==================================================================
BUG: KASAN: use-after-free in rose_get_neigh+0x17e/0x550 net/rose/rose_route.c:692
Read of size 1 at addr ffff888142ff8c30 by task syz.0.2572/12139

CPU: 0 PID: 12139 Comm: syz.0.2572 Not tainted 6.1.135-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x168/0x22e lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:316 [inline]
 print_report+0xa8/0x220 mm/kasan/report.c:427
 kasan_report+0x10b/0x140 mm/kasan/report.c:531
 rose_get_neigh+0x17e/0x550 net/rose/rose_route.c:692
 rose_connect+0x412/0x1380 net/rose/af_rose.c:816
 __sys_connect_file net/socket.c:2011 [inline]
 __sys_connect+0x389/0x410 net/socket.c:2028
 __do_sys_connect net/socket.c:2038 [inline]
 __se_sys_connect net/socket.c:2035 [inline]
 __x64_sys_connect+0x76/0x80 net/socket.c:2035
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f36a578e969
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f36a6598038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a
RAX: ffffffffffffffda RBX: 00007f36a59b5fa0 RCX: 00007f36a578e969
RDX: 000000000000001c RSI: 0000200000000040 RDI: 0000000000000005
RBP: 00007f36a5810ab1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f36a59b5fa0 R15: 00007ffc92458f88
 </TASK>

Allocated by task 4393:
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:52
 ____kasan_kmalloc mm/kasan/common.c:374 [inline]
 __kasan_kmalloc+0x8e/0xa0 mm/kasan/common.c:383
 kmalloc include/linux/slab.h:563 [inline]
 rose_add_node+0x227/0xdb0 net/rose/rose_route.c:85
 rose_rt_ioctl+0xa4c/0xe90 net/rose/rose_route.c:747
 rose_ioctl+0x27a/0x790 net/rose/af_rose.c:1380
 sock_do_ioctl+0xd3/0x2f0 net/socket.c:1204
 sock_ioctl+0x4ed/0x6e0 net/socket.c:1321
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:870 [inline]
 __se_sys_ioctl+0xfa/0x170 fs/ioctl.c:856
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

The buggy address belongs to the object at ffff888142ff8c00
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 48 bytes inside of
 512-byte region [ffff888142ff8c00, ffff888142ff8e00)

The buggy address belongs to the physical page:
page:ffffea00050bfe00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888142ff8c00 pfn:0x142ff8
head:ffffea00050bfe00 order:2 compound_mapcount:0 compound_pincount:0
flags: 0x57ff00000010200(slab|head|node=1|zone=2|lastcpupid=0x7ff)
raw: 057ff00000010200 ffffea000516f208 ffffea000516e708 ffff888017441c80
raw: ffff888142ff8c00 0000000000100005 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 8911692885, free_ts 0
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x173/0x1a0 mm/page_alloc.c:2532
 prep_new_page mm/page_alloc.c:2539 [inline]
 get_page_from_freelist+0x1a26/0x1ac0 mm/page_alloc.c:4328
 __alloc_pages+0x1df/0x4e0 mm/page_alloc.c:5606
 alloc_page_interleave+0x24/0x1e0 mm/mempolicy.c:2115
 alloc_slab_page+0x5d/0x160 mm/slub.c:1794
 allocate_slab mm/slub.c:1939 [inline]
 new_slab+0x87/0x2c0 mm/slub.c:1992
 ___slab_alloc+0xbc6/0x1220 mm/slub.c:3180
 __slab_alloc mm/slub.c:3279 [inline]
 slab_alloc_node mm/slub.c:3364 [inline]
 __kmem_cache_alloc_node+0x1a0/0x260 mm/slub.c:3437
 kmalloc_trace+0x26/0xe0 mm/slab_common.c:1026
 kmalloc include/linux/slab.h:563 [inline]
 kzalloc include/linux/slab.h:699 [inline]
 device_private_init drivers/base/core.c:3541 [inline]
 device_add+0xba/0xfb0 drivers/base/core.c:3591
 device_create_groups_vargs drivers/base/core.c:4391 [inline]
 device_create+0x258/0x2e0 drivers/base/core.c:4433
 bdi_register_va+0x9b/0x750 mm/backing-dev.c:877
 bdi_register+0xd1/0x120 mm/backing-dev.c:909
 device_add_disk+0x758/0x1020 block/genhd.c:513
 add_disk include/linux/blkdev.h:757 [inline]
 loop_add+0x6f2/0x9b0 drivers/block/loop.c:2071
 loop_init+0x173/0x226 drivers/block/loop.c:2263
page_owner free stack trace missing

Memory state around the buggy address:
 ffff888142ff8b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888142ff8b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888142ff8c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                     ^
 ffff888142ff8c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888142ff8d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================