==================================================================
BUG: KASAN: slab-use-after-free in __lock_acquire+0x114/0x763c kernel/locking/lockdep.c:5005
Read of size 8 at addr ffff0000cfe9e390 by task swapper/1/0

CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.8.0-rc2-syzkaller-g41bccc98fb79 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Call trace:
 dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:291
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:298
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0x174/0x514 mm/kasan/report.c:488
 kasan_report+0xd8/0x138 mm/kasan/report.c:601
 __asan_report_load8_noabort+0x20/0x2c mm/kasan/report_generic.c:381
 __lock_acquire+0x114/0x763c kernel/locking/lockdep.c:5005
 lock_acquire+0x23c/0x71c kernel/locking/lockdep.c:5754
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x5c/0x7c kernel/locking/spinlock.c:162
 class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:553 [inline]
 try_to_wake_up+0xb0/0xf2c kernel/sched/core.c:4253
 wake_up_process+0x18/0x24 kernel/sched/core.c:4501
 nilfs_construction_timeout+0x40/0x50 fs/nilfs2/segment.c:2444
 call_timer_fn+0x19c/0x8d4 kernel/time/timer.c:1700
 expire_timers kernel/time/timer.c:1751 [inline]
 __run_timers+0x524/0x6fc kernel/time/timer.c:2038
 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:2051
 __do_softirq+0x2d8/0xce4 kernel/softirq.c:553
 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:81
 call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:889
 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:86
 invoke_softirq kernel/softirq.c:434 [inline]
 __irq_exit_rcu+0x1d8/0x434 kernel/softirq.c:632
 irq_exit_rcu+0x14/0x84 kernel/softirq.c:644
 __el1_irq arch/arm64/kernel/entry-common.c:503 [inline]
 el1_interrupt+0x38/0x68 arch/arm64/kernel/entry-common.c:517
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:522
 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:594
 __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:27 [inline]
 arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:49
 cpuidle_idle_call kernel/sched/idle.c:170 [inline]
 do_idle+0x1f0/0x4e8 kernel/sched/idle.c:312
 cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:410
 secondary_start_kernel+0x198/0x1c0 arch/arm64/kernel/smp.c:272
 __secondary_switched+0xb8/0xbc arch/arm64/kernel/head.S:681

Allocated by task 6508:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x40/0x78 mm/kasan/common.c:68
 kasan_save_alloc_info+0x70/0x84 mm/kasan/generic.c:626
 poison_kmalloc_redzone mm/kasan/common.c:372 [inline]
 __kasan_kmalloc+0xac/0xc4 mm/kasan/common.c:389
 kasan_kmalloc include/linux/kasan.h:211 [inline]
 __do_kmalloc_node mm/slub.c:3981 [inline]
 __kmalloc+0x2bc/0x5d4 mm/slub.c:3994
 kmalloc include/linux/slab.h:594 [inline]
 tomoyo_realpath_from_path+0xc8/0x4cc security/tomoyo/realpath.c:251
 tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
 tomoyo_check_open_permission+0x1ec/0x414 security/tomoyo/file.c:771
 tomoyo_file_open+0x15c/0x1ec security/tomoyo/tomoyo.c:334
 security_file_open+0x70/0x4d8 security/security.c:2932
 do_dentry_open+0x29c/0x12b4 fs/open.c:940
 vfs_open+0x7c/0x90 fs/open.c:1087
 do_open fs/namei.c:3641 [inline]
 path_openat+0x1f6c/0x2830 fs/namei.c:3798
 do_filp_open+0x1bc/0x3cc fs/namei.c:3825
 do_sys_openat2+0x124/0x1b8 fs/open.c:1404
 do_sys_open fs/open.c:1419 [inline]
 __do_sys_openat fs/open.c:1435 [inline]
 __se_sys_openat fs/open.c:1430 [inline]
 __arm64_sys_openat+0x1f0/0x240 fs/open.c:1430
 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155
 el0_svc+0x54/0x158 arch/arm64/kernel/entry-common.c:678
 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598

Freed by task 6508:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x40/0x78 mm/kasan/common.c:68
 kasan_save_free_info+0x5c/0x74 mm/kasan/generic.c:640
 poison_slab_object+0x120/0x188 mm/kasan/common.c:241
 __kasan_slab_free+0x3c/0x78 mm/kasan/common.c:257
 kasan_slab_free include/linux/kasan.h:184 [inline]
 slab_free_hook mm/slub.c:2121 [inline]
 slab_free mm/slub.c:4299 [inline]
 kfree+0x140/0x3c8 mm/slub.c:4409
 tomoyo_realpath_from_path+0x484/0x4cc security/tomoyo/realpath.c:286
 tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
 tomoyo_check_open_permission+0x1ec/0x414 security/tomoyo/file.c:771
 tomoyo_file_open+0x15c/0x1ec security/tomoyo/tomoyo.c:334
 security_file_open+0x70/0x4d8 security/security.c:2932
 do_dentry_open+0x29c/0x12b4 fs/open.c:940
 vfs_open+0x7c/0x90 fs/open.c:1087
 do_open fs/namei.c:3641 [inline]
 path_openat+0x1f6c/0x2830 fs/namei.c:3798
 do_filp_open+0x1bc/0x3cc fs/namei.c:3825
 do_sys_openat2+0x124/0x1b8 fs/open.c:1404
 do_sys_open fs/open.c:1419 [inline]
 __do_sys_openat fs/open.c:1435 [inline]
 __se_sys_openat fs/open.c:1430 [inline]
 __arm64_sys_openat+0x1f0/0x240 fs/open.c:1430
 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155
 el0_svc+0x54/0x158 arch/arm64/kernel/entry-common.c:678
 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598

The buggy address belongs to the object at ffff0000cfe9e000
 which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 912 bytes inside of
 freed 4096-byte region [ffff0000cfe9e000, ffff0000cfe9f000)

The buggy address belongs to the physical page:
page:00000000fc044d3e refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10fe98
head:00000000fc044d3e order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x5ffc00000000840(slab|head|node=0|zone=2|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 05ffc00000000840 ffff0000c0002140 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000cfe9e280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff0000cfe9e300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff0000cfe9e380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                         ^
 ffff0000cfe9e400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff0000cfe9e480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 1 PID: 0 Comm: swapper/1 Tainted: G    B              6.8.0-rc2-syzkaller-g41bccc98fb79 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Call trace:
 dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:291
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:298
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106
 dump_stack+0x1c/0x28 lib/dump_stack.c:113
 assign_lock_key+0x274/0x2a8 kernel/locking/lockdep.c:976
 register_lock_class+0x144/0x6ac kernel/locking/lockdep.c:1289
 __lock_acquire+0x184/0x763c kernel/locking/lockdep.c:5014
 lock_acquire+0x23c/0x71c kernel/locking/lockdep.c:5754
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x5c/0x7c kernel/locking/spinlock.c:162
 class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:553 [inline]
 try_to_wake_up+0xb0/0xf2c kernel/sched/core.c:4253
 wake_up_process+0x18/0x24 kernel/sched/core.c:4501
 nilfs_construction_timeout+0x40/0x50 fs/nilfs2/segment.c:2444
 call_timer_fn+0x19c/0x8d4 kernel/time/timer.c:1700
 expire_timers kernel/time/timer.c:1751 [inline]
 __run_timers+0x524/0x6fc kernel/time/timer.c:2038
 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:2051
 __do_softirq+0x2d8/0xce4 kernel/softirq.c:553
 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:81
 call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:889
 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:86
 invoke_softirq kernel/softirq.c:434 [inline]
 __irq_exit_rcu+0x1d8/0x434 kernel/softirq.c:632
 irq_exit_rcu+0x14/0x84 kernel/softirq.c:644
 __el1_irq arch/arm64/kernel/entry-common.c:503 [inline]
 el1_interrupt+0x38/0x68 arch/arm64/kernel/entry-common.c:517
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:522
 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:594
 __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:27 [inline]
 arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:49
 cpuidle_idle_call kernel/sched/idle.c:170 [inline]
 do_idle+0x1f0/0x4e8 kernel/sched/idle.c:312
 cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:410
 secondary_start_kernel+0x198/0x1c0 arch/arm64/kernel/smp.c:272
 __secondary_switched+0xb8/0xbc arch/arm64/kernel/head.S:681