==================================================================
BUG: KASAN: use-after-free in relay_switch_subbuf+0x8be/0x920 kernel/relay.c:755
Read of size 8 at addr ffff8880964a40d8 by task loop5/2139

CPU: 0 PID: 2139 Comm: loop5 Not tainted 4.19.48 #20
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 print_address_description.cold+0x7c/0x20d mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report mm/kasan/report.c:412 [inline]
 kasan_report.cold+0x8c/0x2ba mm/kasan/report.c:396
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
 relay_switch_subbuf+0x8be/0x920 kernel/relay.c:755
 relay_reserve include/linux/relay.h:261 [inline]
 trace_note.isra.0+0x5b8/0x6e0 kernel/trace/blktrace.c:93
 trace_note_tsk kernel/trace/blktrace.c:124 [inline]
 __blk_add_trace+0xb70/0xe10 kernel/trace/blktrace.c:264
 blk_add_trace_rq+0x192/0x210 kernel/trace/blktrace.c:818
 blk_add_trace_rq_complete+0x153/0x1b0 kernel/trace/blktrace.c:847
 trace_block_rq_complete include/trace/events/block.h:116 [inline]
 blk_update_request+0x79d/0xb30 block/blk-core.c:3084
 blk_mq_end_request+0x5b/0x360 block/blk-mq.c:544
 lo_complete_rq+0x219/0x2f0 drivers/block/loop.c:484
 __blk_mq_complete_request block/blk-mq.c:583 [inline]
 blk_mq_complete_request+0x3b6/0x670 block/blk-mq.c:620
 loop_handle_cmd drivers/block/loop.c:1897 [inline]
 loop_queue_work+0x2a5/0x237a drivers/block/loop.c:1906
 kthread_worker_fn+0x2bd/0x7a0 kernel/kthread.c:662
 loop_kthread_worker_fn+0x51/0x60 drivers/block/loop.c:890
 kthread+0x354/0x420 kernel/kthread.c:246
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415

Allocated by task 28078:
 save_stack+0x45/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc mm/kasan/kasan.c:553 [inline]
 kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:531
 kasan_slab_alloc+0xf/0x20 mm/kasan/kasan.c:490
 kmem_cache_alloc+0x12e/0x700 mm/slab.c:3559
 __d_alloc+0x2e/0x9c0 fs/dcache.c:1610
 d_alloc+0x4d/0x280 fs/dcache.c:1694
 d_alloc_parallel+0xf4/0x1bb0 fs/dcache.c:2441
 __lookup_slow+0x1ab/0x500 fs/namei.c:1654
 lookup_slow+0x58/0x80 fs/namei.c:1688
 walk_component+0x747/0x2000 fs/namei.c:1810
 link_path_walk.part.0+0x594/0x1330 fs/namei.c:2138
 link_path_walk fs/namei.c:2072 [inline]
 path_openat+0x1f9/0x4690 fs/namei.c:3533
 do_filp_open+0x1a1/0x280 fs/namei.c:3564
 do_sys_open+0x3fe/0x550 fs/open.c:1069
kobject: 'loop0' (00000000da02abec): fill_kobj_path: path = '/devices/virtual/block/loop0'
 __do_sys_open fs/open.c:1087 [inline]
 __se_sys_open fs/open.c:1082 [inline]
 __x64_sys_open+0x7e/0xc0 fs/open.c:1082
 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 28079:
 save_stack+0x45/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
 __cache_free mm/slab.c:3503 [inline]
 kmem_cache_free+0x86/0x260 mm/slab.c:3765
kobject: 'loop5' (000000007b287e61): kobject_uevent_env
 __d_free+0x20/0x30 fs/dcache.c:257
 __rcu_reclaim kernel/rcu/rcu.h:236 [inline]
 rcu_do_batch kernel/rcu/tree.c:2584 [inline]
 invoke_rcu_callbacks kernel/rcu/tree.c:2897 [inline]
 __rcu_process_callbacks kernel/rcu/tree.c:2864 [inline]
 rcu_process_callbacks+0xba0/0x1a30 kernel/rcu/tree.c:2881
 __do_softirq+0x25c/0x921 kernel/softirq.c:292
kobject: 'loop5' (000000007b287e61): fill_kobj_path: path = '/devices/virtual/block/loop5'

The buggy address belongs to the object at ffff8880964a4080
 which belongs to the cache dentry(17:syz0) of size 288
The buggy address is located 88 bytes inside of
 288-byte region [ffff8880964a4080, ffff8880964a41a0)
The buggy address belongs to the page:
page:ffffea0002592900 count:1 mapcount:0 mapping:ffff88809ac0f840 index:0xffff8880964a4b80
flags: 0x1fffc0000000100(slab)
raw: 01fffc0000000100 ffffea00023d7b08 ffffea00008c5688 ffff88809ac0f840
raw: ffff8880964a4b80 ffff8880964a4080 0000000100000009 ffff88806d11ccc0
page dumped because: kasan: bad access detected
page->mem_cgroup:ffff88806d11ccc0

Memory state around the buggy address:
 ffff8880964a3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8880964a4000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8880964a4080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                    ^
 ffff8880964a4100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880964a4180: fb fb fb fb fc fc fc fc fc fc fc fc fb fb fb fb
kobject: 'loop4' (0000000081e29d82): kobject_uevent_env
==================================================================