BTRFS error (device loop1): open_ctree failed
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'.
==================================================================
BUG: KASAN: stack-out-of-bounds in deref_stack_regs arch/x86/kernel/unwind_orc.c:304 [inline]
BUG: KASAN: stack-out-of-bounds in unwind_next_frame+0x146f/0x17d0 arch/x86/kernel/unwind_orc.c:437
Read of size 8 at addr ffff888091dbfa48 by task syz-executor.3/21756

CPU: 1 PID: 21756 Comm: syz-executor.3 Not tainted 4.14.215-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x283 lib/dump_stack.c:58
 print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252
 kasan_report_error.cold+0x8a/0x194 mm/kasan/report.c:351
 kasan_report mm/kasan/report.c:409 [inline]
 __asan_report_load8_noabort+0x68/0x70 mm/kasan/report.c:430
 deref_stack_regs arch/x86/kernel/unwind_orc.c:304 [inline]
 unwind_next_frame+0x146f/0x17d0 arch/x86/kernel/unwind_orc.c:437
 perf_callchain_kernel+0x38c/0x520 arch/x86/events/core.c:2343
 get_perf_callchain+0x2de/0x740 kernel/events/callchain.c:217
 perf_callchain+0x147/0x190 kernel/events/callchain.c:190
 perf_prepare_sample+0xd77/0x1380 kernel/events/core.c:6164
 __perf_event_output kernel/events/core.c:6280 [inline]
 perf_event_output_forward+0xc9/0x1f0 kernel/events/core.c:6298
 __perf_event_overflow+0x113/0x310 kernel/events/core.c:7547
 perf_swevent_overflow kernel/events/core.c:7623 [inline]
 perf_swevent_event+0x3c8/0x460 kernel/events/core.c:7661
 perf_tp_event+0x540/0x6e0 kernel/events/core.c:8085
 perf_trace_run_bpf_submit+0x119/0x200 kernel/events/core.c:8055
 perf_trace_lock+0x2d6/0x490 include/trace/events/lock.h:39
 trace_lock_release include/trace/events/lock.h:58 [inline]
 lock_release+0x4df/0x870 kernel/locking/lockdep.c:4016
 __raw_spin_unlock include/linux/spinlock_api_smp.h:150 [inline]
 _raw_spin_unlock+0x17/0x40 kernel/locking/spinlock.c:184
 spin_unlock include/linux/spinlock.h:357 [inline]
 __find_get_block_slow fs/buffer.c:250 [inline]
 __find_get_block+0x65b/0xc40 fs/buffer.c:1357
 sb_find_get_block include/linux/buffer_head.h:346 [inline]
 recently_deleted fs/ext4/ialloc.c:693 [inline]
 find_inode_bit+0x1fb/0x4e0 fs/ext4/ialloc.c:733
 __ext4_new_inode+0x1379/0x4eb0 fs/ext4/ialloc.c:925
 ext4_create+0x244/0x520 fs/ext4/namei.c:2496
 vfs_create+0x3e3/0x620 fs/namei.c:2935
 SYSC_mknodat fs/namei.c:3804 [inline]
 SyS_mknodat+0x2f4/0x470 fs/namei.c:3781
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45e219
RSP: 002b:00007fb782072c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000085
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045e219
RDX: 0000000000000707 RSI: 0000000000000000 RDI: 0000000020000000
RBP: 000000000119bfc0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000119bf8c
R13: 00007ffd3205021f R14: 00007fb7820739c0 R15: 000000000119bf8c

The buggy address belongs to the page:
page:ffffea0002476fc0 count:0 mapcount:0 mapping:          (null) index:0x0
flags: 0xfff00000000000()
raw: 00fff00000000000 0000000000000000 0000000000000000 00000000ffffffff
raw: 0000000000000000 0000000100000001 0000000000000000 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888091dbf900: 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1
 ffff888091dbf980: f1 f1 f1 04 f2 00 f3 f3 f3 00 00 00 00 00 00 00
>ffff888091dbfa00: 00 00 00 f1 f1 f1 f1 04 f3 f3 f3 00 00 00 00 00
                                              ^
 ffff888091dbfa80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888091dbfb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================