==================================================================
BUG: KASAN: use-after-free in iov_iter_alignment+0x6a1/0x7b0 lib/iov_iter.c:1225
Read of size 4 at addr ffff8880a0023c54 by task loop0/14373

CPU: 0 PID: 14373 Comm: loop0 Not tainted 5.4.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fb/0x318 lib/dump_stack.c:118
 print_address_description+0x75/0x5c0 mm/kasan/report.c:374
 __kasan_report+0x14b/0x1c0 mm/kasan/report.c:506
 kasan_report+0x26/0x50 mm/kasan/common.c:634
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/generic_report.c:131
 iov_iter_alignment+0x6a1/0x7b0 lib/iov_iter.c:1225
 iomap_dio_bio_actor+0x1a7/0x11e0 fs/iomap/direct-io.c:203
 iomap_dio_actor+0x2b4/0x4a0 fs/iomap/direct-io.c:375
 iomap_apply+0x370/0x490 fs/iomap/apply.c:80
 iomap_dio_rw+0x8ad/0x1010 fs/iomap/direct-io.c:493
 ext4_dio_read_iter fs/ext4/file.c:77 [inline]
 ext4_file_read_iter+0x834/0xc20 fs/ext4/file.c:128
 lo_rw_aio+0xcbb/0xea0 include/linux/fs.h:1889
 do_req_filebacked drivers/block/loop.c:616 [inline]
 loop_handle_cmd drivers/block/loop.c:1952 [inline]
 loop_queue_work+0x13ab/0x2590 drivers/block/loop.c:1966
 kthread_worker_fn+0x449/0x700 kernel/kthread.c:671
 loop_kthread_worker_fn+0x40/0x60 drivers/block/loop.c:901
 kthread+0x332/0x350 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

Allocated by task 1026:
 save_stack mm/kasan/common.c:69 [inline]
 set_track mm/kasan/common.c:77 [inline]
 __kasan_kmalloc+0x11c/0x1b0 mm/kasan/common.c:510
 kasan_slab_alloc+0xf/0x20 mm/kasan/common.c:518
 slab_post_alloc_hook mm/slab.h:584 [inline]
 slab_alloc mm/slab.c:3319 [inline]
 kmem_cache_alloc+0x1f5/0x2e0 mm/slab.c:3483
 mempool_alloc_slab+0x4d/0x70 mm/mempool.c:513
 mempool_alloc+0x104/0x5e0 mm/mempool.c:393
 bio_alloc_bioset+0x1b0/0x5f0 block/bio.c:477
 bio_alloc include/linux/bio.h:400 [inline]
 submit_bh_wbc+0x1d5/0x700 fs/buffer.c:3107
 __block_write_full_page+0x943/0x1070 fs/buffer.c:1805
 block_write_full_page+0x1a4/0x220 include/linux/highmem.h:102
 blkdev_writepage+0x24/0x30 fs/block_dev.c:609
 __writepage+0x63/0xd0 mm/page-writeback.c:2303
 write_cache_pages+0x94a/0xe70 mm/page-writeback.c:2238
 generic_writepages+0x93/0xd0 mm/page-writeback.c:2329
 blkdev_writepages+0x1d/0x30 fs/block_dev.c:2060
 do_writepages+0xfb/0x1f0 mm/page-writeback.c:2344
 __writeback_single_inode+0xd6/0x620 fs/fs-writeback.c:1452
 writeback_sb_inodes+0x948/0x16c0 fs/fs-writeback.c:1716
 __writeback_inodes_wb+0x11e/0x350 fs/fs-writeback.c:1785
 wb_writeback+0x460/0x770 fs/fs-writeback.c:1894
 wb_check_old_data_flush fs/fs-writeback.c:1996 [inline]
 wb_do_writeback fs/fs-writeback.c:2049 [inline]
 wb_workfn+0xa22/0xfb0 fs/fs-writeback.c:2078
 process_one_work+0x7ef/0x10d0 kernel/workqueue.c:2264
 worker_thread+0xc01/0x1630 kernel/workqueue.c:2410
 kthread+0x332/0x350 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

Freed by task 13065:
 save_stack mm/kasan/common.c:69 [inline]
 set_track mm/kasan/common.c:77 [inline]
 kasan_set_free_info mm/kasan/common.c:332 [inline]
 __kasan_slab_free+0x12a/0x1e0 mm/kasan/common.c:471
 kasan_slab_free+0xe/0x10 mm/kasan/common.c:480
 __cache_free mm/slab.c:3425 [inline]
 kmem_cache_free+0x81/0xf0 mm/slab.c:3693
 mempool_free_slab+0x1d/0x30 mm/mempool.c:520
 mempool_free+0xd5/0x350 mm/mempool.c:502
 bio_put+0x38b/0x460 block/bio.c:255
 end_bio_bh_io_sync+0xbd/0x110 fs/buffer.c:3017
 bio_endio+0x4ff/0x570 block/bio.c:1818
 req_bio_endio block/blk-core.c:245 [inline]
 blk_update_request+0x438/0x10d0 block/blk-core.c:1464
 scsi_end_request+0x8c/0xa20 drivers/scsi/scsi_lib.c:579
 scsi_io_completion+0x17c/0x1b80 drivers/scsi/scsi_lib.c:963
 scsi_finish_command+0x3b3/0x560 drivers/scsi/scsi.c:228
 scsi_softirq_done+0x289/0x310 drivers/scsi/scsi_lib.c:1477
 blk_done_softirq+0x312/0x370 block/blk-softirq.c:37
 __do_softirq+0x333/0x7c4 arch/x86/include/asm/paravirt.h:762

The buggy address belongs to the object at ffff8880a0023c00
 which belongs to the cache bio-0 of size 192
The buggy address is located 84 bytes inside of
 192-byte region [ffff8880a0023c00, ffff8880a0023cc0)
The buggy address belongs to the page:
page:ffffea00028008c0 refcount:1 mapcount:0 mapping:ffff8880a78e8700 index:0xffff8880a0023900
raw: 00fffe0000000200 ffffea00028b4108 ffff8880a7536138 ffff8880a78e8700
raw: ffff8880a0023900 ffff8880a0023000 000000010000000e 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8880a0023b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8880a0023b80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
>ffff8880a0023c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                 ^
 ffff8880a0023c80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff8880a0023d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================