EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue
ext4 filesystem being mounted at /root/syzkaller-testdir4104301062/syzkaller.O4LR2y/81/file0 supports timestamps until 2038 (0x7fffffff)
==================================================================
BUG: KASAN: use-after-free in ext4_rename_dir_prepare+0x42e/0x4a0 fs/ext4/namei.c:3704
Read of size 4 at addr ffff888118c27000 by task syz-executor.5/2259

CPU: 0 PID: 2259 Comm: syz-executor.5 Not tainted 5.10.161-syzkaller-00019-g416c4356f372 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118
 print_address_description+0x81/0x3c0 mm/kasan/report.c:233
 __kasan_report mm/kasan/report.c:419 [inline]
 kasan_report+0x1a4/0x1f0 mm/kasan/report.c:436
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308
 ext4_rename_dir_prepare+0x42e/0x4a0 fs/ext4/namei.c:3704
 ext4_cross_rename fs/ext4/namei.c:4212 [inline]
 ext4_rename2+0x1f37/0x45a0 fs/ext4/namei.c:4296
 vfs_rename+0x95e/0xde0 fs/namei.c:4389
 do_renameat2+0x83e/0x1190 fs/namei.c:4536
 __do_sys_renameat2 fs/namei.c:4571 [inline]
 __se_sys_renameat2 fs/namei.c:4568 [inline]
 __x64_sys_renameat2+0xbf/0xd0 fs/namei.c:4568
 do_syscall_64+0x34/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xc6
RIP: 0033:0x7fbf65a61169
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fbf647d4168 EFLAGS: 00000246 ORIG_RAX: 000000000000013c
RAX: ffffffffffffffda RBX: 00007fbf65b80f80 RCX: 00007fbf65a61169
RDX: 0000000000000004 RSI: 0000000020000080 RDI: 0000000000000005
RBP: 00007fbf65abcca1 R08: 0000000000000002 R09: 0000000000000000
R10: 00000000200000c0 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc00c2e52f R14: 00007fbf647d4300 R15: 0000000000022000

The buggy address belongs to the page:
page:ffffea00046309c0 refcount:0 mapcount:-128 mapping:0000000000000000 index:0x0 pfn:0x118c27
flags: 0x8000000000000000()
raw: 8000000000000000 ffffea0004537808 ffffea0004602708 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffff7f 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), pid 1223, ts 959582774886, free_ts 959608748457
 set_page_owner include/linux/page_owner.h:35 [inline]
 post_alloc_hook mm/page_alloc.c:2386 [inline]
 prep_new_page mm/page_alloc.c:2392 [inline]
 get_page_from_freelist+0x755/0x810 mm/page_alloc.c:4073
 __alloc_pages_nodemask+0x3b6/0x890 mm/page_alloc.c:5160
 __alloc_pages include/linux/gfp.h:529 [inline]
 __alloc_pages_node include/linux/gfp.h:542 [inline]
 alloc_pages_node include/linux/gfp.h:556 [inline]
 alloc_pages include/linux/gfp.h:575 [inline]
 __pte_alloc_one include/asm-generic/pgalloc.h:63 [inline]
 pte_alloc_one+0x1f/0xc0 arch/x86/mm/pgtable.c:33
 __pte_alloc+0x75/0x2b0 mm/memory.c:462
 copy_pte_range+0xe7b/0xf80 mm/memory.c:991
 copy_pmd_range mm/memory.c:1109 [inline]
 copy_pud_range mm/memory.c:1146 [inline]
 copy_p4d_range mm/memory.c:1170 [inline]
 copy_page_range+0xc2d/0x10a0 mm/memory.c:1243
 dup_mmap+0xab4/0xf60 kernel/fork.c:611
 dup_mm+0x91/0x320 kernel/fork.c:1412
 copy_mm+0x108/0x1b0 kernel/fork.c:1468
 copy_process+0x133a/0x33a0 kernel/fork.c:2152
 kernel_clone+0x22d/0x900 kernel/fork.c:2524
 __do_sys_clone kernel/fork.c:2643 [inline]
 __se_sys_clone kernel/fork.c:2627 [inline]
 __x64_sys_clone+0x271/0x2e0 kernel/fork.c:2627
 do_syscall_64+0x34/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xc6
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:28 [inline]
 free_pages_prepare mm/page_alloc.c:1332 [inline]
 free_pcp_prepare+0x18c/0x1c0 mm/page_alloc.c:1406
 free_unref_page_prepare mm/page_alloc.c:3293 [inline]
 free_unref_page_list+0x11d/0x660 mm/page_alloc.c:3367
 release_pages+0xc24/0xc60 mm/swap.c:1082
 free_pages_and_swap_cache+0x97/0xb0 mm/swap_state.c:356
 tlb_batch_pages_flush mm/mmu_gather.c:49 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:240 [inline]
 tlb_flush_mmu+0x8a0/0xa80 mm/mmu_gather.c:247
 tlb_finish_mmu+0xd2/0x1f0 mm/mmu_gather.c:326
 exit_mmap+0x319/0x5c0 mm/mmap.c:3343
 __mmput+0x95/0x2c0 kernel/fork.c:1133
 mmput+0x4b/0x50 kernel/fork.c:1154
 exit_mm+0x5cd/0x790 kernel/exit.c:489
 do_exit+0x5f2/0x2340 kernel/exit.c:800
 do_group_exit+0x13a/0x300 kernel/exit.c:910
 get_signal+0xe17/0x1440 kernel/signal.c:2780
 arch_do_signal+0x8e/0x650 arch/x86/kernel/signal.c:805
 exit_to_user_mode_loop+0xa3/0xe0 kernel/entry/common.c:161
 exit_to_user_mode_prepare kernel/entry/common.c:191 [inline]
 syscall_exit_to_user_mode+0x77/0xa0 kernel/entry/common.c:266

Memory state around the buggy address:
 ffff888118c26f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888118c26f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888118c27000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                   ^
 ffff888118c27080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888118c27100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================