==================================================================
BUG: KASAN: use-after-free in relay_switch_subbuf+0x8c0/0x930 kernel/relay.c:755
Read of size 8 at addr ffff88821a378658 by task ksoftirqd/1/16

CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 5.1.0-rc6+ #85
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 print_address_description.cold+0x7c/0x20d mm/kasan/report.c:187
 kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:132
 relay_switch_subbuf+0x8c0/0x930 kernel/relay.c:755
 relay_reserve include/linux/relay.h:261 [inline]
 trace_note.isra.0+0x5b8/0x6e0 kernel/trace/blktrace.c:93
 trace_note_tsk kernel/trace/blktrace.c:124 [inline]
 __blk_add_trace+0xb70/0xe10 kernel/trace/blktrace.c:264
 blk_add_trace_rq+0x185/0x1f0 kernel/trace/blktrace.c:819
 blk_add_trace_rq_complete+0x17a/0x1e0 kernel/trace/blktrace.c:848
 trace_block_rq_complete include/trace/events/block.h:116 [inline]
 blk_update_request+0x812/0xba0 block/blk-core.c:1434
 scsi_end_request+0x7f/0x850 drivers/scsi/scsi_lib.c:579
 scsi_io_completion+0x20a/0x1420 drivers/scsi/scsi_lib.c:964
 scsi_finish_command+0x3ba/0x670 drivers/scsi/scsi.c:232
 scsi_softirq_done+0x33b/0x3e0 drivers/scsi/scsi_lib.c:1464
 blk_done_softirq+0x304/0x4d0 block/blk-softirq.c:37
 __do_softirq+0x266/0x95a kernel/softirq.c:293
 run_ksoftirqd kernel/softirq.c:655 [inline]
 run_ksoftirqd+0x8e/0x110 kernel/softirq.c:647
 smpboot_thread_fn+0x6ab/0xa40 kernel/smpboot.c:164
 kthread+0x357/0x430 kernel/kthread.c:253
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352

Allocated by task 7826:
 save_stack+0x45/0xd0 mm/kasan/common.c:75
 set_track mm/kasan/common.c:87 [inline]
 __kasan_kmalloc mm/kasan/common.c:497 [inline]
 __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:470
 kasan_slab_alloc+0xf/0x20 mm/kasan/common.c:505
 slab_post_alloc_hook mm/slab.h:437 [inline]
 slab_alloc mm/slab.c:3393 [inline]
 kmem_cache_alloc+0x11a/0x6f0 mm/slab.c:3555
 sock_alloc_inode+0x1d/0x260 net/socket.c:244
 alloc_inode+0x66/0x190 fs/inode.c:210
 new_inode_pseudo+0x19/0xf0 fs/inode.c:903
 sock_alloc+0x41/0x270 net/socket.c:567
 __sock_create+0xc0/0x750 net/socket.c:1362
 sock_create net/socket.c:1449 [inline]
 __sys_socket+0x103/0x220 net/socket.c:1491
 __do_sys_socket net/socket.c:1500 [inline]
 __se_sys_socket net/socket.c:1498 [inline]
 __x64_sys_socket+0x73/0xb0 net/socket.c:1498
 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 7826:
 save_stack+0x45/0xd0 mm/kasan/common.c:75
 set_track mm/kasan/common.c:87 [inline]
 __kasan_slab_free+0x102/0x150 mm/kasan/common.c:459
 kasan_slab_free+0xe/0x10 mm/kasan/common.c:467
 __cache_free mm/slab.c:3499 [inline]
 kmem_cache_free+0x86/0x260 mm/slab.c:3765
 sock_destroy_inode+0x4f/0x60 net/socket.c:272
 destroy_inode+0xc5/0x130 fs/inode.c:267
 evict+0x431/0x680 fs/inode.c:575
 iput_final fs/inode.c:1547 [inline]
 iput+0x530/0x8d0 fs/inode.c:1573
 dentry_unlink_inode+0x2dc/0x400 fs/dcache.c:374
 __dentry_kill+0x390/0x610 fs/dcache.c:579
 dentry_kill+0xd7/0x5e0 fs/dcache.c:698
 dput+0x570/0x6a0 fs/dcache.c:859
 __fput+0x42f/0x8d0 fs/file_table.c:291
 ____fput+0x16/0x20 fs/file_table.c:309
 task_work_run+0x14a/0x1c0 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_usermode_loop+0x273/0x2c0 arch/x86/entry/common.c:166
 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
 do_syscall_64+0x52d/0x610 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff88821a378580
 which belongs to the cache sock_inode_cache(102:syz4) of size 976
The buggy address is located 216 bytes inside of
 976-byte region [ffff88821a378580, ffff88821a378950)
The buggy address belongs to the page:
page:ffffea000868de00 count:1 mapcount:0 mapping:ffff88808fbc5540 index:0xffff88821a378ffd
flags: 0x6fffc0000000200(slab)
raw: 06fffc0000000200 ffff888219bff358 ffffea0008572548 ffff88808fbc5540
raw: ffff88821a378ffd ffff88821a378100 0000000100000000 ffff88805b938740
page dumped because: kasan: bad access detected
page->mem_cgroup:ffff88805b938740

Memory state around the buggy address:
 ffff88821a378500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88821a378580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88821a378600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                    ^
 ffff88821a378680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88821a378700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================