.c:1072
 SYSC_open fs/open.c:1090 [inline]
 SyS_open fs/open.c:1085 [inline]
 SYSC_creat fs/open.c:1110 [inline]
 SyS_creat+0x27/0x30 fs/open.c:1108
 do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
 entry_SYSCALL_64_after_swapgs+0x5d/0xdb

The buggy address belongs to the object at ffff8801989372a0
 which belongs to the cache buffer_head of size 104
The buggy address is located 0 bytes inside of
 104-byte region [ffff8801989372a0, ffff880198937308)
The buggy address belongs to the page:
page:ffffea0006624dc0 count:1 mapcount:0 mapping:          (null) index:0x0
flags: 0x4000000000000080(slab)
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff880198937180: fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc fb
 ffff880198937200: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
>ffff880198937280: fc fc fc fc fb fb fb fb fb fb fb fb fb fb fb fb
                               ^
 ffff880198937300: fb fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb
 ffff880198937380: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fb fb
==================================================================